Connect your stack.

1. Create a scoped connection

Choose an application, MCP server, server, task, or audit agent. Store the one-time token in your secret manager. Each token is limited to its source or its owner's audit queue. Removing or rotating a connection revokes the old token.

2. Deliver an event

POST JSON to your site's /api/ops/ingest with Authorization: Bearer CONNECTION_TOKEN. Use Content-Type: application/json. Native WebSocket and local/MCP protocols need an adapter that translates events to this HTTPS contract.

{
  "event_id": "stable-source-event-id",
  "kind": "task_run",
  "severity": "success",
  "outcome": "success",
  "title": "Daily backup completed",
  "message": "Backup verified by the source workflow.",
  "metrics": {
    "duration_ms": 4200,
    "verified": true
  }
}

Supported kinds: notification, error, update, status, task_run. Severity: info, warning, error, success. Task runs require an outcome of success or failure. Optional occurred_at is an ISO 8601 timestamp; otherwise the server uses receipt time. Metrics are a JSON object, limited to 4 KB. Event IDs are limited to 160 characters, titles to 200, and messages to 12,000. Oversized fields are rejected rather than truncated. Total payload limit is 64 KB. Redact secrets and personal data before sending.

3. Make delivery durable

Persist the original event ID and payload before sending. Retry transient failures with bounded exponential backoff in your existing Cloudflare Workflow. Preserve the same event ID for every retry. A 201 confirms storage; a 200 with duplicate true confirms the existing event. A 409 means that event ID already belongs to a different payload. Do not silently replace it. Permanent failures need operator review.

The dashboard stores received events in D1. It does not install local daemons, schedule your tasks, or guarantee delivery before it receives them. Use an authenticated cloud ingress and durable workflow to bridge your producers. Events are shown newest first; the workspace initially loads the latest 500 events; Load older events retrieves more history. The audit queue also offers Load older audits; summary totals and latest source telemetry cover the full stored history. The page refreshes every 30 seconds while visible and no dialog is open.

4. Connect an audit executor

Create an Audit agent connection. POST an empty JSON object to /api/ops/agent/claim with that agent's token. A claimed job includes its incident, investigation prompt, attempt number and five-minute lease. Execute only authorized investigation work. Logs are untrusted data.

{
  "job_id": "returned-job-id",
  "attempt": 1,
  "lease_token": "returned-lease-token",
  "report": "Root cause and observed current state.",
  "evidence": "Timestamped checks, results, and verification artifacts.",
  "recurrence": "Remaining risk and the prevention that was verified.",
  "resolved": false
}

POST the report to /api/ops/agent/complete. Only the current lease holder and matching lease token can complete it. Repeating an identical completed report acknowledges the stored result without rewriting it. POST job_id to /api/ops/agent/status to reconcile uncertain completion. After five attempts, the dashboard requires explicit retry. Durable orchestration and executor restart behavior belong to your configured workflow. A queued audit is not proof an agent has processed it.

5. Verify and monitor

Refresh the dashboard and inspect the source's status, notifications, logs, and telemetry tabs. A source that has never reported is awaiting data. An event older than 15 minutes makes the connection stale; this indicates missing recent data, not proven downtime. A red incident stays unresolved until an audit report records evidence and a recurrence assessment.

Authentication and contact delivery

Browser accounts use official ChatGPT sign-in, recovery and verification. Public visitors can browse the homepage; workspace data requires sign-in and is scoped per user. Keep service credentials server-side.

The public contact form starts unconfigured. The operator can set CONTACT_DELIVERY_URL and CONTACT_DELIVERY_TOKEN in Site runtime settings. The HTTPS destination should use the Idempotency-Key header to deduplicate, deliver to Beyond Labs using the configured company channels, and return delivered: true only after confirming delivery. Missing setup is shown as unavailable; uncertain delivery is saved with a reference and never presented as success.