Contract-aware derivatives, with an emergency stop that fails closed

Why is contract identity the hard part?

Because an option is not its underlying. Expiry, strike, call/put right, lot size and post-trade context all change what the position is, and a system that treats a derivative as a ticker will produce results that have no relationship to what would have traded.

The failure is quiet, which is what makes it dangerous. A backtest that substitutes the cash underlying for an unresolved option returns a plausible number rather than an error, and the number is meaningless. By the time the discrepancy surfaces, it surfaces as a live loss.

What has to be preserved, end to end

How does the contract catalogue work?

The instrument layer keeps cash, future and option records distinct, then resolves only contracts permitted for the tenant, account, broker segment and venue. Eligibility is part of resolution rather than a later check.

Four levels are evaluated: the underlying's canonical identity; the series, meaning the future or option family with its venue and expiry; the contract itself, with strike, right, lot, expiry class and price precision; and eligibility against the tenant catalogue, account and segment permissions, data availability and connector readiness.

What is actually available today?

The NSE futures and options contract model is available in the platform. NSE live broker execution, grouped exits, expiry handling and reconciliation are connector-enablement dependent. The customer strategy picker is tenant configuration. BSE F&O follows a phased enablement path.

Live availability depends on broker, account, segment, catalogue, permissions and tenant configuration. That is a real constraint rather than a disclaimer, and it is stated here because a broker discovering it during a proof of concept is a worse outcome than a broker reading it on a webpage.

What does the emergency control do?

HALT-NEW blocks new F&O exposure while preserving safety-critical processing. It applies globally, per tenant or per strategy, and fails closed if its state cannot be verified. Expiry handling, fill processing, reconciliation and eligible exit workflows remain active.

The asymmetry is deliberate. Blocking entries while keeping exits available is the only configuration that reduces risk during an incident; a control that blocks both would trap open positions, and a control that blocks neither is decorative.

What does the platform refuse to do?

It refuses to substitute a cash underlying for a derivative it cannot resolve, and it refuses to test or execute against an ambiguous contract. A refusal is the correct output when the alternative is a plausible wrong answer.

Multi-leg execution remains subject to liquidity, partial fills, broker RMS decisions, margin availability and exchange conditions. Futures and options involve leverage and material risk; HALT-NEW and the other controls improve discipline and incident response but cannot prevent all losses, gaps or execution risk.

The derivative lifecycle, stage by stage

Nothing downstream infers a contract that was not resolved upstream. This is the property that makes derivative evidence meaningful.

Why does expiry have to be a first-class concept?

Because a derivative position has a deadline that a cash position does not. Series and cut-off context, expiry awareness, grouped exits and post-trade reconciliation are part of the model rather than operational afterthoughts.

A system that treats expiry as a date field will eventually hold a position through a cut-off it did not model. Treating it as lifecycle state means the readiness check can refuse to open new exposure close to expiry, grouped exits can be coordinated rather than fired individually, and reconciliation has a defined post-expiry state to reconcile against.

What is the honest position on multi-leg execution?

It is supported and it is not guaranteed. Multi-leg execution remains subject to liquidity, partial fills, broker RMS decisions, margin availability and exchange conditions, and no platform can promise otherwise.

The useful thing a platform can do is make partial states visible and recoverable rather than pretending they do not occur: track filled quantity per leg, keep the exit path consistent with what is actually held, and surface an incomplete structure as an exception that needs a decision rather than as a completed trade.