How the Senpi Risk Engine Works: A Deep Dive

2.0 — featuring Senpi Samurai 1.2, the first AI model optimized specifically for Hyperliquid, powered by the Senpi AI Harness — launches in a few days.

Most “AI trading” fails in the same place: the model is the only thing in the loop. It decides what to buy, how big, when to sell, and when to stop — and when it’s wrong, there’s nothing underneath to catch it. One bad inference and the account is the experiment.

Senpi is built the opposite way. Senpi Samurai forms the conviction; the Senpi AI Harness enforces the discipline. The model reads the market and proposes intent. Everything that touches your capital — how big the position is, where the stop sits, when to take profit, when to stop trading entirely — is owned by a deterministic runtime that runs on every tick, the same way every time, and fails closed when anything is uncertain.

That runtime is the risk engine. Here’s exactly how it works.

1. Sizing: conviction-weighted, account-proportional, capped

The model never sizes in dollars. It emits a sizing intent — a marginPct, a fraction of the account it wants behind a trade — and the harness converts that intent into actual dollars off your reconciled, live account value. The model proposes “put medium conviction here”; the runtime decides what that means in USD given what you actually hold right now.

Three layers shape the final size:

• Conviction scaling. Simpler strategies size every entry uniformly (a flat margin_pct). A conviction strategy instead scales its intent with signal strength — a broader, better-confirmed setup lifts marginPct toward a capped ceiling (e.g. up to ~2× the base), while a marginal signal stays small. Conviction is expressed, not binary.

• Account-proportional slots. Each position is sized as a percentage of the account (margin_pct), not a fixed dollar amount — so a strategy scales correctly whether it’s funded with $100 or $100,000. slots and margin_pct are set together as a margin budget (slots × margin_pct), keeping total committed exposure proportional to the account at any balance.

• Leverage by risk profile — or conviction. Leverage is a strategy setting that shifts by risk level (conservative / moderate / aggressive); some strategies also tier it with conviction (e.g. 5× / 6× / 7× as the signal strengthens). Either way it’s owned by the strategy, never hard-coded into the model’s decision.

The runtime also owns slot caps and position dedup: a slots ceiling on concurrent positions, and the guarantee that the model can’t accidentally stack the same asset five times. The model’s job is to be right about direction and conviction; sizing correctness is the harness’s job.

2. Exits: a two-phase dynamic stop-loss

This is the heart of it. Senpi positions are managed by a two-phase DSL (Dynamic Stop-Loss) engine that re-evaluates a price floor on a fixed interval (commonly every 30 seconds) and closes the moment price breaches it. The two phases do two different jobs.

Phase 1 — survive. From entry until the trade first proves itself, the floor is the stricter of two protections:

• An absolute floor from max_loss_pct — your maximum acceptable loss, expressed as a percentage of margin (ROE), not price. This is a crucial design choice: max_loss_pct: 15 means “cut at −15% of the margin you committed,” at any leverage. The engine converts it to a price level by dividing by leverage, so your real risk per trade is the number you actually set.

• A trailing floor from retrace_threshold — a give-back limit measured from the position’s high-water mark.

A breach only triggers an exit after consecutive_breaches_required ticks below the floor — so a single noisy wick doesn’t stop you out of a good trade.

Phase 2 — lock gains. The instant a position clears its first profit milestone, it crosses into Phase 2, where a ladder of profit-lock tiers takes over. Each tier says: once ROE reaches X%, lock a floor at Y% of the high-water mark. Where Phase 1’s floor is engine-polled and closed at market on a breach, this floor is handed to the exchange as a native stop that ratchets — it only ever moves up as new highs print, never loosens.

A concrete tier — { trigger_pct: 20, lock_hw_pct: 30 } — reads: at +20% ROE, protect 30% of the peak gain. As the winner runs, the locked floor climbs with it.

