Trading Assistant — algorithmic trading on Alpaca, paper-validated, MFA-gated

What it does

Three engines run in parallel; you choose which to enable.

Options — long calls / long puts

90% allocation. Breakout + pullback scanner on equities, expressed as 30-DTE 0.70-delta options. Regime-Kelly sizing, swing-low stops, partial-take at 2R/3R/4R, eager pyramid into winners.

Crypto — trend-follow

10% allocation, 24/7. 20-day breakouts with SMA 20/50 alignment, BTC SMA-100 bear filter, 8% hard stop, 30-day time stop. Pyramid + vol-target + conviction tiers.

Backtest baseline

5-year walk-forward on pinned Alpaca bars. Deterministic, reproducible.

Variant	Sharpe	Avg/yr	Worst yr
Portfolio blend (90/10)	~1.26	~+182%	+10%
Swing (current shipped)	~1.10	~+195%	~+5%
Crypto trend (with stack)	—	~+79%	-14% (2022)

Honest live expectation. Live trading typically compresses to 50-70% of backtest figures. The dashboard's Performance Expectations card surfaces both raw and theta-adjusted projections (avg × 0.5, worst × 1.5, sharpe × 0.7). Past performance is not indicative of future results. You may lose money.

How we verify the numbers

A 4-test battery on every shipped change.

1. Parameter stability

Knob ±20% sweep — neighbors must be within 6% of peak. Rejects knife-edge optimums.

2. Intra-year drawdown

Higher returns can't come from looser risk controls. Profile must not be worse than baseline.

3. Leave-one-year-out

No single year drives the aggregate Sharpe. Rejects regime-luck strategies.

4. Trade attribution

Top-10% trade share must be better than baseline. Rejects fragile "needs the home runs" strategies.

Security posture

Broker credentials live here — security is treated as load-bearing.

Per-tenant envelope encryption (AES-256-GCM data keys wrapped by master KEK)
TOTP MFA required for admin actions; step-up re-auth on every sensitive write
PBKDF2-HMAC-SHA256 @ 600k rounds for password storage
Per-IP rate limiting (5 fails / 15 min) on login AND MFA verify
CSRF defense-in-depth: SameSite=Strict + synchronizer tokens on state-changing requests
Open-redirect protection, security headers (CSP, HSTS, Permissions-Policy), sanitized error responses
Hard order bounds — pre-broker validation rejects out-of-spec orders before reaching Alpaca
Idempotent order submission via client_order_id — network retries can't double-fill
Risk-disclosure click-through gate; pre-trade pause until accepted
Per-tenant kill switches with conservative fallback
Audit log of every login, credential change, role change, paper/live flip
Container runs as non-root uid 10001; CI hardened with default-deny permissions and timeouts

Read the security disclosure policy →

Operations

Designed to be left alone.

~5 min/ day operator time

Glance at the daily summary email + dashboard. Engines self-heal dead threads; certs renew automatically; backtest snapshots refresh on launcher boot.

~$6/ month infra cost

1 vCPU, 2 GB RAM is plenty. Hetzner CX22 or DigitalOcean basic droplet. Domain registration optional but recommended for Let's Encrypt TLS.

30 minfirst-deploy time

One docker compose --profile prod up brings up engines, dashboard, Caddy reverse proxy, optional Postgres for multi-tenancy. Full runbook in DEPLOY.md.

What's NOT being claimed

That this beats the market in all conditions
That backtest = live (it doesn't; expect 50-70% compression)
That any prior result is a forecast of the next year
That it's a substitute for your own judgment about strategy fit
That it's a registered investment adviser unless explicitly stated in the dashboard's About section

Beta access

Currently invitation-only. Limited to ~10 beta tenants for the first phase.

If you have:

An Alpaca account (paper at minimum) and a willingness to connect API keys
Patience to paper-trade for 2-3 weeks before going live
Capital you can afford to lose, treated as risk capital
Time to read the risk disclosure and accept it click-through

Email beta@example.com with a sentence about your background and which engine(s) interest you. Beta tenants sign a Beta Tester Agreement and get access at no cost during the beta period.