Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/deniszidbaev-cmyk/polyclaw-trading/llms.txt

Use this file to discover all available pages before exploring further.

This page tracks all notable changes to PolyClaw Trading. The format follows Keep a Changelog and the project adheres to Semantic Versioning. The most recent release is shown first. LIVE_TRADING=0 remains the hard default across all versions.
No unreleased changes are currently documented.
Consolidation release: deduplicated risk/bankroll internals, hardened redaction and the deterministic strategy engine, and faster indicator hot paths. LIVE_TRADING=0 remains the hard default.Changed
  • De-duplicated the risk/bankroll engine. The top-level risk_state.py was a byte-for-byte copy of openclaw_bot.risk.state (652 of 654 lines identical); it is now a thin compatibility shim that aliases the canonical package module in sys.modules, so import risk_state and from openclaw_bot.risk import state resolve to the same object and the risk logic can no longer silently diverge between two copies. (#1160)
  • Decomposed bankroll_runtime: removed divergent duplicated helpers, moved the filter-config subsystem into llm_bundle, and deduplicated eleven ingestion helpers against the runtime package. (#1161, #1162, #1180)
  • Canonicalized the bot package layout and closed out the deferred repository cleanup. (#1182)
  • Hardened the deterministic BTC 5m/15m strategy engine (0.7.1). (#1130)
Fixed
  • Fixed the semantic-mapping polarity flip on contracted negations (“won’t”, “isn’t”) in market-question analysis. (#1135)
Security
  • Hardened synchronized redaction and dashboard safety: strict whitelist validation for dynamically resolved runtime filenames. (#1197)
  • Redaction now masks standalone Telegram bot tokens and generic key parameters in URLs, JSON, and key-value pairs, kept in sync between openclaw_bot.io.runtime and polyclaw_engine.execution. (#1261)
Performance
  • Rewrote the rsi_wilder, average_geometry, and realized_volatility indicator hot paths as single-pass loops without intermediate list allocations; results are mathematically identical. (#1263)
Release engineering
  • Added a tag-triggered GitHub Actions release workflow that verifies the test suite, builds the self-verified OpenClaw plugin bundle with its SHA-256 checksum, and publishes the GitHub release automatically.
  • Fixed the plugin bundle build: root launcher scripts (*.sh), Package.swift, and the Sources/ native runner are now staged, so the self-verifying bundle audit passes again after the layout canonicalization in #1182.
Consolidation release that brings the package metadata back in line with the stable GitHub release series and ships the runtime-backed Mission Control.Added
  • Read-only Mission Control over the non-secret runtime/*.json contract, with equity, realized P&L, drawdown, exposure, daily capacity, signals, execution ledger, and source-freshness views.
  • Dashboard APIs for decisions, equity history, and source health, plus bounded runtime JSON reads and a compatibility fallback for legacy SQLite data.
  • Native macOS Swift orchestration and self-tests alongside the cross-platform Python trading and risk engine.
Changed
  • Consolidated signal-engine, bankroll, market-analysis, wallet-scoring, and trade-history hot-path optimizations landed since v3.1.0.
  • Improved package layout, clean-environment installation checks, portable build hygiene, dashboard accessibility, and responsive behavior.
  • Aligned the Python package, engine, plugin bundle, changelog, and GitHub release version on 3.2.0.
Fixed
  • Corrected runtime path resolution, data-freshness reporting, dashboard mode feedback, and generic HTTP error handling.
  • Preserved strict DRY RUN defaults while recording simulated executions for operator review.
Security
  • Centralized secret redaction and hardened quoted/multi-word authorization token handling without exposing raw values.
  • Hardened market identifier validation against newline and command-argument injection paths.
Deterministic BTC 5m/15m strategy-engine hardening release.Added
  • Independent fetch, candles, analyze, signal, bankroll, validate, execute, report, cycle, loop, and audit commands under src/polyclaw_engine/.
  • Versioned schema-v1 runtime envelopes, strict freshness/geometry/finite-value validation, duplicate-key rejection, and atomic os.replace persistence.
  • Gamma keyset market discovery and CLOB YES-token price history through standard-library urllib only.
  • Explicit BTC question semantics, including deterministic inversion for below/decrease wording instead of assuming outcome index zero is bullish.
