Your platform spends real money building software autonomously. This is the operator's cockpit: the Grafana dashboards that show where every dollar goes, the forms that steer the fleet live, and the two Forgejo issues that tell you how it's going without opening a single graph.

Where the meters live

Open https://grafana.espoautos.com and sign in with the Forgejo OAuth button. Members of the plat org get the Grafana Admin role; everyone else signs in as a Viewer. Four dashboards live in the Platform folder, and Prometheus keeps 60 days of history behind them — the platform's durable spend record.

Dashboard	What it tells you	The lever it maps to
Fleet — Allocation & Burn	Hourly burn by org, 24h spend by org, in-flight runs vs per-org limit, flow holds by reason, live org allocations (including who's paused)	The Set flow and Fleet governor forms on this same board
Flow Dams & Compute	"The dams — where work is held/wasted", run success rate, setup-failure rate, cost truthfulness (% measured), and the three governor gauges: session-window, weekly-budget, burst-brake spend vs share	Governor sizing — whether your caps bind before the provider does
Dispatcher & Provider Health	Provider backoff (seconds remaining), freezers, global runner slots executing vs queued	Global concurrency; clearing a provider backoff
Runs & Repos	Runs per hour by role, run outcomes, top repos by 24h spend, mean duration and cost per run	Where your attention (and budget) should go next

Steer from the dashboard

The "Set flow — $org" panel on Fleet — Allocation & Burn is a Business Forms panel: it doesn't just read, it POSTs a live flow override for the selected org.

Field	What it does
daily cap $	Emergency budget lid over 24h
ceiling $/h	Soft hourly pacing ceiling — holds new work, self-heals when the window rolls
max runs	Max concurrent runs for the org — the steady-state pacer (spend falls out of concurrency x cost x time)
min gap ms	Minimum gap between run starts
breaker $	Emergency stop: org spend in 15 min above this trips a 20 min zero-dispatch cooldown — size it to ~half the hourly ceiling
pause	Holds NEW work for the org; finishing reviewers still ship what's already built

Two behaviors worth trusting: the form pre-fills from the org's current effective values, and blank fields are omitted from the payload — blank means keep, so nothing gets zeroed by accident. Submit, and the "Live — $org" readback row updates within one scrape (~30s); the dispatcher honors the override at its next dispatch decision. A DELETE clears the whole org override, reverting to the env base in gitops.

Being signed into Grafana IS the credential. The forms POST same-origin to /flow-api, where a traefik forwardAuth middleware asks Grafana whether your session cookie is valid before the request ever reaches the dispatcher. No session, 401 — no extra token to manage.

The "Fleet governor" panel works the same way for the fleet-wide knobs — hourly / session / weekly $ — and its DELETE reverts to the env base.

Dams and gauges

Flow control is one idea: a rolling-window USD spend ledger, consulted every time a run would start. Each check is a dam; every held item is metered by reason, which is exactly what the "dams" panel stacks. Per org, in order: breaker (tight-window kill switch, then cooldown) → pause → concurrency → daily cap → ceiling → minimum gap. One deliberate bypass: a finishing reviewer — shipping already-built, CI-green work — skips every gate, because stranding a built PR unreviewed wastes the money already spent.

Above the org gates sits the global governor: fleet-wide dollar shares of your one Anthropic subscription, shortest window first — session $ over a 5-hour window (the provider's real-time wall), weekly $ over 7 days (endurance), hourly $ (burst brake). This is the point of the whole system: spend is paced to your subscription, not to the crew's appetite. The tuning doctrine is built in: raise a knob until global-* holds stay near zero and provider backoff trips start appearing — then back off ~20%. The governor should bind strictly before the provider does.

Provider backoff is the other breaker: three consecutive fast startup failures (the credential/usage-limit signature) pause the whole crew with exponential backoff, 5m→60m; any healthy run clears it. You'll see it counting down on Dispatcher & Provider Health.

The fleet issue and the episode log

You don't need a graph to know how the fleet is doing. The 🛰 Fleet status issue (by default plat/fleet#1; location set by FLEET_REPO/FLEET_ISSUE) is a self-updating table — Org, Health, Episode, Progress bar, Backlog, In-flight, 24h spend — refreshed in place every few hours, with a glyph legend: 🟢 working / ⏳ queued / ⚠️ stalled / ⏸ paused / 🔴 breaker / 🔌 provider backoff / ⚪ idle. Banner lines appear when provider backoff or a global pause is active. The same snapshot is served as JSON at the dispatcher's GET /fleet.

The episode log (plat/fleet#2 by default) is the narrative feed: when every issue in a repo's open milestone closes, the dispatcher closes the milestone and posts one digest — ✅ <org>/<repo> / <milestone> — episode complete, with issues shipped and real agent-compute time logged via Forgejo's native time tracker. How milestones become episodes is covered in Orgs and Planning; what an individual issue's lifecycle looks like is in Building with Issues.

Without Grafana

Every platform ships this surface from birth: germinate seals a fresh Grafana admin password (printed on your YOUR PLATFORM card), registers a sovereign "Sign in with Forgejo" OAuth client, and the dashboards arrive with the seed. The fleet issue and the flow API work everywhere too. The dispatcher's operator API covers every lever above: GET /fleet, GET/POST/DELETE /flow/:org, DELETE /flow/:org/cooldown, POST/DELETE /pause (global pause; finishing reviewers still ship), GET/POST/DELETE /governor, DELETE /provider/backoff. Requests are HMAC-signed with WEBHOOK_SECRET; the plat-flow CLI signs from inside the cluster so the secret never leaves it — plat-flow fleet | get <org> | set <org> '<json>' | pause | resume | clear-backoff. Endpoint and metric tables live in Reference.