Changelog

Oracle 0.19.0, and two more providers' forecasts kept as they are issued

• Oracle 0.19.0. Three questions are added: whether a strait running normally collapses within 14 days, whether a collapsed strait recovers, and whether a serious cyclone alert names a country within 30 days. The VIX, the Nasdaq and the 10-year breakeven are read two days behind, as their publisher posts them; earlier versions read them a day early. Every question was scored again on the same inputs as 0.18, and the seven these changes do not touch came out the same. The record now shows only the questions the production run asks, so conflict leaves it. Three questions beat both naive rules: a strait's collapse from normal, low river water and grid stress.
• European electricity: the day-ahead load forecast is kept. The grid operators' forecast for each quarter-hour of the next day, in six bidding zones, is stored with the time it was first seen, and its history from 2019 with the latest time the regulation allows it to be published. A test of it against the Oracle is registered and has not run.
• US rivers: the National Weather Service's forecasts are kept. Its official stage forecasts at the six river places, and at two neighbouring gauges where it forecasts only in high water, are stored with their issue times, so they can be compared with the Oracle's going forward.
• A volcano feed is paused. The Smithsonian's weekly volcanic activity report has sat behind a browser challenge since 3 October. It is shown as paused rather than failing; nothing is done to get past the challenge.
• Attribution. Where a forecast derived from the VIX is shown, Cboe is named as its source.

River data split by product, forecasts a customer can act on, and the engine's last control

• River data: the model's record and its forecast are kept apart. The GloFAS reanalysis (modelled discharge for days that have passed) and the GloFAS forecast had been stored under one name, so neither could be kept current without overwriting the other. They are now two series, and the forecast is kept with its run time and when it was first seen. The river record questions continue as version 3 on the reanalysis; version 2 is kept as registered, so its eight GloFAS places resolve as censored after July.
• An input built with later knowledge is no longer used. A conflict probability series made by an older model, trained on outcomes before they were published, fed two questions. It was withdrawn, and both were retrained without it. Every forecast now records any chosen input that has stopped arriving.
• Workspace: forecasts a customer can act on. Forecasts about places on an organization's map read as decision cards: what, where, when, how likely beside the registered baseline, the question's standing, data freshness and why it is shown. An organization can watch a place or a question at a level it chooses, see alerts in the Workspace and record what it did about them. Alerts are not sent outside the product. What customers record is never used to train the Oracle.
• The Workspace and the staff dashboard deploy from the pipeline, after a test of their write paths against the real database, rolled back, on test organizations only.
• The engine's last suspended control passed. Registered before it ran, it checked whether the engine could predict outcomes shifted by whole years better than the same engine given only what such a shift keeps. It could not, in any of 26 runs. Eight earlier retrospective results stand again as retrospective results. No question is promoted by it.
• A market forecast is recorded beside the Oracle's, privately. For crude oil and gold, the options market's own expectation of volatility did better in testing than recent volatility. It is now recorded at every issue, from what was available at that moment, and shown to staff only: its data is licensed for analysis, not for publication.
• Done by hand. Two database changes were applied with the migration tool shortly before the pushes that carried them (00:26 and 01:06 UTC), so the site's published figures matched the database when it deployed. The pipeline then found them applied. The volatility history was loaded once (5,894 daily closes). Every deploy of the API, the Workspace, the dashboard, the forecasting service and the site came from the pipeline.

