pub enum Command {
Show 52 variants
Help,
Quit,
Clear,
SwitchMode(ModeTarget),
Status,
Brief,
Risk,
HyperliquidStatus {
symbol: Option<String>,
},
HyperliquidAccount,
HyperliquidReconcile,
LiveCertify,
LiveCockpit,
LiveEvidence,
LiveReceipts,
LiveCanaryPolicy,
RuntimeParity,
Immune,
Quote {
symbol: Option<String>,
},
Regime {
coin: Option<String>,
},
Evaluate {
coin: Option<String>,
extras: Vec<String>,
},
Positions,
Pulse {
limit: Option<u32>,
},
Approaching,
Rejections {
coin: Option<String>,
limit: Option<u32>,
},
Kill,
FlattenAll,
PauseEntries,
ResumeEntries,
Break {
minutes: Option<u32>,
},
Execute,
ExecuteOrder {
coin: Option<String>,
side: Option<ExecuteSide>,
size: Option<String>,
error: Option<String>,
},
State,
Sessions {
limit: Option<u32>,
},
Resume {
needle: Option<String>,
},
Fork,
Heat,
Save {
label: Option<String>,
},
Replay {
needle: Option<String>,
},
Share {
needle: Option<String>,
},
Config {
action: ConfigAction,
},
Verbose {
action: VerboseAction,
},
StateOverride {
label: Option<StateOverrideLabel>,
},
Continue,
Close {
coin: Option<String>,
},
WrapOff,
CoachingReset,
DisclosureOverride {
confirmed: bool,
},
Rate {
trade_id: Option<String>,
rating: Option<u8>,
},
ZeroPrefix {
rest: String,
},
Auto {
action: AutoAction,
},
Headless {
action: HeadlessAction,
},
Unknown(String),
}Expand description
An operator command.
Variants§
Help
Quit
Clear
SwitchMode(ModeTarget)
Status
Brief
Risk
HyperliquidStatus
/hl-status [coin] — read-only Hyperliquid public info status.
This cannot sign payloads or place orders, so it is Neutral.
HyperliquidAccount
/hl-account — read-only Hyperliquid account truth.
HyperliquidReconcile
/hl-reconcile — local runtime versus Hyperliquid account reconciliation.
LiveCertify
/live-certify — dry-run live execution certification harness.
LiveCockpit
/live-cockpit — consolidated live readiness and breaker cockpit.
LiveEvidence
/live-evidence — hash-only signed canary evidence bundle.
LiveReceipts
/live-receipts — public-safe local live execution receipt bundle.
LiveCanaryPolicy
/live-canary — readiness, arm/disarm, and evidence qualification policy.
RuntimeParity
/runtime-parity — production-parity OODA report with live-shadow refusal.
Immune
/immune — risk-blocking immune and circuit-breaker state.
Quote
/quote <coin> — active paper quote source for a symbol.
This is read-only and cannot sign payloads or place orders.
Regime
Evaluate
/evaluate <coin> — fetch the engine’s gate-level verdict
for coin and surface it as a verdict overlay. coin is
required; a missing argument is resolved to the command
and the dispatcher emits a usage hint so the picker and
/help paths stay consistent.
extras preserves any trailing tokens the operator typed
after the coin (e.g. /evaluate sol short). The engine
endpoint does not take a direction — direction is a
property of the verdict, not an input — so extras are
only surfaced as a warning during dispatch. We keep them
here (rather than discarding at parse time) so the
warning can echo the exact tokens the operator typed,
which is more informative than a generic “extra args”.
Positions
Pulse
/pulse [limit] — stream the engine’s recent-events tail
(signals, rejections, state transitions). limit is clamped
client-side to 1..=100 by [HttpClient::pulse]. A missing
limit falls back to Self::default_pulse_limit.
Approaching
/approaching — coins within distance-to-gate of an entry
or exit trigger. No args; results come sorted by ascending
distance.
Rejections
/rejections [coin] [limit] — recent gate rejections. Either
argument can be omitted; numeric tokens resolve to limit,
non-numeric tokens to coin. limit is clamped to 1..=500
by the HTTP layer.
Kill
FlattenAll
PauseEntries
ResumeEntries
Break
Execute
Legacy bare /execute friction demonstration. Kept so stored
sessions and TUI friction fixtures remain decodable; real order
placement uses Self::ExecuteOrder.
ExecuteOrder
/execute <coin> <buy|sell> <size> — place an operator-approved
order through the engine. Malformed invocations are neutral and
render usage without forcing the operator through friction first.
State
Open the full-screen operator-state overview overlay (Addendum A §2.3). Read-only — opens a modal sourced from the engine mirror; the dispatcher itself emits no lines.