3. Trailing stops: the ratchet, and why it’s tuned by strategy class

The ratchet is what lets Senpi let winners run without giving them all back. But the right ratchet for a breakout is the wrong ratchet for a fade — so Senpi ships named presets by strategy class, each a complete, tuned exit shape. Pick the one that matches your thesis (or hand-author every field — it’s the same open schema):

Three time-based cuts sit on top, recycling capital that goes nowhere:

• hard_timeout — an outer bound; close after N minutes regardless of state, so capital is never tied up indefinitely.

• weak_peak_cut — frees a position only if it’s both flat (never cleared a small ROE threshold) and fading. It never touches a winner or a position still near its high.

• dead_weight_cut — closes a position that’s gone stagnant and slipped back to break-even or below.

The design bias is deliberate and asymmetric: capping a fat-tail winner is unbounded opportunity cost, while running “too wide” is bounded by max_loss_pct. So the defaults err toward giving winners room.

4. Turnover limits: the silent account-killer

Overtrading doesn’t announce itself — it bleeds you through fees and whipsaw. The harness caps turnover with three entry gates, checked before every open:

• Max entries per day — a hard ceiling on new positions per UTC day, the single biggest brake on fee-driven bleed and runaway over-trading.

• Per-asset cooldown — after closing an asset, the runtime won’t re-enter it for a configured window (e.g. 4 hours), killing the revenge-trade whipsaw loop.

• Consecutive-loss cooldown — after N losers in a row, the strategy pauses for a cooldown period, so a losing streak can’t compound into a spiral.

Exits can also run as maker (fee-optimized) limit orders with a market fallback — recovering fees on the way out, which matters most for exactly the high-turnover strategies that need it.

5. Drawdown and loss controls: the circuit breakers

The final layer is the kill-switch tier — gates that don’t just skip a trade, they halt new entries entirely:

• Daily loss halt — when the day’s PnL breaches either a dollar or a percentage limit (whichever you set), new entries stop until UTC midnight resets the day.

• Drawdown halt — a true circuit breaker on drawdown from the account’s PnL peak. Critically, it’s PnL-based, so it’s immune to deposits and withdrawals — moving money in or out can’t mask or fake a drawdown.

Together with the per-trade max_loss_pct floor, that’s protection at three scales: per position, per day, and per peak-to-trough.

Underneath all of it: Circuit Breakers

Here’s the part that separates a real risk engine from a checkbox. Every gate check fetches fresh data in real time — no cached verdicts, no background guesses. And if any of those checks fails — a network timeout, a missing snapshot, anything unknown — the engine doesn’t shrug and let the trade through. It returns CLOSED for halt-class gates and COOLDOWN for asset checks.

When risk state is unknown, trading is suspended. There is no permissive fallback. A model error, an API hiccup, a half-loaded snapshot — none of them can open the gate. The only thing that opens it is a clean, current, all-clear read.

And gating is one-directional by design: entries are gated, closes never are. If you’re holding a position, the engine will always let you out — it can stop you from getting in, never from getting out.

The honest part

Risk controls cap losses and suspend trading. They don’t guarantee profits, and we don’t pretend otherwise:

• A stop is a discipline, not a force field — fast markets can slip through a floor.

• Halting after a bad day protects capital, but it can also sit you out of the recovery. That’s the trade we choose on purpose.

• Presets are starting points tuned to strategy classes, not magic numbers. The wide ones bleed in chop; the tight ones cap winners. Matching the shape to the thesis is the whole game.

Every gate, preset, and tier is documented and yours to configure. The strategy packages, the DSL presets, and the full config schema are public in the Senpi skills repo — so you can read exactly what a strategy will do before you run it, and change any field yourself.

This is what Senpi 2.0 is for

The pitch isn’t “an AI that trades for you.” It’s an AI with a harness around it. Senpi Samurai brings the read on the market; the Senpi AI Harness brings the sizing, the ratcheting exits, the turnover brakes, and the circuit breakers — deterministically, every tick, failing closed when it has to. The model can be brilliant or it can be wrong. Either way, your capital is governed by the same disciplined machinery that runs the entire Senpi fleet.

Senpi 2.0 launches in just a few days.

Reserve your agent with $100 free AI credits → waitlist.senpi.ai

🥷