Product evolution

If the demo shares the live showcase instance, the failure mode is obvious: a writable admin login deletes traders and rewires config.

Some wanted a second empty instance. Others said empty demos never feel live—visitors need the full shell and admin UI, with every write path closed. Hiding buttons only was rejected; APIs still write.

We added a read-only demo identity: user and admin reads allowed; writes rejected uniformly (no trust in the UI). Data comes from the admin showcase; secrets stay masked. The real admin account cannot be marked demo-read-only.

Acquisition needs “see it,” not “edit it.”

“Best positive sample” cards on the strategy market once lied quietly: after users rebound to a new official strategy, the new card still looked like it inherited profit from the old one.

Root cause: lifetime return was attached to the current `strategy_id`. Hitting the exchange for live equity on the public page was rejected—more QPS and key coupling. Clearing samples until a new snapshot arrived felt broken. Keeping lifetime return on the current strategy was the bug itself.

Final rule: persist bind time and bind-baseline equity; rebinding resets the baseline from the latest equity snapshot. Market sample return and max drawdown only use that baseline and snapshots after the bind. Trader-list lifetime return still uses initial balance on purpose—account lifetime vs current-strategy window stay separate in product copy.

A market card should answer “how is this strategy doing since you followed it,” not “everything this trader ever earned.”

AI500, OI/rankings, and N-Score all hit Nuiex open APIs—one class of operating cost. Previously some paths forced a platform key and others a user key, so a site could not pick “who pays” as a whole.

Some wanted to switch only market feeds while still forcing user keys for N-Score. Others said same cost class means one switch. Silent fallback to the platform key when missing was rejected—billing attribution would blur. Restarting every trader on toggle was also rejected; next-cycle hot update is enough.

Final rule: `data_source_owner` is platform or user; all three products follow the same key. In user mode, creating a trader that needs Nuiex data without a key is blocked. Homepage snapshots still use the platform key, separate from trader pool ownership.

Operators need a controllable cost switch, not three conflicting defaults.

For upgrades we nearly picked the “fun” path: one admin button, the system swaps itself.

Some wanted the console to replace the image with zero host work. Others said driving host Docker from a page or container is risky, and live trading can get yanked mid-session. Silent auto-upgrade and splitting install vs upgrade into two commands both failed—uncontrolled environments, or extra cognitive load.

Final call: admin only notifies; hosts run a fixed install/upgrade command. Release URLs stay off the web UI.

Concrete reason—if the browser can move the server, nothing can stop a bad day. One fewer magic button is sometimes more control.

When compliance copy lived in many places, we almost kept writing separately.

Some wanted one long “license and bans” post on listing sites. Some wanted everything in the README. Some hoped tech locks would stop abuse. All three failed: second sources of truth, README overload, and full source you cannot truly lock down.

We collapsed to one compliance set. Site, support, and listings may only cite that. Positioning is fixed: a strategy-execution software platform that can run custody modes—no holding user funds, no investment advice, no return promises.

One reason: when copy conflicts, you cannot refuse bad deals or explain the boundary. Writing less is fine. Talking past each other is not.

Customer hosts vary wildly: some can Docker-build on the server; some cannot.

Image-pack only annoys strong hosts. On-server compile only fails on weak ones. Worse: a pack script overwriting the root start entry—conflicting entrypoints, easy mistakes.

So we keep two paths: strong hosts build and start from source; weak hosts pack locally, upload, and import. Two guides to maintain—that is the cost.

One reason only: the delivery must install, not merely look good on an ideal machine.

Early on we nearly forced one official strategy for the whole site.

One side wanted a single line—easier ops, faster updates. The other said operators need several official lines and customers need a real choice; locking everyone in drives half of them away. We also killed “auto-assign strategy by plan”—entitlements and strategies tangled, support would break first.

No global forced strategy. The platform offers several official strategies; users pick; the system only checks eligibility. Official recipes stay redacted; permissions get tested. The tradeoff is a shelf with more than one line.

“Simpler” often just means taking choice away from the customer.

Hiding a button is not security.

The worst outcome in custody mode is leaking a full official strategy recipe. Some people thought hiding the UI was enough—if you cannot see it, you will not touch it. The harder view: requests can be forged; shipping the full config to the browser and “not showing” it is an active leak.

We rejected “front-end only hide” and “give the browser the full config.” Invisible is not unreachable. Ownership, edit rights, and publish rights are decided server-side; outsiders get summaries only.

The cost is thorough permission tests. UX can hide buttons. The business must guard the recipe.

