Built so the worst day is a bounded day.

01In the order path

Trading gates

A global kill-switch, order placement enable and dry-run flags. They are shown on every desk and stop the whole book when flipped.

Caps first

Max capital and max loss per strategy subscription are checked before an intent becomes an order. An intent over cap is refused, not reversed.

Validators

Lot size, tick size and product rules from the broker registry are checked on every child order. Basket MTM target, stop and trail run in software beside the broker.

Exposure on fill

Every fill re-checks exposure against the book, so a partial fill cannot leave you outside the limits you set.

EOD pause

Scheduled pause of strategy books and cancellation of working orders at close.

02At the broker boundary

Static-IP egress

Per-trader remote executors with elastic IPs for brokers that pin addresses. Placements, schedules and an IP ledger keep it auditable.

Rate limits

Broker rate-limit rules live in the registry and are enforced by the router with backoff, so bursts do not trip the venue.

Request register

Every outbound broker call, direct or via the executor, is stored with endpoint, status and latency.

Tokens, not passwords

Broker OAuth tokens and session identifiers are encrypted at rest and scoped to the account. TOTP secrets are optional and used only to complete the broker's daily login.

OAuth relay

Callbacks and postbacks land on a hardened ingress with route and request audit.

03Around the people

Roles

platform_admin, sub_broker, org_manager, trader, quant_trader and devops_admin, with module-level permission codes for trading, strategies, settings, operations and accounts.

Act-as audit

Operators acting on a trader's book do so under their own identity. Each session and order is attributed to the operator.

Sessions

Cookie-based sessions through a backend-for-frontend; invites clear stale sessions; password reset and OTP flows are rate-limited.

Separation

Paper and live books are distinct. Shadow mode emits signals with no orders. Promotion to live is an explicit action.

04Operations

Market-state monitor

Quote freshness, feed shards and backlog are visible so a stale tape is known, not guessed.

Ops alerting

Issue events become incidents and page the team over Telegram, Slack and email.

Config releases

Broker configs are versioned with fingerprints, imported and activated explicitly. Live behaviour follows the active version, not a file on disk.

Reconciliation

Positions and orders reconcile against each broker; differences are surfaced in the ledger and in reports.