← Blog

Recipe: Build a Pod and Allocate Risk Down a Recursive Tree

A runnable recipe for authoring a Kestrel pod document where a PM allocates nested risk envelopes to Books and Traders, and platform Risk halts on a day-loss.

Answer card

A pod is a recursive org node: a PM allocating a risk envelope to children that are Books or other pods. To build one, author a Kestrel pod document: declare a POD with a RISK day-loss <n>R -> halt line under it, give each child a budget, and give each Book a coverage with a thesis. Children's budgets must sum within the parent's; authority only narrows downward; the platform's Risk layer (L0) can clamp or veto anyone, including the PM, and may never open risk.

The one invariant to hold in your head

Two rules make a pod safe, and they are the same shape at every depth:

  1. Budgets nest. A child can never be allocated more risk than its parent holds. Siblings sum within the parent.
  2. Authority only narrows downward. A PM allocates; a Trader spends inside its Book. Nothing downstream can widen what an ancestor granted.

The org is data (a standing Kestrel document you can revise intraday), not fixed structure. Depth is unbounded. Humans sit above the root; a pod is the largest thing that runs on its own.

A small pod document

Here is a three-child desk. Budgets are in R (one unit of the pod's risk). Instruments are illustrative.

POD desk
  RISK day-loss 8R -> halt
  BOOK momentum  budget 3R coverage SPY QQQ thesis "0dte momentum"
  BOOK reversion budget 2R coverage large-cap thesis "large-cap reversion"
  POD overnight
    RISK day-loss 2R -> halt
    BOOK gamma budget 2R coverage SPX thesis "overnight gamma"

Read it top-down:

  • desk is the root pod. Its PM holds an 8R envelope. If the desk's aggregate day-loss hits 8R, Risk halts the whole subtree.
  • Its children (momentum, reversion, and the sub-pod overnight) are allocated 3R + 2R + 3R = 8R. They sum within the parent. Nesting holds.
  • overnight is itself a pod: a PM node one level down. It re-declares its own tighter RISK day-loss 2R -> halt, then allocates 2R to its child Book gamma. Narrower than its 3R grant: authority narrowed, never widened.
  • gamma, momentum, and reversion are Books: the leaves, the only places positions and orders live. Everything above a Book allocates and aggregates; it never holds a position.

The Traders running those Books author the actual contingent programs (the plans) inside their coverage. A PM never authors tickets; PM actions are allocations and envelope changes.

What Risk can and cannot do

RISK day-loss 2R -> halt is not the Trader's stop. It is the platform's L0 envelope, sitting above every pod member including the PM. It can clamp (shrink) or veto (halt), and it enforces the day-loss ceiling deterministically. What it can never do is open risk: Risk widens nothing, arms nothing, buys nothing. That asymmetry is the safety property: the enforcement layer is strictly subtractive.

Where this is today

The pod document and its nesting invariants are the org model Kestrel is built around. As of mid-2026: anonymous trial sims, certified Grades, shareable proof URLs, and 402 Offers with Stripe settlement are live; always-on paper presence and the human-signed live path are in build. The free tier needs no signup. Run pods in sim first (recorded data, simulated fills), then paper (live data, simulated fills). Live is a platform-enforced singleton (one pod lineage never runs live twice) and live scope needs a human two-signer, not a wallet. Deploy this template into your pod, tune the budgets to your own R, and you arm it.

A pod is a tree of nested risk envelopes where budgets sum downward and authority only narrows; Risk can veto anyone, but may never open risk.