Pipeline view for Stage 8 — Order manager & reconciliation. See also Stage 7 — Decision & risk.

Order flow

From signal to on-chain order, every step. Every box is a real bot; every arrow is a typed schema. The order is fixed: Discovery → Intel → Strategy emits OrderIntent → Risk → Execution → Security → Lifecycle → Governance. Risk has no input until Strategy decides.

Pipeline rule: Risk evaluates OrderIntents. There is no path from a market observation to a signed order that bypasses Strategy. Reordering this is forbidden — see forbidden patterns.

Signal (Intel) — Intelligence bots emit typed signals (MarketSnapshot, OrderBookSnapshot, news, sports feeds). All freshness-stamped.
Discovery — disc.marketscanner filters the signal space down to candidate markets that pass the eligibility rules.
Strategy emits OrderIntent — Exactly one Alpha Strategy bot evaluates the candidate and either emits an OrderIntent or returns STRAT_NO_EDGE. Risk does nothing until this step completes.
Risk pipeline — The OrderIntent passes through every Risk bot in declared order. Each emits a RiskVote. Any single REJECT halts the pipeline.
Execution shaping — If approved, exec.fee_slippage_estimator, exec.smart_router and (if needed) exec.order_shaper turn the intent into an ExecutionPlan.
Signing — The signer service produces a SignedOrderRequest using EIP-712 v2 and the configured builderCode.
Submission — The signed request is posted to the CLOB v2 endpoint. The Order Lifecycle Manager owns the order from this point on.
Lifecycle — exec.order_lifecycle_manager handles fills, partials, amends, cancels and timeouts. Every event emits a ReportEnvelope.
Reconciliation — gov.reconciler matches on-chain state to internal state on a heartbeat. Any mismatch fires GOV_RECONCILE_MISMATCH and may trigger the kill switch.
Audit — Every step is recorded by gov.audit_log with the correlation ID. The full trail is replayable by gov.replay_simulator.

Latency budgets along the path

Hop	Target	Hard cap
Signal → MarketSnapshot	< 100 ms	250 ms
Strategy decide()	< 50 ms	200 ms
Full Risk pipeline	< 50 ms	150 ms
Execution shaping	< 100 ms	300 ms
Signing	impl-dependent	500 ms
Full intent → on-chain	< 500 ms	1500 ms (kill switch arms beyond this)

What can short-circuit

Kill switch. Active state means the pipeline halts at step 4 every time, regardless of intent.
Stale book. If the OrderBookSnapshot is older than its budget, Risk emits RISK_STALE_BOOK and the pipeline halts.
Market halted. The Market Halt Detector emits RISK_MARKET_HALTED before any other Risk bot runs.
Wallet funding short. The Wallet Funding Guard halts at signing time with SEC_WALLET_FUNDING_SHORT.