  • EMA8/EMA21, Wilder RSI14/ATR14, sample-density POC, nine pattern groups, multi-timeframe scoring, manual review, bankroll reserve, drawdown hysteresis, safe position sizing, and PolyClaw subprocess execution.
  • Live-price slippage preflight and detection of PolyClaw’s partial split/CLOB failure output; partial executions require manual cleanup and block re-entry.
  • Official-host/HTTPS HTTP allowlisting without redirects, stale-history rejection, live-fixture prohibition, and a second fresh risk/semantic gate immediately before subprocess launch.
Changed
  • The supported Python floor is restored to >=3.12.
  • run_pipeline.py now drives isolated filesystem-contract stages and audit runs full unittest discovery.
  • Live trading remains disabled unless LIVE_TRADING is exactly 1.
Stabilization release: restored the valuable fixes that were stuck in closed (unmerged) agent PRs, repaired the failing test suite, and added the missing operational safety layers.Restored (from closed PRs, verified absent from main)
  • Automation loop launchers runtime/automation-3-pipeline-loop.{cmd,ps1} per the existing test specification, and updated the stale kilo_cycle test to the renamed OpenRouter fallback (#625).
  • Thread-safe ledger/state writes: unique temp names (thread id + random suffix) and LEDGER_LOCK/STATE_LOCK in token_budget.py and multi_orchestrator_skill.py (#215).
  • Live-order execution hardening in trade_gate.py: TimeoutExpired records rc=124 and launch failures rc=1 instead of crashing the gate; failed orders always reach the execution ledger so the failure cooldown works (#1012).
  • PIPELINE_FORCE_LIVE_TRADING / PIPELINE_FORCE_ALLOW_REDEEM now pin the safety keys against .env.local overrides inside env_local.inject_into_environment (#1012).
  • .env.local injection hardening: value tails can no longer set LIVE_TRADING/ALLOW_REDEEM, and write_env_file strips newline injection (#961).
Added
  • Dashboard: loopback binding by default with DASHBOARD_HOST/DASHBOARD_PORT overrides, optional DASHBOARD_AUTH_TOKEN (Bearer / X-Auth-Token, 401 otherwise), and a real GET /health endpoint.
  • Auto circuit breaker: after PANIC_AUTO_THRESHOLD consecutive failed live orders the trade gate creates runtime/panic_stop.flag and halts; the flag (or PANIC_STOP=1) blocks subsequent runs until removed.
  • Public market-data adapters: CoinGecko spot prices (market_data_sources.py) and Polymarket trader tracker (trader_tracker.py) feeding the copy-trading watchlist/signals.
Fixed
  • All six previously failing tests (automation loop launcher spec ×5, kilo_cycle fallback rename ×1).
  • Dashboard binding regression back to 0.0.0.0 (originally fixed in #118).
  • requires-python lowered to >=3.11 to match the actual runtime the suite is verified on.
Fixed
  • Published the sanitized release snapshot on top of GitHub main.
  • Forced dry-run runs to keep LIVE_TRADING=0 and ALLOW_REDEEM=0.
  • Kept packaged per-trade risk caps at the project safety limit of 2%.
  • Preserved drawdown protection after realized losses instead of clearing it when no positions are open.
  • Restored bot package compatibility imports and hardened secret-scanner exclusions for local tool state.
