Sentinel Suite · NinjaTrader 8 · living document·Docs home →

NinjaTrader Suite — Vision & Roadmap

⛔ GTrader21 was PULLED from the suite on 2026-07-29 and archived out of the compiled tree. Mentions below are HISTORY. The suite has two order sources: the Deck (manual) and the Bridge (automated) — any "all three order paths" statement here is stale.

Living document. This is the single place that captures what we're building and why, so every new Claude Code session (and you) starts oriented. Update the Status column as things move. Paired with the auto-loaded ../CONTRIBUTING.md (the rules/map) and the memory files (evolving per-project history). For the product/packaging view (the rungs, the runtime floor, the open-source posture), see the companion PRODUCT_LADDER.md / PRODUCT_LADDER.html — this doc is the pipeline map, that one is the product map.

Status legend: 💡 idea · 📝 designed · 🔨 building · ✅ shipped · ❄️ frozen checkpoint

🎯 The Vision

A cohesive suite of trading tools for NinjaTrader 8 — not a pile of one-off scripts — sharing a common design language and, over time, shared infrastructure (a kill-switch, feed-health gating, a unified logging/analytics layer). The pieces fall into four roles:

1. Signal sources — indicators that generate entry/bias signals (TrendArchitect MQB/MQS, GodTrades BG/FC/OBR, regime detectors).
2. Execution engine — arms signals and runs the full trade lifecycle (entry → protective orders → trailing → risk-gated exit) with a rich on-chart panel + risk card. (GTrader21 / the ported TrendArchitect panel.)
3. Cross-account distribution — the Copier AddOn: mirror one signal account to many execution accounts with prop-firm and instrument rules.
4. Observation & safety — the "Sentinel" layer: feed-health gating, a shared kill-switch, and post-trade analytics/logging (MAE/MFE Logger, Sentinel Log).

The guiding principle emerging from the copier work: decouple the leader (signal) from the execution accounts via fill-mirroring, so safety and distribution tools can wrap the strategy without touching its order path.

📍 Current State (2026-07-25) — LATEST (supersedes every dated snapshot below, all kept as history)

Read this before the 07-14 block below it. The focus changed between them, so the older block is not just behind on version numbers — it describes a step we have since moved past.

⭐ THE 2026-07-22 PIVOT — sensor edge-discovery, before Council fusion

The 7-voter roster is best read as scaffolding — assembled to build and prove the fusion machinery, which it did, rather than selected as an edge. Measured tick-true on 3,777 replay fires with a 70/30 time holdout against a 0.12R cost bar (break-even p = 0.560): trading the fused verdict does not clear the bar out of sample, and neither does any single sensor — best was AVMA 0.564 with a Wilson lower bound of 0.504, Council base rate 0.498. At n=448 decided the interval is ±5 points, so N is as much the constraint as signal is.

⇒ The durable asset is the tick-true measurement tooling (Lab\viz\observatory.py → :8501) — honest, real-fill, tick-by-tick outcome per decision, which a trader inside NinjaTrader cannot see. ⇒ The current job: audition the catalog voters STANDALONE and tick-true across a bar-type matrix, then build up from what holds. Buying N is what the corpus bakes are for.

• The Eye is out of the audition (2026-07-23). Breadth-only, its 1.4 weight never entered netScore, and it is not installed on the bake worker. Mentions of "Eye(1.4)" in the history blocks below are point-in-time records, including the 8-voter fusion table.
• Fitting the ConvictionFloor + per-bar-type weights is parked — there is not yet a result solid enough to fit against. The method (holdout discipline + tick-true fills) carries straight into the auditions.

Shipped since the 07-14 block

• Core v1.48.0 — ConvictionState (v1.37.0, the Drift CVB voter) · ReplayMode (v1.38.0) · RosterIO/LaneIO cascade (v1.39.0) · the generation beacon (v1.40.0) · Swallow/Faults (v1.41.0, migrated across 726 call sites / 86 files) · log retention LOG_GENERATIONS = 6 (v1.42.0) · CvdState (v1.43.0, the CVD voter — cumulative delta on any bar type, carrying Efficiency: ticks of price per 1,000 contracts of net aggression) · LaneAssign/ResolveLane (v1.44.0, the lane read from Sentinel\Lanes.conf rather than F6 alone) · PressureState (v1.45.0, the BSP voter — bid/ask-classified buy-vs-sell share) · NoteSignalFire / DrainSignalFires / SignalFireStats (v1.46.0) · the CVD VoterCatalog row (v1.47.0) · the completed bar-type name registry (v1.48.0 — _bartypeNames carried 3 of the 7 shipped Sentinel bar types, so Drift/Lattice/Effort/Tide rendered as Type212204…Type212207 on every surface). All documented in SENTINEL_DESIGN_SYSTEM.md §6f and §9. ⭐ v1.46.0 is the one that mattered most and it is not a voter: the excursion corpus could only ever see the Council, because the recorder's sole intake was a GetCouncilState poll opening on Open("COUNCIL", …). Every strategy was invisible to the corpus by construction — you could run one for a month and have nothing to grade it with. That, not exit policy, was the actual blocker behind Keel. Intake is now generic and the Council is one caller among several. ⚠ The {{core_version}} token kept this bullet's NUMBER current while its LIST rotted six versions behind — a substituted token refreshes the claim it stands in for, never the prose around it. ⭐ And it recurred on 2026-08-10, one bump later: v1.48.0 landed, the token moved this bullet's heading to v1.48.0 by itself, and the list still stopped at v1.47.0 until it was added by hand. ⇒ A version bump is a THREE-place edit — the const, the file banner, and every prose list that enumerates what shipped. The first two are guarded by version_check.py; the third is not, and a token makes the gap invisible by keeping the surrounding claim looking fresh.
• The corpus acceptance gate — Lab\verify_votes.py + vote_health + the 🗃 Corpus row on the Health board (SENTINEL_DATA_PLATFORM_SPEC.md §13), and the 10-minute preflight procedure (SENTINEL_RUNBOOK.md §4b).
• An F5 decouples every bar-type seam; only an NT RESTART fixes it — the answer to the whole BRK/FLUX/CVB saga. RUNBOOK §4b ①.
• Replay throughput: the continuous contract GC ##-## delivers 0.25–1.29× where front-month delivers 95–100× on byte-identical files — proven in one process with the instrument as the only variable, and pruning the folder 2,188 → 12 files changed nothing. ⇒ corpus bakes run front-month into distinct lanes.

