Recipe: Promote a Strategy Sim -> Paper -> Live

Answer card

To promote a Kestrel strategy from SIM to PAPER to LIVE, you author each mode as a distinct, receipt-gated version: SIM (recorded data, sim fills) earns a certified Blotter and Grade; PAPER (live data, sim fills) proves the same edge against real quotes; LIVE (real broker, real money) requires a human two-signer Envelope. You never flip a flag; you author into the next version. LIVE is a platform-enforced singleton.

The three modes, and what each one changes

One axis moves at a time. That is the whole discipline.

SIM -> PAPER swaps recorded data for live data; fills stay simulated. PAPER -> LIVE swaps simulated fills for a real broker; data was already live. Because only one variable changes per gate, a regression has exactly one place to hide.

The plan you are promoting

Illustrative only (generic instruments, not a strategy reveal):

PLAN headline-chase budget 0.25R ttl 15:55 regime {intraday: trend}
  USING signal SPX exec SPY 0dte
  WHEN spot > HOD AND velocity(5m) >= p95
  DO buy 2 +1 C @ min(fair, mid) peg cap fair
  TP 2.5x frac 0.5 @ fair
  EXIT spot < VWAP held 120s @ fair
  INVALIDATE regime != {intraday: trend} -> halt

Target grammar; parser parity tracked in the kestrel repo.

Gate 1: SIM earns a Grade

Run free SIM sessions on recorded data. The output is a certified Blotter (a deterministic session record) and a Grade. Grades are contamination-fenced: an LLM author is graded only on post-training-cutoff, date-blinded days, because weights leak what code fences can't stop. Grade judgment, not parameters.

GRADE plan headline-chase OVER 2026-01-01..2026-03-31 FILL conservative
  VS ungated
  BY regime

A Grade above your bar is the receipt that opens Gate 2. No Grade, no promotion; a Grade is never flattering when the judge is honest.

Gate 2: PAPER proves it on live quotes

Author the PAPER version. Same logic, live data, simulated fills. This is where the interface earns its keep: the runtime renders perception as a Frame (the chart is in text, O(new bars) not O(screen)) and fires PLANs in milliseconds (fire-then-inform; the agent is never in the hot path). PAPER answers what SIM cannot: does the edge survive real spreads and real quote motion? A quote is not a value, and PAPER is where that distinction bites.

PAPER earns its own Blotter and a shareable proof URL. That proof is the receipt for the final gate.

Gate 3: LIVE, signed by a human

Here promotion stops being a wallet decision. The one authorization primitive is the Envelope {scope, budget, ceiling, expiry, revocation}, and it is two-signer: a wallet may sign commerce scopes (data, sim, paper), but a human must sign legal, broker, and LIVE scopes. The term-sheet approval URL shows worst-case-in-dollars before anyone signs.

LIVE is a platform-enforced singleton (the live singleton): one pod lineage never runs live twice. Risk (L0) can clamp or veto anyone, including the agent, and may never OPEN risk. You deploy the template into your pod; you arm it. This is how an agent could express a play, never a recommendation.

The rule that makes it safe

Promotion is authoring into the next version, never flipping a flag. Each mode is a separately written, separately graded artifact with its own receipt. There is no mode = live toggle to fat-finger, because there is no toggle at all; there is a new version, a new Grade, and a human signature. Authority narrows downward; expiry is mandatory; revocation is one tap.

Where this is honestly not ready

As of mid-2026: anonymous trial sims, certified Grades, shareable proof URLs, and 402 Offers with Stripe settlement are live; always-on paper presence and the human-signed live path are in build. The free tier needs no signup. Live broker execution rides on BYO-broker OAuth and remains roadmap: a paper-only Alpaca broker adapter is in build, IBKR and Robinhood follow on the roadmap (order not final), and no custody is ever taken. If you need a hosted black-box signal or discretionary advice, this is the wrong tool; Kestrel sells certification over custody, not tips.

Promotion is authoring into the next version, never flipping a flag; only a human signs live.