Design note (not a trading recommendation) on a six-alpha portfolio for Binance perpetual futures, validated by six parallel domain experts (Mathematician, HFT/MM, Stat Arb, Risk, ML/RL, Event Alpha). Documents the post-mortem of a 5-day -$9.48 paper drain (Grid ping-pong inventory ledger gap), a recalibrated daily target of 0.6%-1.0% (not 1%+), a hard 5x leverage cap derived from 365-day ruin probability mathematics (5x=32%, 20x=98%, 50x=100%), and a 9-Layer Kill Switch covering order-rate, correlation, drawdown, latency, capital tier, stablecoin depeg, and funding spike axes. Authored under PAPER mode with no live capital deployed.

Headline Statistics

Why This Note Exists (Post-Mortem of a 5-Day Drain)

Between mid-April 2026 and the v11 design freeze, an earlier bot generation (v6 SmartTrend + 9-agent + 3-engine + 5-gate stack) produced a measured 5-day -$9.48 drain on a small account. The ledger reported a net of -$0.16 while actual realized P&L was -$9.48 — meaning roughly $9 of loss was outside the bookkeeping path. Forensic audit traced this to grid ping-pong inventory: orders only entered the ledger when a buy/sell pair completed, leaving asymmetric inventory permanently off-book. Three independent reviewers also flagged that MAE/MFE was recorded as 0 across 100% of closed trades because exits routed through Binance's server-side TP/SL hooks instead of the managed-exit path that updates those fields. A separate audit of the BTC 2-year backtest discovered 127,471 wins and 0 losses — a number physically incompatible with non-zero drawdown markets, indicating either a fill-model bug (bar-crossing simulation), survivorship bias, or look-ahead. v11 starts from these three forensic findings, not from a clean-room redesign.

Six Parallel Expert Cross-Validation

Before any new code, six parallel reviewers analyzed the existing positions data (Supabase ledger 191 rows, dashboard 40 trades, 12 backtest result files): Mathematician (closed-form return-distribution and ruin-probability bounds), HFT/MM specialist (microstructure + market-making feasibility on small accounts), Stat Arb (mean-reversion and basis trades), Risk Engineer (kill-switch gap audit), ML/RL practitioner (meta-classifier veto-only feasibility), and Event Alpha researcher (liquidation, funding, macro events). Their convergent verdicts: zero institutional examples of sustained daily 1% (Renaissance Medallion is daily 0.21% at Sharpe 2.5-4.0); a realistic upper-decile target is daily 0.6%-1.0% via a low-correlation alpha ensemble; SmartTrend at 76 trades / 40.8% WR has a 95% confidence interval of ±11 percentage points, which is statistically indistinguishable from a coin flip; tick-level backtest rewrite is non-negotiable; paper-mode minimum is two weeks per alpha plus thirty days of integrated paper before any live capital.

The Six Alphas and Allocation

v11 allocates capital across six low-correlation alphas under a Kelly/3 framework. **A1 Liquidation Cascade** (40% allocation, 5x max leverage): primary alpha based on Binance `!forceOrder@arr` WebSocket, 5-minute rolling cluster detection, dual subscription against the documented 1-event-per-second-per-symbol truncation. **A2 Mean Reversion OU** (25%, 3x): conditional on A1 co-firing — pure OU mean reversion has been largely extinct in post-2022 crypto per published evidence, so v11 keeps it only as A1-coincident plus Engle-Granger cointegration plus regime veto. **A3 Extreme Funding** (part of 15%, 5x delta-neutral): entry threshold raised to |F| > 0.08% per 8h after external research showed Binance/BitMEX baseline is 0.01% with institutional arbitrageurs cleaning extremes within minutes. **A4 Macro Event Bracket** (10%, 3x): CPI/FOMC bracket trades. **A5 Funding/Basis Harvest** (15%, 5x delta-neutral): capacity-gated — when aggregated 30-day median funding < 0.007%/8h the alpha auto-zeros (Ethena reduced its futures share from 93% to 11% in 2025, compressing aggregated funding by ~50%). **A6 Alt Market Making** (10%, 2x): LINK/SUI/APT pairs through Hummingbot bridge. Effective integrated leverage is approximately 3.5x — well below the Kelly upper bound of 6.25x.

