KillSwitch
risk.killswitch
Risk Guardrail
live
General live
demo-wired
reference impl
KillSwitch is the top-level emergency stop for the entire trading system.
What it does
KillSwitch is the top-level emergency stop for the entire trading system. It can be triggered automatically when intraday or weekly drawdown exceeds a threshold, when the order-reject rate spikes above a circuit-breaker level, or when a market data feed is lost with open positions. It can also be triggered manually via the Admin UI. Once active, KillSwitch rejects every incoming OrderIntent without exception until a manual reset is performed (if require_manual_reset=true) or the trigger condition clears. It does not modify orders — it only blocks them entirely.
Pipeline placement
runs after: Any triggering event (drawdown breach, reject-rate spike, manual flag, feed loss
→
KillSwitch
→
runs before: All other guardrails and ExecutionPlan emit
Applies to: All OrderIntents — checked first in the guardrail pipeline
Why it matters
| If this fails | Consequence |
|---|---|
| Runaway loss not stopped automatically | Without a drawdown circuit breaker, a strategy that enters a losing streak continues to trade, compounding losses until a human intervenes — which may be too late. Worked example Setup: Account drawdown crosses -5% intraday at 16:42 UTC. Three strategies are still open: maker_tight on 4 markets, cross_market_arb on 2 markets, news_materiality_trader on 1 market. Total notional 42,000 pUSD. Without bot: Each strategy continues to submit OrderIntents on its own cadence. By 17:11 UTC drawdown is -8.4% and one strategy has averaged down twice. The team only sees the breach when the daily report runs at 18:00 UTC. With bot: KillSwitch crosses the -5% threshold at 16:42:09 and flips to active. Every subsequent OrderIntent across all three strategies is rejected with `KILLSWITCH_ACTIVE`. require_manual_reset=true, so the trip persists until an operator clears it. |
| API or wallet misbehaviour not detected | A spike in order rejections from the exchange or a wallet desync can indicate a broken execution path. Continuing to submit orders under these conditions risks unintended positions or double-orders. |
| Data feed lost with open positions | If the CLOB WebSocket feed dies and positions remain open, the system cannot monitor or hedge those positions. The safe action is to halt new orders until the feed is restored. |
| No single manual override path | In an incident, teams need a single, reliable mechanism to stop all trading immediately. Without a centralised kill signal, individual strategy shutdowns may be missed. |
Inputs
Polymarket inputs
| Input | Source | Required | Use |
|---|---|---|---|
| CLOB WebSocket connection status | WebSocket | required | Detect feed loss; trigger KillSwitch if WebSocket has been disconnected for more than the allowed dead window while positions are open. |
| Order reject events from the exchange | CLOB | required | Count reject events per minute; if reject rate exceeds reject_rate_circuit threshold, trigger KillSwitch. |
Internal inputs
| Input | Source | Required | Use |
|---|---|---|---|
| Rolling intraday and weekly P&L | PortfolioGuard | required | Monitor drawdown against intraday_drawdown_pct and weekly_drawdown_pct thresholds to trigger the circuit breaker. |
| Manual kill flag from operator dashboard | Admin UI | required | Accept a manual activation signal that overrides all automatic conditions and immediately halts trading. |
| Open position count | PortfolioGuard | optional | Condition the WebSocket-dead trigger on whether any positions are currently open; if no positions exist, feed loss alone does not trigger KillSwitch. |
Authority
What this bot is permitted to do
Pause Reject
State
Readiness
General live
Status
live
Class
Guardrail
Default mode
general_live
Developer owner
Polytraders core — Risk pod
Capital impact
Critical
Reason codes emitted
| Code | Severity | Meaning | Action |
|---|---|---|---|
| KILL_SWITCH_ACTIVE | HARD_REJECT | The KillSwitch active flag is set; all orders are rejected regardless of other conditions. | Return HARD_REJECT immediately on every intent. |
| STRATEGY_BUDGET_EXCEEDED | HARD_REJECT | Intraday or weekly drawdown has exceeded the hard circuit-breaker threshold. | Activate KillSwitch with trigger_reason=INTRADAY_DRAWDOWN_EXCEEDED or WEEKLY_DRAWDOWN_EXCEEDED. |
| STALE_MARKET_DATA | HARD_REJECT | P&L or WS feed data is unavailable for more than 60s; system health is unknown. | Activate KillSwitch with trigger_reason=STALE_MARKET_DATA. |
| KILL_SWITCH_INTRADAY_DRAWDOWN | HARD_REJECT | Intraday drawdown exceeded intraday_drawdown_pct hard threshold. | Activate KillSwitch; set trigger_reason=INTRADAY_DRAWDOWN_EXCEEDED. |
| KILL_SWITCH_WEEKLY_DRAWDOWN | HARD_REJECT | Rolling 7-day drawdown exceeded weekly_drawdown_pct hard threshold. | Activate KillSwitch; set trigger_reason=WEEKLY_DRAWDOWN_EXCEEDED. |
| KILL_SWITCH_REJECT_RATE | HARD_REJECT | Order reject rate from the CLOB exceeded reject_rate_circuit threshold in a 5-minute window. | Activate KillSwitch; set trigger_reason=ORDER_BOOK_UNAVAILABLE. |
| KILL_SWITCH_FEED_DEAD | HARD_REJECT | CLOB WebSocket feed has been dead for > 30s with open positions. | Activate KillSwitch; set trigger_reason=ORDER_BOOK_UNAVAILABLE. |
| KILL_SWITCH_MANUAL | HARD_REJECT | Operator manually activated KillSwitch via Admin UI. | Activate KillSwitch; set trigger_reason=MANUAL_KILL. |
Related bots in Risk Guardrail
Used by
Reverse index — strategies that currently reference risk.killswitch. If you change this bot's authority or reason codes, these strategies must re-pass shadow.
| Strategy | State | Activity |
|---|---|---|
| Crypto Q2 — basket rebalance | frozen | last triggered 6m ago |
Showing 1 of 1 · demo-wired ≠ production-live
⚙ Configuration — risk.killswitch
Why this matters
Risk Guardrail bots does NOT propose intents or sign orders; only permits or blocks. Understanding the authority boundary prevents misuse and makes promotion-gate reviews faster and more reliable. View raw spec JSON →