2.15 OrderAmendCancelManager

1. Bot Identity

Operational profile

2. Purpose

Owns every amend and cancel operation against the CLOB for orders Polytraders has placed. Strategies do not cancel directly — they emit an OrderAdjustment intent which this bot validates, sequences, and submits via the EIP-712 v2 envelope. Maintains a strict monotonic intent sequence per order so cancels can never race amends.

3. Why This Bot Matters

• Race conditions on cancel/amend

  Without a single sequencer, two strategies can race each other to amend the same order, producing inconsistent CLOB state.

• Phantom cancels

  A cancel that fails silently leaves an order resting that strategy code believes has been killed; mismatched state causes self-trades and over-positioning.

• Amend bypasses risk

  An 'amend size from 100 to 500' looks like a cancel-and-place but bypasses Risk if not routed through this bot.

No worked examples on this bot yet. Worked examples are optional but strongly recommended — they turn an abstract failure mode into something a developer can verify in a fixture.

4. Required Polymarket Inputs

5. Required Internal Inputs

6. Parameter Guide

7. Detailed Parameter Instructions

{ "amend_timeout_ms": 1500 }

if (now - sent > p.amend_timeout_ms) retry_or_escalate();

{ "cancel_timeout_ms": 1500 }

if (now - sent > p.cancel_timeout_ms) retry_or_escalate();

{ "max_inflight_per_order": 1 }

if (inflight[order_id] >= p.max_inflight_per_order) reject_intent('EXEC_AMEND_INFLIGHT');

8. Default Configuration

{
  "amend_timeout_ms": 1500,
  "cancel_timeout_ms": 1500,
  "max_inflight_per_order": 1
}

9. Implementation Flow

— not yet authored —

10. Reference Implementation

Pseudocode is language-agnostic. FETCH = read input. EMIT = produce output. IF/THEN/ELSE = decision. Translate directly to TypeScript, Python, Go, or Rust.

validate(adjustment)
if op == 'amend' and new_size > current.size:
  pass_through_risk(delta_intent)
seq = next_seq(order_id)
result = clob.send(adjustment, seq, eip712_v2_envelope())
wait_ack_or_timeout(p.amend_timeout_ms)
reconcile_with_lifecycle()
emit_report()

11. Wire Examples

Input — what arrives on the wire

{
  "intent_id": "adj_001",
  "order_id": "ord_xyz",
  "op": "amend",
  "new_size_usd": 50
}

Output — what the bot emits

{
  "intent_id": "adj_001",
  "order_id": "ord_xyz",
  "outcome": "ACK",
  "seq_id": 7,
  "reason_code": "EXEC_AMEND_OK"
}

12. Decision Logic

13. Standard Decision Output

This bot returns a RiskVote object. See RiskVote schema.

{
  "intent_id": "adj_001",
  "order_id": "ord_xyz",
  "op": "amend",
  "new_size_usd": 50,
  "outcome": "ACK",
  "seq_id": 7,
  "reason_code": "EXEC_AMEND_OK"
}

14. Reason Codes

15. Metrics & Logs

Metrics emitted

Dashboards

• 2.15 overview dashboard

16. Developer Reporting

"Per operation: order_id, op, seq_id, sent_ts_ms, acked_ts_ms, outcome, reason_code."

17. Plain-English Reporting

18. Failure-Mode Block

19. Failure-Injection Recipes

20. State & Persistence

Per-order seq_id counter (durable). In-flight operation map (in-memory).

State stores

Cold-start recovery

Cold-start hydrates from fast KV; missing keys default to safe fallback.

On restart

All in-flight decisions are re-evaluated; no bot decision is trusted across restart without re-emit.

21. Concurrency & Idempotency

22. Dependencies

Depends on (must run first)

Requires (graph.requires)

exec.order_lifecycle_manager

23. Security Surfaces

Only this bot's identity has CLOB write permission for amend/cancel.

Signing surface

Reads pending signed orders; never signs on user behalf.

Abuse vectors considered

• EIP-712 v2 signature required for every operation.

Mitigations

• Rate-limit per source
• Audit-log every override
• Require role-based authz on admin paths

24. Polymarket V2 Compatibility

25. Versioning & Migration

26. Acceptance Tests

Unit Tests

Integration Tests

Property Tests

27. Operational Runbook

If timeouts spike: inspect CLOB v2 latency; enable verbose ack-trace logging; consider widening timeouts only as a temporary measure.

On-call actions

Manual overrides

• polytraders bot pause 2.15 — Disables the bot's enforcement layer; downstream consumers fall back to safe defaults.

Healthcheck

GET /healthz/order_amend_cancel_manager → 200 if last successful evaluation < 60s ago.

28. Promotion Gates

A bot does not advance to the next readiness state until every gate below is green. Gates are observable from production data — no subjective sign-off.

Promote to Shadow

Promote to Limited live

Promote to General live

29. Developer Checklist

Ready-to-ship score: 27/27 sections complete · 100%