Production live autonomy

What “production live” means here

HISS is production-live as a compiler, fuse verifier, receipt layer, and paid x402 service surface. Every artifact on the Bankrbot × Robinhood path — command packs, instruction capsules, runbooks, receipts, audits — is a real, deterministic, hash-verified output. What HISS is not live as, by design: an order router. Live order placement, if you authorize it, happens outside HISS, through your Robinhood Agentic Account and your own Robinhood MCP connection.

The exact boundary

Robinhood’s Trading MCP exposes live-capable order tools: place_equity_order, cancel_equity_order, place_option_order, and cancel_option_order. These are Robinhood MCP tools. They are not HISS tools; HISS has no rail to call them, and every compiled instruction pack says so in as many words. The instruction pack also carries the full source-verified tool policy — 44 Robinhood MCP tools across account, watchlist, market-data, equities, options, and scanner groups — so your agent knows exactly which tools are read-only, which are review steps (review_equity_order, review_option_order), and which four are live-capable.

Before anything live: the acknowledgment

live_candidate compiles only after the nine-boolean LiveAutonomyAck — separate from mode selection, never inferable by an agent. It exists because of a fact Robinhood states plainly: if you have asked your agent to act without your approval, it can place trades without your confirmation. The acknowledgment makes you say that out loud, along with the loss-of-principal risk, your monitoring responsibility, your responsibility for the instructions you hand the agent, where orders will appear (your Agentic account Activity and Robinhood history), the long-equities-and-options-only scope, and options risk if options are ever in scope. The full object is specified in Autonomous trading safety.

During: fuses, in the loop

The compiled capsule instructs the agent to validate — before any live-capable Robinhood MCP order tool is used — HISS fuses, account permissions, supported asset class, tradability, notional limits, cadence limits, market-hours policy, stop conditions, and receipt logging. Fuses are binding constraints, not suggestions; a breached fuse is a stop condition.

After: receipts and post-run audits

Every compile writes a deterministic receipt with liveOrderSent: false hard-typed — no HISS artifact can claim an order happened. After any agent session, the reported activity goes back through the post-run audit, which checks each reported order against the receipt’s allowed tickers, per-order cap, and daily cap, and flags anything outside them. The audit verifies reports against fuses; it does not read your brokerage account and it never confirms an order occurred.

Your responsibilities, verbatim posture

• You are ultimately responsible for the trades your AI agent places.
• You are responsible for monitoring agents, account activity, and positions.
• Robinhood does not supervise or audit agents; neither does HISS.
• HISS does not store Robinhood credentials and does not send live orders from the web app.

Setup guide: Bankrbot × Robinhood MCP · consent model: Autonomous trading safety · machine-readable rules: /SKILL.md · /api/bankrbot/schema.