How Ping is built, and how to check it

What Ping can and cannot do, what leaves your computer, and the commands that prove it.

Ping is a desktop program that watches Kalshi and paper-trades on your own computer. Before you run anything that touches an exchange key, you should be able to check what it does rather than take our word for it. Here is how Ping is built, what it can and cannot do, and how to verify each claim yourself.

What it is

  • A small web app written in Python that runs at 127.0.0.1 on your machine and opens in your browser. Nothing on your network can connect to it, and it has no login because it never listens outside your computer.
  • It reads Kalshi prices, order books, the trade tape and settlements with your own API key, and simulates resting orders under the lab's rules. This version has no code that can place, change or cancel a real order.
  • Strategies are plain text files you can read, copy and edit. The built-in ones are the lab's own, with their records.

What leaves your computer

  1. Kalshi. Read-only requests and a price stream, signed with your key, straight to kalshi.com. Ping refuses any other Kalshi host unless you change the config yourself.
  2. pondletter.com, once a day. Your member key, a random install id and the version number, so your copy knows your membership is still active. Nothing about your trades, strategies or Kalshi account is sent.
  3. Your AI provider, only if you add your own key. The strategy helper sends your request to Anthropic or OpenAI directly. Without a key, that code never runs.

There is no analytics, no crash reporting and no third-party script.

Where your keys live

Your Kalshi key ID, private key and member key go into the system keychain (Keychain on Mac, Credential Manager on Windows, Secret Service on Linux) under the name pondletter-ping. If the keychain is unavailable, they go into an owner-only file in ~/.ping. They are never written to the database, the config file or a log, and the interface never displays them again after you paste them.

How the install is checked

  • The installer is a short script you can read before running: ping-install.sh and ping-install.ps1. It uses no administrator rights and writes only inside your home folder.
  • It downloads Ping as a Python wheel and verifies the SHA-256 against the published checksum list before anything is installed. A mismatch stops the install.
  • Members get a personal download token tied to their account; the download itself is not a public link.
  • Ping is not signed with Apple or Microsoft certificates. Those cost money every year and prove only who paid; the checksum and the readable code prove what the program is. Windows may show a SmartScreen notice on first launch; Mac does not, because the launcher is a script that runs the installed Python.

Check it yourself

After installing, the code sits in a normal folder (on Mac and Linux, ~/.local/share/uv/tools/ping/lib/python3.12/site-packages/ping/). Two searches tell you most of what matters:

grep -rn "portfolio/orders" .        # prints nothing: no order endpoint exists in the app
grep -rn "\.post(" . --include=*.py  # exactly two lines: the daily member check, and the optional AI helper

Open kalshi/client.py to see the whole Kalshi client: GET requests and one websocket, nothing else. Open membership.py to see exactly what the daily check sends.

Your own rules

Members can add rule files of their own. Those are the member's code, running on the member's computer with the same access as any script they would run; Ping loads them from a folder the member controls and never downloads rule code from anywhere. A rule can return a paper bid or nothing. There is no order-sending code in the app for it to reach.

What the paper engine does and does not claim

Paper fills are counted only when the market trades through your price, not when it merely touches it. That is stricter than most backtests and is the reason the lab's paper numbers have tracked its real-money numbers. Paper is still paper: no queue position, no partial fills, no outages. Ping shows both counts so you can see the gap.

What about live orders?

Not in this version, and not by accident. A live version is the next build, after the paper beta has run for a month. It will unlock per strategy only after a paper record, start at one contract, carry a daily loss limit and a kill switch, and reconcile every fill against Kalshi rather than its own ledger. The code that sends orders will be as readable as the code that reads prices is today. Members on paper now get it first.

Questions

Write to hello@mg.pondletter.com. The public demo on sample data is at Trading bot; the members' install page is at Install Ping.