Webull F4 Live-Flip CeremonyPHASE 4 · OPERATOR RUNBOOK · REAL MONEY

Webull F4 (live) · Phase 4 · 2026-06-18 · ~9 min read · Real capital on a real exchange. Operator-signed, per-strategy, $100/ticket. UAT first.

§1 · Pre-flip checklist

Every row must PASS before running the §2 authorize script. These are the operator's empirical lab-entry thresholds, not the F7 EDGE_CONFIRMED gate.

Recipes & PASS/FAIL assertions

Gate metrics (rows 1–3):

curl -s 'http://127.0.0.1:8030/api/webull/f7/gate?mode=paper' \
  | python3 -c "import sys,json; d=json.load(sys.stdin); \
      b=[x for x in d['buckets'] if x['strategy_id']=='<strategy>'][0]; \
      assert b['n_closed'] >= 30,  f'FAIL n_closed={b[\"n_closed\"]}'; \
      assert b['p_lower']  > 0.30, f'FAIL p_lower={b[\"p_lower\"]}'; \
      assert b['b']        > 0.5,  f'FAIL b={b[\"b\"]}'; \
      print('PASS', b['strategy_id'], b['n_closed'], b['p_lower'], b['b'])"

R-distribution sanity (row 4) — fires FAIL if any close has |R| > 5:

SELECT COUNT(*) AS extreme_r
FROM webull_paper_trades
WHERE webull_strategy_id='<strategy>' AND is_live=0 AND status='closed'
  AND ABS(realized_r) > 5;
-- PASS iff extreme_r = 0

5-arm provenance (row 5) — fires FAIL if fewer than 2 labs contributed:

SELECT COUNT(DISTINCT webull_lab) AS arms
FROM webull_paper_trades
WHERE webull_strategy_id='<strategy>' AND is_live=0 AND status='closed';
-- PASS iff arms >= 2

Service health (row 6) and cron installed (row 7):

systemctl --user is-active stockpickerai          # PASS iff prints: active
crontab -l | grep -q phase4_reconcile.py && echo "PASS: reconcile cron installed" \
                                          || echo "FAIL: install §1.4 cron first"

§2 · Authorization command & expected output

Authorization is a deliberate, signed operator action — it writes one row to webull_live_authorizations.db. Run it interactively:

python3 scripts/phase4_authorize_strategy.py \
    --strategy long_call \
    --by "operator-2026-06-18" \
    --max-usd 50 \
    --notes "Phase 4 first authorization: lab experiment 4a"

Expected JSON output (the script snapshots paper metrics at the moment of auth as a sanity record):

{
  "status": "authorized",
  "strategy_id": "long_call",
  "authorized_at": 1781747820,
  "paper_snapshot": {"n_closed": 32, "p_lower": 0.412, "b": 0.83},
  "max_position_usd": 50
}

SQL invariant immediately after auth — exactly one active authorization for the strategy:

SELECT COUNT(*) FROM webull_live_authorizations
WHERE strategy_id='long_call' AND revoked_at IS NULL;
-- expected: 1

From this moment, the next open_trade() for long_call with live_mode_request=True routes through webull_live_adapter.place_option_order() (which still runs broker preview_option first, never skipping it). Every other strategy remains paper. The max_position_usd on the row caps the ticket regardless of the global MAX_DOLLARS_PER_TRADE.

§3 · First-3-trades monitoring protocol

The first three live trades after authorization are watched by the operator in sequence. Each has a specific gate; failing any one is an operator-only revoke + investigation — there is no automation here.

§4 · Convergence check (every 10 live closes)

This is the science. Live execution is a second, independent dataset; the edge claim requires it to agree with paper. After every 10 live closes for an authorized strategy, run:

WITH live AS (
    SELECT COUNT(*) AS n,
           AVG(CASE WHEN realized_r > 0 THEN 1.0 ELSE 0.0 END) AS p_hat_live,
           AVG(realized_r) AS mean_r_live
    FROM webull_paper_trades
    WHERE webull_strategy_id=? AND is_live=1 AND status='closed'
),
paper AS (
    SELECT COUNT(*) AS n,
           AVG(CASE WHEN realized_r > 0 THEN 1.0 ELSE 0.0 END) AS p_hat_paper,
           AVG(realized_r) AS mean_r_paper
    FROM webull_paper_trades
    WHERE webull_strategy_id=? AND is_live=0 AND status='closed'
)
SELECT live.p_hat_live, paper.p_hat_paper,
       ABS(live.p_hat_live - paper.p_hat_paper) AS delta,
       live.mean_r_live, paper.mean_r_paper
FROM live, paper;

Convergence rule on delta = |p_hat_live − p_hat_paper|:

Auto-divergence detection is a candidate for future automation; in v1 the operator runs this query manually and decides. Divergence is not a failure of the rail — it is exactly the finding Phase 4 exists to surface: a paper edge that does not survive real execution is a real (and valuable) negative result.

§5 · Kill-switch operations

Three reachable surfaces. The kill revokes the authorization row — the next open_trade() for that strategy reverts to paper. No service restart needed.

1 · From any phone with bash (the intended use case)

curl -X POST https://gpu3.<host>/api/webull/f4/kill/long_call \
     -H "Content-Type: application/json" \
     -d '{"reason":"phone kill - lunch meeting"}'

Expected response:

{
  "status": "revoked",
  "strategy_id": "long_call",
  "open_live_positions": 2,
  "next_open_trade_routes_to": "paper"
}

2 · From the dashboard (cursor's lane)

/webull-live-dashboard — a kill button per strategy plus a red KILL ALL (double-click) that hits POST /api/webull/f4/kill/all and cascades over every active authorization.

3 · From the CLI (during dev)

python3 scripts/phase4_authorize_strategy.py --strategy long_call --revoke --reason "kill"

§6 · Rollback / loss-floor condition

When MAX_DAILY_REALIZED_LOSS = $250 is breached, the adapter enforces the floor without operator intervention:

1. webull_live_adapter.check_position_limits() returns a blocked reason.
2. All subsequent live trade attempts return {"status":"blocked","reason":"MAX_DAILY_REALIZED_LOSS breached: today_pnl=-$251.34"}.
3. The routing layer falls back to the paper bridge — observations keep accumulating to the paper baseline, but no new live trades fire.
4. Open live positions are NOT auto-closed — the operator decides (market context matters).
5. At UTC midnight the daily counter resets. The operator's next-day decision: re-authorize or leave revoked.

SQL the operator uses to inspect the day's realized live loss:

SELECT SUM(pnl_usd) AS today_realized
FROM webull_paper_trades
WHERE is_live=1 AND status='closed'
  AND closed_at >= strftime('%s', 'now', 'start of day');

Webull F4 Live-Flip Ceremony · Phase 4 · 2026-06-18 · real capital, operator-signed, per-strategy, $100/ticket, UAT-first. Safety binding: per-strategy rows in webull_live_authorizations.db (not an env flag). Prerequisite science: F7 Verdict Readout Protocol · binding methodology: F7 Options whitepaper. Reconciliation cron: scripts/phase4_reconcile.py (every 60s; records broker-vs-local drift, never auto-kills positions).