Part II

Using FrontierStack Mobile

The five tabs you live in day to day — Fleet, Operations, Shell, the AI Administrator, and everything else under More.

Chapter 5

Using the App: Fleet, Operations, Shell & AI

Once your phone is paired, the app is a secure incident companion and remote for the desktop. This chapter walks through the five tabs — what each shows, what still works offline, and what it lets you do.

FrontierStack for iPhone and iPad is a secure incident companion and remote for FrontierStack on your Mac. Its main screen has five tabs — Fleet, Operations, Shell, AI and More. Most fresh observations and controls come from the Mac over the signed connection created at pairing, while a small, clearly labelled set of phone-originated health and recovery features remains useful when that connection is unavailable. This chapter covers all five; Settings and the lock screen are in the next chapter, and pairing itself is in Pairing your device.

Two ideas run through every tab. First, observation sources stay distinct: cached Mac data shows its age, and a check made now by the phone does not masquerade as full service health. Second, what you are allowed to do depends on this device's permission level, which you set on the Mac — and the most powerful things (a raw shell, direct SSH, or letting the AI make changes) need extra grants, described where they come up.

5.1Fleet — your servers and devices

The Fleet tab is home. At the top, Phone & Fleet keeps two independent facts apart: the route this phone is using to reach the Mac, and the Fleet site the Mac currently uses to scope monitoring and devices. Below it are two groups: your servers and your pinned devices.

The Servers section lists every pinned server — the local Mac is just the first row, so you drive it exactly like any other. Each row carries a status dot:

Dot	Meaning
Green	Up — reachable and healthy.
Amber triangle	Degraded — reachable but something needs attention.
Red	Down — the Mac can't reach it right now.
Hollow	Unknown — not yet probed.

Tap a server to open it. Its detail screen gives you the same host-level controls as the desktop:

Check server reachability — contact the saved SSH port and up to eight standard ports implied by services FrontierStack already detected, straight from this phone. A connection proves reachability, not complete service health.
Services — start, stop, restart or reload each detected service.
Reboot a remote Unix or Windows server, Run Diagnostics (a plain-language "what's wrong right now") and View Logs. Reboot reports success only after the server or its enrolled monitor accepts it.
Open Web UI in the built-in browser, and Open Shell (jumps to a shell bound to this server).
Remote Tools — ping, traceroute, listening ports, a web check and a log tail, run on the server itself.
Terminal Sessions — list tmux, GNU screen and Zellij sessions without reading their contents; attach over Direct SSH, or end one session after confirmation.
Fleet Run — read-only checks for pending reboot, disk usage, or uptime/load across every server (see More, below).
Full status details — OS, uptime, CPU, memory, every reported address, service state and SSH identity evidence in one diagnostic view.
Performance & history — current CPU, memory, disk, load and uptime followed by six hours to one week of helper-recorded history, learned-baseline assessment, reboot markers and watchdog events.
Database Emergency & Power Prep — graduated database actions that use the database protocol when SSH is unavailable, including clean shutdown before a reboot or hard power cut.

5.5.1Performance & history

The phone combines current performance and Behaviour & History because they answer one question on call: is this machine behaving normally? Choose a six-hour, one-day, three-day or one-week window. FrontierStack shows whether it is still learning the baseline, behaving normally for this server, or reporting a specific unusual change. Reboots and watchdog incidents appear on the same timeline so a spike has context.

NoteHistory is recorded by the monitoring helper on the server, so collection can continue while the Mac sleeps or is offline. Reading fresh history in the app still requires the Mac connection. A server without the helper shows that no history is available rather than drawing an empty graph.

5.5.2Database Emergency & Power Prep

When a database connection pool is exhausted, SSH can fail at the same time. Emergency actions therefore ask the Mac to reach the database over its own client protocol and port. The steps progress from killing stuck connections, through stopping writes and flushing, to a clean database shutdown. A clean shutdown prepares the server for a safer reboot or power cut; stopping the database always requires confirmation.

SecurityEmergency operations still require the paired Mac to be reachable, unlocked and holding the configured database credentials. Those credentials never move to the phone. Starting a stopped database requires SSH because a database cannot start itself through its own client protocol.

Below the servers, your pinned devices appear in collapsible sections by kind — routers, switches, printers, NAS, smart-home and so on — each with an online/offline dot and a menu to open its web UI, check its status, or power-cycle it (where a plug or KVM is linked on the Mac).

screenshot to be added

Figure 5.1. The Fleet tab: one compact Phone & Fleet row, a Servers list with the Mac first and a status dot on each row, and collapsible device sections below.Capture: capture: Fleet tab connected, Phone & Fleet as one row, two or three servers each with a green/amber dot, one device group expanded

NoteFleet preserves the last signed snapshot when the Mac is unavailable and labels its age instead of presenting it as live. Use Check server reachability for a separate observation made now from this phone; it does not overwrite the Mac's service-health result.

