1,500 instruments, every stop-loss on time

TradeChef's strategies sell option premium: ThetaPlay and SellSpread open multi-leg positions on five-minute cycles and rely on MTM-triggered protective exits to cap losses. The exit path runs through six hops: exchange feed, tick gateway, enrichment against ClickHouse and PostgreSQL, event queue, CEP strategy engine, order service, exchange gateway. When any hop slows during a fast market move, the stop-loss executes late on a leveraged book. The entry can wait five minutes; the exit cannot wait five seconds.

• The exit is latency-critical

  Short-premium books with up to ₹13.7m margin depend on MTM-triggered exits. A slow chain does not just delay data, it delays the stop-loss, and a fast move prices that delay immediately.

• Six hops, one budget, no owner

  Each service had its own latency alarm; nobody owned the end-to-end 150 ms tick-to-order budget, so every degradation became an argument about whose hop it was.

• Alarms fired after the money

  p99 latency alerts are lagging indicators. By the time they fired, exits had already gone out late. The signals that lead a breach, queue lag, ack times, cache hit-rate, were not first-class.

• Provider, exchange, or us?

  Ticks arrive from multiple feed providers and orders leave through the exchange gateway. When something slowed, triage burned time on the question that changes everything: their side, which we fail over or protect against, or our side, which we fix?

• Three workloads, one database

  The nightly bhavcopy load and multi-year backtests share ClickHouse and PostgreSQL with the live path. Batch health was invisible to the trading team until it surfaced as morning slowness.

• Slowness had no price

  Nobody could say what a minute of chain lag cost in rupees, so infrastructure priorities were argued with adjectives instead of numbers.

Managed Service Ops onboarded all three pipelines as business processes with operating windows, decomposed the tick-to-order budget across the chain, wired leading indicators to every hop, and mapped each service to the strategy books riding on it, so a slowdown surfaces as rupees at risk, a named guilty hop, and a governed action, not as a wall of latency graphs.

• OnboardThree pipelines, three operating windows

  Live chain is mission-critical 09:15–15:30 IST; the bhavcopy load owns its evening window; backtests are welcome off-hours and flagged instantly if they intrude on market hours.

• Budget150 ms, decomposed and enforced

  Feed gateway 10 ms, enrichment 25 ms, queue 15 ms, CEP 60 ms, order service 25 ms, exchange ack 15 ms. Every hop carries its own budget and its own leading indicator.

• DetectLeading indicators, not post-mortems

  Consumer lag and queue depth, order-ack p99, enrichment cache hit-rate, ClickHouse parts and merge backlog, PostgreSQL pool saturation, and tick sequence gaps fire minutes before the SLO breaches.

• QuantifyBlast radius in rupees

  Each service maps to the strategy books on it. Impact is computed from open MTM exposure and slippage per second of delayed exit, plus missed five-minute entry cycles, a number, not an adjective.

• ActMOPs with trading-grade governance

  Scaling CEP consumers and prioritizing exit orders over entries run auto-safe. Pausing new entry cycles requires approval. A strategy kill-switch never fires without a human. Entries can wait; exits go first.

• VerifySherlock closes it, not hope

  An incident ends only when tick-to-order p99 holds under 150 ms across a full verification window. Recovery is proven with mechanical checks, never assumed from a quiet dashboard.

Governed autonomy, trading edition: nothing touches live orders without an approval gate; auto-safe scope is limited to scale-out and queue prioritization; exchange-side slowness triggers protection, never blame; and every action, human or automated, lands in the audit trail with rollback attached.

This is TradeChef's estate as Managed Service Ops models it. Click any component to see its role, its share of the 150 ms budget, the leading indicators watching it, and the MOPs standing by. External systems, the exchange feed and the exchange order gateway, are shown dashed: they are probed and disambiguated, not blamed.

Pick a component and a duration, and see what Managed Service Ops computes: the cascade through the chain, the strategy books whose exits are at risk, the exposure in rupees without intervention, and what the governed 90-second response protects. The same engine drives the live product; these figures are illustrative.

The trading team moved from arguing about whose hop was slow to reading a single screen that names the hop, prices the risk, and shows the fix already in flight, with recovery proven before the incident closes.

In premium selling, the entry can wait five minutes; the exit cannot wait five seconds. This is the first system that treats our latency budget as a business number, with a rupee value attached to every hop, and proves recovery instead of assuming it.