Public record
Sapphire Alpha is one person's lab for safe AI agents: tools that decide what may be published, watch whether systems are really running, keep agents from spending or trading outside hard limits, and check agent work before anyone is paid. Everything here is a prototype or research.
Sapphire Alpha is a name shared by separate repositories. This page describes each one from that repository’s own files. It does not run them, and it does not say whether any of them is available.
The work
Decide what may be published. Watch whether systems are really running. Keep agents from spending or trading outside hard limits. Check agent work before anyone is paid.
01
Warden decides which vault notes may ever be published. Unclassified is secret, never public. Provenance inventories local actors and scores them. A missing source is reported as unknown. Sentinel stops an unsafe decision before any wallet signature or order submission.
02
Atlas is one read-only surface over every lane. Atlas asserts nothing it did not observe. Unknown is never a green light. Witness watches from hardware that is not the thing it observes. An empty window is unknown, never healthy. Dashboard and Nexus are separate observing repositories.
03
As of . Historical snapshot, not live.
Agentic is the automated trading desk. An AI agent trades a small Robinhood cash account under the risk limits listed on the trading page. Percentages only. Not investment advice. The page does not say whether the agent is running, and it cannot place an order.
04
AOX (Agent Opportunity Exchange). Lab prototype. A referee checks one agent's work for another before a simulated payment. Synthetic tasks only, testnet only. Read more at /aox.
The lab
Safety and publishing: Warden, Provenance, Sentinel. Observing systems: Atlas, Witness, Dashboard, Nexus. Research: Librarian, AOX. Historical snapshot: Trading desk.
Safety and publishing
Decides which vault notes may ever be published. Private source.
Inventories local actors and scores them. Unknown is not safe.
A policy, privacy, and payment safety firewall. Public file, pinned.
Observing systems
Research
Historical snapshot
Agentic, a small cash account inside hard risk rails. Percentages only.
As of . Historical snapshot, not live.
Automated desk · historical snapshot
As of . Historical snapshot, not live.
Agentic is the automated trading desk. An AI agent trades a small Robinhood cash account under the risk limits listed on the trading page. The page shows return versus deposits, the S&P 500, drawdown from the peak, win rate, cash share, options share, and the kill switch from that snapshot. Percentages only. Not investment advice. The page does not say whether the agent is running, and it cannot place an order.
Research · lab prototype
AOX (Agent Opportunity Exchange). Lab prototype. A referee checks one agent's work for another before a simulated payment. Synthetic tasks only, testnet only. Read more at /aox.
Each description stops where its files stop.
Evidence manifest: public file pins and private-source status
Sentinel, Nexus, and Dashboard each link to one public file at a fixed commit. Warden, Provenance, Atlas, Librarian, and Witness are source private: this page has no link, commit, file path, or file digest for them. The words on this page are the public record. GitHub archive flags below were observed on 2026-10-13. An archived repository is still described from its files. Archive status is not a liveness claim.
Lane = one ongoing project. Vault = the owner's private notes. Fails closed = when in doubt, it says no.
Safety and publishing
Source private.
Decides which vault notes may ever be published, and builds the library from the ones that may.
Unclassified is secret, never public. A note is public only because a rule affirmatively says so. Absence of a secret signal is not evidence of safety. Secret rules beat internal rules regardless of order. A verdict names the rule id. The matched value does not appear.
Redaction can mask incidental infrastructure detail. The masking patterns are the detection patterns. A redacted note is classified again before it is trusted. A note that is about a secret stays withheld. Client and employer work is withheld even when none of it is secret, including a note that only mentions it in passing.
The README records one measurement over 1,275 notes: 351 publishable, 3 of those with redactions, and 924 withheld. The largest withholding reasons it records are agent-memory (239), affiliation (231), path-not-public (144), and trading-area (97). It also records that an early token rule had no left word boundary and withheld 17 notes the README describes as legitimate.
Safety and publishing
Source private.
Inventories local actors and scores them. The source reads MCP server configuration, editor hook settings, git hooks, and launchd jobs. Each actor has a kind, a name, a redacted command, a source, an enabled state, a risk, and a reason.
A missing, unreadable, or unparseable source is reported as unknown. It is not skipped, and unknown is not treated as safe. Secret-shaped arguments are omitted from the recorded command. A remote entry keeps the transport and hostname, not the path or the query string.
The source scores a command as critical when the name or command mentions robinhood, trade, wallet, order, payment, transfer, send-email, resend, twilio, deploy, or dns. It scores a shell, curl, or wget as high. Otherwise the score is medium. The score is unknown when the command cannot be determined.
Safety and publishing
sapphire-sentinel README @ 12aa231bd6af5927e2b664fe5e471fa2ca445015 · GitHub archive flag observed 2026-10-13: archived
The README describes a policy, privacy, and payment safety firewall for AI agents in tokenized RWA finance. It gives agents a bounded mandate before they can buy paid intelligence, touch tokenized-stock workflows, or draft market actions.
