Shariah Compliance Engine Features — keel
This page describes only what the engine repository can show. Each section links to the source that proves it — if a claim ever drifts from the code, the link is how you catch us.
Attested asset screening — fails closed
Admission to the allowlist is split by what is knowable. Market facts are computed. Shariah classifications — is the core purpose a haram sector, is the token asset-backed 'ayn or a claim dayn, does it pay a riba-like yield — are attested, never inferred, via keel assets attest. An absent attestation is a rejection, not a default pass.
Verify in the repository: compliance/screen.py
The rails — eighteen checks no order can skip
Deterministic guards that nothing can override, not even autonomy mode:
- The halal allowlist, per-order and per-day spend caps, exposure and concentration caps
- Correlation-aware sizing, a minimum-move floor, no-martingale and no-stop-widening
- Total and weekly drawdown breakers, a consecutive-loss/edge-decay breaker
- Feed-staleness and quote-balance checks
- Rail 14 — venue subscription/withdrawal attestations: live BUYs are refused until the operator attests
- Rail 17 — §65.4 qabd: withdrawal capability is attested and enforced, because an asset that cannot be withdrawn may not have been validly possessed
- A max-spread entry gate that refuses live BUYs at or beyond 50bp spread, fail-closed on an unreadable book
- A rail veto names itself and the command that clears it
Verify in the repository: execution/guards.py
Strategy gates — candidate → paper → live
A rule must walk three stages before it can touch live money. Promotion clears a two-part gate: performance floors and an overfitting check (PBO/CSCV). The 100-trade sample floor may be met by the rule's own backtest or pooled across products in paper — provided at least five products each contribute ten trades, because a pool of correlated samples overstates its power.
Verify in the repository: agent.py — RULE_REGISTRY
Honest measurement, against DCA
keel simulate replays the real rules over fetched history, compares against a simple DCA benchmark, and writes a GO-LIVE / TRAIN-MORE report naming every gate and its numbers. The backtester prices per-product slippage scaled from each asset's real liquidity (5–50bp), so results cannot be flattered by thin books. On the default rules it will very likely tell you TRAIN MORE — that is the engine working, not broken.
Verify in the repository: the experiment record
Three deployment profiles that share nothing
Daily paper, live, and an hourly evidence profile (paper-hourly) — each with its own database and config. The hourly profile exists because the daily clock measures 2.15 signals per asset-year (a 100-trade review 31–84 years away), while the same rules on ONE_HOUR bars fire 49.4 — about 940 entry signals per year pooled, putting forward-evidence review weeks away instead of decades. It is measured net-negative too: it exists to collect admissible forward evidence, not profit.
Verify in the repository: operator runbook
A broker port, not a broker lock-in
Adapters implement one contract — the keel-broker-api port — and register under the keel.brokers entry point. Coinbase Advanced Trade is the reference adapter; Robinhood ships as an optional, deliberately unwired venue; an Alpaca adapter joined in v0.10.0. A deliberately divergent fake venue keeps the port honest: the conformance suite (~3,000 tests) runs against both.
Verify in the repository: packages/
Confirm by default; autonomy changes who is asked
keel previews each order and asks at the terminal; headless, it declines. keel autonomy on changes who is asked, never what is allowed. To stop trading, keel kill — the kill-switch fails closed.
Verify in the repository: the README, 'How keel works'
keel ships inert
Nothing trades until you promote a rule, attest the venue subscription, fund the account, and — in confirm mode — type y. Long-only spot only: no leverage, no shorting, no derivatives, and sizing uses actual cash, so no riba.
Account-level obligations no rail can see (disabling USDC rewards on idle balances, chiefly) are the operator's to verify — the operator runbook lists them.