Sessions
/sessions [limit] — list recent sessions. Default limit is
Self::default_sessions_limit; the impl clamps higher
values to that ceiling so a stray /sessions 100000 does
not blow the conversation pane.
Resume
/resume <ulid|label> — append the prior session’s events
into the current log, silently (without re-persisting).
The argument can be a ulid (full or 6+ char prefix) or a
human label set via Self::Save. Missing argument is
resolved to the command and the dispatcher emits a usage
hint, keeping the picker path consistent with /evaluate.
Fork
/fork — start a new session whose parent_ulid is the
current one. Takes no arguments; the ulid is generated by
the session store. Rendered as a single “forked →
Heat
/heat — composite heat readout combining the
risk-summary percentages (drawdown / daily-loss /
exposure) with kill-switch + circuit-breaker state into a
single actionable “how hot am I?” line. Distinct from
/risk (which is a terse risk-only readout) because heat
folds in guardrail-proximity and circuit state so an
operator scanning for “am I close to a limit?” can get
that answer in one token. No args — heat is always the
current state.
Save
/save <label> — attach a human-friendly alias to the
current session. Labels are resolved later by /resume <label> so operators can name a session “pre-cpi” or
“scratch” without memorizing ulids. Overwriting a label
is allowed and intentional.
Replay
/replay <ulid|label> — paint a prior session into the
conversation log without switching to it. Identical to
/resume in every respect except that the SessionSource
adapter is not asked to rotate the active write target.
This is the path operators use when they want to study a
past session while continuing to record into the current
one; /resume implies “I am picking this up again”,
/replay implies “I am looking at it”.
/share [ulid|label] — render a shareable text snapshot of
a session (metadata + events) as a single command block in
the conversation pane. Argument is optional; when omitted
the current session is shared. The dispatcher emits JSON
wrapped in a fenced block so the operator can select-and-
copy without format drift. File / clipboard export is
deferred — a snapshot in the log is the minimal viable
share primitive and avoids host-I/O policy decisions.
Config
/config <action> — read-only introspection of the
operator’s on-disk config + secret-resolution state.
Intentionally read-only at this layer: write paths
(zero init, zero pair) already have dedicated
entrypoints and we do not want the TUI to silently
rewrite config.toml from a slash command. Missing /
unknown action resolves to a usage hint rather than a
silent no-op.
Fields
action: ConfigActionVerbose
/verbose [on|off|toggle] — toggle the TUI’s verbose
rendering mode. Today that means “include date +
seconds in log timestamps” instead of the default HH:MM:SS.
Future verbose-gated surfaces (full event payload dumps,
richer friction reasoning) will key off the same flag.
Argument grammar:
- bare
/verbose→VerboseAction::Toggle /verbose on→VerboseAction::On/verbose off→VerboseAction::Off- anything else →
VerboseAction::Unknownso the dispatcher can surface a usage hint. Silent acceptance of an unknown argument would make the command seem inert.
Fields
action: VerboseActionStateOverride
/state-override <label> — operator-declared override of
the engine-computed behavioural label. Risk-increasing
(see RiskDirection::Increases) because a healthier-
than-observed claim unlocks lower friction; the ladder
must still gate it so an operator declaring STEADY
while the engine sees TILT pays the full L2 typed-confirm
cost. Passing None is resolved to the command so the
dispatcher can emit a usage hint with the valid labels.
Fields
label: Option<StateOverrideLabel>Continue
/continue — acknowledge the most-recent coaching
notice and resume. No-op when no coaching is queued.
Neutral risk (pure acknowledgement).
Close
/close [coin] — close a single position. Per-coin
sibling to /flatten-all; risk-reducing, friction-
exempt at every state. coin is optional — a bare
/close resolves to the most recently actioned symbol
(when the positions model ships). For now the handler
surfaces a “pending positions model” line rather than
pretending to close anything — silence here would be
the worst possible failure mode for a risk-reducer.
WrapOff
/wrap-off — skip the daily wrap for this session only.
The next session runs the wrap again (per ADDENDUM_A §9.1,
the opt-out cannot be sticky). Neutral risk.
CoachingReset
/coaching reset — clear the rolling coaching notice
buffer. Neutral risk. Kept distinct from /clear (which
empties the whole conversation log) because operators
sometimes want to quiet coaching without losing the
decision trail.
DisclosureOverride
/disclosure-override --i-know-what-i-am-doing — jump
ahead in progressive disclosure. Risk-increasing: the
operator is defeating a guardrail designed to throttle
feature exposure to earned competence. The confirmed
flag carries whether the literal phrase was typed. A
bare /disclosure-override or a typo in the phrase
resolves to confirmed = false so the dispatcher can
emit a usage hint naming the exact words required —
silent rejection would make the command seem broken.
