The fleet roster#
Fleet is every enrolled endpoint with its connectivity, lifecycle and profile convergence. It has three views (LIST, GRAPH and GATEWAYS) over one population.
The columns that matter
| Column | Read it as |
|---|---|
| State | Awaiting approval, active, deactivated, revoked, or wiped. |
| Reporting | Whether the plane has heard from it recently. NOT REPORTING is the column that finds a broken machine. |
| Last seen | When it last spoke. |
| Policy rev | Which profile revision it is on, over the current one. 1 / 2 means it has not converged. |
| Profile | Which deployment profile governs it. |
| Gateway | Direct, or the fog gateway it relays through. |
| Agent | Installed agent version. |
| Can run | What the hardware qualified for. NOT REPORTED means no capability report has arrived. |
Filter by state, operating system and profile. A filter combination you use daily can be kept with SAVE AS VIEW, which puts it in the sidebar with a live count.
Endpoint operations
The band above the table counts open, refused, retried, acknowledged and unreachable operations. It also states plainly when endpoints cannot receive operations at all because their agent is too old. That is an upgrade, not a network fault.
Endpoint lifecycle#
| Action | Effect | Needs |
|---|---|---|
| Admit | Activates a pending endpoint and mints its credential, shown once. From the Enrolments lane of Review. | fleet.manage |
| Deactivate | Stops it syncing. Reversible: reactivating restores it. | fleet.manage |
| Revoke | Terminal. The credential is never reinstated. The record is kept so its owner can still see what it reported. | fleet.revoke |
| Request wipe | Terminal. Destroys local agent state and stops the device indexing, syncing or re-enrolling. | fleet.revoke |
Revoke and wipe are not undoable
No admin action reverses either. Both route through a confirmation that names the specific target, and neither is available from the command palette as a targetless action, precisely so a keystroke cannot fire one.
A wipe that a device has not yet acknowledged shows as WIPE UNANSWERED on the roster. That is a real state: the instruction is outstanding and the machine has not come back to take it.
Opening one endpoint gives its capabilities, its profile and the controls that reach it. From there, Model placement answers “why is this machine running this model?”, with every candidate that lost and the reason each was rejected.
Topology, gateways and inventory#
- Estate topology
- The three tiers drawn (control plane, fog gateway, endpoint) with which endpoints relay through which gateway and which branches are reporting. A shape argument.
- Infrastructure inventory
- The record beside the picture: control planes, public hostnames, gateways and endpoints, and which connections between them have been observed rather than only configured. A record argument.
- Fog gateways
- Site-local relay nodes, what each advertised, and the placement engine’s verdict on it.
Gateway states, and why there are four
- Pending. Registered and credentialled, but the control plane has never had an authenticated request from it. Unobserved is not broken, and a pending node must still be routable or it could never become active.
- Active. It has authenticated at least once. An observation, never an inference.
- Deactivated and Revoked are the two refusals. Only these become an explicit “unreachable” signal to the placement engine.
With no gateway bound to a fleet, devices post context packs straight to the control plane over one address, which is what every device in the field does today.
Models: qualification and promotion#
Models holds qualification evidence reported by the fleet, and the decisions taken on it. Devices report as they run cases; nothing here is a benchmark we ran.
| Outcome | Means | Next |
|---|---|---|
| Qualified | Every hardware floor held. | Promotable. It appears in the Model promotions lane of Review. |
| Missed a floor | Fell short. | More cases will not help. Not promotable. |
| Not enough evidence | Too few observations to conclude anything. | Run more cases. |
| Not measured | Nothing measured at all. | Not a pass. Do not read it as one. |
Let evidence accumulate
Qualification is a measurement across real fleet hardware. A model with four observations is not qualified; it is unmeasured.
Promote from the Review queue
Qualified-and-undecided pairs sit in the Model promotions lane. Promoting needs model.promote because it changes what every device in the ring loads on its next reconcile.
Pin only when you must
Pin a model fixes a choice for a scope with a written reason. With no pins, model selection is automatic everywhere, which is the state you want most of the time. A pin is a standing override that outlives the reason for it unless somebody revisits it.
Rollouts: shipping a new agent#
Rollouts is the release lifecycle. CI publishes immutable signed releases; operators freeze a cohort, inspect preflight risks, and move it through explicit stages.
Check a signed release is registered
Registered releases lists what CI has published. With none registered there is nothing to roll out. That is a pipeline problem, not a console one.
Create a frozen campaign
Name it, choose the signed release, and choose the target kind: a Deployment profile, a Saved fleet view, or Explicit device IDs. Freezing fixes the cohort so it cannot grow underneath you mid-rollout.
Run preflight before you create it
Run preflight inspects the cohort for risks first. Do this every time; it costs nothing and it is the only look you get before the cohort is frozen.
Move it through stages
MANUAL PROMOTION is the mode on the form, so promotion between stages is explicit. Watch convergence in the campaign, and in the profiles table’s NOT CONVERGED column.
Target a saved view, not a hand-typed device list
Explicit device IDs exist for a genuine one-off. For anything repeatable, save the filter as a view on Fleet and target that. A list you retyped is a list that will be wrong the second time.
Control planes#
Control planes is the surface for organisations running their own deployment: stable deployment identities and their observed infrastructure: region, release, health, public ingress, ownership proof, and TLS convergence.
- Request infrastructure creates a deployment with a name, a mode and a region.
- Bind public ingress attaches a hostname, declaring whether it is a name in a zone we operate or one in your own DNS. The two carry different proofs, and the distinction is never defaulted, because guessing which namespace a name sits in is guessing who is vouching for it.
- The plane a device talks to is decided at enrolment and rides in the enrolment link. Endpoints already enrolled do not move when this changes.
You are done when
Fleet shows no unexplained NOT REPORTING endpoints, no profile carries a stale NOT CONVERGED count, model pins exist only where you can state the reason, and any rollout in flight had preflight run before its cohort was frozen.
Something here wrong, missing, or no longer true of the product? Write to hello@evodira.com. Documentation that has drifted from the console is a bug and we treat it as one.