⚠ Tool versions in the inventory below have drifted (e.g. Deck_v0_2_3 → live SentinelDeck_v0_2_6). memory/NOW.md is authoritative for the live version matrix.

📍 Current State (2026-07-14) — (history; superseded by the block above)

The suite has moved well past the snapshots below. Where they disagree on a version or count, this block wins.

⚠ Live per-tool versions move faster than this narrative. For the authoritative version matrix (Core · Council · Bridge · Cockpit · GTrader21 · recorder) memory/NOW.md wins over any number pinned below; {{core_version}} + the voter count render live from code and can't drift.

• The Council fuses 25 VOTERS (was 8–9). SentinelCore → v1.48.0, Council → v1.8.x.
• ⭐ Newest thread — SentinelFlux (order-flow imbalance BAR TYPE). A from-scratch López-de-Prado information-driven bar type (BarsPeriodType 212203, reserved block 212200–212299) stabilised by the TBars discipline. It closes bars on accumulated signed order-flow imbalance → the suite's first genuinely orthogonal axis (every other voter is price-derived). Publishes SentinelCore.FluxState → the FLUX voter + a FluxAbsorbDamp absorption modulator. Built + live-validated on a full 10/10 Council roster on GC.212203v8. Spec: SentinelFlux Bars. Grading vs TBars is pre-registered as EXP-0004.
• ⭐ The DATA PLATFORM is BUILT (was a plan): SQLite Sentinel\Lab\db\sentinel.db (WAL) + a live --watch ingester + Streamlit :8501 + Grafana :3000, auto-started by the SentinelDataPlatform scheduled task. The ingester now folds the Council VOTE VECTOR from the council\ corpus into the DB (~14.8k trades and growing, ~99% carrying the vote vector) — the precondition for fitting the model. Spec: Data Platform.
• The excursion recorder is SentinelExcursionRecorder_v2_0_0 (v2.1.6, schema 1.4 / ctick.3), Council-only: schema-1.4 ROW files in Excursions\council\1.4\ + per-fire tick-path sidecars in Excursions\council\ticks\; streams each row to disk on window-completion for crash-safety.
• ⭐ PER-CHART LANES — run N charts on identical bars with different systems. A scope discriminator: set a chart's Council Scope Lane = A/B and its scope becomes GC.212202v6x24@A (blank = bare, back-compat), so two charts identical on instrument+bartype+size no longer clobber each other's CouncilState/roster/corpus. The Council publishes laned, reads shared sensors bare, and loads a per-lane roster (Models\GC\<bartag>@A\Roster.conf, which inherits the bar-type baseline) plus a per-lane Lane.conf PROFILE (ConvictionFloor / deadband / consult toggles / modulator damps; sparse — absent keys inherit F6). Recorder v2.1.3 files each lane into its own corpus; SentinelBridge v0.2.4 + GTrader21 v0.1.8 consult the matching lane; the Cockpit ⑤ BUILD (v0.4.0) authors the lane roster + Lane.conf from the GUI. Fixes the SCOPE CONTENTION case. This is the A/B testing surface. (Core v1.32.0 lane registry + v1.33.0 LaneIO/cascade; Council v1.7.0 lane + v1.8.0 profile.) See System Builder spec §14 + the per-chart-lane memory.
• ⭐ HELM — the interdiction layer is BUILT (2026-07-15). A human grabs the wheel of a running automated actor without stopping it (the trio: Deck you drive · Bridge it drives · Helm grab the wheel). Helm owns no orders — it publishes a HelmIntent addressed to a specific actor's instanceKey; that actor executes with its own order handles and stays the sole owner (the only safe path: a panel closing a managed position desyncs it and locks the strategy out). SentinelCore → v1.34.0 (HelmVerb/HelmIntent/HelmState seam, one-shot expiry-guarded drain; risk-reducing verbs fail-OPEN, risk-adding pass GateEntry fail-CLOSED). SentinelBridge → v0.3.0 = the reference consumer (obeys all 10 verbs, Ledgers every intent as helm-intent stamped with the EpisodeId, marks the episode HumanOverride so the Lab excludes it). SentinelCockpit → v0.5.0 = the surface (new ⑤ Helm · interdict rail reads AllHelmStates() and its buttons publish intents). Plumbing tier live-validated (Pause/Resume round-tripped Cockpit→Bridge→HelmState→Ledger in ~350ms); position tier (Flatten/BE/MoveStop on a real trade) pending — see Docs/HELM_TEST_PUNCHLIST.md. GTrader21 is the frozen prototype Helm supersedes.
• The standing ML payoff is unchanged and now data-ready: fit the ConvictionFloor (0.20 interim) + per-bar-type weights from the clean schema-1.3 first-touch corpus.