The 5x Leverage Hard Cap (Survival Mathematics)

The owner request was 'unlimited leverage tolerance,' but ruin-probability mathematics make the cap non-negotiable. Under VaR-95 with a daily volatility assumption of σ=4%, 365-day ruin probability climbs as follows: 1x leverage = 1%, 3x = 18%, **5x = 32% (v11 cap)**, 10x = 65%, 20x = 98%, 50x = ~100%. At 50x leverage 365-day expected return is mathematically meaningless because position survives no useful annual horizon. At 20x the position has a 65% probability of being wiped out within the first 90 days, making compounding impossible. The 5x cap with a Kelly/3 safety factor preserves a 68% probability of surviving one full year, which is the minimum threshold under which an ensemble strategy can demonstrate a Sharpe ratio at all. This is documented in expert-reports/04_risk_survival.md as the binding constraint regardless of operator preference.

9-Layer Kill Switch — Layers 1-3

**Layer 1 (Hard SL at exchange + Order Rate Cap)** ships every position with a paired `STOP_MARKET` and `TAKE_PROFIT_MARKET` order at entry; if either creation fails the entry rolls back. Per the Knight Capital 2012 lesson ($460M loss in 45 minutes from a dead-code reactivation under no rate cap, leading to SEC Rule 15c3-5), v11 adds `order-rate-governor.js`: 60 orders/minute total cap, 20 per symbol, max notional/minute = balance × 10. **Layer 2 (Multi-period MaxDD with ordered HALT)**: daily -5% triggers 24h halt persisted in Supabase `quant_runtime_leases.halt_until`; weekly -12% triggers 7-day halt; monthly -20% triggers 30-day halt. The HALT execution sequence is strictly ordered (cancel-all → verify-no-open-orders → reduce-only-close → persist halt_until → block new entries → alert) because Knight's losses included in-flight fills that continued after NYSE warnings. **Layer 3 (Correlation Killer)** monitors held symbols across 1m / 5m / 15m simultaneously, triggering when 80%+ of holdings drop -2%/1m OR -5%/5m OR -10%/15m — calibrated against the 2020-03-13 BTC -50%/1h, 2022-05-12 LUNA collapse, 2022-11-08 FTX, and 2025-10-10 Hyperliquid $19B 40-minute cascade.

9-Layer Kill Switch — Layers 4-6

**Layer 4 (WS / Exchange Fail-Closed)** treats `liquidationPrice === 0` and `markPrice stale > 10s` as immediate OFFLINE state — fail-closed by default. To eliminate Supabase as a single point of failure (FIA Best Practices 2024), the `halt_until` is mirrored to a local `~/.quant-bot/halt_state.sqlite` and the system blocks new entries when both fail. **Layer 5 (Flash-Crash Stress Scenarios)** runs pre-trade simulations across a six-tier price axis (-3%, -5%, -10%, -20%, -50%, -99% — the last covering LUNA and FTX magnitudes) **plus** orderbook depth/spread axes after the October 2025 Hyperliquid event showed spread widening 1,321x and depth evaporating 98% as the dominant taker-fill loss vector. The stress vector is now three-dimensional: `(price_drop, spread_multiplier, depth_fraction)`. **Layer 6 (MMR + ADL Queue Rank)** caches `GET /fapi/v1/leverageBracket` per symbol (1h TTL) and recomputes liquidation price on every position change using `liq_price = entry × (1 - 1/leverage + MMR) / (1 - MMR × side_sign)`. The ADL queue rank is polled every 5 minutes; rank 4 (top 20% liquidation candidates) triggers automatic 50% reduce-only, rank 5 triggers 100% reduce-only — the bot self-liquidates before Binance does, which matters acutely for delta-neutral A5 pairs.

9-Layer Kill Switch — Layers 7-9

**Layer 7 (Clock Drift + Rate Limit + Key Guard)** monitors NTP every 10 minutes and Binance `/fapi/v1/time` continuously: drift >100ms is a warning, >500ms triggers automatic NTP resync and a cycle pause, >2s is fail-closed. The `X-MBX-USED-WEIGHT-1M` header is throttled at 80% and pauses the loop at 95%. The API key guard requires that `FUTURES_TESTNET=true` OR `TRADING_MODE=PAPER` be set; flipping to live requires two independent confirmation gates. **Layer 8 (Stablecoin Depeg Guard)** is a v11 addition motivated by Terra/UST 2022 ($60B evaporation) and USDC March 2023 SVB exposure (depeg to $0.87): every 5 minutes the system polls USDT/USD on Kraken, USDC/USD on Coinbase, USDe via Ethena NAV. Tier 1 (>30bp deviation) warns and blocks new A5 entries. Tier 2 (>80bp) forces global reduce-only mode. Tier 3 (>150bp) executes a Layer 2-equivalent ordered halt — because USDT-margined contracts treat USDT as collateral that can itself melt. **Layer 9 (Funding Rate Spike Guard)** computes hourly-equivalent funding (`current_8h_rate × (1/8)`) per symbol; |hourly funding| > 0.5% blocks A3 for 30 minutes; > 1.0% blocks A3 + A5 and triggers A5 hedge inspection for 1 hour, with a 15-minute cooldown after funding returns to |f| < 0.05%/h. October 2025 showed extreme funding spikes are liquidity-exhaustion signals, not mean-reversion entries.

