When the engine stops
The algorithm runs itself. But in three cases it asks the operator, and in one more it simply lies down. A walk-through of how the HIL queue, strategy modes, and the kill switch fit together — and where the line between them is.
The most contradictory promise any algorithmic stack makes goes like this: “you control the capital, but you don’t have to do anything with your hands.” It reads well, it falls apart in practice. If the algorithm really asks the operator for nothing, the operator is dead weight. If it asks on every decision, you’re back to the ninety buttons we left behind.
The line gets drawn in three layers. First — strategy modes. Second — the HIL queue for specific events. Third — the kill switch as the emergency brake. Each layer covers a different class of situations and exists exactly because over five years we got burned a few times when one of them was missing.
Modes: the coarse volume knob
Every strategy has five states: NORMAL, CAUTIOUS, MANUAL, PAUSED, EMERGENCY. The engine behaves differently in each.
In NORMAL the strategy lives on its own. It computes signals, reallocates weights, ships orders in maker mode, freezes capital deployment under the drawdown throttle. The operator looks at the equity curve once a week and usually does nothing.
CAUTIOUS is the paranoia setting. Same actions, but any rebalance with a capital move above a threshold lands in the HIL queue. The strategy keeps trading; only the big shifts wait for approval. We turn this on ahead of FOMC, ahead of NFP, or after a bad night.
MANUAL means the strategy stops opening new positions but keeps managing the existing ones. Handy when you want to top up or bleed off exposure by hand without killing the strategy entirely. Standing stops and take-profits remain active.
PAUSED is a full stop. No new trades, no rebalances. Open positions sit as-is until an explicit command. This is the mode for trips, holidays, venue migrations, or for the case when you just want to watch the market without your hands in it.
EMERGENCY is automatic PAUSED plus force-close across all open positions. The algorithm triggers it itself in three cases: the kill switch is engaged, the smoothed drawdown crosses −15%, or the venue returns 5+ errors in a single tick. Exiting EMERGENCY is manual only, with an explicit admin approval.
The HIL queue: where your “yes” lives
The HIL queue isn’t “the operator stares at every order.” It’s where specific classes of decisions land — the ones we decided are too weighty for the automaton.
There are four. Any capital movement between cash, the portfolio side, and trading above a threshold — there. Any portfolio rebalance moving one asset’s weight by more than N percentage points in a single tick — there. Any breach of a manual limit you set yourself — there. And any attempt by the strategy to step outside its predefined exposure bands — there too.
The queue lives in the dashboard and in your Claude chat in parallel.
The dashboard shows cards with the proposed action, old and new
values, and the engine’s reasoning. In Claude you can pull the same
queue with list_pending_approvals and resolve a specific one through
approve_trade. The decisions land in audit_log with a marker for
where they came from — a button or a chat line.
What matters: while an approval is pending, the strategy keeps going. It doesn’t block other trades and doesn’t slow the other engines. The specific action that hit a limit waits; everything else moves.
Kill switch: the emergency brake
The kill switch isn’t a mode. It’s a global flag that flips a strategy (or all of them at once) into EMERGENCY with force-close. You engage it in one case — when something looks wrong and you’ll sort it out later.
Architecturally the kill switch is one row in the database with two
fields: engaged: bool and reason: string. Every engine tick reads
that field before any signals or trading actions. If the flag is up,
the engine first closes positions at market (with a chat
notification), then stops. No ordering issues, no race conditions.
Engaging is operator-or-admin. Resetting is admin-only and only after an explicit command with a recorded reason. This is deliberate: you can stop the system with one motion, you restart it with two hands and a clear head.
Where the line falls
The hardest design question is what the algorithm should decide on its own and what should land on the operator. We arrived at a simple rule. The algorithm decides everything that fits inside predefined bands — weight ranges, margin limits, turnover caps. The operator steps in when an action wants to leave those bands, or when the bands themselves need to move.
In responsibility terms: methodology owns the trade-by-trade decisions inside the bands. The operator owns the bands and any change to them. An algorithm with no bands is autotrading; bands with no algorithm are an electronic broker. inite.fund sits between the two.
One last thing. If a week passes with no approval in the HIL queue, that doesn’t mean you’re not needed. It means the engine is calibrated right. The average inite.fund operator confirms 2-4 actions a week; if it gets higher, we revisit the bands. If it gets lower, we revisit them too — a system that never asks is usually not one you want to hold money in.
— inite team
- 2026-05-11A ledger you can't quietly rewrite
Every capital flow, every approval, every mode change lands in an audit log with a hash chain. Why this matters in trading software, and how to verify integrity in under a minute.
- 2026-05-06Drawdown as a throttle, not a brake
Why the long sleeve cuts risk at −8% — well before the −15% target band — and why the cut is partial rather than total. The math, the philosophy, and the edge cases that broke our first three designs.
- 2026-05-03The regime engine, in one note
What sits at the heart of the balanced sleeve: a three-state HMM on a hand-picked observation vector, with regime-conditional exposure ceilings instead of regime-conditional bets.