A trading rig that tests its own strategies every hour — and never places an order

Isolation first, so "paper only" is a fact about the installation and not a promise. The rig runs as its own locked-down system user with its own clone of our in-house backtesting engine and its own candle cache — 14.4 million rows, copied once from the existing cache and never written back to it. There are no exchange credentials, no order-placing code path and no secrets anywhere under the install, so there is nothing to leak and nothing to accidentally arm. The service unit itself is the seatbelt: a read-only home, a memory ceiling, a CPU quota and a low priority, so the production jobs that share the machine never feel the sweep running.

One hourly tick, six phases. It updates its own copy of the engine (pulling and reinstalling only when the code actually moved), tops up five-minute candles for the top hundred USDT pairs by volume, runs a budgeted strategy sweep, runs the paper round, regenerates the public page, and writes a structured log line. A failure in any one phase never aborts the rest: failures are collected as shapes — phase plus exception type — and each shape mails the administrator at most once a day while it persists.

The sweep is budgeted, not exhaustive. Each round gets 600 seconds of wall clock and a hard cap of 400 configurations, evaluated over a 30-day window that is quantised to the day, with the last 30% of it held back as out-of-sample and realistic commission and slippage charged on every side. Candidates come from three places, woven together so exploration is never starved: the curated baseline strategies, one-step parameter neighbours of the current top scorers, and pure random combinations. The ranking score is out-of-sample robustness minus an overfit penalty — a configuration that dazzles in-sample and stumbles out-of-sample scores worse than a boring one that does neither.

The leaderboard is the memory, and it is also the resume point. Each result is one row keyed by configuration and window, committed the moment it lands. A configuration is never re-tested on a window it has already been scored on, so knowledge accumulates instead of being recomputed; when the budget runs out mid-round, whatever was not reached simply comes back next hour with no queue state to maintain. Every new day is a new window, so the whole frontier gets re-scored against fresh data automatically.

Promotion is deliberately slow, and demotion is deliberately quick. A configuration only enters the paper book if it has held the top five for three consecutive hourly checks, has been scored on at least two distinct sweep windows, and carries a non-negative score — with a ceiling of six active strategies and a 48-hour cooldown before anything demoted can return. Once promoted, forward performance is tracked against the backtest's own expectation, and four separate rules pull the strategy back out: a drawdown breach at any age, a hard divergence from expectation once a handful of trades have closed, a narrower expectation band after two days of evidence, and an absolute daily floor. Every promotion, demotion and re-anchor is kept as an event, so the record of what the rig believed and when is complete.

Simulated fills are replayed, not accumulated. Promoting a strategy freezes an anchor bar and a symbol set; each tick then re-runs the deterministic backtest from that anchor and folds newly closed trades into a fills ledger under stable keys. Because the same anchor over immutable candle history always produces the same trades, the ledger only ever grows at the tail — a tick that dies halfway through cannot corrupt it, and nothing has to be serialised between runs. Positions still open are reported as a snapshot with unrealised P&L and are never counted as fills.

It repairs itself, and asks for help in writing. Transient exchange hiccups are retried with backoff before anything is called a failure; a sweep round that overruns its budget halves the next round's allowance and earns it back gradually over clean rounds. When a failure shape survives several consecutive ticks anyway — or a papered strategy is auto-paused for behaving nothing like its backtest — the pipeline writes an incident file, and a privileged drainer turns pending incidents into a single de-duplicated card on the Trello board that our AI agent works. The rig has no credentials of its own to open that card with, by design; it leaves a note, and the agent that reads the board investigates and fixes.

The dashboard is deliberately dumb. The public page is plain HTML regenerated from the SQLite state with no imports from the trading engine at all and an atomic write into place, so it keeps telling you the truth about the last known state even on a tick where the engine itself is broken. A daily digest email covers the same ground for anyone not watching the page: configurations tested, leaderboard movement since yesterday, promotions and demotions, and the paper P&L.