Manager Help

English

简体中文

English

简体中文

Appearance

Back to Console ↗

Fleet Exec ​

Fleet Exec is fleet-level remote command orchestration: pick a batch of devices, dispatch by command template, and collect results and audit centrally.

Flow ​

Fleet execution preview, approval, dispatch, and reconciliation

  1. Choose a command template (which constrains the executable command shape).
  2. Select target devices or device groups.
  3. Manager performs a zero-execution preview: every device is classified as executable, denied, blocked, or unsupported, and its plan plus classification are sealed in the database. A dry run stops here and has no execution path by construction.
  4. The operator approves the sealed preview; high-risk guardrails may require a second approver. Approval is bound to the preview generation and guardrail revision, so it cannot authorize a plan that has changed.
  5. The Manager instance holding the target signaling connection dispatches the plan. The host Daemon re-validates authorization, template, fingerprint, and risk ceiling; the Worker receives only the frozen program and argv.
  6. Manager aggregates structured results and audit. On timeout it queries the host's durable execution ledger; a genuinely unknown mutation is held for human review rather than mislabeled as an ordinary failure.

Decision vs Execution ​

Manager is the policy decision point (PDP), responsible for preview, approval, and sealing each device plan. The host Daemon is the policy enforcement point (PEP) and independently re-validates before handing work to the Worker. The edge therefore does not blindly trust a command merely because it came from the center—even across Manager instances.

Safety Constraints ​

  • Executable commands are constrained by command templates and AI policies — nothing runs freely.
  • The Fleet PEP always rejects free-form commands. The per-command owner exception on an owner's own device belongs only to interactive diagnosis and never expands Fleet authority.
  • Dispatch intent is persisted before the network send and deduplicated by execution generation; reconnect/retry logic never treats a possibly executed mutation as definitely not run.
  • Every execution enters AI Audit for traceability.