> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/normative-design/testing.md). # Test and release strategy Pull-request branch protection requires the deterministic `ci / typescript`, `ci / execution-python` and `ci / browser-e2e` jobs. Live Arcus, Hyperliquid, Lighter and Robinhood Chain availability is isolated in the scheduled/manual `provider-canary` workflow and classified using fixed reason codes; see [Provider canary classification and response](/nytshift-docs/market-data-and-providers/provider-canary.md). | Suite | Proves | Required gate | | ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Unit/property | sizing, leverage, PnL, rounding and policy precedence | all risk rules/branches; no NaN/overflow | | Contract | payloads, signatures, errors and schema drift | order/cancel/fill lifecycle matches state machine | | Replay | deterministic decisions/fills and no look-ahead | same events/config → same result | | Integration | reconnect, duplicates, out-of-order events and partial fills | no double count; eventual reconciliation | | Public venue boundary | official-origin pinning, body cap, concurrency, rate window, circuit open/half-open/recovery | no SSRF, raw body leak, overload fan-out or fabricated recovery | | Public stream boundary | pool/ref-count, replay/unsubscribe, heartbeat, stale/oversize close, subscription/message/new-connection budgets; Arcus/Hyperliquid full L2 snapshots; Lighter nonce-continuous changes, deletion and forced gap recovery | one socket per venue; strict REST fallback and age stay explicit; malformed/crossed/wrong-market books fail closed; no endpoint/symbol/payload telemetry | | Live-feed soak evidence | eight normalized loopback probes, bounded/fresh schemas, fixed-code failures, 10,000-sample cap, SHA-256 chain, minimum coverage/availability, real child-generation change, 60-second convergence and 24-hour qualification | no direct venue call, payload/endpoint/account retention, unsafe runtime continuation, fake restart proof, diagnostic-RPC promotion or short-run qualification | | Browser trust boundary | nonce rotation, script/style tags, directives, self-hosted fonts, cross-origin headers and violation observer | zero unnonced scripts, script `unsafe-inline`, unexpected connect origins or runtime CSP violations | | Accessible interaction boundary | forward/reverse modal focus wrap, initial focus, opener restoration, dialog-identity transfer, busy Escape guard, visible focus and reduced-motion media emulation | no focus escape/loss, hidden in-flight mutation, involuntary animation or scripted smooth-scroll override | | RHC wallet-activity boundary | canonical-log identity/account checks, exact native raw wei, Alchemy capability gating, inbound/outbound deduplication, bounded page keys, independent gaps, reorg replay, v1-to-v2 migration and backup validation | no explorer scraping, floating-value authority, unsupported/internal native-history claim, truncated checkpoint, lost token history or browser/provider credential leak | | Durable market-history boundary | strict OHLCV validation, correction merge, v1→v2 migration, retention/LRU caps, write-through provenance, unsupported-market rejection, provider/store double-failure and persisted pagination | no invented bars, hidden live fallback, cache-authorized market, unbounded checkpoint or leaked path/provider detail | | RHC live-perp coverage | exact canonical-symbol join, Arcus `ONLINE` gating, Hyperliquid deployer symbols, provider degradation, malformed values, venue schedule bounds and Arcus-first preference | no ticker-derived token identity, offline listing, stale retained promotion, guessed current session or implied execution authority | | RHC contract provenance | one immutable registry, venue/catalog parity, count/category/symbol/address uniqueness, bounded official-page parsing and online source comparison | no duplicate identity list, silent contract drift, auto-accepted source change or symbol-only identity | | Arcus no-send preflight | exact decimal parsing, tick-tier selection, tick/step quotient, TIF rules, staleness, book/slippage, off-hours bounds/margin, eligibility, exposure, collateral, reduce-only semantics, same-origin/rate boundary and missing venue limits | no float-rounded engine values, stale/tampered browser authority, protected headers, signature, confirmation token, submission claim or invented maximum | | User-owned Arcus withdrawal lifecycle | exact EIP-712 domain/message and signer recovery, dual Privy tokens, provider-wallet/chain binding, one-use ticket claim, repeated live preflight, fixed-origin single POST, strict submit/acknowledgement and terminal-document drift checks, 202-pending, known rejection, ambiguous outcome, exact-ID terminal transfer, strict durable transitions, health and backup corruption | no key custody, login-derived authority, arbitrary recipient, replay, blind retry, ACK/balance/list-absence finality, raw identity/signature persistence or hidden unhealthy store | | Arcus account lifecycle | strict REST normalization, exact account-scoped subscriptions, snapshot replacement, consecutive order updates, duplicate/out-of-order handling, fail-closed gap plus