The details

Which model answers you, whether it can be reached right now, and what the session has cost so far. This is also where you decide whether Directive 47 talks to anything outside this machine at all.

Ask for it

“which model are you using” “what has this session cost” “personality off”

What it tells you

Provider: Anthropic
Model: claude-sonnet-5
Availability: Available
Personality: on
Session so far: 3 turn(s), $0.0412
Speech so far: 1,204 characters spoken, $0.1204

Speech is counted separately and in a different unit, because it is billed in a different unit: the model is billed per token and the voice per character. It is here rather than on a report of its own so that “what has this cost” has one answer — see what the voices cost for where the rate comes from and why it is an assumption you can correct. A provider that charges nothing says free rather than $0.00, and the line is absent entirely until something has been spoken.

What it has cost over time

The line under the panel says what the last turn cost, and the banknote beside it opens the rest: the token counts, what the session has come to, and five running totals — today, the last 7 days, the last 30 days, this week (Sunday to Saturday) and this calendar month.

Today is first because it is the one you read, and the freshest window earns the top of the list. There is deliberately no “last 24 hours” beside it: that is the same number with a boundary you cannot point at, and “what have I spent today” is the question people actually ask.

On a Sunday, today and this week start at the same midnight and show the same figure. On the 1st, today and this month do. On a Sunday the 1st, all three agree — that is right, not a fault.

Those four are kept in data/spend.jsonl, one line per charge, written as it happens and read back when Directive 47 starts. Both the model and the voices go in it; a total covering only half of what you spent would be worse than no total at all.

Each row records the instant it happened, in UTC. “Today”, “this week” and “this month” are worked out against your clock at the moment you ask, which is what keeps them right across a daylight saving change and right if you ask from a different timezone than you flew in. A day the clocks moved in is 23 or 25 hours long, and today still means the midnight your clock showed rather than a fixed number of hours back.

A charge Directive 47 could not price — a model with no published rate, or a voice provider you have not set a rate for — is recorded with its tokens or characters and no dollar figure. Any window containing one reports at least its total rather than presenting a figure that silently leaves part of the cost out.

Every figure in there is an estimate, and the window says so once at the top. Directive 47 knows each provider’s published rate, not what your account is actually billed — a subscription with bundled credits can make the real cost anything from higher than the estimate to nothing at all, and no API reports which arrangement you are on. It is said once rather than stamped on each number: one sentence has room to say why, and a three-letter suffix does not.

The file is only ever appended to, so nothing that has already been written can be lost by a later crash. Delete it and the running totals start again from empty; nothing else is affected.

Starting the figures again

Reset in that window offers six spans — this session, and the same five windows the figures list shows. Take one and everything charged inside it stops counting, in every window that contained it: reset today and today’s charges leave this week, the last 7 days, the last 30 days and this month as well. That falls out of how the figures are worked out — each one is a question asked of the ledger rather than a counter kept running — so there is nothing left over to disagree.

This month does not nest with the rolling windows, and that is right rather than a gap. Reset it on the 3rd and three days go; the rest of the last 30 days stands, because those charges are still inside that span.

Nothing is deleted. A single line is added to data/spend.jsonl recording the reset and the span it covered, and the totals skip anything it covers. The history stays on disk, the file stays append-only, and a reset you did not mean is undone by deleting that one line by hand — which matters, because this is the one figure in Directive 47 that stands for real money.

It asks before it does anything, naming the window and the amount. Every other eraser in Directive 47 acts on the press; this one is different because it sits where the numbers are, which is where you want it and also where a stray click reaches.

This session also empties the session block above, which lives in memory rather than in the ledger. So does every other span, since a turn’s figures carry no timestamp to sort them by — if you have been running since before the window you reset began, the session figure reads low until the next turn while the running totals stay exact.

With no key stored it says so, rather than going quiet and leaving you to work out why nothing answers:

Provider: Anthropic
Model: claude-sonnet-5
Availability: NotConfigured — No Anthropic API key is stored. Add one in Settings.
Personality: on
Session so far: 0 turn(s), $0.0000

Stopping a turn

“Stop” and “cancel” are different things, and the difference is on your bill.

