Stoic Citadel — Safety-First Algo-Trading Platform
A 47,650-LOC async Python platform for MetaTrader 5 / prop-firm challenges, built around a fail-closed, seven-layer risk engine — and honest enough to prove, out-of-sample, that its own strategy has no edge yet.
Timeline
2026
Role
Lead Engineer
47.6k LOC
Codebase
484 · 80% gate
Tests
7 gates
Safety layers
Engineering outcome
7-layer fail-closed risk engine · 484 tests
Honest impact
Infrastructure & risk-engineering showcase — no validated edge (reported honestly)
Problem
Retail algo-trading projects fail in two classic ways: an account blows up because one missing stop-loss or a hung process went unguarded, or a strategy only looks profitable because the backtest quietly leaked future data. Prop-firm rules (5% daily loss, 10% total drawdown) punish either mistake instantly.
The Challenge
Build a trading platform where safety is a property of the architecture — a missing stop, stale data or a frozen bot must never blow up the account — and where the research is rigorous enough to reject its own strategy when the edge is not real.
The Solution
A decoupled macro/micro design: a Freqtrade + ML strategy publishes a TRADE_INTENT over Redis and never trades directly; a fast async micro-service runs seven independent risk and FTMO gates, sizes every position off the real stop distance, and executes via smart order types against a hardened MT5 bridge. An independent equity watchdog runs as a separate process and can flatten the book — closing stop-less positions by ticket — even if the main bot hangs. A leak-free walk-forward harness (purge + embargo, realistic FX costs) then tested the strategy out-of-sample and correctly found no validated edge.
Inside the platform
Engineering & honest research, in figures
Every chart is generated from the repository — the architecture, the seven-layer risk engine, and the walk-forward research that correctly concluded there is no validated edge yet. Nothing here inflates performance. Click any figure to enlarge.
Architecture
Decoupled macro / micro pipeline. The ML strategy only publishes a TRADE_INTENT over Redis; a fast async service enforces risk and executes — so heavy model logic can never block a trade.
Explainable ML
The model layer is governed, not a black box: LightGBM/XGBoost ensembles are meta-labeled (TripleBarrier), versioned in a 12-model registry with lifecycle status, monitored for drift — and explained with SHAP before anything is trusted.
Defense in depth
Seven independent safety layers. A rejection at any one stops the trade, and the last runs as a separate process that can flatten the book — closing stop-less positions by ticket — even if the main bot hangs.
The honest result
Out-of-sample, net of realistic FX costs, no instrument clears the robustness bar and both FX pairs are below breakeven. The walk-forward was built to disprove the strategy — and it did. No live deployment.
Risk under control
Across every instrument, drawdown stays far inside the prop-firm limits — a product of deliberately conservative sizing and rare entries, not evidence of a proven edge.
Proven by tests
484 automated tests across the stack — including property-based (Hypothesis) and chaos tests — with an 80% coverage gate and a blocking secret-scan enforced in CI.
Technical Highlights
Seven-layer defense-in-depth: every order passes data-freshness, market-safety, risk, circuit-breaker, FTMO, sizing and an out-of-band equity-watchdog gate
Fail-closed by default: the MT5 bridge refuses to run without an API key; the loader raises StaleDataError rather than trade on stale candles; the margin guard fails closed
Independent dead-man's switch closes naked (stop-less) positions by ticket after a grace period — proven by regression tests
FTMO compliance as a first-class module: daily 4% / weekly 8% / max-DD 9.5% limits, +10% profit-target halt, ≥4 trading days, restart-safe state
Leak-free walk-forward research (purge + embargo, realistic FX costs) that correctly concluded NO validated edge — profit factor below 1.0 out-of-sample
484 automated tests (property-based + chaos) with an 80% coverage gate and a blocking secret-scan in CI
System Architecture
Python 3.12 · AsyncIO (async execution engine)
Freqtrade (macro strategy layer)
Redis pub/sub (macro → micro handoff)
FastAPI MT5 bridge (API-key + rate-limit)
LightGBM · XGBoost · Optuna · River (ML/MLOps)
PostgreSQL · SQLAlchemy · Alembic
Prometheus · Grafana · Loki (observability)
Docker · GitHub Actions (ruff · mypy · bandit · semgrep · CodeQL · Trivy)
Independent equity watchdog (out-of-band kill-switch)
Core Technologies