Polymarket: new orders remain transmissible after order-safety heartbeat failure

[investlink-ai]

With the official Polymarket execution adapter and heartbeat_enabled=True, a new
order still reaches a loopback HTTP server after NT logs a heartbeat authentication
failure. I reproduced this on 2.0.0rc5 and 2.0.0rc6.dev20260916 using native
factories and Strategy.submit_order, without custom execution-client code.

I am opening a Discussion to clarify the intended contract. The
order-safety heartbeat documentation
describes disconnected health reporting after a failure; I did not find an explicit
guarantee that subsequent submissions are blocked locally.

Should the adapter reject new submissions while heartbeat health is lost, or is
that the caller's responsibility? If it belongs to the caller, what public Python
API or notification should a native-factory strategy use to enforce that policy?

Reproduction

The self-contained script below starts a synthetic HTTP/WebSocket venue on
127.0.0.1, supplies dummy credentials and uses the official factories. It:

1. Acknowledges the initial heartbeat and waits for strategy startup.
2. Returns HTTP 401 to the next /v1/heartbeats request.
3. Waits for NT's native Polymarket heartbeat authentication failed log.
4. Only then creates and submits a new GTC/post-only limit order.
5. Records whether the mock receives POST /order.

The parent process observes the native log and signals the child through stdin;
submission is not scheduled using a fixed sleep after the server's response.
max_retries=0 and execution reconciliation is disabled to isolate the path.

Save the script below as reproduce.py and run from outside an NT source checkout:

uv venv .venv --python 3.12
uv pip install --python .venv/bin/python 'nautilus-trader==2.0.0rc5' 'aiohttp==3.13.3'
.venv/bin/python reproduce.py --healthy-control
.venv/bin/python reproduce.py --assert-blocked

To repeat with the development wheel in a separate environment:

uv venv .venv-dev --python 3.12
uv pip install --python .venv-dev/bin/python 'aiohttp==3.13.3'
uv pip install --python .venv-dev/bin/python \
  --index-url https://packages.nautechsystems.io/simple \
  'nautilus-trader==2.0.0rc6.dev20260916'
.venv-dev/bin/python reproduce.py --healthy-control
.venv-dev/bin/python reproduce.py --assert-blocked

Observed results

Tested on 2026-09-18, macOS 26.6.2 ARM64, CPython 3.12.11, aiohttp 3.13.3.

Installed wheel	Healthy control	After heartbeat 401 and native failure log
2.0.0rc5, PyPI	One order transmitted and accepted by mock	One order transmitted and accepted by mock
2.0.0rc6.dev20260916, official package index	One order transmitted and accepted by mock	One order transmitted and accepted by mock

Both healthy controls exit 0. Both --assert-blocked runs exit 1 because the
proposed no-transmission assertion fails. The failure sequence is:

TRACE heartbeat_response=200
TRACE strategy_started_after_readiness
TRACE heartbeat_response=401
[ERROR] ... Polymarket heartbeat authentication failed
TRACE parent_observed_native_failure_log
TRACE creating_and_submitting_new_order
TRACE order_http_request_received

The mock intentionally accepts /order; this demonstrates local transmission and
the resulting NT lifecycle, not actual Polymarket acceptance or financial loss.
The script does not directly read the Rust health flag. The inspected source logs
the authentication failure immediately before storing false, so the state
interpretation is source-derived; the runtime observation is after the log.

The development wheel was the latest compatible version returned by a refreshed
index query on this environment. I did not build or execute today's develop head.

Relevant source and scope

Source inspection at develop commit b2f61748ba90dd0adb8e5b9918ce56ddc97970eb:

• Heartbeat authentication failure
  logs the error, marks heartbeat health false and returns.
• is_connected()
  includes heartbeat health when enabled.
• submit_order_command
  dispatches without checking that health state at this entry point.

This report covers a new single order after heartbeat authentication failure.
Batches, replacements, queued requests, retries, reconnects and already-in-flight
orders have not been exercised by this reproducer. A proposed adapter guard would
need explicit semantics for those cases while preserving cancellation and
reconciliation. No patch is included.

I searched the existing Polymarket heartbeat issues and PRs. The nearby
#4864 concerns market
WebSocket PING before subscription, which is different from this authenticated
order-safety heartbeat path.

Complete standalone reproducer (reproduce.py)

"""Observe official NT order transport after a synthetic heartbeat 401.

