Senior MT4/MT5 & MetaApi Engineer - Audit and Targeted Fixes

IMPORTANT: THIS IS AN AUDIT-FIRST ENGAGEMENT FOR AN EXISTING PRODUCT. The product already exists and is substantially complete. We are NOT hiring someone to create a new trading platform or “Desk”, rewrite the application, develop trading strategies, add new features, or redesign the architecture. We need a senior trading-systems engineer to independently verify the reliability, correctness, and operational safety of an existing proprietary multi-account execution platform. The engagement begins with an end-to-end technical audit of a frozen code revision. Only after we review and approve the findings may the same engineer implement specifically approved, minimal fixes. TECHNOLOGY AREAS - MT4 and MT5, including MQL4/MQL5 components - Python asyncio workers and MetaApi - Next.js and TypeScript - Supabase/PostgreSQL, including RPCs, migrations, transactions, and RLS - Durable queues and outbox patterns - Idempotency, reconciliation, leases, and fencing - Docker/Wine and MetaTrader runtime environments AUDIT OBJECTIVE Determine, using reproducible evidence, whether the existing system behaves safely and consistently during normal operation and realistic failure conditions. The audit must cover, at minimum: - Complete order, deal, and position lifecycle - MT4 versus MT5 execution semantics - Hedging and netting account behavior - Partial fills, rejection, cancellation, expiry, and position closure - SL/TP creation and modification - Provider timeouts and ambiguous execution outcomes - Prevention of duplicate orders during retries - Worker crashes, restarts, reconnects, and recovery - Concurrent workers and multi-account execution - Queue durability, idempotency, and reconciliation - Lease ownership, stale-worker prevention, and fencing - PostgreSQL transaction and concurrency safety - MetaApi synchronization, callbacks, reconnects, and error handling - Security boundaries, secrets handling, and database authorization - Docker/Wine runtime and deployment risks - Existing automated-test coverage and important missing tests PHASE 1 — AUDIT DELIVERABLES 1. Written findings classified as: - P0: immediate safety or money-path risk - P1: serious reliability or correctness risk - P2: lower-risk improvement 2. Every P0/P1 finding must include: - Exact code location - Technical root cause - User or operational impact - Reproduction steps or a failing automated test - Smallest safe remediation - Estimated effort and regression risk 3. MT4/MT5/MetaApi coverage matrix showing what was tested, the result, and any limitation. 4. Final GO, CONDITIONAL GO, or NO-GO assessment with clearly stated residual risks. We do not expect an unrealistic “zero bugs” guarantee. 5. Short live technical walkthrough of the findings. PHASE 2 — APPROVED FIXES ONLY Phase 2 begins only after the audit has been reviewed and accepted. For each approved issue, the engineer must provide: - A minimal, scoped patch - A regression test reproducing the original defect - Before-and-after execution evidence - Any required documentation or runbook update - A list of residual risks or untested conditions Unrelated refactoring, framework migration, feature development, architectural redesign, or a full rewrite is not authorized. If a wider change is genuinely necessary, it must first be justified with evidence and approved in writing. REQUIRED EXPERIENCE - Proven production work with both MT4 and MT5 - Strong MQL4 and MQL5 knowledge - Strong Python, including asyncio and resilient API clients - Direct production MetaApi experience strongly preferred - Clear understanding of orders, deals, positions, hedging, and netting - Experience handling ambiguous broker/API outcomes safely - PostgreSQL transactions, locking, idempotency, and concurrency - Next.js/TypeScript backend or API experience - Docker and Wine/Windows runtime familiarity - Evidence-based code auditing and regression testing - Strong spoken and written English or Italian ENGAGEMENT RULES - The selected engineer must personally perform the work. - No subcontracting without prior written approval. - Initial repository access will be read-only and tied to a frozen commit. - Testing will use demo/sandbox environments only. - No real funds, live trading accounts, or production credentials will be provided. - No production deployment or configuration change is authorized without written approval. - NDA and IP assignment will be required. - This is an engineering reliability audit, not a review of trading-strategy profitability. Please do not submit a generic proposal. Begin your application with “AUDIT-FIRST” and answer every screening question.