XRILL Trading Operating System

Next.js + Supabase port of the XRILL trading course product, originally a Python/Streamlit app.

This is the real, working build. It was pushed straight to Vercel via vercel deploy (no Git repo backing it), so it never existed anywhere else — not in this repo, not on this Mac — until it was pulled back down from the live deployment on 2026-09-08. If you also have ~/Desktop/XRILL/xrill-trading-os around, that was an earlier from-scratch scaffold built before this one was discovered; it's superseded by this folder and safe to delete.

What's actually built

• Full gate-flow wizard (components/XrillWizard.tsx): Daily Check-In → Trade Gate → Setup Score → Trade Plan → Risk Manager → Execution Check → Trade Score → Authorization
• Scoring/gating math (lib/xrill.ts) ported from the original Python (main.py, trade_score.py, account.py) — kept as the single source of truth so authorization is always recomputed server-side, never trusted from client input. Re-tooled for options buyers: the Trade Plan step no longer does futures point-value math — it's built around SPY/QQQ/single- stock CALL/PUT premiums (ticker, Call/Put, entry premium, a stop that's either a stop-loss premium or "full premium at risk" for 0DTE/scalps, and a target premium), with 1 contract = 100 shares baked into every dollar calculation. Risk Manager still dynamically caps contracts from your real account balance and risk % (lib/xrill.ts's evaluateRisk), and now warns inline on the Trade Plan step itself — before you even reach Risk Manager — if the contract count you entered exceeds what your risk settings allow.
• Setup Score is now five plain-language yes/no checks (trend alignment vs. 9/21 EMA, key level reaction, momentum/volume, news/event clear, 2x R:R) at 5 points each instead of 1–5 slider ratings — pass bar is 20/25. Inline (?) hints (components/Hint.tsx) explain jargon at the point of use (liquidity, "1 contract = 100 shares", waiting for candle closes) across the wizard for beginners.
• /dashboard — account balance/risk, last session, performance stats
• /session — runs the wizard, app/session/actions.ts saves the result
• /playbook, /account — supporting pages
• Supabase auth (app/login, lib/supabase/*, middleware.ts)
• Wired to the same xrill-trading Supabase project (schema: profiles, accounts, xrill_sessions, xrill_outcomes, leaderboard_stats view)
• /analytics — full analytics command center (lib/analytics.ts, ported from the original analytics.py): win rate, profit factor, expectancy, average R, equity curve, max drawdown, breakdowns by ticker/direction/ market session/setup type/score bucket, plan and exit-rule adherence, MFE/MAE, holding time — with client-side date/ticker/setup/direction filters, same as the original Streamlit "Analytics Command Center" tab
• /intelligence — trading profile (strongest/weakest gate, tiered observations, a recommendation) ported from the original CLI's xrill_intelligence() in main.py, plus an "XRILL Coach" mindset check-in (lib/coach.ts, ported from coach.py), plus a "🤖 XRILL Rejection Analysis" section (lib/rejection.ts, ported from xrill_rejection_analysis()) breaking down block reasons by category and surfacing the most common one with the same coaching message the CLI gave. None of these existed in working form anywhere before now — the Streamlit UI only had a placeholder ("Intelligence / Coach module will be connected next") and the real logic lived only in the old CLI, never wired into the web app.
• /journal — every XRILL session, newest first, with the trade plan and final decision (ported from xrill_session_history()), and — this is the important part — an actual UI to record the trade outcome (P/L, followed plan?, followed exit rules?, emotion, lesson) that was previously only possible from the CLI's menu option 22 (xrill_trade_outcome()). Before this, xrill_outcomes had zero rows in the live database and no code path anywhere in the web app ever wrote to it — /analytics's P&L, win rate, profit factor, and every other outcome-derived metric were reading a table nothing could populate. /journal is that missing write path, via a new server action (app/journal/actions.ts) and an xrill_outcomes.session_id unique constraint added directly in Supabase so each session's outcome can be saved and edited in place. Outcome recording is restricted to authorized sessions only (a blocked session was never executed, so there's nothing to journal), and the page has All/Authorized/Blocked filter tabs.
• /about — origin & philosophy, the 8-gate breakdown, an FAQ, a methodology-only performance-transparency section (no fabricated numbers — it points to your real /analytics and /intelligence instead), a quick-start guide, and a CFTC-style risk disclosure (a drafted starting point, not reviewed by counsel).
• Site-wide visual pass: a dark, glowing candlestick/data-terminal motif (components/visuals/CandlestickGlow.tsx), inline SVG (no external images, nothing to download) in the app's own color tokens. A dim, full-bleed version sits behind every page (TerminalBackdrop, mounted once in app/layout.tsx); a brighter version anchors the landing page hero; a compact banner variant sits behind the header on Dashboard, Analytics, and Intelligence.

Known issue to fix before relying on this in production

[email protected] has several disclosed vulnerabilities, including a middleware authorization bypass (GHSA-f82v-jwr5-mffw) — meaningful here since middleware.ts is what gates access to authenticated routes. Run npm audit for the full list. Upgrading to a patched Next 14.2.x point release (rather than jumping to Next 16, which would need retesting the auth flow) is the lower-risk fix.

Local development

npm install
npm run dev

.env.local is already present (gitignored) with the Supabase URL and publishable key for the xrill-trading project.