Operator console
How a human watches and steers Invest while it stays inside its paper boundary. The console's panels, the single audited pipeline every knob change flows through, operator identity, and the Telegram bot that mirrors alerts and selected writes.
Watching a system that trades on its own
Invest runs unattended, but it is not unobserved. A Next.js operator console fronts a Python backend and gives the operator a live view of the paper book and the controls that bound it. This is operator tooling for a private-preview system: there is no public signup and no self-serve access, and nothing here changes the fact that Invest places paper orders only.
The console is deliberately split into two exposure tiers. The full console, with its write capability, lives on a private network. A separate read-only viewer is exposed through a Basic-Auth Cloudflare Tunnel for people who should see state without being able to change it. Both tiers look at the same underlying system; they differ only in whether the person looking can act. None of this widens access to Invest itself, which remains a private-preview system with no public signup and no product API.
What the panels show
The console groups its surface into panels: a kill switch, portfolio risk, strategy health, model comparison, decision quality, execution quality, and an approval queue. Alongside them, charts render options flow, the volatility surface and skew, payoff diagrams, Greek curves, and a risk heatmap. The approval queue pairs with escalation routes that can approve, reject, close a position, or disable a signal source, so a human decision has somewhere to land when the system asks for one.
One audited path for every knob change
Knob mutations do not write to Redis directly. Every change flows through a single pipeline: a confirm modal collects a reason and, for destructive knobs, a typed confirmation; destructive actions such as panic_flatten additionally require a one-shot nonce; the request then passes an allowlist and a bounds check; and finally the Redis write and the Postgres audit row commit together in one transaction. If any stage fails, nothing is applied and nothing is half-recorded.
Operator identity rides an X-Operator header that an environment allowlist gates. The console therefore knows who is acting, and the audit trail ties each mutation to that identity, the reason they gave, and the value that was applied.
Alerts and writes beyond the browser
A Telegram operations bot mirrors alerts and heartbeats so the operator does not have to sit in the console to notice something. It also supports selected knob writes, such as adjusting heat, and it displays the clamped value that actually took effect rather than only the value that was requested. The bot is a narrow front end over the same audited pipeline, not a side door around it.
For the controls the console exposes, see risk in practice. For the decision record the panels review, see the decision cycle.