snapshot recovery, sparse fill monotonicity and terminal UI evidence | no cross-account frame, HTTP-ACK finality claim, REST-cleared sequence incident, duplicate fill/order effect, signing material or execution authority | | Arcus protected execution | official compact canonical bytes, real Ed25519 verification, address query/body binding, exact tick/quantum recomputation, operator/CSRF gates, live portfolio/rate recheck, one-use place/cancel tickets, durable idempotency, mainnet canary and reconciliation | no key in web/browser/audit, stale or replayed confirmation, retry after unknown, ACK-as-final, off-origin signer or disabled-localhost activation | | Hyperliquid revenue boundary | live user fee parsing, exact signed decimal cost arithmetic, maker/taker ranges, per-user max-builder approval, BFF/signer scope equality, additive v2 parity, SDK builder propagation and pre-submit approval drift | no hidden spread, fee on unfilled orders, fee-unbound signer call, float-derived quote, stale/revoked approval, mismatched builder or AI-held approval authority | | Hyperliquid venue dead-man boundary | official `scheduleCancel` arm/remove calls, complete bounded all-DEX open-order reads, durable pre-call CLOID evidence, account/network lease binding, monotonic heartbeats, deadline/heartbeat freshness, same-account testnet trigger proof, operator/CSRF/rate limits, ambiguous-call reconciliation and restart persistence | no mainnet entry without fresh protection, browser-held lease, blind retry, partial-DEX scope, disarm with open orders, refresh counted as a venue trigger, config-manufactured rehearsal or inferred cancellation | | Hyperliquid builder reward reporting | strict referral and spot metadata shape, exact token-index identity, token-zero root parity, duplicate/unknown token refusal, identity removal, content hash, operator auth and provider failure | no combined-claim overstatement, float conversion, browser identity override, archive-schema guess, claim signature or execution capability | | Arcus signer supervisor | testnet-only environment validation, child-environment allowlist, offline doctor, exact loopback health scope, real child recovery, clean stop and redacted state/log inspection | no mainnet, Hyperliquid key, unrelated web/provider secret, runtime injection, repository/relative key, public bind, venue request, account/key path/internal token persistence or implicit order authority | | Hyperliquid signer supervisor | path-only API-wallet validation, master-key refusal, zero-network doctor, lazy SDK construction, child-environment allowlist, exact authenticated schema-v8/WAL/eligibility/dead-man health, shared-store lock, real child recovery, clean stop and redacted state/log inspection | no inline/master key, mainnet, Arcus execution, unrelated secret, repository/symlink key, public bind, startup venue request, account/builder/key path/token persistence or implicit order authority | | Hyperliquid campaign evidence | exact private draft generation, nine-case testnet completeness, capped mainnet closure, pre/post/final readiness, five-minute per-mutation authorization freshness, database projection, recovery/backup, final flat/zero-order safety, canonical digest and redaction rejection | no omitted lifecycle case, campaign-level approval substitution, widened $12/1x policy, unresolved mutation/incident, raw identity/CLOID/key/token/URL/database value, repository evidence file, network request or implied venue authority | | Read-only wallet boundary | strict chain/account parsing, EIP-6963 announcement validation/deduplication, passive and consented EIP-1193 reads, wrong-chain handling, explicit switch/add fallback, event refresh and mobile geometry | only account/chain/switch/add methods; no signing, transaction, permission, secret storage or provider-label authority | | Operator boundary | missing/wrong secret, Origin/content type/body bounds, cookie flags, CSRF, tamper/expiry/revocation, session-scoped rate windows, locked redaction | no unauthenticated execution or audit access; no forwarded-header bypass or browser-stored credential | | Contract governance, public responses and signer precision | deterministic JSON Schema/OpenAPI regeneration, immutable-v1 addition/mutation/removal, operation request/parameter/security/response drift, strict normalized market, account, RHC-readiness and RHC price/portfolio/activity/radar output, secret/address/endpoint-free producer-failure handling, canonical/feed/count/gap/cursor invariants, nested extras, JSON number/exponent rejection, exact product/stop constraints and TypeScript/Python parity | no silently regenerated breaking contract, unresolved `$ref`, venue-native/private/provider-endpoint leak, malformed public numeric/OHLC/account/readiness/RHC-data shape, address or endpoint in violation telemetry, public-RPC production promotion, oracle/canonical overclaim, float-tolerance signer authority, cross-language drift, credential/public bind or schema-derived execution permission | | Execution-flow tracing, observability and SLO delivery | fresh BFF span ownership, signed review-root continuity, exact CLOID/client-ID signer lookup, browser-header rejection, exact