📍 Current State (2026-07-07)

⭐ NEWEST (2026-07-11) — Sentinel goes OPEN SOURCE (MPL-2.0). A parallel productization thread turned the suite into a shipping open-source product: the Product Ladder (PRODUCT_LADDER.md) + the boundary inventory (SENTINEL_BOUNDARY_INVENTORY.md); the SentinelCore runtime split (→ v1.23.0, now a partial class so the Sensors bundle omits the L2 Safety layer, bundle-clean-verified); the assembled suite-oss repo (in Documents\NinjaTrader 8\Sentinel\, outside bin\Custom); a full provenance audit (WAE was an unlicensed port → clean-roomed as SentinelWAE_v2_0_0; LiquidityWalls kept as MPL-2.0 © TradingIQ); and MPL-2.0 chosen as the license. The port-sentinel-indicator skill now gates on license/provenance. Read the continue-here-2026-07-11 + product-ladder memories.

The suite looks and behaves like a system, and as of 2026-07-07 it has a brain: the Council confluence arbiter (see below). Prior threads: (A) the safety/correctness hardening push to make it fundable/prop-safe (offline build DONE; LIVE validation pending) — see SENTINEL_HARDENING_FRAMEWORK.md + SENTINEL_TEST_TRACKER.md + sentinel-hardening memory; (B) a design-system / Sentinel-homing polish thread that made the on-chart tools cohere and the tree self-organize; and (C) the Deck SIGNAL ARM — a generic indicator-plot signal → arm/auto-fire engine (see below + deck-signal-arm memory). The newest thread (D) is fusion + orthogonal signal collection — the Council fuses the suite's sensors into one verdict, and as of the 2026-07-07 session close that arc is COMPLETE: the Council fuses 8 voters + 6 modulators/vetoes, with five orthogonal axes SHIPPED (Clock · Participation · Location · MTF · Intermarket, all live on GC), SentinelCore at v1.12.0, and a codified Council Protocol. The next thread (E) is the Bridge side — an execution surface that consumes CouncilState and records verdicts to the Ledger (see Near-term sequence #8). The one open item across A/B/C remains LIVE market-open validation.

⭐ Current State (2026-07-08, later) — THE COCKPIT: the suite gets a command surface

The push after closing the loop was operability — a single place to answer "is my brain alive, and why isn't it trading?" without opening the Indicator dialog or grepping the log. - SentinelCockpit_v0_1_0 — BUILT (Phase 1), NEEDS F5. A floatable/pinnable WPF NTWindow (AddOns/SentinelCockpit_v0_1_0.cs, base …AddOns.Sentinel ns, display "Sentinel Cockpit", Control Center ▸ New ▸ Sentinel Cockpit) that RE-READS the published …State seams instead of fighting for on-chart card corners — the ultimate dogfood of the publish/consult architecture (ONE consumer of all of it). Phase 1 = ① DECISION (GetCouncilState → last verdict + self-computed freshness → honest stale Ns dot; bias pill / conviction-vs-floor track / size×; the why-line: kill ▸ governor ▸ veto ▸ stale ▸ floor ▸ size ▸ edge) + ② GATE (kill-switch + per-account Governor cards). Instrument picker from AllCouncilStates; 📌 pin = Topmost; Sentinel\Cockpit.conf persists instrument+pin; K theme. No change to any existing tool → the F5 is test-safe; SentinelCore stays v1.14.0 (reads seams only). NEXT = Phase 2 (③ Context + ④ Voters + age dots + per-card show/hide); Phase 3 (ChartTrader dock + follow-active-chart). Spec SENTINEL_COCKPIT_SPEC.md. Motivating episode: the Bridge "traded then stopped" — the Council looked gone but was live (67 verdicts), its card just buried in a stacked corner + a dry-up staleness flicker; real cause benign (conviction below the 0.35 floor → correct stand-down). The Cockpit surfaces exactly the stale ▸ floor pair that confused the operator. - SentinelDashboard → v1.1.9 — Accounts tab exposes the FULL governor in-tab (manual daily cap / reset hour / trailing DD + type + flatten buffer / auto-flatten); Save merges* into the account's conf line (no longer wipes unmanaged fields). (v1.1.7 Home/News front page + v1.1.8 Excursion two-column redesign earlier the same day.)

