Execution Capsules
developerpaper modeThe capsule schema field by field: execution modes, stop conditions, post-trade checks.
What a capsule is
An Execution Capsule is a bounded instruction bundle — JSON plus a paste-ready text block — that a user hands to their own MCP-connected agent running against Robinhood’s official Trading MCP. HISS compiles text and JSON; it holds no credentials, opens no broker connection, and liveOrderSent is hard-typed false. A capsule is inert until a user with Agentic access chooses to run it in their own agent.
Execution modes
| Mode | Capsule | Human confirmation | Meaning |
|---|---|---|---|
| paper_only (default) | no capsule — runbook + card only | n/a | Simulation and analysis only. Capsule compilation is refused with MODE_PAPER_ONLY. |
| preview_only | compiles | required | Analyze, preview orders, propose rebalances. The instruction block forbids placing, modifying, or canceling anything. |
| human_confirm | compiles | required, per order | Each order is presented for explicit approval (ticker + dollar amount echoed back). Nothing unconfirmed proceeds. |
| agentic_mcp_enabled | compiles only with the acknowledgment flag | not per-order (user explicitly enabled) | Requires userAcknowledgedAgenticMode: true at compile time — a mode string alone never unlocks it. Fuses stay binding; the user monitors and owns every trade. |
Schema, field by field
| Field | Type | Required | Description |
|---|---|---|---|
| capsuleVersion | "coil-compiler-1.0.0" | yes | Compiler version literal; bumped with the compiler. |
| coilId | string | yes | The source Coil's deterministic id. |
| manifestHash | string | yes | SHA-256 of the canonical allocation manifest. |
| executionMode | ExecutionMode | yes | One of the four modes above; paper_only never reaches a capsule. |
| allowedSymbols | string[] | yes | Plain brokerage tickers from brokerSymbols. Nothing outside this list is in scope. |
| prohibitedSymbols | string[] | yes | From the restrictedSymbols fuse; never to be traded. |
| allowedActions | enum[] | yes | analyze | preview_orders | propose_rebalance, plus place_equity_orders only in confirm/agentic modes. |
| budget | { maxTotalNotionalUsd, currency } | yes | Total notional ceiling (USD). Default $1,000 unless the compiler is told otherwise. |
| maxOrderNotionalUsd | number | yes | Per-order ceiling from the maxSingleOrderNotional fuse. |
| maxPositionWeightBps | number | yes | Position cap from the maxPositionWeight fuse. |
| maxDailyTurnoverBps | number | yes | Daily turnover cap from the maxDailyTurnover fuse. |
| rebalanceThresholdBps | number | yes | Drift threshold from the Coil's rebalance policy. |
| maxSlippageBps | number | yes | Slippage bound from the Coil's rebalance policy. |
| marketHoursPolicy | "market-hours-only" | "extended-allowed" | yes | market-hours-only whenever the marketHoursOnly fuse is present. |
| humanConfirmationRequired | boolean | yes | True in every mode except agentic_mcp_enabled. |
| stopConditions | string[] | yes | Hard stops — see below. |
| postTradeChecks | PostTradeCheck[] | yes | Checks the agent runs after any activity — see below. |
| robinhoodMcpInstructions | string | yes | The paste-ready text block for the user's MCP agent. |
| receiptId | string | yes | Capsule receipt id (hrcpt_ prefix). |
| fuseChecksum | string | yes | Canonical hash of the fuse set — receipts verify against it. |
| capsuleChecksum | string | yes | Canonical hash of the entire capsule including instructions. |
| liveOrderSent | false | yes | Hard-typed false. HISS has no rail that could ever set it true. |
Stop conditions
Every capsule ships all five, verbatim:
- Stop immediately if any fuse would be breached.
- Stop if account data is stale, incomplete, or contradicts the plan.
- Stop if the user expresses confusion or asks to pause.
- Stop if any referenced price feed is stale, paused, or unavailable.
- Stop if the Coil receipt hash no longer matches the manifest.
Post-trade checks
- Position weights vs targets — every position within the max-weight fuse.
- Daily turnover — cumulative turnover under the daily-turnover fuse.
- Order log vs plan — every filled order maps to an approved intent; none outside the plan.
- Drift after execution — residual drift below the rebalance threshold.
Example capsule
{
"capsuleVersion": "coil-compiler-1.0.0",
"coilId": "coil_7f31…",
"manifestHash": "9b41c8…",
"executionMode": "human_confirm",
"allowedSymbols": ["AMD", "MU", "ORCL", "SGOV"],
"prohibitedSymbols": [],
"allowedActions": ["analyze", "preview_orders", "propose_rebalance", "place_equity_orders"],
"budget": { "maxTotalNotionalUsd": 1000, "currency": "USD" },
"maxOrderNotionalUsd": 500,
"maxPositionWeightBps": 4000,
"maxDailyTurnoverBps": 2000,
"rebalanceThresholdBps": 500,
"maxSlippageBps": 50,
"marketHoursPolicy": "market-hours-only",
"humanConfirmationRequired": true,
"stopConditions": ["Stop immediately if any fuse would be breached.", "…"],
"postTradeChecks": [{ "check": "Position weights vs targets", "expectation": "…" }],
"robinhoodMcpInstructions": "HISS EXECUTION CAPSULE — …",
"receiptId": "hrcpt_ab12…",
"fuseChecksum": "e410…",
"capsuleChecksum": "77af…",
"liveOrderSent": false
}HISS EXECUTION CAPSULE — AI Infra, Hold the NVDA (coil coil_7f31…, v1)
Compiled by HISS. HISS is not affiliated with Robinhood. This capsule is an
instruction bundle for YOUR agent using Robinhood's official Trading MCP in
YOUR Agentic account. You control the connection, the budget, and every
trade. Not investment advice.
Mode: HUMAN-CONFIRM. Present each order for explicit per-order approval
(ticker + dollar amount echoed back). Never place an unconfirmed order.
Target allocation (weights in bps sum to 10,000):
- AMD: 25.00%
- MU: 25.00%
…
Risk fuses (all binding):
- No position may exceed 40.0% of the strategy.
- No single order above $500.
…
Stop conditions:
- Stop immediately if any fuse would be breached.
…What a capsule may and may not instruct
- May: read account/portfolio data, quotes, indicators, and watchlists; simulate orders and verify tradability before anything else; work with long equity (and long options, where the Coil allows) intents inside the Agentic account, sized within the reserved capital and fuses; use scanners and watchlists as monitoring scaffolding.
- Must not: assume trading outside the Agentic account (impossible by Robinhood’s design — capsules never pretend otherwise); use short selling, margin, crypto, futures, or event contracts (not supported via the agent today); flip the user’s autonomy setting — silent autonomy is never a capsule’s to grant; or bypass or discourage Robinhood-side controls (notifications, trade preview, disconnect).