StrataDocs

Automation Safety

The public agent surface is designed to fail closed.

Authority belongs to the external agent owner

Strata provides discovery, quote, prepare, and submit operations. The external agent owner decides which of those its agent may call and configures signer authority. Strata does not impose a second human-approval policy; it validates the public protocol, signatures, immutable economics, expiry, and idempotency.

Quote discipline

  1. Discover the live capability before using it.
  2. Use atomic units for money.
  3. Bind the response to the requested market, side, and input.
  4. Check the server-derived lifetime.
  5. Account for both labelled fee fields.
  6. Respect the returned minimum output.
  7. Request a fresh quote after expiry or any retryable failure.

The official SDKs perform these structural checks automatically. Your application remains responsible for deciding whether the economics meet its own policy.

Vault session authentication

Execution does not use a wallet seed phrase, exported private key, or server-held trading key. An owner-configured signer acts outside Strata. The SDK or MCP flow then:

  1. signs a one-time authorization bound to the quote and minimum output;
  2. validates that preparation preserved that authorization;
  3. runs the external agent owner's transaction verifier;
  4. asks the non-exportable session to sign the verified transaction; and
  5. submits it with an idempotency key.

The owner wallet remains the recovery authority. The owner may pause or revoke the session and remains required for withdrawals. A session key should be stored in the platform keystore, never in source code, configuration text, logs, or an agent prompt.

Disabling either trade capability in Strata's control plane immediately closes that public operation without a client update.

Resting-order automation

Use the persistent order-command SDK when both order capabilities advertise WebSocket transport. Proactive self-trade cancellation is optional and defaults to none. Activate cancel_taker, cancel_maker, cancel_both, or skip_own_liquidity only when the owner explicitly asks for that behavior. The matcher and on-chain program independently prevent actual self-fills.

Treat the immediate submit result as an RPC-broadcast receipt. Chain success or failure arrives through pushed status and is durably recoverable with the same control ID and idempotency key. Never post the same economic action again merely because a connection dropped.

For unattended resting exposure, arm the SDK dead-man guard. Its cancellation transaction is externally verified and pre-signed before the ticket becomes active. A process crash, network loss, or dropped guard stops heartbeats and therefore cancels; shutdown must not silently disarm it.

Before a release, run the non-trading order-command load certificate against the deployed region and keep the JSON artifact. It must include achieved throughput, latency percentiles, error rate, and zero sequence-integrity faults. A build passing unit tests is not a latency certification.

Never paste a wallet seed phrase, private key, session key, or API token into an agent prompt.