Team workflow¶
One organization, two surfaces, one core. The SaaS is read-only; the TUI/CLI executes locally. Everything is attributed to the signed-in person.
Person A: scan in the TUI¶
Scan, then press s. A small Sync to Horizon card opens: it shows the snapshot source, resource count, and job. No URL or token form — the session already on the machine is used. The card stays available, and the status bar keeps "synced 12m ago" for 24 hours.
If no source plugin is installed, the TUI opens the plugin marketplace automatically. Plugins installed in the organization are installed on this machine on launch; none produces a dead-end "no plugin" prompt.
Person B: see it in Horizon¶
The synced snapshot appears in Recent scans and the dashboard. Horizon is read-only: it can analyse, generate a signed plan, and show policy results, but it cannot execute a change.
Person A: execute a Horizon plan¶
The CLI fetches the plan, verifies its signature, runs preflight locally, and posts the audit outcome back to the plan. Horizon shows who executed which action; the audit actor is the signed-in user.
Attribution¶
- Scans record the syncing user.
- Plan audit events record the executing user.
- Workspace plugin installs record the installer.
- Policy changes record the author.
If sync is rejected¶
- Session expired →
cs login. The TUI never asks for a token. - No snapshot → run a scan first;
sshows the missing-state card. - Snapshot rejected → the server explains the schema error; update the CLI and rescan. The API accepts old formatting when the canonical digest matches.
The legal boundary is unchanged: Horizon never mutates infrastructure. The person running the CLI owns the credentials and the execution.