Skip to content

Cloudflare workspace and stopped trading runtime

The options research workspace was published on October 20, 2026 from commit 1b960009052a6210a41d0fbe6ed67abc2b2d816e in successful release run 39499987904 after PR #178. Pages deployment 4b81540c serves the overview, chain, strategy builder, paper/manual journal and field guide. Existing Research, Learning and founder sessions are preserved. The existing real Mo session survived publication; production GLD/SLV IEX observations and bounded indicative option quotes were verified. Canonical health reported options configured and execution disabled; anonymous private APIs returned 401. All 83 public routes and 51 deployed JS/CSS assets returned 200 on the release check. This is a research/data service, not a restored trading engine.

The earlier Cloudflare browser workspace and authentication service were published on October 20, 2026 from commit 2af52302a57bd70630c3ecb0c60fc49c41e1cc43 in successful release run 39495056782. The runner received a managed challenge on the canonical domain and verified the existing Pages origin instead, with an explicit warning. Separate public checks verified HTTP 200 health and HTTP 401 for unauthenticated sessions on both production domains.

Mo's existing credentials completed a production browser sign-in, reload, Research/Learn, sign-out, protected-route rejection and re-sign-in check. Naz's successful sign-in with existing credentials was confirmed by the user. Both founder password hashes were preserved.

The DigitalOcean qgtm-trading droplet was deliberately destroyed on September 14, 2026 at 13:45:22 UTC. Its trading daemon, FastAPI origin, Redis, PostgreSQL, monitoring stack, and self-hosted GitHub runner have not been recreated.

Current topology

Surface Hosting Purpose
qgtmai.com / www.qgtmai.com QGTMAI Cloudflare Pages, project qgtm-trading Authenticated options research workspace, Research and Learning; static Next.js export plus Pages Functions
qgtm-trading.pages.dev Default Pages asset hostname for the same project Static asset host; login is intentionally limited to the production domains above
qgtm-terminal-api Private Cloudflare Worker Founder authentication, health/capabilities, bounded read-only market data and private options records
QgtmSessions SQLite-backed Durable Object bound as SESSIONS Persistent sessions, login/data request limits and owner-scoped options workspaces
qgtm-docs.pages.dev Cloudflare Pages, project qgtm-docs Project documentation and historical technical reference
qgtm-pr-logger.qgtmai97.workers.dev Existing Cloudflare Worker Existing GitHub merge-to-Notion activity integration

Pages Functions reach qgtm-terminal-api through the private QGTM_API service binding. The Worker has no workers.dev or preview URL. Browser authentication requests stay on the website's origin; no removed droplet address is involved. The deployment preserves the existing founder password hashes in Worker secrets. The production login origin allowlist is https://qgtmai.com and https://www.qgtmai.com; the default Pages asset hostname is not a login origin. Session cookies are HttpOnly, Secure and host-only; local browser storage is not accepted as proof of authentication.

In the Cloudflare Pages dashboard, Functions quota behavior is Fail closed. Preserve that setting: requests must not bypass Functions if execution is unavailable or the quota is exhausted. This dashboard setting is separate from the source-controlled Worker and service-binding configuration.

The trading runtime remains offline. Broker account data, legacy market feeds and execution are unavailable. The terminal checks authenticated service capabilities before mounting legacy data providers or trading pages. Its separate options research adapter can provide read-only observations without polling trading endpoints or opening the trading WebSocket. Historical research figures remain labelled as historical, not current market/account data.

Options data and research boundaries

On October 20 the owner explicitly authorized connecting existing Alpaca credentials for read-only market data after the adapter was reviewable. The hosted workflow transfers these privately to MARKETDATA_ALPACA_KEY and MARKETDATA_ALPACA_SECRET Worker secrets, never browser variables or logs. This is an application-level read-only restriction; it does not establish a read-only permission scope for the provider credentials. The adapter only GETs allowlisted data.alpaca.markets paths and rejects redirects. It exposes no broker account, position, order, broker-contract or arbitrary URL endpoint.

Options use the explicit indicative feed: modified derivative quotes, not executable OPRA/NBBO; derived trades are delayed 15 minutes. Underlyings use IEX snapshots, not consolidated US market data. OPRA needs explicit entitlement and configuration; no silent fallback is performed. Missing fields remain null. The default chain covers a disclosed 60-day window and at most three 1,000-row pages; partial results and timestamps are visible. Standard 100-share stock/ETF deliverables are assumed rather than reference-verified; adjusted/unrecognized roots and known index roots are excluded. SPX/index options are out of scope.

