| surface | vertical | purpose | link | access | origin | health | functional | freshness | port |
|---|---|---|---|---|---|---|---|---|---|
| finview | insurance | insurance operator | open ↗ | gated | vm | up | unknown | — | 8000 |
| bankview | banking | banking operator (real banklib engines) | open ↗ | gated | vm | up | ok | — | 8011 |
| energyview | energy | energy operator (energylib / M-431) | open ↗ | gated | vm | up | ok | — | 8012 |
| tenk2win | all | inverse-model intelligence (3 verticals) | open ↗ | gated | vm | up | ok | fresh 1.4h | 8001 |
| strata | all | structural maps + /terminal | open ↗ | gated | vm | up | ok | unknown | 8002 |
| tenkviz-preview | all | multi-vertical PUBLIC-data preview | open ↗ | gated | vm | up | ok | — | 8023 |
| tenkviz | all | public-data tenkviz surface (10-K/SEC cards — public data only) | open ↗ | public | edge | up | ok | — | — |
| modelrisk | platform | the command center (this app) — now a live dynamic service (D066) | open ↗ | gated | vm | up | unknown | — | 8003 |
Access: most surfaces are behind Cloudflare Access (the gated ✓ is a config property, asserted not re-probed); a surface marked public is intentionally un-gated and shows public data only (tenkviz.com, the public-data tenkviz surface — the public-data-only IP boundary holds). Every surface is gated XOR public — none is accidentally exposed. Origin: a vm surface is probed by systemctl + loopback; an edge surface (CF-hosted, no VM service) is probed by a public GET on its origin. Health is probed at snapshot time: a surface reads up when its systemd unit is active or a loopback/public GET returns 200; a down surface renders red and is never hidden. modelrisk has no VM service — it is the command center itself (CF Pages), shown as self. Freshness (G0): liveness ≠ freshness — a surface that is up but whose data store is past its ceiling (or whose maintenance timer failed) reads stale (red), never green. A surface with no store to watch shows —. Functional (G3): liveness ≠ data — each surface's functional probe GETs a real endpoint that must return SANE content (an /api row count > 0, a known firm renders); an up-but-empty surface reads degraded (red), never green. A surface with no functional probe shows —.