The operator console

The console is where the desk is run. Tokens, venues, pairs, spreads, and limits are settings here, not code, so the team changes them live without a deploy. It's a separate internal web app. Every change needs a written reason and is logged with the old and new value, who made it, and when.

What the operator sees and controls

The dashboard shows the health of every service, the status of each exchange feed, and live prices per asset per venue. The rest of the console is organized by job:

Area	What you can do
Emergency controls	Halt the whole desk, or lift the halt. Turn on the stress overlay (1 to 1,000 bps, set to expire in 1 to 60 minutes). Pull any venue out of pricing or hedging with one switch.
Pairs and spreads	Every quotable pair with its live rate and spread. Pause or resume a pair, override its spread or maximum trade size on the spot, or add a new pair from the token catalog.
Quotes	Every quote ever issued, with rejection counts by reason. Each quote keeps its evidence: both price samples, the venue each came from, and the gap between them.
Venues and hedges	Each exchange connection with its margin, positions, and orders. Every hedge and its state. Each asset's hedge budget and how much is reserved.
Risk	The three pause layers, quoting, filling, and hedging, each showing what tripped it and why. Trip or release any of them on its own.
Capital	Inventory per asset, shielded and unshielded, total and reserved. The wallet pool with per-wallet refill and sweep thresholds. The rebalance queue: approve, reject, or mark a ticket executed.
Orders	Every swap with its on-chain detail. When one gets stuck, force it to resolve: claim it, refund it, or cancel it.

Guardrails

Risky settings don't change the instant you save them. Edit a spread limit, a budget cap, or a risk threshold and it stages with a countdown, so a mistyped number can be caught and cancelled before it goes live.

The settings that could do real damage are shaped so they can't. The stress overlay has to have an expiry and can't exceed its cap. The hard spread ceiling isn't in the console at all, and the safety-critical hedging parameters are fixed at deploy time, not something anyone can tune mid-panic.