Changelog

The Strategies page was empty on the paper plane, because every rule there runs as manual. It now opens with the rules that are running and why each one sends or waits, the paper record grouped by the rule that opened each trade, and each model's research beside its paper results.

• AddedRunning on this plane: every enabled rule, what triggers it, whether it sends without you or waits for you, and which limit decides that: the rule, its strategy's rung, the profile or the plane.
• AddedPaper record by origin: closed round trips grouped by the rule that placed the entry, or typed ticket, with wins, realized P&L and the signal, timing and sizing split. Each row says how its count compares with the 60 round trips the ladder needs before it judges anything.
• AddedMomentum's study beside its paper record: out-of-sample Sharpe, deflated Sharpe and drawdown, each against the threshold it had to clear.
• ChangedEach strategy's gates are shown as a measured value against a required one, met or not met, instead of a list of raw evidence keys. The rung meanings are written out instead of hidden in hover text.
• SafetyOn an unattended paper plane, a banner says that rules asking for EXECUTE send because the plane allows it, not because they earned the rung, and that the same rules would wait for you on live. Nothing about what sends has changed.

The calendar was empty on the paper plane even after trades had closed. It now shows each day's closed paper trades, with the same figures as the Attribution page.

• FixedClosed paper trades now appear on the calendar day they closed, with the realized amount, the number closed and the symbols. Before, they reached the Attribution page and nowhere else.
• FixedThe round trips line on the trading frequency chart now includes paper trades too.

With two tabs open, the paper plane asked Alpaca for the account so often that Alpaca began refusing, and pages came back empty. A page now asks once and shares the answer for a few seconds.

• FixedEach page read asks the broker for the account, positions and fills once, and pages read within five seconds of each other share those answers. Two open tabs no longer use up Alpaca's request limit.
• SafetyOnly page reads share answers. Confirming an order, checking limits and running automations always ask the broker fresh, and any new ticket or fill clears what was shared, so a fill cannot show as a reconciliation mismatch.

A rule written to place one order, such as selling a position at the open, can now be marked to run once. After its order fills it pauses itself, so it cannot fire again on a position that is already gone.

• AddedTimer, trigger and threshold rules take a once setting. Such a rule fires each session until one of its orders fills, then pauses itself and shows "done: its order filled" instead of "paused". If its order never fills, it tries again next session.
• SafetyA once rule does not send a second order while its first is still working at the broker, and any fill counts as done, including a partial one. Rules not marked once repeat exactly as before.

The Start paper button and /paper now start the paper plane with --unattended, as the 06:05 job already does. The plane is in the same mode whichever of the three started it.

• ChangedStart paper on the status bar launches the plane with --unattended. Its hover text now says that automations set to EXECUTE send without a click, and rules set to PROPOSE still wait for you.
• Changed/paper start passes the same flag. /paper and /paper status now report whether the plane is attended, the active profile, and how many enabled rules are set to EXECUTE.
• SafetyNeither restarts a plane that is already running to add the flag; an attended plane stays attended until you stop it. Nothing changes a rule from PROPOSE to EXECUTE for you.

The paper plane can be started so that automations send their orders without a confirmation click. It is off unless the plane is started with --unattended, and it exists on the paper plane only.

• AddedStarted with --unattended, the paper plane lets an automation send its order without a click, even though its strategy has not yet earned that rung. The status bar on every page, the startup line and the server banner all say UNATTENDED, in words rather than only a colour.
• ChangedThe 06:05 PT weekday launchd job now starts paper with --unattended. If a plane is already up it is left alone, and the job logs whether that plane is attended or unattended.
• SafetyEach rule is opted in on its own: only a rule that asks for EXECUTE sends. Rules written to propose, including every stop already on the paper account, keep proposing.
• SafetyThe passive profile still caps every order at a proposal. Every unattended send goes through the same confirm path as a click: limits re-checked, a quote older than 60 seconds refused, a halt suspends. Crypto never sends itself.
• SafetyThe mode is a start-up flag on the paper process and nothing else. No setting, HTTP call or environment variable can turn it on, and a restart without the flag is attended again.

On the paper plane, a draft for a stock outside the thirty listed names now adds that name to the ticket’s list instead of being refused, once Alpaca has shown it can price it.

• AddedSaving a draft for an unlisted US stock checks it with Alpaca and, if Alpaca has a trade for it, adds it to the trade page’s symbol list. The name is kept in the workspace, so it is still there after a restart.
• SafetyA name Alpaca cannot price, a typo or a crypto pair is refused with the reason, and no draft is saved. The simulator still offers only its thirty names and now says why. The cap of thirty on LLM screening is unchanged.

