Last Updated: 2026-10-26
Updated 26 October 2026. Illustrative engineering design, not a report of a deployed profitable system.
A model output is only one input to a trading system. The harder question is whether an instruction still describes the account and market when it reaches execution. This design keeps the useful separation between data, features, signals, risk, execution and monitoring, while making their failure contracts explicit. It starts with recorded data and simulated orders; it is not a live bot installation guide.
Six responsibilities do not require six servers
Begin with separately testable modules and a single accountable execution writer. Separate processes when isolation or throughput justifies their operational cost. A queue and more services introduce replay, ordering and recovery problems as well as isolation.
Scroll sideways to see every column. Keyboard: focus the table region and use the arrow keys.
| Module | Record it owns | Condition that blocks a new instruction |
|---|---|---|
| Market data | Venue, instrument, event time, receive time, sequence and gaps | Missing sequence or stale observation |
| Features | Input range, availability time, schema and transformation version | Incomplete window or incompatible schema |
| Signals | Model/version, input IDs, target and expiry | Expired input or an unapproved model version |
| Risk | Account snapshot, current exposure, limits and decision reason | Unknown positions, unresolved orders or stale balance |
| Execution | Intent ID, request, venue acknowledgement and fills | Unreconciled earlier request or invalid instrument constraints |
| Monitor | Age, gaps, rejected intents and recovery state | Cannot establish the system's actual state |
The monitor should distinguish “no signal,” “input unavailable” and “request outcome unknown.” A green process heartbeat does not mean the data is current. A risk approval also needs expiry: a valid decision can become obsolete while waiting in a queue.
A failure trace with an explicit outcome
Synthetic timeline: a feature snapshot is available at 12:00:00; an intent expires at 12:00:05. Execution receives it at 12:00:07. Reject the expired intent. Do not keep trading on the “last good signal” merely because the feature process stopped. Five seconds is an arbitrary fixture value, not a suitable limit for every strategy.
Now suppose a different request was sent before expiry and its response timed out. The local state is unknown, not rejected. Preserve its stable client/request identifier and reconcile venue orders, fills and balances before deciding whether another submission is needed. Blindly retrying a market order can duplicate exposure. A process restart must preserve this unresolved state rather than reset it to “ready.”
Preventing new orders does not cancel resting orders or close existing positions. Those require separately specified, reconciled actions. A cancellation timeout is also unknown. No restart policy or local loss threshold guarantees a maximum account loss during gaps, custody failure or liquidation.
Delivery is not execution
Redis documents Pub/Sub as at-most-once delivery: a disconnected subscriber can lose a message. Do not treat a notification channel as the only order ledger. Persist intent and processing state; define replay, acknowledgement, deduplication and retention explicitly. A queue acknowledgement by itself does not prove that a venue accepted or filled an order. A durable message design still needs account reconciliation.
For a small offline prototype, an append-only event record and a single writer can make the state transitions easier to inspect. Production durability, concurrent writers, crash recovery and venue-specific idempotency need their own implementation and tests; this article does not supply them. The offline control fixture demonstrates a persistent halt and duplicate input handling without placing orders.
What belongs in the research record
Save the historical instrument universe, delisted assets, raw data revisions, timestamp definitions, missing periods, strategy version, all tried variants and the untouched evaluation window. A closing price is not available before that close; a next-bar open is not automatically an executable fill. Model spreads, depth, fees, partial fills, latency and rejection assumptions separately.
Fit preprocessing on training data only and reuse the fitted transformation on later data. Scikit-learn's leakage guidance explains why fitting transformations on test data contaminates evaluation. Time-ordered evaluation must also respect overlapping label windows. Shadow predictions can reveal operational differences, but simulated fills do not establish live execution quality or profitability.
Report returns with the denominator beside them. Synthetic example: a short with $10,000 notional receives 0.04% at each of three funding events: $12 before costs. If the combined hedge ties up $20,000, that is 0.06% of committed capital for that day, not 0.12%. Multiplying a fixed rate through a year is a scenario, not a forecast; funding can change sign, legs can diverge and collateral can be liquidated.
Evidence needed before calling it a working system
Keep reproducible fixtures for stale data, schema mismatch, duplicate intent, timeout after submission, partial fill, cancellation timeout, restart with an unresolved order, failed state persistence and a changed instrument tick size. Store expected state transitions and compare them with observed results. A screenshot of a rising equity curve cannot replace those records.
The build-versus-buy decision should include data licenses, monitoring, recovery labor and maintenance, not just a server bill. A custom system is useful when you need inspectable behavior and can support it. It has no inherent higher “edge potential,” minimum profitable capital or timetable to profitability. Stop at research if the operational or strategy evidence is inadequate.
Educational engineering material, not investment advice or an assurance of safety. Crypto trading can lose the full allocation or more where liabilities permit. AITR may earn commissions elsewhere on this site; no provider purchase is required for this offline design.