Module 06 · Paper Execution Engine — Synthetic Fills Only
Irreversible Paper-Only Gate — Safety by Design
Open lesson + course map
On this lesson
Course outline
Module 1 · Market Systems and Safety — Pehle Boundaries Samjho
Module 2 · Python Bot Architecture — Ek Professional Bot Ka Skeleton
Module 3 · Market Data Pipeline — Read-Only Evidence Safely Fetch Karo
Module 4 · AI Research Engine — Extraction Se Human Review Tak
Module 5 · Strategy Research — Hypothesis Se Paper Test Tak
Module 6 · Paper Execution Engine — Synthetic Fills Only
Module 7 · Risk Controls — Estimation Error and Paper Limits
Module 8 · Database and Monitoring — Audit Logging and Model Evaluation
Module 9 · Deploying the Research Service — Read-Only and Measured
A runtime toggle named paper=true is reversible and therefore weak. Make paper-only scope irreversible within this product: omit authenticated dependencies, reject trading credential names, allow no write methods, use fictional points, and make build checks fail if prohibited capability appears.
Create a safety manifest listing allowed outbound hosts, HTTP methods, imported packages, environment names, database tables, and command entry points. The production research worker may fetch public GET data; the paper worker has no network. Neither includes an authenticated venue library.
Add static checks across source, lockfile, configuration, and documentation for forbidden patterns. Avoid relying only on words, because names can vary; also inspect dependency graphs and exercise runtime network policy. The CI job should create an environment containing fake suspicious keys and prove startup rejects them.
Use fictional paper_points as an integer unit. The schema prohibits currency codes, account balances, deposit references, addresses, signatures, and provider order IDs. Reports display “simulation points” and a banner that points cannot be redeemed or mapped to PKR.
Safety events are append-only: forbidden setting seen, network denied, unknown dependency, and schema violation. A failed gate stops the run before data processing. No admin override exists inside the application; changing scope would require a different reviewed product, which this course neither designs nor promises.
Make the manifest reviewable in continuous integration. Generate a software bill of materials, compare outbound-host and dependency lists with the approved baseline, scan source and compiled artifacts, and run network-denial tests. A checksum-approved release is promoted only when all gates refer to the same commit. Document false positives explicitly; never add a broad exclusion merely to make the scan green.
Review transitive dependencies as well as direct packages. A harmless-looking reporting library can add a network client or telemetry component. The build fails when the dependency graph changes until the new graph is assessed and the approved checksum baseline is deliberately updated. Runtime file permissions prevent the paper worker from loading undeclared plugins.
// pakistan_angle
Pakistan Angle
The project avoids payment workarounds, venue eligibility, and account setup entirely. Pakistani regulatory guidance may evolve; a codebase with zero execution capability keeps the educational lab clearly focused on software testing and forecast evaluation.
// hands_on
Hands-On Exercise
Write safety-manifest.json and CI checks. Add a fake package named trade-client, a fake EXCHANGE_SECRET, a POST attempt, and a currency field in separate negative tests. Each must fail before a run starts and append a sanitized safety event.
// completion_rubric
Completion Rubric
5 checks — tick as you verify
// sources
Sources
3 official sources — check every claim yourself