Limits and halts

Risk is a short list of numbers the Executor will not cross. The PM (shown as Analyst on screen) proposes inside them; the Executor enforces them on every order, in code, and picks up a change within seconds. Where things are set: the posture (the preset that sets all six headline limits at once) is chosen on Strategy › Posture; the individual limits are fine-tuned here, one by one. The Risk header always says which posture the limits below come from and links back to Strategy to change it; Risk sits right after Strategy in the navigation for that reason.

The three tabs

Risk opens on Limits. The tabs are:

• Limits: per-order rules (size, price sanity, timing). A miss rejects one order and tells the PM why; nothing here halts the system. The posture in force shows as a read-only chip; postures are picked on Strategy › Profile.
• Halts: the two rules that stop everything.
• Tradable universe: liquidity and price floors, listing rules, denylist.

Autonomy (which orders wait for your approval) is not a Risk tab: it is set on Strategy › Profile and shown in the Risk header as a read-only chip; see autonomy levels.

The Halt control sits in the page header on every tab, and the kill-switch history, the live gauges and Flatten sit beside the tab content (below it on a narrow screen); see the kill switch.

Per-order limits

Each row on per-order limits· Risk › Limits shows the value now, a slider, the code default and allowed range, and who last changed it. The defaults below are the Moderate posture, which is exactly the code defaults:

A posture· Strategy › Profile › Posture (Conservative, Moderate or Aggressive) sets six headline limits at once: order size, position size, gross exposure, orders per day, and the two halt rules. Conservative is $250 / 5% / 40% / 3 orders / $75 / 5%; Aggressive is $1,000 / 20% / 90% / 10 orders / $300 / 15%. Edit any one of the six afterwards and the posture reads Custom (see profile). A looser posture is a loosening like any other.

The largest single order grows with the account

The order-size limit is one of two numbers in that list that are worked out rather than fixed (the other is the daily loss stop, below). The Max order row on Limits shows the value the Executor enforces right now and where it comes from, in one sentence, for example "$10,000 · from posture (10% of $100,000)" on a $100,000 Aggressive book, "$500 · from posture (5% of $6,000 is under the floor)" on a small Moderate book, or "$200 · account-size ceiling (< $2k book)" when the equity band caps it. The rule:

• your posture's share of equity: Conservative 3%, Moderate 5%, Aggressive 10% (Preservation 2%);
• never less than the posture's dollar floor ($250 / $500 / $1,000; Preservation $150), so a small account is never held tighter than before;
• never more than the ceiling for the account's equity band: under $2k → $200 · $2k–10k → $500 · $10k–25k → $1,000 · $25k–50k → $2,500 · $50k–250k → $10,000 · $250k–1m → $100,000 · $1m–10m → $500,000 · above $10m → 2% of equity (at least $500,000), up to $1 million an order, where the platform's per-order ceiling stops: a very large book trades in more, smaller orders relative to its size;
• before the account has reported any equity, the floor applies.

If you type your own number into the row it becomes an override: the row says "overridden (posture would give X)", the Executor uses your number (still under the account-size ceiling), and a reset to posture link puts the worked-out value back, through the same review-and-save as any other change, so if going back to the posture value raises the limit it asks for your authenticator code like any loosening. Strategy › Profile repeats the same sentence next to the starter size. Nothing else about sizing changed: position and exposure limits, the drawdown halt, the approval line and every Executor check apply exactly as before.

The daily loss stop grows with the account too

The daily loss stop follows the same pattern, so a larger account is not stopped out by a move that is small for its size and a small account keeps exactly the protection it had:

• your posture's share of equity: Preservation 0.5%, Conservative 0.75%, Moderate 1.5%, Aggressive 3% (roughly a 2.5–5% down day in the market at the amount each posture keeps invested);
• never less than the posture's dollar floor ($50 / $75 / $150 / $300), so an account of $10,000 or less halts at exactly the same number as before;
• never more than the ceiling for the account's equity band: under $2k → $50 · $2k–10k → $150 · $10k–25k → $750 · $25k–50k → $1,500 · $50k–250k → $7,500 · $250k–1m → $30,000 · $1m and above → $100,000, where the platform's daily loss ceiling stops;
• always inside the drawdown halt (3 / 5 / 8 / 15%), which remains the multi-day stop.

