Skip to content

Proof ledger

A claim is only as strong as its failure path.

This is the contract beneath the interface: how evidence becomes intent, where authority stops, what the system does when a check fails, and which details never enter the public surface.

Control lifecycle

Six gates from observation to record.

Intelligence may influence a proposal. It cannot erase a deterministic check, widen an authority envelope, or rewrite the receipt.

  1. 01

    Observe

    Collectors turn market, host, and chain state into typed snapshots. Missing data stays missing; it is never filled with a plausible number.

    EVIDENCE · Freshness and source state appear in the live desk.

  2. 02

    Form intent

    Research and models produce a proposal with a thesis, invalidation condition, horizon, and requested exposure.

    EVIDENCE · Intent is data. It has no execution authority.

  3. 03

    Validate

    Deterministic checks evaluate freshness, wallet scope, trade caps, daily caps, and the kill switch before any action can advance.

    EVIDENCE · A missing or failed check resolves to stop.

  4. 04

    Authorize

    The active operating mode decides whether a valid proposal needs explicit approval or may proceed inside a pre-authorized envelope.

    EVIDENCE · Mode never expands the envelope; it only narrows authority.

  5. 05

    Execute

    A separately provisioned worker translates the authorized intent into a bounded action. Models never receive private key material.

    EVIDENCE · The edge cannot originate an execution.

  6. 06

    Reconcile

    Receipts and resulting state are compared with the authorized intent. Divergence becomes an exception, not a rewritten story.

    EVIDENCE · Decisions remain attributable to the rule and evidence in force.

Authority

Operating modes are permission ceilings.

A mode changes how far a valid intent may travel. It never changes whether the intent is valid. The active posture and freshness belong in the live desk, not in timeless marketing copy.

Failure matrix

Failure is a state, not a surprise.

Every important refusal should be legible: the condition, the immediate response, and the only safe way forward.

Telemetry stale

Proposal cannot validate

Wait for a fresh signed snapshot

Signature invalid

Payload rejected

Rotate or repair the collector credential

Replay detected

Sequence rejected

Advance the signed sequence and investigate

Wallet outside scope

Execution blocked

No automatic remediation

Capital cap breached

Execution blocked

Reduce intent or change the envelope out of band

Approval missing

Proposal remains queued

Authorize explicitly or let it expire

Kill switch active

All execution stops

A deliberate reset is required

Receipt mismatch

Position is quarantined

Reconcile before another related action

Public read surface

Inspect the same projections the interface reads.

These are anonymous, read-only views. They expose state needed to understand the system while omitting exact capital, identity, key material, local paths, and executable authority.

safe public reads

$curl -s https://sapphirealpha.xyz/api/health# service identity and readiness $curl -s https://sapphirealpha.xyz/api/v1/live# typed architecture telemetry; nullable means unmeasured
GET /api/health
Service liveness
GET /api/build
Source, runtime revision, and shipped asset manifests
GET /api/v1/live
Typed architecture telemetry used by the Evidence Horizon
GET /api/v1/readiness
Exact inert-source and unavailable-runtime dependency state
GET /api/v1/moss
Privacy-bounded on-chain observer state
GET /api/v1/transparency
Capital and activity summaries with sensitive detail omitted
GET /api/v1/status
Sanitized control-plane and service posture
GET /api/v1/widgets
Compact, safe status projections for the live desk
GET /api/fleet
Aggregate leases, gates, and snapshot age
GET /api/v1/vault-map
A public-safe knowledge graph when a projection is available

Language contract

Working glossary.

These words have operational meanings here. Precision matters most where a vague synonym could imply authority that does not exist.

Intent
A structured request to act. It carries a thesis and limits, but no authority.
Authority envelope
The named wallets, instruments, actions, and capital limits an executor may not exceed.
Fail-closed
A control posture where missing, stale, invalid, or uncertain input produces refusal.
Projection
A deliberately smaller public view built from an internal record by an explicit whitelist.
Freshness
The measured age of an observation relative to the decision that depends on it.
Reconciliation
The comparison of authorized intent, execution receipt, and resulting state after an action.

Disclosure ledger

What is true today.

Scope stated

Shipped

Signed, replay-resistant telemetry

Ingest verifies the body signature, payload size, schema, and sequence before persistence. Anonymous callers receive a separate projection.

Source shipped

Fail-closed control contract

The source contract defaults to refusal. Runtime installation, credentials, broker reconciliation, and production execution remain unavailable until separately proven.

Shipped

Reproducible public measurements

Published counts identify what was counted, when it was counted, and the source revision. Nullable telemetry remains visibly unmeasured.

Withheld

Capital and identity detail

Exact balances, current holdings, wallet identifiers, hostnames, paths, prompts, and proposal bodies are absent from anonymous responses.

Not claimed

No public performance claim

The site does not publish a return, hit rate, uptime percentage, or execution-latency figure until the underlying measurement is fit to inspect.

Not claimed

No blanket security guarantee

Controls reduce defined failure modes. They do not make the system infallible, eliminate market risk, or replace independent review.

See the contract under load.

The ledger explains the rules. The live desk shows their current inputs, freshness, and public-safe state.

Open live desk →