The Oracle's record checks more for itself

• Every forecast the API serves says what it may be called. A question is research until it passes its promotion tests, and none has. That is now on every forecast and every question the API returns, as it already was on the Oracle page, together with which baseline each forecast is set against.
• The database checks more of the record itself. It recomputes every score from the forecast and its outcome. It refuses a forecast made by a model of another question or another version, and one whose window had already closed when it was issued. It keeps the time each observation was first seen, even against a hand-written change.
• The Oracle page says only what the record supports. Its record covers thirteen questions. Twelve are asked every day; conflict is not yet among them, and its row is carried from version 0.04. The earthquake control ranks seismic countries above quiet ones, as a map would, and shows no skill at timing.
• Each forecast is set against the rule its promotion is judged by. A question passes its forward test only if it beats the stronger of two rules anyone could follow without a model: the usual places, and tomorrow like today. Until now each forecast carried only the second, which for most questions is the weaker. From 10 October every forecast carries the stronger rule's answer on the same question, chosen as the experiments chose it, and the record compares the two on the same forecasts. Forecasts issued before then are not compared.
• Deployed by hand. The Oracle's forecasting service was deployed with the emergency credential twice on 9 October (00:56 and 21:19 UTC), each time with the image the pipeline built and tested for that commit. It now records which image made each forecast and when its models were trained, and computes the baseline above. The API, the database changes and the site came from the pipeline. From 22:01 UTC that day the pipeline deploys the forecasting service too, with the image it built and tested, so it is no longer deployed by hand.

Oracle 0.18.0, and a forecast record that cannot be rewritten

• Oracle 0.18.0: the published record is the corrected engine's, and it says what earlier versions overstated. Some inputs had been read before they were published. The river questions read a model reanalysis up to seven weeks before it existed. The port and strait lists were chosen with later years in view. Some outcomes were learned from before they were known. With that corrected, two questions hold up against both naive rules, river low water and power-grid peaks, where 0.17 said four. The strait question, which the 7 October entry said still beat both rules, is not shown to beat a naive rule.
• The Oracle's daily forecasts are issued by a scheduled service. They had been made by a script on one computer, which stopped after 25 September. Each model is now checked before it is used, and each forecast is stored with the model that made it and a fingerprint of the data it could see. The first issue, at 22:57 UTC on 8 October, published 745 forecasts for twelve questions. They are resolved and scored as their outcomes become known.
• A forecast cannot be backdated, edited or removed. Each forecast is stored with an issue time inside the run that made it, and the database refuses one dated earlier or later. A forecast whose window had already opened is marked late rather than advance. A recomputed forecast is a new revision, and the record scores the first one published.
• The database keeps the first value of every observation. From 8 October it records when each stored observation was first seen and every later change to it. In the first hour it caught 80 European grid-load figures and 6 US demand figures revised after they were first published.
• Workspace: forecasts beside the dependency map. The Workspace lists the Oracle's latest forecasts for the places on an organization's map, each next to the existing exposure analysis for that place. The two are never combined into a probability of loss.
• Deployed by hand. The Oracle's forecasting service was deployed with the emergency credential three times on 8 October (19:19, 19:44 and 23:56 UTC), with its trigger secret set once, because the pipeline's credential cannot yet deploy containers. The image deployed each time was the one the pipeline had built and tested for that commit. The last one stops a weekend from counting as a failed run: the price questions are asked on weekdays only. The Workspace was deployed once (21:28 UTC). Every API deploy that day came from the pipeline.

Traffic against its long-run normal, and Oracle 0.17.0

• A strait or port is no longer read against a normal that has become its closure. Traffic was compared with the last 120 days for a strait and the last two to three weeks for a port. Six months into the Hormuz closure that normal was 5 transits a day, and the strait read 80% of normal. Each route's recent normal is now checked against the same days of every earlier year since 2019, and when it has fallen into a disruption the reading is taken against the long-run level: Hormuz reads 3% of normal and critical, and ports behind it, such as Jebel Ali, read critical rather than too small to measure.
• Oracle 0.17.0: the straits question asked against the same normal. The straits forecast's normal was the past year, which a long closure also becomes. It is now the past year unless that has fallen into a disruption, so the Red Sea diversion counts as a collapse for as long as it lasts. Asked that way, the record still beats both naive rules.
• Headlines are no longer filed by a word inside another word. Political stories that mentioned a conspiracy were filed as maritime piracy, and stories about couples as coups. Six rules now match whole words. The 83 stored stories that no rule now covers were removed and 8 were relabelled, with a record kept of each.