⭐ Current State (2026-07-08) — THE LOOP IS CLOSED: the Bridge is built and LIVE-VALIDATED

Thread (E) landed. The suite now has a full sense → decide → act → record loop: sensors publish …State seams → the Council fuses them into CouncilState → the Bridge consumes that verdict, sizes/gates/routes an order, and records the verdict to the Ledger on every fire so Lens can grade the weights. Highlights: - SentinelBridge — the automated Council-consumer, BUILT + LIVE-VALIDATED. (namespace NinjaTrader.NinjaScript.Strategies — deliberately the BASE Strategies namespace, display "Sentinel Bridge".) v0.1.0 = headless engine: reads SentinelCore.GetCouncilState (Council-as-signal, edge-detected bias-flip, one-shot per verdict, flat-only), sizes baseQty × SizeMult, routes through GateEntry (fail-CLOSED, enters only on IsClear), managed bracket, and RECORDS the verdict every fire (Ledger.Order + a "bridge-fire" Action) so Lens can grade the sensor weights. v0.2.0 adds an on-chart Sentinel glass card with a clickable ARM BRIDGE button (arming gates all firing; off on load; never persisted), optional ExitOnCouncilFlip, and UseSentinelConfig (auto-reads <inst>_COUNCIL_<dir>.conf). v0.1.0 archived. LIVE-VALIDATED 2026-07-07: fired a SIM GC SHORT off the Council verdict with a managed 40t/30t bracket; the fill was captured in the Ledger (verified in the dashboard Slippage tab, tag SentinelBridge). See BRIDGE_SPEC.md. CAVEAT (fixed): the first live test fail-CLOSED because the Bridge passed RiskDollars into GateEntry → it risk-sized to 0 → "risk too small" Advisory; fix = pass riskDollars=0 (the Bridge sizes itself; the Gate only validates). Also fixed: card reads CouncilState live every render; gate on SizeMult>0. - GTrader21 v0.1.7 — Eye→Council DECOUPLE done (the P3 the roadmap listed as planned). New opt-in UseCouncilGate + CouncilMaxAgeSeconds (group 14, default OFF): SubmitEntry consults the Council's FUSED verdict (GetCouncilState → HasEdge && Aligned(dir)) instead of the Eye directly; the Eye becomes one voter inside the Council. Turn ON + UseEyeGate OFF to decouple. v0.1.6 frozen (both coexist). - Council now fuses 9 VOTERS — the prior 8 + WAE. SentinelWAE_v1_0_0 (Waddah Attar Explosion) is a new momentum-breakout voter publishing SentinelCore.WaeState — the first tool "born compliant" under the naming law. SentinelCore bumped to v1.13.0. - Excursion lab records the Council verdict. SentinelExcursionRecorder_v1_4 (renamed from SignalExcursionRecorder_v1_3 — first tool to fully adopt the naming law; v1_3 archived) records the COUNCIL verdict as a "COUNCIL" signal (schema 1.2, conviction buckets LOW/MID/HIGH). SentinelExcursions → v1.0.5 (ByConviction partition + ConvictionVerdictCode — "does conviction pay?"). Dashboard → v1.1.6 (⑤ Conviction referee in the Excursion tab; Apply ◆ writes <inst>_COUNCIL_<dir>.conf — the file the Bridge reads). See EXCURSION_RECORDER_v1_4_SPEC.md. - FEDERATED NAMING LAW ratified (SENTINEL_NAMING_FEDERATION.md + design-system §7): every Sentinel tool carries the tell on 4 layers — display Name="Sentinel <Thing>", class Sentinel<Thing>_vX_Y_Z, namespace …Indicators.Sentinel, cyan card + label-remover. ⚠ STRATEGIES stay in the BASE …Strategies namespace (NOT sub-namespaced) — NT's Strategy selector HIDES sub-namespaced strategies (verified on SentinelBridge). This REVERSES the earlier "drop the prefix" convention. 17 indicator heads had their display Names retrofitted to "Sentinel X" (identity/class renames happen at each tool's next bump); BuySellVolumePressureMountain display → "Sentinel BSVPMountain". Retired/archived: GTrader_v1_0_0 + GTraderStrategy_v1_0_0, ADXPro_v1_1_0, Deck_v0_2_1, SignalExcursionRecorder_v1_3. - Hardening / observability: SentinelRiskService → v1.0.8 (persists the governor daily-P&L baseline via SentinelCore.State so a mid-day F5 no longer zeroes the day). SentinelDashboard → v1.1.6 (Accounts cards now show live open/unrealized + the account's raw realized matching NT). - New living manual: SENTINEL_SUITE_MANUAL.md — the zero-to-fluent suite manual (trader + coder).

⭐ NEW 2026-07-05 — Design-system homing + UX polish (all compiles clean; F5-validated in part; see continue-here-2026-07-05 + sentinel-namespace-and-naming memories)

• On-chart "flight-instrument" cards — retrofit COMPLETE. Every retrofitted tool now draws its readout as a SentinelSkin.Painter glass card (header dot + title + state pill + track + mono rows) instead of Draw.TextFixed: CompressionBase, ADXPro, Eye (perf grid), SignalExcursionRecorder (the last gained a card — was headless).
• SentinelSkin.CardLayout (SentinelSkin internal v1.1) — a shared anti-overlap registry: cards from different tools docked to the same chart corner auto-stack (never cover each other); each card gets a CardCorner property to spread across corners. VALIDATED live (two cards stacked cleanly).
• Namespace convention — tools group in the picker. Suite indicators live in namespace …Indicators.Sentinel; NT's picker renders sub-namespaces as expandable folders, so they cluster under a "Sentinel" folder (VERIFIED). NT codegen is namespace-aware → still hostable by simple name. AddOns already use AddOns.Sentinel.
• Strict naming enforced — clean <Thing>_vX_Y_Z (folder supplies the "Sentinel" context; drop redundant prefixes; lowercase v, three parts). Adopt at each tool's next bump only (namespace+name = serialization identity).
• Old versions ARCHIVED out of the tree (13 files → Documents\NinjaTrader 8\_archive\Indicators\) so no one uses stale ones — kept only the newest Sentinel-homed head of each.
• Label remover — MANDATORY standard. Every Sentinel indicator hides NT's top-left name label by default (ToString() override) with a ShowIndicatorLabel toggle to restore it.
• Chart candles recolored (user pick): up = teal #FF009999, down = grey #FF8E8E8E (skin ChartControl.xaml); chart right-side margin is a per-chart property (save as Default template), not a skin key.

