docs/GUARDED_EXECUTOR_CONTRACT.md

Guarded Executor Contract

The aggregator does not place orders.

Any future executor must satisfy this contract:

Required checks

• dry-run/live posture
• HALT_TRADING env var
• .membra_halt file
• position guard
• max notional
• max contracts
• max inventory per symbol
• max total exposure
• recovery protocol state
• audit receipt before and after attempt

Forbidden

• raw exchange client calls from strategy modules
• live mode default
• credential logging
• background daemon without visible PID/receipt
• auto-reopen behavior without explicit policy and cap