Risk fuses
developerAll 15 fuse kinds, the required capsule set, bounds, and how fuses compile.
What a fuse is
A risk fuse is a typed, checkable constraint. It either bounds what a compiled artifact may instruct (position weight, order notional, turnover) or defines a hard stop — a “blow” condition that halts the session. Fuses are all binding: every capsule lists them verbatim, the compiler checksums them (fuseChecksum), and each fuse kind may appear at most once per Coil.
The 15 fuse kinds
The description column renders live from describeFuse() in @hiss/core — the same one-liners that appear inside capsules and checklists.
| Kind | Required | Params | Bounds | describeFuse (example instance) |
|---|---|---|---|---|
| maxPositionWeight | capsule-required | maxBps | (0, 10000] bps | No position may exceed 40.0% of the strategy. |
| maxSingleOrderNotional | capsule-required | maxUsd | > 0 | No single order above $500. |
| maxDailyTurnover | capsule-required | maxBps | (0, 10000] bps | Daily turnover capped at 20.0% of the book. |
| maxDrawdownAlert | optional | alertPct | percent | Alert and pause if drawdown exceeds 15%. |
| maxVolatilityBucket | optional | bucket | low | medium | high | Only medium-volatility assets are in scope. |
| restrictedSymbols | optional | symbols[] | plain tickers only (^[A-Z][A-Z0-9.]{0,9}$) | Never trade: TSLA. |
| marketHoursOnly | optional | — | — | Orders only during regular market hours. |
| earningsBlackout | optional | daysBefore, daysAfter | days | No trades 2d before through 1d after earnings. |
| manualConfirmAboveNotional | optional | thresholdUsd | USD | Explicit human confirmation for any order above $100. |
| noOptions | capsule-required | — | — | No options, ever. |
| noMargin | capsule-required | — | — | No margin, ever. |
| noCryptoUnlessAllowed | optional | allowed?[] | empty = none allowed | No crypto. |
| noLeveragedETFsUnlessAllowed | optional | allowed?[] | empty = none allowed | No leveraged ETFs. |
| stopIfOracleUnhealthy | optional | — | — | Stop if any referenced price feed is stale, paused, or unavailable. |
| stopIfReceiptMismatch | optional | — | — | Stop if the Coil's receipt hash no longer matches the manifest. |
Required for every capsule
REQUIRED_CAPSULE_FUSES — a capsule cannot compile without all 5:
maxPositionWeightmaxSingleOrderNotionalmaxDailyTurnovernoOptionsnoMargin
A missing one fails validation with MISSING_REQUIRED_FUSE. Note noOptions is in the required set: the default posture is equities-only, and a Coil author must deliberately remove that stance (and re-validate) before a capsule can reference options at all.
Validation rules
DUPLICATE_FUSE— each fuse kind may appear at most once.FUSE_BOUNDS—maxPositionWeightandmaxDailyTurnovermust be in (0, 10000] bps;maxSingleOrderNotionalmust be positive.FUSE_SYMBOL— restricted symbols must be plain tickers, never addresses.MISSING_REQUIRED_FUSE— capsule compilation only; the five required kinds above.
The default fuse set
New Coils start with eleven fuses — the five required kinds plus manual-confirm above $100, market-hours-only, crypto and leveraged-ETF exclusions, and the two stop fuses:
"fuses": [
{ "kind": "maxPositionWeight", "maxBps": 4000 },
{ "kind": "maxSingleOrderNotional", "maxUsd": 500 },
{ "kind": "maxDailyTurnover", "maxBps": 2000 },
{ "kind": "manualConfirmAboveNotional", "thresholdUsd": 100 },
{ "kind": "marketHoursOnly" },
{ "kind": "noOptions" },
{ "kind": "noMargin" },
{ "kind": "noCryptoUnlessAllowed" },
{ "kind": "noLeveragedETFsUnlessAllowed" },
{ "kind": "stopIfOracleUnhealthy" },
{ "kind": "stopIfReceiptMismatch" }
]