A draft taken to a ticket now remembers that ticket, and leaves the drafts list once the order fills, so an entry that has already happened no longer sits beside its own exit looking like a second idea.

• FixedFilled drafts stayed listed until discarded by hand. Four entry drafts that had filled a week earlier were shown next to their time-exit sells, reading as duplicate buy and sell pairs. A draft whose ticket filled is now retired, on the drafts page and in the daily review.
• AddedA draft that is already on a ticket says so, with the ticket and its state. If that ticket was refused, cancelled or rejected, the draft says nothing was executed and stays open.
• SafetyA ticket can only retire the draft it matches: same asset class, symbol and side. A buy that fills can never retire the sell draft of the same name. A mismatched, discarded or unknown draft is refused before any ticket is created.

A PC can now hold the paper credentials, in Windows Credential Manager, so the local instance and the paper plane run there as they do on a Mac.

• AddedWindows Credential Manager as a credential store. The app picks the Keychain on a Mac and Credential Manager on Windows, from one place, and refuses on any other system rather than falling back to a file.
• ChangedEvery "store it with" command on the Connections page and in error messages is now "uv run python -m tradebench.app credentials store <name>", which works on both systems. Live-plane connections still show the Keychain command.
• SafetyOn Windows, "credentials store" asks for the value twice without echoing it, refuses an empty or mismatched entry, and writes it without starting another process, so the value never appears in a command line.

The daily loss limit and session P&L automations now measure today against the previous close, not every trade since the account opened.

• SafetyThe daily loss limit was checked against realized P&L since the account opened, so a losing week could have blocked orders on a flat day, and a bad day could hide behind an earlier good one. It now checks today's change against the previous close, open positions included. Automations that watch session P&L read the same figure.
• ChangedRealized P&L on the overview, the live page and the daily report is unchanged: it still counts every closed round trip.

A signal rule tops a pick up to the per-position cap instead of buying a full position on top of shares you already own.

• FixedWhen a signal rule picked a name you already held, it bought a full position anyway, and the limits refused the order for breaking the per-position cap. It now buys only the shares that bring the position up to the cap, and it skips the name with a note when you already hold that much.
• FixedThe preview of a signal rule showed each cost note once per order. It now shows each note once.

The ticket and drafts pages, tightened after a morning of using them, and a fix for names that looked missing from the book before the open.

• FixedThe ticket lists every name in the equity book, quoted or not. Before the open it left out any name without a two-sided quote, and called PLTR “not in the equity book” while the drafts page said it was tradable. An unquoted name now shows no prices rather than zeros.
• AddedThe Ticket book has a Date column, in Eastern time, and opens newest first.
• ChangedLong reasons and signals — in the Ticket book and on draft cards — show two lines, with Read all to open the rest. The code that refused a ticket stays visible.
• AddedA Drafts button beside the trade ticket’s title.
• FixedTake it to the ticket is rounded like every other button. It was the only square one.
• ChangedThis page is a masonry grid, with the current release full width at the top.

Small corrections to the live view and the account panel, found by using them, and a changelog so the next batch has somewhere to be written down.

• AddedA Changelog page, under Reference in the sidebar.
• AddedA profile photo in the account panel: JPEG, PNG or WebP up to 5 MB, cropped square and re-encoded in the browser, which strips the location a phone writes into a picture.
• SafetyThe server checks the photo’s bytes rather than its claimed type, refuses SVG and anything still carrying EXIF, and keeps it in its own file so saving the account record can neither replace nor clear it.
• FixedThe live cards’ interval selector now works on the deployed page — the offline fixture carries one payload per interval instead of serving 5m for all of them.
• FixedThe account button shows initials only from the phone layout’s breakpoint down, and carries the full name as its accessible label.
• FixedA class a browser extension adds to the page body no longer reports as a hydration error, which had made a successful account save look like a failure.

A page for watching held positions during the session, and the first way to rest protective exits behind a position that is already open.

• AddedLive, first in the During group: every held name marked at the current price, what today has done to it, and how old that price is.
• AddedAn adjust drawer that sizes a ticket against a position through the same limits and required reason as the trade ticket. It records; it does not send.
• AddedProtect: a take-profit and a stop resting behind an open lot, as a ticket with one idempotency key, journalled first and confirmed by a person.
• AddedA card per position showing the shape of the day, with the previous close, cost basis and any resting target and stop drawn on it. A shared-scale mode lets names at very different prices be read side by side.
• AddedThe New investment walkthrough hands off to the trade ticket, which reads the handoff and refuses to guess at a field it cannot parse. The instrument menu follows the asset class.
• ChangedThe paper broker adapter can place a one-cancels-other exit pair over shares it already holds (applied by hand in execution/).
• SafetyA dead Confirm button shows the order path’s own refusal, not a second copy of the rule. A day change that could not be computed is shown as missing, never as zero.