The four Sentinel-homed heads (2026-07-05): CompressionBase_v1_3_0 · SignalExcursionRecorder_v1_3 · ADXPro_v1_1_0 · Eye_v1_1_0 — all in Indicators.Sentinel, all with the glass card + CardCorner + label remover.

⭐ NEW 2026-07-06 — Deck SIGNAL ARM (generic indicator-plot → arm / auto-fire; see deck-signal-arm memory)

Deck_v0_2_2 gained a SIGNAL ARM section (top of panel, collapsible) — the Deck can now arm or auto-fire off ANY loaded indicator's PLOT, discovered from ChartControl.Indicators at runtime (no hardcoded signals). - Rules Sign / Rising / A×B cross / Threshold + Invert; cadence bar-close/tick; dropdown source pickers (A/B). - ARM = highlight BUY/SELL, human confirms. AUTO-FIRE = fail-CLOSED through the Gate, one-shot/bar, flat-only + opposite-reverse, forces MARKET, tag Deck:signal. Suppresses the state-at-enable (only a real change fires). - Read-race hardened — a one-bar pulse from a foreign OnBarClose source is read on the just-closed bar + re-checked every tick (fires the bar after the signal; non-repaint). Diagnostics → sentinel.log (Deck:sig). - New suite convention: signal-emitting indicators expose their signal as a hidden PLOT (transparent + IsAutoScale=false). CompressionBase_v1_3_0 added a Signal plot (±1 breakout) as the reference. (The other seam is a SentinelCore publish.) - Persisted config (survives F5/workspace; watch NOT persisted) + in-Deck presets (signal + entry; load/save/delete). - STATUS: all compiles clean; LIVE auto-fire validation is the sole open item (Test tracker §D3). ~~Kept IN-PLACE on Deck_v0_2_2; freeze Deck_v0_2_3 once auto-fire + drag/attach both pass SIM.~~ SUPERSEDED 2026-07-21: renamed to SentinelDeck_v0_2_5 (naming law) and published as a public testers' preview with auto-fire ENABLED — testers are now the validation path, so the freeze gate is a graded corpus, not a solo SIM pass. Freeze = drop " (DEV)" from the DeckVersion constant.

⭐ NEW 2026-07-07 — the Council: the suite's CONFLUENCE ARBITER ("the brain") — BUILT ✅

Council_v1_0_0.cs (namespace NinjaTrader.NinjaScript.Indicators.Sentinel, display name "Council") is a read-only chart indicator — it places NO ORDERS. It is the fusion point the suite was missing: every sensor already published a SentinelCore state seam, but nothing combined them. The Council does. - Consumes every existing published sensor seam for its instrument via a weighted VOTE: Eye verdict, TrendState (SentinelTrend), CciState (WoodiesCCIPro), AdxState (ADXPro), EnvelopeState (VolEnvelope), BrickState (Sentinel bartypes) → fuses into ONE verdict: fused Bias (−1/0/+1), Conviction (0..1 = how ALIGNED the fresh voters are), SizeMult (0..1; 0 when vetoed or below a conviction floor), agree/disagree/voter tallies, and a compact human-readable Reasons audit string. - Account-free HARD VETOES zero conviction: global kill · scoped per-root kill · rollover · news lockout · an absorption wall blocking the intended side. - PUBLISHES all of the above as a new SentinelCore.CouncilState seam (SentinelCore bumped to v1.7.0) so any strategy / Bridge / Deck can consult the SAME decision instead of re-deriving confluence. - Exposes hidden transparent Bias/Conviction plots (so the Deck SIGNAL ARM reads it generically), draws a Sentinel glass card, and logs verdict CHANGES to sentinel.log. - ⚠ HONEST CAVEAT (record this loudly): the sensors the Council fuses today are almost ALL price-derived (ADX/CCI/Trend/Envelope/Brick all echo the same OHLC), so they are NOT independent. "Conviction" measures AGREEMENT, which is not the same as CONFIRMATION. The Council only gets genuinely smarter as ORTHOGONAL signal axes are added — which is exactly the next thread (see The Council & orthogonal signal collection below).

✅ SESSION-CLOSE UPDATE (2026-07-07) — the signal-collection arc is COMPLETE (all built + compiling + rendering LIVE on a GC chart)

The Council now fuses 8 VOTERS — Eye(1.4) · SentinelTrend/TrendState(1.0) · WoodiesCCIPro/CciState(0.8×strong) · ADXPro/AdxState(0.6×strong) · VolEnvelope/EnvelopeState(0.6) · Brick/BrickState(0.5) · CompressionBase/CompressionState(0.7) · Intermarket/IntermarketState(0.6) — plus 6 modulators/vetoes: breadth · VolEnvelope squeeze · Clock (midday/off-session damp + kill-window veto) · Participation (rvol damp) · MTF (counter-higher-TF damp) · Location (into-level damp); hard vetoes = global/scoped kill · rollover · news lockout · liquidity wall. SentinelCore bumped to v1.12.0 across the session (seams: CouncilState v1.7.0 · ClockState v1.8.0 · ParticipationState v1.9.0 · LevelState+MtfState v1.10.0 · CompressionState v1.11.0 · IntermarketState v1.12.0). The 3 dark voters (SentinelTrend/ADXPro/VolEnvelope) were fixed to publish default ON. COUNCIL PROTOCOL codified (SENTINEL_DESIGN_SYSTEM.md §9 item 6): every new signal/regime/bias/context indicator MUST publish a …State seam (INT/double/bool), default PublishState ON, and be wired into the Council (voter/modulator/veto) — a hidden plot alone is not enough. PARKED: breadth internals ($TICK/$ADD — feed is DELAYED, needs a real-time entitlement, and it's an ES/NQ tool anyway) · book/spread microstructure · VIX regime.