5.2Operations — the Mac's health and recovery evidence

The Operations tab begins with the live connection state and a refresh button, then gathers the Mac's operational summary rather than merely listing services. Overview shows server count, App Lock state, MCP state, open issues and whether remote changes are currently authorised. Restore readiness shows the latest bounded restore checks, encrypted recovery-copy evidence and representative-workload rehearsal without exposing backup paths, contents, accounts or credentials.

When FrontierStack has evidence for them, Likely upstream causes points to a confirmed dependency worth investigating first, and Server behaviour reports privacy-reduced anomalies learned from local history. These are diagnostic hints, not proof of causation. The final Services section shows the Mac's controllable local services and offers Start or Stop with authority checks and confirmation where appropriate.

This app is independent of the Mac's sidebar. Whatever you have hidden there to keep the desktop tidy remains reachable on the phone. Nothing on the phone changes the Mac's visual sidebar, and a cosmetic desktop preference cannot hide an operational item during an incident.

NoteEarlier versions let the phone edit the Mac's sidebar. That was removed: it made the phone's usefulness depend on a cosmetic desktop preference, which is exactly the wrong coupling when you are away from the Mac and something is down.

5.3Shell — a real command line

The Shell tab opens a command-line on the Mac or any linked server. Pick the target from the bar at the top — This Mac or any server — then type commands and read their output. Servers log in automatically using the key and credentials already stored on your Mac; a sudo command uses the server's saved sudo password. None of those credentials ever travel to your phone — the Mac runs the command and streams the output back.

Under More → Scripts you'll find your saved scripts and the built-in maintenance presets, synced from the Mac; tap one to run it and watch the output stream in.

Direct SSH — when the Mac is offline. The shell above is routed through the Mac. On a server's page you can also tap Enable direct SSH (while the Mac is online) to install this device's own SSH key on that server; after that, SSH (direct) opens a real terminal straight from the phone to the server — even when the Mac is offline or on another network — as long as you can reach the server's network (same Wi-Fi or over Tailscale). The phone's SSH key is generated on and never leaves the phone, and the Mac's own key and passwords are never copied to it. Revoking or unpairing the device removes its key from your servers.

SecurityThe shell is the most powerful thing the app can do, so it is gated tightly. This device must be at Full control with "Allow remote shell" switched on for it in the Mac's Paired Devices pane, the Mac must be unlocked, and every request is signed. Without that explicit grant the shell stays off — "Full control" alone is not enough.

NoteThe shell is line-oriented with a working directory that persists across commands (so cd sticks). It runs ordinary commands and scripts; full-screen terminal programs like top or vim aren't supported.

5.4AI — chat with the Administrator

The AI tab is a multi-turn conversation with the same AI Administrator that runs on your Mac. Ask about your servers, services or devices in plain language; as it works it shows the tools it runs and their results inline, so you can see how it reached an answer.

The current AI conversation is Mac-backed. If the Mac cannot be reached, cached health and direct checks remain available elsewhere in the app, but the phone does not send your infrastructure snapshot or credentials to a separate AI service and does not pretend that an offline answer is live.

By default the assistant is read-only — it can look but not change. Switch on "Allow changes" (top-right) to let it act: restart a service, flush DNS, and so on. The conversation history — including any tool results, which can contain secrets — stays on the Mac; your phone only sees the rendered replies. Everything the AI does here still runs on the Mac and obeys the same guards as on the desktop; a chat from the phone can be turned off entirely per device with the Mac's Allow AI Administrator switch, and it always requires the app unlocked and this device signed. Conversations you have from the phone are saved into the Mac's AI Administrator history, so you can pick them back up there.

NoteIf a change is refused with “needs approval”. By default FrontierStack asks you to confirm each external change in the app on the Mac — which you obviously can't do while holding the phone. Approve this device once instead: on the Mac, Paired Devices ▸ your device ▸ “Allow AI changes without asking me here”. That waives only the confirmation prompt: the device still needs a permission level that allows tools, the Mac still has to be unlocked, Allow changes still has to be on for that conversation, and if you require a password for external changes that is still enforced.

A green shield to the left of each reply means the answer was protected: before anything left your Mac for the AI model, FrontierStack scrubbed secrets (keys, tokens, passwords) from the tool results — tap the shield to read what that means. You can select and copy both your questions and the replies (press and hold, or use the Copy action) to paste an answer elsewhere. And when you have a server selected, the assistant answers about that machine — the query still runs on your Mac, but "how long has it been up?" or "what's listening?" is scoped to the device you picked, not the Mac.

screenshot to be added

Figure 5.2. The AI tab mid-conversation: a question, the assistant's reply with a green protection shield beside it, and an inline "ran read_logs" tool line, with the Allow changes toggle in the top-right.Capture: capture: AI chat showing one exchange with the green shield, a visible tool action and the Allow changes toggle

5.5More — alerts, locations and the rest

The More tab gathers everything that doesn't need its own tab.