Both work while a turn is running rather than waiting for it to finish — a turn in flight is the only thing either has to act on.

One limitation: whatever the model had already produced before you cancelled has already been billed by the provider, and Directive 47 cannot get the figures for a turn it tore down. So a cancelled turn adds nothing to the running total, which slightly under-reports the session. Cancelling saves the work that had not happened yet, not the work that had.

Settings

The rows here follow the provider you pick. Choose None and the rest disappear rather than sitting there greyed out.

Provider

The model cannot change this. Picking a provider picks where your turns go, so it is the panel’s to change and not the model’s.

Changing it clears the model choice with it — model names belong to their provider, and carrying one across is how you end up with a selection that fails at the first question.

Why the last two are separate entries and not one row you retarget: what leaves your machine is written per provider, and no single sentence can say both everything goes to OpenAI and nothing leaves this machine. Splitting them splits the key as well, which is right on its own terms — an OpenRouter key is not an OpenAI key — and it splits the prices, which matters because one set is published and the other cannot be.

The protocol split is the same line. Server-side web search now lives in the tools array on the Responses API everywhere it exists, and Chat Completions is where every local server lives. No local server has a web search anyway, so the two halves land exactly where they belong.

Endpoint

Only appears for providers where pointing somewhere else means something — a gateway, a proxy, a local server speaking the same protocol. Anthropic has one address and no reason to accept another, so with Anthropic selected there is no row here to worry about.

For the two OpenAI-shaped providers this is the row that matters most. Include the version segment, the way every OpenAI-compatible client wants it:

http://127.0.0.1:11434/v1

That is Ollama’s default and the value the row starts with. LM Studio is usually http://127.0.0.1:1234/v1; a vLLM or llama.cpp server is whatever port you started it on. If you paste a bare origin with no path at all, Directive 47 fills the /v1 in for you — anything else you type is left exactly as typed, because a client that rewrites addresses is a client that cannot reach the one place you needed.

Changing it empties the model list, and then Directive 47 asks the endpoint what it serves and fills the list back in with the endpoint’s own answer. Directive 47 still knows nothing about which models live at an address it has never heard of — that has not changed and should not, since a model name carried across from another provider is a selection that fails at the first question. What changed is that there is now somebody to ask.

If the endpoint does not answer, or answers with an empty catalogue, the list stays empty and you type the name yourself. That has always been supported.

Model

Which model answers. Leave it empty for the provider’s default, shown greyed out so “I have not chosen” stays distinguishable from “I chose that one”.

This is the model your conversation takes. The things Directive 47 says without being asked can be sent somewhere cheaper — see Model for the quiet calls, two rows down.

Anthropic’s default is the highest Sonnet — currently Claude Sonnet 5. A companion answering questions about a game in flight is not the work the Opus tiers are priced for, and the Opus models are the next entries in the list if you want one. OpenAI’s default is the middle tier for the same reason.

The OpenAI-compatible provider has no default at all, and that is deliberate: your server serves whatever you loaded into it, so any guess would fail at the first question. Pick from the list the endpoint gave back, or type the name.

The offered list is every model Directive 47 can price, so anything picked from it keeps the running cost accurate. Type one by hand and it is accepted, but counted as unknown rather than as free. Models the endpoint offered are in that second category — Directive 47 has no published rate for a model it has never heard of, and inventing one would be worse than saying so.

Every row in the picker says what it costs, and two of them say a little more:

gpt-5.6-terra — the provider's default — $2 in / $12 out per million
gpt-5.6-luna — cheapest here — $0.20 in / $1.20 out per million
grok-4 — priced as unknown

The rate is read from the same table the running total is billed against, so the price beside a model and the price on your bill are one number rather than two that happen to agree. The provider’s default and cheapest here are worked out from the list itself rather than written beside it, which is why there is no word here about what any model is good at: capability prose ages silently, tiers get renamed under their names — 5.4’s mini and nano became 5.6’s terra, sol and luna — and a rate that goes out of date does so visibly.