Safety/correctness hardening (thread A)

The active work is a safety/correctness hardening push to make it fundable/prop-safe — see SENTINEL_HARDENING_FRAMEWORK.md (the plan) + SENTINEL_TEST_TRACKER.md + the sentinel-hardening memory.

Newest since 2026-07-03 (all compiles clean; ⚠ needs live validation — market was closed): - Sentinel Deck (Deck_v0_2_1, indicator, Indicators.Sentinel) — a MANUAL discretionary order deck + account risk card: all order types, all price-entry methods, full trade management (bracket/OCO, breakeven, all 7 trail modes, scale), chart-scoped flatten, pop-out/dock, and the $-risk sizer. 2026-07-05 suite-convention alignment: rehomed to Indicators.Sentinel (Sentinel folder) + renamed SentinelDeck_v0_2_0→ Deck_v0_2_1 (strict naming) + label remover (order tags decoupled from Name into a stable _tag) + risk card docks via CardLayout/SentinelCardCorner. No order-LOGIC change (⚠ still validate on SIM). v0_1_0/v0_2_0 archived. + FEATURE (2026-07-05) — on-chart order visuals ("Show order lines"): live ENTRY (cyan) / STOP (red) / TARGET (green) lines with R/$/tick chips (right-side labels default; editable width). Deck_v0_2_2 adds DRAG-TO-ADJUST + HOVER-ATTACH (⚠ modifies live orders — SIM-first): hover a STOP/TARGET line → drag to re-price the working order (StopPriceChanged/LimitPriceChanged + Account.Change); drop on an overlay indicator plot to attach (order follows the plot each tick, throttled; only-improve toggle). Esc cancels. Also v0.2.2: risk-card bar timer/tick counter, button-sizing fixes. v0_2_1 frozen. - SentinelSkin framework (AddOns/SentinelSkin.cs) — the shared on-chart drawing library (palette + Painter) every tool uses; + a platform Sentinel skin (templates/Skins/Sentinel/) that themes candles/ chrome/selection. SentinelV1_0, SentinelEye, CompressionBase repaletted to the tokens. - HARDENING — the OFFLINE build list is COMPLETE (SentinelCore v1.1.0, SentinelDashboard v1.1.4). The 3 substrates + their views are all built; only LIVE (market-open) validation remains (Test tab). - Gate — GateEntry/SizeForRisk/TickValue + rate guard, wired Deck (fail-open) + GTrader21/Copier (fail-closed); hard auto-flatten (opt-in hardEnforce=true). - Ledger + State — SentinelCore.Ledger daily JSONL (Order/Action/Fill) + READ API; SentinelCore .State keyed restart-surviving store. Fill capture wired into ALL 3 order sources (GTrader21/Deck/ Copier→copy-slippage). Position-state persist + restore (GTrader21, restore = opt-in, safe 3-case). Reconnect reconciliation (naked-position detect+alert). - Alerts — 2-tier SentinelCore.Alerts + SentinelAlertService (sound + optional push shell cmd, Sentinel\Alerts.conf). Clock/TZ (resetHour=), readiness view, config-git. - VIEWS — dashboard Journal (blotter/audit + live tail), Slippage (execution quality), Test (alert config + dry-run gate probe + safe self-checks + ledger audit), + reusable WPF chart primitives (HBars/HDivBars/SignedBars/Columns) across the data tabs. - NEXT = LIVE validation only (market was closed): kill proof, alert sound, restore, auto-flatten, reconnect.

Highlights since the Jul-1 snapshot below:

• SentinelDashboard (v1.1.4) — 12 tabs: Copy · Log · Risk · Journal · Slippage · Lens · Eye · Arc · Assist · Excursion · Accounts · Test (all live). Reskinned "flight-instrument" palette + chart primitives.
• SentinelCore v1.0.9 — shared registries/gates: kill-switch, per-instrument scoped kill, feed-health, Eye verdicts, fleet plan (Arc), manual-assist tickets, rollover, news lockout, config-use, consistency governor, account profiles. Combined entry gate CanEnter = kill + scoped-kill + feed + governor + session + rollover + news; CanActInstrument for the copier; SizedQuantity for profile sizing.
• GTrader21 v0.1.6 (v0.1.5 frozen; v0.1.4 was the live ES FC-in-trend test) — Sentinel entry gates (CanEnter), feed-watch registration, Arc/Eye/Trend gates, lab-config auto-read (GTraderConfigs\*.conf) + reports back, profile-aware sizing + session gating.
• Signal lab (measurement ≠ execution): SentinelExcursionRecorder_v1_4 (renamed from SignalExcursionRecorder_v1_3, now records the COUNCIL verdict as a "COUNCIL" signal — schema 1.2, LOW/MID/HIGH conviction buckets; Indicators.Sentinel; glass card + label remover; raw maxMFE/maxMAE per signal, regime+eye tagged) → SentinelExcursions v1.0.5 (ByConviction partition + ConvictionVerdictCode) + the Excursion tab (edge chart, per-signal detail, expectancy grid w/ ◆ best-responsible, Eye referee, ⑤ Conviction referee, fire-rate) → Apply ◆ / Sync-all writes .conf (incl. <inst>_COUNCIL_<dir>.conf the Bridge reads) → GTrader21 auto-reads. First finding: FC-in-trend is the edge; OBR is noise. See EXCURSION_RECORDER_v1_4_SPEC.md.
• Safety (Risk v1.0.6): feed lag/stall watchdog with hysteresis + auto feed-recovery; scoped (per- instrument) auto-kill; rollover countdown; news lockout (News.conf); consistency governor hosting (Profiles.conf, firm presets). Copier v0.1.0g — scoped-kill + governor + session gating per follower.
• Observability: state.json (v1.0.7) now carries risk/eye/arc/assist/configs/governor/profiles/eyeReferee blocks.

