Private TWAPs
Two managed executors, one rule: the selected account scope never drifts.
Omni exposes a personal Private · Omni managed TWAP and a separate managed-vault TWAP path. Both schedule ordinary builder-tagged child orders, but they use different sessions, signers, storage, and account scopes. They are testnet-only and fail closed when identity, task ownership, market scope, builder configuration, or reconciliation is uncertain.
At a glance
- Networks
- Testnet only Personal Private TWAP and vault-managed TWAP remain blocked from mainnet.
- Child orders
- Builder-tagged ALO The server injects the nonzero builder; callers cannot override it.
- State
- Durable tasks Task intent, child ownership, fills, remaining size, and VWAP are reconciled server-side.
Why It Matters
What traders and researchers should take away
- A long-running order does not require an execution key to remain in the browser.
- Personal and vault balances, positions, fills, and task tables cannot overwrite one another after a scope switch.
- Cancellation reports the confirmed terminal outcome instead of treating an HTTP success as proof that execution stopped.
How it works
What the product uses behind the scenes
- Personal Private TWAP uses the purpose-specific omni-ptwap API agent and isolated encrypted server storage; it never falls back to the general trading agent.
- Managed-vault TWAP uses the short-lived vault session and executor assigned to that vault; tasks appear in the normal TWAP Active and History tables.
- Every partial child requires at least $10 of live limit-price notional except an exact verified reduce-only residual close.
- The browser supplies strategy inputs, never builder fields, signer material, or an upstream executor URL.
Notes
Things to know
- Private TWAP is not Hyperliquid native TWAP and is not a basis strategy; it schedules ordinary post-only child orders.
- Personal Private TWAP is available only for a personal master account on testnet; it is not selectable in a managed-vault workspace.
- In-place modify remains disabled where builder retention cannot be proven; cancel and replace instead.
- Mainnet requires durable nonce fencing, restart recovery, fill backfill, builder-fee reconciliation, emergency unwind drills, and independent audit.
Select the executor by account scope
A visible account choice determines every downstream read and write.
- Personal master: Custom → TWAP → Private · Omni managed; wallet-owned master, purpose-specific omni-ptwap signer.
- Managed vault: the normal TWAP ticket and private tables remain visible, but all state and writes bind to the selected vault and vault executor.
- Changing wallet, network, vault, session, or connection epoch invalidates stale requests and delayed snapshots.
- Locked vault mode cannot fall through to personal or general-agent execution.
Durable task lifecycle
Intent is persisted before risk and every child is reconciled before terminal status.
- Persist task schedule and child ownership before submitting risk-accepted work.
- Build a post-only child from live BBO, inject builder configuration, sign server-side, then observe open-order and fill state.
- Cancel any remainder, reconcile requested and filled quantity plus VWAP, then publish Active or History state.
- Treat failed_unreconciled or ambiguous submit/cancel as an error requiring reconciliation—not a successful terminal state.
Security and recovery rules
Signer lifecycle and task recovery remain purpose-specific.
- Disabling personal Private TWAP removes its ciphertext and cached signer without changing interactive trading authority.
- Rotation and disable are blocked while the same master retains active child intent, including unreconciled failed tasks.
- A vault bearer remains in memory, vault-scoped, short-lived, and cannot fund, withdraw, transfer, manage keys, or change the builder.
- Restart and Redis-loss drills must prove nonce fencing, idempotency, fill backfill, cancel-all, and reduce-only unwind before public-money release.
References
Implementation references
Private TWAP account model
omni-terminal/docs/WALLET_LINKING_MODEL.mdPurpose-specific signer storage, account scope, builder injection, and lifecycle invariants.
Managed vault execution model
omni-terminal/docs/MANAGED_VAULT_TRADING.mdVault session, standard private tables, managed TWAP, gateway, and recovery contract.
Vault SDK managed TWAP example
https://github.com/InTheta/hl-vault-sdk/blob/main/examples/managed-twap.tsPublic client-side preview and task submission pattern for the vault executor.