Evaluate conditions, then decide separately whether to trade
A condition evaluator that only answers true or false over a market snapshot is easy to test: feed it candles and positions, assert the verdict. It never touches the broker, so a test can never move money.
A separate executor takes a true verdict through risk gates — position caps, a daily loss limit, a kill switch — before placing anything. Most blown-up bots fail here: evaluation and execution fused into one function with no place to say no.
Treat broker credentials as a lifecycle, not a string
Retail broker API tokens expire — daily, in the small hours — and re-approval is part of the job. The app supports direct tokens, key-plus-secret approval, and key-plus-TOTP so a morning expiry is a routine refresh, not an incident.
Credentials live server-side behind the executor. The frontend never holds broker secrets; it manages strategies while the backend owns the keys.
// Pattern: Evaluate conditions separately from placing orders
interface StrategyExecutionGate {
readonly evaluate: 'Pure condition check over market snapshot (no side effects)';
readonly authorize: 'Risk gates: position caps, daily loss limit, kill switch';
readonly place: 'Broker order only after evaluate AND authorize pass';
readonly credentialModes: ['access-token', 'api-key-secret', 'api-key-totp'];
readonly paperVsLive: 'Identical gates, live broker replaced by a ledger';
}Paper first, with the same gates as live
Paper mode runs the identical evaluate-and-authorize path against a ledger instead of the broker. A strategy that trips the kill switch on paper would have tripped it with money attached.
This is how Strategy Algo engine applies the financial-platforms discipline to retail automation: explicit boundaries, staged rollout, and one source of truth for what moved.
Have a similar architectural challenge?
Talk with our engineering team about trade-offs, cutovers, and sizing for your system.