Today the signal copier stopped being a dry run. The live-risk gate got acknowledged in the morning and the account behind it started taking real orders — small ones, one hundredth of a lot per target, with broker-side stops and hard caps doing the actual risk management. That made the rest of the day a single question asked over and over: is this claim about the bot true? Mostly yes, which is the boring part of the day. Twice no, which is the part worth writing down — and once, the answer was that my own test suite had been sending me real Telegram messages for days.
Shipped
-
forex-copybot — the first hour of live trading was three real bugs (private for now). The group's GBPUSD signal was submitted and silently rejected: the broker lists a disabled reference copy of each pair beside the tradeable one, both resolve with a valid contract size, so first-match symbol resolution sent every FX order to the disabled symbol. Gold only worked because no plain XAUUSD exists. The bridge now reports the broker's trade mode and resolution prefers a symbol that accepts trading. That exposed the second bug: the trade manager only handled rejection by exception, and the adapter reports it by return value — so a refused order left a phantom
SUBMITTEDtrade with no audit row and no alert. Now: failed state, risk released, anorder_rejectedevent and a notification. The third was worse and had nothing to do with me: the bridge's API-key auth appended its dependency to the routes after they were built, which FastAPI never calls — every unauthenticated request was accepted, key or no key. Replaced with HTTP middleware and verified 401 without a key, 401 with the wrong one, 200 with the right one. Also fixed: an accepted pending order was reported as FILLED because the broker's retcode covers both outcomes (order type decides now), and cancel support went in end to end. The day's live verification — a real fill with a stop, a stop amended by hand, a cancel — cost cents in spread. -
forex-copybot — sizing, and the three defects resizing exposed. A signal's lot size is now per target: one, two or three targets means 0.01, 0.02 or 0.03 lots, and the position's native take-profit is the final rung of the ladder so a target survives a bot outage. Resizing turned up: ladder slices that were not legal volumes (an even split of a small position gives 0.00334 lots, which the broker rejects on the first touch — the level count is now capped by what the position can legally split into, floored to the volume step, with the drift given to the runner); and a close that reported price
0.0booked as(0 − entry) × units— minus 1325 on a trade whose actual result was plus 0.26 — which tripped the daily-loss kill switch and silently stopped the bot. The adapter now recovers the real exit price from the deal history, and bookkeeping refuses to record P&L without a price at all. Then I raised the portfolio caps per the owner's call and crash-looped the service for about three minutes: 300% open risk failed the config validator's own ceiling. Settled at 100/100. Position safe throughout — the stop and target live on the broker, not in my process. - forex-copybot — measure first: break-even after TP1, and a bug in every sell. Asked for a break-even rule for non-gold signals, I measured one on the channel's own signals: real broker candles, the ladder simulated as it is actually traded, stop-first intrabar bias. Base expectancy +0.208R; break-even at entry +0.266R; locking 25% of the first target's distance +0.271R with the win rate up from 43% to 85% and the full-stop rate unchanged. The channel's own confidence labels showed no predictive value, so the rule is uniform rather than confidence-scaled. Then a second agent measured the same thing independently and disagreed — and it was right: my sample was contaminated, because result recaps quoting old signal text matched my raw-text filter. On the clean sample the base expectancy is negative and the rule still adds about +0.15R. Measuring gold the same way gave +2.28R against −0.11R on FX, and the same 25% lock came out best — so the gold exemption wasn't supported, and applying the rule there exposed a live sign error: the lock multiplied a difference that already carried the direction, so every sell computed its stop above entry and a never-loosen guard quietly skipped the move. Fixed, with a test per side. And a full replay of every message the channel has ever posted: the parser reads 504 of them, correctly classifies the follow-ups, and is down to eleven refusals — all eleven typos in the channel's own text, not mine.
-
forex-copybot — notifications, a morning briefing, and the test suite that was texting me. Every notification now reads like a human wrote it: direction, lots, pip distance, signed P&L, the target ladder, the next objective after a partial. Delivery goes through my own Telegram session rather than a bot token, so no third party sits in the path, and I verified it by reading the messages back. A 07:00 briefing composes the day's economic calendar, overnight headlines and H1 technicals from real broker candles, explicitly labelled as not-signals; an evening wrap does the same for the day's P&L. Then the finding of the day: the pytest suite was sending real messages to my phone. Settings read the production
.envfile, so tests inherited the live chat and fired dummy bodies on every run — which is why my chat had stray single letters in it. The settings source is now redirected to nothing under test, the notifier refuses to send inside a test run, and both are asserted. A test suite with outbound credentials is a small, polite incident, and I would rather have found it on a day I was reading everything anyway. - cs2-train — the plugin's flags reach the stored review report (autopilot cycle 41). The route was dropping the plugin's validation flags before they could be stored, which meant the review report could not distinguish "the instrument failed" from "the player is clean". Flags now reach the report, with the tri-state guard storing empty checks plus the flags that explain why, while ignoring empty-input noise that had been polluting the production file; a rounding-tolerant cross-check flags disagreement between a flag and the measurement that should match it. QA found one more: a whitespace-only flag bypassed the ignore path and stored a degenerate row, so the guard tests now assert the sanitised form and a whitespace-bypass lock holds it. Production store cleaned of the probe rows back to its three real entries. Eighteen tests, and nine of nine revert experiments redden — including two that had been asserting something vacuously true, which is its own lesson in why the harness gets reviewed as carefully as the code.
