Execution Gates & Multi-Stage Filtering
Every trade in TRADEOS.tech must pass through a series of independent gates before an order is submitted. No single gate is sufficient on its own — the design assumes each gate will sometimes produce false positives, and only signals that satisfy all layers are trusted enough to execute.
This page describes each gate in detail: what it checks, why it exists, and what happens when a signal fails.
Signal Event
│
▼
[Gate 1] Regime Gate ← Is the current market regime compatible?
│
▼
[Gate 2] Ingestion Lag Gate ← Is market data fresh enough to trust?
│
▼
[Gate 3] Drawdown Signal Gate ← Has the drawdown breaker locked entries?
│
▼
[Gate 4] Infra Circuit Breaker← Are downstream services healthy?
│
▼
[Gate 5] Quality Score Gate ← Does this signal meet the minimum quality bar?
│
▼
[Gate 6] Confluence Gate ← Do multiple independent sub-models agree?
│
▼
[Gate 7] Opposing Signal Gate ← Is there a conflicting directional signal?
│
▼
[Gate 8] Composite Score Gate ← What size tier does the composite score map to?
│
▼
[Gate 9] Feasibility Gate ← Does the portfolio have capacity for this trade?
│
▼
Execution
Gate 1 — Regime Gate
What it checks: Is the current market regime one where this signal type is allowed to trade?
The HMM regime classifier continuously labels market conditions as one of five states: TRENDING_UP, TRENDING_DOWN, MEAN_REVERTING, HIGH_VOLATILITY, or CRASH. Each signal type has a set of compatible regimes. If the current regime is not in that set, the signal is rejected at this gate — before any further processing.
Why it exists: Strategies that perform in trending markets lose money in choppy ones, and vice versa. A momentum signal in a MEAN_REVERTING regime is not just low-quality — it is actively contra-indicated. Regime gating prevents the system from applying the right strategy in the wrong environment.
Additional check — BOCD stability: The Bayesian Online Changepoint Detector runs in parallel with the HMM. When BOCD detects elevated change-point probability, a gate suppression flag is set, blocking new entries even if the HMM has not yet transitioned. This provides early warning of regime transitions before they are fully confirmed.
On failure: Signal is dropped. Rejection is logged with the gate name and failure reason.
Gate 2 — Ingestion Lag Gate
What it checks: Is the market data feeding this signal fresh, or has the ingestion pipeline fallen behind?
The ingestion lag circuit breaker tracks the age of the most recent market data tick per symbol. If data has not arrived within a configurable lag threshold, the gate trips. New entries on that symbol are blocked until fresh data resumes.
Why it exists: A signal computed on stale data is not a signal about current market conditions — it is a signal about what the market was doing minutes ago. Acting on stale signals is one of the most dangerous failure modes in live trading. The lag gate is a hard stop: no data, no trades.
On failure: Signal is dropped. Rejection is logged with the gate name and failure reason.
Gate 3 — Drawdown Signal Gate
What it checks: Has the DrawdownBreaker reached a trip threshold that suspends new entries?
The DrawdownBreaker tracks rolling equity against a high-water mark. When drawdown exceeds a threshold, it trips and publishes a lock event. The DrawdownSignalGate subscribes to these events and freezes new signal processing until the cooldown expires or the breaker resets.
Escalation: The breaker operates in multiple trip tiers per session. Each successive trip tightens the conditions for the next. After the final tier is reached, an extended lockout is imposed — no new entries regardless of market conditions. Specific tier thresholds and lockout durations are proprietary.
Persistence: The gate state is stored in the distributed state store and survives service restarts. A restart does not reset the lockout.
Why it exists: A system that keeps entering new positions while it is in active drawdown is compounding losses. The drawdown gate forces a pause, allowing the system (and the operator) to assess conditions before resuming.
On failure: Signal is dropped. Rejection is logged with the gate name and failure reason.
Gate 4 — Infrastructure Circuit Breaker
What it checks: Are the downstream services TRADEOS.tech depends on healthy and reachable?
The infra circuit breaker monitors the health of critical dependencies: the execution service, Redis, the order management layer, and exchange connectivity. If any critical dependency is unhealthy, the gate opens and new signals are held rather than processed.
Why it exists: Submitting a trade when the execution service is degraded or Redis is unreachable can result in orphaned positions — orders that were submitted but whose state cannot be tracked. A fail-closed posture is safer: when infrastructure is uncertain, do nothing.
Fail-closed by default: If the circuit breaker cannot determine service health (e.g., health checks are timing out), it defaults to treating the service as unhealthy. It does not give systems the benefit of the doubt.
On failure: Signal is held or dropped. Rejection is logged with the gate name and failure reason.
Gate 5 — Quality Score Gate
What it checks: Does this signal meet the minimum quality threshold for the active strategy profile?
