Administration
One console for every product. A systems administrator does not want five consoles.
Re-derive a health reading
Paste a health document from a /healthz endpoint. This page re-derives 6 of the 10 alarms from the document’s own fields and reports any disagreement with the alarm list the document carries. It writes nothing, resolves nothing, and reaches no network.
What an administrator may not do from here
There is no status light and there will not be one. A single word summarising health is the field an operator learns to watch and stops reading.
There is no control that corrects a meter, raises a limit, resolves an alarm or stops sealing.
The alarms this engine can raise
Parsed from 03-source/lib-memory/lib/memory/health.js at build time, never typed. An alarm added tomorrow appears here the day it is added.
| Alarm id | Re-derived here? | Condition |
|---|---|---|
| no-health | yes | the document is absent or does not parse |
| ledger-unreadable | yes | ledger.error is present |
| registry-expired | yes | registry.expired === true |
| registry-pre-root | no | a conjunction of fields. A conjunction re-implemented in a page is a second implementation of the engine’s rule, and this register refuses a second implementation of a rule. |
| audit-sink-dropping | no | a conjunction of fields. A conjunction re-implemented in a page is a second implementation of the engine’s rule, and this register refuses a second implementation of a rule. |
| audit-sink-uncounted | yes | audit_sink.dropped === null |
| durability-detached | no | a conjunction of fields. A conjunction re-implemented in a page is a second implementation of the engine’s rule, and this register refuses a second implementation of a rule. |
| writer-lease-lost | no | a conjunction of fields. A conjunction re-implemented in a page is a second implementation of the engine’s rule, and this register refuses a second implementation of a rule. |
| durability-unknown | yes | durability.durable === null |
| harness-red | yes | harness_exit is a number and is not 0 |
The register these products share
| Shared surface | Provided by | Consumed by |
|---|---|---|
| operator-console | Corobate | Stock Risk Receipt, AttestedAssets, PaymentVerification, TellmeTiresias |
| customer-service | — | — |
| schema-migration | — | — |
A finding this console reports about its own register.
check-separability.js verifies the graph shape and that each declared surface directory exists. It never asks whether a declared capability has an implementation. AUDIT-PACK/check-capability-implementations.js now does, and the honest number is larger than the one anybody had noticed.Declared capabilities with no implementation
Derived from AUDIT-PACK/capability-implementations.json, reconciled against the 31 capabilities PRODUCTS.json declares. An exemption is not a pass — it is a debt with a date on it.
| Capability | Exempt since | What actually exists |
|---|
Cited to code, with a note
| Capability | The note |
|---|---|
| edge-detection | Constants and their comparison rather than a named function. Same caveat as the two above. |
| notification-projection | DECLARED 31 August 2026, AFTER BEING WIRED AND UNDECLARED FOR WEEKS. `notify.js` is required by the engine index and driven by harness §69 through `28-beta/build-notification-chain.js`, which calls `router.notify()` on two real sealed receipts. It has no test file of its own — its coverage is that driven section plus `10-ally/test/ally.test.js` — and that is recorded rather than smoothed over. IT WAS FOUND BY ACCIDENT: the principal corrected the scope of TellmeTiresias, named notification as one of its functions, and the search for it turned up a whole capability that no product declared. `check-separability.js` governs capabilities PER PRODUCT, so a module nobody declares is a module nothing can catch being forked — which matters here, because the delivered AttestedAssets and F08 estates each ship a `notify.js` of their own. THREE MECHANISMS THAT MAKE IT MORE THAN A MAILER: what was sent is a role-scoped PROJECTION whose digest is appended to the ledger BEFORE dispatch is attempted; a projection carries its own digest, deliberately different from the sealed receipt_hash, so it cannot impersonate the original; and a FAILED delivery is also a ledger entry, so there is no path where a notification silently does not happen. |
| operator-console | HALF REAL, AND THE HALF THAT IS REAL IS THE ENGINE'S. health.js raises ten named alarms and two HTTP surfaces serve them; 24-delivery/console.html re-derives two of the ten client-side and 27-console/dist/*/admin.html re-derives six. What does NOT exist is an operator console that reads a running system: 24-delivery/operator.html fills every reading slot with the literal string 'no value is read on this page', by design and with the design stated on the page. |
| support-boundary | RENAMED FROM `customer-service` ON 26 AUGUST 2026, DECISION D-03, and the rename is the point. What was declared was a support SYSTEM — a ticket, a case, an escalation state machine — and none of that exists. What DOES exist is one real, load-bearing, machine-enforced rule: no page whose audience is a support agent may carry a control that writes, checked over the BUILT pages by check-wire.js and again by 27-console/check-console.js rule C2. That is a genuine capability and it is genuinely consumed: it is the mechanism behind 'a verdict a support agent could change on request is a verdict nobody should rely on'. The prose pages, the terms clause and the 54-line playbook remain documentation, and documentation is not a capability. |
| trial-count-gate | The gate exists as a minimum-N constant and a sufficiency test that emits ABSTAIN: 'NOT_ENOUGH_DATA'. Same caveat as walk-forward-calibration: inside a page, no module boundary, no Node test. |
| version-selection | RENAMED FROM `schema-migration` ON 26 AUGUST 2026, DECISION D-03. Nothing in this tree upgrades a stored record from one schema to another, and the old name said it did. What exists is version SELECTION: a receipt carries its own sealed receipt_version and the encoder is chosen FROM THAT FIELD rather than from the reader's build, so a v1.1 receipt is re-derived under v1.1 rules by a v1.8 verifier. That is real, tested, and the reason old receipts still verify. It is not migration and it should not be sold as migration. |
| walk-forward-calibration | REAL, AND IN A PAGE RATHER THAN A MODULE. These are functions inside 22-f08/app.html, so nothing outside that page can import them and no Node test exercises them. PRODUCTS.json records this capability's estate as PENDING and calls it 'reportedly the component with the greatest distance from prior art, and currently protected by nothing'. A capability that exists only inside a page is a capability with no test and no claim. |
Compliance posture
27 controls across 4 catalogue(s), read from 17-compliance/controls.json. SATISFIED there means a mechanism exists, runs in the verification harness, and is pinned by a test that fails when the mechanism is removed — and PARTIAL carries its own instruction never to use it to mean “mostly”.
controls
27
SP800-53r5 · SP800-161r1 · SP800-218 · AI-RMF-1.0
satisfied
21
mechanism runs in the harness and a test fails when it is removed
partial
5
never used to mean “mostly”
titles unverified
17
offline, NIST’s exact wording cannot be confirmed — counted, not hidden
Corobate · standalone install · one product · built by 27-console/build-console.js from the register, not typed.
This page loads nothing from another origin, makes no request at run time, and touches no browser storage. It works from a file on disk with no server.
Nothing in this console is legal advice.