Methodology

How a record gets in

Each of the 55 feeds has an adapter that knows its publisher's shape, cadence and licence, and adding a source means writing one adapter and one line in the registry. Adapters run in four cadence groups: three every five minutes, eighteen hourly, twenty-five daily, and nine heavier ones — satellite detections, port traffic, ownership registers — in a nightly slot of their own. Within a group the cheap and critical run first, so a slow provider at the end cannot starve the rest.

Every run is logged with what it fetched, what it wrote and whether it succeeded, and the adapter's state after its last run is one of seven words: live, degraded, paused, failing, needs key, idle, parked. Health counts only live as healthy — a source that delivered part of what it wanted is degraded, one the backoff has parked is paused, and one taken off the schedule on purpose is parked, which carries the date and the reason — and every state is shown by name in the Terminal, because a feed that stops quietly is the failure this system was built to make visible.

A record is admitted with, at minimum: a publisher and its licence, the publisher's own record identifier, one domain and one category, a severity, a timestamp for when the source published, a separate timestamp for when Vaethra first saw it, and wherever the source gives one, a location. Those two timestamps are kept apart on purpose — several sources publish hours to months after the fact, and conflating them would make a stale feed look live. The source's own numbers — magnitude, fatalities, megawatts, percentages — travel with the record unaltered.

One taxonomy, whatever the source

Every record from every source is mapped into exactly one of eleven domains and one of 82 categories, one severity scale and one confidence class — so a missile strike, a canal draft restriction, a flood and a subsea cable cut are comparable, filterable objects on one screen. A source that does not fit extends the taxonomy first. It never adds an axis of its own, and the graph and the simulator inherit every change without work.

Severity is a normalised 0-to-1 measure of operational consequence, not the source's own scale. Each adapter maps its native scale — Richter magnitude, an alert level, a fatality count, an outage in megawatts — into that band, so a filter of "at least high" means the same thing everywhere. It is labelled five ways, from info to critical.

Confidence is how far to trust the record itself, set from its source class (§3) unless the adapter has a better basis. Severity says how bad; confidence says how sure. They are never combined into one number.

Status is where a record is in its life — active, monitoring, resolved or historic — and is a state, not a judgement of importance.

Two ladders

Not all evidence deserves equal weight, so it is not given it. There are two ladders, because a record and a link are different things.

Records: the source class

Assigned from the kind of publisher, not from the content, and visible on every record as a two-letter mark. Six classes, strongest first:

Class	Meaning
Official	Published by a government or intergovernmental body
Research	From a coded, peer-reviewed or research-grade dataset
Sensor	Derived from instruments — satellite, vessel or network telemetry
Model	Model output rather than a direct observation, labelled as such
Aggregator	Collected from upstream publishers
News	Press reporting — a lead to verify, not confirmed fact

The bottom rung is discounted heavily rather than excluded. A wire report is evidence, and pretending otherwise would leave the index blind on the first day of a crisis, when press is all there is. But one feed can emit tens of thousands of them a day and a corroborated source cannot, so in the pressure index an event known only from press counts for a fifth of what an event from any stronger class counts for.

Links: the method

Every link in the graph states how it was established, and the ladder has five rungs: measured, a published bilateral figure somebody else stands behind; structural, a rule asserted in the code; statistical, co-movement this system learned; documentary, a relationship a model read out of documents from two independent publishers; signal, a transient co-anomaly. When two rungs assert the same relation between the same pair, only the strongest stays live and the rest are marked superseded, not deleted — and the mark is recomputed in both directions on every rebuild, so a weaker link returns the moment the stronger one disappears. A statistical link carries a cascade only after a review has found a plausible mechanism for it, and a documentary link only after a person has accepted it; until then both are shown as evidence and are not walked by the cascade.

The same event, reported five times

One earthquake reaches us from a sensor network, two wire services and a national agency, and a single article can be coded into a dozen events. Counting them all would make the world look busier than it is, so records are collapsed by three literal rules a reader can check — no model, no embedding, no similarity threshold to argue with:

1. The same article, coded more than once. Applied to news-class sources only, because only they publish a distinct URL per report; an official feed links every warning to the same landing page. There is also a ceiling on how many reports one URL may carry, past which it is a landing page whatever its class claims.
2. The same source, the same headline, the same day.
3. The same physical incident from different providers. Two agencies publish independent solutions for one earthquake within minutes and within a few kilometres; the URLs differ and the headlines differ, but the place and the time are the identity. Applied only to four kinds of incident that stay put, with a distance and a time window tuned per kind and deliberately tight, because the loose end of this rule once read hundreds of distinct navigation warnings as one story. Tropical cyclones are excluded: they move.

