Controlled Production Pilot

Production access begins as a controlled pilot, not an unrestricted launch. MyStocks and the partner agree the permitted customers, transaction values, daily volume, enabled capabilities, operational ownership, and incident escalation path before the first live mutation.

MyStocks also enforces a platform-wide enrollment cap (three partners by default) so the pilot cannot silently expand into general availability.

Admission and fail-closed behavior

MyStocks configures the pilot against the production partner credential. Read-only reporting remains available while a pilot is paused, but customer creation, funding, trading, and withdrawals require all of the following:

• Pilot status is APPROVED.
• The relevant feature flag is enabled.
• A named MyStocks operational owner and a 24/7 money/order incident contact are recorded.
• Per-customer, per-transaction, and partner daily limits are configured and not exhausted.
• Daily reconciliation is current and, when exception blocking is enabled, BALANCED.
• The production key is active. Suspending the key blocks all requests immediately.

Pilot restrictions return PILOT_RESTRICTED (403). Exhausted limits return PILOT_LIMIT_EXCEEDED (429). Do not automatically retry either response. Escalate through the named operational contact.

Treasury boundary

Partners perform their own customer KYC and collect or pay customer money through their own rails. POST /users/{userId}/deposit and POST /users/{userId}/withdraw allocate funds between the partner master wallet and its beneficial-owner sub-ledgers; they do not move money through a customer payment rail.

Money entering or leaving the MyStocks master wallet uses POST /topup or POST /payout. Both create a PENDING request and always require MyStocks treasury review. The pilot policy cannot disable this manual-review requirement.

Daily operating sequence

1. Export GET /report/reconciliation?asOf=YYYY-MM-DD and the required CSV sections.
2. Confirm the cash roll-forward, beneficial-owner securities ledger, unsettled orders, fees, and custody proof.
3. MyStocks operations records BALANCED, EXCEPTIONS, or INCOMPLETE with an HTTPS evidence link.
4. Resolve money or order discrepancies through the 24/7 incident contact. Mutations remain paused when reconciliation is overdue or exception blocking is active.
5. Review daily customer and partner usage against the agreed limits before enabling the next operating day.

Emergency controls

MyStocks operations can independently disable customer onboarding, funding, trading, or withdrawals. Disabling new trading does not prevent risk-reducing order cancellation. A pilot pause blocks new mutations while preserving read-only reconciliation access. Full key suspension is the immediate kill switch and blocks every API request.

Partners must retain polling and webhook evidence for every order, ledger allocation, and reconciliation exception throughout the pilot.