One host.
Many factories.
Shared infrastructure.

The second factory creates concerns no single factory can own.

Repository autonomy is useful. Duplicating host configuration, upgrade procedures, and operational checks across every repository is not.

Classified by where it lives, not by feature.

Every setting District touches is either host-side or committed to a repo. The split is the product.

1. District writes committed files exactly once, at onboarding, and only reports drift afterwards.
2. District rewrites host-side artifacts on every apply without asking.
3. District never commits to a managed repo. It prints the commit line.

Nine verbs. Each one shells out to the host tools it checks or manages.

District never imports from mikeroySoft/factory and never reimplements a factory command. If it needs a per-repo fact, the fix is a flag on factory.

A shared operational picture. Not another project inbox.

The scoped console and graphical Overview are merged: stable diagrams show real cached state, concurrent stage occupancy, capacity, source ages, findings, and evidence-backed motion. Detailed Flows and Brief work, combined operator acceptance, and console cutover are still pending.

Try the current console: after starting the dashboard, open http://127.0.0.1:8760/?view=overview for the implemented graphical watch surface. Change view to flows or brief for the shared scoped shells; detailed flow lanes, the evidence panel, and the full Brief are still planned. Combined Overview/Flows visual acceptance and the default-route cutover remain pending. Atlas and existing management remain at / and /legacy.

LAN viewing requires an explicit bind such as --host 0.0.0.0. Manage and detect require direct HTTP to numeric loopback or localhost at the actual server port. LAN URLs remain read-only even on the host; DNS aliases and reverse proxies are unsupported, and forwarded headers fail closed. Network policy.

What we chose. What we chose not to build.

District started with a city-shaped Atlas. The new operating surface puts work and evidence ahead of architecture and repository size, while Atlas remains the default until acceptance and cutover.

Read the approved operations-console specification · One operator, one Linux host. Multi-host orchestration, team management, and an LLM-generated Brief are outside this console's scope.

One classification for the CLI and dashboard.

Machinery findings, project context and observation quality are separate. CLI status takes one bounded runtime/full collection round through the same source adapters as the server. Missing execution telemetry is explicit, not reconstructed from artifacts.

Exit 0: every entry normal, or an empty fleet. Exit 1: any supported operational attention. Exit 2: unknown observation or state without attention. Attention takes precedence, but unknowns remain visible. Engines without execution telemetry report partial/unknown rather than silently healthy.

The CLI and dashboard share source adapters and classification. Runtime and full snapshots refresh independently; producer timestamps, record-level quality, bounded history, and gaps remain explicit. A slow full snapshot does not need to block publication of runtime evidence.

Integrating with District? The source and JSON contract documents observation bounds, findings, and the migration from the old health/reasons fields. district status --json exposes the normalized state keyed by repository slug.

From fleet registry to operational evidence.

Selected milestones through September 18, 2026. Dates below use UTC merge history for PRs; these are source milestones, not tagged releases or a claim about every installed host.

1. September 18, 2026Merged

   An on-demand fleet review joins the command line.

   district report prints one read-only Markdown report from a bounded, non-atomic observation round and existing metric caches. It retains source ages, lists every registered repository and coverage gap, discloses actual producer windows and bounded GitHub queries, labels partial counts, and pools rates only when numerators, denominators, and windows are compatible.

   Boundary: this is an operator-requested snapshot, not a scheduled report, provider-written narrative, new collector, automatic publication, or claim of autonomous delivery.

   Report #52 · Issue #51 · Source milestone 3ab332d

2. September 10, 2026Merged

   District can update itself without updating the fleet.

   • district update pins an official commit with successful CI, prepares it before downtime, preserves the dashboard bind and active District timers, and verifies the replacement collector. Query-only planning, offline rollback, and a retained recovery helper cover both normal upgrades and interrupted replacements.
   • Separately, a shared Factory engine reinstall now preserves the optional [defaults].factory_extras selected in the host registry instead of silently returning to a bare install.

   Why: District self-update must not also update Factory or rewrite units; an explicit Factory reinstall must retain the operator's selected extras.

   District update and recovery · Factory extras preservation cc66f1b

3. September 9, 2026Merged · implementation

   The graphical Overview renders observed fleet activity.

   Stable, equally weighted diagrams show concurrent stage occupancy, capacity, freshness, findings, resources, and bounded recent activity. Fresh confirmed active stages may pulse; distinct observed transitions and completions animate once, with watch, pause, hidden-tab, reduced-motion, keyboard, and narrow-screen safeguards.

   Still gated: merge is not human acceptance or cutover. A real fresh-active pulse, real resource/capacity waits, and real capped/unexpected-stop observations remain uncaptured or fixture-only; the operator's combined Overview/Flows visual acceptance is pending.

