Polytraders Dev Guide
internal
Phase 1 · 9/109 wired

AI assist

Users need help deciding what to trade, placing it well, and understanding what they are holding. Three AI surfaces cover those needs. All three are advisory: they produce typed suggestions that enter the same RiskGate as any other intent. None of them can sign anything.

The rule that makes the rest safe. AI never holds Trade authority. There is no code path from a model response to a signed order that skips the guardrail chain. A model that is wrong, manipulated, or hallucinating is then a bad suggestion — annoying, not catastrophic.

What exists today

Worth being honest about the starting point: the only AI in the system now is the parameter optimiser (random, Bayesian TPE, and an LLM-driven mode) plus one entity-resolution bot that matches equivalent questions across venues. Neither is a user-facing assistant. All three surfaces below are new work.

Surface A — trade determination

Answers: "I don't know what to trade."

Takes the user's stated interest and the current market state, and returns a ranked candidate list with reasoning. It does not decide; it shortlists, and every item is traceable to the data that produced it.

interface TradeSuggestion {
  marketId: string;              // must resolve; hallucinated ids hard-reject
  side: "buy" | "sell";
  conviction: number;            // 0..1, calibrated, not vibes
  rationale: string;             // plain English, shown verbatim to the user
  evidence: Array<{             // REQUIRED. No evidence ⇒ no suggestion
    kind: "signal" | "book" | "news" | "resolution_rule";
    ref: string;                 // signal name, snapshot id, article id
    observedAt: number;
  }>;
  suggestedSizePctOfBankroll?: number;   // a hint; the chain decides
  modelVersion: string;          // pinned, logged, comparable over time
}

Rules

Surface B — placement assistance

Answers: "How do I actually get this on without paying up?"

Given an approved intent, suggests how to work it: passive or aggressive, one clip or several, limit placement relative to the touch, timing around known events. Bounded by construction — it operates strictly inside the envelope the chain already approved.

MayMay not
Suggest a limit price inside the approved band.Suggest a price outside the band.
Suggest splitting into clips.Increase total size beyond the approved figure.
Suggest waiting for depth or after an event.Delay past the intent's validity window without re-proposing.
Suggest passive vs. aggressive posture.Change side or market.
Explain the expected cost of each option.Assert a fill probability as a fact.

Overlaps deliberately with exec.smartrouter and exec.antitoxicfill. Those are deterministic and stay authoritative. Surface B explains and proposes alternatives; it does not replace them. When they disagree, the deterministic utility wins and the disagreement is logged — that log is how we find out whether the model is adding anything.

Surface C — position, correlation, and risk monitoring

Answers: "What am I actually holding, and what could hurt me?"

Read-only, Governance authority, and the surface users will value most. Turns a position set into something a human can act on.

Read-only means read-only. Surface C may recommend flattening and may offer the user a button that creates a proposal. It may not act, and it may not be wired to a scheduler that acts on its behalf. An automated de-risking loop driven by model output is a Trade-authority AI wearing a monitoring costume.

Failure modes, and what we do about them

FailureLooks likeControl
Prompt injection via market text Market titles, resolution rules, and news are attacker-controlled text arriving in a prompt. Treat all market-derived text as untrusted data, never instructions. Structured extraction only. Never let retrieved text alter tool-calling behaviour.
Hallucinated market ids A plausible id that does not exist, or exists and is the wrong market. Registry validation before display. Never construct an id from model output.
Silent model drift A provider updates a model; behaviour changes with no code change. Pin versions. Log modelVersion on every suggestion. A held-out suite runs on every version change.
Overconfidence Conviction that does not track outcomes; users size on it. Calibration tracking as a first-class metric. Suppress the surface if calibration degrades.
Correlated advice Every user gets the same suggestion; they crowd the same side and become each other's adverse selection. Monitor suggestion concentration across users. This is a platform-level risk with no per-user symptom.
Cost and latency blowout A monitoring loop that calls a model per position per tick. Hard per-user budgets. Cache aggressively. Deterministic checks first; the model only explains what they found.
Advice that looks like a recommendation Regulatory and expectation risk from confident phrasing. Fixed framing rules. Always show evidence. Never state a price or an outcome as certain.

Where AI must not be used

the four invariants · these are not negotiable

  1. 1

    The platform never holds user funds.

    Keys stay in the user's wallet. There is no platform-controlled omnibus account, no internal ledger of custodied balances, and no code path that can move a user's assets without a signature the user authorised. If a feature needs custody to work, it does not ship.

  2. 2

    A user bot never reaches the venue directly.

    User-authored logic produces a proposal. It never holds a venue client, an API key, or a signer. Exactly one component signs and submits, and it is ours.

  3. 3

    Guardrails cannot be configured away.

    The user tunes thresholds inside bounds we set. The user cannot remove a guardrail from the chain, reorder the chain, or lower a hard cap below the platform floor.

  4. 4

    AI never holds Trade authority.

    Model output is advisory. An AI suggestion enters the same RiskGate as any bot intent and is subject to the same rejects. There is no path from a model response to a signed order that skips the chain.

If a design requires breaking one of these, the design is wrong. Escalate before writing code — do not work around it. See RiskGate and the signing model.