A model on your own machine is priced at zero, and says why. If the endpoint is a loopback address, the turn is free — that is a fact about the address rather than a guess about the model, and reporting “unknown” forever about something that genuinely costs nothing is noise pretending to be rigour.

The cheaper models carry live game state under a weaker guarantee, and it is worth knowing before you pick one. On Claude Opus 5, Opus 4.8 and Fable 5, what your ship is doing right now reaches the model under a role that journal content cannot imitate. Everywhere else — Claude Haiku 4.5, Sonnet 5, and every OpenAI-compatible endpoint — it is folded into the message instead, marked off by a convention rather than by a boundary. That is the well-travelled path rather than a new risk, and the guardrails that say in-game text is information rather than instruction are above all of it either way. But a hostile ship name has one more thing it can try on the cheap models than on the expensive ones, so the choice is a real one and not only about money.

Model for the quiet calls

Which model writes the things you did not ask for: a line of In Ship chatter, the brief when you sit down, what Directive 47 says after a long gap, a lore lookup, and choosing a voice for a core. Leave it empty and they use the model above, which is what every version before this one did.

It is close to free money, and the reason is caching rather than the rate card. A conversation turn re-sends everything said so far, and the provider charges the cheap cached rate for a prefix it has seen before — but a cache belongs to one model, so alternating between two models pays to write the cache again each time you come back. One detour costs several times what the cheap turn saved, which is why Directive 47 will never switch models question by question. The quiet calls are the opposite case: none of them carry the conversation, every one of them already starts cold, so sending them somewhere cheaper costs nothing at all and saves most of what Directive 47 spends while you are not talking to it.

Two calls deliberately ignore this row. Writing an adventure and writing your Commander’s log both stay on the model above — you pressed a button and are waiting, the output has to name real systems exactly, and the log is quoted at a price before it is written.

It clears itself when you change provider or endpoint, exactly as the model row does: a model name belongs to the endpoint that serves it, and one carried across would fail on the first ambient remark, which is a failure nobody is watching for.

Think at least this hard

The least effort a question gets, however plain it looked.

Directive 47 gauges every question on its own — a lookup gets the cheapest setting, planning a route gets more, and asking it to think carefully gets the most. That gauge is a heuristic reading your words, and it is sometimes wrong in the cheap direction. This row is where you say the bottom rung is not enough for you.

The rungs are Low, Medium, High, Xhigh and Max. Leave it empty and the gauge decides, which is the default.

Only your conversation is held to it. The quiet calls above are not, and that is deliberate: a floor of High would turn every line of In Ship chatter into a reasoning call, which is exactly the spending the row two above exists to stop.

Never think harder than this

The most effort a question gets, however hard it sounded.

Thinking is most of what a turn costs, so this is the dial that decides what an expensive-looking question is allowed to spend. It also catches the gauge being wrong in the other direction: it matches on the words you used and not on grammar, so an idle “what do you think about the Corvette” contains “think about” and is priced as a request to deliberate.

Each of the two rows offers only the rungs the other allows, so you cannot set a floor above a ceiling from the panel.

Two things you can say out loud, because this is the row you will want to reach with your hands on the stick:

stop thinking so hard      → the ceiling becomes Medium
think as hard as you like  → the ceiling is cleared

API key

Encrypted for your Windows account and kept in data/secrets.json beside the executable.

For the OpenAI-compatible provider the key is optional, and the row says so. A model running on your machine has no account and no key to paste, and leaving the box empty is a complete configuration rather than an unfinished one. The row is still there because a gateway speaking the same protocol may want one.

It is only ever written, never read back. Directive 47 can tell you whether a key is stored and can replace it; nothing — not the panel, not the model, not the logs — can show you the key again. If you lose it, paste a new one.

The row says which state it is in, and the box changes with it: No key and “Paste a key to store it”, or Key stored and “Paste a new key to replace it”.

