Control plane
view-only on the public domainChange something, and prove what changed. Every panel names its source inline; absent reads —, and a real zero reads 0.
01 · Throughput
canonical adapter user planeFabric unknown — the byte-rate cannot be labelled, because the adapter has not been scraped yet. Absent reads —; a real zero reads 0. The backend says what computes the physical layer; the fabric says what carries it. A sim or loopback byte-rate is never labelled a radio number. A sample is pushed to the trace only on a successful read, so use the freshness strip above to tell a flat line from a dead feed.
02 · Devices and UEs
control-api fabric: unknownThe RAN adapter has not been read yet. Nothing is asserted.
No fabric was named, so what any number here would be a count of is not established.
Read nothing further into it until the fabric is known.
Source not read yet
Where this number comes from, and what it is a count of. The top figure is the RAN adapter's own ran_attached_ues series, read once at /api/ran/metrics. The body is checked before a
number is taken out of it: it must be a Prometheus exposition carrying ran_backend_info, so a health blob from some
other service on the same port cannot become a UE count. If the check fails the panel says
Unknown and prints nothing.
It counts UEs. It does not count PDU sessions. One UE can hold several; the UE on this stack holds four. Four is a different quantity, it is
not shown here, and the two are never added. Sim load is a demand generator with no radio behind it, and is never added to
either.
03 · Spectrum sensing
tvws ResNet18 · 6-classResearch preview, not a spectrum-access authority. On the 28-channel UHF survey of
2026-08-04 (560 records, 10 occupied / 15 vacant, ground truth from measured physics) this
checkpoint detected 2 of 10 live multiplexes and called 48 of 300 vacant records occupied, at 0.93 to 0.99 confidence. With the
physics detector wired in — same unchanged checkpoint, one process, differing only in
whether a calibrated control floor is passed — that becomes 10 of 10 multiplexes and 0 of 15 vacant channels called occupied. Not clean yet:
UHF 28 still asserts OCCUPIED on 8 of 20 records, and that threshold was
not moved. This caveat used to blame the threshold for calibration on synthetic noise; a
measured receiver-noise null falsified that on 2026-08-05 — real receiver noise tops out
at comb z = 2.289 against the synthetic 2.19, and 0 of 300 records reach the 3.5 threshold. The firing arrives through the antenna and its cause is
now open: a genuine emission below the energy floor, which would mean the
ground truth needs revising rather than the detector, or front-end intermodulation. The
RX-gain sweep that separates them has not been run.
The earlier “40 of 80” figure came from a 2026-07-29
set that was entirely occupied, on which answering OCCUPIED
unconditionally also scores 80 of 80 — it measured no discrimination. Rollout is opt-in and
this service was not restarted: with no calibrated control floor configured the engine
falls back to the legacy CNN verdict and reports occupancy_source: cnn-confidence, so the occupancy shown
above is the classifier’s unless a floor is set. Model confidence is not accuracy: high
confidence has been measured on wrong answers, so the theta_sense = 0.85 gate does not
catch them. PAWS grant state is the authority.
04 · Mode and PAWS controls
mode-controllerForce locks the controller. Reset returns it to autonomous hysteresis (trace-driven). Degrade at —, recover at —, — transitions so far. Controller state: Awaiting the controller..
Disaster scenario: down drops the regulator; the waiver pre-authorises sensed channels. The state shown is read back from the database, never assumed from the button you pressed.
05 · Scenarios and subscribers
subscriber-simEverything on this card is simulated demand. None of it registers on a radio, and none of it appears in the real-attach figure in section 02.
06 · Stack lifecycle
control-apino job started
Allowlisted profiles only, confirmation required, and never down -v. The line above is the control API's answer, not an assumption about what happened.
07 · Diagnostics
inventory + prometheus targetsA service reported absent is not in the active profile, which is different from unhealthy. Absence is neither a pass nor a failure.
08 · Capabilities
control-apiThe capability register has not answered yet.
09 · Access
control-api/api/control/{whoami,users,provision,access,auth,esim}. Ki and OPc are never returned by the API and are never rendered here. Invite codes are
shown once.
10 · Service inventory
control-api The control API has not answered yet.| SERVICE | STATUS | CONTAINER |
|---|---|---|
| The control API has not answered yet. | ||
11 · Real UEs
ran-manager| ID | IMSI | KIND | IP |
|---|---|---|---|
| ran-manager has not answered yet. | |||
12 · Open5GS subscribers
Ki / OPc redacted| IMSI | KI | APN |
|---|---|---|
| The subscriber store has not answered yet. | ||
13 · Audit timeline
latest 10| TS | ACTION | ACTOR | TARGET |
|---|---|---|---|
| The access audit feed has not answered yet. | |||
14 · Logs
logs-proxyConnecting to logs-proxy…
15 · Terminal
opt-in /terminal/Operator opt-in. A web shell is remote code execution, so this panel does not dial out
on page load. The host wires ttyd at /terminal/; press connect to try it. A
failed probe here means the shell was never provisioned, which is absence, not a fault.