Scheduled rules, connections added from the page, and a local instance that can hold a real account — with the risk engine and order management system installed.

• AddedAutomations: timed and threshold-triggered rules, with a dry run and a run-now control.
• AddedConnections can be added from the page. They reference Keychain entries and never carry the value.
• AddedCharts on the overview.
• AddedA local instance that reads the macOS Keychain and trades against the simulator, in its own data root, separate from the demo.
• ChangedThe risk engine, order management system, broker adapter and options Greeks limits were installed by hand after review. The four suites that could not run before now pass.
• SafetyThe paper/live separation on stored credentials is enforced on writes and deletes, not only on reads.

A second asset class with its own types, risk limits and order shape.

• AddedOption contracts, OCC symbology, Black-Scholes pricing and the Greeks, and volatility estimation.
• AddedOption chains, validation, and multi-leg structures.
• AddedOptions risk: Greeks limits and an unwind sequence.
• AddedMulti-leg orders.
• AddedOptions attribution, a separate promotion ladder, and tax handling.

Everything between a signal and an order, and what watches it afterwards. The risk engine, order management system and broker adapter were written with their tests and held back for human review.

• AddedIdempotency keys, an audit trail and autonomy gating on every order path.
• AddedRisk engine, order management system and broker adapter, each with a test suite written first.
• AddedCredential handling through the macOS Keychain, and a credential boundary check.
• AddedReconciliation against the broker, and fat-finger guards.
• AddedExecution quality measurement, feeding back into the cost model.
• AddedPromotion gates, a go-live checklist and the morning report.
• AddedAn adaptation tier that separates what may refit itself from what needs a person, and an experiment register.
• AddedThe attribution ledger and the running automation ladder.
• AddedScheduling, deploy safety, clock drift detection and a launchd agent.
• AddedStructured logging, alert routing and the design tokens.
• AddedDecay detection with CUSUM, and a shutdown rule.
• AddedWash-sale detection.
• SafetyA hook that denies agent writes to execution/ and risk/, and one that denies credential-shaped literals anywhere in the repository.

Tickets that need your click now sit at the top of the overview, with how long they have waited and how far the market has moved since their limit was set. Halt is in the status bar on every page, and Limits now lives in Settings.

• AddedAwaiting you: every ticket waiting for Confirm, oldest first, with its age and how far the price it would fill at has moved from its limit. A limit the market has moved past is flagged, and its Confirm button is no longer the highlighted one.
• AddedThe status bar shows how many tickets are waiting for you and links to them.
• SafetyHalt is in the status bar on every page instead of only on the Limits page. It works as before: nothing is sent until a person resumes with a written reason. When reconciliation is what halted trading, the status bar links to it instead of offering a Resume that cannot clear it.
• ChangedLimits is now a section of Settings, and the old Limits address takes you there. Connections moved into the Configuration group in the sidebar.

The learning page used to show every daily review in full. It now opens with what to do next session, then one line per day and the headline of each lesson, with the full text a click away.

• AddedNext run: what the evening review and the momentum model point to for the next session, most urgent first, each with the measurement behind it under "Why".
• AddedRecommendations that can be an order have a Draft button. A sell is sized to the shares you hold; a buy is left for you to size. Nothing is drafted until you click, and every order still goes through a ticket and Confirm.
• AddedMomentum's current picks, shown with the date their prices end and the note that the model failed its test. With the rebalance rule on, a pick gets no draft, so a name cannot be bought twice.
• ChangedRecent days shows each session in one row: net, orders and the first thing to do. Lessons show their headings. The full review and the full lesson are under Details.
• ChangedThe page is called Learning in the sidebar.

The status bar names the paper plane's mode as AUTO or MANUAL, both in green. Auto is the normal way to run, so it no longer reads as a warning.

• ChangedThe status bar shows ● AUTO when automations may send paper orders without a click, and ○ MANUAL when every order waits for you. It replaces the amber ▲ UNATTENDED, and manual mode is now shown too rather than left blank.

The automations form now has a Run once checkbox, and resuming a rule that finished runs it once more instead of stopping it again straight away.

• AddedA Run once checkbox on the automations form for timer, trigger and threshold rules. It is not offered for a model rebalance, which places several orders a session.
• FixedResuming a run-once rule that had finished arms it again. Before, the order that finished it the first time would have paused it again at its next check.

