Living backlog

What to consider

Everything a top-tier spot automation desk ships, plus LumenBotFi rails: elections, spot-only, honesty, Floor. Core first, then “and then some.” This list is the product — not a pitch.

Now

112

0

Later

30

Never

7 Build order

Tenant + desk + paper DCA (SO + TP + time-stop + manual/signal start)
ccxt catalog (US-access venues public; Coinbase paper real)
Operator halt + per-user halt + audit
Grid paper + trailing TP
Signal webhook + Floor consumer
Coinbase dry_run → Kent-armed live (his account only)
Fan-out + more venues
Trailing grid, combo, backtest, Telegram, billing

A. Tenant & control plane

14/19 now

now

Magic link

local token; no mailer yet

now

2FA (TOTP) + passkeys + step-up for live arm

TOTP enroll/verify; passkeys + live step-up later

now

Email verify, password reset, session revoke

Reset + revoke + email verify (local token; no mailer)

now

Multi-tenant isolation (user → connections → automations → deals)

now

Roles: owner, trader, viewer, accountant, operator

user | viewer | operator; owner/trader/accountant later

now

Customer-added subusers who can change a desk

3Commas hole. One person, one desk. Only the master admin grants a human.

never

Per-tenant encryption of API keys (trade-only; refuse withdraw)

website refuses keys/arm; local executor file vault stays unarmed

now

Operator master control: users, fleet, audit, global halt

now

Per-user halt / pause / disable

now

Audit log (who, what, when, IP, before/after)

now

Feature flags, kill switches, maintenance banner

now

Stripe, plans, bot/connection limits, dunning

later

GDPR/CCPA export + erase

now

Status page, incident comms

later

SSO/SAML for orgs

later

Device/session list + revoke-all + new-device alerts

List + revoke; alerts later

now

Session idle timeout + concurrent session cap

30m idle; 5 sessions

now

Operator IP allowlist

later

B. Exchange layer (spot)

15/16 now

Connect US-access venues via ccxt (Coinbase first for live)

Coinbase, Kraken, Gemini, Crypto.com, Binance.US, Bitstamp

now

Paper / dry_run / live (owner-armed only)

Paper + draft + dry_run on HMAC. Armed/live 400 until Kent flips the local vault by hand.

now

Trade-only key check; reject withdraw/transfer

paper probe contract; live vault later

now

IP whitelist helper, passphrase, subaccounts

/desk/connect elects IPs/subaccount/passphrase-required; secrets refused; live venue IP later

now

Precision, min notional, lot size, rate limits

paper round + min qty/notional; live rate-limit later

now

Idempotent orders, retries, reconnect, clock skew

paper cloid + 30s skew; live retries later

now

Balance, open orders, fills, spot holdings

paper snapshot + place-when-hit; live private later

now

Fee-tier awareness (maker/taker, volume flywheel)

We do not measure venue fees on the desk.

later

Multi-connection per user

now

Health: key dead, geo-block, nonce, 401/429

paper: executor/tape/venue halt; live key classes later

now

Unified pair map (ETH/BTC vs venue symbols)

now

Order-book depth check before maker placement

0.05 BTC paper maker depth; skip if size does not fit; not a venue book

now

Delist / halt / dust handling

paper pair halt + dust flatten; live venue delist later

now

Per-venue kill switch

now

Paper fill uses spread / slippage model

5 bps paper market fills; limits stay elected; not a pick

now

Exchange maintenance calendar (pause rather than error)

paper calendar; pause not error; live venue calendar later

now

C. Core bot types

17/17 now

DCA: base, SO count/volume/step/deviation, avg, TP, time-stop, cooldown

now

DCA start: signal/manual only (no open ASAP default)

now

Trailing TP

now

Reinvest profit locked 0% on longs

now

Min/max deal size, daily deal cap

Daily cap 24; paper max notional 0.25 BTC

now

Pause / resume / panic close (reduce-only)