The representative of a collapsed story is the most severe report, then the earliest seen. It carries the count of reports behind it; each of those keeps its own record, its provenance and its place in every export. Nothing is deleted. The collapse runs inside the database every five minutes.

Separately, and never on the path the feed depends on, a nightly pass compares the text embeddings of recent events and marks near-identical copies against the first report. The same embeddings answer "has anything like this happened before" and power the Terminal's search by meaning.

How the index is computed

Global pressure is a 0–100 reading of how loud the world is today. It is deliberately simple and transparent — evidence-weighted counts plus route stress — and it is not a prediction. Four choices shape it:

Only serious events enter

The index reads the last day's high and critical events. A critical event counts for four times a high one, so severity compounds rather than adds.

Evidence weighting

An event from any source stronger than press counts in full; an event known only from press counts for a fifth of that. This is the half that makes the number worth anything — without it the index was arithmetically a volume counter for the one feed that supplied nearly every high-or-critical event, and "severe" tracked how busy the news crawler had been.

Diminishing returns per domain

Each domain contributes on a square-root curve, so the index responds to the breadth of stress across domains rather than to the raw volume in any one of them. Ten domains mildly stressed reads higher than one domain screaming. The routes under watch add a term of their own, built the same way from the watchboard's stress scores.

Saturating, not clamped

The raw score is mapped through raw / (raw + K) rather than clipped at 100. A linear index pinned at maximum every day carries no information; the hyperbola stays responsive in the middle band and reserves the 90s for a genuinely extreme day.

The band, and why it is not an error bar

The honest uncertainty in this number is not sampling noise. It is a judgement: how much an uncorroborated press report is worth. So the index is published with a band that takes that one judgement to its two defensible extremes — discard uncorroborated press entirely, or trust it exactly as much as an official advisory. A reader who disagrees with the weight can read their own number off the range, and the width of the band is itself informative: a wide band means today's picture rests on press reports nobody has confirmed.

Routes and grids against their own normal

Ports, chokepoints and electricity grids are judged against themselves. There is no global threshold, and a route is never compared with another route.

A route — a port, a canal, a strait — is read from its daily transit history. The provider under-reports its newest days and revises them upward over weeks, so the reading skips the days still being revised and takes the median of the recent window, which a single missing day cannot move. A strait or canal is compared with the median of its last four finalised months, and a port with the median of the two to three weeks the provider published most recently. Those weeks and months can themselves sit inside a disruption: a strait that has carried a twentieth of its usual traffic since March has a four-month median that describes the closure, not the strait, and a port behind it a two-week median that makes it look too small to measure. So each route's recent median is checked against the same days of the year in every earlier year on record, and once the recent median would itself read as disrupted against that long-run level, the reading is taken against the long-run level instead. The ratio gives one of six levels: normal, elevated, strained, disrupted, critical — or unknown, which is what a route reads when its data is too old or its normal traffic too small for a ratio to mean anything. Unknown is reported as unknown; it is never dressed as critical, because a dead feed once read a busy port as a collapse.

A grid is compared with the same hour on the same kind of day — weekday or weekend — over recent weeks, because demand has a daily and weekly shape and "100% of the last three days' peak" is a description of an ordinary evening. "Eighteen percent above normal for a Tuesday at six" is a claim about the grid. A grid with too few comparable hours reads unknown.

Routes and grids are counted separately everywhere they appear, because a grid running hot is not a shipping route running below normal, and the two were once added together.

Finding stress before it is news

Every tracked numeric series — port calls, vessel speeds and stopped shares, river discharge, wind and wave, atmospheric columns, satellite dark-vessel shares — is compared against its own robust baseline. The mining runs inside the database every fifteen minutes over nineteen metric families, because that is where the whole history lives and a windowed comparison over hundreds of thousands of rows is cheap there; the public endpoint only reads the result.

Four gates keep the count honest. A significance gate requires the divergence to be large relative to that series' own variation. A size gate discards moves that are statistically striking but practically trivial — a route going from two transits to four is a doubling and is not news. A history gate requires enough baseline samples behind the comparison, with the minimum declared per family. A freshness gate, also declared per family, refuses to mine a series whose newest observation is older than the family allows: a reading older than that means the feed stopped, not that the sea went flat.

A signal's severity is built from the same three measurements — how unusual the move is, which is the largest term, how big it is, and how much history stands behind it — each scaled by a weight the family declares. A signal carries its direction, its z-score, the size of the move, its sample count, and the age of the newest observation behind it.

