Live modes

Five modes, in order of increasing effect. Every bot must support at least off, shadow, and enforced. Most also support advisory and quarantine.

Mode	What it does	Effect on orders	When to use
`off`	Bot is disabled. `decide()` is not called.	Nothing.	Set during incident handling or before promotion.
`shadow`	Bot runs and emits ReportEnvelopes, but its output is discarded.	Read-only.	Pre-promotion validation; cross-checking new logic against incumbent.
`advisory`	Bot's output is shown to operators and downstream bots, but never blocks or submits.	Warn/recommend.	Risk bots in their first week of life; new strategies before stub→limited_live.
`enforced`	Bot's output is honoured according to its authority — Risk can block, Strategy can emit OrderIntents, Execution can submit.	Up to its declared authority.	The default for any bot at `limited_live` or `wide_live`.
`quarantine`	Bot isolates the affected market(s), wallet(s), or strategy(ies). It does not block the rest of the system.	Reject orders that touch the quarantined scope; let everything else through.	When a problem is localised but the rest of the platform is healthy.

Promotion ladder

A bot's mode and its readiness state are coupled. The default ladder is:

stub · mode off by default.
stub · promoted to shadow in staging with synthetic input fixtures.
limited_live · advisory in prod_advisory; output reviewed by Risk on a daily standup.
limited_live · enforced on a per-market allow-list.
wide_live · enforced across the full universe.

Demotion goes through the same ladder in reverse and never skips a step.

Per-bot mode support

Every bot declares which modes it supports in its spec page. The build cross-checks this against the bot's class and authority — for example, a Guardrail must support enforced and quarantine; a Signal Service is forbidden from supporting enforced because it has no enforcement surface.