How Decrypt OS works

What it is

Decrypt OS is built on Arch Linux with the Omarchy (Hyprland) desktop. It is not an official Omarchy distribution. It bundles the tools to run automated trading strategies in one place: the Decrypt app, the strategy engines, the Tradovate bridge and a local ICT assistant.

The idea is a dedicated, repeatable environment instead of running bots on your everyday computer. The image you download is the whole machine. If something goes wrong, you import a fresh copy.

FOR

Traders who already use TradingView strategies and a Tradovate account, and want the alerts executed from a separate machine they control.

NOT FOR

Funded or live accounts. The engines are not qualified for them in this beta. Use Simulation or demo.

COST AND LICENSE

Free software under the GNU AGPL-3.0. Source on GitHub. Strategies are separate invite-only TradingView scripts, not part of the image.

How it runs

Decrypt OS is a Linux desktop inside a virtual machine (VM). The VM runs on an Apple Silicon Mac with UTM, or on a 64-bit Windows, Intel or AMD PC with VirtualBox, VMware or QEMU/KVM. Your everyday system keeps running next to it; the trading setup lives inside the VM.

• The VM needs 4 CPU cores, 8 GB of memory and about 45 GB of free disk space. The computer itself needs more than 8 GB of memory in total.
• Nothing is signed in and no trading or broker connection is active until you set it up in the Decrypt app.
• Intel Macs and physical installs (without a VM) have not been tested. The .vmdk for VirtualBox and VMware has not been boot-tested yet; if it does not start, use the .qcow2 with QEMU/KVM.

Requirements, downloads and the verification steps are on the download page.

The five workspaces

The desktop has five numbered workspaces. Click the number in the top bar, or press Super+1 to Super+5, to switch.

1. 1Decrypt OS appSetup, status, connections, strategy access, engines and system care. Start here; the Home page shows your next step.
2. 2TradingYour engine and your TradingView chart.
3. 3Tradovate bridgeThe Tradovate login window and bridge status. You sign in here yourself.
4. 4ICT assistantA mentor for Inner Circle Trader concepts, on your own Claude account.
5. 5Bridge AdvancedPause, resume, flatten, add logins. This is where you resume entries.

The trade path

One alert, five steps. The strategy runs on TradingView; Decrypt OS receives its alert, checks it, and places the order in your own Tradovate account through the bridge's browser session.

1. Your strategy fires an alertYour TradingView strategy decides to enter. Its alert carries the whole plan: size, stop, take-profits, break-even, runner, end of day, daily loss lock and touch entry.TRADINGVIEW · YOUR ACCOUNT
2. The bridge receives itThe alert arrives at your private alert address and is handed to the bridge.DECRYPT OS · WORKSPACE 3
3. The engine checks itSafety checks only, listed below. Anything unknown fails closed: no order.DECRYPT OS · MATCHING ENGINE
4. The order goes to TradovateThe bridge drives your own Tradovate web session, in its own browser window, and waits for the broker to confirm.TRADOVATE · YOUR ACCOUNT
5. Exits run as the alert saysStop, take-profits, break-even, runner and end of day follow the alert. A feature the alert switches off does nothing.DECRYPT OS · BRIDGE

The strategy owns every trading rule. The bridge only executes. It has no contract cap, filter, time window or trade logic of its own: the strategy alert sets the size, and the strategy decides everything else.

What the checks are

• Strict format and identity of the alert
• Entry freshness
• The right account and contract
• A fresh account reading
• A flat account before a new entry
• A positive whole-number size
• Exits that never exceed the open position
• No opposite position in your other accounts (anti-hedge)
• Broker confirmation
• The kill switch

The checks add safety. They do not add trading decisions.

Entries start paused

New entries are paused after every setup and every restart. Nothing trades until you resume entries in Bridge Advanced (workspace 5) and your strategy alert is set up in TradingView. Resume only when you are ready.

