desk-autonomy-policy

Copy template/autonomy.json to your desk root and edit mode, account, and limits yourself; no agent may write it. Every ticket is then checked by policy_gate.py against those limits and live account state before desk_send.py may sign anything.

The gate verifies mode, network, account, halt status, ticket expiry and age, market, leverage, slippage, risk arithmetic, equity freshness, per-trade and total open risk, position count, daily loss, rate limits, cooldown, and origin. A PASS writes a signed approval JSON valid for ten minutes.

A failed gate exits with code 1 and prints the failed check names on the last line, such as risk-per-trade, daily-loss, or cooldown. An unavailable account read exits with code 2 and is never treated as a pass.

Yes. While halted, entry tickets fail the halt gate, but close, protect, and cancel tickets still pass so the desk can always get flat. Only the user may resume, from their own terminal; agents are denied the resume command.

Ceilings are 1% risk per trade, 4% total open risk, 10x leverage, 6 positions, a -5% daily loss stop, 10 sends per hour and 60 per day, 50 bps slippage, and 30-minute ticket age. A policy set looser than any ceiling is invalid as a whole.

No. The gate is arithmetic, not a judge of ideas; it only guarantees nothing is sent outside the written limits, on the wrong network, past the loss stop, or twice for one ticket. It cannot make a bad strategy good or stop an agent acting outside the scripts.