boot
One process takes the lease
A single-writer file lock, TradingRuntimeLease.ts, decides that exactly one server owns the trading database. Dual belief is bounded to one heartbeat; dual writing is impossible.
AI agents trade Hyperliquid testnet under budgets, guards, and reconciliation. This atlas takes the machine apart, one subsystem per page.
The atlas was commissioned around seven questions. Each one has a home.
Every trading action travels the same spine: a typed request becomes a command, a pure decider emits events, reactors do the side effects, and the exchange answers. Click any node to read its page.
From a cold start to a filled order, in six beats. Every step cites the code that performs it.
A single-writer file lock, TradingRuntimeLease.ts, decides that exactly one server owns the trading database. Dual belief is bounded to one heartbeat; dual writing is impossible.
A supervised, keyless child process records market history because Hyperliquid only serves about 5,000 bars: "a minute not recorded is a minute gone" (archive/config.ts:8-12).
Binding a chat thread to a market creates a mission with an authority envelope: leverage, notional, cumulative-loss, and planned-risk ceilings as absolute dollars (TestnetAuthority.ts:13-23).
Persisted predicates evaluate on live candles, fire exactly once through two durable guards, and a composed wakeup snapshot resumes the harness under a decision lease (WatchEvaluator.ts:16-25).
trading_enter runs the 14-item preview, persists the execution record and risk reservation before signing, signs inside the serialized nonce lane, and posts to /exchange.
Fills arrive over the userFills feed; the reconciler overwrites local tables with canonical truth and rings the invalidation doorbell, so the web UI updates from projector output alone (HyperliquidReconciler.ts:1100).
Ranked by how much of the system exists to protect them.
Eight named triggers funnel into one convergence pass where local state never outranks Hyperliquid. Drift is classified, repaired, and reported.
Read reconciliation 02Every acknowledged position increase must carry a confirmed exchange-native reduce-only stop. If the protection window closes uncovered, the position is emergency-closed.
Read risk control 03The exchange does not deduplicate marketable IOCs, verified live. T3 Trade persists the idempotency record before signing and refuses every retry that could double a position.
Read executionSixteen pages, one subsystem each. Live chips show which build agent is writing what, right now.
What T3 Trade is, the boundaries it refuses to cross, and how all sixteen parts stack into one product.
The command queue, pure decider, persisted events, projectors, and reactors that everything else plugs into.
The one path that spends capital: preview, record-before-sign, nonce lane, response inspection.
Budgets that clamp, guards that block, protections that must exist, and the seven controls that always answer.
Eight triggers, one convergence pass, and how drift is classified, repaired, and told to the agent.
The shared types and pure policy math that keep server, web, desktop, and providers honest in lockstep.
Local, deterministic signing; a key that fails closed; ceilings that only narrow.
How delegated authority lives, sleeps, gets woken by its own predicates, and is taken away cleanly.
Charts, alerts, backtests, and validations with no signer at all, and refusals that stay honest.
Five agent runtimes behind one contract, and the boundary test that keeps trading code from spawning any of them.
Short-lived credentials, managed tunnels, and a control plane that is deliberately not the data path.
The panels operators actually touch: read models via typed atoms, an invalidation doorbell, staleness banners, and controls that work when nothing else does.
The constitution in one page: every guard, budget, lease, and idempotency boundary, and what each one costs.
Five real fixes, RC02 to RC06, each a lesson about never calling an unconfirmed outcome a success.
Mission, watch, wake, cloid, IOC, doorbell, projection: the system's vocabulary in plain words.