Modes

Axon has three operating modes. Pick deliberately — each has a different risk profile.

Mode	Chain	Venue	Risk
Demo	None (synthetic)	Simulated fills	None — fake everything
Testnet	Arbitrum Sepolia (421614)	Hyperliquid testnet	Fake money, real signing
Live	Arbitrum One (42161)	Hyperliquid mainnet	Real money

Demo

The default on first run. No real chain calls, no venue connections, no API keys needed.

• Synthetic positions and balances (state survives the daemon's lifetime, reset on restart)
• Simulated fills with realistic slippage + fees
• All ~35 MCP tools work end-to-end against the simulated state
• Useful for: agent development, dashboard demos, testing strategy logic

Demo is the safest place to validate that your agent does what you expect before any money is involved.

Testnet

Real signing on Arbitrum Sepolia + Hyperliquid testnet. Fake money, real flow.

• Real EIP-712 signing through the keystore
• Real RPC calls to Arbitrum Sepolia
• Real Hyperliquid testnet builder fees, agent keys, etc.
• Bridge testnet USDC in via the dashboard

This is the rehearsal mode — proves your end-to-end setup works (RPC, builder approval, agent runtime, MCP tools) before you switch to mainnet.

Live

Real Arbitrum One + Hyperliquid mainnet. Real money. Read docs/security-model.md first.

• Same flow as testnet, but on production chains
• Builder fee + referral revenue accrue to the configured master account
• Audit log captures every signed intent, fill, and policy change

Switching modes

Via the dashboard

Settings → Mode has three cards. Click "Switch to …" — the dashboard writes a mode latch to ~/.axon/mode.json and calls POST /v1/service/restart. The daemon:

1. Stops cleanly (releases venue connections, flushes audit DB)
2. Re-reads the latch on boot
3. Starts in the new mode
4. Dashboard reconnects via /v1/session/refresh and shows the new mode in the header

The whole flip takes ~3-5 seconds.

Via the CLI

axon --live        # boot in live mode (one-off; doesn't update latch)
axon --demo        # explicit demo mode

Explicit CLI flags don't update the persistent latch — they're for one-off runs (CI, scripted demos). The dashboard's mode switcher is the canonical way to flip your default mode.

Latch precedence

The daemon resolves mode in this order on each boot:

1. Explicit CLI flag (--live / --demo) wins
2. Mode latch at ~/.axon/mode.json (set by the dashboard)
3. Default: demo (safe fallback)

Mode switches are persistent

After switching to live via the dashboard, every subsequent axon (or desktop launch) starts in live mode automatically. To reset, switch back to demo via the dashboard or delete ~/.axon/mode.json.

Per-mode storage

Some state is mode-scoped, some isn't:

• Keystore — single keystore, all modes
• Audit log — single hash chain, all modes (each row tagged with mode)
• Policy — single policy, applies to every mode
• HL agent key — separate keys per testnet/mainnet (auto-managed)
• Strategies — installed strategies are shared; their execution state is mode-scoped

So your live-mode positions are isolated from your testnet positions, but your audit log unifies everything for tamper-evidence.

Safety rails

Even in live mode, several rails protect you:

• Policy engine — daily notional cap, max leverage, per-asset whitelist
• Kill switch — hold-to-arm UI; armed switch blocks every signing path
• Builder fee cap — hardcoded max at HL's 10 bps cap
• Bearer token — only localhost can hit the daemon; tokens rotate per session

See Security Model for details on each.