Operator Manual

$ man sapphire

EACH_TAB

tab	route	what it shows	data source
Brain	/p/brain	public-safe cross-silo synthesis: health 0..1, regime, narrative, degraded silos	`/api/brain/synthesis` summary
Markets	/p/markets	top 10 crypto by mcap, sparklines, total mcap, BTC dominance, 24h change	CoinGecko (60s cache)
Threats	/p/threats	live CVE feed, 30d severity stack, public prioritization labels	`/api/threats/live` public summary
System	/p/system	public system summary plus admin lock states for raw telemetry	`/api/silos/health` summary
Hackathon	/p/hackathon	4 submissions: 0G APAC, MegaETH, Robinhood London, Zama	hack.sapphirealpha.xyz (fallback: baked-in)
Wildfire	/p/wildfire	public alert map + KPI strip + Phase-0 status	wildfire public health summary
THO	/p/tho	retail-brand info card → OPEN OPERATIONS CONSOLE	tho.sapphirealpha.xyz `/healthz/`
Regional	/p/regional	configured regions, public-safe intel sample, status link	regional public health summary
About	/p/about	manifesto, comparison vs Bloomberg/Glassnode/Recorded Future	static (Sapphire README)
Help	/p/help	this page	static

KEYBOARD_SHORTCUTS

key	action
`g h`	go home (shell)
`g b`	brain
`g m`	markets
`g t`	threats
`g s`	system
`?`	this page
`esc`	back to home shell

// shortcuts wired by the home shell — sub-pages support [< back] crumb at top-left.

DATA_PROVENANCE

Trading research. Signal, forecast, fill, and executor detail exists only in the admin surface. The public site shows market context and readiness labels without exposing operational paths.

Threat intel. The threat-intel service pulls CISA Known Exploited Vulnerabilities, NVD, MITRE ATT&CK, scores with EPSS + composite actionability, and exposes only the same-origin public summary at /api/threats/live.

Regime. Daily collector emits regime label (RISK_ON / RISK_OFF / TRANSITION), score, BTC dominance, fear/greed, average funding. We surface valid (non-UNKNOWN) rows + a staleness watermark.

Markets. CoinGecko free tier with 60s in-process cache (Cloud Run instances are ephemeral so per-instance cache is sufficient). Top 10 by market cap with 7-day sparkline.

Service health. Public pages show aggregate health counts only. Service names, hosts, latency, local runtime detail, and operational timeseries require admin.

USING_THE_BRAIN

Visit /p/brain — health score, regime, public narrative, and degraded silo names are at the top.
Narrative is a public-safe plain-English sentence per silo. It avoids raw service names, hosts, signal rows, and action instructions.
Priority actions expose only a locked state publicly; action text and counts require admin sign-in.
Correlations and persisted history match against deterministic catalogs, but those endpoints are admin-only.
Use /admin for persistence, history, correlation, and decision queues.

INTERPRETING

Regime. RISK_ON boosts long signals (×1.05), RISK_OFF penalizes them (×0.80) — see SignalEnhancer. TRANSITION is neutral. Score is in [-1, +1]; magnitude is conviction. Fear/greed is the Crypto Fear & Greed Index 0..100.

Threats. Severity ranks by CVSS bucket (CRITICAL ≥ 9.0, HIGH 7.0–8.9, etc.). KEV-tagged means it's been observed exploited in the wild — patch first. EPSS is the exploit-probability score in [0, 1] from the FIRST.org model.

Markets. Sparkline color: green = +24h, red = -24h. Mcap shows USD; BTC dominance is BTC mcap / total crypto mcap.