Show unmasks what you are typing, on the way in only — a stored key is still never shown back. It exists because the commonest reason a key does not work is that it was pasted wrong, and you cannot see that through bullets. What you paste is trimmed before it is stored: a key copied from a browser arrives with a trailing newline more often than not, and a newline fails at the provider in a way that reads as a wrong key rather than as a bad paste.

Verify Key proves it. It is shut until you have pasted something — on an empty box the only answer it could give is that an empty key is not a valid one — and pressing it stores what you typed and then checks that, so it is never answering about the key you have just replaced. The check is the smallest real call the provider offers — one token, no tools, no persona — and it says what came back:

Anthropic accepted the key.

This matters more than it sounds. A key that is wrong, revoked, or newline-padded is otherwise indistinguishable from one that works until your first question fails, by which point you are looking at Directive 47 not answering rather than at a key not working.

Rejected and unreachable are different answers and are kept apart. If the check cannot be made at all — offline, blocked, timed out — it says so and says nothing about the key. Being told a good key is bad would send you to your account page to issue another one that fails the same way.

On an OpenAI-shaped endpoint the check asks for the model list instead, and answers something like OpenAI answered — 5 models. That is the better probe here for three reasons: it works with no key, which is the reason for running your own model; it works with no model chosen, which a local server may well be; and it is the exact call Directive 47 makes anyway to fill the picker, rather than a proxy for it. A server that is simply not started yet reads as unreachable, not as a wrong address.

If you already keep ANTHROPIC_API_KEY in your environment, that still works and is used when nothing is stored here.

When your endpoint cannot do something

An OpenAI-compatible server is a moving target: the protocol has a dozen implementations and they do not agree about the optional parts. Whether tool calls work, whether reasoning effort is a field it knows, whether it will report token usage — none of that is in a model list, and Directive 47 does not guess.

So it advertises, then demotes. Every request offers everything. If the endpoint refuses and names the field it refused, that one capability is switched off for that address and the turn is sent again without it. You see an answer, not an error and not a retry.

Four things can be dropped this way, and each costs something small rather than the turn:

Once per capability per address, and only for as long as Directive 47 is running. It is never retried in a loop, because a client hunting for a request shape the server will accept is indistinguishable from an outage from where you are sitting. And it is never written to disk, because a demotion saved to a file outlives the server upgrade that fixed it — and you would have no way of knowing why the tools silently stopped being offered.

Nothing is demoted on a guess. A refusal that names no field turns nothing off.

The first run

On a fresh install there is no key, so the first thing you would otherwise do is hunt for this row in a surface with fourteen sections. Directive 47 offers the two that matter instead — this one, and the voice key as optional — with what each one sends and where.

If you have picked the OpenAI-compatible provider, there may be nothing to offer: a key that is not required is not a missing one, so a local model is a complete configuration with an empty box and the first run has nothing to ask you for.

It is not a wall. Decline everything and Directive 47 still runs: you get a typed companion that reads your journal and answers from what it can see, rather than one that talks back. That is the same rule as everywhere else here — a capability without its key is off, not broken.

There is no “we have shown this” flag, and that is deliberate. The condition is there is no usable language-model key, asked fresh each time. That is also true if you copy your data\ folder to another machine: secrets.json is encrypted for one Windows account, so on the new one those values cannot be decrypted and are reported absent — and the offer appears, on exactly the machine that needs it. A flag would have been set on the old machine and would suppress it forever on the new one.

Reopen it any time from About → Set up keys. Keys get rotated and revoked, so the state that triggers this is one a working install can come back to.

Personality

Off gives you plain answers. It does not loosen anything: the rules that stop Directive 47 inventing capabilities it does not have are separate, and nothing on this panel can reach them.

Spoken shortcuts, recognised without the model:

“personality off” / “turn personality off” / “turn your personality off” “personality on” / “turn personality on” / “turn your personality on”

The whole sentence has to be the phrase rather than merely contain it, so asking “what does personality off actually change” gets you an answer instead of switching it off.

