⚡

Autonomous Connector Reauth Control Plane LIVE DAEMON CONNECTED ROLE: ADMIN

Endpoints: https://reauth.corp.goog (GCLB 136.81.208.20 • cl/1013063873) • Cloud Run • ctkwok2:16068 • x20web • Architecture Doc
Interactive Metrics & Connector Lookup: Search for any connector right below to inspect its full configuration, live health, and playbooks, or click any KPI card, chart bar, or time-series point to filter the 299-connector fleet.

🔍 Search & Inspect Any Connector (Full Detail Lookup)

Type any connector name, CON-* row key, slug (e.g. slack, docusign, jira, google_drive, clarity_ai), collection ID, or auth method and press Enter or click a match

⚡ Latest Actions Performed by Reauth Engine & Control Plane

Live execution ledger of proactive/reactive worker dispatches, Zero-LOAS REST probes, 1P OTA grant refreshes, 3P capsule logins, and multi-layer situation diagnoses (Last sweep: —)
Timestamp (PT) Category & Mode Target / Connector Outcome Action Detail & Zero-LOAS / Worker Evidence Inspect / Re-Run

1. Fleet Health & ConnectorHub Verdict Distribution

Live health status across all 299 connectors in gement-connector-hub-953321.connector_hub — click any bar to filter
Live cspan + BigQuery
Workstream Tracker Status (Click to Filter):

2. Reauth Mechanism & Execution Substrate Breakdown

How each connector authenticates and which execution layer heals it (Healthy vs. Needs Attention)
Zero-LOAS + Capsule cpl

3. Proactive Refresh Horizon & Token TTL Policy

When scheduled proactive reauths fire next (at 80% of TTL) and ConnectorHub refresh policy breakdown
EWMA TTL Scheduler
ConnectorHub Token Refresh Policy Modes (Click to Filter):

4. System Health & Reauth Healing Time Series

Historical & live progression of Healthy vs. Failing connectors and reconsent/probe throughput across the 299-connector fleet — click any time point to filter
275 / 299 Healthy (92.0%) +200 Healed Since Oct 31
Time-Series Milestones & Activity Windows (Click Any Window to Filter Connectors):

Immediate Action & Reauth Queue (Reactive Failures & Proactive Due)

Connectors currently queued for healing or attention — click any button on the right to probe, mint TOTP, run 3P login, or inspect docs
Connector Queue Bucket & Reason Hub Verdict Auth Method & Mode Tracker Status Explicit Actions (Click to Run)

⚡ Full Reauth Action Ledger & Multi-Layer Situations

Complete chronological history of all actions performed by con-reauth-engine and con-reauth-ui across all 4 architecture layers
Timestamp (PT) Category & Mode Target / Connector Outcome Action Detail & Zero-LOAS / Worker Evidence Actor Inspect / Re-Run

Connector Fleet Explorer (All 299 Connectors)

Click any filter pill below, search by name/collection/project, or click the action buttons on any row to execute live operations
Showing: All 299 Connectors
Connector (`row_key`) Hub Verdict Auth & Policy Mode TTL & Next Refresh Latest Action Performed Target Substrate Tracker State Actions (Click Any Button)
Execution Substrate & Scheduler Controls: Click any option card below to choose where each engine layer runs, adjust timer intervals or dispatch caps, and click 💾 Save & Apply Configuration. Changes persist to reauth_engine_config.json and sync to cspan / BigQuery.

Where It Runs: Execution Substrates

Click an option card in each section to select the active execution environment
Hybrid Auto (Capsule → Host) Recommended
Runs headless Chrome inside isolated Cloudtop Capsule (cpl) first; falls back to host if Uplink proxy blocks the vendor domain.
Cloudtop Capsule Only (cpl)
Strictly sandboxes all 3P vendor browser logins inside windsurf_sandbox_roa / jetski-capsule-eval-aa capsules.
Host Workstation Only
Runs 3P vendor login directly on the host workstation with ECP proxy.
Zero-LOAS GCP ADC REST gcert-Safe
Uses permanent OAuth2 refresh token in application_default_credentials.json with quota project spark-assistant-test-ext.
Capsule-Routed REST Probe
Executes DiscoveryEngine REST health probes from inside the active Cloudtop Capsule.
Prod Borgcron #18 + On-Demand Heal
Shares daily 06:30 PT sobi_ota_grant_refresh (210 grants) and triggers local ProvisionAgentCredentials on 401.
Prod Borgcron #18 Only
Relies solely on the production Borgcron job without local 1P grant refresh.

How It Runs: Unattended Schedulers & Guardrails

Control the systemd timer, proactive TTL lead window, and queue dispatch toggles
Timer: active (waiting)
Systemd User Timer (con-reauth-engine.timer)
Next run: loading...
Set Timer Cadence:
Queue Dispatch Toggles (Click to Enable / Disable):

Where the Control Plane Is Hosted

Click any link below to open that hosting surface
4 Surfaces Active
1. Production .corp.goog Domain — https://reauth.corp.goog Open URL ↗
Global External HTTPS Load Balancer IP 136.81.208.20 (reauth-app-https-fwd-rule + mTLS reauth-app-mtls-policy in ge-sobi-ctkwok, UberProxy DNS in cl/1013063873).
2. Cloud Run Backend Service — con-reauth-ui-485166230064.us-central1.run.app Open Cloud Run ↗
Serverless container in ge-sobi-ctkwok (us-central1) with UberProxy P4SA service-485166230064@gcp-sa-uberproxy.iam.gserviceaccount.com granted roles/run.invoker.
3. Live Cloudtop Daemon — http://ctkwok2.c.googlers.com:16068/ Open Daemon ↗
Managed 24/7 by ~/.config/systemd/user/con-reauth-ui.service with direct local systemctl and Cloudtop Capsule cpl access.
4. Corp x20web Shared Bundle — https://x20web.corp.google.com/~ctkwok/con/control_plane.html Open x20web ↗
Corp SSO-authenticated static + live hybrid bundle in /google/data/rw/users/ct/ctkwok/con/control_plane.html.

Team Access Control (RBAC) & Shared State

Synced via cspan (projects/ge-sobi-evals/instances/sobi-lifecycle/databases/record) and BigQuery

CON-SLACK (slack)

Project 406418761334 • Collection • Skill
Live Connector Actions (Click to Execute):
Per-Connector Substrate & TTL Override:
Select an artifact tab above to inspect its contents.