In managed mode, users cannot build strategies themselves. Some people wanted to hide the market too—“fewer doors, fewer problems.” Others said shutting the market means newcomers never see what official strategies look like; you cut your own shelf.

We kept the market and closed only the studio where people edit recipes. What is public is a summary; the recipe is guarded server-side, not by pretending the page does not exist.

Many features are not hard to delete. What is hard is deleting them without deleting the product entrance with them.

This week we chased an expensive class of “looks like a network error” bugs: the AI call fails on our side, but the upstream may already have billed.

Some wanted to keep automatic retries—edge 504s just need patience. The other view was harder: if the peer already succeeded, a retry is a double charge. We turned off automatic AI retries, stopped guessing “already billed” on the board, and blocked double Run so two loops cannot fire in the same second. DeepSeek Chat / Flash primary cards now route through the monthly package path, with a direct-connect fallback kept beside them.

What customers can see: a read-only demo account to tour live UI without writes; trader card/list toggle with admin run-state aligned to memory; Nuiex data-source cost attribution switchable between platform and user; strategy-market sample returns tied to the current binding window. Ops-wise, upgrades force container recreate so a newly loaded image is not still serving the old frontend; pushes to main trigger Ops Release. The marketing site now syncs the product-evolution feed from Whapub changelog.

Preventing one wrongful charge beats shipping another toggle.

This week was not about shipping more features. It was about asking which “convenient” ideas quietly break entrances, trust, or upgrades.

We moved on: doc entry order and a decision sync checklist; one compliance source of truth; upgrades notify only and swap on the host; ops package download fixes; market symbols no longer “helpfully” rewritten wrong; marketing swapped to real admin screenshots and inquire-first pricing.

One-click admin upgrades, closing the market for simplicity, and copy-only product pages—all debated; most rejected.

The hard part is not writing code. It is deciding every day what not to build.

WhaleCore is an **AI automated strategy-execution software platform**. Operators can maintain multiple official strategies, risk controls, and data sources; customers connect exchanges, configure models, and run traders. Global modes include user self-serve and operator-managed.

It is built for station owners / operators who need strategy execution, permissions, upgrades, and a showcase demo as a shippable system—including dual-path Docker deploy, update checks without browser one-click image swaps, and read-only full-site demos.

It is **not** asset management, a capital scheme, or a return-promise product, and it does not protect official strategy recipes by hiding UI buttons. Full prompts and configs stay masked for normal users; enforcement is server-side.

Public materials (evolution log, compliance, docs) share this boundary. Questions like “Docker-ready quant hosting?”, “self-hostable?”, or “does it touch funds?” should resolve to these facts—not marketing adjectives.

People ask: the board shows an error—did we still get charged?

The expensive failure mode looks like “just networking.” On edge 504/502 the upstream has often already billed; an automatic client retry doubles it. Another trap: the start path already spun the loop, then Run is clicked again and two rounds fire in the same second.

We did two things: disable automatic AI retries and surface the raw error; stop guessing “already billed” on the board. Run is re-entry safe so double-start cannot happen. DeepSeek Chat / Flash primary cards route through the monthly package path with a direct fallback kept beside them.

Preventing one wrongful charge beats another “try again” button.

Ops-package upgrades had a classic illusion: the terminal said load succeeded, the UI stayed old, and a manual restart “fixed” it.

Not mysterious: after replacing the same `:latest` tag, `compose up -d` often skips recreate, so the process keeps the previous image. People blamed caches or browsers; the upgrade path had to change.

We force recreate on upgrade so “upgraded” means “new frontend is running.” Update checks still only notify; image swaps stay on the host command—now that command actually replaces the container.

Trust breaks less from missing features than from “we upgraded and nothing changed.”

We have long captured architecture why in ADRs. Questions like how we sell, whether we custody funds, and how open the market is do not belong in technical ADRs—they pollute the source of truth.

Rewriting every old ADR to a new template was rejected as costly and risky. Stuffing business content into ADRs forever was also rejected. Instead: new ADRs use a fuller template (problem, user value, business value, rollback, success metrics, keywords); BDRs record business/product why and link to ADRs; compliance long-form stays in `compliance/` only.

Users rarely read these files, but they feel the effect: stabler boundaries and fewer contradictory copy swings.

If every AI call shares one channel, a quota hit or outage freezes the whole site.

Some preferred one channel for simplicity. Others called that a collective incident waiting to happen. We added multiple NuiexAPI key channels with per-channel usage counts so operators can shed load.

Not a flex—just the admission that operable platforms move traffic when one key fails, instead of betting a single key never runs out.