Kill Switch Runbook

Use this runbook when the trading stack must stop creating risk immediately.

When to Use

• drawdown or loss thresholds are escalating toward NO_NEW or FLATTEN
• broker API degradation makes order state unreliable
• data corruption or stale upstream inputs make signals untrustworthy
• reconciliation finds unknown or mismatched positions
• operator judgement says continuing to run is unsafe

Current System Reality

• The kill-switch logic lives inside qgtm_risk.manager.RiskManager
• The daemon escalates tiers from WARN to THROTTLE to NO_NEW to FLATTEN
• There is no dedicated public HTTP kill-switch endpoint in the current paper-first production path
• There is no standalone python -m qgtm_live.kill_switch command in the repo

Immediate Operator Actions

1. Stop the daemon

sudo systemctl stop qgtm-daemon

2. Confirm the control plane is no longer advancing

curl -sS https://api.qgtmai.com/api/v1/daemon/telemetry
curl -sS https://api.qgtmai.com/health

3. Cancel or flatten at the broker if exposure exists

• Use the Alpaca dashboard or broker tooling to cancel open orders
• Flatten any unwanted open positions directly at the broker if necessary

4. Keep live trading disabled before restart

Ensure the runtime configuration still keeps live trading gated off:

QGTM_LIVE_TRADING_ENABLED=false

5. Preserve evidence

• save daemon and API logs
• note the trigger reason
• capture positions, orders, and any reconciliation mismatch

Automated Kill-Switch Behavior

The daemon can escalate automatically based on:

1. daily loss limits
2. drawdown state
3. heartbeat/watchdog conditions
4. order or execution anomalies surfaced by the runtime

See qgtm_risk.manager and qgtm_live.daemon for the current code path.

Recovery

1. identify the root cause
2. verify orders and positions are reconciled
3. confirm market data and broker state are clean
4. review whether the system should restart in paper-only mode
5. document the incident before returning the daemon to service