now

Reverse/flip only after a new election

now

Grid: upper/lower, count, inventory, long/short-as-rotation

Arithmetic + geometric; customer elects spacing

now

Trailing grid, re-center, range-exit stop

paper re-center + range-exit; customer elects

now

Combined grid + DCA

paper grid+DCA; customer elects both; live later

now

Signal: election-gated start, paper fill

now

Webhook / Floor feed / TradingView-compatible payload

HMAC + election match; no pair inference

now

Fan-out: one signal → many tenants’ matching elections

paper Floor HMAC; matching elections only; we do not infer

now

Stop-loss as elected param (spot, reduce-only)

now

Personal saved configs (not a marketplace)

apply fills sizes; reinvest 0% refused; own elections only; no ranking

now

Max concurrent deals per tenant

Cap 8 open deals

now

Signal replay protection (nonce + timestamp window)

same nonce 400; hook ±5 min skew

now

D. Deal / order engine

10/11 now

Deal state machine: idle → entry → averaging → TP/timeout/error

now

One active deal per automation

now

Limit, post-only/maker, market (restricted)

paper limit/post-only; live venue later

now

Partial fills, cancel/replace, stuck-order watchdog

paper 50% then leftover; overview+portfolio say partial; 4-tick stuck cancel

now

SO ladder on book vs place-when-hit

paper onBook vs placeWhenHit; live venue later

now

Reduce-only closes

now

PnL in BTC (USD display optional, never the objective)

now

You-vs-Ghost (HODL) per account

Off the desk. We do not score you against the automation.

later

Paper matching engine shares deal code with live

Same tickBot; live adapter still unarmed

now

Client order id / idempotency key on every order

lbf_… on every paper fill

now

NTP / clock-skew guard before signing orders

desk sends 30s clock on start/signal/panic; live signing later

now

E. User desk

13/13 now

Home: connections, automations, open deals, realized BTC

now

Create wizard — pair + direction election required

now

Bot detail: config, ladder, fills, logs

now

Activity / fill tape

now

Portfolio: per-pair BTC stack, idle cash

Idle cash stays on the venue

now

Telegram / email / SMS (opt-in, not advice)

opt-in recorded; prototype does not send; not advice

now

Paper vs live badge everywhere

now

Mobile-responsive; later iOS/Android

now

WCAG keyboard + contrast

skip link, focus ring, labeled elections, reduced motion

now

CSV export of deals/fills (exchange is trader of record)

activity + lots CSVs; never the email

now

Live desk via websocket (fills without polling)

paper SSE; fills without polling; we never recommend

now

Price chart on bot (no overlay advice)

elected pair tape only; no overlay

now

PWA / installable desk

manifest; paper desk; we never recommend

now

F. Operator / master control

8/8 now

Fleet table, halt, tick

now

Impersonate read-only

click through to the bot page; start/panic refused until stop; we do not act as them

now

Connection health, error classes

paper: executor/tape/venue halt; live key classes later

now

Proof board: nothing live without gates

now

Decision Center: what needs Kent’s arm

paper launch board on /admin; live arm stays on the local executor

now

Tenant key vault (Kent-gated)

GET status unarmed; website cannot arm or load keys

now

Replay / forensics on a deal

paper deal timeline from elections/fills/obs; not advice

now

Living product inventory on operator desk

now

G. Others sell — later or never

7/14 now

Copy trading / marketplace of configs

Configs as recommendations = adviser risk. Skip.

never

SmartTrade terminal (manual bracket / trailing)

paper bracket; customer elects; live later

now

Backtest + paper on historical bars

replay elected tape only; we do not invent bars

now

Strategy journal

customer notes only; viewer cannot write; pick copy refused

now

TradingView / Pine alerts

same HMAC path; ticker-only refused; we do not infer

now

Telegram remote control

paper remote; customer elects; no Telegram bot; we do not infer

now

Multi-TP / scaled exit

paper scaled exit; customer elects levels

now

Martingale warnings / hard cap (reject 1.5× SO trap)

now

Futures / hedge / combo / options

Spot-only forever

never

AI “what to trade”

never

Public leaderboards / advertised win rates

never

Staking / earn / idle-cash sweep

Looks like custody or a product we do not sell

never

DEX routers

CEX spot first

later

Fiat on-ramp / hosted wallet

never

H. LumenBotFi edge

10/17 now

Customer elects. Record. Execute. Never recommend.