venue audit filter, semantic outcomes, v1/v2-to-v3 migration, rolling minimum sample, fixed-code open/recovery, durable outbox dedup/leases/restart retry, exact-body HMAC, authenticated aggregate, health, backup and Hyperliquid mainnet gate | no caller-owned lineage, cross-order/venue detail, account/order/body/URL/credential/receiver field, fabricated proposal validity, lost pending incident, redirect, duplicate authority, unbounded store, correlation-as-finality claim or telemetry-derived execution authority | | Position-safe AEGIS policy | long/short reduction direction, flat and position-flip refusal, venue-lot normalization, entry-breaker bypass ordering, correlated boundary/breach, non-finite/duplicate policy rejection, deterministic quantity-range properties and live-shaped execution review | no trusted reduce-only flag, cross-zero close, hidden correlation concentration, mutable malformed policy, new reason-enum drift or signer-bypass claim | | Portfolio reconciliation | boot/reconnect/periodic convergence, exact replay, sparse multi-DEX collateral-token identity, strict spot-token/reserve-oracle conversion, Standard/Unified/Portfolio-Margin capital, HIP-3 fee/PnL/funding units, exact missing-order lookup, reviewed status families, event-time pagination, account-mode detection, coalesced reads, active leverage/size/available-capacity review, execution/automation generation gate, drift, coverage, stale/future/sequence refusal, strict checkpoint, aggregate health and opaque backup/restore | no client snapshot authority, guessed collateral parity/LTV borrowing, mismatched fee token, missing-order finality inference, partial-state deletion, old-state rollback, duplicate fill/funding, perps-only Unified/Portfolio-Margin equity, leverage mutation, NaN/unknown field, account-address/key/token persistence or execution authority | | Advisory proposal lifecycle | strict nested schema, validity bounds, UUID normalization, identity-only hash persistence, duplicate/conflict behavior, reservation collision/release/expiry, exact symbol/side binding, pre-signer consumption, invalidation, auth/CSRF, aggregate health/observability and strict backup/restore | no prompt/evidence/body persistence, neutral execution, AI signing, AEGIS bypass, cross-intent reuse, post-expiry use, unknown-outcome retry or proposal-derived venue finality | | Bring Your Own Agent MCP and paper | stable MCP negotiation, loopback/origin/auth/content bounds, per-connection rate limits, exact tool/account/symbol scopes, schema-v3 migration, immediate revocation, inert prompt text, immutable canonical paper envelope, idempotent session/order replay, fresh book/all-position marks, reduce-only, notional/frequency/loss locks, operator projection, health and verified backup/restore | no model credential collection, session-as-auth, remote bearer activation, cross-connection data, signer/submit/cancel/retry/fund/transfer/withdraw tool, stale simulation, non-canonical capital state, hidden paper-to-testnet promotion or plaintext token persistence | | Watchlist preferences | malformed/oversized/unsafe storage, cap/deduplication, venue isolation, live availability intersection, shortcut focus guards, reload and responsive behavior | no stored markup or cross-venue bleed; no favorite presented as a price, listing, position or authority | | Command palette | ranking, normalization, query/result caps, ID deduplication, cross-venue live discovery, degraded-feed exclusion, Arrow/Home/End/Enter/Escape flow, focus/modal guards and 390 px containment | no stale venue result, false Robinhood Chain listing, interpreted markup, dialog stacking or execution action | | Price alerts | strict storage parsing, directional creation, venue/symbol isolation, stale/future rejection, one-shot evidence, reload, degraded feed, focus and responsive behavior | no trigger without a fresh verified matching observation; no background-delivery claim or stored authority | | Held-mark consumer isolation | available/held/unavailable projection, exact Arcus/Lighter/Hyperliquid/HIP-3 venue identity, fixed source attribution, duplicate/invalid-clock/degraded omission, all-three PAPER binding and terminal presentation strings | no retained held value can trigger an alert, seed PAPER/chart/order state or masquerade as a live watchlist, palette, brief, evidence or book mark | | Workspace layouts | exact schema/name/ID/timestamp parsing, byte/count/duplicate caps, immutable presets/save/apply/remove, reload, shortcut focus guards and computed responsive geometry | preference-only storage; no hidden-pane authority change or viewport overflow | | Candle continuity | malformed/future/OHLC rejection, overlap precedence, 5,000-bar cap, variable calendar months, exact gap counts, stream discontinuity and recovery repair; context-bound state, exact payload identity, late-stream rejection, delayed-response rapid switching; production-browser pagination, scheduled refresh, forced REST outage/recovery and 390 px geometry | older verified pages survive refresh; prior candles, studies and numeric axes cannot bleed across venue/symbol/interval changes; gaps stay visible; repair failure never erases