> ## Documentation Index
> Fetch the complete documentation index at: https://docs.archivecircle.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin pipeline

> Review death verification cases and operate the escalation pipeline.

The admin pipeline dashboard is used to inspect and operate death verification cases.

## Accessing the panel

The admin panel lives at `/app/admin/deaths` on a dedicated subdomain, `admin-eternum.archivecircle.xyz`, kept separate from the customer app (`eternum.archivecircle.xyz`). Three layers control access:

* **Edge gate** — Cloudflare Access protects the admin subdomain with a one-time PIN sent to allowlisted emails, before any request reaches the app.
* **Host routing** — Next.js middleware (`web/middleware.ts`) serves the admin UI only on the admin host; the customer host redirects `/app/admin/*` to the vault. This is UI separation, not an authorization boundary.
* **API authorization** — the API checks the signed-in user's email against `ADMIN_EMAILS` on every admin request, independent of which host served the page.

<Info>
  The Cloudflare Access email and `ADMIN_EMAILS` are independent. A user must pass the edge gate to load the panel and have an `ADMIN_EMAILS` account to perform admin actions.
</Info>

## Admin tasks

Admins can:

* View verification cases
* Review death certificate uploads
* Approve or deny certificate evidence
* Trigger pipeline presets for testing (admin-gated, available in all environments)
* Resolve contests during the challenge window

## Pipeline states

| State     | Meaning                                              |
| --------- | ---------------------------------------------------- |
| pending   | Verification is active but not complete.             |
| contested | A trusted contact contested the verification.        |
| verified  | Recovery can proceed.                                |
| cancelled | The pipeline was stopped, usually by owner check-in. |

## Signal threshold

Verification requires at least two signals and at least one high-weight signal. High-weight signals include reviewed documents such as notarized certificates or government registry matches.

One signal is the trusted-contact quorum: it fires when at least two distinct trusted contacts confirm the death and they form a majority (more than half) of the owner's active contacts. The death-review screen shows the running count (for example, `2/3 — quorum reached`) so you can see how close a case is before acting.

<Warning>
  Admin actions affect beneficiary recovery. Review evidence carefully before moving a case to verified.
</Warning>