what changed

three independent audits — from a hackathon judge perspective, a code auditor perspective, and an investor perspective — flagged the same set of issues. we fixed them all in one push.

SDK data now survives restarts

the Parasol Agent SDK previously stored API keys and agent state in memory. that means every time a serverless function cold-started on Vercel (or a Railway container restarted), all SDK-created agents, their portfolios, and their API keys vanished.

this was fine during development. it's not fine when external developers are building on your SDK.

both lib/sdk/auth.ts and lib/sdk/agents.ts now use a write-through cache pattern:

in-memory Map for fast lookups on the hot path

Supabase persistence on every mutation (key creation, agent creation, trade execution, updates)

lazy load from database on first access after a cold start

cache-miss fallback — if a key isn't in memory, we check Supabase before rejecting it

this means API keys created on one server instance are valid on another. agents don't lose their portfolios. trade history persists. if Supabase isn't configured (local dev), it falls back to in-memory-only automatically.

the existing database schema already had the tables (api_keys, sdk_agents, sdk_trades) from migration 002. they were just sitting there unused. now they work.

55 new tests covering the code that matters most

the audit identified that the highest-value functions in the codebase — the ones that decide whether a trade happens and how large it is — had zero test coverage.

we added two test suites:

risk manager tests (26 tests in lib/risk/__tests__/manager.test.ts):

checkKillSwitch — verifies the daily loss and drawdown kill switches trigger at the correct thresholds and stay triggered once active

checkTradeAllowed — tests every gate: kill switch, max positions, daily P&L, duplicate tokens, cash reserve, consecutive loss cooldowns

calculatePortfolioHeat — verifies the aggregate risk calculation across empty portfolios, single positions, and multiple positions with different stop distances

calculatePositionSize — confirms risk-based sizing respects stop loss distance, caps at available balance, and returns zero below the $10 minimum

updateDriftDetection — tests concept drift: insufficient data returns no signal, a sustained win rate drop triggers drift mode (60% position reduction, +0.05 composite score threshold), and recovery when win rate normalizes

checkCashReserve — verifies the cash buffer requirement blocks trades when reserves are low

SDK route tests (29 tests in app/api/sdk/__tests__/sdk-routes.test.ts):

key generation with correct format, environment prefix, custom permissions, expiration

key validation including Bearer prefix handling, expired keys, revoked keys

permission enforcement — a key with only agent:read cannot call trade:execute

full agent CRUD lifecycle: create, retrieve, list, update, delete, with wrong-apiKeyId rejection on every operation

response formatting to verify internal fields don't leak through the public API

every test uses mock objects with no external dependencies. npm test runs the full 129-test suite in under 500ms.

MCP server consistency fixes

two small but important corrections:

1. the startup log now lists all 10 registered tools, including parasol_token_intelligence which was missing from the logged output

2. the fatal error message for missing Supabase credentials now references SUPABASE_SERVICE_ROLE_KEY (the actual env var name) instead of the old SUPABASE_SERVICE_KEY

these don't change behavior — the tools and auth were already working. but inconsistent logs and error messages erode trust in production systems.

all SDK routes updated for async

the persistence changes made generateApiKey, validateApiKey, authenticateRequest, createAgent, updateAgent, and deleteAgent async. all 8 SDK API routes were updated to await them. TypeScript caught every callsite at compile time — no runtime surprises.

what this means

the SDK is now production-grade for external developers. API keys persist across deployments. agent state survives cold starts. the risk management system — the code that prevents catastrophic losses — has test coverage. and the full suite passes through the pre-commit hook, so nothing ships without a clean typecheck and test run.

total test count across the project: 129, covering risk management, trading execution, technical analysis, safe trade checks, agent personality selection, and SDK operations. all pass in under 500ms.