same-context rendered history | | Technical chart engine | strict style/indicator/period preferences, bounded ordered periods, requested-period calculations, incremental append/last-bar classification, full correction/backfill fallback, reload persistence, UTC OHLCV crosshair and 390 px study-panel geometry | no unsafe preference coercion, series rebuild on ordinary live ticks, ambiguous local-time readout or clipped mobile control | | Chart-native perpetual risk | live/degraded/future/stale market observations, exact venue/symbol matching, exact Lighter market ID, uninspected versus flat accounts, account expiry, multiple matches, long/short distance, missing liquidation, breached boundary and responsive price-line lifecycle | no stale mark authority, cross-market position bleed, locally inferred entry/liquidation, long-side math applied to shorts or hidden unavailable state | | Chart-native account margin | exact Hyperliquid primary/deployer DEX selection, unavailable DEX state, Arcus complete/partial position-margin aggregation, complete Lighter type-0 account aggregation, exact Lighter market ID, malformed/non-finite values, fresh/partial/unavailable/stale account state and responsive account-rail containment | no cross-DEX capital bleed, partial sum presented as complete, inferred leverage/capital, stale account authority, hidden provider omission or page-level mobile overflow | | Chart-native carry and realized performance | exact Hyperliquid deployer-prefixed and Arcus symbol matching, bounded fill-window availability/completeness, exact single-position funding, exact Lighter symbol/market ID, duplicate-position refusal, malformed/non-finite values, independent available/partial/unavailable/stale performance and responsive metric-rail containment | no cross-market or spot-fill bleed, incomplete sum, lifetime overclaim, funding-sign reinterpretation, performance-to-capital contamination, stale authority or page-level mobile overflow | | Chart-native funding and liquidation context | exact venue/symbol funding snapshots, duplicate-time replacement, bounded point/window/mean/range/sign statistics, future/malformed/context mismatch, additive public contract, Lighter exact market/tag/time/coverage, provider failure redaction, Hyperliquid/Arcus undocumented states, cached degradation and responsive metric-rail containment | cross-market history bleed, summed or annualized carry, heuristic liquidation classification, account-ID leakage, venue-wide notional overclaim, stale authority or page-level mobile overflow | | Command-deck readiness | diagnostic non-promotion, missing chain observation, unstable production, provider divergence/loss, market degradation, browser provider-gate copy | a block height never implies production; only monitored redundant HTTP/WSS/archive evidence can produce production-ready state | | AI evals | grounding, abstention, schema and injection resistance | zero execution bypasses; ≥99.5% schema validity target | | Security | authZ, tenant isolation, key/log leaks and dependencies | no unresolved critical/high finding | | Resilience | WS silence, 429/5xx, DB/Redis loss and clock drift | fail closed; kill switch and recovery audited | | Release | paper shadow and capped mainnet canary | owner, risk and security sign-off | ## Environment progression 1. Local fakes and recorded fixtures. 2. Hyperliquid testnet with a dedicated API wallet and disposable account. 3. Seven-day paper shadow against live mainnet public data without signing. 4. Testnet chaos/timeout/kill-switch drills. 5. Small mainnet canary under a separate feature flag and notional cap. Tests must never load a real key from developer machines or CI. Exchange contract tests are opt-in and must use a testnet-specific secret scope. ## Route performance budgets `performance-budgets.json` is the reviewed source of truth for independent landing, command-deck, and terminal limits. The desktop Playwright gate records DOM nodes, first-party transfer bytes, script bytes, CSS bytes, the longest individual long task, long-task count and aggregate duration, cumulative layout shift, and licensed chart bytes. The reviewed ceiling applies to the longest individual task, matching the audit's “none over” requirement; count and aggregate duration remain in the trend artifact so distributed main-thread regressions stay visible. Licensed chart assets are reported separately and excluded from the application-byte total. CI retains `output/performance/route-budgets.json` for 30 days so a proposed budget increase can include an explicit rationale and before/after comparison. Run the focused gate after a production build with `pnpm test:performance`; the full `pnpm test:e2e` suite runs the functional browser matrix first and then the same performance gate. The budget sampler always uses one isolated desktop worker so activity from unrelated browser scenarios cannot inflate its long-task evidence. Soft assertions retain every route measurement in `output/performance/route-budgets.json` before a budget failure is reported. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/normative-design/testing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.