Takes effect before their first sign-in. Blocks
override everything, including auto-approve.
Watchlist — symbols the gateway accepts
Timeframes the gateway accepts
Add the frame here BEFORE creating any alert on it — a fire on a frame not listed is rejected and mails.
Every accepted signal, every rejection and the daily secret audit are mailed here, and the
gateway refuses a config without an address. Saved with the watchlist. Blank on a brand-new
config: this page is public source, so the mailbox is not written into it — type it
once and save.
Earnings dates (P-126)
The dashboard warns when a position is open through a print: the resting stop stays
but can fill well past it, so the 1% sizing stops bounding the loss (P-129). Typed by hand
from the company's own investor-relations page — there is no automated source, because
Yahoo's keyless feed carries dividends and splits but not earnings, and its earnings endpoint
answers with a bot challenge this project does not defeat.
A date left blank, or left in the past, shows as a warning — never as "no risk".
Tick never reports for an ETF, trust or fund (GLD) so it goes quiet instead:
that is a different thing from a date nobody has typed yet, which is why it is a separate
control. Saved with the watchlist. Since P-190 a date for a symbol you remove stays in
the config and simply stops being shown here: the gateway does not use it, but it still
checks it, so one it cannot read is named just below wherever it is stored, and the
save no longer edits entries it was not asked to touch.
A signal for a symbol not on this list is recorded and rejected, never silently dropped
(spec FR-10). Changes take effect immediately — no redeploy. Removing a symbol does not
delete its history.
Remember to add or remove the matching TrendSpider alert pair — this list only
controls what the gateway accepts, not what gets sent.
Alert token security
Alert tokens are derived, never stored: HMAC(master, generation + symbol + direction).
Nothing here reveals a token — these are the two controls that decide which tokens the
gateway will still accept.
Rotate ONE scope — the tool for a single exposed token
Moves one symbol+direction to its own generation. The old token stops verifying, the
new one (derived at that generation) works, and no other Note is touched. Prefer
this over the generation bump below whenever only one credential leaked.
Then re-derive just that scope's Notes:
node tools/derive-token.js SYM go <gen> <frame>, once per frame the
watchlist accepts, because each Note body names its chart's frame. A symbol in a TradingView
batch pane needs its line regenerated too, and that line carries BOTH directions: give
derive-batch-line.js the symbol as
SYM:<go gen>:<nogo gen>. The box above lists every generation
and revocation changed on this page and not yet saved; once the save lands it prints the exact
commands, and keeps them while the gateway still holds what was saved. A chip's × returns its scope to
the global generation; when that is lower it asks for a second click, because it revives
the tokens at the global generation.
⚠️ A revoked scope stays dead regardless — un-revoke it above the save if you are
rotating it back to life.
One click: rotate a symbol's go + nogo and save
Click, then click again within fifteen seconds: both scopes move to (their highest current
generation + 1) and the config saves — the symbol's current pair stops verifying at
once, in every alert that carries it. The command it prints (run it from the repo's top
folder) derives the new pair with the master typed at a hidden prompt, with one set of Note bodies
for each frame the watchlist accepts (a 1h Note takes the 1h body); then update each place the pair lives: the TrendSpider
Notes for the symbol (Go, NoGo, and any AddOn, Trim or ZeroRej), the TradingView sidekick
instance's settings, its alert (recreate it), and the batch pane that lists the symbol
(regenerate its token line with SYM:<gen> and edit-save
its alert). What stays manual is every paste and alert, because neither vendor has an API
for them.
Generation
—
⚠️ Bumping invalidates EVERY derived token at once. Every alert Note carrying a
"token" stops authenticating until you re-derive it at the new
generation and paste it back. Alerts still carrying "secret" are
unaffected. Do this in one sitting.
Revoked scopes — blocked at every generation
Use this to kill one exposed credential immediately. ⚠️ The block ignores generation, so a
revoked scope stays dead even after a bump — remove it here once you have
re-derived, or that symbol never authenticates again.
Same save as the watchlist — one config document. An owner staged a
rotation here, never scrolled up to the other save button, and the leaked token stayed
live for a day. Hence a save button IN this card.
Webhook source addresses (P-206)
A leaked alert token is only useful from a machine that can reach the gateway. This check
compares where each request actually came from with the addresses its source
publishes. Log records a mismatch on the row (a red tag on the dashboard, a column in
the export) and refuses nothing. Enforce refuses a mismatch as
source_ip_not_allowed. Run Log for a week first: if the vendor's
own rows carry the tag, the judged entry is wrong and Enforce would refuse every fire.
Unless the tag reads payload names no source: then that alert's body is
missing "source" and the judged entry is fine (runbook 10.15 step 4).
Mode
TradingView
TrendSpider
Exact IPv4 addresses, comma-separated, from the vendors' own pages (TradingView: "How to
configure webhook alerts"; TrendSpider: "Webhooks for Alerts"). Both lists can change without
notice.
Same save as the watchlist — one config document.
Cloud cost (P-223)
Reading the last billing notice…
This card only reads. Changing the budget is done in the Cloud console. The figures come from
the Cloud Billing budget's own notices, which Google publishes several times a day; a Google
budget alerts and never stops spending, and a hard cap is an owner decision that is not built.
A mail goes to the notification address the first time each threshold is crossed in a budget
period.
Order routing: kill switch
Halt stops order routing. The global switch stops every account; an account's switch stops that
account only. An absent switch reads as halted. Nothing routes in this build: the switch is in place
before anything can.
Reading the routing switches…
Release is not available here in this build. Confirm a halt on /health, routing.switch.
Features in UAT
Alert coverage (TrendSpider and TradingView)
Symbol
Timeframe
Go alert
NoGo alert
Last signal
Total
Alert body
Add a symbol to the watchlist above first.
Derived from the ledger: a direction shows ✓ once the gateway has received a real fire of
that direction on that timeframe from some alert. The grid does not separate systems, so
a GNG alert that delivers makes the cell ✓ even if the Custom or Sidekick alert of that direction
does not. — means no alert of that direction is delivering, or none has fired yet
— the ledger cannot tell those apart. Intraday bars only means every row was an
intraday bar labelled 1D: an alert on the wrong chart or an old script. ✓ + intraday
bars means some alert delivered, and an alert of that direction is also firing on the wrong
chart. Test rows only means the only rows were sent by hand. A burst mark means the
newest fire of that direction came from the 17 Aug re-activation burst: it counts here as
delivery, and the dashboard's Observe gate does not count it as evidence. Based on the last 300
signals of each timeframe.
Who can read the ledger
The effective answer, computed the same way canReadDashboard() in
firestore.rules computes it: a block anywhere wins, otherwise an explicit
approval from either source grants access. Admins are always included — they are
authorised by the rules directly and never need a record here.
Email
Access
Granted by
Notes
Nobody has access yet.
Email invites & blocks
Email
Status
Added
By
No email invites or blocks yet.
Sign-in requests
Email
Status
Requested
Decided
By
Nobody has requested access yet. Requests appear here when someone signs in
on the ledger page and asks.