Live accounts are not a test environment
A trading system update is not a website deploy. If it is wrong, the cost is not a broken layout, it is somebody's capital. We treat every release as though it cannot be rolled back mid-position, because in practice it often cannot.
The release pipeline
- —Change is specified in writing with the failure mode it addresses, before code is written.
- —Full walk-forward re-run, with results compared against the previous version rather than against zero.
- —Two weeks minimum on our own live capital before any customer sees the build.
- —Staged rollout to volunteer members, then general availability with a published changelog.
Configuration never changes underneath you
An update will never alter your risk settings. If a release changes a default, existing installations keep their current values and the change is documented so you can adopt it deliberately. Silent configuration changes are the fastest way to destroy trust in an automated product, and we would rather ship slower.
The only thing worse than a bug is a change your customer did not know had happened.
Versioning, release notes and knowing what you are running
Every release carries a version, a dated note describing what changed, and an explicit statement of whether behaviour that affects trading has been altered. If you cannot tell from the notes whether an update changes how positions are sized or stopped, the notes have failed regardless of how detailed they are.
What our notes always state
- —Whether trading behaviour changed, in the first line.
- —Whether the update is required or optional.
- —Any configuration migration needed before running it.
- —How to roll back if the update causes a problem.
Staged rollout and the right to not update
Updates reach a subset of accounts first and widen only after live telemetry confirms nothing regressed. A release that looks perfect in testing can still meet a broker configuration nobody anticipated, and the cost of discovering that on ten accounts rather than every account is the entire argument for staging.
Stability over novelty
Operators running a configuration that works are under no obligation to take an optional release. We will always state clearly which updates are security or correctness fixes that genuinely should be applied, and which are improvements you can adopt at your own pace.
Everything discussed here is applied on a public, third-party verified account — updated continuously, losing weeks included.