GOD MODE

How the console is organized, what every zone owns, and the rules every dial must follow.

The console is a single page: /MasterGodMode.html. Switching zones is a UI-level toggle; nothing reloads. All write actions hit the architect-gated /api/god/* namespace.

Dial doctrine. The Sovereign Console exposes 71 platform-flag dials at the time of this manual version. The live, authoritative list is rendered by Zone 5 → DIAL BROWSER (GET /api/god/dial-schema); the Platform Flags entry in Zone 5 names categories and representative keys. This manual is not exhaustive about every dial — it points you at the live browser.

Hardcoded parameters. Several economic/policy parameters live in code by deliberate architect decision and are NOT exposed as dials (product prices, the seat-transfer closure-invariant). These are documented inline at the relevant zone with their file:line and current value so the architect knows their real state. They are not gaps — they are intentional code-managed surfaces.

Live state of every system. No actions here mutate data directly — overview is the eyes, not the hands.

People, identities, tier control, founder slot management, defense actions per user.

Where money lives. War tax, override royalty, founder seats, B2B licenses, treasury.

Sentinel rules, bot spend ceilings, rate-limit overrides, defense events.

The foundation — platform flags, containment ladder, signed escalation gate, treasury internals, danger zone.

Cross-cutting index of the observability + admin panels shipped 2026-05-17 (F1 Stars · F2 Stories · F3 Activity Pulse · F4 Identity Cards · Rap Battle 6 · memory bridge · pg_cron). Each panel is documented in its proper zone above; this section is a feature-name index for discoverability.

One-page summary of every operator control. Reversible flag means: can be undone without database surgery.

Routes exposed under /api/god/* with no current UI wire. These are programmatic-only — call via curl, the AI Operator chat (tools), or a sidecar CLI.

Plain-English definitions for the technical vocabulary used across the console.

Trust Score

A 0.0–1.0 number computed every 6 hours that summarizes whether an actor (user, partner, api_key, bot) is behaving like a real, well-aligned operator. Drives auto-throttle and auto-revoke decisions. Lives in trust_snapshots; derived from append-only trust_events.

Signal Weight

The delta a single event applies to a trust score. Strong-positive = +0.300; mild-positive = +0.100; mild-negative = −0.100; strong-negative = −0.300; terminal = −1.000. 15-day exponential half-life decay.

Commit Credit

The currency that lets a user "commit" a parlay draft to lock its result. FREE tier gets 3/week. Architect bypasses.

Draft Slot

The visual board lane (1, 2, 3…) a parlay occupies before commit. Draft slots cap by tier. Commit moves the slot from draft → committed state. Locked = built but commit credit exhausted (upsell).

Auto-Revoke

Sentinel/Sovereign Defense action that automatically locks a B2B license when its trust_score ≤ 0.05. Sets licenses.status='LOCKED', writes license_audit_log, kills partner API access.

Append-Only

A database table that rejects UPDATE and DELETE via a trigger (RAISE EXCEPTION USING ERRCODE='insufficient_privilege'). The trail is permanent evidence. Examples: ledger, auditor_ledger, trust_events, containment_state_log, license_audit_log.

God Mode Dial

A mutation control in Zone 4/5 that flips a platform behavior (bot enable, spend ceiling, rate-limit override, trust score override, platform flag). All gated by Signed Escalation.

Ghost Clause / Ghost Layer

The schema-level enforcement of the architect's 5% royalty. A trigger on transactions table auto-fills the royalty when missing, OR silently force-pends the row if under-recorded. "Architect royalty is a law of physics in this system, not a line of application code."

War Tax

1% tax applied to qualifying transactions, pooled in war_tax_pool. Disperses to the architect on sweep. Enforced via enforce_battle_war_tax trigger with override metadata.

LEGACY_49

Founder tier 1 — slots 1 through 50 (pivot is FOUNDER_PIVOT = 50 at lib/seat_tier_resolver.js:14; slot 50 resolves to LEGACY_49). Subscription tier shipped at $49/mo via Stripe price STRIPE_PRICE_FOUNDER_49_MONTHLY. Pricing per slot range resolved by slotToTier().

SOVEREIGN_100

Founder tier 2 — slots 51 through 100. Subscription at $100/mo via Stripe price STRIPE_PRICE_FOUNDER_100_MONTHLY. FOUNDER_CAP = 100: slotToTier(101) throws.

SOVEREIGN_200

UI label only — NOT implemented. Referenced as a $200/mo tier for seats > 100 in routes/ai_operator.js:1152 + routes/architect_god_mode.js:4285. Resolver throws on slot > 100; no Stripe price env exists. Do NOT grant a slot > 100. See Zone 3 → SOVEREIGN_200 entry.

Dead Man's Key (DMK)

32-character break-glass key that lets the architect regain JWT auth even when normal login paths are broken (DB partial, ip-blocklisted, password unknown). bcrypt-hashed at rest. 5 failed attempts → key locks; only architect email or Telegram can issue a recovery sequence.

