Inspector and Operator

Motebit ships two internal dashboards alongside the five user-facing surfaces. Both are React + Vite, both are private (BUSL-1.1), neither talks to the AI loop. They split on a single question: is this about one motebit, or about the relay's fleet?

Both surfaces invoke typed fetch() calls only — never construct prompts, never route through sendMessageStreaming. Surface-determinism doctrine applies harder here than anywhere; an operator console that takes user-shaped instructions is the wrong category for the audience.

Decision tree

The fastest way to pick is to phrase the question:

• "Why is this motebit doing X?" → Inspector. State, memory, plans, audit trail, conversation history — single-agent introspection.
• "What's happening on my relay?" → Operator. Withdrawals to settle, federation peers, transparency posture, disputes, fees collected, anchoring batches.

If the question begins "is this motebit…" it's Inspector. If it begins "is the relay…" it's Operator. There is no overlap by design — fleet-shaped panels were extracted out of the inspector in 2026-04-28 specifically so the audience boundary is sharp.

Inspector — single-agent introspection

cd apps/inspector
VITE_API_URL=https://relay.motebit.com \
  VITE_MOTEBIT_ID=<your-motebit-id> \
  VITE_API_TOKEN=<master-token> \
  pnpm dev
# → http://localhost:5174

Polls every 2 seconds. Backs off to 10s on consecutive errors. The connection-state dot in the top-right shows green when the relay round-trips successfully, red otherwise.

Operator — relay-fleet console

cd apps/operator
VITE_API_URL=https://relay.motebit.com \
  VITE_API_TOKEN=<master-token> \
  pnpm dev
# → http://localhost:5175

No VITE_MOTEBIT_ID — operator is fleet-scoped. Each panel polls on mount; failures surface as state, not throws.

Operational rhythm

Suggested cadence for an operator running relay.motebit.com:

Daily (5 minutes) — Operator only:

• Health — open the operator console; the Health panel is the default tab. The headline numbers tell you whether the relay is being used at all, and the partnership-vs-code signal tells you whether the next architectural pick is more code or more outreach.
• Reconciliation — second check. Green = ledger consistent, red = an invariant broke and money state needs investigation.
• Withdrawals — clear the queue. Each pending row blocks an agent; long-tail withdrawals are operational debt.
• Federation — eyeball peer states. Anything suspended warrants a check.
• Disputes — any opened or evidence rows need attention.

Weekly (15 minutes) — Operator + Inspector:

• Operator → Fees — confirm the by-rail mix matches your expectation. A sudden zero on a rail is an integration failure.
• Operator → Anchoring — confirm the on-chain anchor is keeping pace with batches. Persistent unanchored = chain submitter problem.
• Operator → Transparency — confirm declared and proven match. Drift here means doctrine has fallen behind code.
• Inspector → Gradient (per active motebit) — long-arc trajectory check.

On incident — both, in order:

1. Operator → Reconciliation — is the money state consistent? If no, that's the lead.
2. Operator → Freeze — if the lead suggests writes are corrupting state, hit the kill switch first; investigate after.
3. Inspector → Events for the affected motebit — chronological frame
4. Inspector → Audit — what the policy decided
5. Operator → Disputes — was a dispute filed?
6. Operator → Federation — is the relevant peer alive?
7. Operator → Receipts — for any contested settlement, look up the byte-identical canonical JSON and re-verify offline.
8. Refer to the operations runbook for the full incident-class procedures (rehydrate, identity backup, full reconciliation flow).

How to extend

New inspector tab — agent-scoped means: the data is per-motebit (the relay route is …/:motebitId/…). Add a relay route, a fetch* helper in apps/inspector/src/api.ts, a panel component in apps/inspector/src/components/, wire into InspectorApp.tsx nav + switch.

New operator tab — fleet-scoped means: the data is per-relay (/api/v1/admin/… or /federation/v1/…). Same shape, in apps/operator/.

If you find yourself wanting a tab in both, it probably belongs in neither — it's a category-confused panel. The records-vs-acts test from docs/doctrine/records-vs-acts.md usually clarifies which side it belongs on.

What these surfaces aren't

Neither is a surface for end-users. The five user-facing surfaces (web, desktop, mobile, spatial, cli) talk to a motebit through the creature; that's the medium for end-users. Inspector and operator are debug + administration surfaces, intentionally outside the creature metaphor.

Neither is a deployment target for the public. They run locally against a relay you operate; the relay's /api/v1/admin/* routes are master-token gated. If a third-party operator ever needs an operator surface, they run their own copy locally pointed at their own relay — same code, same routes, different operator.

Neither hosts a chat. There is no AI loop in either app, by design — surface-determinism doctrine forbids constructing prompts to drive operational acts. Every action is a typed call.