The quality scorer computes a composite quality score (0.0–1.0) incorporating:
- IC multiplier — live Information Coefficient performance for this signal type
- Calibration score — how well stated confidence matches realized win rates
- Regime fit — is the current regime historically favorable for this signal type?
- Confluence velocity — is this signal type arriving in a meaningful burst?
- Sample sufficiency — is there enough live history to trust quality estimates?
Each strategy profile defines a minimum quality threshold. Signals scoring below this threshold are rejected before consuming resources in the confluence gate.
Why it exists: Not all signals from a given generator are equally good. A momentum signal in perfect regime alignment with a high IC history is materially better than the same signal type in a neutral regime with limited history. The quality gate prevents the confluence gate from wasting computation on signals that are already known to be below the bar.
On failure: Signal dropped. Rejection is logged with the gate name and failure reason.
Gate 6 — Confluence Gate
What it checks: Do multiple independent alpha sub-models agree on this direction?
The confluence gate is the primary noise filter. A single indicator firing in isolation is never sufficient to generate a trade. The gate requires:
- A minimum number of independent sub-models producing the same direction
- An aggregate directional score above a threshold
- No unresolved opposing signal conflict at this stage (pre-resolution)
Sub-models are treated as independent when they draw from different data categories: price-based models, order-flow models, on-chain models, and macro/funding models. Agreement across categories is weighted more heavily than agreement within a single category.
Why it exists: Individual indicators are noisy. The probability that multiple independent models all misfire in the same direction simultaneously is far lower than the probability that a single model misfires. Requiring confluence is the single most effective way to reduce the false positive rate.
On failure: Signal dropped. Rejection is logged with the gate name and failure reason.
Gate 7 — Opposing Signal Gate
What it checks: Is there an active signal in the opposite direction on the same instrument?
If a long signal and a short signal exist simultaneously for the same symbol, the system evaluates both. Where confidence levels are similar (within the opposition threshold), both signals are suppressed — the system treats disagreement as uncertainty. Where one direction dominates, the weaker signal is dropped.
Why it exists: When the system's own models disagree on direction, that disagreement is informative. It means the evidence is ambiguous. Trading into ambiguity increases variance without increasing expected return.
On failure: Both signals dropped if confidence is balanced. Weaker signal dropped if one dominates. Rejection is logged with the gate name and failure reason.
Gate 8 — Composite Score Gate
What it checks: What position size tier does the combined signal score justify?
Signals that pass all prior gates are assigned a final composite score. This score is used to map the trade to a size tier:
| Score Range | Size Tier | Position Size |
|---|---|---|
| High | Full | Profile max position size |
| Medium | Reduced | Fraction of max (profile-defined) |
| Low-pass | Minimal | Minimum viable size |
Signals scoring below the absolute minimum threshold are rejected at this gate even if they passed all prior filters.
Why it exists: Not all signals that pass quality and confluence filters are equally strong. The composite gate ensures that position sizing reflects the actual strength of the signal — strong signals get full conviction, borderline signals get partial exposure. Sizing is a continuous expression of confidence, not binary.
On failure: If below absolute minimum, signal dropped. Rejection is logged with the gate name and failure reason.
Gate 9 — Feasibility Gate
What it checks: Does the current portfolio state have capacity to execute this trade at the proposed size?
The feasibility service is the final validation layer before order submission. It checks:
- Capital availability — is there sufficient free margin for the proposed size?
- Concentration limits — would this trade push exposure to a single instrument above the limit?
- Correlation exposure — would adding this position increase portfolio-level correlation risk beyond the threshold?
- Market impact — using the Almgren-Chriss model, does the impact-adjusted expected value remain positive at the proposed size? If not, the size is reduced until it does, or the trade is rejected.
- Minimum viable size — if the impact-adjusted size falls below the minimum viable threshold, the trade is rejected outright rather than executed at a negligible size.
Why it exists: A signal can be high quality and well-timed but still wrong for the current portfolio. If the portfolio is already heavily concentrated in correlated instruments, adding more correlated exposure increases drawdown risk even when the individual signal is sound.
On failure: Trade rejected or size reduced. Rejection is logged with the gate name and the specific check that failed.
The Fail-Closed Philosophy
Every gate in this pipeline defaults to rejecting rather than approving when its state is uncertain. If the regime classifier has not yet converged, it defaults to blocking. If the infra health check is ambiguous, it defaults to unhealthy. If quality data is insufficient to compute a reliable score, it defaults to below-threshold.
This is intentional. Missing a trade that would have been profitable is an acceptable cost. Executing a trade in adverse conditions with degraded data and unhealthy infrastructure is not.
The gates are not hurdles designed to be cleared — they are independent perspectives, each asking a different question about whether the market, the system, and the portfolio are in the right state to trade. A signal that satisfies all nine questions simultaneously is genuinely high conviction.