Let the model search the web

Off by default. On, Directive 47 can look something up online when a question turns on current information — what a patch changed, what other Commanders are reporting, a community guide that did not exist when the model was trained.

Directive 47 does not do the searching. Your language-model provider does, on the far side of the connection you already have with them, and only the reply comes back. So this opens no new destination: nothing goes anywhere that was not already receiving your turns. What it does change is that the model can now read arbitrary pages about what you asked, and the wording of the search — drawn from your question — goes with it. The Privacy row says so while it is on.

One search happens without you asking a question. With the lore remark set to look things up, arriving in a system Directive 47 knows about searches for that system by name. Nothing else about you goes with it, and it obeys the same rules as everything here — spoken as a search result, never written into a table — but it is the one case where a search follows a jump rather than a question. Setting that row to Remark only, or switching this one off, ends it.

Two things are true of anything found this way. It is spoken as something read, with the source named, and never silently mixed into the ship and galaxy figures Directive 47 was built with — if a page disagrees with those, you get told both and which is which. And it is never written into Directive 47’s own tables: those are generated from recorded sources, and a search result has no route into them.

Searches are billed by your provider on top of the turn, at roughly a penny each. The turn price counts them, so a searching turn reads as what it actually cost. A turn will not search more than three times.

It needs a working language model, so it does nothing with the provider set to none or with no key stored. On a custom endpoint it stays off whatever this row says: whether a gateway can search is not something Directive 47 can know, and asking one that cannot would fail the turn rather than answer it without searching.

When it cannot search, it says so instead of answering from memory. Directive 47 tells the model which half is missing, because the two have different answers:

The endpoint wins when both apply. Being told to flip a switch that will not help is worse than being told nothing, because you flip it, nothing changes, and the next explanation is one you have a reason to distrust.

Nothing is said at all when search works, so having it on costs you no words about it.

Character sheet

Who your Commander is, in a few lines — name, where they are from, age, how they speak. Kept between sessions.

D47 carries it with every turn and with everything it says in character: the In Ship chatter, the greeting when you sit down, a core’s first words. Before this row existed those lines were written by a model that had never heard of the person flying, which is why they felt generic — ten ways to say docked at a station are still ten ways to say nothing. Keep it short: it is some forty tokens, and those forty go out on every remark.

The carrier’s captain and tower do not get it. They are strangers on a comms channel and do not know your history — the same reason they do not get the core’s persona.

Per Commander. Another Commander logging in on this machine sees their own sheet, not yours — see Some rows are the Commander’s.

About Me

Your Commander’s story, in your own words, as long as you like — how you fly, what you are working towards, where you have been. Kept between sessions.

It is treated as true. A biography names people, places and factions that are your own invention rather than Frontier’s lore, and the answer is not a disclaimer: it is your character in your game, and the ship’s AI is told the story is true of the world you share and to inhabit it. A core that speaks of a Power with suspicion because you have reason to is the feature. Operational answers are unaffected — those come from tools and tables, not from this box.

It is sent with every turn, where it sits inside the cached prefix and costs nothing after the first. It also goes with about one line of In Ship chatter in four — the story is the expensive half, and a remark about a docking bay does not need thirteen hundred tokens of history every time, only now and then when it might land. Which remark is chosen by the same count that picks the stock line, never by a clock, so a recorded session replays to the same calls.

Per Commander, and empty is meaningful. Each Commander on this machine has their own story; one who has never written one reads the installation’s, and one who clears the box reads nothing — not the installation’s, and not another Commander’s. When a different Commander logs in, the prompt is rebuilt around their story, and because the story sits inside the cached prefix that rebuild throws the cache away. That is one slower first turn per login, accepted on purpose: a login is rare, and a Commander must never be answered from somebody else’s cached history.

Both go to the provider along with everything else. See Privacy.

{"type":"object","properties":{},"required":[],"additionalProperties":false}

{"type":"object","properties":{},"required":[],"additionalProperties":false}

[Information] Anthropic configured from the secret store