Added
  • Implemented May Safety Baseline Roadmap — established stable audit baseline, addressed secret-handling debts, and removed legacy :LOAD_TOKEN fallbacks. (#3)
  • Made sell_unwanted_tokens.py date configurable via --date CLI argument with sensible default (today’s date). (#47)
  • Improved maintainability by adding from __future__ import annotations to test files and comprehensive docstrings with “MUST NOT” sections to core modules. (#52)
Changed
  • Signal Engine — Lazy Parsing Optimization: Deferred parsing of OHLC series until after initial EMA/RSI trend validation; refactored safe_series to use list comprehensions. (#1)
  • Live Probes — TTL Caching: Implemented 30-second TTL for live probes to prevent redundant subprocess calls and Polygon RPC requests during rapid refresh_bankroll_runtime invocations. (#2)
  • Signal Engine — Series Parsing & Pattern Detection: Added early slicing of raw input lists to MIN_CANDLES * 2 window before safe_series processing; deferred conversion of auxiliary series. (#7)
  • Trade History Sync: Optimized trade matching logic from O(Positions × Executions) to pre-indexed dictionary lookups; replaced expensive ISO datetime parsing in hot loops. (#9)
  • Signal Engine — Windowing & I/O: Eliminated redundant I/O by passing pre-calculated market analysis directly to candidate loader; introduced windowed data processing. (#10)
  • Hot-Path Utilities: Added lru_cache to parse_iso_datetime; optimized safe_mean to use sum/len; refactored extract_signal_features to slice closes before returns calculation. (#13)
  • Signal Engine — O(1) Tail Parsing: Introduced MAX_LOOKBACK cap (100 bars) applied before parsing, avoiding full series conversion for markets with thousands of candles. (#14)
  • Signal Engine — Hot Path v1/v2: Early slicing of OHLCV series to MIN_CANDLES (30) elements; refactored build_bars to list comprehensions; deferred parsing of auxiliary series until after initial trend filter. (#15, #16)
  • Signal Engine — Series Slicing: Sliced large raw history payloads (1,440 points) to a 100-candle buffer. (#18)
  • Trade History — Pre-indexed Reconciliation: Pre-indexed executions and decision_snapshots by market_id, reducing complexity from O(N×M) to O(N+M). (#20)
  • Execution Log — O(1) Loading: Transitioned from O(N) full-history scan to O(1) targeted date-based lookup in summarize_execution_rows. (#21)
  • Signal Engine hot path iterations (converting only trailing candles, deferred auxiliary series, 5-candle slice for returns): #23, #26, #29, #32, #38, #41, #43, #44, #50, #51, #53
  • Trade History Reconciliation: Optimized bottleneck in sync_trade_history via pre-indexed lookups and reduced string formatting overhead. (#28)
  • Market Analysis — Deferred Conversion: Reduced redundant I/O and deferred type conversion in market analysis pipeline. (#30)
  • Dependencies: Bumped openclaw dependency from 2026.4 to 2026.5 across /extensions/kimi-search and /extensions/kimi-claw directories. (#12)
Fixed
  • Fixed unit tests and updated documentation for sandbox environment compatibility. (#5)
  • Stabilized test suite: fixed brittle mocks in signal engine and trade gate tests; removed legacy test file referencing non-existent automation scripts. (#6, #17)
  • Maintenance fixes and TUI token loading update — added :LOAD_TOKEN helper for gateway token resolution. (#8)
  • Fixed environment-related blockers, stale candle test failure, and brittle mocks for sandbox compatibility. (#24, #25)
  • Improved API reliability and fixed failing tests across the test suite. (#31, #34, #35, #36, #37, #39, #42, #45)
  • Fixed cross-platform process management blockers — replaced Windows-only tasklist/taskkill with os.kill() and proc.kill() for Linux compatibility. (#48)
  • Fixed build failure — changed market_reports.py exit code from error to warning when optional PolyClaw dependency is missing; updated stale test fixture dates. (#49)
Security
  • Hardened Secret Scanner: Added detection for PEM-formatted private keys and Google API keys; introduced checks for hardcoded variable assignments; added filtering for common placeholder values to prevent false positives. (#27)
  • Hardened File Permissions: Enforced 0600 (owner-only) permissions for .env.local, openclaw.json, and daily log files; added tests/test_file_permissions_sentinel.py for programmatic verification. (#40)
  • Fixed API Key Leakage: Removed Gemini API key from URL query strings in kilo_cycle.py (moved to secure headers); hardened sensitive file permissions to 0600. (#46)
Performance audits
  • Performance Audit Map — identified hotspots in signal generation, market analysis, and data synchronization with five safely implementable optimizations. (#4)
  • Performance Audit Report — documented database scanning bottleneck in runtime_io.py and redundant I/O in bankroll_runtime.py. (#11)
  • Performance Audit Report — full-scan regex on SQLite binary and algorithmic hot paths analysis. (#19)
  • Performance Audit Report and Optimization Map — identified redundant subprocess calls as primary pipeline bottleneck. (#22)
  • Performance Audit Report and Optimization Roadmap — comprehensive audit with prioritized optimization recommendations. (#33)

Build docs developers (and LLMs) love

Get started for freeTalk to us