Design the panel

The box is a 320 by 240 panel with a fixed pixel font, read in about ten seconds. Everything you send renders inside the payload box, a bordered region inset from every edge. The system band, the quorum row, the countdown and the key legend belong to the device.

The regions

SYSTEM BAND · YOURS TO READ, NEVER TO WRITE

PAYLOADDEPLOYapi>prodBYkeithSHA9C1FA2

QUORUM ROW · CORE SUPPLIED

KEY LEGEND · SYSTEM OWNED

A payload can’t draw outside its box, and accent is an enum rather than a color value, so nothing in a request can imitate the device’s own chrome. The server sanitizes every field and the firmware sanitizes it again.

The fields

title is the category, in caps: DEPLOY, MERGE, PAYOUT. subject is the thing itself, drawn large: the repo and environment, the amount, the account. fields are up to two label and value pairs that tell the right one from the wrong one, like who asked or which branch. Anything past the second field moves behind the DETAIL key.

accent colors the payload box and takes amber, green, cyan, violet, rose. severity colors the system band and takes low, elevated, critical. An unknown value falls back to the default.

Limits

FIELD	LIMIT	WHY
title	17 characters, uppercased	The 24x24 logo tile eats 31px of that row.
subject	20 characters	10 at the large size. Longer steps down to 24px and wraps to two lines of 14.
subject, if it reads as money	28 characters, never truncated	$470,000 cut to $470,0 reads as a smaller number and gets authorized. It steps down a size instead. Past what the box can draw the device elides visibly rather than painting past the border.
fields[].label	4 characters, uppercased	Labels sit in a fixed column beside their value. This is why the digest label is SHA and not DIGEST.
fields[].value	10 characters	Elided with an ASCII period, never a unicode ellipsis, which is three 4px blocks at 34px.
fields	2 entries	A third shrinks type below the legible floor or pushes into the key legend. Extras move behind DETAIL.
accent	an enum	amber, green, cyan, violet, rose. An unknown value snaps to amber. Never a hex value, because a hex value could pass for chrome.
severity	an enum	low, elevated, critical. An unknown value snaps to low. It recolors the system band and draws nothing inside the payload box.
logo	a content hash	A 24x24 one-bit bitmap named by sha256 digest. Anything else is dropped for a monogram, so a payload cannot draw an arbitrary picture.
every character	0x20 to 0x7e	One rune, one column. An undrawable rune becomes a question mark, one for one, so a lost character is visibly lost.

A subject that parses as a currency amount is never truncated. It steps down a type size instead.