# Cursors Operations

Cursors Operations is a real Open MCT console for watching cursor transport machinery. The browser joins WebTorrent metadata planes, reports WebRTC peers and HTTP webseed paths, and downloads no payload until an operator explicitly asks for a one-piece integrity probe. A separate native observer can add normal BitTorrent, TCP, µTP, DHT, and optional WebRTC telemetry without pretending those transports exist in a browser.

The console now keeps six levels explicit: world/intent, signed cursor history, capability authority, signed Caravan discovery, encrypted swarm availability, and current bodies/transports. A torrent row is a transport source, not a cryptocursor. A connected peer is a byte path, not an identity or capability.

The visual system begins with the ATLAS field-console language: dark smoked panels, phosphor instrumentation, segmented numerical readouts, topology lines that glow only when a path is live, amber operational cautions, and compact bounded cards. It is intentionally a generic Cursors instrument, not an ATLAS hardware replica.

## Begin in the territory netwalk

The cockpit is a stable, Self-centered territorial machine rather than a force-directed graph. Self / Body occupies the geometric center socket. The local signing identity, local mailbox, curve, fabric, observers, pointers, core, and browser memory occupy named nearby sockets; segmented trust, LAN, direct, relay, mailbox, storage/recovery, and unknown backplanes surround that hub. A retained radar sweep scans outward from Self. Circuit photons move only when this observer reports non-zero activity.

Peer locality comes from endpoint scope or explicit mediation. The native bridge classifies an observed endpoint before redaction. WebRTC without candidate/relay evidence remains **Topology Unknown**. See [Peer locality and territories](peer-locality.md) for the decision table and live inspection links.

Identities, mailboxes, cryptopointers, cryptofabrics, and curve spaces are real HTML controls positioned over the D3-managed canvas. That hybrid keeps the spatial feel of a canvas while preserving focus, labels, mobile taps, and ordinary click behavior. The body, its signing identity, and the invitation-scoped participant identity set remain separate; transport peers never masquerade as identities. Single-click any component to select it in Open MCT and open the detailed Circuit inspector. Double-click it to zoom into that machinery while Self remains available as a picture-in-picture return control.

The inspector answers four questions at every level:

1. What does this thing hold?
2. What can it exchange?
3. What is actually observed now?
4. Which curve-scoped mailbox channel belongs to it?

From there, **Focus + Self PIP** enters a deterministic component view, **Return to Self** fits the whole machine and selects the local body, **Details + Chat** deliberately opens the larger exchange drawer, and **Open guide** explains the object without requiring repository access. The larger details view can still pin the object, copy a view or trust-gated fork link, and host curve-scoped local chat. Browser back and forward restore selection, focus, and details state.

Cryptofabric selections add a circuit workbench with ingress, store, weave, and egress probes. Probe labels distinguish observed signals from configured, declared, planned, and unavailable paths. Carrier inventory, store inventory, admission policy, and trace/table actions remain attached to the selected fabric, while every probe states what transport evidence cannot prove about identity, authority, delivery, or execution.

`curso.rs` is only the host. The system and objects are Cursors, Cryptocursors, cryptopointers, cryptofabrics, mailboxes, and curve spaces.

## What is live

| Signal | Browser observer | Native bridge | Empty-state meaning |
|---|---:|---:|---|
| WebRTC WebTorrent peers | Yes | Optional | `0` means observed zero |
| CORS-enabled HTTP/BEP 19 webseeds | Yes | Yes | `0` means no declared/observed paths |
| TCP BitTorrent peers | No | Yes | `UNOBSERVED` until bridge connects |
| µTP / UDP / DHT | No | Yes | `UNOBSERVED` until bridge connects |
| Signed BEP44 directory heads | Telemetry only | Resolve, verify, decrypt | `UNOBSERVED` until bridge connects |
| Piece hashes and verification events | Yes, for selected probes | Yes | No simulated verification |

The browser cannot open arbitrary TCP or UDP sockets. A dashboard that claims otherwise is not a monitor; it is fiction. The native bridge keeps that boundary explicit.

## Public reference versus signed Caravan swarm

The Sintel swarm proves that the browser's WebTorrent observer, webseeds, trackers, peer wires, and piece verifier are live. It is deliberately public and provides no Cursors authorization.

A signed Caravan swarm starts from a private invitation. The native bridge uses the invitation's pinned Ed25519 key and salt to resolve a mutable BEP44 head, checks its minimum sequence and expiry, verifies an application signature, decrypts its AES-256-GCM manifest, and only then joins the magnet named inside. The manifest must declare encrypted payload bytes plus cursor and capability roots.

See [Signed Caravan swarms](signed-swarms.md) for the security model and publisher flow.

## Run the console

Use Node 20 or 22 because Open MCT 4.2 declares support through Node 22. The native bridge should run on Node 22 so WebTorrent's native WebRTC transport can install its supported binary.

```sh
npm install
npm run dev
```

The browser automatically joins the public Sintel reference swarm with `deselect: true`. This obtains live metadata and peer/webseed observations but does not select media payload. Add `?reference=off` to the URL to disable the reference join. The Sources panel also offers Big Buck Bunny as a second public reference on demand. Reference availability can change; neither source is Cursors authority or a durability promise.

Open MCT exposes each aggregate signal under **Cursors Operations → Live Fabric Telemetry**, so operators can open native telemetry plots and LAD tables in addition to the purpose-built operations surface. **Start a Guided Netwalk** is the first folder in the same tree and can restart locality, local-message, persistence, or resurrection tours at any time.

