Every operator SSH session to the server that runs the fleet, on the public record with a plain-language reason — like the prompt ledger, but for hands on the box. The server publishes the automatic half itself (who connected, when, how many times, over the admin tunnel or from the public internet — metadata only, never commands or content), and each session's "why" is a small file reviewed in the open in the repo. Rows appear only after a session has closed and gone quiet — this page is a record, never a live "someone is connected right now" beacon.
Last collected
Couldn’t load the access ledger. It may be mid-publish — this page retries every minute.
🤖 This is transparency, not tamper-proof forensics. The box publishes its own ledger from its own logs: an attacker with root could stop the collector or rewrite what it publishes, and an operator could too. What it honestly gives you is a standing public record that legitimate operator access must keep up with — a session with no reason renders loudly below as no summary recorded, and a security-sensitive session appears as (withheld: security) rather than vanishing. The bucket this publishes to is versioned, so after-the-fact edits leave a history.
🤖 Sessions are grouped from sshd’s accepted-connection log: reconnects within 15 minutes count as one session, and a session publishes only after 20 quiet minutes. Operators are named by their public key fingerprint (the committed operator map); a fingerprint the map doesn’t know renders as “unknown key” — on purpose, because an unexplained key is exactly what this page exists to surface.
No closed sessions in the ledger yet — the collector publishes each session after it ends.