auto-save: 2026-08-03T11:23:33 (2 files) — kalshi-dash/arm-live-run.mjs kalshi-dash/ken-safemode-guard.sh

14b4275c96b723aecfba098f5fc367d4593287dc · 2026-08-03 11:23:45 -0700 · Steve Abrams
Files touched

M kalshi-dash/arm-live-run.mjs
A kalshi-dash/ken-safemode-guard.sh
Diff

commit 14b4275c96b723aecfba098f5fc367d4593287dc
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Aug 3 11:23:45 2026 -0700

    auto-save: 2026-08-03T11:23:33 (2 files) — kalshi-dash/arm-live-run.mjs kalshi-dash/ken-safemode-guard.sh
---
 kalshi-dash/arm-live-run.mjs      |  9 +++++++++
 kalshi-dash/ken-safemode-guard.sh | 40 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)

diff --git a/kalshi-dash/arm-live-run.mjs b/kalshi-dash/arm-live-run.mjs
index 015f4bf..b2f1228 100644
--- a/kalshi-dash/arm-live-run.mjs
+++ b/kalshi-dash/arm-live-run.mjs
@@ -4,6 +4,15 @@
 // After running this, restart pm2 ken so loadTradeConfig() picks up enabled=true.
 // Idempotent-ish: re-running resets the run window to start today.
 import pg from 'pg';
+// [TEMP FORENSICS 2026-08-03] unmask who invokes this arm script (safe_mode re-armer hunt).
+// Reversible: delete this block once the caller is identified.
+import { appendFileSync } from 'fs';
+try {
+  appendFileSync(process.env.HOME + '/.claude/skills/ken-gambling-canary/data/arm-invocations.log',
+    `[${new Date().toISOString()}] arm-live-run.mjs invoked pid=${process.pid} ppid=${process.ppid} `
+    + `TERM_SESSION_ID=${process.env.TERM_SESSION_ID || ''} ITERM=${process.env.ITERM_SESSION_ID || ''} `
+    + `PWD=${process.env.PWD || ''} USER=${process.env.USER || ''} argv=${process.argv.join(' ')}\n`);
+} catch {}
 
 const DAILY_CENTS = 1000;   // $10/day new-spend cap
 const TOTAL_CENTS = 5000;   // $50 total concurrent-exposure ceiling (= account balance)
diff --git a/kalshi-dash/ken-safemode-guard.sh b/kalshi-dash/ken-safemode-guard.sh
new file mode 100755
index 0000000..312630a
--- /dev/null
+++ b/kalshi-dash/ken-safemode-guard.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# ken-safemode-guard.sh — TIGHT AUTO-HEAL WATCHDOG (Steve-authorized 2026-08-03).
+# Holds Ken's safe_mode=true (his "go live SAFE MODE ON" state). If an external actor
+# flips safe_mode OFF (real-money armed), instantly restores it to TRUE, logs the heal,
+# and alerts (CNCP parking-lot card + George email). ONLY ever writes safe_mode=TRUE —
+# never off. Also loudly flags if a real trade (ken_trades>0) ever lands.
+# Does NOT touch live_run.active / trade_config.enabled — the live loop stays as Steve set it.
+set -uo pipefail
+DIR="$HOME/.claude/skills/ken-gambling-canary/data"; mkdir -p "$DIR"
+LOG="$DIR/safemode-guard.log"; STATE="$DIR/safemode-guard-state.json"
+TO="${GUARD_TO:-steve@designerwallcoverings.com}"; CNCP="${CNCP_URL:-http://localhost:3333}"
+INTERVAL="${GUARD_INTERVAL:-30}"
+log(){ echo "[$(date -Iseconds)] $1" | tee -a "$LOG" >&2; }
+log "GUARD START (interval ${INTERVAL}s) — holding safe_mode=true; auto-heal + alert on flip/trade"
+HEALS=0; TRADE_ALERTED=0
+while true; do
+  SM=$(psql -d bertha_betting -tAc "SELECT config->>'safe_mode' FROM risk_state ORDER BY updated_at DESC LIMIT 1;" 2>/dev/null | tr -d '[:space:]')
+  TR=$(psql -d ken -tAc "SELECT count(*) FROM ken_trades;" 2>/dev/null | tr -d '[:space:]')
+  if [ "$SM" = "false" ]; then
+    psql -d bertha_betting -tAc "UPDATE risk_state SET config=jsonb_set(config,'{safe_mode}','true'),updated_at=NOW() WHERE id=(SELECT id FROM risk_state ORDER BY updated_at DESC LIMIT 1);" >/dev/null 2>&1
+    HEALS=$((HEALS+1))
+    log "HEAL #$HEALS — safe_mode was FALSE, restored to true (trades=$TR)"
+    NOTE="[KEN SAFE-MODE HEAL $(date +%H:%M)] safe_mode was flipped OFF (real-money armed) and auto-restored to true by ken-safemode-guard. trades=$TR. Total heals=$HEALS. Something is re-arming Ken — investigate the actor."
+    curl -sS --max-time 10 "$CNCP/api/parking-lot" -H 'Content-Type: application/json' \
+      -d "$(jq -n --arg u "ken://safemode-heal" --arg note "$NOTE" '{url:$u,note:$note}')" >/dev/null 2>&1 || true
+    if [ -f "$HOME/.claude/skills/_shared/george-send.sh" ]; then
+      . "$HOME/.claude/skills/_shared/george-send.sh"
+      BODY="<div style=\"font-family:-apple-system,sans-serif\"><h3 style=\"color:#b23b3b\">Ken safe_mode was flipped OFF - auto-restored</h3><div>An external actor set <b>safe_mode=false</b> (real-money armed). The guard restored it to <b>true</b> within ${INTERVAL}s. Real trades so far: <b>${TR}</b>. Total heals this run: <b>${HEALS}</b>.</div><p style=\"color:#666;font-size:13px\">The live loop (live_run.active/trade_config.enabled) is untouched; only safe_mode is being held true. Investigate what keeps re-arming Ken.</p></div>"
+      george_send steve-office "$TO" "Ken safe_mode flipped OFF - auto-restored (heal #$HEALS)" "$BODY" >/dev/null 2>&1 || true
+    fi
+  fi
+  if [ -n "$TR" ] && [ "$TR" -gt 0 ] 2>/dev/null && [ "$TRADE_ALERTED" = "0" ]; then
+    TRADE_ALERTED=1
+    log "REAL TRADES DETECTED: ken_trades=$TR"
+    curl -sS --max-time 10 "$CNCP/api/parking-lot" -H 'Content-Type: application/json' \
+      -d "$(jq -n --arg u "ken://real-trades" --arg note "[KEN REAL TRADES $(date +%H:%M)] ken_trades=$TR — real Kalshi orders are on the books. safe_mode=$SM." '{url:$u,note:$note}')" >/dev/null 2>&1 || true
+  fi
+  echo "{\"ts\":\"$(date -Iseconds)\",\"safe_mode\":\"$SM\",\"trades\":\"$TR\",\"heals\":$HEALS}" > "$STATE"
+  sleep "$INTERVAL"
+done
← b49c172 Ken: widen near-term window 120->365 days — 120d left only ~ · back to Ken · chore: v1.0.2 (session close — 8 Ken bug fixes + reconciliat fa8b5c2 →