The builder separates common-expiry payoff and analytical unlimited risk from European Black–Scholes scenarios with explicit inputs and Greek units. Time is entered explicitly, including fractional calendar days. The model does not infer exchange cutoffs, American early exercise, assignment, discrete dividends, margin or fills. Templates require entered premiums; no strategy edge or profit probability is claimed. Paper journal records are hypothetical and manual records are self-reported; recorded realized P&L uses entered premiums and fees only.

Private saved work is keyed by the authenticated founder. PUT requests must match both expectedOwner and revision; the body never selects the storage owner. Account-switch and revision conflicts fail without overwriting saved data. Limits are 40 watchlist symbols, 100 plans, 200 journal records and 1–8 legs per record. See options workspace plan and Worker controls.

qgtm-api.qgtmai97.workers.dev and qgtm.pages.dev belong to Portfoleo. They are not the trading API or terminal. Execdash is a separate local market-data terminal, not a hosted execution service.

Deployment and verification

.github/workflows/deploy-web-self-hosted.yml retains its historical filename but runs on ubuntu-latest. On main-branch web/edge changes or manual dispatch, it validates the QGTMAI account and existing founder configuration, tests the Worker and options math, lints and builds the frontend, validates the Pages project and service binding, deploys the private Worker, preserves its founder-hash secrets, privately connects the owner-approved market-data secrets, and publishes qgtm-trading with the service binding. It then checks the public health response and rejection of an unauthenticated session request. It never deploys the trading daemon or calls broker account, position or execution APIs. Only a canonical HTTP 403 with cf-mitigated: challenge permits a warned fallback to the existing Pages origin's health/session checks; a green runner check alone does not verify canonical access.

Configuration lives in qgtm_edge/wrangler.jsonc and qgtm_web/wrangler.jsonc. Use the QGTMAI Cloudflare account only.

  • GET /health: public web/auth service health; status: ok is not a claim that the trading engine or broker is running.
  • GET /api/v1/auth/session: returns the server-verified user or HTTP 401.
  • GET /api/v1/system/status: authenticated capabilities; reports trading_runtime: offline, execution_enabled: false, account_data_available: false, and market_data_available: false.
  • The same status exposes separate options_workbench_available, options_workspace_available, options_data_configured and options_feed fields. Legacy market-data false does not mean the separate options adapter is unavailable; configured true alone does not prove provider health/entitlement.
  • GET /api/v1/options/quotes and /chain: authenticated, bounded read-only observations with explicit source, timestamps, missing fields and partial flags.
  • GET / PUT /api/v1/options/workspace: authenticated private research records, with same-origin mutation checks, owner comparison and atomic revisions.
  • User verification: sign in, reload, open Research/Learn, sign out, and confirm a protected route requires sign-in again. Verify actual option observations separately from configuration, preserve existing records, and use disposable local fixtures for persistence tests. Trading routes must remain disabled.

Docs publishing uses .github/workflows/deploy-docs.yml and qgtm-docs. PR-logger publishing uses .github/workflows/deploy-pr-logger.yml and its existing Worker. Cloudflare deployment credentials stay in GitHub Actions secrets; existing founder hashes are copied directly to Worker secrets without printing their values.

Retired operations

Main/PR CI, manual hermetic backtests and manual/change-triggered security scans use hosted runners. The nightly backtest workflow remains disabled in the repository UI; its source definition is manual-only. Security scanning is enabled on hosted runners without a schedule. Eight stale schedules were removed: watchdog, nightly backtests, security scan, auto-research, weekly digest, morning brief, intelligence report and midday report. Security scanning remains available manually and on relevant changes.

Seventeen old operations workflows are hard-disabled in source: droplet API deploy, daemon controls, server diagnostics, runner recovery, monitoring, broker-backed backtests and legacy reports/publishing. A manual dispatch runs a hosted retirement notice; every historical job is unconditionally disabled. The retired droplet API workflow is manual-only. Merging main cannot revive the trading engine; automatic Cloudflare web/auth publishing is a separate path.

Historical job bodies remain for review history and safety regression tests. Old run reruns use old YAML: keep retired workflows disabled in repository settings and do not rerun historical operations.

A future trading runtime requires a separate hosting, credential, data-license, strategy-evidence, broker-state and release plan. Do not restore old DNS, provision a droplet or remove retirement guards as routine workspace maintenance. No live-capital or strategy-promotion approval is implied by passing software tests or working website authentication.