Reliability & execution integrity

Clawlas operates in markets where venues, contracts and APIs change within seconds. A provider failure, a duplicated job or a malicious token must never bypass deterministic limits. These rules are enforced in code, around — not inside — the AI layer.

Idempotency

Every execution request carries an idempotency key(the order’s client_order_id, or a content hash on-chain). A network timeout must never cause a second order before the first attempt is reconciled — the engine looks up the key, finds the in-flight attempt and resolves it rather than re-submitting.

On boot, the engine reconciles open state against the real exchange and wallet accounts, so a crash or restart mid-order never duplicates a position or loses track of a fill.

Reconciliation after every execution

A successful API response is not a confirmed fill, and a landed transaction is not a known position. After every execution the engine independently verifies each of these from the venue or chain — never from the LLM that proposed the trade:

• order status
• fills
• average price
• fees
• balance changes
• transaction confirmation
• acquired token amount
• residual allowance
• position state

Any discrepancy beyond tolerance raises a reconciliation mismatch, which is both an alert and a circuit-breaker input. Realized fees, slippage and gas are written to trade_costs so net PnL reflects what actually happened, not what was quoted.

Stale-data blocking

A trade is blocked the moment any input becomes unreliable:

• the price timestamp is too old, or the order book has not updated within tolerance;
• the RPC is behind head, or the quote has expired;
• pool state changed materially, or liquidity dropped below the strategy minimum;
• a provider returns values inconsistent with its peers, or exchange status is degraded.

Blocking is deterministic and fail-closed: when freshness cannot be proven, the order does not leave. Stale-data duration is itself a circuit breaker — a feed that stays stale escalates from blocking one trade to halting the strategy.

Circuit breakers

Independent breakers halt activity before damage compounds:

• max daily loss
• max loss per strategy
• max consecutive losses
• max failed transactions
• max reconciliation mismatch
• max provider error rate
• max API spend
• max slippage deviation
• abnormal wallet-balance change
• stale-data duration
• chain / exchange incident
• global manual kill switch

Budgets separated by importance

Cost controls degrade non-critical work first; execution safety is the last thing to go. The same thresholds the cost-control engine enforces never touch reconciliation or risk:

unproven freshness   → block
unreconciled attempt → no re-submit
breaker tripped      → halt scope, alert, require human
research budget gone → analysis stops, monitoring continues