Overview
Fleet health
Worst first. The reason is the heartbeat's own, not a guess.
Update drift by component
Posture
Recent activity
The newest audit entries. Denied and error first-class, not hidden.
Pick a car on the left.
It opens here, beside the list, so the fleet stays in view.
Car
Cellular radio
The head unit owns this model; a tick is written to the car and read back (rule 28).
A code works once: if you just used it (to sign in), wait for the next one.
One timing model, owned by the HU. Value = in force (measured); Stored = what was set. A blank Value means nothing can measure it now (rule 14).
A code works once: if you just used it, wait for the next one.
SMS wake centre — read only here
The number whose SMS the modem treats as the telematics centre, read back
from modem NV with AT+MBCNTCFG?. This is what wakes the car when it is parked.
There is no setting for it on this screen — the modem holds one entry, so
writing a new number retires the old one at once, and nothing here can tell a right number
from a wrong one. It is not unreachable: an admin can run
car-link -ask WAKECFG <number> from the Root tab, which
does exactly that write with no validation and no record — see the note below.
Reading this panel needs the admin role, because the read puts a command on
the car's modem AT channel.
Runs as root over car-link's recovery exec (the rule-29 sanctioned exception).
A code works once: if you just used it, wait for the next one.
car-link version is measured from the live session; the rest need a probe (a fixed read-only -version).
OTA & component versions
APK hosting
Hosting only — an upload changes no car, and nothing on this page installs it on one.
Operators
Who may use this plane. iam owns the list and decides every change: the owner invites admins and viewers, an admin invites viewers; nobody acts on themselves or on a higher rank. The owner is created only at the iam host.
Invite an operator
Create an operator and hand over a password
For when email is not configured. You choose the address; this plane generates one password for you to give them IN PERSON. It works ONCE and expires. At that sign-in they must set their own password and scan their own authenticator before the account becomes a live operator — until both are done it can open no session at all.
Known trade-off: you will know their first password, so in principle you could complete their setup yourself. An emailed invitation, offered when this deployment has mail, exists to make that impossible. The IP that finishes the setup is recorded.
Customers
A car owner's account. They have no account on this plane — everything they do is in the phone app — so this is the only place their account can be rescued. Every change asks for a reason and a fresh authenticator code, is recorded against your session, and the customer is emailed that it happened. iam decides each one and refuses the owner's main account, any operator's account and your own.
Rescue this account
The reason goes in the audit trail and iam refuses the change without one. Write what you actually did — "identified him by the VIN and the code on the car's screen" is a reason; "unlock" is not.
My account
Actuation PIN
The second credential every car write needs — link timing, the root
console, the version probe. 4 to 8 digits, not all the same and not a run
(1234 is refused); it is typed one-handed in a car park, so its strength is
the attempt limit, not its length. Costs your password and a fresh authenticator code,
because a PIN is the credential that opens the car. Any actuation token minted under a
previous PIN stops working.
Recovery codes
Regenerating retires every previous code. It costs your password and a fresh authenticator code.
Change password
Every session is signed out afterwards. If an administrator gave you your first password, change it now.
Operator audit
The plane's own actions. iam keeps its own trail for authentication and control tokens; the token id joins the two.