The complete user guide.

VICE4X / Created by KAHZI

A single institutional workspace for your member identity, holder records, education, documents and collaboration. The current release brings these records together with clear permissions and an accountable history.

VICEBOT personal access is currently exclusive to KAHZI. Native MT5 execution, exact TradingView parity, Google Calendar/Zoom booking activation and device-specific call behavior require their respective provider or device verification. The application shows unavailable integrations explicitly.

01 / First access

VICE4X is invitation-only. The founder or an authorized operator creates a personalized invitation bound to your email. Open the invite link on the device you intend to use. Use the exact invited email address to create your account, verify your email when prompted, and sign in.

1. Open the official app at vice4x.netlify.app and confirm HTTPS.
2. Select account creation only when you have a valid, unexpired invitation.
3. Use the email address on that invitation; do not share invite links or codes.
4. Complete Supabase email verification where required. Refresh and sign in.
5. Authorized staff can view issuer modules; ordinary members see only permitted tools.

02 / Login and recovery

Email, username or Google

Use email and password, username and password (when a username is provisioned), or “Continue with Google” if that identity is configured. If the account has a registered email/Google identity, choose the sign-in method attached to that identity.

Recover password

1. Select “Forgot password?” on the login screen and enter the account email.
2. Open the Supabase recovery email, return to the authorized HTTPS site, and enter a new password of at least 12 characters.
3. Confirm the password and sign in again.

Recovery depends on the operator allowing the site URL in Supabase Auth redirect settings and on email delivery. A failed provider connection must not invalidate a valid membership login.

Private session

Use Sign Out when finished, especially on shared devices. Normal and private browsing sessions may have different site storage; they are not interchangeable.

03 / Your navigation

The left navigation organizes features by purpose. On smaller screens, use the menu toggle. Sections shown depend on your assigned server-side role; not all members receive Trade Desk, Treasury, Data Rooms or Compliance access.

04 / Charts, bots and trading

My Chart and Trade Desk are separate from live broker execution. Select an instrument and timeframe, confirm the current data source and timestamp, and understand any SIM, FILE, DELAYED or LIVE label before relying on a number.

Drag within the chart to pan time and price. Drag the right price axis to change vertical scale or the bottom time axis to change candle count. Use the mouse wheel or two-finger pinch to zoom; Shift+wheel scales prices. With the chart focused, arrow keys pan, plus/minus zoom and zero resets. Reset view restores automatic scaling. Support and O.I. are in the chart toolbar so they do not cover the price axis.

A failed live feed shows UNAVAILABLE and clears its candles. Practice candles appear only when practice/SIM is explicitly selected. Confirmed fractal dots retain their five-candle confirmation delay; future candles do not retroactively confirm a dot before that delay.

VICEBOT/quant analysis panels can show signals, backtests or hypothetical trade setups. A simulation is not a placed order. Broker connectivity and actual orders require explicit, separately tested, authorized integrations. Follow your own risk limits; use demo accounts for initial testing.

05 / Portfolio, MT5 and external accounts

Portfolio

Live verified broker equity must be attributed to the current signed-in user, recent, real-account confirmed, denominated in USD for USD aggregation, and deduplicated against live bridge connections. Historical entries, self-declared balances and DEMO accounts are not evidence of live funds.

Connect MT5 without a PC

1. Open MT5 Accounts, then the Cloud MT5 option available to your role.
2. Enter a descriptive label and your broker's exact MetaTrader 5 server name; select DEMO or LIVE.
3. Approve any displayed third-party hosting costs.
4. Follow the generated link to the official MetaApi site. Enter MT5 login and an investor/read-only password there, never into VICE4X.
5. Wait for provider provisioning, deploy/start the terminal if required, and refresh account status. Verify broker name, real/demo mode, holdings and freshness.

The Cloud MT5 connector is read-only. It requires an administrator to configure a MetaApi token securely in Supabase. The external official broker portal is just a website handoff unless an actual broker API integration has been installed. Windows/WSS bridge remains optional and requires its own client.

Release 1.3.8.0-IRU-CERTIFICATES / Backend integrity and membership

Administrators can select Run Diagnostics to inspect issuer reference policy, holder-capacity enforcement, orphan records, and live database read paths. Delegated role changes require server authorization and auditing. Current internal reference prices are fixed at VICE $2 and V4X $320; a separate reviewed migration is required for policy changes. These checks do not certify live broker access, Netlify publication, or collateral value.

Governance proposals now have server-managed voting windows. An active, verified holder may submit one FOR or AGAINST vote per proposal; direct ballot writing is prohibited. Votes here are application governance records, not blockchain transactions, and do not establish legally binding governance rights on their own.