On a phone the status bar was five rows and stayed pinned to the top as you scrolled, taking about a fifth of the screen. It is now one row, and the rest of it is one tap away.

• ChangedBelow 860px the status bar is one row: the menu, demo or live, HALTED and UNATTENDED when they apply, refresh and your account. Plane, profile, broker, the reading time and the theme switch open beneath it from a details button.
• AddedThe menu drawer has its own close button, and focus moves to it when the drawer opens. The open drawer covers the menu button that opened it, so before this the only way out was tapping the dimmed strip beside it.
• FixedThe menu button is a 40px target rather than the bare glyph, the drawer is sized to the visible screen on iOS, and the page keeps clear of a landscape notch and the home indicator.
• FixedThe segmented control on Automations wraps on a phone instead of running past the edge of the screen.

Each paper credential on the Connections page now has a Store or Replace button. It opens Terminal on the command that stores that credential, and you type the value there.

• AddedThe Connections banner lists every paper credential a provider needs, such as Alpaca’s key id and secret, marked stored or missing. Each has a button, even before any connection names it.
• AddedA credential named by a connection row has the same button beside it. After a press, the page re-checks the Keychain every few seconds for two minutes, so the entry turns from ✗ to ✓ without a refresh.
• SafetyThe page never takes a value. The key goes from your keyboard into Terminal, where it is read without echo, and never reaches the page, an HTTP request or the process list.
• SafetyThe button works only from a page opened at localhost on a Mac, never on Vercel and never from another site. Only a plain credential name is accepted, so nothing else from the request reaches the command Terminal runs.

The status bar on the local dashboard can now start the Alpaca paper plane when nothing is running, and stop it when it is. The deployed page shows no such control.

• AddedStart paper launches the same process as /paper and the 06:05 launchd job, logging to ~/.tradebench/logs/paper.log, and reports the reason if it refuses to start, such as a missing Keychain entry.
• AddedStop paper shuts the plane down the way Ctrl-C does. Orders already at Alpaca stay open; stopping cancels nothing.
• SafetyThe control works only from a page opened at localhost, never on Vercel and never from another site. Start will not displace a running demo or simulator. Stop touches only the paper process, and asks a second time if Alpaca has not yet acknowledged an order.

Run locally against the paper plane, the dashboard now shows the paper account on every page. A slow answer from the account is waited for, not replaced with generated demo data.

• FixedThe dashboard gave the local API four seconds and then showed the generated fixture. The paper plane asks Alpaca on most reads and takes two to five seconds, so the positions page could show the demo’s holdings while the rest of the page showed the paper account. The fixture is now shown only when nothing is running at all.
• SafetyA running API that still does not answer in 30 seconds returns an error saying so. It is never quietly replaced with demo data.
• FixedThe status bar said “mock — no broker account is connected” on the paper plane, and the Equity tile said “mock broker”. The status bar now names the broker behind the API. The simulator and the demo still say mock.

After each close the app files a dated review in the Library: each position against its stop and time exit, the day measured against each name's own volatility, and a to-do list in the order to act on it.

• AddedDaily review, filed once per session after the close as "Daily review, YYYY-MM-DD" in the Library. It flags a close through a stop, a time exit that is due or overdue, positions with no stop resting at the broker, and a plane that started after the open and so could not watch. It also flags buy drafts for names already held.
• AddedEach day's move is shown in sigmas of the name's own daily volatility over 70 sessions. Inside two sigmas it is called noise; beyond it, the review asks you to read the news before the open.
• SafetyThe review only reads. It proposes no order and changes no rule, and every action on its list is addressed to you.

The overview says whether today finished above where it started once a $0.15 fee is charged on every buy and sell, and shows fees to date beside realized P&L.

• AddedThe Today panel shows the day against the previous close after fees, where the day started, the fees charged today, and whether the day was won. A day counts as won only when it is above where it started after paying for its orders; a day that only covers its fees is not won.
• AddedEvery filled buy or sell is charged an estimated $0.15, the figure for real trading. The panel shows the orders to date, the fees they add up to, and realized P&L after fees. An order filled in several parts is charged once. Paper charges nothing, so this line is labelled as modelled.
• AddedThe day figure measures a name bought today from its fill price, not from the previous close, so a noon buy does not count the morning's move. When a name held overnight has no previous close, the day shows as unknown rather than flat.

A rule that asks a registered strategy what to hold, and proposes the orders to get there. Every order still waits for your confirmation.

