Attention queue
Private operator access
Know what is hosted.
One Retehost-owned view of hosting inventory, customer accounts, hosting access grants, deployments, and security posture.
Fail-closed configuration
Admin access is unavailable.
The shared Supabase project is selected, but the Retehost-only control RPC has not been applied and verified. No private records were requested.
- Shared identity infrastructureRetehost, DRE, and other approved apps may use the same Supabase Auth project.
- Application authorityA shared login grants nothing here without an exact active Retehost operator membership.
- Retehost sandboxWaiting for the parameter-free snapshot RPC, operator enrollment, AAL2 tests, and source-parity proof.
- Email sign-inWaiting for the neutral shared magic-link template and exact Retehost PKCE redirect to be verified.
- Live systemProduction, DNS, users, and existing factors remain unchanged.
Identity · Step 1 of 2
Operator sign in.
Use the shared identity provisioned as the Retehost owner. The same identity may sign in to other portals, but a DRE, CFW, customer, or other app role does not grant Retehost access. Private hosting records remain closed until multi-factor verification is complete.
Identity · Step 2 of 2
Confirm it is you.
Enter the current six-digit code from your authenticator. Once this browser session is verified, it is remembered and reused without another code.
Need a new authenticator? Generate a QR code or manual setup key here. Verifying a replacement changes shared MFA state and can sign out other sessions using this identity once.
Operations overview
System posture.
A current view of hosted entities, customer identities, Retehost access grants, and deployment evidence.
Waiting for verified access
Secure loading
Loading authorized records.
AAL2 is confirmed. The portal is requesting one Retehost-scoped snapshot from the shared project.
Current posture
What needs attention.
Counts are calculated from the authorized projection loaded for this session.
Operating boundary
Observe here. Change elsewhere.
This browser can inspect RLS-authorized hosting records. Retehost is the authority for its accounts, access grants, deployment evidence, and operator security. Hosted applications retain their own software, users, data, and product licensing.
Hosted entities
Inventory.
No inventory matches this view.
Clear the search or choose another status filter.
Customer tenancy
Customer accounts.
Controlled provisioning
Accounts are invite-only.
No browser control creates users, memberships, or hosting access grants. Provision Retehost hosting access through an approved server-side workflow, then send the customer to the appropriate app-owned activation and recovery route when the hosted application requires one.
Open operator email sign-in- 01Verify the customer, agreement, account owner, requested Retehost service, and hosting access scope.
- 02Provision the identity and account membership through the approved admin channel.
- 03Grant only the required Retehost hosting entitlement and validity period; application authority stays with the hosted product.
- 04Send activation privately, test least privilege, and retain the approval record.
No accounts match this view.
Clear the search or choose another account status.
Hosting access
Access bindings.
No access bindings match this view.
Clear the search or choose another access status.
Access boundary
Security.
Identity, authorization, and release controls for this read-only surface.
Identity + AAL2
Shared Supabase authentication establishes identity. Exact Retehost membership and TOTP-backed AAL2 are both required before any private snapshot runs.
Retehost-only RPC
One parameter-free snapshot RPC reauthorizes the current session and exact Retehost scope. This interface carries no service-role credential and reads no raw table.
Read-only browser
No create, update, delete, entitlement, deployment, or revocation control is exposed here.
Release evidence
Operational changes require a scoped work order, preview validation, production evidence, and a known rewind target.
Current session
Verified operator context.
Use the approved Retehost server-side process to invite an operator, change a membership, grant or revoke hosting access, record approval evidence, or revoke host sessions. This control plane does not issue permissions or licenses inside hosted applications. Do not share credentials or place access tokens in work orders.