Pipeline

The four-state promotion ladder. New page — does not exist in the live product yet. This is the spec.

Why this page exists

Operators today have no idea which bots are safe to enable. The Pipeline page makes the promotion contract explicit: every bot starts frozen, moves to demo-wired when its 27 sections and tests pass, then must run 24h in shadow, then must be observed in runtime-live on a paper wallet, before finally being allowed in production-live with real pUSD. Each transition is a hard gate.

demo-wired

Spec complete, tests pass, last envelope was recent. Not yet observed in shadow.

risk.killswitch

27/27 · last 14:48:21

risk.compliancegate

27/27 · last 14:32:08

risk.markethaltguard

27/27 · last 14:11:54

risk.stalebookguard

27/27 · last 14:42:51

risk.marketqualityguard

27/27 · last 13:58:17

risk.exposureguard

27/27 · last 14:38:44

risk.drawdownguard

27/27 · last 13:42:09

strat.maker_tight

27/27 · last 14:46:02

exec.smartrouter

27/27 · last 14:40:18

shadow-ready

24h in shadow with zero unexpected reason codes. No execution.

Empty until a demo-wired bot finishes 24h shadow soak

Promote from demo-wired via the operator API /promote once the 24h gate clears.

runtime-live

Running against the real adapter on a paper wallet. Envelopes are still audited.

Empty until ops signs off on a shadow-ready bot

Requires real adapter, paper wallet, builderCode bound, and a signed-off ops runbook.

production-live

Real pUSD, real CTFExchangeV2 orders. Full audit, full alerting.

Empty until a runtime-live bot earns the production gate

Requires real pUSD wallet, explicit operator approval, per-bot exposure cap, and oncall rotation.

Frozen specs (preview)

These are not on the ladder yet — they haven't been wired. The 109-spec freeze holds until Phases 1–7 lock. Showing first 5; full list in the dev guide.

disc.headline_scanner

18/27 · frozen

disc.outcome_resolver

12/27 · frozen

intel.macro_sentiment

21/27 · frozen

strat.fade_meanrev

8/27 · frozen

exec.taker_aggressive

19/27 · frozen

Promotion contract

Each transition is a hard gate. No bot moves without all of these passing.

From → to	Gates
frozen → demo-wired	27/27 sections · reason-code regex passes · `npm run verify` 0 warnings · mock adapter integration test
demo-wired → shadow-ready	24h shadow soak · ≥100 envelopes · zero unexpected reason codes · replay determinism 100%
shadow-ready → runtime-live	Real adapter, paper wallet · builderCode bound · ≥24h with zero RISK_* unexpecteds · ops runbook signed off
runtime-live → production-live	Real pUSD wallet · explicit operator approval · per-bot exposure cap · oncall rotation in place

Polytraders Operator UX Mock · INTERNAL · demo-wired ≠ production-live · the plan · reason codes · shadow-mode pipeline