PlcConsoleConnect a customer site outward to the control plane, keep credentials rotatable and verify the installed release.
Each agent belongs to one tenant and site. The compact row shows lifecycle and connection state while expansion provides the operational detail.
The Identity card shows the reported software version and installation identifier. Credentials records issuance and expiry. Connection separates latest observation from the last successful connection and Last error provides the most recent recorded failure.
Credential actions affect the agent’s ability to authenticate. Treat the newly issued secret as sensitive and update the site installation before removing the old path.
| Visible state | Meaning | Next action |
|---|---|---|
| Pending / Awaiting connection | The agent record exists but no authenticated connection has been observed. | Install the agent, verify configuration and check outbound WebSocket access. |
| Active / Connected | The configured agent has a current authenticated session. | Expand the row and verify version, heartbeat and site assignment before relying on it. |
| Disconnected | There is no live agent session. | Check service state, network access, credential validity and Last error. |
| Heartbeat stale | A live session exists but its expected heartbeat is overdue. | Investigate agent load, network quality and server processing before assuming a full disconnect. |
| Disabled | The record remains available for history but is not allowed to serve commands. | Re-enable only after the reason for suspension is resolved. |
| Credential revoked | The current credential can no longer authenticate. | Rotate or reactivate through an approved process and update the protected site configuration. |
The scheduled updater checks the stable release manifest, verifies the new bundle, installs the versioned release, switches the current release link and restarts the service. Verify both the updater result and the version reported by the next authenticated hello.
When no updater is configured, download all verification material, verify it, install the new release beside the existing one, switch the current release link, restart the service and retain the previous release until the new connection is confirmed.
Verify the release URL and nginx access rules. The manifest, archive, checksum and signature bundle must all be available to the intended downloader.
Give the verification tool a writable Sigstore or trust-material location. A read-only home directory can prevent initial trusted-root creation.
Inspect the current release symlink and the service command. Restart only after confirming both point at the newly installed release.
Check server endpoint, TLS, WebSocket upgrade, credential state and the authenticated hello. A handshake exception by itself does not identify the failing layer.
The packaged Java runtime may be missing the XML module required by Logback configuration. Verify the produced distribution, not only the source build.
Set the configured agent log level to DEBUG temporarily. Command response bodies are debug-only and must remain bounded and free of credentials.