Immediate next (all LIVE / market-open — the offline build is done): open the dashboard Test tab and run the safe checks now (alert sound, dry-run gate probe, self-checks, ledger audit); then on a Sim session validate the market-open items in SENTINEL_TEST_TRACKER.md: kill-switch proof, GTrader21 position-state restore (turn on the opt-in prop, recompile mid-position, confirm NO duplicate stop), stop-fill slippage, auto-flatten, and reconnect naked-position alert. Then re-arm the live ES FC-in-trend test and validate the governor/session/sizing gates funded. See memory/sentinel-hardening.md for the blow-by-blow.

🧠 The Council & orthogonal signal collection (✅ the axes are SHIPPED — 2026-07-07)

The Council (shipped 2026-07-07, above) is the fusion seam. It is only as good as the axes it fuses — and the original sensors were almost all price-derived and therefore correlated (agreement ≠ confirmation). The push this session was to add ORTHOGONAL signal axes — genuinely independent information — each of which: - publishes its own …State seam (so the Council votes on it, and so any tool can consult it), and - records to the SentinelCore.Ledger on every fire (so Lens can grade whether the axis actually adds edge).

STATUS: the ladder is DONE — five orthogonal axes shipped as their own Indicators.Sentinel NO-ORDER indicators (publish default ON), all wired into the Council + live-verified on a GC chart. The COUNCIL PROTOCOL is codified (SENTINEL_DESIGN_SYSTEM.md §9 item 6): every new signal/regime/bias/context indicator MUST publish a …State seam and be wired into the Council — a hidden plot alone is not enough.

1. ✅ Clock — ClockState (Core v1.8.0). Session phase, mins-to-close, kill window (via SessionIterator). MODULATES every voter's weight (midday / off-session damp + kill-window veto) rather than casting its own vote.
2. Event veto — EventState. Already has a consumer path (folded into the news-lockout veto): SentinelRiskService reads Sentinel\News.conf → SentinelCore.SetNewsLockouts → CanEnter, and the Council vetoes on NewsLockoutActive. The user's Python EconomicCalendar.py (ForexFactory fetch → scored JSON) should FEED this — its block_windows land in News.conf. CAVEATS: (a) freshness guard — treat a stale/missing calendar as fail-to-caution; (b) its directional bias_score is EQUITY (MNQ)-specific and must NOT be consumed by gold (GC/MGC) — only the blackout windows are universal; (c) timestamps are ET wall-clock (need ET→session conversion). (A dedicated EventState seam beyond the existing news-lockout path is still open.)
3. ✅ Participation — ParticipationState (Core v1.9.0). Time/bar-normalized relative volume (RVOL) + climax / dry-up detection. Modulates via an rvol damp.
4. ✅ Location + MTF (Core v1.10.0): - ✅ Location — LevelState: VWAP + bands, prior-day H/L, opening range, initial balance, session H/L + the nearest level; modulates via an into-level damp. - ✅ MTF — MtfState: bias on the 1/5/15/60/240 ladder, per-TF trend = hosted SentinelTrend; modulates via a counter-higher-TF damp.
5. ✅ Intermarket — IntermarketState (Core v1.12.0), the fifth axis and a genuine 8th VOTER (0.6). Configurable correlated instruments, instrument-agnostic polarity (default ZN+ for gold). Built precisely because DXY isn't on the feed but ZN/ZB are real-time — the concrete answer to the parked "Internals" item for gold.
6. PARKED (keep on the list): breadth internals ($TICK/$ADD/$VOLD/$TRIN — the feed is DELAYED without a real-time entitlement, and it's an ES/NQ tool anyway) · book/spread microstructure · VIX / vol-term-structure regime.