It checks domain allow-lists, spend limits, quote binding, prompt-injection language, secret-egress risk, contract-level receipt replay protection, and privacy commitments first. Safe decisions produce hashed receipts. Unsafe decisions are blocked before any wallet signature or order submission.
The README’s safety defaults say testnet and paper-only, no live orders, no secret reads, and no real funds or custody. It says live settlement stays disabled unless an env-gated testnet mode is explicitly added, and that the registry contract has no withdraw, transfer, or value-moving path.
Observing
Source private.
One read-only surface over every lane, and the queue of things only the owner can clear. Atlas asserts nothing it did not observe. Every value records its source and the time it was collected. A value it could not collect is unknown, with the cause attached. Unknown is never a default, a zero, or a green light. One unknown component makes the whole lane unknown.
Each lane keeps a declared half, written by a human, separate from a derived half that Atlas collects. A lane is live only when an external liveness signal is both declared and observed. The README says recent commits show that work is happening, not that anything is running.
The README says Atlas reads repositories, open pull requests, a dispatch ledger, the vault, resident local models, a remote GPU gateway, loaded launch agents, and a frozen snapshot. It holds no credential and has no write path. It does not retrieve quotes, regenerate a brief, or ingest email. Public output is redacted before it is embedded, including home paths, private addresses, tailnet hostnames, and token-shaped strings. A separate mode reads one supplied observation bundle and does not collect.
The README records why: a dashboard once showed a lane as ready while the machine was unreachable, because the status had been copied from a plan document.
Research
Source private.
A local research librarian for a vault of notes. It finds notes that lack references, fetches real sources, and attaches them with provenance. It runs on the owner’s hardware. Retrieval uses two keyless public APIs. Judgement uses the vault’s own local embedding model. The README says nothing leaves the machine except the searches themselves.
It attaches verbatim excerpts with URLs, retrieval times, and content hashes. It does not generate prose. Dry run is the default. It appends sections and does not overwrite existing prose. It does not mark a note finished. The README says that is a human judgement. If the local embedder is unreachable, the cycle writes nothing.
The README records a measurement on 2026-08-19 over a 1,296-note vault: 853 notes were still marked seed, and 202 of 204 sampled notes had no Sources section. It also records three failures from building it: an index can answer when nothing is relevant, ranking by need selects stub notes, and shared words are not the same as being about the same subject.
Observing
sapphire-nexus README @ fa27ae143855ccd9055bd604c75d00287c4fb8ce · GitHub archive flag observed 2026-10-13: archived
The README describes a local-first intelligence kernel for AI, quant research, and runtime evidence. It provides an operator workbench, typed API contracts, and adapter readiness checks. Risky lanes are disabled by default.
The README says public mode disables private local adapter probes and returns hardening headers. It stores metadata, hashes, summaries, and provenance. It does not store raw private payloads. Live trading, Telegram sends, wallet signing, and secret handling are disabled by default.
Observing
Source private.
Independent lane observation. It runs on hardware that is not the thing it observes. The README gives three rules. A verdict comes from a window, never one sample. An empty window is unknown, never healthy. If the witness cannot reach any control target, that sweep is blind, not down.
It has no authority. It opens no control-plane connection, holds no credential for anything it probes, and cannot route, dispatch, or change a disposition. Its receipts are advisory.
Observing
sapphire-alpha-dashboard README @ a4ee786a46d6f4990f2d3e112ac4b589e0dd248b · GitHub archive flag observed 2026-10-13: archived
The README documents two surfaces it says were shipped together: an evidence observatory and a decision observatory. It says the application has no trading or infrastructure actuation routes. Missing sources render as not observed, warming, stale, or offline. The README says they are never rendered as synthetic market activity.
The README says public telemetry can include semantic roles, status, measured load, freshness, latency, and measured link activity, and that an unobservable rate is null rather than zero. It says the projection rejects hostnames, addresses, ports, endpoints, paths, credentials, prompts, wallet or account material, balances, positions, orders, raw errors, and unknown fields.
This website is not that application. The page you are reading is the static site in this repository.
This site is a static, read-only HTTP process for sapphirealpha.xyz. It serves this page, the trading desk page, and a small set of public files. It has no forms, accounts, or controls. A separate private system (Kadima Control) is the only thing allowed to change anything; this site cannot. This site is not a control plane.
The health routes report only that this process answered. They do not report the systems above, a fleet, or a model.
As of . Historical snapshot, not live.
The trading page shows that snapshot. It does not say whether the agent is running, and it cannot place an order. GET and HEAD are the only methods. Other methods are rejected. Unknown paths are not found.