Atropos 1.1.0, and a relationship graph that can be checked

• A dependency map in the Workspace. A customer can keep their own facilities, suppliers, routes and products and what each depends on, edit and archive them with a reason, link them to their assets, bring them in from a spreadsheet and take them out again, and map them to the public entities they are. An exposure analysis then traces a public disruption through the public graph to the map and along the customer's own dependencies, says whether the answer is exact, and shows every step. The map is private to the organization and changes nothing in the public graph.
• Creating and editing in the Workspace work from a browser. Until 3 October the API refused, before they reached it, every edit and every create the Workspace and the staff dashboard sent from a browser: new keys, invitations, assets, role changes. Nothing was written and nothing was exposed; the requests were turned away at the door.
• A customer can withdraw what it published, with a second factor and a reason. The public record keeps the row with the date it was withdrawn, and no longer shows it as current. A customer can also rename the organization and give its assets their own attributes.
• Atropos 1.1.0. Three changes move its scores. A dependency inferred by a model, from co-moving series or from a news report, now carries a shock only once it has been reviewed; until then it is shown as an association and not walked. Every relation now means the same thing in the API, the Terminal and Atropos: a currency peg runs from the anchor to the follower and not back, a competitor's gain is counted against the loss, and a hedge or a substitute softens the impact instead of being counted as a casualty. And an answer no longer depends on the order the database returns rows in, which could give the same request different scores.
• The graph is published as a dated version every night, with a checksum, and compared with the previous form before any surface reads from it. Graph answers say which version they were computed alongside.
• A relationship read from the news carries a shock only once a named person accepts it. The decision is tied to the documents that person read. If the publishers or documents behind it change, the decision lapses and the relationship goes back for review.
• The relationship web opens by kind or by country. The Terminal's whole-graph view now opens on groups (17 kinds of entity, or 245 countries) with the links between them summed by kind of link, and fetches a group's members only when it is opened. Its first view is 2.6 KB over the network where it was 629 KB. Every entity at once is still one click away.
• Oracle 0.16.0: the ports record re-scored. Two of its port features had been built, for every year scored, from relationships the system only learned in August 2026. Scored again without them on the same port-days, average precision is 0.342 against 0.338. Every other question in the record is unchanged.
• Every impact, not only the strongest. The API can queue a cascade that walks every impact of one subject above a floor, against one fixed version of the graph, and page through the results with the evidence for each link. It runs in the background and survives the version it started from being replaced.
• Bounded answers say they are bounded. A request for every depth reports whether it reached everything; when a size or time limit stopped it, it says which, and where to continue.
• Graph answers come from the published graph. Impact, its strongest-first form and neighbour lists, the subgraph, the global graph, Atropos and a Workspace exposure now read the graph version published each night, and each answer names the version. Each was compared with the previous answer before it moved; one was moved back, corrected and moved again.
• A public placeholder nobody could attribute was withdrawn. One classified placeholder published on 9 September had no record of which organization or asset it came from, so no customer could withdraw it. It was withdrawn on 5 October on the owner's decision, kept in the public record marked withdrawn, with no owner invented for it. A standing check now reports any live publication without that record.
• The second-factor prompt says where its code comes from. It names the authenticator app the account set up and when, says the code is never sent by email, and says what to do without the app.
• Deployed by hand. The API was deployed with the emergency credential six times on 1 and 2 October, not from the pipeline, while this work was checked against the running system. The staff dashboard, which the pipeline does not deploy, was deployed with the same credential once on 2 October, on 3 October the Workspace three times and the staff dashboard twice, on 4 October each once more, and on 5 October each once. The pipeline's checks were run before each deploy.

The Oracle's accuracy record

• Oracle 0.14 publishes its accuracy record. A pre-release: fifteen questions asked every day, from port and strait traffic to power-grid peaks, river levels, hazards, markets, commodities and currencies, each scored on years its models had not seen and with every input read as late as it really arrives. Each question is set beside two rules anyone could follow without a model, given the same number of alerts; three beat both. The table is on the Oracle page and in the published-figures endpoint.
• Every day's Oracle forecasts are committed to a dated log before their outcomes are known, the record Oracle 1.0 will be judged on.

