Hardening P1-P4: eyes, brakes, adverse selection, Bayesian brain

[arena-ai-coding-agent]

Four protective layers over the ultra-low-latency hot path (tick-to-wire < 50 µs objective; layered steady-path overhead ≈ +0.33 µs p50, far inside the +5 µs P99 budget). No existing module removed or renamed — pure extension.

P1 Eyes — private user WSS accounting (AccountEvent), lock-free PositionTracker (net qty, VWAP entry, open qty per order), pre-fire reservation checks, periodic REST reconciliation with kill-switch latch on drift.
P2 Brakes — always-on RiskManager: market/portfolio exposure caps, stop-loss on liquidation mark vs VWAP, hedge on the complement token with real-time unrealized P&L, daily-loss kill switch that freezes and cancels.
P3 Adverse selection — VolatilityGate (spread width + mid-change rate regimes) driven dynamic pre-signed ladder TTL, >5%/100 ms mid-jump shock cooldown, slippage gate vs current mid (rejects stale/toxic slots pre-signature).
P4 Brain — closed-form Bayesian engine (Beta-Binomial from mid-seeded prior, Dirichlet-Multinomial, sigmoid log-LR shifts): posterior update ≈ 41 ns p50 / read ≈ 39 ns p50, no heap/virtuals. Cold-thread NDJSON evidence ingestion + hot-reloadable source reliability; trusted evidence (prior 0.40 → 0.557) emits exactly one BAYES_SIGNAL through the same pipeline as alpha (brakes/TTL/slippage all apply); sub-floor reliability is gated and journaled.

Paper trading honesty — BOT_MODE=mock now synthesizes venue fills for accepted mock orders into the account queue and feeds a tight, continuously refreshed book: tracker, brakes and brain observe real flow end to end (30 s smoke: 149 orders/149 fills, 1 BAYES_SIGNAL, 0 tracker anomalies, sell-before-fill correctly gated).

Verification: 4/4 ctest green; check_latency.py 7/7 budgets pass; docs updated (CONFIGURATION P4 table, PERF baseline F3/F4 sections, README status).

---

Summary by cubic

Adds four protective layers over the ultra-low-latency hot path, with no existing module removed or renamed: private user-channel accounting with venue reconciliation (P1), an always-on risk manager with stop-loss/hedging and a daily-loss kill switch (P2), an adverse-selection volatility gate with dynamic ladder TTL and shock cooldowns (P3), and a closed-form Bayesian signal engine with NDJSON evidence ingestion (P4). Layered overhead is ~+0.33 µs p50, inside the +5 µs P99 budget.

P1-P3: accounting, brakes, adverse selection

• Private user WebSocket normalizes to fixed-point account events; a lock-free position tracker handles reservations, VWAP entry, and periodic REST reconciliation that latches a kill switch on drift.
• Risk manager caps exposure, triggers stop-loss on liquidation mark vs VWAP, hedges on the complement token, and freezes and cancels on daily loss.
• Volatility gate tightens pre-signed ladder TTL, cooldowns >5%/100 ms mid jumps, and rejects stale/toxic slots against the current mid before signing.

P4: Bayesian brain and paper trading

• Closed-form Bayesian engine (Beta-Binomial mid-seeded prior, Dirichlet-Multinomial, sigmoid log-LR shifts): ~41 ns update / ~39 ns read, no heap, no virtuals; trusted evidence emits exactly one BAYES_SIGNAL through the same pipeline as alpha.
• Cold-thread NDJSON evidence ingestion with hot-reloadable source reliability; below-floor reliability is gated and journaled.
• BOT_MODE=mock now synthesizes venue fills and a continuously refreshed book so tracker, brakes, and brain observe real flow end to end.

Verification: 4/4 ctest green, 7/7 latency budgets pass, docs updated.

^{Written for commit 1d25514. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c9b8bcbe-c922-46b5-8769-efc79a4e67f1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Autopilot could not be updated. Open Coding to check access and billing.