🏷️ Naming / renames

• The brain is named "Council" — deliberately NOT "Architect" (rejected to avoid collision with the existing TrendArchitect panel).
• The automated-strategy chart trader is named "Bridge" — pairs with the manual Deck (nautical: trade by hand on the Deck, command the autopilot from the Bridge). "Helm" = you grab the wheel of a running actor without stopping the car — the discretionary interdiction layer. (✅ BUILT 2026-07-15 — see Current State 2026-07-14; Bridge ✅ BUILT + LIVE-VALIDATED 2026-07-07 as SentinelBridge — see Current State 2026-07-08.)
• Eye is DECOUPLED from GTrader21 (✅ done, v0.1.7). The Eye is just one sensor publishing EyeVerdict to the bus (already generic at the Core level); GTrader21 is now just one strategy among many — its opt-in UseCouncilGate consults the Council's fused verdict rather than consulting the Eye directly.
• FEDERATED NAMING LAW (SENTINEL_NAMING_FEDERATION.md + design-system §7): the 4-layer tell (display Name="Sentinel <Thing>" · class Sentinel<Thing>_vX_Y_Z · namespace …Indicators.Sentinel · cyan card + label-remover). ⚠ EXCEPTION — strategies stay in the BASE …Strategies namespace (NT's Strategy selector hides sub-namespaced strategies; verified on SentinelBridge). This reverses the earlier "drop the prefix" convention. 17 indicator heads got the display-Name retrofit; class/identity renames land at each tool's next bump.

🛠️ Tool Inventory & Status

Execution engine

Suite architecture (decided 2026-07-01: Hybrid)

Each tool is its own headless AddOnBase service (fault isolation) + one shared SentinelCore (kill-switch, feed-health gate, settings dir — the only cross-tool dependency) + one unified tabbed dashboard (SentinelDashboard) whose tabs attach to each service's .Instance. Product family: Copy · Log · Risk · Lens · Arc · Eye (from the user's naming).

Cross-account distribution

Observation & safety ("Sentinel" layer)

Signal sources & analytics (existing library)

Orthogonal signal axes (Council voters/modulators — Indicators.Sentinel, NO ORDERS, publish default ON, live-verified 2026-07-07)

Idea for later: "regime gating" — only arm a signal when the regime detector agrees. Cross-cuts signal sources + execution engine.

🧭 Near-term sequence

Items 1-6 below (the original Jul-1 skeleton plan) are all ✅ done — SentinelCore, Copier, all dashboard tabs, config persistence, feed-health probe (Risk), and stop-handling (pure fill-mirror kept) all shipped. Current sequence:

0. ✅ DONE — the whole offline hardening build (SentinelCore v1.1.0 · Dashboard v1.1.4 · AlertService v1.0.1 · GTrader21 v0.1.6 fill-capture/persist/restore · Deck v0.2.0 + Copier v0.1.0h fill-capture). Compiles clean, F5'd.
1. 🔜 LIVE validation via the Test tab + SENTINEL_TEST_TRACKER.md: kill-switch proof (probe→HARD), alert sound, GTrader21 restore (opt-in; recompile mid-position; no dup stop), stop-fill slippage, auto-flatten, reconnect naked-position alert.
2. Validate the safety gates on a Sim account before funded use: governor caps/loss-stop, per-account session windows, and profile sizing (set size=0.5|contracts=2|session=<now>|dailyLoss=<small> and watch the logs).
3. Accrue the lab data: run FC-in-trend on GC + NQ (per-instrument TP/SL from their own excursion medians); let Eye accrue so the Eye referee produces a verdict.
4. Governor phase-5 (SizeScale/dilution after an over-cap day) once there's cross-day P&L to work with.
5. Consume session / ContractLimit more widely and wire per-account profiles into the copier sizing if the desync concern is resolved.
6. Docs freshness discipline (roadmap thread #5): keep ROADMAP + the specs + memory current at each milestone.
7. ✅ DONE — the Council has real independence. The orthogonal signal-collection ladder is SHIPPED: Clock · Participation · Location · MTF · Intermarket — five independent axes, all wired into the 8-voter/6-modulator Council and live-verified on GC (see The Council & orthogonal signal collection above). (A dedicated EventState seam beyond the existing news-lockout path remains open; breadth internals / microstructure / VIX are parked.)
8. ✅ DONE — the Bridge closed the loop. SentinelBridge (v0.2.0) consumes CouncilState (gate on HasEdge + Aligned, size SizeMult → GateEntry) and records the verdict to the SentinelCore.Ledger on every fire; LIVE-VALIDATED on a SIM GC short (fill captured, Slippage tab). The Eye→Council decouple also shipped (GTrader21 v0.1.7 UseCouncilGate).
9. 🔜 NEXT ACTIVE THREAD — validate the closed loop + start grading it. (a) LIVE-validate an overnight Bridge run (arm on SIM, confirm it fires/gates/records over a session, no naked positions); (b) Lens grading — run Lens over the Bridge/Excursion Ledger records to answer does conviction actually pay? and feed the answer back into the sensor weights / <inst>_COUNCIL_<dir>.conf; (c) build the Event/news veto axis — a dedicated EventState seam beyond the existing news-lockout path, fed from EconomicCalendar.py block_windows (freshness guard · equity-bias-not-for-gold · ET→session); (d) clear the pending SENTINEL_TEST_TRACKER.md safety proofs (items 1-5 above).

📚 Where the deeper detail lives

• Build rules & versioning policy: ../CONTRIBUTING.md
• GTrader21 full build history & lessons: memory/gtrader21-panel-integration.md
• Copier architecture & decisions: memory/copier-samples-analysis.md
• ~~Advanced suite build docs~~ · ~~Per-indicator/strategy quick reference~~ — ARCHIVED 2026-08-03 to Docs/_archive/ (AdvancedSuiteDocumentation.md, QuickReferenceGuide.md). Both were pre-Sentinel, v1.0, dated January 2026 and never updated. Superseded by the Suite Manual and the complete registry.
• Original Sentinel design transcripts: ~/Downloads/Sentinel_Project_*.txt