How Does kappi Seal, Score and Publish a Trade?

How is a trade sealed?

A trade command is encrypted on the trader's own device with drand time-release encryption before it reaches kappi, so while the capsule is sealed nobody can read it — not other traders, not bots, not kappi. It opens after a delay the trader chooses, between 1 hour and 30 days, released by a decentralised network rather than by kappi.

Two things follow from sealing on the device rather than on a server. Precedence is fixed at the moment of the commit, because the timestamp does not depend on anyone reading the contents. And there is nothing to leak in the meantime — a sealed capsule cannot be front-run, because there is no readable position inside it.

What makes the log tamper-evident?

Every trade command is appended to a tamper-evident log the moment it is received. kappi builds a Merkle tree of the new entries and publishes its single root hash to the public Hedera ledger. Anyone can check an exported log against those published hashes and confirm nothing was added, removed, re-ordered or back-dated — without trusting kappi.

The distinction that matters: this is not "kappi checked it and says it is fine". A reader takes the exported log, recomputes the Merkle root, and compares it with the hash already published on a ledger kappi does not control. If a single entry had been edited, added, reordered or back-dated after the fact, the recomputed root would not match. Verification that requires the platform's cooperation has only moved the trust problem one step.

What does the record actually contain?

The record keeps the exact message the trader wrote alongside the trade commands parsed from it. The parse powers the stats; the original words are what make the parse checkable, because anyone auditing the record can re-read what was actually said. A misread parse can be flagged and corrected on review; the original text never changes.

This is why the record is readable as evidence rather than only as statistics. A reader who doubts the parse can read the sentence the trader wrote and judge for themselves, which is a different and stronger property than a number nobody can trace back to its source.

When does a trade become public?

Only closed trades appear on a public profile or the community board. Open positions stay off both, even after the capsule has opened, so a live edge is never given away. A trade can stay open for up to 200 days; one that is never explicitly exited counts as closed at the 200-day mark, or at the option's expiry, whichever comes first.

Community-board figures are 30-day trailing. A trade that spans the edge of the window contributes only the part inside it, as though it were opened and closed at the window's edges. Displayed market pricing allows up to 60 seconds of time slippage against the moment the commit was received.

How is reward-to-risk computed?

R:R is reward divided by risk, read from entry, target and stop prices only and never from position size. A position whose worst case is knowable at entry gets a ratio. A bounded position left to run with no target reads as an open reward until it closes, and is then scored on its actual exit. A position whose loss has no floor at entry gets no ratio at all and is excluded from the figure rather than assigned an invented risk. The headline number is a median, so one outsized winner cannot move it.

How is position size read?

Size is read from the trader's own words and weighted as risk per trade, so a high-conviction trade moves the score more than a probe. The rules are the same for everyone.

Stated size	Weight (risk per trade)
Tester, Lotto, YOLO	0.5%
Light, Starter	1%
Medium, Normal (the default when size is not stated)	2%
Heavy, Going big	5%
All-in	10%

Adding to a position deploys more capital, so the weights sum: a normal entry plus a normal add is 4%, which reads as heavier than either alone. A dollar amount or a contract count reads as normal, because kappi never knows a trader's total capital and inventing a percentage from a contract count would be a guess presented as a measurement.

What is RME?

RME is net R kept divided by gross R risked: for every unit of risk put on the table, how much came back. It is shown as a percentile against the trader's own last 20 readings rather than as a raw ratio, so it grades a trader against their own norms. It reads from 11 closed trades onward; below that kappi says there is not enough to read instead of showing a number off one or two trades.

A percentile against your own history rather than against other traders is a deliberate choice. A low-win-rate, high-reward method and a high-win-rate scalping method produce incomparable raw ratios and identical percentiles when each is performing normally, so the number tracks form rather than style. Above 55% is strong form by the trader's own standard; below 15% is their worst recent stretch.

Where does the timestamping construction come from?

It predates cryptocurrency by nearly two decades. Haber and Stornetta published the method in the Journal of Cryptology in 1991: hash each document, link the hashes, and the date becomes unforgeable even by the service issuing it.^[1] The IETF standardised a signed-hash version in 2001 as RFC 3161, in which the timestamping authority signs only a hash and never sees the underlying data.^[2]

kappi's log is an application of that work rather than an invention on top of it, which is the honest way to describe it, and it is why the verification instructions above are checkable against a published standard rather than against kappi's own documentation.

All of the above is what $15 a month buys, with no free tier: unlimited sealed commits, a public profile computed from them, and a proof anyone can recheck without asking kappi for anything.