> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/evidence-and-handoff-records/nightshift-a-z-trader-certification-2026-07-24.md). # A-to-Z trader certification · 2026-07-24 **Date:** 2026-07-24 **Production URL:** **Production release:** `a660ed48645219c6c2e6aac152728e2f2a525018` **Artifact SHA-256:** `0e1129f8869d55a0a26595c51fab190ca78d8c8589308e9741db7b72d450d06c` **Test surface:** signed-in production Chrome session, live public venue data, persistent PAPER trading, read-only account tools, infrastructure and fail-closed authority boundaries **Excluded authority:** no real order, cancellation, leverage mutation, wallet signature, API-wallet registration, funding, withdrawal, deposit or capital movement was attempted ## Executive verdict NightShift's signed-in desktop PAPER terminal is operational across Hyperliquid, Lighter and Arcus. The run exercised live-book market and limit simulation, resting GTC orders, reduce-only rules, stop loss and take profit triggers, persistent PostgreSQL recovery, risk caps, account and market reads, workspaces, alerts, charts, onboarding, discovery, Robinhood Chain diagnostics and every visible authority mode. All tested PAPER positions are flat, active local GTC orders are zero, reserved GTC notional is zero and PAPER remains selected. Three production defects or configuration gaps were found and resolved: 1. Duplicate workspace names could blank the terminal. The workspace boundary now contains the collision and the production regression passes. 2. A late Hyperliquid account response could appear inside a newly selected Arcus inspector. Account reads now use venue-scoped abort controllers and reject superseded responses. 3. The production Privy app was not issuing identity tokens. The required Privy setting was enabled, the restored-session token refresh path was retained in code, and the signed-in profile now loads revision 1, linked-wallet evidence, portfolio workspace and access map. The immutable Linux release passed the full repository handoff gate and was promoted atomically. Public health, PostgreSQL, encrypted backup verification and HTTPS routing pass. **Certification:** desktop signed-in PAPER trading and read-only venue intelligence pass. Real-capital trading is **not certified or authorized** because the private signer, eligibility, testnet campaign, dead-man rehearsal, alerting, legal decision and explicit mainnet canary evidence are not complete. ## Rail-by-rail result | Rail | Data | Account tools | PAPER | Approval / live | Result | | ---------------------- | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------ | -------------------------------------------------------------------- | ---------------------------------------------------------- | | Hyperliquid | Live metadata, 10 DEX discovery, book, trades, candles, funding and references | Public master/sub-account state, positions, orders and bounded history | Market, limit, GTC, reduce-only, SL, TP, portfolio and persistence | Approval remains human-gated; LIVE remains locked | PASS for public read + PAPER | | Lighter | Live public catalog, book, trades, candles and funding | Public L1 account read; private orders/fills remain explicitly separate | Live-book open/close and risk controls | No signer configured; venue mutation unavailable | PASS for public read + PAPER | | Arcus | Live Robinhood Chain-rooted perpetual catalog, book, trades, candles and market brief | Public EVM inspection with Arcus-only validation and response isolation | BTC-USD and NVDA-USD open/close cycles | Approval is no-send; LIVE requires API wallet and operator authority | PASS for public read + PAPER | | Robinhood Chain assets | 27 canonical contract rows plus native ETH, public provider head and diagnostic holdings | Manual public-wallet read and injected-wallet discovery without a signature | Not a perpetual PAPER venue | Direct Stock Token RFQ/execution remains unavailable | PASS for discovery/read-only; production-data lane blocked | ## Trader test matrix | Area | Production scenarios | Result | | --------------------------- | ------------------------------------------------------------------------------------------------- | ------------------------ | | Authentication | Restored Google session, server session verification, identity-token refresh, profile reload | PASS after Privy setting | | Private profile | Revision 1 preferences, experience, portfolio home, density, chart preset and notifications | PASS | | Linked wallets | Provider-verified embedded wallet inventory, bounded chain evidence, no signature request | PASS | | Access map | Research, account, portfolio, trading/funds and Agent API boundaries remain independent | PASS | | Onboarding | Five-step first-user guide and coachmark entry point | PASS | | Changelog | Full lifecycle release notes open and render | PASS | | Build trust | Exact 40-character commit and artifact digest match public health | PASS | | Workspace presets | Full desk, Chart focus, Research and Execution | PASS | | Custom workspaces | Pane toggles, save/apply/delete, duplicate-name containment | PASS after fix | | Price alerts | Above and below creation, persistence, removal and zero-value rejection | PASS | | Command palette | 48 safe commands/results, cross-venue market search and keyboard navigation | PASS | | Chart styles | Candles, line, area and Heikin-Ashi | PASS | | Chart intervals | All advertised Hyperliquid, Lighter and Arcus intervals | PASS | | Chart history | Range controls, bounded backfill, FIT, zoom and live return | PASS | | Chart tools | Indicators, horizontal/trend drawings, history tools and fullscreen entry | PASS | | Market transport | REST recovery plus supervised WebSocket book/trade updates | PASS | | Reference integrity | 534 markets; every published reference remained inside the 500 bps quarantine envelope | PASS | | Market brief | Deterministic briefs on Lighter, Arcus and Robinhood Chain discover-only surfaces | PASS | | PAPER setup | Starting balance, daily loss, drawdown, market cap, portfolio cap, spread and slippage | PASS | | Market entry | Hyperliquid long and short fills from visible depth | PASS | | Position sizing | USD sizing and 1x/2x/5x/10x guidance | PASS | | Stop validation | Invalid long stop and already-triggered levels rejected | PASS | | Stop execution | Valid stop armed, persisted and triggered from a newer live mark to flat | PASS | | Take-profit validation | Invalid/already-triggered levels rejected | PASS | | Take-profit execution | Valid target triggered from a newer live mark to flat | PASS | | Immediate limit | Crossing limit filled; non-crossing immediate limit did not invent a fill | PASS | | Resting GTC | Non-crossing order created, reserved risk, survived reload and canceled locally | PASS | | GTC lifecycle | Open, persisted, canceled and reserve released; zero active at handoff | PASS | | Reduce-only side | Same-side/add attempt blocked | PASS | | Reduce-only size | Over-close and position-flip attempts blocked | PASS | | Partial close | Partial reduction retained the exact remainder | PASS | | Exact close | Remaining quantity closed exactly to flat | PASS | | Risk cap | `$251` entry rejected by the configured `$250` market cap | PASS | | Portfolio accounting | Equity, realized/unrealized lifecycle, limits and trade history visible | PASS | | PostgreSQL recovery | Browser state recovered and converged to `DATABASE SYNCED` after reload | PASS | | Hyperliquid account read | Public burn-address inspection returned no open positions or orders | PASS | | Lighter account read | Public account boundary exercised without private order authority | PASS | | Arcus account read | Valid request stayed Arcus-scoped; invalid address returned Arcus validation | PASS after fix | | Cross-venue race | In-flight Hyperliquid request canceled before switching; no response leaked to Arcus | PASS after fix | | Robinhood catalog | All canonical assets browsed; contract and class evidence visible | PASS | | Robinhood holdings | Invalid address rejected; public burn address returned bounded holdings | PASS | | Robinhood provider selector | Phantom, MetaMask and Brave Wallet selectors exercised without connecting | PASS | | Robinhood watchlist | Add, filter, remove, empty and restore full catalog | PASS | | Robinhood activity | Holdings, RFQ, activity and index-audit tabs | PASS | | Robinhood index safety | Contiguous checkpoint and head-safety projection | PASS | | Robinhood fail-closed | Diagnostic RPC, no archive attestation, no WSS heads and no direct execution | PASS | | Approval mode | Human-gated/no-send states remained explicit | PASS | | LIVE mode | Signer/operator/eligibility gaps remained locked and no venue mutation occurred | PASS | | Browser diagnostics | No error originated from `https://nytshift.xyz`; observed errors were competing wallet extensions | PASS | The alert engine's actual future market crossing was not artificially forced during this production session. Its crossing behavior passed the deterministic automated suite. Chrome's extension control surface also does not expose device-viewport emulation, so this run does not claim a live 390-pixel Chrome pass; 27 terminal contrast/mobile contracts, scroll-boundary tests and the repository's mobile-390 production evidence contracts passed instead. ## Defects and corrections ### 1. Restored Privy session had no profile token **Observed:** the user was server-verified but the private workspace displayed `PRIVY IDENTITY TOKEN REQUIRED`. **Cause:** the production Privy app's **Return user data in an identity token** setting was disabled. Privy's production contract requires that setting before `useIdentityToken` or `getIdentityToken` can return provider-bound account data. **Correction:** enabled the setting in the exact production Privy app. The application also refreshes a missing restored-session identity token with Privy's supported `getIdentityToken` API. **Retest:** after a full production refresh, the profile loaded revision 1, Google evidence, the verified embedded-wallet projection, customer capital desk and feature-access map. ### 2. Cross-venue account response race **Observed:** a late Hyperliquid response could be rendered after the user had switched to Arcus. **Correction:** every Hyperliquid, Lighter and Arcus account request now owns an abort controller; a new request or venue selection aborts the previous controller, ignores superseded completions and resets the form under a venue key. **Retest:** initiated Hyperliquid inspection, switched to Arcus while it was in flight, waited beyond the original request window, then exercised Arcus validation. Only Arcus state and Arcus copy were rendered. ### 3. Python lint toolchain drift **Observed:** an unpinned builder could select a newer Ruff release and produce non-release lint behavior. **Correction:** Ruff is pinned to `0.15.21` in the Python project and lock. **Retest:** Python lint, 96 Python tests and all signer-supervisor integrations pass inside the immutable Linux release builder. ## Automated verification | Gate | Result | | --------------------------------------------- | ---------------------------------------------------------- | | Web