now

Wizard = signed election of pair + direction + params

now

Spot-only; short = rotate to cash / rebuy

now

After-tax BTC payback velocity (internal north star)

Lives on Trading Floor; not marketing %

later

Floor wire: proven feed → 5 gates → SHADOW → pin → fan-out

later

forward_proven / honest-0; no fabricated edge in UI

now

LumenShield / forbidden-word linter on all copy

now

Trade-only + no custody + no withdraw

now

Chrome extension later (not keys in browser)

later

Contract / e-sign of election

later

Reversal as elected type, not a pick

now

Multi-account AM clients behind consent + proof

later

Reconciliation: sim vs live fills

later

Maker-first / fee-band progress

later

Any param change requires a new signed election

now

Objective in BTC (USD is display-only)

now

Help that never ranks pairs

now

I. Platform engineering

5/10 now

Queue per tenant, fair rate-limit budget

overview shows used/120; ticks free; 429 when used; we do not pick

now

Signal once → dispatch many

same paper Floor fan-out; matching elections only

now

Idempotent webhooks, outbox

paper outbox; idempotent; no live callback

now

Horizontal workers (DCA / grid / signal)

later

Postgres + encrypted vault (Supabase)

JSON store in prototype; quiet GET skips rewrite

later

Traces, fill telemetry, venue errors

paper fill/trace log; live venue errors later

now

Chaos: exchange down, duplicate signal, clock jump

paper: offline pause, duplicate nonce, timestamp skew; live chaos later

now

Staging + shadow against 3Commas until cutover

later

Uptime SLO + canary deploys

later

Data residency choice

later

K. Security (top-tier)

1/8 now

CSP, CSRF, lockout, rate-limit, no secrets in logs

Lockout + report-only CSP + nosniff + Origin CSRF + token match + paper write budget

now

Ed25519 physical arm for live (matches Floor)

later

KMS/HSM for vault at rest

later

SOC 2 path, pentest, vuln disclosure

later

Backup / restore drills

later

Dual-control to arm live (operator + owner)

later

Vault key rotation

later

SBOM + secrets scan in CI

later

L. Risk

2/3 now

Per-automation max notional + daily deal cap

Paper cap 0.25 BTC elected size; daily 24 already

now

Drawdown pause / venue-error kill switch

Pause at 25% paper drawdown

now

RiskGuard from Floor on live adapter

later

M. Tax & reporting

2/2 now

FIFO lots, ST/LT flags (internal)

paper FIFO from fills; ST/LT holding-period flag; not tax advice

now

Accountant fill CSV (exchange is trader of record)

now

N. Legal surfaces

5/5 now

Terms, privacy, risk, cookies — no adviser language

now

Signup geo/sanctions screen

18+ and sanctions attestation + paper deny-list; not a live OFAC feed

now

Election + audit retention policy

400 days; then prune elections/audit/events/journal

now

Best-execution / conflict disclosure

you elect venue; no PFOF; no internalization; not a best-ex claim

now

Public changelog (no performance claims)

public /changelog; no win rates

now

O. Support

3/3 now

Support tickets + runbooks

paper inbox; ack then follow-up reply; no mailer

now

Help: elections, spot-only, keys never on site

now

Sandbox / demo tenant (paper only)

now

P. Customer platform API

0/3 now

Customer REST API (platform keys, not exchange keys)

later

Outbound webhooks: deal filled / halted

later

HMAC-signed inbound/outbound webhooks

later