KyPulse

Supported cryptographic configuration and upgrades: Key strength and TLS.

Start here: Standalone installation. Local operator sign-in works without KyIdentity; the first admin password is written to initial-admin-password in the data directory, never to the log. Add health endpoints to monitor any compatible service; KyYard integration is optional for container information and log collection. Alerts require a configured, reachable webhook.

Unified health and logging for the Busnes.app Ky suite. KyPulse polls every Ky app's /healthz, reads container state from KyYard, shows what is broken first, and sends an outbound webhook when an app goes down or degrades. It is read-only towards the apps it watches: it observes and reports, and never changes them.

Design: docs/superpowers/specs/2026-09-26-kypulse-design.md.

What works today

Area	State
Health polling, alert state machine, webhook alerts	done
Status, Alerts, app detail, alert bar, webhook form	done
KyYard pairing, container facts, stale marking	done
KyPulse's own tamper-evident audit trail	done
Source pairing, log ingest, admin log and activity APIs, retention	done
kypulse-send Linux sender	done
Admin Logs/Activity screens and KyYard log/audit collection	done; audit requires the KyYard cursor API

Screens

• Alert bar, on every page. Red with one line per down or degraded app; green with the healthy count and the last check; a separate line when webhook delivery keeps failing or KyYard data is stale.
• Status, the home tab. Every watched app as a tile, broken first. Admins add apps here.
• Alerts. State changes and hourly reminders with their delivery result, and current silences.
• App detail (#/apps/<id>, the link webhook messages carry). Current state with the exact failing request, the checks from the last response, alert history, KyYard container facts, and, for admins, silence (1 h, 8 h, until fixed), edit and delete.
• Logs (admins). Filtered log timeline, raw text, source pairing/revocation and collection status.
• Activity (admins). Imported audit events, filters, failed-sign-in burst hints and collection status.
• Settings. Two-factor authentication for local accounts, the alert webhook, KyYard pairing/collector ages (admins), theme, database driver.
• Backup (admins). KyRecovery pairing, schedule, local copies, restore drill.

Roles are admin and viewer. A viewer sees Status, Alerts, app detail and a read-only Settings; every write and Backup are admin-only, and the server enforces it. Collected Logs and imported Activity, including app-detail log queries, are admin-only.

License

See LICENSE.txt.

Container-local installer setup and its current acceptance limits are documented in installer setup.

Documentation

• Running — Quick start.
• Log collection — Sending logs.
• Monitoring — Watching apps, Alert webhook, KyYard.
• Configuration — Configuration, Compose overlays.
• Operations — Backup and restore, Command line.
• Development — API, Develop.
• Verifying releases — Check a release image's signature and source commit, and rebuild its binary to the same bytes.
• Assurance case — Threat model, trust boundaries, and why the security requirements are met.