Crypto Divergences

Changelog

Main work on the public desk from late July through September 2026. Oldest entries at the bottom.

Articles desk

Public notes on how the book is scored, regular vs hidden geometry, the closed-candle RSI/MACD scanner, and related oscillator work — with live charts from the actual tape.

  • New /articles index and five long-form pages.
  • Hit-rate and volume charts render from the live public database, not mock data.
  • Home, nav, footer, sitemap, and robots include the section.

Accuracy, own scanner, and distribution

Desk prints and a mechanical scanner now share one feed, with scored results on a public accuracy page.

  • Hit-rate strip on home, signals, and pair pages; full breakdowns on /accuracy by timeframe, side, source, and oscillator.
  • Public source labels are Desk, Scanner, or both, plus filters for oscillator and regular vs hidden.
  • Quiet desk by default: H1+ and majors. M15 alt noise is behind “all timeframes”.
  • TradingView chart (RSI + MACD) and an M15 / H1 / H4 stack on each pair page.
  • Own closed-candle RSI/MACD scanner on top Binance USDT-M volume; M15 scanner hits are stored but not alerted.
  • Live % vs entry on each row; outcomes also snapshot 4h, 24h, and max adverse / favorable excursion.
  • Local watchlist, CSV export of the filtered desk, JSON/RSS fields for source and taxonomy, HMAC-signed webhooks.
  • Telegram Alerts stay out of the nav until a bot token is configured; RSS remains the public subscribe path.

Security lockdown

Public surfaces that should never have been in the web root were removed or blocked, and mutating admin actions now require CSRF tokens.

  • Removed the public Adminer install; session, state, and ingest logs moved outside the document root.
  • Database credentials now load from .env; MySQL password and ingest API key rotated.
  • Nginx denies ops scripts, node_modules, secrets, and the ingest endpoint except from private/local networks.
  • CSRF on login and admin forms; signal delete is POST-only; XSS escaping on message text and URLs.
  • Session cookies set HttpOnly / Secure / SameSite; session id regenerated on login.
  • Maintenance PHP is CLI-only. Sitemap generation no longer trusts Host from the browser.

Ingest recovery and a live signal desk

New divergences had stalled after early January. Ingest was repaired, then the public site grew from a static table into a live desk.

  • Reconnect and history catch-up on start and every few minutes.
  • Loopback ingest with the correct Host header so posts reach PHP even when public DNS is odd.
  • Two-hour pair/side/timeframe dedup so catch-up does not flood the table.
  • Live feed polling on home and signals; pretty URLs for /pair/BTC-USDT.
  • Public JSON and RSS APIs; entry snapshot plus horizon mark-to-market vs Binance futures.
  • Alerts subscribe UI (bot still optional), health checks, sitemap, and robots.

Design refresh

The site was restyled as a light paper desk. Layout bugs that caused horizontal scroll and stray grey edges on mobile were fixed.

  • Unified light theme across home, signals, and inner pages (hero stays dark).
  • Off-canvas nav that does not leave a scrollable gutter when closed.
  • Hero motion via background position instead of a scaled layer that overflowed.
  • Cropped hero art and offset grids so the top/left grey lines no longer show on phones.