This browser console is the first admin surface for Kulunu Guard. It talks to the
backend over the existing signed policy APIs, so lock, unlock, release, and wipe stay
auditable and backend-authoritative.
Recommended operating modelUse a web console for staff, keep the Guard app as Device Owner only, and let the backend remain the source of truth.
Current authPaste the backend admin bearer token from backend/.env. The token is stored in this browser tab session only.
Enrollment Workflow
Ready
Sign in to fetch a LAN-safe backend URL, or enter a public/LAN URL manually.
Leave this blank unless the APK is hosted at a different public or LAN URL.
Choose a provider path, then create either a lab QR session or a production enrollment handoff record.
Enrollment options. Activate Guard after normal setup, or use a spare company-owned phone for lab Device Owner testing. Lab enrollment may be blocked by Play Protect; production approval remains unresolved.
Workflow Result
No active result
Create an enrollment to see its setup instructions.
No QR generated yet.
Enrollment: -Expires: -Session: -
-
No provisioning payload generated yet.
Access
Not connected
Sign in with admin credentials to load managed devices.
Devices
0 loaded
Devices are ordered by backend updated_at.
No devices loaded yet.
Device Detail
No device selected
-
-
-
-
-
-
-
-
-
-
-
-
Actions
Read only until connected
Select a device to send an admin command.
Offline recovery (admin only)
Authorize 24 hours of temporary access when normal unlock cannot reach the phone. Ask the device user to open Offline recovery and read the current request. A phone that cannot run Kulunu Guard cannot use this recovery method.
Enter the support reason in the action reason field above.
Device location (admin only)
Requires Guard 0.2.4 and consent completed on the device user phone. Only the latest position is retained for 7 days. Reports are not guaranteed live. Disabling deletes the stored position immediately; phone settings clear when it syncs.
Use the action reason field above for changes or requests.
Wipe is destructive. Use it only for spare lab phones or final controlled
retirement of a company-owned phone. The device will factory reset after syncing the signed
DEPROVISION_WIPE policy.