The console is the MIKODES Admin Kit 0.6.0 (in packages/admin-kit/, wired in server/admin-kit/) with PIT's own pages inside it. It is off until ADMIN_SECRET_KEY is set. It never touches a trading key or an order.
Overview: net revenue (realised, 30 days), active members, signed-in users, agents waiting for review, model decisions, paper entrants running, viewers online, and a Needs you list of failing checks. Get started: the few setup fields (product name, accent colour) and the blockers; finishing setup is refused while a blocker fails. ⌘K / Ctrl+K jumps to any page, setting or action.
| Page | What you set |
|---|---|
| Brand | Product name, tagline, accent colour (#rrggbb; empty = the design's ultramarine) |
| Legal | The disclaimer in the public footer. The built-in "Not investment advice" line always stays. |
| Page | What it does |
|---|---|
| Builder fee | On/off (off by default), Hyperliquid builder address, fee in tenths of a basis point (hard cap 100 = 0.1 %) |
| Membership & payments | Stripe on/off, USDC on/off, USDC receiver, chain id (default 8453, Base), token contract, confirmations, free-tier delay, the Telegram alert bot on/off and its username. All off by default. |
| Plans & members | Create plans (price per period, features); the Stripe webhook address to paste into Stripe; grant a membership by handle (comp or bank transfer). |
| Sponsors | Sponsor slots on an entrant, a season or a banner, always labelled "Sponsored"; aggregate impressions and clicks only. |
| Income ledger | Record income that arrived outside PIT (sponsor invoices, other). Revenue reads it. |
| Affiliate links | Exchange referral links with a disclosure, hidden per country. |
These edit arena.config.json (every save is a version you can roll back). Switching to mainnet, turning Ride on and the server kill switch ask you to type a confirmation word.
| Page | What it does |
|---|---|
| Paper league | On/off, pause, decision interval, starting balance, trades before ranking, simulated taker fee and slippage, daily LLM budget with today's estimate and pacing, variants, price table. |
| Season | Id, name, start and end (UTC), network (type MAINNET to confirm), coins from the live Hyperliquid list, decision interval, risk limits. Start a new season archives the current one. |
| Competitors | Add, remove, reorder, enable; name, provider and model id, colour, Hyperliquid account (checked live), public style prompt, leverage and interval overrides. |
| Model settings | Per provider: base URL (gateway), timeout, max output tokens, temperature. |
| Prompts | Trading and forecast templates with {{variables}}, previewed with live data (variables). |
| Prediction league | Refresh, forecast now, selection rules, pin or exclude a market. |
| Ride | On/off (type ENABLE), blocked countries, rider limits and starting values. Shows when an environment variable overrides it. |
| Operator & runner | Generate a new operator token (owner only, shown once), last heartbeat per competitor, and the server kill switch (type STOP). |
| Page | What it does |
|---|---|
| Site & SEO | Headline (up to 3 lines of 60 characters), SEO title and description, share image, default theme, announcement banner and its tone. |
| Community | Sign-in, picks and duels, points, rules for user agents and the models they may use. |
| Users | Signed-in users (handles, shortened addresses). |
| Agent moderation | Review, approve, reject, pause or retire user agents. |
| Site links | Footer and social links. |
| Page | What it does |
|---|---|
| Integrations | Model keys, Stripe secret key and webhook secret, Telegram bot token, USDC RPC URL. Write-only, AES-256-GCM encrypted with ADMIN_SECRET_KEY, with Test connection. A key in the environment wins and locks the field. |
| Security & alerts | Two-factor (authenticator app, 8 recovery codes), sessions, and the owner's switch to require two-factor. |
| Export / Import | Download settings; import with a preview of every change (anything over a cap is refused). |
| Arena config history | Every saved version of arena.config.json, hand edits included: compare, roll back. |
| Revenue | Realised money only, each event with its reference: Stripe and USDC memberships, sponsor and other recorded income, Hyperliquid builder rewards. CSV. Nothing estimated. |
| Status | Blockers: a model key; builder fee valid if on; Stripe and USDC complete if on; Ride has blocked countries if on. Warnings: live Hyperliquid prices for the paper league, Telegram alerts on with a bot token, PIT_SECRET set, PUBLIC_URL set (and https:// in production; see Deployment).
Info: operator token, Polymarket answers (when the prediction league is on), every key is in Integrations. |
| Audit log, History, Team | Append-only log of every change (addresses masked, secrets never recorded); console settings versions with rollback; people and roles. |
| Role | Can |
|---|---|
| Owner | Everything, including secrets, import, rollback, the operator token and the team. The last owner cannot be removed. |
| Manager | Settings and PIT's pages; not secrets or the team. |
| Viewer | Reads. |
Opening /admin while signed out shows the sign-in form (or, before an owner exists, the setup form: the one-time ADMIN_SETUP_TOKEN from .env, or the setup code from the server log when no token is set; setup is refused without one and closed once the owner exists).
Passwords of 12+ characters; sign-in locks for 15 minutes after 5 failures for one email; sessions last 12 hours in an httpOnly, SameSite=Strict cookie. The Operator & runner page is shown to managers and owners; generating a new operator token is owner only.
The console's Docs link appears only when you set PIT_DOCS_URL (how).