Under **Cursor Apps**, **Lua + SQLite Machine Lab** is an executable body instrument rather than transport telemetry. Its proof flight runs off the UI thread, then exposes the restricted Lua source, compiled continuation graph, SQLite body description, leased assertion, and transactional outbox readback. If the Open MCT shell itself is under diagnosis, `/cursor-machine-proof.html` opens the identical lab component directly. Read [the Machine Lab guide](cursor-machine-cockpit-lab.md) before treating a green result as evidence of general Lua execution or a completed external effect.

## Help and public guides

The cockpit has two explanation paths that share one vocabulary:

- Hover a small `?` to see the concise meaning of an instrument; click it for an Open MCT overlay with the full boundary and a route to the relevant guide.
- Open **Cursors Operations → Public Flight Manual** in the Open MCT object tree. Every guide is a first-class Open MCT object with a searchable library, category map, reading time, on-page outline, related-guide cards, and a copyable public deep link.

The guide source is bundled into the static site. Reading it does not require repository access, and the essential reading path never depends on a private GitHub issue. The Open MCT object action **Read Cursors Guide** also routes a telemetry point or Cursors object to its most relevant public explanation.

## Mailboxes, chat, and curve scope

Every inspectable object has a mailbox channel. In the public build, chat is a working local draft exchange backed by LocalStorage and BroadcastChannel, so same-origin tabs on this browser can see deduplicated envelopes. It is not advertised as signed, confidential, durable, or remotely delivered.

The masthead exposes the selected curve address. A local curve stays on this browser deployment. A relative curve creates a named child projection without changing identity. A meeting curve is derived from a sorted set of admitted key fingerprints plus an invitation nonce; it describes where invited participants agree to meet, not who they are and not what they may do. Changing curves changes mailbox scope and leaves old messages on their original curve.

The separate [opt-in Cloudflare service](cloudflare-service.md) is an undeployed extension for encrypted remote mailbox storage, settings, signaling, and opaque WebSocket relay. The committed configuration has remote mode disabled and no production route.

## Run the native observer

The bridge is intentionally read-only. It accepts no public source-mutation endpoint; operators supply an allowlisted JSON manifest at process start.

```sh
CURSOR_SOURCES_FILE=./bridge/sources.example.json \
CURSOR_ALLOWED_ORIGINS=https://curso.rs \
CURSOR_BRIDGE_HOST=0.0.0.0 \
npm run bridge
```

For invitation-scoped signed swarms, use a private invite file instead of or alongside public observation sources:

```sh
CURSOR_SWARM_INVITES_FILE=./private-invites.json \
CURSOR_ALLOWED_ORIGINS=https://curso.rs,https://spaceghost.github.io \
CURSOR_BRIDGE_HOST=0.0.0.0 \
npm run bridge
```

Optional controls:

- `CURSOR_ENABLE_DHT=0` disables DHT.
- WebTorrent's Node observer is hybrid by default: normal TCP/µTP/DHT plus its native WebRTC implementation.
- `CURSOR_PROBE_FIRST_PIECE=1` selects only piece zero and deselects it immediately after verification.
- `PORT` or `CURSOR_BRIDGE_PORT` changes the listener port from `8788`.

Terminate TLS in front of the bridge and enter its HTTPS origin in the console’s Operator view. A Cloudflare Tunnel is appropriate; a Cloudflare Worker itself cannot join TCP/µTP/DHT BitTorrent fabrics.

## Deploy the Open MCT surface

The UI is static and deploys to Cloudflare Workers Static Assets:

```sh
npm run deploy
```

`wrangler.jsonc` deliberately contains no native bridge binding. This keeps edge presentation and native network observation as separate, auditable trust boundaries.

## Agent map

- `operations/main.js` installs the real Open MCT shell and plugins.
- `operations/plugin.js` defines the Open MCT object hierarchy and live telemetry provider.
- `operations/transport-runtime.js` owns the browser WebTorrent observer, bridge polling, telemetry history, and no-fake-data semantics.
- `operations/locality.js` classifies only observed device/LAN/direct/relay/mailbox evidence and preserves unknowns.
- `operations/identity-vault.js` implements local Ed25519 custody wrapped by passphrase or compatible passkey PRF.
- `operations/view.js` is the interactive operations view provider.
- `operations/cursor-machine-lab.js` is the live restricted-Lua/SQLite Wasm proof instrument.
- `browser/sqlite-body-worker.mjs` owns the browser's writable SQLite connection and bounded body RPC.
- `operations/operations.css` carries the ATLAS/segmented/LCARS instrument language.
- `bridge/server.mjs` is the native read-only WebTorrent observer.
- `test/operations-helpers.test.mjs` protects transport classification, URL policy, and address redaction.

## Security and operational constraints

- Treat torrent manifests and peer networks as untrusted input.
- Treat invitation files and manifest keys as secrets; never commit or expose them through browser telemetry.
- A DHT or torrent peer is not admitted to cursor authority. Verify directory, payload, cursor, and capability layers independently.
- Do not expose bridge source mutation to the public Internet.
- Keep payload deselected unless an operator requests a bounded probe.
- Configure an exact CORS allowlist; do not use `*` on the native bridge.
- Remote peer addresses are redacted before the bridge emits telemetry.
- Webseed origins must permit range requests and CORS for browser use.