Holdra Admin

Access is limited to a named list of operators. Same email + one-time code the app uses — there is no password. Every sign-in is announced in Telegram.

Confirm it is you

Good for 15 minutes, then the next change asks again. Holding a signed-in console is not proof you are still the one at the keyboard — a code just read from your inbox is.

Holdra Admin

Needs a human

Accounts where the agent is not doing what its owner thinks it is. Empty is the goal, not a bug.

Wallet reconciliation

Every wallet Privy holds for us, against every address our database has written down for a person. One chain, no gaps: email → their Privy identity → their signature → their wallet. A break means someone is looking at a wallet that is not where their money is — which is exactly what happened on 17 August, and was found by hand over ssh.

Read-only, and the job behind it is too. It never deletes and never repairs: at Privy "delete a wallet" means destroying a key, and any automatic fix would be moving someone else's money without a human.

Users

Search by email or paste a user id from a log.

Audit trail

Append-only. Rows cannot be edited or deleted, including by a database superuser.

Billing reconciliation

Compares Stripe against our subscription mirror and our capital caps against the plan grid. Read-only: it reports, a human decides.

Strategies

What each strategy is configured to do. Read only. The same quantities live in two places — the engine config in the database and the risk-engine ceilings in code — and they have disagreed before. Both are shown separately rather than merged, because a single number would hide which layer produced it. Editing arrives once it is decided which source is authoritative.

Plans

The grid as the code enforces it. Prices live in Stripe — this is what we compare against, not a second place to change them. A price edited here and not there would be a second, divergent record of what people pay.

Platform

The switch that stops trading for every account at once. The per-user kill switch on the Users tab stops one person; this is the control for when the agent itself is the problem and stopping accounts one at a time would be a race.

Halting stops new orders, entries and exits alike. It does not close anything — forcing a flat book would realise losses at the worst possible tick. Open positions keep their own stops. Whoever halts is buying time to decide, not deciding.