Predictive Risk Engine

Before every trade, the engine runs a Monte Carlo simulation: - Takes the last 90 days of returns for all positions in the portfolio - Simulates 10,000 possible next-day scenarios using historical return distributions - Calculates the 95th percentile worst-case loss (VaR) - If adding the proposed trade would push portfolio VaR above the risk level's threshold (8% Conservative / 15% Balanced / 25% Aggressive), the trade is blocked

This is the same methodology used by institutional risk desks (Basel III compliant VaR calculation). It prevents the bot from over-concentrating in correlated positions during volatile periods.

The Global DD Breaker runs every 5 minutes for all live users:

• Computes current equity vs trailing 30-day peak
• If drawdown >= 20% → all bots paused immediately
• Inserts event into dd_breaker_events for audit trail
• Notifies admins via Telegram and PagerDuty
• User must manually reset after reviewing the situation

This is the last line of defense — even if all other risk gates fail, the DD breaker ensures no account can lose more than 20% from peak without human intervention.

Configurable per-account: threshold (default 20%), lookback (default 30 days). Can operate in SHADOW mode (logs but doesn't halt) for testing.

Three layered protections sit ABOVE pre-trade risk limits:

1. Cold-start cap — New bots are capped at $1,000 notional until they prove themselves (14 days + Sharpe > 1). Then promoted to $10,000 (proven), then $100,000 (scaled).

2. User circuit breaker — If daily P&L drops below -X% of capital, all bots for that user are paused for the rest of the day.

3. Order anomaly detection — Rejects orders where quantity is 3x the median historical order OR price deviates 5 standard deviations from mark price.

All three operate in fail-CLOSED mode for live trading. If a database read fails, the safeguard assumes the worst case and rejects the order.

Every 5 minutes, the intraday risk system: - Loads current mark prices for all live positions - Computes portfolio value and compares against session high - Calculates drawdown from intraday peak - Flags VaR breaches (when intraday loss exceeds daily VaR estimates)

Alert levels: - OK — normal operation - WARN — drawdown > 5% from session high - CRIT — drawdown > 10% OR VaR-99 breach

Critical alerts trigger immediate Telegram + PagerDuty notifications.

Two additional gates check market microstructure before execution:

Order Book Imbalance (OBI) If the order book is heavily skewed against our direction (e.g., we want to buy but there's 3x more volume on the ask side being pulled), the trade is delayed or size-reduced.

Microprice The microprice (volume-weighted midpoint) is compared to the last trade price. If microprice suggests adverse short-term movement > 0.3%, entry is delayed by one tick.

Both gates use real-time L2 data streamed via NATS from Tardis.

All risk gates operate in fail-closed mode for live trading: - If Redis is unavailable → all orders blocked (not passed) - If ClickHouse is down → microstructure gate blocks (not passes) - If VaR calculation errors → trade blocked - If exchange returns unexpected error → circuit breaker trips - If kill-switch check fails → order blocked

This is the opposite of most trading bots which fail-open ("if we can't check, just trade"). We chose fail-closed because missing a trade costs opportunity; executing a bad trade costs capital.

Paper trading uses fail-OPEN so transient infrastructure blips don't halt the simulation.