Nowcast and baseline. fourteen families describe conditions now. five describe a recent past window, because their instruments publish weeks behind; those are lead-only — they corroborate a trend and never fire an alert or drive a prediction on their own. Every family also carries a reliability tier, on the same 1-to-4 scale as an open-source sighting.

Signals are kept separate from confirmed events everywhere in the interface, because most of them amount to nothing and mixing the two would quietly convert speculation into record. Every signal the miner emits is also written to an append-only forward ledger, one row per series per day, which is the record validation is meant to be scored against as it accrues.

How a dependency is recorded

The graph is a directed set of links: from → to means "a disruption at from propagates to to", with a weight, a lag in days, and the method that established it. There are seventeen kinds of entity and twenty-five kinds of relation, and the layers are built by different means:

• Structural links come from rules over the registry: a chokepoint to the countries, ports and commodities that depend on it; a commodity to its consumers; a port to its country; an energy node to its commodity; a country to its region and its currency. One rule records that every economy consumes fuel, grain, fertiliser, medicines and chips, so a country absent from the published producer list of one of those is importing it — a deduction from published shares, applied only to commodities where non-production implies dependence. Another records that cargo diverts to ports in range when one closes, decayed by distance and the smaller port's capacity to absorb it; those links mitigate a shock rather than spread it.
• Measured links carry a published bilateral figure — who bought what from whom, in dollars — from trade and input–output statistics, with the year it was measured. They are never rescaled.
• Statistical links are learned from co-movement: series aligned to days, levels converted to symmetric daily changes, one series tested for consistently leading another. A link is accepted only with enough overlap, only when both halves of the history agree independently, only when the lead beats the same-day correlation and the reverse direction by a margin, and never between two series of the same metric — two ports that both dip every December correlate and establish nothing. The layer is rebuilt every three hours and is labelled as association, not cause.
• Documentary links are read from publisher text by a language model. A new entity needs repeated mentions before it is promoted; a relationship is promoted only when the model copied an explicit assertion from the text and both endpoints already exist in the registry, and it keeps the passage it came from.
• Signal links join two entities that were anomalous in the same window. The weakest claim in the system and the most transient: rebuilt from scratch every night.

A weight only means something relative to the other weights it is pooled with, so every layer declares what its weight is: a share of what the target relies on, a share of what the source carries, a conditional criticality, or a coupling. Only the first is normalised, and only the first is what the simulator consumes. A pass at build time detects a layer writing one kind of weight into a pool of another — the category error behind three rounds of past fixes — rather than silently rescaling it, because an automatic rescale was built, measured, and made the answers worse.

How a shock is walked

Atropos names a subject, applies a severity and works out what else stops. Four ideas separate it from multiplying edge weights along a path, which is the obvious method and the wrong one.

A link weight is not an exposure. What matters is not how strong a link is, but what share of the dependent's total dependence it represents. Normalising within the pool of links of the same relation into the same target is what makes a large diversified economy shrug and a single-supplier economy collapse from one rule. Measured links use their published share directly; an asserted share is damped when the pool is thinly mapped, so the one supplier the graph happens to know is not read as the only one that exists.

Not every relation transmits failure. A supplier failing propagates almost fully; a member of a sector failing barely moves the sector. How much passes on is a property of the relation kind — physical dependency strongest, financial and pricing couplings weaker, membership and location weakest. Some relations may not chain past the first hop, because a producer's output and a symmetric correlation would read as causal paths if allowed to continue. Substitutes and hedges are mitigations and are never walked.

Containment points the wrong way. Facilities, companies and ports point at their country. A forward walk from a destroyed country would reach none of its own infrastructure — the one thing certainly destroyed — so Atropos walks location backwards, only for containment, and only when the shock is severe enough that the container really is gone. Pricing relations are walked backwards for the same reason: a currency has no outbound links, and collapsing the dollar reached nothing.

Some coupling is not arithmetic. A shock to Taiwan does not reach the United States in proportion to chip imports; it reaches it through a standing commitment, and the result is not a shortage but a war. Those commitments engage only above a severity threshold — an invasion and a port strike are different kinds of event here — and what passes onward from an engaged guarantor is damped hard, because a country at war goes on exporting. The channel label stays on the path so the reader knows which kind of claim they are looking at.

Every hop states the relation it followed, the channel it used — dependency, demand, containment or security — the share it carried, the method behind it and the lag it added. Every impact reports its exposure, its significance (the entity's size against the median of its own kind, so a small refinery losing everything and a huge one losing a tenth stay distinguishable), the product of link confidences along its path, and the weakest method anywhere on that path. A contribution that falls below a floor is not carried further.

