What Is a Time-Capsuled Trade Commit?

What problem does sealing solve?

Two problems that normally trade off against each other. Publishing a call in advance makes it checkable but gives away a live position. Keeping it private protects the position but leaves nothing anyone can check afterwards. Traders usually pick one and accept the cost of the other.

A seal separates the two halves. Precedence — the fact that you said something at a particular moment — is fixed immediately, because a timestamp does not require anyone to read the contents. Disclosure happens later, on a schedule you set. You get the evidentiary value of publishing in advance without the exposure of it.

How does the seal work?

A trade command is encrypted on the trader's own device with drand time-release encryption before it reaches kappi, so while the capsule is sealed nobody can read it — not other traders, not bots, not kappi. It opens after a delay the trader chooses, between 1 hour and 30 days, released by a decentralised network rather than by kappi.

The detail that matters is where the encryption happens. Sealing on the trader's own device before anything is transmitted means the platform never holds a readable position, so "kappi promises not to look" is not a promise anyone has to accept — there is nothing to look at. The release is performed by a decentralised network on a schedule, not by kappi deciding to open it.

What is actually recorded at the moment of the commit?

A sealed capsule, the time it was received, and enough structure to keep the log running. That is the whole visible footprint until the capsule opens.

The record keeps the exact message the trader wrote alongside the trade commands parsed from it. The parse powers the stats; the original words are what make the parse checkable, because anyone auditing the record can re-read what was actually said. A misread parse can be flagged and corrected on review; the original text never changes.

What stops the record being rewritten afterwards?

Every trade command is appended to a tamper-evident log the moment it is received. kappi builds a Merkle tree of the new entries and publishes its single root hash to the public Hedera ledger. Anyone can check an exported log against those published hashes and confirm nothing was added, removed, re-ordered or back-dated — without trusting kappi.

So the guarantee is not "kappi says nothing changed". A reader recomputes the Merkle root from the exported log and compares it against a hash that was published, roughly a minute after the commit, to a ledger kappi does not control. Any edit, deletion, reordering or back-dating changes the recomputed root and the comparison fails. Verification that needs the platform's cooperation has only relocated the trust problem.

How long can a capsule stay sealed?

Between 1 hour to 30 days, chosen per commit. The right delay depends on what you are protecting:

Delay	What it suits
1 hour	Intraday calls, where the edge is gone by the close anyway
1 day	Overnight and next-session positions
1 week	Swing positions still working
30 days	A thesis you intend to hold, or a level you do not want crowded

A longer delay does not make the record stronger. The timestamp is fixed at the commit either way, so the delay is purely a decision about when the position stops being yours alone.

What happens once it opens?

Only closed trades appear on a public profile or the community board. Open positions stay off both, even after the capsule has opened, so a live edge is never given away. A trade can stay open for up to 200 days; one that is never explicitly exited counts as closed at the 200-day mark, or at the option's expiry, whichever comes first.

Community-board figures are 30-day trailing. A trade that spans the edge of the window contributes only the part inside it, as though it were opened and closed at the window's edges. Displayed market pricing allows up to 60 seconds of time slippage against the moment the commit was received.

What does a commit look like in practice?

You write the trade the way you would write it to a friend — the symbol, the direction, the price, the stop and the target — and the extension commits it. A position entered at 4.50 with a stop at 4.00 and a target at 5.50 carries an R:R of 2.0, because it risks 0.50 to make 1.00. That ratio is read from the three prices and never from position size, so it describes the plan rather than the stake.

What you cannot do afterwards is move the stop in the record. You can move it in the market, since it is your money. But the commit keeps saying 4.00, and the difference between what you committed to and what you did is the thing the record is actually measuring.

Is this a new idea?

The mechanism is not. Haber and Stornetta set out how to time-stamp a digital document in 1991, proposing that documents be hashed and the hashes linked so that a timestamp cannot be forged even by the service issuing it^[1] — the paper that later became the structural basis for hash-linked ledgers generally. The IETF standardised a version of it in 2001 as RFC 3161, in which a timestamping authority signs only a hash of the data, never the data itself.^[2]

That last detail is exactly the property a trader needs. Proving a document existed at a time has never required showing anyone what the document says, and a time-capsuled commit is that thirty-year-old idea applied to a position rather than a contract.

The other half of the idea is equally established. The CFA Institute's Global Investment Performance Standards require fair representation and full disclosure, with performance shown across every portfolio in a composite rather than the accounts that worked.^[3] A sealed commit supplies the timing; committing all of them supplies the completeness.

kappi is a trade recorder: you commit a trade before the fact, it is sealed on your device for a time-capsuled delay you choose, then kappi publishes it on a Merkle-anchored log. The record is yours to share, with whoever you choose. $15/month, no free tier.