Sentinel

The 13-rule self-healing scheduler. Runs on cron, detects platform health issues, attempts auto-fix where safe (DB pool restart, Railway redeploy probe), escalates to architect Telegram for the rest. Rule 3 (redis_connection) is currently dormant — Redis disabled via REDIS_ENABLED=false; reconnect probe re-activates when Redis returns. The other 12 fire on schedule.

B2B License Tiers

STARTER / GROWTH / SCALE / WHALE — pricing + entitlement tiers for partner API access. Each license stamps a tier on every audit row.

Persona+

$4.99 / $14.99 monthly subscription that unlocks dual-persona AI (Cody AND RiRi) for non-LEGACY_49 users. LEGACY_49 founder tier already bundles both — Persona+ checkout 409s for LEGACY_49.

Context Injection

Per-parlay external-variables field. Architect or user attaches narrative context (injury / weather / fatigue / revenge / etc.); the commit-time engine parses signals and applies a probability delta before grade assignment. Persists across draft/commit/locked. Edit anytime via PATCH /api/parlay/context/:id.

Sovereign Flip Switch

The sovereign_flip platform flag (cody | riri) that determines the active web AI persona. Architect-only via Telegram /flip. Cody owns it — the command passes through his AI pipeline.

Containment Mode

Layer 3 of the Sovereign Lock doctrine. Three states: CLEAR → WATCHLIST → CONTAINED. Sentinel auto-escalates on persistent CRITICAL defense events. Only architect can manually reset.

Signed Privilege Escalation

The challenge/response gate every high-governance action passes through. Returns 202 + opens a 5-minute challenge row in escalation_challenges. Approve via TOTP from the PENDING ESCALATION vital card — enter the 6-digit code from your authenticator app.

Approved Via

Field on every auditor_ledger row written by the escalation gate: 'telegram' (bot path) or 'totp_fallback' (UI path). Names which channel authorized the action.

Cody Sleep

Autonomous nightly proposal subsystem. Cody reads platform performance + ledger activity during quiet hours, drafts dial-tune proposals, surfaces them for architect approval at morning. Auto-apply gated behind a 17-dial config cluster (cody_sleep_*) — OFF by default, whitelist-driven when ON. See Zone 5 → CODY SLEEP.

Phase 1 Visibility Suite

The observability + admin panels shipped 2026-05-17: F1 Stars Purchasable, F2 Sovereign Stories, F3 Activity Pulse, F4 Identity Cards, Rap Battle 6 audience streams, memory bridge, pg_cron unified health. See the PHASE 1 VISIBILITY SUITE section for the cross-cutting index.

Hardcoded Prices (managed outside God Mode)

Product prices live in code + the Stripe dashboard by architect decision and are NOT exposed as God Mode dials. Documented at Zone 3 → HARDCODED PRICES with file:line and current values: Persona+ Basic $4.99, Persona+ Premium $14.99, Voice top-ups $2.99/$7.99/$14.99, Backstage pass $4.99, Animated companion $4.99, Founder tier upgrade fallback $100. Changes require a code edit + redeploy and/or Stripe dashboard action.

TRANSFER_PLATFORM_FEE

The seat-transfer platform cut, hardcoded at 0.19 (19%) in routes/founder_system.js:575. Closure-invariant: 19% platform + 5% royalty + 1% war tax + 75% seller = 100% exactly. A dial for seat_transfer_fee_pct was explicitly rejected because changing the value without re-deriving the math invariant would silently desync the breakdown. Doctrine-locked NOT a dial.

REDIS_ENABLED

Env-var circuit-breaker at lib/redis.js:80-83 shipped in Fix A (commit 545c42a). When set to the literal string 'false', Redis client init short-circuits — no createClient, no infinite reconnect loop. Unset = enabled (backward-compat preserved). God Mode UI dial banked behind Combo World Phase 5. See Zone 5 → REDIS CIRCUIT-BREAKER.

Dial Browser

The live, schema-driven dial editor at Zone 5 → DIAL BROWSER. Renders all 71 platform_flags with type-aware editors, min/max bounds from lib/dial_schema.js, 🔒 indicators for signed-escalation-gated dials. Authoritative source for which dials exist + what their bounds are.

B-wave (B1 / B2 / B3)

Three-tier Sentinel threshold-scatter dial conversion completed 2026-05-26. B1: 5 count-type dials (min-samples + thresholds + batch limits). B2: 11 duration/window dials (SQL INTERVAL '1 X' * $N parameterization across 7 rules — unit-suffix doctrine locks _hours/_days/_seconds against multiplier). B3: 4 rate/lockdown dials (including the only rate-type Sentinel dial ai_fallback_rate_max). 20 of 22 banked threshold-scatter candidates wired; #19 severity-matrix dropped as architectural-choice-not-config; #22 ride-along auto-resolved via B1.