Family turns a Quazzar node into a supervised device for the people who share it with you — your kids, your students, anyone you’ve been asked to keep an eye on. It’s three things bundled into a single screen on the Control Panel: a timeline of what’s running and where it goes, a policy engine that can block, schedule, and budget time, and a live screen view for when “are you actually doing your homework?” needs a real answer.

It’s aimed at parents running the household node, teachers running a classroom of small machines, and supervised-adult arrangements (think elder-care, supervised release). Visibility, Enforcement, Connection — that’s the whole product, and every other page under /docs/cloud-os/family* is just one of those three pillars in more detail.

What’s covered

Family is organised around three pillars. Each one is independent — you can turn on Visibility for everyone and leave Enforcement off, or push policies without ever opening the live view.

Visibility

Every program launch and every DNS lookup that happens for a monitored user gets recorded locally and shown back to you as a timeline. You can see what was opened, when, and for how long, plus the hostnames the device tried to resolve while it was open. The default view is a day’s timeline; a Summary panel rolls the same data up into “screen time per category” and “top sites” so you don’t have to scrub the timeline by hand.

Enforcement

A policy is a small set of rules attached to a monitored user:

• Blocklists — refuse DNS resolution for hostnames in named categories (adult, gambling, social, gaming) or in a custom list.
• Bedtime — refuse to log in (and lock an active session) between configured hours.
• Daily budget — a hard cap on minutes-per-day of foreground session time, optionally split per category.

Policies live on the node and apply instantly when you save them — no sync window, no reboot required.

Connection

When a session is in progress, the supervisor can request a live screen view that mirrors the active desktop to a tab in the Control Panel. The monitored user sees a status-bar indicator the entire time the view is open, and the session is recorded in the audit log. Live view is a Pro-tier capability.

Free vs Pro

The Free tier covers a single household device with one supervised user. Pro unlocks classroom-scale deployments and the connection layer.

The gate is enforced server-side by license.Gate — see Orbit Pro for the full tier matrix and upgrade flow.

Workspace personas

Pick the persona that matches how you’re using Quazzar the first time you visit the Family section in the Control Panel:

• Family — the default. URL is /family, the sidebar entry is “Family”, copy reads “child device” / “Bedtime” / “Parents digest”.
• School — for classrooms. URL is /school, the sidebar reads “School”, copy reads “student device” / “Class schedule” / “Teachers digest”. The teacher role is the primary editor.
• Managed Devices — for company-issued laptops. URL is /workspace, the sidebar reads “Managed Devices”, copy reads “managed laptop” / “Working hours” / “Managers digest”.

Permissions and the underlying OS enforcement are identical across all three modes — only labels change. Switch the persona later from Settings → Workspace if your use case shifts. Bookmarked URLs auto-redirect to whichever prefix matches your current persona.

Setup walkthrough

End-to-end, going from a fresh node to a monitored kid is five steps. You can do every step from the GUI; the CLI variant is still around for headless setups.

1. Install or pair the node with your Control Panel the usual way (Setup Wizard → Pair to CP, or paste your CP URL into the installer).
2. Open the OS’s Settings → Family page on the node. Copy the Instance ID with the built-in copy button, then press Generate pair code — a fresh 10-minute code appears with a live mm:ss countdown. (For headless nodes, run quazzar family pair from a terminal — it prints both values.)
3. In CP, open Family / School / Workspace → + Add device. Pick your node from the dropdown — every fleet-registered device is listed with online 🟢 / idle 🟡 / offline ⚫ indicators, already-enrolled ones drop out automatically. Paste the pair code from step 2 and submit.
4. Open the device, head to Users, and toggle Monitor on for each account you want supervised. The toggle takes effect on the next login; an active session is left alone.
5. Open Policies for the monitored user and configure the rules that matter to you — blocklists, bedtime window, daily budget. Save and you’re done; the rules apply on the next event the node evaluates.

If you’re rolling out across many devices (a classroom), do step 5 once on a template user and use Push to group in Policies to fan the same ruleset out to every monitored user in the group.

Managed-by-Control-Panel indicator

Once a node has been enrolled into a workspace, the local OS shows a persona-aware banner on the Dashboard and Settings → Family — “Managed by Family Control Panel”, “Managed by School Control Panel”, or “Managed by Workspace Control Panel”. A local supervisor sees at a glance that policies are administered remotely.

The re-pair section on Settings → Family hides while managed (minting a fresh pair code now would only let a different supervisor take over). To regain local control, run Uninstall Family from the CP-side device page — the banner clears automatically and the OS returns to the un-enrolled state.

What the monitored user sees

Family is designed to be obvious to the person being monitored — no hidden surveillance, no quiet recording. Three surfaces make the monitoring state visible:

• Login banner. When a monitored user signs in, a banner across the top of the desktop reads “Family monitoring is active” with a link to the details page. Dismissing the banner does not turn monitoring off; it only hides the banner for the session.
• Settings → Family page. A dedicated panel inside the user’s own Settings app shows exactly what is being collected — the list of events (program launches, DNS qnames, session metadata), the active policies, and the name of the supervisor account that configured them.
• Status-bar indicator. When a live screen view is in progress, a small badge appears in the status bar for the entire duration of the session. Clicking it shows who is watching.

These surfaces are not configurable away. They’re part of the transparency contract — if you’re being monitored, you can always see what’s being collected and when someone is actively watching.

Privacy contract

Family records program launches, DNS query names, and screen-view session metadata (start, stop, supervisor identity). It does not record keystrokes, clipboard contents, file contents, camera, or microphone, and there is no hook in the codebase to do so. Live screen view streams pixels in real time and is not persisted to disk unless the supervisor explicitly starts a recording (Pro feature, auditable). All collected events are scoped to the local node and visible to the monitored user on their own Settings → Family page.

See Family hardening for the boot-path lockdown that prevents a monitored user from disabling the agent by booting into recovery or a live USB.

Where to next

• Family stats — Timeline, Summary, and alerts on the visibility side.
• Family policies — Authoring blocklists, bedtime windows, and daily budgets.
• Family screen — Live screen view setup and audit trail (Pro).
• Family hardening — Boot-path lockdown, agent integrity, and recovery-mode policy.