Create order
TLM submits a UserOp. For automated paths it targets SpellsGmxWrapper instead of raw multicall.
Two-Layer Model
Durable orchestration above, serialized execution below.
Spells splits execution into two layers because business intent and blockchain ambiguity are different problems. Workflows own durable sequencing for casts, monitoring, and triggers. The TLM owns nonce serialization, submission, receipt verification, and bounded recovery per Metavault.
Workflow cadences
60s
Position monitor and trigger evaluator both target one-minute loops.
Receipt timeout
2 min
After that, TLM moves from optimistic polling into explicit verification.
Recovery budget
15 min
Gas bumps and nonce recovery remain bounded rather than indefinite.
Emergency path
Separate
User-paid degraded close stays available even if sponsorship or Vercel fail.
Normal cast flow
Worker validates and hands off. Workflow owns business sequencing. TLM owns transaction truth until the resulting state is confirmed and recorded.
Trigger-driven execution
Triggers do not bypass the execution backbone. They enter it through the same durable path, which matters especially for GMX’s async order model.
Emergency close chain
When higher-level dependencies fail, the system can drop to a Worker-owned emergency surface and eventually to raw user-signed transactions.
TLM state
The TLM is where ambiguous blockchain state becomes controlled state.
The TLM is a Durable Object per Metavault. It acquires nonce context, builds calldata or wrapper calls, estimates gas, signs, submits, polls, verifies post-conditions, and recovers from stuck states without entering blind retry loops.
GMX + execution
GMX is the exception that shapes the whole execution model.
A GMX receipt confirms order creation, not completed exposure. That means the system must track by order, persist `gmx_order_key`, detect frozen or cancelled orders, and treat keeper execution as a second phase.
Enter `pending_keeper`
The order is on-chain, but the position is not yet active. Typical keeper latency is 30–120 seconds.
Resolve order state
The monitor checks `getAccountOrders` and position deltas. Disappearing order key plus expected state change means success. Frozen or timed-out orders raise attention.
Launch GMX facts
- Curated market allowlist only.
- TP/SL is platform-managed, not native GMX trigger orders.
- Worst-case TP/SL latency is roughly 2–3 minutes.
- Keeper timeout alert default is 5 minutes.
Wrapper requirement
- Automated GMX paths must go through SpellsGmxWrapper.
- Wrapper pins receiver, constrains markets, bounds size and fee caps.
- Raw `ExchangeRouter.multicall(bytes[])` is not acceptable for unattended session-key execution.
Runtime lifecycle
User-facing states stay simple even when runtime states do not.
The PRD exposes active, closed, and liquidated. The runtime model adds opening, arming, adjusting, closing, and GMX-specific pending states, but unresolved execution problems are still shown as attention on the position rather than as a confusing new lifecycle state.
Attention conditions are separate from lifecycle
External modification must be reconciled
Closed means on-chain verification, not optimistic UI state
User cost model
Fees combine infrastructure recovery with product revenue.
Spells charges a gas-cost recovery component plus a platform execution fee on open and close operations. Fee transfer happens atomically inside the same UserOp as the operation, so if the fee cannot be collected, the action does not proceed.
Open fee
10 bps on position open, waived below $100 notional.
Close fee
5 bps on close, with management actions otherwise charging gas recovery only.
Markup
20% configurable markup on estimated gas cost, plus GMX keeper fee recovery where relevant.
Per-operation caps
Cast: $50. Close: $150. Rebalance: $30. GMX increase/decrease: $50. Session-key fee transfer caps remain separately bounded at 150 USDC or 0.1 WETH.
GMX execution fee funding
GMX keeper fees are paid from user funds, never from the paymaster. User-initiated trades top up ETH from the EOA. Autonomous trades unwrap WETH in the Metavault if native ETH is insufficient. A small WETH reserve around 0.05 WETH is expected for automation readiness.
Fee stability rule
If base fee at signing drifts beyond the markup buffer used during estimation, TLM aborts with fee-estimate drift instead of pushing a stale price assumption into signing.