The deep-audit remediation, and two incidents

• Every system now carries a published version. Terminal 1.0.0, Atropos 1.0.0, signals 1.1.0, harness 1.0.0, API 1.0.0, Oracle 0.1.0 (not shipped). Shown in each application and on the facts endpoint; every stored backtest run records the miner and harness versions active when it ran, so results are compared version to version. The signal miner's threshold recalibration is recorded as 1.1.0.
• Enterprise rate limits are real. A second limiter binding holds an enterprise key to 6,000 requests a minute; Teams keys stay at 600; keyless callers are limited per address. The commercial page states the three tiers as they are enforced.
• Cloudflare's cookieless page counts are placed by hand on the site, the Terminal and Atropos, and nowhere else; the zone's automatic injection, which had reached the customer workspace, is off.
• The admin routes answer on one host only, the one Cloudflare Access covers, and the operating agent presents an Access service token there; the workers.dev hostname serves the public API and refuses admin calls.
• An external health check calls the API and the two products every thirty minutes from outside the system and emails the owner on failure.
• The methodology and the glossary were rewritten from the code. The old evidence table named five record tiers where the software has six source classes, the deduplication section described a rule the collapse does not use, and the glossary said "three channels" beside an entry listing four. Both pages now state what the code does, in twelve sections and 83 entries; every number on them is read from the published-figures endpoint, and the calibration constants are withheld on purpose, which the page says.
• Transport. Plaintext HTTP to the API had answered with the full body since launch; the zone now redirects every host to HTTPS, refuses TLS below 1.2, and verifies the origin certificate. Measured before and after; the claim checker now probes the handshake rather than reading a header.
• The database listener is no longer reachable from the internet. It accepts connections only from Cloudflare's address ranges and only over TLS. The customer plane is served on a connection that cannot bypass row-level security; the public record's connection still holds the owner role, and the trust centre now says so plainly.
• Incident: the nightly graph rebuild had not run for nine nights. The heavy scheduled job was killed for memory every night from 3 to 11 September while it built a 240 MB extract in one string, and nothing recorded it. The extract now streams, runs last, and every scheduled job leaves a start and a completion mark that the ops report reads.
• Incident: the map shipped without its worker. The MapLibre 6 upgrade on 11 September rendered a globe with no data layers for about twenty minutes; the library loads its worker from a file the build had not emitted. Found in a real browser, fixed, and the build now refuses to ship without that file.
• The export listing no longer enumerates storage. It had returned the coordinates of every cached satellite crop to any first-party request; it now lists four registered extracts and nothing else, with their age and a stale flag.
• Ground truth is growing again. The nightly import had timed out for five nights; it now walks a cursor in bounded batches every thirty minutes, and the corpus went from 100,023 to 144,986 confirmed events.
• The enquiry form's challenge is real, and enquiries reach a person. The token is sent and verified server-side; the operations mailbox was verified the same day, so enquiries and operational alerts are delivered rather than logged.
• Every figure the trust centre states is measured. Row-level security coverage, the function count, the keyless-path count, the migration count, the page count and each page's review date come from the running system or the repository at build time, and the build refuses a figure that has drifted. Several had: "51 tables" was 53, "77 functions" was 98, "five endpoints" was fifteen.
• The commercial page states no prices. Tiers and what each carries are described; a figure comes from a conversation, through the enquiry form.
• The compliance page says the audits have not started. The application is being built around the SOC 2 criteria and ISO 27001 Annex A; the audits are on the roadmap and no firm is engaged. The previous wording said an observation window was under way. It was not.
• Deployment moved into the pipeline behind the credential scan, the type check and the four test suites, with a scoped token that can deploy and nothing else.

