What the Dashboard Is For
The Dashboard reports posture and offers the next move. Every action on it is a governance action, request an exception, generate a snapshot, run a scan, set up a policy. The decisions themselves aren’t made here: assigning, resolving, deferring, and reopening findings all live in the Review Workspace, and every card that points at findings links you there. Above the cards sit a coverage badge, Full Coverage or Partial Coverage, how the code arrived, and when it was last scanned. To the right, New Scan and Download.Tabs, and Why You May Not Have Any
The tab strip is built from the scanners your organisation actually has, never from a fixed list. With more than one, you get Overview plus one tab per domain, Components and Cryptography. Overview is the standing answer to “what needs doing”; each domain tab goes deep on one subject. With one domain there’s nothing to switch between, so there’s no tab strip at all, you get a single merged canvas. That’s deliberate, not a missing feature.Lenses: The Question You’re Asking
Each domain tab carries a lens dropdown that swaps its card set for the question you have today. Overview has no lens, it doesn’t vary by question. Components offers All Cards · License Compliance · Vulnerability · Audit Export. Cryptography offers All Cards · Reachability · Post-Quantum · Export Evidence. Beside the lens, a period dropdown, Last 30 Days, Last 90 Days, or All Scans. It narrows history only. Posture is always as of the latest scan, whatever period you pick, so changing it can never make a current problem disappear.Making the Canvas Your Own
Select Customize and the canvas becomes editable; the button becomes Done. While it’s on, every card carries a move handle on the left and a remove button on the right, and you can:- Reorder — drag a card onto another, or use the keyboard (below).
- Resize — drag a card’s right edge. Widths move in whole columns, between a quarter and the full width. Resizing is offered only on a wide window; on narrower ones the layout is fixed to halves or full width, so there’s nothing to set.
- Add — Add Cards opens the card library, every card this view can hold with a one-line description. Cards already on the canvas are listed but greyed, so the library reads as a complete inventory rather than a mystery. Select one to append it. Hide Library closes it again.
- Remove — the × on the card.
Earnie saves rapid edits in order. If the latest save or reset fails,
it reports the error and restores the last layout the server confirmed,
rather than leaving an arrangement on screen that will disappear on
reload.
Reordering Without a Mouse
Tab to a card’s move handle, it’s announced as “Move Merge gate. Use arrow keys to reorder.”, then press← or → to move that card one place at a time. Home sends it to the front of the canvas and End to the back. It’s the same operation as dragging, and it’s the reliable one on a trackpad.
Your layout is yours. Layouts are saved per person, and separately
for each tab and lens. Rearranging your Dashboard doesn’t move a
colleague’s, and nothing you do here changes any finding, policy, or
verdict. If a card is added to or removed from Earnie in a later
release, your saved arrangement for that view is returned to the
default rather than half-applied, otherwise a new card would be
silently missing and you’d have no way to tell it from one you’d
removed yourself.
What Each Card Tells You
Needs Attention is the top of the page and the only card you must read. It lists one row per condition, each a plain sentence with a single verb beside it:
Rows appear only when they’re true. When none are, the card reads Clear, “Nothing blocks a merge and no evidence is missing.”
The rest of Overview:
- Merge gate carries the verdict, Blocked, Warned, Passed, with the counts behind it and when it was evaluated.
- Evidence reads Ready with the formats already rendered and your review coverage.
- Provenance is the share of files matched to known components, snippet fingerprints, not manifests.
- Components and Cryptography are summaries that link to their tabs. The Cryptography card includes focused sparklines for Reachable weak crypto and PQC-vulnerable assets; the same rows sit beside the other metrics in Posture trend. Each sparkline uses the latest twelve completed scans; Posture trend also prints the current value and its movement. A scan that didn’t run cryptography leaves an absent point in those rows instead of a zero; only a crypto scan that ran and found none can plot zero.
- Decision throughput counts what was closed, split between agents and CI on one side and humans on the other.
Export Readiness
On Cryptography, Export readiness measures whether your export-control evidence is complete, it never states or implies an ECCN, and says so on the card: “Evidence only, never a determination; no ECCN is stated or implied.” It reads Ready when every active finding has complete evidence under the export regime version shipping today, Not ready when evidence is missing or unresolved, and Stale when the evidence exists but all of it predates a regime update. Those last two are different jobs: a not-ready project has an evidence gap to close, while a stale one has nothing wrong with its code and needs a re-scan. Where only part of the project predates the update, the card keeps its ordinary reading and adds the count of findings that carry only superseded evidence, the ones a re-scan would actually move.Some mass-market reporting-line evidence can only be decided over the
whole project. An RSA or elliptic-curve finding reaches a final answer
only after Earnie checks the same scan for symmetric confidentiality
algorithms (AES counts; authentication, integrity, hash, MAC, and
signature mechanisms like HMAC don’t). Earnie resolves this
project-level condition before it computes readiness, while keeping the
original per-finding evidence unchanged for audit.
Risk dataset <id> — last reviewed <date> and Export dataset <id> — last reviewed <date>. The risk dataset set the severity of every finding counted here; the export dataset answered every export test. These are the same claims the export report’s header makes, on the same two datasets, so the dashboard and a filed exhibit can never disagree about which curation you’re looking at. Under those two lines, What these datasets say opens Settings → Crypto Assessment, the published rules themselves, see Triaging Findings.
Post-Quantum Exposure
Post-quantum exposure assesses every cryptographic asset type by its resolved algorithm family (algorithms, protocols, certificates, and key material). It counts only cryptography a quantum computer actually breaks, the classical public-key families, so a broken hash like MD5 is a severity problem here, never a migration item. Assets Earnie couldn’t judge stay separate as unassessed; they’re never folded into the quantum-safe remainder, and a curation gap is never presented as migration work.Reading the Numbers Honestly
This is the part worth learning, because it’s where a dashboard normally lies to you. Earnie uses different words for a measurement that came back zero and one that was never taken, and never rolls either into a score or a grade.Partial Coverage Changes What the Numbers Mean
When the header badge reads Partial Coverage, the posture was built from declared components only, the manifests and lockfiles, with no code matching behind it. Provenance and Origin split then show— rather than a percentage, the Component matrix reads Declared with — for files, and Needs Attention raises “Posture is declared-only, no files were matched.” Treat it as an inventory of what the project says it uses, not of what’s in the code.
If the page can’t load. When Earnie can’t fetch the project’s
scans you get “Could not load scans” and a Retry, and no merge-gate
verdict at all, a verdict beside “could not load” would read as a
verdict about the failure.
Downloading Evidence from the Dashboard
Download in the header is the shortcut to everything this project can hand to someone else. The menu reads the snapshot for the exact scan that backs the posture on screen; a newer snapshot from another scan isn’t substituted. Selecting an item downloads that artifact immediately, it doesn’t send you to the SBOM ledger. The menu offers only formats already rendered on that snapshot, so a snapshot has to exist first: with none, Needs Attention says so and offers Generate SBOM (see Exporting an SBOM).- SBOM · CycloneDX — the broadly supported inventory format.
- SBOM · SPDX — the licence-focused one.
- Notice file — the attribution text you’re obliged to distribute, as
NOTICE.txt. - Export-control report — where cryptography is enabled and the scan found something. Evidence for your own self-classification; it states no ECCN. Its header names the curated datasets behind it and the date each was last reviewed.