Single EXE
Ships as one portable executable — no installers, no MSI. Copy it to the host and run it.
Origin Admin Console · Internal
One cockpit for administering the PI ecosystem.
The administrator plane behind the Origin suite — a single portable desktop app that runs host operations, diagnostics, and guided runbooks through one hardened, audited runner. Built for the person who has to keep the archive alive.
Internal · by invitation
Single portable EXE · no installer
Why it exists
Admin work on a PI System is a scatter of scripts and consoles. This puts it behind one gated door.
One place
Host operations, service checks, diagnostics, and guided runbooks — invoked from a single cockpit instead of a folder of half-remembered PowerShell.
Runs where PI lives
A desktop app on the box you administer — no browser, no cloud dependency, loopback-only. Nothing to expose to the network.
Auditable by default
Every action goes through a validated runner and lands in a masked, rotating audit log. Destructive steps ask first.
Architecture
Built as a locked, portable cockpit.
One file to hand an administrator; nothing to install, nothing to bundle separately.
WebView2 desktop
A native desktop window (pywebview / WebView2) — not a browser tab — with a clean React interface.
Local agent
An in-process local API runs in the same process as the window — bound to loopback only, behind a per-session token.
The security core
Designed to be command-injection-free by construction — not by sanitizing inputs after the fact.
Every external action is a validated argument list, never an assembled command string.
Argv-only execution
Every external process is a validated argument list run with no shell — no string-built commands, ever.
Allow-list at the boundary
Inputs are validated against an allow-list before anything runs — the boundary decides what's permitted.
Secrets via environment
Credentials pass through environment variables only — never on a command line, never in the logs.
Masked, rotating audit log
Every action is recorded to a rotating audit log with secrets masked — a durable record of what was done.
Confirmation gates
Destructive operations require an explicit confirmation before they proceed.
Loopback + per-session token
The local agent binds to loopback only and requires a per-session token — nothing is reachable from the network.
Internal · by invitation
Not on the shelf — on request.
The Admin Console is the hardened plane we run the ecosystem with. If you're an existing customer or partner who needs it, ask and we'll talk about access.