5.5.3Agent Activity

Agent Activity is the phone's status-only view of work known to the paired Mac. It groups running coding-agent processes, FrontierStack sessions and jobs, configured runtimes, and detected worker boxes into Needs You, Running, Recently Finished, and Ready. Tap an item with a host to inspect that host's durable terminal sessions.

SecurityAgent Activity never sends prompts, command lines, transcripts, environment variables, terminal contents, or credentials to the phone. Listing and ending terminal sessions require the paired Mac. A full-screen attach is offered only when Direct SSH has installed this phone's key and the saved server identity matches.

5.5.4Queue Operations

Queue Operations mirrors the Mac's read-only queue dashboard. Pull to refresh health for RabbitMQ, Kafka, NATS/JetStream, Redpanda, AWS SQS, Azure Service Bus, Google Pub/Sub, Celery, Redis Streams, Pulsar and RocketMQ. It shows backlog, consumers, lag and dead-letter totals without downloading message bodies. Configure credentials and thresholds on the Mac; the phone receives only the signed, sanitised health summary.

5.5.5Queued Actions

When the Mac is offline, eligible service menus say Queue Start, Queue Stop, Queue Restart or Queue Reload. The request stays on this phone and does not run automatically. Open More → Queued Actions to inspect the exact target and expiry, swipe to cancel anything you no longer want, then explicitly send the remaining actions after the Mac returns. Each request expires after four hours and the Mac rechecks its signature, permission and App Lock before executing it once.

NoteThe queue accepts only named service operations. Scripts, shell commands, reboots, fleet runs, device power and access changes cannot be queued.

5.5.6Alerts

Alerts is the inbox of server alerts — a service down, a disk filling, a certificate expiring — raised by the Mac and its agents. Tap Enable push notifications so they reach you even when the app is closed. Push needs the Mac (or its relay) online to send.

SecurityYour phone never registers itself with the push server directly. When you enable notifications it hands its push token to the paired Mac over the signed connection; the Mac signs the registration with the key from its active licence and registers it for you. So revoking the phone on the Mac — or unpairing here — also stops its push notifications, even while the phone is offline.

5.5.7Checks — watchdogs and a maintenance pause

Checks is the manager for the Mac's Service Guardian: every service being guarded, whether each is healthy, and which have Keep Alive or Auto Recover switched on. It is the phone-side view of the pane described in Chapter 11 of the desktop manual.

Its useful trick is the pause. Before working on a machine, pause all checks — or just one service — for anything from 15 minutes to a day. While paused, the Mac stops health-checking and stops restarting that service, so your maintenance doesn't fight the watchdog or set off alerts.

Disk repair is protected automatically: while Disk Utility First Aid or a filesystem repair tool is running, automatic recovery pauses without changing its settings. Maintenance-timeout counters are cleared, and recovery waits 60 seconds after repair finishes before starting fresh. The Checks screen shows this safety hold.

TipPausing is deliberately not the same as switching a watchdog off. Nothing is disabled and no setting is lost: the check resumes by itself, exactly as configured, when the window ends. You can also resume early. That is the whole point — you cannot forget to turn protection back on.

5.5.8Phone connection & Fleet sites

The Fleet tab keeps this compact: one Phone & Fleet row shows the active Fleet site and opens the detailed Phone & Fleet Sites screen. That screen separates three things that the old “Location” label could make look like one: how this iPhone reaches the Mac, the site the Mac matches from its own network, and the Fleet site currently used to scope monitoring and devices. The phone's physical position and network do not select the Fleet site.

Choose Follow Mac's detected site to let the Fleet context follow the Mac. Pin another Fleet site when you deliberately want to view or operate that site's context. Pinning does not change the phone's route to the Mac and does not make a remote private network reachable; opening devices at that site still needs an existing route such as Tailscale or a VPN.

5.5.9Fleet Run, Shared & web UIs

Fleet Run offers reviewed, fleet-wide read-only checks for pending reboots, disk usage, and uptime/load, then shows per-host results. Package updates, Git pulls, service restarts, installs and custom commands remain in the Mac's staged operator-review flow. Shared lists the temporary Debug Shares the Mac has opened, which you can open or stop; opening a new one needs Full control and the Mac's external-change policy. Web UIs & Bookmarks opens the admin pages of routers, NAS and cameras, plus addresses bookmarked on the phone. Local self-signed sites require explicit fingerprint trust; public sites require normally trusted HTTPS.

Note"Reachable" means your phone is on the device's network — true on the same Wi-Fi, and often true away from home over Tailscale (for example through a subnet router). For a local, private or Tailscale site with a self-signed certificate, verify and approve its SHA-256 fingerprint on first use; a later change is blocked. Public sites must pass normal iOS certificate validation.

5.5.10The manual on the phone

More → Manual opens this book from the app bundle. It works without the Mac or a network connection, and its search runs on the phone. The manual is also available from the pairing screen, which is useful when the connection itself is what you need to troubleshoot.

Finally, More holds Settings and Help — covered next.

FrontierStack User Manual · Version 1.0.0 · Chapter 5