Paper vs live
Paper is the default everywhere and nothing in the console switches to live; what the environment pill means, what the readiness scorecard measures, and the deploy-time ceremony that stands between a green scorecard and real money.
- Who it is for
- Owners & operators
- Reading time
- 4 min read
- Updated
Everything starts in paper. Paper is the default environment in the code, the example env files, the container definitions, the infrastructure and the service units, and the default broker is the built-in simulated one. No console setting switches to live: Connect refuses live keys unless the deployment explicitly enables live connections, the refuses to start live against the simulated broker at all, and it refuses to start when the keys it is given are paper keys under live or live keys under paper. Going live is a separate deployment with a separate key, done by a person, after evidence.
The environment pill
The pill at the left of the top bar says which world the book is in:
- PAPER: outlined. A ; no real money.
- LIVE: filled orange and pulsing. A real brokerage account.
- ENV MISMATCH: amber. The environment flag and the Executor process disagree.
A mismatch is not cosmetic. Risk check #1 (broker_env_matches_process) compares the flag with the running process before anything else and halts on the first it sees until they agree. The Environment card on Accounts then carries an "Environment mismatch" line saying every order is refused until the operator resolves it.
The readiness scorecard
Paper → live readiness is owner-only (there is a link to it from Performance). It scores thirteen gates from what the system already records, in the same order every time, and gives a verdict, a score, the consecutive green trading days out of the 5 required, and a sparkline of the last 10 trading days. A gate is green, red or unknown, and unknown never passes.
The gates, with their code-default thresholds:
| Gate | Green when |
|---|---|
| Paper days | at least 20 funded paper trading days on the books |
| Closed trades | at least 15 completed round trips |
| Max | no worse than 8% over the paper history |
| Sharpe | at or above 0 |
| Executor errors | at most 0.5% of loop ticks errored in the last 10 days |
| Incidents | no mismatch, policy-halt, broker-auth or circuit-breaker alert in 10 days (loss and drawdown halts do not count) |
| Audit score | agent-hygiene score at least 80 over the last 5 days with trading sessions |
| acks | none of the last 5 PM sessions ignored a steering note |
| response | the Critic reviewed at least 90% of proposals over the last 5 days |
| Report criticals | no critical in the last 5 |
| Reconciliation | no book-versus-broker mismatch alert in 10 days |
| Cost per fill | model spend per fill at most $2.00 over 20 days |
| Tests green | the deployed commit has a green CI marker no older than 3 days |
Each gate shows its value, threshold, window and why, with its evidence one click away. The deployment can tighten a threshold; an attempt to loosen one is ignored. The page measures and never switches anything (there is deliberately no button), and it keeps scoring the paper history after a cut-over, so it stays your "was the paper record real?" reference.
The ceremony
The Environment card on Accounts states which world the book trades in, says in one paragraph that going live is a deliberate ceremony and never a switch on that , and links to the scorecard; it shows no steps, settings or buttons. The ceremony itself has four parts:
- Readiness evidence: every acceptance item checked by you after reading its evidence.
- : active and funded as the broker reports it, with a separate live key in Secret Manager the console never reads.
- Arm the flag: set the environment flag to live behind a typed GO LIVE and your . On its own this trades nothing: the Executor is still on paper, the pill reads ENV MISMATCH and check #1 halts everything.
- Redeploy the Executor with its own environment set to live. This is done in the deployment on the trading machine, not in the console. The mismatch clears when the process reports live.
None of it happens in the console: the API does not compute the readiness-evidence checklist yet and has no route that arms the flag. The cut-over itself is three separate acts on the VM: a reviewed code change that adds the live profile, a config change on the machine that sets the Executor's environment to live (never in the repository), and a , for which the Executor is to print the live account and refuse to run until a person types the exact sentence back. That confirmation gate is planned, not built, and the runbook may not be run until it lands. Nothing in the repository, API or console flips the environment for you.
Rolling back to paper needs no ceremony and nothing has to be green: , set the Executor's environment back to paper in the deployment, restart. It is always allowed.
Why it is never one click
Each step is a different act by a different mechanism (evidence you read, an account the broker vouches for, a flag and a process that must agree, a sentence you type on the machine), and any one alone does nothing. The first live week runs on tiny limits set on Risk › Limits and Risk › Halts (the runbook says at most $100 an order, 5% a position, 25% gross and 2 orders a day, with the halts at a $50 and 4% drawdown), with the at $0 and on manual on Strategy › Profile, so every order waits in the Inbox. Performance for the live book is compared with the paper week before anything is loosened, and then only one notch at a time, each behind code check and audit, never more than one loosening a day, and only after five clean live days.