Loops

While a position is open, a scheduled keeper runs it. The keeper runs as two lanes on different clocks. A protection lane runs every few minutes, because a price move is a now problem, and carries the hedge and liquidation guards. A yield lane runs hourly, because funding moves over hours, and carries the carry guard. A separate daily lane watches key expiry.

Every pass begins by reading the trading key. A revoked or expired key stops the pass there, which makes revocation the off lever: nothing further triggers once the key is gone. Otherwise the pass reads the live position, evaluates the guards, and for a guard set to act on its own, signs the repair with the trading key and settles it on HyperCore. The keeper is otherwise always armed.

Authorization

Before a repair is signed, the backend gates it. It checks, in order, that the key is present and not revoked, that the key has not expired, and that the action is in the trading key's scope. A revoked or missing key stops the repair. An expired key stops it and flags the key for renewal. Trades and margin top-ups fall inside that scope, so the trading key signs them itself and the user is never prompted. A withdrawal or a margin-mode change falls outside it and routes to the user to sign.

The authorization gate and the risk layer are separate concerns. The risk layer decides what the position needs. The gate decides whether the key is allowed to do it. An auto-act repair still passes the scope check, and anything out of scope becomes a request for the user to sign.