Skip to main content
Version: 2026.07.11

GRIFF Desktop Control Plane (DCP)

The Desktop Control Plane is the V1 product surface — the polished operator UI that runs and configures the whole platform (setup, install, config, management, user/admin) so nothing is hand-edited as .md/.json. It is a full R/W control plane, not a read-only dashboard.

Authority note. This page is the wiki's entry point for the DCP. The DCP build's definition-of-done docs (SBOM · RUNBOOK · DEV · USER) should be reconciled into a stable owner before public release; historical worktree paths are not active authority. This wiki page plus the Griff Docs MCP corpus are the searchable documentation surface.

Stack​

  • Electron 32 + React 18 + Vite (electron-vite), strict TypeScript, no Tailwind (a single design-system CSS, griffai-app.css).
  • Single-operator (charter D23 — NOT multi-tenant SaaS).
  • Zero native dependencies — the auth module uses node:crypto + Electron safeStorage only (no better-auth/better-sqlite3/argon2/otplib), so the build stays clean.

The 7-zone command rail​

ZonePurposeSurfaces (examples)
HomeTriagetoday · cockpit · workbench · work queue
OperateRunstatus · brain-connector · L1-L5 · observability · flags · alerts · sessions · usage · agent ledger · recovery
CoordinateRouteagent-direct · orchestrator · board · bootstrap
GovernControlgovernance (PEP) · MASTER ATC · approvals · replay · evidence · ID lineage · ops log · demo-lab · relational · bidirectional
ConfigureTuneProviders & Models · Settings · Packaging · Modules (full R/W config: atomic write + timestamped backup + receipt)
Setup/InstallStartfirst-run setup wizard · dependency checks
AdminManagelogin/MFA/recovery · profile circle · operator identity · provider presence · roles · approvals
  • a Source Library drawer (files · source index · master map · knowledge graph · mapping module · notes · plans · architecture · diagrams · artifacts · templates).

Architecture (one-direction data flow)​

main process read-models → risk-tiered IPC registry → preload contextBridge → renderer useIpc hook. The rail is data-driven from appShell/zones.ts (COMMAND_ZONES), filtered by isImplementedPageId() so only real, data-backed pages render — no placeholders. Reads are bounded by a pathPolicy allowlist (registered subroots only; never an E: scan). IPC actions are risk-tiered: read (open) · sensitive (operator confirm) · hard-gated (confirm + PIN + identity), e.g. Brain restart and MFA enroll/disable.

Embedded auth (Admin zone)​

A real single-operator login module: scrypt password (salt:hash, timing-safe, ≥12 chars), RFC-6238 TOTP MFA + single-use recovery codes (~80-bit, scrypt-hashed), optional configured-gated external OAuth providers (loopback PKCE), and a user-profile circle in the rail foot. Secrets live in the main process only; the renderer receives booleans/labels (the one-time enrollment ceremony is the only secret payload that crosses). At-rest store encrypted with the OS keychain via safeStorage.

Service operations surfaced in-app​

  • Config R/W (Configure zone) — replaces hand-editing; atomic temp-rename write + timestamped .bak + provenance receipt.
  • Brain restart (hard-gated) — runs the health-gated restart script; never a process kill (honors the codex-rc MCP/router freeze on :8787/:8788). See Reliable Service-Ops Tool.
  • Scheduled-task control (MASTER ATC) — enable/disable/run/stop GRIFF-* tasks, each with a receipt.
  • griff-map — live drive index via Brain /map/query (read-only, existing bearer).

Full build docs​

  • SBOM / RUNBOOK / DEV / USER → …/packages/dcp/docs/
  • Build receipts (this rebuild): 06_SESSION_EVIDENCE/receipts/dcp-phase1-7zone-ia-20260618, dcp-phase2-pages-20260618, dcp-phase5-6-auth-defects-20260618, dcp-phase7-audit-fixes-20260618 — each with file SHA256s + typecheck/build exit codes + screenshot pixel-proof.