Execution and risk

Shadow first

jorli deploy infy-ema-crossover --mode shadow --broker kite --capital 50000
jorli worker run
jorli status --broker kite

Shadow intents are persisted and simulated locally. Generated demo candles are allowed only when the strategy explicitly enables allowSyntheticData.

Bounded live deployment

jorli deploy infy-ema-crossover --mode live --broker kite --capital 50000 \
  --expires 2026-07-12T15:20:00+05:30 --yes
jorli deploy activate <deployment-id> --yes
jorli worker run

Creating a live deployment is step one: Jorli writes a pending HMAC-SHA256 authorization whose host key stays in the OS credential store. The envelope binds strategy/schema/engine versions, broker account, instruments, products/order types, capital/risk/order/position limits, session, daily shutdown, and an expiry no more than 24 hours away. Activation is the separate second step and repeats signature, broker readiness, account, and time-window checks.

While that envelope is active and its worker heartbeat is fresh, entries and exits inside the exact bounds can execute unattended through the same quote, risk, dry-run, persistence, and broker CLI gates. The AI cannot activate, extend, edit, or relax the envelope. Immediately after an entry partial or full fill, Jorli submits opposing stop-market protection for the filled delta. Restart reconciliation rebuilds missing coverage without duplicating existing protection.

Entry preflight uses a fresh full-depth quote and rejects missing liquidity, zero volume, a wide bid/ask spread, or excessive limit-to-LTP deviation. Active Kite and Dhan risk snapshots are aggregated for global P&L, position, and day-order limits, and SQLite atomically reserves global entry capacity across processes. Rejected entries cool down for five minutes; losing exits/stops cool down for fifteen minutes. Runtime EMA/ATR sizing and tick rounding match the approved strategy/backtest, and stale or off-session candles cannot emit signals.

At every worker tick, reconciliation runs before authorization renewal. A tampered/expired authorization, stale heartbeat, changed broker account, broker/local position mismatch, or missing stop coverage pauses the deployment fail-closed. Ten minutes before the configured session close, Jorli submits bounded risk-reducing exits and pauses for the day. Risk reduction, protection, reconciliation, pause, and kill remain available when new risk is blocked.

If protection placement or cancellation is rejected or ambiguous, the deployment pauses and global kill activates. An ambiguous entry or exit is persisted for broker reconciliation and must never be retried blindly.

Controls

jorli pause <deployment-id>
jorli stop <deployment-id>
jorli kill --yes
jorli kill --clear       # only after reviewing account state

Pause prevents new intents but keeps reconciliation and protection active. Stop refuses while an entry is pending or quantity remains open. Global kill blocks new entries, attempts one confirmed cancellation of every identifiable pending live entry, and pauses all deployments across Kite and Dhan. It does not flatten existing positions or remove their stops; protection and confirmed exits remain available. If a cancellation is ambiguous, kill stays active and reports manual reconciliation as required.

Before using funds, complete a separate minimum-quantity authenticated fill, stop, exit, and restart-reconciliation smoke for each broker account. Dhan also requires its static-IP prerequisites. Jorli blocks Dhan live deployment unless dhan ip get reports a valid configured primary or secondary IP; the operator must still verify this host actually egresses through that public IP. Automated adapter tests cannot certify broker-side account configuration.