Step 3 of how this works
The ladder
How a bot earns the right to touch real money — five rungs, one at a time, no skipping. Every card below is a real bot; click it to read what it does.
What climbing the ladder means
A bot is just a set of rules somebody wrote down. Nobody — not you, not us — knows whether those rules are any good until they have been watched. So a new bot starts switched off, and has to earn each next step by surviving the one before it. Rung 1 it only exists. Rung 2 it plays with fake money. Rung 3 it watches the real market and says out loud what it would have done, while doing nothing. Rung 4 it really places orders, but from an empty wallet. Only at rung 5 can it spend anything, and even then a human has to sign off and a spending cap goes on.Every gate exists because of a specific way this goes wrong. Untested rules lose money. Rules that worked on made-up data fall apart on real prices. Rules that look right in theory place absurd orders in a thin market. Each rung catches one of those before it costs anything. That is also why most bots below are still on rung 1 — the ladder is slow on purpose.
demo-wired
9Rung 2Running on fake money
Spec complete, tests pass, last envelope was recent. Not yet observed in shadow.
To leave this rung: it has to run beside the live market for a full day without doing anything surprising.
shadow-ready
0Rung 3Watching real markets, placing nothing
24h in shadow with zero unexpected reason codes. No execution.
To leave this rung: a person has to look at what it said it would have done, and agree it was sane.
Empty until a demo-wired bot finishes 24h shadow soak
Promote from demo-wired via the operator API /promote once the 24h gate clears.
runtime-live
0Rung 4Placing real orders, from a wallet with no real money in it
Running against the real adapter on a paper wallet. Envelopes are still audited.
To leave this rung: someone signs off, a spending cap goes on, and somebody is on call.
Empty until ops signs off on a shadow-ready bot
Requires real adapter, paper wallet, builderCode bound, and a signed-off ops runbook.
production-live
0Rung 5Live, with real money
Real pUSD, real CTFExchangeV2 orders. Full audit, full alerting.
To leave this rung: nothing — this is the top. It can still be stopped instantly.
Empty until a runtime-live bot earns the production gate
Requires real pUSD wallet, explicit operator approval, per-bot exposure cap, and oncall rotation.
Rung 1 · written down, not running
Frozen specs · 106
Everything on the bottom rung: the rules exist and have been written up, but nothing is switched on. Grouped by class. Each card opens the real per-bot spec — identity, reason codes, sections, capital impact. This is the same content the class pages surface, just laid out linearly against the promotion ladder above.
Promotion contract
Each transition is a hard gate. No bot moves without all of these passing.
| From → to | Gates |
|---|---|
| frozen → demo-wired | 27/27 sections · reason-code regex passes · npm run verify 0 warnings · mock adapter integration test |
| demo-wired → shadow-ready | 24h shadow soak · ≥100 envelopes · zero unexpected reason codes · replay determinism 100% |
| shadow-ready → runtime-live | Real adapter, paper wallet · builderCode bound · ≥24h with zero RISK_* unexpecteds · ops runbook signed off |
| runtime-live → production-live | Real pUSD wallet · explicit operator approval · per-bot exposure cap · oncall rotation in place |