Risk in practice
The implemented companion to Invest's conceptual risk controls. Two equity-relative ruin fences, a final-submit backstop, deterministic sizing that ignores model confidence, fail-closed operator knobs, and a plain statement of which controls are armed and which run shadow-first.
The companion to risk controls
Risk controls describes what Invest's controls are for. This page describes how they are built, at the level the private-preview paper system implements them. The boundary is unchanged: paper trading only, and nothing here is investment advice.
Two ruin fences keyed to equity
The centerpieces are two equity-relative ruin fences that compare a trade's planned maximum loss against net liquidation. The per-trade ceiling is set at 25% of equity in the owner model, defaults to armed, and is designed tighten-only: the environment may lower it, and there is no disarm path. The aggregate fence caps the gross sum of planned losses at 100% of equity, and it fails closed when the book cannot be priced. An unpriceable position is treated as risk the system does not get to carry.
Immediately before native order construction, a final-submit backstop re-checks planned risk post-sizing. Its job is to catch drift between sizing and submission. It exempts exposure-reducing intents: close, roll, hedge, and flatten are never blocked by a fence whose purpose is limiting new exposure.
Portfolio breakers and the paper profile
Daily-loss and drawdown-from-peak breakers resolve from the trading profile knob and are physically matched against the Interactive Brokers mode and port agreement. The paper profile relaxes capacity and exposure caps relative to a live one but keeps the quality and feasibility checks. Operator knobs live in Redis and fail closed when absent or malformed: an absent kill switch blocks, absent heat means no sizing, and the trading profile must match the broker mode.
Sizing ignores confidence
Sizing is deterministic: bankroll scaled by the edge-to-loss ratio, a Kelly fraction, and a heat factor, then re-expressed on a buying-power basis. It deliberately does not read the grader's confidence in the proposal. That separation is pinned as a design invariant: the model's certainty may influence whether a proposal exists, never how large it becomes. Rejections from the evaluate_trade validator carry explicit codes (kill switch, liquidity breach, undefined risk, insufficient buying power, aggregate and per-trade risk breaches, macro event pause, unknown strategy, options level), so a blocked entry is always explainable.
Armed and shadow, stated plainly
Several named controls are shadow-first by design: they observe and record rather than veto. The regime gate, the concentration gate, and the loop breaker run this way, and the console is designed to refuse setting the loop breaker to enforce. The deployment governor is documented in shadow terms as well. Treat these as instrumentation on the way to enforcement, not as enforcement.
Exits get different treatment from entries. Before each automated close leg, a lifecycle ruin-fence backstop blocks only legs that would increase unbounded upside exposure, and evidence-availability failures fail open by design so a position is never trapped by a missing feed. At fill time, a naked-short guard re-checks net exposure per underlying. And when everything else is in question, the process stop remains the only fully verified emergency stop: kill-switch enforcement reads an in-process snapshot, so stopping the process is the definitive halt.
Implemented controls are still paper-phase controls. Their presence is not a guarantee of safety, performance, or suitability for live trading, and Invest makes no claim of readiness for real money.