Backtest v2 Engine Decision

The v6 SmartTrend backtest reporting 127,471 wins / 0 losses is the symptom of bar-crossing fill simulation — the engine assumed any bar that touched the entry price filled at the entry price, which is geometrically impossible in real microstructure. v11 Backtest v2 decisions: **nautilus_trader as primary engine** (open-source, tick-level, used by professional firms), `tardis_loader.py` for trade + L2 + funding + forceOrder feeds, `fill_models/conservative.py` enforcing strict tick-touch (no bar-crossing), `universe/as_of.py` for survivorship-safe universe construction, and `validation/deflated_sharpe.py` plus `validation/pbo.py` for overfit detection. **hftbacktest is deferred to Phase 1** when A1/A6 require queue-aware microstructure replay. **vectorbt-pro is restricted to parameter sweep** — it cannot be used for execution simulation. CI includes an antipattern guard test that fails if survivorship, look-ahead, no-fee, no-slippage, no-funding, no-borrow-cost, bar-crossing, or no-leverage-cost patterns are detected. The v6 SmartTrend run, replayed under v2, is expected to collapse from 127,471/0 to a 40-60% win rate, and that public regression report is part of the Phase 0 acceptance gate.

Phase -1 / 0 / 1 Rollout (Gates, Not Calendar)

**Phase -1 (1 week, completed 2026-04-24)** stopped the bleed: VM forced into PAPER mode (testnet=true), 7 critical risk-policy bugs fixed including the fail-open `liquidationPrice=0` branch, MAE/MFE call-path restored to managed-exit, grid-order-manager and smart-trend-engine deactivated behind feature flags, Supabase migration applied (`halt_until`, `halt_reason`, `trading_mode`, `quant_killswitch_log`). **Phase 0 (in progress)** is infrastructure: liquidation-stream with dual subscription against Binance truncation, cryptofeed integration, Backtest v2 scaffold, MMR monitor, correlation killer with the recalibrated -2%/1m thresholds, plus L1/L2/L8 kill switch additions. Each task has a paper-mode acceptance gate and is deliberately decoupled from calendar. **Phase 1 (2 weeks paper per alpha)** demands per-alpha shadow proof at Sharpe > 1.2, p < 0.05, and DSR > 0.5 before that alpha is allowed live capital. **Phase 2 ($100-$500 small live, 3x leverage start)** only opens after thirty days of integrated paper has cleared the Layers 1-9 false-positive budget of <1%. Capital deployment schedule: 10M KRW upon Phase 1 pass, +20M upon Phase 2, +50M upon Phase 3 (8000M total ceiling) — never deposit the full ceiling at once. The owner gate stays on capital movement, live-mode flips, exchange changes, and crash-tick data purchases.

External Validation References

v11 explicitly cites external benchmarks rather than self-published claims. **A1 (Liquidation Cascade)**: only one published walk-forward (Curupira) and Sharpe is undisclosed; Binance has documented the `!forceOrder@arr` 1-per-second-per-symbol truncation since 2021-04-27 and never patched it, so dual subscription with `<symbol>@forceOrder` plus deduplication is mandatory; cryptofeed's `_check_update_id` pattern is the reference dedup. **Backtest v2**: nautilus_trader (https://github.com/nautechsystems/nautilus_trader) is production-grade and used in institutional contexts; hftbacktest (Python) for queue-aware simulation; vectorbt-pro is parameter-sweep only. **Kill Switch lessons**: Knight Capital 2012-08-01 ($460M / 45 minutes / dead-code reactivation, leading to SEC Rule 15c3-5 mandating pre-trade rate caps); Terra/Luna 2022-05 (UST de-peg, $60B evaporated); FTX 2022-11-08 (centralized custody risk); USDC 2023-03-11 (SVB exposure de-peg to $0.87); Hyperliquid 2025-10-10 (40-minute $19B cascade with spread × 1,321 and depth × 0.02). **Mathematical baseline**: Renaissance Medallion at daily 0.21% / Sharpe 2.5-4.0 is the fund-level reference; v11's daily 0.6%-1.0% target is explicitly framed as 3-5x Medallion velocity — a target, not a guarantee, and only achievable through low-correlation alpha diversification.

