The doctrine every feature follows
Air-gapped console. Vigia is a desktop app for macOS (Intel and Apple Silicon) and Windows. It talks to servers over the operator's own SSH logins, and otherwise only to what the operator names — a repository, the AI provider Themis thinks with. LockFlare runs no service Vigia depends on: slots are signed keys opened on the computer, the key is the identity — on the computer, behind a password — and the only server-side infrastructure LockFlare keeps is the issuer of those keys. Nothing Vigia does phones home — there is no list it fetches, not even from a button; the model Themis thinks with is a name typed under Setup.
Nothing installed on the box. Every reading is a command over the session already open; every change is a script run as root through the same sudo path. There is no agent, no daemon, no port opened for Vigia. What must run while Vigia is closed is a file Vigia writes on the box — a cron line, a systemd unit, a hook — never a Vigia process. Vigia is a configuration tool that acts when the operator opens it, not an alerting system.
Every job runs detached on the box. Long work (installs, restores, upgrades, data moves, cluster builds) is started detached on the box, in its own folder under /var/lib/lens/jobs, and survives Vigia closing. The screen shows one lightbox listing the job's own steps with Stop; blocking jobs keep it up, others offer "Keep working". Multi-box jobs read the whole board first — shells, root, tools, room — and show what is in the way with the fix beside each line; nothing writes until the list is empty.
Proved before kept. Changes that can lock the operator out (sshd hardening, a network address, a bridge) arm a revert first and are kept only after a fresh login or reachability check succeeds; otherwise the previous file comes back and the screen says "reverted". Firewall rules never remove the operator's own SSH cover; the SSH port is allowed before the firewall is turned on and cannot be denied.
Being logged in is the authentication. No Touch ID per action. Root is the saved login's password through sudo, sealed under your key and asked once if missing. Touch ID or Windows Hello is asked only to unlock Vigia and before the actions that are hard to undo (uninstall, wipe, the encrypted backup's folder and restores), where Go asks a second time so no screen can skip it; with the sensor turned off under Setup › Accessing Vigia, the password is asked there instead.
Consistency of the frame. Every screen wears the same head: a state band that says the verdict in one line, tabs, findings worst-first with the fix on the row, a row that opens into the thing's own page, quiet background re-reads that never disturb an open form, and a job console with live output wherever something runs for minutes.