   D04 · #27 · Source milestone 7e17b14 · Evidence and remaining exit gap

4. September 7, 2026Merged

   The scoped console lands; telemetry and upgrades get tighter.

   • Overview / Flows / Brief navigation over real cached state, with factory scope, honest loading and expired-selection messages, and Back / scroll / focus preservation.
   • CLI status now collects the same runtime evidence as the dashboard. Record-scoped diagnostics preserve partial observations without flattening unrelated current evidence.
   • Shared-engine upgrades wait for every managed active pass and restore timers before reporting their state. Full-snapshot collection has its own bounded deadline.

   Why: agreement between surfaces and safe maintenance matter more than adding another visualization.

   Console #35 · Telemetry #38 · Upgrade safety #39 · Record quality #41

5. September 6, 2026Merged

   One classification, one collector, an explicit trust boundary.

   • Operating state, execution state, observation quality, and findings replace the old mixed health verdict.
   • Independent runtime/full refresh, bounded collection work, and sanitized cache-only browser reads become the common console data source.
   • LAN viewing becomes read-only; host mutations fail closed outside trusted local requests.
   • Host doctor, CI-derived gate proposals, and locked hourly reconciliation join the everyday workflow.

   Why: more viewers should not create more collection work, and remote visibility should not grant remote control.

   Classification #33 · Collector #34 · LAN boundary #32 · Doctor #16 · Onboarding #18 · Reconciliation #19

6. September 5, 2026Design approved

   From an architecture map to an operations console.

   Approved the Overview / Flows / Brief direction, a shared evidence model, and dependency-gated implementation tickets. Atlas stays available until the new console passes its implementation and human acceptance checkpoints.

   Why: repository size is not operational importance. The operating screen should answer whether work is flowing and what the operator can actually act on.

   Approved specification and ticket plan

7. September 3–4, 2026Initial implementation

   A district around the factories.

   Introduced the host registry, onboarding and adoption, shared defaults, port allocation, reconciliation, upgrades, failure caps, and fleet status. Added cached repository metrics, the Atlas, local management, dashboard installation, and a reusable agent skill.

   Why: centralize what every factory needs without taking ownership of its committed configuration or project decisions.

   Initial implementation · Live Atlas · Agent skill

Full commit history · All merged pull requests

Make the machinery readable. Then make it the home screen.

Shared state, collection, the LAN boundary, the scoped shell, and D04's graphical Overview implementation are merged. As of September 18, 2026, the current held console milestone is D05 Flows, followed by D06 Brief and the acceptance-gated management/cutover sequence — not a release-date promise.

Merged is not accepted or cut over. D04 is implemented in source, but its remaining live-state evidence and the operator's combined Overview/Flows visual checkpoint still apply. D05 Flows #28, D06 Brief #29, management #30, and cutover #31 remain open and held. Atlas remains the default; successful CI alone does not authorize console cutover.

Follow the live issue tracker for current status, dependencies, and discussion. Scope or order may change as real operation provides evidence.

Python 3.11+, one dependency, a stdlib HTTP server.

For a Linux host with user systemd, Factory, git, and an authenticated gh CLI. Runtime execution detail requires a Factory build supporting dashboard --runtime-json.

$ npx skills add mikeroysoft/district
$ uv tool install git+https://github.com/mikeroySoft/district
$ district doctor                       # check this host before onboarding
$ district add ~/dev/owner/repo        # or a GitHub URL; adopts an existing .factory.toml
$ district apply                        # reconcile units, labels, doctor, caps, policy
$ district dashboard --install          # dashboard + hourly metrics and apply timers
$ district status
$ district report                       # on-demand read-only Markdown review on stdout
$ district update --dry-run             # exact SHA, CI eligibility, service plan; no mutation

The host config file at ~/.config/factory/config.toml is the registry. No second store. A repo is managed iff it has a [repo."owner/name"] table with a path.

Optional Factory features survive every shared, host-wide engine reinstall when selected in the registry, for example:
[defaults]
factory_extras = ["atlas"]
Omit the setting or use an empty array to keep installing bare Factory; run district apply --upgrade to apply the selection to the one engine used by every managed repository.

Set factory_ref = "main" under [defaults] to make every hourly district apply follow the Factory clone's GitHub origin. District resolves and installs the immutable remote SHA only when every check run has completed successfully, records it under [defaults.engine], and leaves the installed engine unchanged while CI is pending or failed. Omit factory_ref to keep upgrades explicit.

District self-update supports only a non-editable uv install from the official repository. It prepares the target before downtime, runs replacement and recovery from a retained stdlib helper outside the managed environment, and keeps the prior successful installation for district update --rollback. Metadata lives under ${XDG_STATE_HOME:-~/.local/state}/district/update, never in Factory's registry. A source checkout can bootstrap the installed tool with uv run python -m district update --to <eligible-sha> --yes.