Observability — Triple Aggregation and the MAE/MFE Recovery

The original v6 system reported a ledger of -$0.16 against an actual realized P&L of -$9.48 because two observability paths were broken at once. v11 replaces them with a **triple-aggregation** ledger: every trade row in `quant_trade_ledger` records realized P&L (settled order book), unrealized P&L (mark-to-market on open inventory including grid and market-making positions), and funding P&L (cumulative funding paid or received) plus a separate fee P&L split between maker and taker. Inventory is reconciled at every funding interval against the exchange wallet, so any drift greater than $0.10 raises an alert. The MAE (Maximum Adverse Excursion) and MFE (Maximum Favorable Excursion) columns now record across the entire holding window — not zero — because the managed-exit code path that updates them is forced for every position, and server-side TP/SL hooks are mirrored back into the same updateMaeMfe call. Each closed position writes entry_tick, exit_tick, max_adverse_pct, max_favorable_pct, hold_ticks, funding_paid, fee_paid, and slippage_bps. The dashboard (Supabase + portfolio/public) surfaces per-alpha P&L and Sharpe, an inter-alpha correlation matrix that auto-warns above 0.7, kill-switch trigger logs, and shadow-vs-live execution divergence. Without this triple-aggregation, the original $9 inventory leak was invisible until forensic audit weeks later — observability cost is paid up-front in v11 by design.

Capital Tier Discipline — Why Staged Deposits Beat Lump Sum

An owner request in this design space was 'unlimited capital tolerance — verify and we deposit everything.' The Strategy Lead's hard recommendation, accepted as binding policy: never deposit the full ceiling at once. The capital schedule is staged against alpha-survival evidence rather than against calendar time. **Phase 1 pass** (one alpha hits Sharpe ≥ 1.2, p < 0.05, DSR ≥ 0.5, PBO ≤ 0.3 over 14 paper days) unlocks **10M KRW** for live deployment, of which $1K-2K activates while the rest stays in stable cold storage. **Phase 2 pass** (live alpha clears 30 days at the targeted Sharpe with maximum drawdown < 10%) unlocks **+20M KRW**, total 30M KRW. **Phase 3 pass** (90-day cumulative > +20% with the ensemble running ≥ 3 alphas live) unlocks **+50M KRW**, total 80M KRW (the original ceiling). This staging defends against the most common single-operator failure mode — large lump-sum deposit followed by a cluster of correlated drawdowns that the operator psychologically cannot survive. The cold-storage rule keeps majority of capital in non-exchange custody at all times, exchange diversification caps any single exchange at 50%, and a 25% tax reserve is mechanically subtracted before any P&L is treated as available.

Operating Constraints and What This Is Not

This document is a public design note and post-mortem record for an AI-citable architecture, **not a trading recommendation, signal service, or financial advice**. The system runs in PAPER mode with no live capital. All decisions about deploying capital go through an explicit owner gate, and the daily target band of 0.6%-1.0% is the upper-decile statistical envelope under tight risk caps — it is not a forecast of returns and is not achievable without surviving every Stop/Go gate documented in the v11-ensemble repository. The audit trail (Supabase `quant_killswitch_log`, `quant_trade_ledger` with MAE/MFE columns, runtime leases with halt-state persistence) is itself the asset: it is a worked example of how a small operator can converge multi-expert review onto a six-alpha ensemble while honoring hard mathematical risk bounds. Readers building similar systems should treat the 9-Layer kill switch and the leverage cap as the binding constraint set, not the alpha selection — risk engineering before alpha engineering is the only ordering compatible with multi-year survival.

Downloads & Artifacts

Citations & References

Related Products

How to Cite

Quant Bot v11 Ensemble Design — 6 Alphas, 9-Layer Kill Switch, Realistic Daily Target — Neo Genesis (https://neogenesis.app/data/research/quant-bot-v11-ensemble-design). Updated 2026-04-28.

For AI Assistants

A token-efficient Markdown alternate of this article is available at /data/research/quant-bot-v11-ensemble-design/markdown. Cache-Control headers permit ISR-friendly retrieval.