tests | 185 files passed, 2 skipped; 1,114 tests passed, 2 skipped | | Venue tests | 53/53 | | Contract tests | 73/73 | | TypeScript/Turbo tasks | 16/16 | | Operational/runtime audit suite | 157/157 | | Python execution tests | 96/96 with one Starlette deprecation warning | | Python lint | PASS with Ruff 0.15.21 | | Arcus signer supervisor integration | PASS, offline/no authority | | Hyperliquid testnet signer integration | PASS, offline/no authority | | Capped Hyperliquid mainnet signer integration | PASS, offline/no authority | | Signer-store backup/restore | PASS | | Optimized Next.js production build | PASS | | Local route smoke | PASS | | Handoff and secret scan | PASS, zero errors | | Public reference audit | PASS, 534/534 published references accepted | The two skipped tests are the disposable-PostgreSQL integration suites. They were not pointed at production because they create and mutate isolated test schemas. The real production path was independently verified through the exact four-migration registry, signed-in profile read, PAPER writes/reloads, public health and encrypted backup checks. ## Deployment and infrastructure evidence | Evidence | Result | | -------------------------- | ------------------------------------------------------------------ | | Artifact file count | 2,836 | | Artifact tree SHA-256 | `d534e46359f68f43593f35a7d075ef4d3e3ead3eb658e5e4a81f0ccb82ae12c1` | | Artifact bytes / unpacked | 24,000,895 / 81,088,512 | | HTTPS routes | `/`, `/terminal`, `/nightshift`, `/api/health` returned 200 | | HTTP redirect | 301 to HTTPS | | Web service | active, zero automatic restarts | | Release capacity | ready; deployment required no pruning | | PostgreSQL | active, loopback-only on `127.0.0.1` and `::1` | | Migration registry | current, 4 applied / 4 available, checksums verified | | Customer store | ready; one customer, three PAPER sessions, one active session | | Backup timer | enabled and active | | Latest encrypted backup | AES-256 custom dump, SHA-256 verified, root-only `0600` files | | Hyperliquid signer service | installed, disabled and inactive | | Arcus signer service | not installed | | Execution | disabled | | Mainnet | false for Hyperliquid and Arcus | The one systemd warning at promotion was the old Next.js process exiting with status 143 during the explicit service restart. The new process became active immediately, reports zero automatic restarts and has served the exact verified release since. ## Screenshot evidence The local evidence folder is: `output/nightshift-a-z-certification-2026-07-24/screenshots` It contains 29 screenshots (approximately 4.18 MiB), including: * Arcus and Lighter flat PAPER cycles; * onboarding, changelog, workspaces, alerts and command palette; * all chart styles/timeframes/drawing controls; * Hyperliquid entry, live PnL, armed SL/TP, genuine stop and target triggers; * reduce-only partial/exact closes, GTC reserve and risk-cap rejection; * account equity, limits and public Hyperliquid account read; * Robinhood Chain diagnostic/index evidence; * restored signed-in profile; * corrected Arcus inspector isolation; * exact production build proof; * final zero-position/zero-order PAPER handoff. ## Clean handoff state * Hyperliquid PAPER position: flat. * Lighter PAPER position: flat. * Arcus PAPER position: flat. * Hyperliquid local GTC: 0 active, `$0` reserve. * Inspected Hyperliquid public account: 0 positions, 0 open orders. * PAPER remains selected; APPROVAL is no-send; LIVE is locked. * PostgreSQL reports `ready` and the UI reports `DATABASE SYNCED`. * No task-owned server, watcher, test runner or browser tab remains. * Source fix commit and this report are pushed to GitHub. ## Remaining launch blockers 1. Complete and retain Privy production rehearsal evidence for both Google and wallet login, cookie-domain/DNS, expiry, origin rejection and Robinhood Chain switching. 2. Configure a dedicated user-owned Hyperliquid **testnet** API wallet without exposing the owner key. 3. Configure signed eligibility, signer scope, confirmation secrets, builder identity and independent operator alert delivery. 4. Run the full testnet campaign with fresh action-time authorization for each mutation: resting GTC/cancel, IOC fill, reduce-only close, bracket TP/SL, ambiguous-outcome reconciliation, dead-man and restart/restore. 5. Copy encrypted PostgreSQL backups off-host and enable provider snapshot/PITR or an equivalent independently credentialed recovery path. 6. Configure licensed Advanced Charts and its exact-release production rehearsal evidence if that advertised lane is required. 7. Replace the Robinhood public diagnostic RPC with independent production HTTP, archive and WSS providers and complete the provider attestation. 8. Record legal/jurisdiction approval before customer real-money execution. 9. Only after all prior gates pass, request separate fresh authorization for a low-value, capped mainnet canary. This certification grants no such authority. ## Final assessment NightShift is ready for signed-in desktop PAPER use and read-only multi-venue research. The tested simulation, persistence, risk and fail-closed boundaries behave as designed, and the final state is flat. It is not yet truthful to call the platform live-capital ready. The next milestone is the private testnet signer campaign—not a mainnet deposit. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/evidence-and-handoff-records/nightshift-a-z-trader-certification-2026-07-24.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.