The path
One way in,and one orderout of it
Every order — typed, proposed by the assistant, or emitted by a strategy — takes the same route through the same four services. Nothing else holds the credential that can submit to a venue.
The four steps
- 01
Intent
One service originates orders and it is the only caller the execution API accepts for a placement. A single door is what makes "did anything skip the gate" a question with an answer.
- 02
Risk
Your limits, evaluated against a fresh portfolio snapshot. A pass produces a short-lived signature over this exact order — quantity, price, symbol, side.
- 03
Execution
The signature is verified against the values about to be sent, the account is confirmed to be yours, the venue is confirmed to be one you may reach, and the order is rounded to the instrument’s filters.
- 04
The venue
Submitted under a client order id issued once for that account. Fills come back on the private stream and are written to the ledger, which is what your positions and P&L are derived from.
The failure this is designed around
A lost response is not a failed order
The dangerous moment in electronic trading is not a rejection — it is a submission whose answer never arrives. The order may be live. Retrying blindly places a second one; giving up leaves an unmanaged position. Both are worse than the problem.
So identity comes before authorisation
A repeat of a known client order id is answered with the order that already exists, before the approval is even examined. That ordering was learned the expensive way: approvals are short-lived, so a retry a minute later carries an expired one, and verifying first told the caller the trade was refused while it was live at the venue. The natural next step from there is a fresh proposal — a second real order.
And a lost order is reconciled, not assumed
On startup and on a schedule, open orders are re-read from the venue and matched against the ledger. An order the venue knows about and we do not is adopted; a fill we missed is booked; a discrepancy that cannot be resolved is raised as an issue rather than smoothed over. The branch where the venue accepted an order and the response was lost has been exercised for real on a production key, not dry-run.
Questions about the order path
Can a strategy place orders without me?
Only one that a human promoted, with a scope that says so, under a risk policy that was in force at promotion. And it takes the same route: the gate does not know or care whether a human or a strategy proposed the trade.
What is a client order id for?
It is the identity that makes a retry safe. Issued once per account, carried to the venue, and used to match fills back — including fills recovered later from a venue that rounds our ids, where the instrument is what gives the match away.
What if the venue rejects the order?
You get the venue’s own reason, mapped rather than swallowed. A rejection is a fact about your order; an unmapped status is a fact about our connector, and those are reported differently on purpose.
Follow one all the way through
On paper the path is identical up to the last step, including the reconciliation.