The default walk is six hops. That is a budget, not a claim about how far a shock travels: the walk is convergent on its own, because every hop multiplies by a share below one. A complete cascade is available on request and is bounded by work rather than depth — it always completes the hops a default run would, then spends its budget going further, and it reports whether it emptied its frontier (converged) or ran out of budget, and if so which budget. Nothing walks past 32 hops, where anything still moving is a pathology rather than a result.

How any of this is checked

The backtest asks one question: did signals precede confirmed events more often than chance? It is answered by replaying history point-in-time — reconstructing what would have been visible on each past date, using only what was known then — and scoring the result against independently sourced ground truth. Building it wrong is worse than not building it: a leaky backtest produces a flattering number that looks like validation. So the design refuses to score rather than produce a number, at every step.

• Ground truth is a separate ledger of confirmed events — the real event date from the source, the source, a reliability tier on the same 1-to-4 scale as a sighting — and machine-coded press is excluded from it as a claim rather than a confirmation.
• An event is attributed to a region by its type. A maritime region is a lane and claims events by distance, over water only; a land region claims only events inside a declared boundary, tested first. An event that fits neither is left unmapped. A gap is honest; a mis-attributed event is fabricated ground truth that corrupts every metric downstream.
• A signal is scored against events after it, within a horizon. Lead time must be strictly positive: a signal on the day of the event predicted nothing, and no horizon, however large, makes an earlier event scoreable. The count of point-in-time violations is published with every run and must be zero.
• Two null baselines are published beside every result. An always-flag baseline, which flags every single day; and a shuffled baseline, which scores the same signals in random order over two hundred draws. Beating always-flag says the signals carry more than the corridor's base rate; beating shuffled says their timing carries information.
• Below ten scored signals no rate is printed. The verdict says insufficient, and there is no parameter anywhere that suppresses a bad result. When flagging every day already scores so well that the test cannot discriminate, the verdict says uninformative. When no qualifying signal fired in the window, it says no evidence.

The verdict is written once, by the harness, in five forms, and every surface reads the stored verdict rather than recomputing it — a summary that re-derives the thing it summarises is a summary that can disagree with it, and this project has done that twice. The published record on /record is a deliberately pinned run rather than whichever corridor finished last. At the date above the ledger holds 24 runs over 6 regions, of which the harness counts 0 as demonstrating skill.

Atropos is tested by a different question: on the day a series moved, did the things the simulator named actually move? The shocks are found in the data — any day a series moved beyond a few standard deviations of its own recent behaviour — rather than curated, because a hand-picked list of famous events is a list chosen for consequences already known. Each run is scored against two null models: the same entities in random order, and the same entities ordered by how much they normally move. A model that beats random and loses to size has learned nothing except which entities are large.

What is measured about the system itself

Availability is sampled every five minutes by the scheduled run and kept for 400 days, read back as a daily rollup on /status. It is measured from inside the system: a total outage records no sample rather than a failed one, so a gap is shown as a gap and the expected-versus-actual sample count is published beside it. It is not a service-level agreement and is not allowed to imply one.

Integrity is a set of database checks, each written from a real failure that once returned healthy counters — a cursor incrementing while never advancing, a source restamping unchanged rows with the clock, a column null on every row so a filter matched nothing. They run hourly, and the count of open findings is published on the status page and in the facts endpoint. The scheduled work also writes a start mark and a completion mark, so a job killed mid-run is raised as down rather than passing as silent.

Published figures — feed counts, graph size, coverage, the accuracy record, the security posture, and the parameters on this page — are read by every surface from one keyless endpoint, each group labelled derived or measured. A figure this site states that disagrees with it stops the build.

Versions. Each system carries a published version — the Terminal 1.0.0, Atropos 1.1.0, the signal miner 1.1.0, the backtest harness 1.0.0, the API 1.0.0, and Oracle 0.19.0 until it ships — shown in each application and published by the facts endpoint. Every stored backtest run records the miner and harness versions active on the day it ran, so a miss under one version is never added to a hit under another, and a reader of the record can see which version produced a result. A major bump means the output means something different; a minor bump means the same method, better calibrated; a patch changes no output. The history is kept with the date each version began.

The constants

This page states every rule and every principle, and the numbers on it are read from the running system rather than typed. It does not state the calibration: the weight on each relation kind, the exponent that preserves a dominant supplier's lead, the damping on a security commitment, the impact floor, the signal thresholds and per-family weights, the distance and time windows of the proximity rule, or the similarity cut-off of the near-duplicate pass. Those are the tuned part of the method. They are versioned with the code, every change to them is reviewed and recorded, and a licensed customer can review them under its agreement.

Everything else here can be argued with, and should be. If a sentence on this page describes something the software does not do, that is a defect, and we want to know.