Issuer distributions are recorded against holder IDs and are visible according to member/staff permissions. Labels such as AUDITED or PAID are record states, not independent evidence that cash settled at a financial institution.

Manually entered external account figures remain usable as administrative records but are not counted in LIVE consolidated verified USD totals. Broker terminals, on-chain assets, prices and other third-party data must be separately verified.

06 / VICE and V4X units

The IRU view is your internal record of unit class, history and authorized distributions. A holder tier is determined by recorded entry/contribution class, while any Legacy designation is separately awarded; neither is automatically recalculated from a displayed reference valuation.

The current issuer management references are VICE $2 per unit and V4X/VPRE $320 per unit. These are not market prices, legally binding appraisals, guaranteed collateral values, lender commitments or proof of third-party fair market value. A lender must independently accept collateral and determine credit terms.

Institutional actions such as allocation, approval, reserve release and reconciliation require authorized staff and server-side checks. Members cannot directly adjust their own units.

07 / Chats, calls and VIP channels

Open Chats & Calls to select a public channel or permitted direct conversation. Group channels and any executive/private channel are governed by server-side access rules. Messaging and online presence need a working Supabase realtime connection; remote calls need browser permissions, signalling and a properly provisioned TURN service.

Failed sends retain the draft. History loads the latest 200 records. After a one-to-one call connects, Camera enables video and Share screen opens the browser picker; only one video source is sent at a time. Stop sharing using the active control or browser control. Both callers must refresh to the same release. Group conferencing, complete device selection, durable read receipts, editing/deletion and full history search are still incomplete.

If calls fail: allow microphone access, confirm your operating system allows the browser to use the microphone, check the app diagnostics, and test again with another member on a separate network. Do not assume every message is independently audited end-to-end encrypted: older key derivation remains unverified for that claim.

08 / Academy and certificates

Select Learn & Certify. Read the 21 core chapters in modules I–VII and select Mark read for each. Live progress is marked complete only after the database confirms it. Prior device-only reading marks must be reconfirmed once. Complete each four-question server-graded assessment with 75% or better in every core module, then request the course certificate using your verified profile name.

New certificate issuance checks backend chapter receipts and passing scores. Changing a browser value does not earn a certificate. Repeating an eligible request returns the existing active certificate. Previously issued legitimate certificates are retained. Download/print your certificate and use the verification flow for authenticity. This is a VICE educational certificate, not a regulated professional license.

09 / Support, requests and services

From Help & Tickets you can view your tickets and submit an issue with a concise subject, what you expected, what happened, the page, the current build, and the approximate time. Never paste a password, authentication token, seed phrase, personal banking password or private API key.

Services, VIP and marketplace features may require a particular membership tier or operator approval. A submitted request has not been fulfilled until its status is confirmed by the responsible system/operator.

10 / Governance, distributions and issuer operations

Governance proposals are published by authorized personnel; voting eligibility and tally logic are enforced server-side. Distributions and custody/treasury movements are separate from proposed or reference values; consult their transaction state and actual receipts.

Staff with the correct role may see Holder Registry, Invites, Treasury, Compliance, Contracts, Audit Log and Reconciliation. Changes to financial rights should use approved, append-only, replay-safe workflows rather than direct table edits.

11 / Documents and wallet

Documents go to an access-controlled private storage bucket. Its current object-size limit is 10 MB. Upload your own permitted documents and verify a successful metadata record; other members should not be able to read your files.

Edit form supports compatible AcroForm text/date fields, checkboxes and selections. Profile autofill uses verified identity/contact fields. Export the PDF or save a new private copy; the original remains unchanged. Read-only fields, signature-field PDFs and XFA documents are protected. Arbitrary page-text editing and complete multi-signer request/sequence/reminder workflows are not implemented.

My Wallet is separate from custody proof. Never reveal your seed phrase/private key. Check chain, wallet account, signed message and transaction confirmation. Tokens, internal IRUs, and independently held on-chain assets are separate things; do not infer chain ownership from an application screen.

12 / Security and privacy

• Use a unique password, verify HTTPS and prefer MFA where available.
• Do not upload trade passwords or MetaApi operator tokens to VICE or chat.
• Operator secrets belong in provider secret managers; the browser key is a public Supabase anon key, not a service-role secret.
• Read-only connectors do not authorize trading. Do not share the account on a communal device.
• Report suspicious account changes and revoke compromised access through the operator immediately.