• AddedA Signal kind on the Automations page. Once a session, at a time you set after the open, it ranks momentum’s 27 studied names and proposes a buy for each new top-3 name and a sell for each name that fell out, sized to the profile’s per-position cap. Between rebalances it keeps the same picks and retries any it does not yet hold, so a buy the limits refused is tried again the next session.
• SafetyA signal rule sells only shares its own orders bought, never your positions. It skips a name while one of its tickets is still open, refuses to rank on history older than the previous session, and takes no parameters from the page.
• SafetyMomentum is labelled for what it is: it failed its registered test (deflated Sharpe 0.90 against 0.95, with a 30% drawdown). Its picks are for you to confirm, not a validated strategy.
• AddedDry run on a signal rule shows the names it would hold, each order with its size and limit, and why any name was skipped.

Drafts carry through to the ticket, and the first orders on paper found three defects: a draft that opened as the wrong symbol, a fill nothing noticed, and a journal the plane could not read back.

• AddedA draft can carry a limit price. Take it to the ticket opens on it rather than on the ask; switching symbol or side goes back to the quote.
• AddedThe Ticket book sorts by any column. A third click returns to journal order.
• SafetyA draft’s symbol is never swapped for another on the ticket. One the book does not carry stays, blocked, until you pick a symbol yourself — and that pick clears the reason written for the other. A draft outside the book is refused when saved.
• FixedAn order still working at the broker explains its unfilled shares, and fills are polled every 30 seconds, so a fill that lands after Confirm no longer halts the plane as unrecorded.
• FixedThe log redactor no longer mistakes some timestamps for credentials. It had blanked times in the ticket journal, and the paper plane could not start from it.
• FixedLive stays up when a held name has no quote, valuing it at the last trade. One unquoted name had dropped the whole page back to the demo data.
• ChangedThe equity book swaps F, ABBV and CVX for DELL, PLTR and ANET, and stays at thirty names.
• AddedAutomations gain a slate kind: a timer whose content is the drafts rather than a named instrument. Creating one is refused until it can fire, so it can never show as enabled while doing nothing.
• AddedTwo drill scripts: one kills the paper plane between sending an order and its acknowledgement, the other asks Alpaca what became of that order.

The confirm button reaches a real broker for the first time — Alpaca’s paper environment, with every order confirmed by a person — and strategies run on real history.

• AddedA third instance, paper, alongside the demo and the local simulator. It has its own data root, cannot point at live, and caps every strategy at Propose.
• AddedPaper round trips reach the attribution ledger and survive a restart.
• AddedA strategy book, a daily review that can demote a strategy automatically, and promotion that only a person can grant.
• AddedReal daily price history from Alpaca into the point-in-time store, and two registered strategies walk-forwarded on it.
• AddedA light theme, derived from the dark palette rather than drawn separately.
• AddedThe Reference page, under Settings.
• ChangedThe broker seams a real venue needs: a market-data protocol, account balance owned by the venue, and one confirmer for every order path.
• FixedAn empty Keychain entry is no longer treated as a stored credential.

The dashboard and its local API: what an operator looks at before, during and after a session, deployed read-only to Vercel as a design-review surface.

• AddedThe dashboard, settings with passive, aggressive and custom profiles, limits, and trade tickets that are proposed and then confirmed.
• AddedCrypto as a third asset class: fractional quantities rounded down to the venue’s precision, and a ceiling that binds.
• AddedA versioned learning library.
• AddedAn overview board you can arrange, with tiles that read the record back.
• AddedYour own record: tasks, notes, a calendar and drafts.
• AddedExit policy: the arithmetic behind a take-profit and a stop-loss, and a bracket that rests with the entry.
• AddedThe Rockwell identity: the glass surfaces, the palette, the lion mark and the animated background.
• AddedA sidebar that collapses on desktop and becomes a drawer on a phone.
• AddedA broker protocol the dashboard submits through, and a preflight command.
• ChangedReconciliation compares the local journal against the broker, rather than the broker against itself.
• SafetyThe deployed page renders a generated fixture when the local API is unreachable. Writes return 503 and are never simulated.
• FixedFive layout defects found by reviewing the running pages.

Data, storage, and the tools for testing an idea honestly before it goes anywhere near an order.

• AddedMoney as Decimal, never float, and an injected clock so a replayed session gives the same answer.
• AddedMarket data types, the real NYSE calendar, and corporate actions.
• AddedPoint-in-time bar storage on Parquet and DuckDB.
• AddedLive feed plumbing: backoff, gap detection and backpressure.
• AddedAn event-driven backtester with a settlement-aware portfolio.
• AddedA cost model wired through the backtester.
• AddedA feature library with a check that no feature reads the future.
• AddedEvaluation: deflated Sharpe, walk-forward and purged k-fold.
• AddedModel plumbing, and an LLM layer with caching, isolation and bounded influence.