Private TWAPs

Two managed executors, one rule: the selected account scope never drifts.

Omni exposes a personal Private · Omni managed TWAP and a separate managed-vault TWAP path. Both schedule ordinary builder-tagged child orders, but they use different sessions, signers, storage, and account scopes. They are testnet-only and fail closed when identity, task ownership, market scope, builder configuration, or reconciliation is uncertain.

At a glance

Networks
Testnet only Personal Private TWAP and vault-managed TWAP remain blocked from mainnet.
Child orders
Builder-tagged ALO The server injects the nonzero builder; callers cannot override it.
State
Durable tasks Task intent, child ownership, fills, remaining size, and VWAP are reconciled server-side.

Why It Matters

What traders and researchers should take away

  • A long-running order does not require an execution key to remain in the browser.
  • Personal and vault balances, positions, fills, and task tables cannot overwrite one another after a scope switch.
  • Cancellation reports the confirmed terminal outcome instead of treating an HTTP success as proof that execution stopped.

How it works

What the product uses behind the scenes

  • Personal Private TWAP uses the purpose-specific omni-ptwap API agent and isolated encrypted server storage; it never falls back to the general trading agent.
  • Managed-vault TWAP uses the short-lived vault session and executor assigned to that vault; tasks appear in the normal TWAP Active and History tables.
  • Every partial child requires at least $10 of live limit-price notional except an exact verified reduce-only residual close.
  • The browser supplies strategy inputs, never builder fields, signer material, or an upstream executor URL.

Notes

Things to know

  • Private TWAP is not Hyperliquid native TWAP and is not a basis strategy; it schedules ordinary post-only child orders.
  • Personal Private TWAP is available only for a personal master account on testnet; it is not selectable in a managed-vault workspace.
  • In-place modify remains disabled where builder retention cannot be proven; cancel and replace instead.
  • Mainnet requires durable nonce fencing, restart recovery, fill backfill, builder-fee reconciliation, emergency unwind drills, and independent audit.

Select the executor by account scope

A visible account choice determines every downstream read and write.

  • Personal master: Custom → TWAP → Private · Omni managed; wallet-owned master, purpose-specific omni-ptwap signer.
  • Managed vault: the normal TWAP ticket and private tables remain visible, but all state and writes bind to the selected vault and vault executor.
  • Changing wallet, network, vault, session, or connection epoch invalidates stale requests and delayed snapshots.
  • Locked vault mode cannot fall through to personal or general-agent execution.

Durable task lifecycle

Intent is persisted before risk and every child is reconciled before terminal status.

  • Persist task schedule and child ownership before submitting risk-accepted work.
  • Build a post-only child from live BBO, inject builder configuration, sign server-side, then observe open-order and fill state.
  • Cancel any remainder, reconcile requested and filled quantity plus VWAP, then publish Active or History state.
  • Treat failed_unreconciled or ambiguous submit/cancel as an error requiring reconciliation—not a successful terminal state.

Security and recovery rules

Signer lifecycle and task recovery remain purpose-specific.

  • Disabling personal Private TWAP removes its ciphertext and cached signer without changing interactive trading authority.
  • Rotation and disable are blocked while the same master retains active child intent, including unreconciled failed tasks.
  • A vault bearer remains in memory, vault-scoped, short-lived, and cannot fund, withdraw, transfer, manage keys, or change the builder.
  • Restart and Redis-loss drills must prove nonce fencing, idempotency, fill backfill, cancel-all, and reduce-only unwind before public-money release.

References

Implementation references

  • Private TWAP account model

    omni-terminal/docs/WALLET_LINKING_MODEL.md

    Purpose-specific signer storage, account scope, builder injection, and lifecycle invariants.

  • Managed vault execution model

    omni-terminal/docs/MANAGED_VAULT_TRADING.md

    Vault session, standard private tables, managed TWAP, gateway, and recovery contract.

  • Vault SDK managed TWAP example

    https://github.com/InTheta/hl-vault-sdk/blob/main/examples/managed-twap.ts

    Public client-side preview and task submission pattern for the vault executor.