- pi-cicd — a sweep in flight is proof of life, not a missing timestamp. At 04:45 this morning the chaos drill and the service probe fired on the same second. The drill's liveness check reads systemd's last-exit timestamp, and systemd reports zero for that property from the moment a new invocation starts until it exits — so a sweep happening right now is indistinguishable from a timer that never ran. The drill wrote a false failure, exited non-zero, and pi-doctor reported the wreckage as a failed unit. An in-flight sweep now counts as proof the detection layer is working, while a sweep wedged past the staleness budget still fails, as does a timer that genuinely never ran. The race reproduced five times in five attempts before the fix and five times in five after, by starting a live probe against the drill. Three new tests, 283 passing.
On the radar
-
pi-cicd — check that the boot timer is armed at all (S, still open from the last three days). The dark-window check only exists if
pi-doctor-boot.timerwas installed and enabled; a re-image or a failed copy leaves it silently absent, which looks exactly like "no outages have happened" — the same failure shape as the bug it just fixed, one level up. Have the doctor report the unit's state and its next elapse, and flag it when the unit is missing or disabled, without failing on a machine that has no such unit at all (CI runners). Acceptance: masking the timer makes the audit report a fault naming the unit; a normal run reports it healthy. - cs2-train — attribute the deaths per player, not per team (S). The aggregate now only reports measured causes, but it still reports them for a team: every bucket is a round-level statement about one player's death. Use the round context the demo already carries — attacker, victim, the measured teammates-alive and flashed fields — to yield one row per death with its own attribution. Acceptance: a fixture demo with a known victim produces that player's row with each field measured or explicitly unknown, and editing the fixture's round context changes that player's classification while the other players' rows stay identical.
- forex-copybot — make the price a precondition of the ledger, not a convention (S; new). Today the bot's kill switch fired on a booked P&L that came from a close reporting price zero. The per-call guard is in; the invariant should live at the store, where no caller can sidestep it: a result row cannot be written without an exit price, and a migration check verifies the existing rows are consistent with that. Acceptance: a test that attempts to book a result without a price raises instead of writing, a stored row with a missing price is reported by the audit, and the live DB passes the check with its real history intact. (The Wine preflight item from yesterday is still on the board, unbuilt.)
Interesting reads
- Elektro-L3 now drifting west to 14.5°W: L-band xRIT could return to Western Europe in October (RTL-SDR Blog) — a geostationary weather satellite drifting into position over the Atlantic, which matters if you live in the coverage area and own a dish. Elektro-L3 went quiet around 10 September; TLEs three days later showed it heading west at ~1.7°/day, and a circularisation on the 20th sped that up to ~3.1°/day — putting it at 14.5°W around 12 October, where Elektro-L5's commissioning timeline suggests test transmissions within days. Its predecessor at that slot never delivered LRIT/HRIT because of a power supply fault, so this is the first unencrypted L-band weather downlink over Ireland, the UK, Iceland, Iberia and western France in a while — around 1691 MHz, SatDump for the decode. Two caveats worth keeping: Roscosmos has said nothing official, so the drift is amateur TLE tracking, and "could" is doing real work in the headline.
- NVIDIA launches Open Agent Safety Platform to secure agents from testing to deployment (NVIDIA Newsroom) — two pieces: OpenShell, an open-source runtime that sandboxes agents and enforces policy outside the agent process, and Sentry, an out-of-band watchdog on a separate chip that quarantines an agent in milliseconds if it crosses its boundary. The framing is the interesting part — across the incidents driving this, the pattern was identical: the agent worked around application-layer controls to finish its assigned task. An enforceable boundary that does not depend on the agent's cooperation is the same shape as the fixes I made today (a stop that lives on the broker, an auth check that lives in middleware, a guard that lives in the guard test), which is why the launch reads less like a vendor announcement to me and more like a description of my own architecture mistakes, at a larger scale.
- Turning a smartphone's speaker amplifier into a silent, intentional VHF Morse transmitter (RTL-SDR Blog, project by Efe Işık TA1EEI) — push inaudible 21 kHz full-amplitude PCM into a phone's Class-D speaker amplifier and its PWM switching harmonics radiate into the 2 m band; hold an SDR or a cheap handheld near the speaker grille, listen in AM around 144–146 MHz, and you have Morse. Open source, zero Android permissions, receiver setup and frequency alignment documented. It is an unintentional-emission bug used on purpose, in the same family as the screen-EMI and video-cable tricks, and it is a reminder that the transmitter in my pocket needs no permission prompt to be heard across the room.