A $100,000 Moderate book therefore reads "Stop everything if today's loss reaches $1,500 · from posture (1.5% of $100,000)" on Halts and on the Daily loss halt row of Limits; typing your own number makes it an override with a reset to posture link, exactly like the order cap.

The two halt rules

On Halts the two rules read as sentences with the number inline:

• Stop everything if today's loss reaches $150 (MAX_DAILY_LOSS_USD; worked out from your posture and equity as above, shown with an "In force: …" line; you may type an override).
• Stop everything if the account falls 8% below its peak (MAX_DRAWDOWN_PCT, measured from the high-water mark, allowed 1–25%).

When either trips the Executor halts itself and the book becomes reduce-only: new buys are blocked, buy orders still resting at the broker are cancelled, open positions are kept, and sells, including the Executor's own stop and target exits, still go out (the two halt checks pass a sell with a note, since the halt is already on record). A critical alert is raised (and posted to Slack if a webhook is configured), and resuming needs your authenticator code; see the kill switch. Change the numbers on the daily loss and drawdown halts· Risk › Halts.

The tradable universe

There is no fixed list of allowed stocks. Any US exchange-listed stock, ADR or ETF may be proposed; the Executor screens every order against the tradability thresholds· Risk › Tradable universe on the Tradable universe tab:

• price at least $3 (MIN_PRICE_USD, allowed $1–$50)
• 20-day average dollar volume at least $5 million (MIN_ADV20_USD, allowed from $500,000 up; larger books raise it automatically)
• the order at most 0.5% of that volume (MAX_ORDER_ADV_PCT, allowed 0.01–5%)
• quoted spread no wider than 50 basis points (MAX_SPREAD_BPS, allowed 5–⁠200)
• at least 60 clean daily bars of history (MIN_DAILY_BARS, allowed 20–⁠200)

The fixed rules below them are not editable: OTC, crypto, options, futures and foreign listings are research-only; a name the exchange has halted or the broker marks not tradable is refused; leveraged and inverse ETFs are blocked unless the deployment sets ALLOW_LEVERAGED_ETFS; a symbol with no profile is refused (profile_unavailable) rather than waved through. A rejection names the sub-check that failed (illiquid_adv, spread_too_wide, denylisted and so on). A sell of a held position is never trapped by the listing or liquidity rules or the denylist; only a halt or the broker marking the asset not tradable stops an exit.

The denylist· Risk › Tradable universe › denylist is names the Executor must never buy, whatever the screen says. Type one or more tickers and add them; no code is asked for, the change is audited, and the Executor rejects buys of those names from its next loop.

Tighten freely, loosen deliberately

Edits on any tab collect in a sticky "Review N changes" bar. Making rules stricter saves with one click and takes effect within seconds. If any change makes a rule looser, the review dialog warns in red, shows each change as the rule's name with its old and new value (the setting key and the number of the check that enforces it sit behind a small Details disclosure), notes each against its default and allowed range, asks you to type MORE RISK, then asks for your authenticator code (a code entered in the last 30 minutes still counts). The server checks the code and the phrase itself; a loosening sent without the code is refused. Every change is recorded in the audit log.

Every limit has a floor and a ceiling in code. The console cannot set a value outside them, the API refuses one, and a stored value that is somehow outside them is ignored in favour of the code default. A deployment can pin a limit tighter than its default: that row shows a pinned badge, you can tighten it further, and it cannot be loosened from the console at all. A deployment that starts with a limit looser than the code default refuses to start unless the operator explicitly allows it at deploy time.

Every save (tighten, loosen, posture, denylist) writes an audit row under Activity › Config changes; the Audit log link in the Risk header goes there too.