Rate
/rate <trade_id> <1..=10> — attach a conviction rating
to a past trade, feeding the operator-state classifier
and the eventual calibration overlay (Addendum A §10,
M1_PLAN §7a line 119). Neutral risk: a rating is a
self-report about a closed trade, not a position-change.
Parse semantics: the rating is an integer in 1..=10
(spec wording; the classifier’s event field is u8).
Values outside the range, non-numeric tokens, or a
missing argument resolve to rating = None so the
dispatcher can emit a usage hint citing the full range
— silently clamping to 1 or 10 would launder a typo
into a recorded conviction. trade_id is passed
through verbatim (it’s the engine’s opaque identifier);
an empty one resolves to None and the same usage path.
The handler is an honest stub for the engine POST half: the rating is journaled locally via the operator- state sink (so the classifier observes it deterministically on replay), and the pane line says “recorded locally; engine POST pending” so the operator never infers a silent server-side success. The engine-side POST lands with the rest of the ADR-016 operator-state writes.
ZeroPrefix
Operator typed a shell-style invocation like zero doctor
inside the TUI prompt. Carried separately from
Command::Unknown so the dispatcher can emit a targeted
“you’re already inside zero — did you mean /
rest is the whitespace-joined args exactly as typed, so
the hint can reproduce the operator’s intent verbatim
(zero --version → hint mentions /version,
zero alone → hint mentions no-command). The hint is
produced at dispatch time, not at parse time, so the
exact wording stays next to the other user-facing copy.
Auto
/auto on | off | status — toggle Auto mode, which
instructs the engine to take Plan-mode verdicts without
operator confirmation. Risk-increasing: flipping the
engine from a gated Plan posture to an auto-accept posture
unlocks engine-initiated position changes, the same kind
of exposure surface /execute opens. The friction ladder
gates /auto on exactly like /execute — a TILT operator
unlocking auto-acceptance at 2 AM is the canonical tired-
operator footgun.
/auto off and /auto status are Neutral — turning
the accelerator off is a risk-reducer-shaped action and
status is read-only. Risk direction therefore depends on
the action; Self::risk resolves it by inspecting the
AutoAction carried here. A bare /auto resolves to
AutoAction::Missing so the dispatcher can emit a usage
hint rather than a silent toggle — guessing the operator’s
intent at this much exposure would be an honesty failure.
Fields
action: AutoActionHeadless
/headless start | stop | status — spawn / stop / query
the operator-local supervisor daemon (ADR-006). The
command itself is Neutral: starting the daemon does
not take new positions (the daemon is a watchdog + kill-
switch surface), stopping it removes the supervisor but
does not touch live exposure, and status is read-only.
The CLI does not implement the supervisor; dispatch
routes each action through the crate::SupervisorSource
trait on [DispatchContext]. When no adapter is
attached (tests + --no-persist paths), the dispatcher
emits a single “headless supervisor unavailable” alert
rather than pretending. Unknown / missing actions route
to a usage hint — same honesty contract as /config.
Fields
action: HeadlessActionUnknown(String)
Implementations§
Source§impl Command
impl Command
Sourcepub const fn risk(&self) -> RiskDirection
pub const fn risk(&self) -> RiskDirection
Compile-time-style risk classification. const so callers
can match in const contexts (e.g. CI lints).
Sourcepub const fn default_pulse_limit() -> u32
pub const fn default_pulse_limit() -> u32
Default limit for /pulse when the operator omits it.
Chosen to fit comfortably in a scroll-less conversation
pane but still be meaningful; the HTTP layer clamps to
1..=100 so raising this later is safe.
Sourcepub const fn default_rejections_limit() -> u32
pub const fn default_rejections_limit() -> u32
Default limit for /rejections when the operator omits it.
Matches /pulse for visual parity; the HTTP layer clamps
to 1..=500.
Sourcepub const fn default_sessions_limit() -> u32
pub const fn default_sessions_limit() -> u32
Default limit for /sessions when the operator omits it.
Twenty rows is “everything I did this week” for a typical
session cadence; higher values make the pane scroll to read
the newest entries, which defeats the purpose of a listing.
Callers in dispatch clamp above this so /sessions 1000
still shows a tight, navigable list.
Sourcepub const fn max_sessions_limit() -> u32
pub const fn max_sessions_limit() -> u32
Hard ceiling on /sessions so a stray high value cannot
spawn a multi-page readout that hides the prompt.