Security
Credentials
Section titled “Credentials”AI keys and explicitly configured direct-stream credentials use macOS Keychain, Linux Secret
Service (secret-tool), or Windows user-scoped DPAPI. Jorli refuses insecure deterministic-file
fallback. Broker mutation credentials stay in the Kite/Dhan CLI keyrings. Stream API keys/client
IDs and access tokens authorize only the official read-only market/order-update WebSockets.
Never pass an AI key with --api-key. The option is rejected because arguments are visible
in shell history and process listings. Never paste broker tokens, PINs, TOTP values, or API
secrets into the Jorli conversation.
Every normalized stream event carries broker/account identity, a local monotonic sequence, receive/exchange time, and protocol provenance. SQLite stores only checkpoints and sanitized order fields. Stale reads, gaps, malformed frames, or account mismatches fail closed; reconnect cannot resume delivery until CLI order, trade, and position snapshots succeed.
AI boundary
Section titled “AI boundary”The AI may propose schema YAML and explain reports. It cannot call an order mutation, approve risk, supply a confirmation flag, or override deterministic validation. Runtime evaluation reads the saved document and does not call the model.
Local data
Section titled “Local data”SQLite under ~/.jorli/jorli.db stores strategies, backtests, deployments, intents, and
append-only audit events. The database contains trading history and should be protected by
full-disk encryption and user-only filesystem permissions. It does not contain broker or AI
secrets.
jorli backup uses SQLite’s online backup API and writes an authenticated encrypted archive; it is
safe while the worker runs. Restore is deliberately offline and holds the same cross-process host
lock as the worker. Treat unencrypted exports and logs as financial data.
Broker mutations
Section titled “Broker mutations”Live broker mutation is bound to broker + account + strategy version, requires deployment and per-entry/exit confirmation, uses correlation IDs, fails closed on stale/missing risk data, requires full-depth liquidity for entries, aggregates active Kite/Dhan limits, and atomically reserves entry capacity across processes. Partial fills receive fill-sized stop-market protection. Protection failure or ambiguous cancellation pauses the deployment and activates global kill; ambiguous broker responses are preserved for reconciliation rather than retried.