Security, compliance and depth

• A full trust centre of eighteen public pages, covering architecture, access control, availability, recovery, incident response, vulnerability management, data protection and privacy, with control-by-control maps against SOC 2 and ISO 27001 and an executable Data Processing Agreement. See /trust.
• Database authorisation tightened to deny-by-default throughout. Row-level security on every table, and every database function reachable only through a secret-gated path with a fixed operation allowlist. (The secret-gated path was retired on 9 September in favour of pooled connections; see the entry above for where that stands now.)
• Licence classification for every data source. Each of the 55 sources now carries an explicit redistribution class, enforced in the application and independently in the database, and reported live at /api/v1/licences.
• Self-hosted typeface. Fonts are served from our own origin, so no font service sees a visitor's IP address. The only third-party scripts on any Vaethra property are Cloudflare's cookieless page count and the enquiry form's challenge, both disclosed in the privacy notice.
• Atropos shows the full depth of a cascade. An unlimited run now renders every hop it reached rather than the nearest few, so a five-hop chain is visible end to end.
• Operational alerting. Problems are recorded when they appear and again when they clear, with a daily summary; since 12 September the open set is published on the status page.
• ACLED and GDACS backfilled to 2015, adding 2.6 million conflict events and 55,000 disaster records to the analytical archive.
• Semantic search across the public corpus, as far as the embeddings reach. They cover about half of public events and the backlog drains twice a day; the coverage figure is one of the two standing warnings on the status page, published rather than rounded up.

Depth, accuracy and the archive

• Historical backfill across the whole source set. Port transits, seismic solutions, grid demand, storm surge, equities, sea ice, river discharge, macro indicators and commodity trade, most of them walked back to 2015.
• ERA5 reanalysis — 157 weeks of weather on every tracked chokepoint and site.
• EM-DAT country baselines for disaster exposure, and OpenSanctions listing history as a country-week series.
• Accuracy measured against ground truth. Backtesting compares every signal against a null baseline and publishes the result, including where the answer is that a signal shows no skill.
• The scoreable region set expanded from 21 to 37 corridors, with the evidence corpus behind them growing from 1,637 to 5,371 records.
• One page that answers "what is running, and what is not". Per-source health, scheduled job health and data integrity checks in one place.
• Uptime published at /api/v1/uptime, with sample coverage reported alongside it.
• The API became licensed and the apps stayed free. Programmatic access needs an issued key; the Terminal and Atropos still need no account, and the health, status and uptime endpoints remain permanently open.

Atropos, and the relationship graph beneath it

• Atropos. Break something — a strait, a supplier, a grid — and follow the recorded dependencies to what stops and roughly how soon. Its own site at atropos.vaethra.com, with a branching diagram, a world map and per-channel filters.
• Every edge declares what its weight means. Share-of-target and criticality are different claims, and both interfaces now show which one an edge is making.
• Graph layers: monetary, industrial, ownership and dependence, each walkable separately.
• Supply-chain seeding so the graph knows how things are made, and producer shares measured from observed volumes rather than assumed.
• Bilateral critical-minerals dependency from UNCTAD, measured in dollars, and an ownership graph streamed from OpenSanctions.
• Live AIS from Digitraffic, Sentinel-1 dark-vessel detection, and Global Fishing Watch SAR detections as their own layer.
• Physical-condition feeds — sea state, storm surge, sea ice, inland waterway levels, atmospheric composition — with somewhere to see them.
• Trade press and business news as a text corpus for relationship extraction, with model output labelled as model output throughout.
• The mission site, the API landing page and a shared design system across all three properties.

Foundations

• The Terminal. Every located disruption from the public feed set on one screen, each record carrying its publisher, its licence and both timestamps.
• The durable archive. Every event, observation, entity and edge streamed to a permanent analytical store and never pruned, which is what makes correlation and backtesting possible at all.
• The relationship graph — structural, organisational and causal layers, with entity resolution over vector search.
• Documentary and statistical extraction, turning published text and observed co-movement into candidate relationships that are then gated on evidence.
• The interactive map — country and entity layers, satellite basemaps, dependency graph overlay, and a simple view for reading at a glance.
• The daily brief and watchlist, so a returning reader sees what changed since they last looked.
• Automated test suite and typed codebase from the first week, run on every push; since 12 September the pipeline that runs them is also the deployment path.

Continuous, and it includes the corrections

The systems ship continuously rather than on a release schedule, so this page is grouped by period. Alongside the features above, each period included ordinary engineering work: performance, index and query tuning, source reliability, and corrections where we found something reporting a result it had not actually produced.

Material incidents are recorded here with the same detail as any other change. Service status is at /status, and the security programme is at /trust.