Quox Console

What Quox Console is #

Quox Console is the native Apple-platform window onto a QuoxCORE instance you already run. It is not a service and holds no account of its own: you connect it to an instance (yours, or the public demo), sign in as the person that instance already knows, and the app shows you what is yours.

It is free, has no tiers, and is currently distributed through TestFlight while the public beta is prepared.

The design rule the whole app follows is honesty: unknown is never rendered as zero, unreachable and unauthorised and empty are three different screens, and a decision shows as recorded only when the instance confirms it.

Requirements #

Chat additionally needs the instance to have an AI provider key configured, because agents answer with the instance's own models and keys. That is a server-side step, covered in Integrations. Console tells you before you type if the instance is not ready, rather than letting a message fail.

Getting started #

1. Install from TestFlight. During the beta, invites are added manually; request one.
2. Try the demo first if you like. A public demo estate is built in, with its credentials shown in the app. It resets itself regularly, wiping everything anyone planted, so treat it as a playground. It will not reset while you are actively using it.
3. Add your own instance. Instances tab, Add a connection, and give it the address you use for the dashboard in a browser. The dashboard origin is the door; Console reaches every service through it. Plain hostnames get https automatically.
4. Sign in. Your normal instance email and password. Tokens are stored in the device Keychain, never in preferences, and signing out on one instance never touches another.

Connections and trust #

Console speaks to any number of instances, directly or through a Qluster controller, and keeps each connection's identity and tokens separate.

Self-signed certificates. Most self-hosted instances present a certificate iOS does not trust by default. Console handles this with an explicit, per-connection trust decision: the first time an instance presents a self-signed certificate you are shown the situation and choose to trust exactly that certificate for exactly that connection.

If the same server later presents a different certificate, Console says so plainly, because that is what a renewal looks like, and it is also what interception looks like.

The three states. A connection that cannot be reached says Unreachable. One that refuses your certificate trust says Untrusted. One that answers but rejects your session says so as an authorisation problem. These are different problems with different fixes, and the app never collapses them into one grey dot.

Chat #

Chat is a native conversation surface for every agent on the selected instance: the built-in roster and the assistants your organisation configured. The instance context is always on screen and switching is explicit, so a question meant for the dev instance cannot quietly land on production.

• Identity travels. Agents wear the colours Core assigned them, and profiles (tap any avatar) show who an agent is, what it does, and how it is addressed. Tap your own avatar for who you are on each instance.
• Conversations survive. History and half-typed drafts persist on the device per instance and agent. Server-side history is on the roadmap; today a fresh device starts fresh.
• Honest failure. A message that did not deliver says so, keeps your text, and offers one tap to try again. Replies render markdown properly, and any message can be copied as the raw text it came from.

The inbox #

When an agent or workflow needs a human, the item lands in the inbox, and the inbox is why the app is on a phone at all.

• Approve or deny from the list or the detail screen. Denials can carry a reason, which travels to the workflow that asked. Approvals resume it; denials stop it.
• Snooze (an hour, four hours, or tomorrow morning) hides an item from your list until the time passes. Escalate raises an item to urgent, with an optional reason.
• No optimistic lies. A decision is shown as recorded only when the instance confirms it, and what you just decided stays visible in a Decided recently section so you never wonder whether it registered.
• Urgent floats. The list sorts by priority and refreshes itself while open.

Rooms #

On instances with governed Matrix rooms, a Rooms section appears in Chat: your organisation's rooms with unread counts, live timelines, and sending, including photo and video attachments. On instances without Matrix the section simply does not exist; there is nothing to configure in the app.

Watch, TV and Mac #

Apple Watch. A glance fed by the phone: how many approvals are waiting, and the newest titles. The watch holds no credentials, runs back to watchOS 8, and states the age of what it shows. Even watches too old for apps benefit once push is enabled, because iPhone notifications mirror to a paired watch.

Apple TV. The estate on the wall: health tiles that poll each instance's public health endpoint every minute, with measured latency, collector uptime, a WARD witnessing chip, and a strip of the recent checks where grey honestly means not-asked-yet. The TV never signs in and holds no secrets, only addresses. Ships with the public beta.

Mac. A native Mac build exists and runs; its desktop layout is being tidied and it joins TestFlight after the public beta.

Troubleshooting #

Privacy and support #

Console stores tokens in the device Keychain, keeps chat history on the device, contains no third-party analytics, and speaks only to the instances you add plus, if you use it, the public demo. The full policy is at Quox Console privacy, and the support page with common setup questions is at Quox Console support.

Stable, beta and planned #

The engineering-grade version of this table, with evidence classes and known gaps, lives in the repo as STATUS_AND_LIMITS documentation; this page states the same facts at reading distance.