Every C2 we used before building AXIS had the same shape: a fat client on the operator's machine, a server somewhere, and a silent rule that the real product lived in the client. The client version-pinned you. It pinned your OS. It pinned which machine you could work from, and it made "I'll check from my laptop" a sentence nobody ever said twice after the first try.
We deleted the client. Not demoted it — deleted it as a requirement.
What was left had to carry the entire operation in a browser tab, served by the teamserver itself, or the design had failed.
The workstation is a credential
Once the panel is the product, an operator's workstation stops being an installation and becomes a credential. Any machine you trust — a browser, your account, TOTP — is the full console, with nothing to sync and nothing to wipe. The state lives in one place, on the server you run, and every operator sees the same fleet at the same time. Multi-operator stopped being a feature we maintain and became the default way the thing exists.
This is also why the console page is honest. Every rendering there is the product, not a marketing invention. If a capability cannot be reached from a browser tab, it does not ship — that sentence is on our wall, and it is why the site you are reading can be short.
What we deleted to get there
Deletion is the part nobody blogs about, so: the scripting engine that duplicated what REST already says; the second, "lighter" interface that always lagged a release behind; three configuration formats, of which YAML survives; and every feature that needed the client to exist. The desktop client we ship today is optional on purpose — it mirrors the panel for operators who want native windows, and it wins nothing for existing.
What survived deletion is what the capability reference lists. The budget this discipline buys shows up where you would expect: a 225 KB agent, a panel that loads on hotel Wi-Fi, and a release train that ships quarterly because the surface it ships is small enough to test.
The trade you should know about
Browser-first costs something, and pretending otherwise is how marketing pages lose credibility. A browser tab is one phishing session away from being somebody else's console, which is why TOTP is not optional and why audit logs export. And a panel you reach from anywhere must be boring on the wire in a different way than an implant — the traffic profile problem moves up the stack. We think the trade is worth it. The license numbers say enough of you agree.
The defender's angle
If the workstation is a credential, defend it like one. Our threat model says the panel is one phished session away from being somebody else's console — yours should say that about every administrative interface you run, ours included. The signals are ordinary but concrete: a long-lived HTTPS session to a host nothing else in the network talks to, a single-page application on an unusual port that answers every route with the same HTML, TOTP-backed logins at odd hours from a machine that never installed anything. And when something does go wrong, the audit export is the feature you will wish your own tooling had copied.
Now published: the 225 KB budget — what the core carries, what moved to the depot, and how a module arrives.