Themis (the activity)
No authorization step. Themis reads a server through the session Vigia already has; nothing is set up on a box first, and asking writes nothing there. A report from a server's own Themis screen is kept on it — in /var/lib/lens/reports, twenty of each kind — and Delete Reports on that screen removes them and nothing else; the rest of /var/lib/lens belongs to other features. That screen is in Tools on every server.
Ask Themis. First in the chair's menu: a question about the servers picked in the column on the right — the same pick as Actions, Snippets, Flows and Overview. She reads each one and answers once for all of them, naming the server in every finding. Servers without a shell are opened first in one batch behind a box that counts them in; the question waits until every one is up or has given up, and one left out is named. A server that cannot be read as root is read as its login user, and she is told so. Save as Group, under the servers, keeps the pick.
Groups. Servers asked about together, drawn from anywhere on the map, with the words Themis is given before every question: What it is and What matters. Made in a side sheet — the map with a box per server and per group, a search, All / None — from New Group at the foot of the chair's menu, or from Save as Group. A group's page is its own conversation, with Edit, Change Servers… and Delete, which asks first and leaves the servers as they are.
Proposals. She proposes, never changes. One at a time, each with Run / Show me / No: the row says in words what Run does and why, Show me prints the exact script, and in a group the line names its server — a name that matches none is refused, not guessed. Run goes through the flow runner's own executor, as root, with a ledger line on the box.
The model she thinks with. Set per account under Setup › Themis AI: the provider (Anthropic, OpenAI, xAI, or Local — anything that speaks the OpenAI chat API), the model, whose account pays (the API key kept encrypted, sent nowhere but that provider), the answer length, and how many steps before she answers with what she has. The model is its API name, typed exactly as the provider spells it and sent through unchanged; nothing is looked up — a list is wrong three months after a build, and fetching one would be a call to LockFlare, which Vigia never makes.