I swapped the model and nothing happened

A couple of months ago, the last time the model behind Trader-7 changed, it took me the better part of a week and a string of separate fixes to work out what had gone wrong.

This week I changed it again with one environment variable, watched it boot, and the system carried on trading. Nothing broke. That is the whole story, and the fact that it is a boring story is the point.

What actually changed

Over the last two and a bit weeks I moved the two Claude models that make Trader-7's decisions from Opus 4.7 to Opus 4.8. The strategist that reads the market and sets a stance, and the risk manager that vets every proposal before it can become a trade. The signal generator stayed on DeepSeek, the data processor on Gemini. Two brains swapped, in a system that trades three coins on a paper account without me watching it.

Here is why the boring version matters. Last time I upgraded these same models, OpenRouter quietly resolved a generic model name to a cheaper, older version than the one I had asked for. The system ran for days on the wrong model before the cost line stopped adding up and I noticed. The lesson I wrote down then was blunt: never trust a model name that is not pinned to an exact dated version, and never flip a model without proof it behaves the same.

Building the proof first

So this time the proof came before the switch.

There is a harness in the repo now that taps every live model call and writes the prompt and the response to disk. Turn it on, leave it running, and you collect real production prompts. Then, offline, you replay those prompts through the candidate model and compare the two side by side.

I replayed 78 real strategist prompts through Opus 4.8. The JSON parse-fail rate came back at zero, same as 4.7. Cost sat in the same tier, about half a cent a call more. Confidence was a fraction lower, which for a risk model is not the wrong direction.

None of that tells me 4.8 is smarter. The harness cannot measure smarter. What it can do is rule out a regression, and it did. That is the honest justification for the upgrade: stay on the current model, and rule out the surprises before they cost anything, rather than after. I would rather write that plainly than pretend I found an edge.

The flip

The switch itself was two steps. First a small code change to register the new model's price, so cost tracking does not silently log every call at zero. Then two environment variables and a restart.

I watched the logs come back up. Both models routing to the exact dated version I had pinned. Cost coming through correctly. No mismatch warning. It kept trading through the swap.

What else landed

The model swap was the headline, but it was not the only thing that shipped in this window.

Security came first. An audit turned up API keys that had been committed into the repo's history. The repo is private and stays private, so the real exposure was small. But a secret in git is a secret in the wrong place regardless of who can see it, so I cleaned it up properly: rotated the keys, scrubbed the history, and added an automated scanner that blocks any future commit carrying a detectable secret. I also added a filter that cleans external news and market text before it reaches the model, so a headline cannot smuggle instructions into the trading prompt.

Then the signal-quality work. The model that generates entry signals is unreliable at price arithmetic. Every so often it emits a stop or a take-profit that is nonsense: a target at twice the entry, or a placeholder that resolves to a negative price. Two guards catch that now. One clamps an impossible target and holds the trade. The other rebuilds the stop and target from volatility when the model's own numbers are broken, so a genuinely good signal with bad arithmetic still becomes a valid trade instead of being binned.

That second guard earned its place this week. The signal model tried to short all three coins at once with take-profits at 199% of entry, which on a short is a negative price. The clamp held all three. Nothing bad reached the book.

And the kill switch. The emergency-stop buttons on the dashboard and in Telegram used to report success and do nothing, because they wrote a status flag the trading loop never read. Now they actually halt it. I also closed the issue register down to zero: every open bug and follow-up is fixed or deliberately parked with the reason written down.

How it is doing

The paper account is up around $1,234 across 212 closed trades, a 37.3% win rate. XRP is still the best of the three at plus $737. Per-trade Sharpe is roughly 0.12, which is thin, and I will say so.

The market has been rangebound for a week, Bitcoin pinned to its 50-day average, and the system has traded accordingly: selective, one or two positions at a time, refusing to force entries into a directionless tape. This afternoon it rode an Ethereum long to a $64 gain and then sat on its hands. Right behaviour, even if it is not a thrilling one.

Where things stand

The thing I keep relearning with this system is that the interesting work is the work that makes changes boring. A model swap on a live autonomous system should be frightening. It was not, because the verification came first: pin the version, replay real prompts, prove no regression, flip a variable, watch it boot.

One position open, an XRP long. Register at zero. Both brains on the current model, and the account still ahead. Nothing happened, and it took a fortnight of work to get there.