13 / Troubleshooting connections

1. Open Check Application Connections from login, or Run Diagnostics when authenticated.
2. Check that Published version matches the displayed build, currently 1.3.8.0-IRU-CERTIFICATES.
3. Check Supabase Auth and session; when logged in, check Member Profile, Holder Registry, Academy, Support and Governance.
4. Check the Market Search Proxy, TURN Calls and Cloud MT5 only for services you use.
5. If your sidebar disappears, verify the session and member profile first. Optional MT5 failures should not sign you out.
6. After an operator confirms a successful Netlify deploy, open the home URL without an old ?build= query, refresh and sign in again.
7. Save the displayed diagnostic statuses and send a ticket with a timestamp. A service marked WARN needs investigation; a PASS is only a connectivity check, not a completed feature test.

14 / Operator acceptance and limitations

Before declaring production ready, verify actual Netlify deploy SHA, email/username/Google login and recovery, two separate member roles, Supabase storage separation, IRU replay/caps, certificate falsification resistance, realtime messaging, TURN cross-network calls, provider-side MT5 investor credentials, market-data latency, account-level isolation, governance approvals and ledger accounting.

Service diagnostics are observational. Provider tokens, TURN secrets, a second test member, regulated financial validation, on-chain attestations and live-trading behavior must all be independently provisioned, permissioned and accepted. Do not label any test “100%” while those gates are open.

Chat confidentiality and restricted staff rooms

VICE4X version 1.3.8.0-IRU-CERTIFICATES enforces the reserve and treasury channel permissions at the database layer. General and trading channels are for authenticated members, and direct messages are scoped to their participants. The server validates message sender identity and sender display names.

Browser display permissions do not replace database policies. Members without appropriate roles cannot query staff-only messages directly.

Sending photos and voice notes

Within an authorized channel or direct message, tap + to choose a JPEG, PNG or WebP image (maximum 8 MB). Tap Mic to start a voice note, then Stop to send it. Recording stops after 60 seconds and asks the browser for microphone access. Images and voice files are saved to the private VICE Chat Media bucket; only members authorized for that channel or direct conversation can request short-lived media links.

Audio recording support depends on the browser (WebM, MP4, OGG or MP3 types). If microphone access is denied or unavailable, the app displays an error. For sensitive content, do not rely on this legacy chat system as audited end-to-end encryption. Live two-member media acceptance on iPhone and Android is still required.

Audit provenance and member session restrictions

VICE4X 1.3.8.0-IRU-CERTIFICATES separates unverified activity reported by a browser from actual issuer-authorized backend events. Member activity is rate-limited and tagged CLIENT_REPORTED/UNVERIFIED_CLIENT_EVENT; browser events alone are not evidence that a distribution settled, a transaction executed, or a certificate was issued. Authorized database operations retain their own server-side audit trail.

Direct messages now require a provisioned member profile. WebRTC TURN credentials, when enabled, are provided only to authenticated accounts that are also recognized as approved VICE4X members. Provider activation and a real two-party test are still required.

15 / IRU Certificates: QR + Code 39

When an authorized issuer records new VICE/V4X units, retires units, completes an approved allocation, or marks a recorded distribution PAID, the database generates a token certificate. An authorized executive may also issue one consolidated period snapshot for an account. This is an issuer accounting record, not proof of bank settlement or independent value.

Certificate layout and barcodes

Printed certificates show a scannable QR code that opens /verify.html?id=VCT-..., plus a Code 39 1D barcode encoding the same VCT identifier. Most phone cameras scan QR directly. For Code 39 use a standard barcode scanner and enter the returned ID into the verification page.

What gets verified

Public verification checks a database-issued certificate ID, active/revoked state and integrity digest. It displays only approved status metadata: certificate ID, kind, program, issue time and digest. Holder identity, unit quantities, balance snapshots and internal revocation notes remain private. Sign in with authorized holder/issuer access to view the complete certificate. A revoked ID remains revoked.

1. Log into VICE4X with your provisioned account.
2. Open My IRU & Units, then My Verified IRU Certificates.
3. Select Preview to inspect the 8.5 × 11 inch certificate; select PNG to save a 2550 × 3300 pixel image.
4. Use Print / PDF and save to PDF in your browser print dialog.
5. Scan the QR to open the public verify page or type the VCT ID from Code 39.
6. Read both current certificate state and the dated balance snapshot. Older certificates retain older balances after later transactions.

Operator

Open the holder registry for an authorized unit change; certificates are generated by the backend trigger, never through fabricated client-side records. Use Issue Period Summary to record a consolidated certificate for one named holder and YYYY-MM period. Revocation requires issuer privilege and a stated reason. Reissuance requires a newly authorized issuer action; a revoked ID remains revoked. Delivery email is queued in the private outbox, but SMTP delivery requires the separate private server worker to be running with valid credentials.