Strategies

Decrypt's strategies are invite-only TradingView scripts. They are not in the image. You request access from the app's Strategy access page, which sends your TradingView username to Decrypt Labs. Access is added to that username by hand, so allow some time. Then look in TradingView under Indicators → Invite-only scripts.

The engines in this beta

Seven engines, with the status the app's catalog shows today. Only Turtle Soup Shift has run with live alerts; the other six have not, so expect problems and use Simulation only.

• Turtle Soup Shift is installed from the app. The other engines are set up with the bridge's terminal setup command, which the getting started guide walks through.
• Follower accounts copy Soup trades only. Another engine trades its own account only.
• Contracts do not roll over by themselves. Near a roll date, set up the engine again for the next dated contract.

Your accounts and keys

Decrypt OS needs no registration. It uses three accounts that are yours, each only when you choose to connect it.

TRADINGVIEW

Charts, strategies and alerts. The Guardian saves your TradingView sign-in, encrypted, and can recover an expired session with your permission.

TRADOVATE

You sign in yourself on workspace 3 and choose Access Simulation. The browser saves the login, encrypted by your desktop keyring. Decrypt OS never sees your Tradovate password.

CLAUDE

Your own Claude subscription (Pro or Max) or an Anthropic API key, for the assistants. You paste the setup token or key into a terminal on workspace 4, never into a chat.

Logins stay on your machine. The Decrypt app keeps its own encrypted storage for assistant sign-ins and saved logins. The VM's disk itself is not encrypted. Captcha and two-factor prompts need you; finish them in the Tradovate or TradingView window.

The ICT assistant

Workspace 4 holds a mentor for Inner Circle Trader concepts. It runs on your own Claude account, through the setup token or API key you provide. It is there to help you learn and to manage and monitor your setup. It is separate from the trade path above.

Safety and privacy

KILL SWITCH

Fail-closed. Entries are off until you resume them, after every setup and every restart. Pause or flatten any time from Bridge Advanced.

ANTI-HEDGE

No new entry while there is an opposite position in your other accounts.

FAIL-CLOSED CHECKS

Strict format and identity, freshness, size and position conservation, broker confirmation. Anything unknown means no order.

LOOPBACK ONLY

The app and the bridge listen on the machine itself. Alert intake uses a private, instance-specific token through your own HTTPS origin.

SIGNED DOWNLOADS

Each release is signed. The download folder has checksums, a signed manifest and the public key. Verify before you import.

OPEN SOURCE

GNU AGPL-3.0. If you distribute a modified version, or run one as a service for other people, you must publish your changes under the same license. SECURITY.md covers vulnerability reports.

Privacy

The only thing Decrypt OS sends to Decrypt Labs by itself is a strategy access request, and only when you send one: your TradingView username as typed, an optional contact method if you give one, the strategies you picked, the time, and whether it was sent. The request keeps a salted hash of its source IP for rate limiting only; the raw address is not stored, and the hash is not used to identify or track you and is not shared. It does not include your account numbers, broker credentials or machine identifiers. Full note: PRIVACY.md.

What is coming

No dates, and no promises about results. Each item says what is true today.

• More engines installable from the appOnly Turtle Soup Shift installs from the app; the others use the bridge's setup command.
• In-place updatesA new version comes as a new image. You import it as a new VM and set it up again, including your sign-ins.
• A VirtualBox and VMware boot-verified PC imageThe .vmdk has not been boot-tested in VirtualBox or VMware. The x86_64 .qcow2 with QEMU/KVM is the fallback.
• Lumi RTH Gap tested against a live broker feedIts 1-second MES feed has not been tested against a real broker connection.
• Order Blocks Decoded with a public TradingView pageA research build, paper only, with no public TradingView page, so access cannot be requested.
• A native install, without a VM, for a dedicated trading PCA direction we are looking at. Physical installs are untested; use the VM.
• More strategies over timeSeven engines in the catalog, at the stages listed above.

The current list of known issues is in the release notes.

Next steps

Feedback goes through GitHub Issues, with templates for a bug report, feedback and a strategy access problem. Never post account numbers, tokens, passwords or your private alert address.