Requires Python 3.12+, nautilus-trader 2.x and aiohttp. No bot imports.
All venue endpoints are loopback; every credential is a published dummy fixture.
Run this file in a fresh process because NT's native logger is process-global.
"""

from __future__ import annotations

import argparse
import asyncio
import json
import platform
import sys
from collections.abc import Callable
from importlib.metadata import version
from pathlib import Path
from typing import Any

FAILURE_LOG = "Polymarket heartbeat authentication failed"
CONDITION = "0x" + "c" * 64
TOKEN = "12345"
SIGNER = "0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a"


async def until(predicate: Callable[[], bool], timeout: float = 8) -> None:
    async with asyncio.timeout(timeout):
        while not predicate():
            await asyncio.sleep(0.005)


async def child(healthy: bool) -> None:
    from aiohttp import web
    from nautilus_trader.adapters.polymarket import (
        PolymarketDataClientConfig,
        PolymarketDataClientFactory,
        PolymarketExecutionClientConfig,
        PolymarketExecutionClientFactory,
        PolymarketInstrumentProviderConfig,
        SignatureType,
    )
    from nautilus_trader.common import Environment, LoggerConfig, LogLevel
    from nautilus_trader.live import LiveExecutionEngineConfig, LiveNode, LiveNodeConfig
    from nautilus_trader.model import (
        InstrumentId,
        OrderSide,
        Price,
        Quantity,
        TimeInForce,
        TraderId,
    )
    from nautilus_trader.trading import Strategy

    instrument_id = InstrumentId.from_str(f"{CONDITION}-{TOKEN}.POLYMARKET")
    started = asyncio.Event()
    requests: list[list[str]] = []
    heartbeats: list[dict[str, Any]] = []
    payloads: list[dict[str, Any]] = []
    events: list[str] = []
    sockets: list[web.WebSocketResponse] = []
    market = {
        "id": "1",
        "conditionId": CONDITION,
        "question": "Synthetic loopback contract",
        "clobTokenIds": json.dumps([TOKEN, "67890"]),
        "outcomes": '["Yes","No"]',
        "endDate": "2030-01-01T00:00:00Z",
        "startDate": "2026-01-01T00:00:00Z",
        "active": True,
        "closed": False,
        "acceptingOrders": True,
        "enableOrderBook": True,
        "orderPriceMinTickSize": 0.0001,
        "orderMinSize": 5,
        "negRisk": False,
    }

    async def handler(request: web.Request) -> web.StreamResponse:
        requests.append([request.method, request.path])
        if request.path == "/ws":
            ws = web.WebSocketResponse()
            await ws.prepare(request)
            sockets.append(ws)
            async for message in ws:
                if message.data == "PING":
                    await ws.send_str("PONG")
            return ws
        if request.path == "/markets/keyset":
            return web.json_response({"markets": [market], "next_cursor": None})
        if request.path == "/version":
            return web.json_response({"version": 2})
        if request.path == "/balance-allowance":
            return web.json_response({"balance": "1000000000", "allowances": {}})
        if request.path == "/positions":
            return web.json_response([])
        if request.path in ("/data/orders", "/data/trades"):
            return web.json_response({"data": [], "next_cursor": "LTE=", "limit": 500, "count": 0})
        if request.path == "/v1/heartbeats":
            heartbeats.append(await request.json())
            failed = not healthy and len(heartbeats) > 1
            print(f"TRACE heartbeat_response={401 if failed else 200}", flush=True)
            if failed:
                return web.json_response({"error": "invalid auth"}, status=401)
            return web.json_response({"heartbeat_id": "mock-heartbeat"})
        if request.path == "/book":
            return web.json_response(
                {
                    "market": CONDITION,
                    "asset_id": request.query["token_id"],
                    "timestamp": "1789723827000",
                    "hash": "fixture",
                    "bids": [],
                    "asks": [],
                    "min_order_size": "5",
                    "tick_size": "0.0001",
                    "neg_risk": False,
                }
            )
        if request.method == "POST" and request.path == "/order":
            payloads.append(await request.json())
            print("TRACE order_http_request_received", flush=True)
            # Deliberately accept in the mock to observe the native event lifecycle.
            # This is not a claim about real-venue acceptance after a heartbeat 401.
            return web.json_response(
                {
                    "success": True,
                    "errorMsg": "",
                    "orderID": "0x" + "a" * 64,
                    "status": "live",
                    "takingAmount": "",
                    "makingAmount": "",
                }
            )
        raise web.HTTPNotFound(text=f"Unexpected mock request: {request.method} {request.path}")

    class Probe(Strategy):
        def on_start(self) -> None:
            started.set()
            print("TRACE strategy_started_after_readiness", flush=True)

        def on_order_event(self, event: Any) -> None:
            events.append(type(event).__name__)

    app = web.Application()
    app.router.add_route("*", "/{path:.*}", handler)
    runner = web.AppRunner(app)
    await runner.setup()
    site = web.TCPSite(runner, "127.0.0.1", 0)
    await site.start()
    port = runner.addresses[0][1]
    http_url = f"http://127.0.0.1:{port}"
    ws_url = f"ws://127.0.0.1:{port}/ws"
    provider = PolymarketInstrumentProviderConfig(load_ids=(instrument_id,))
    node = LiveNode.build(
        "heartbeat-reproducer",
        LiveNodeConfig(
            environment=Environment.LIVE,
            trader_id=TraderId("REPRO-001"),
            data_clients={
                "POLYMARKET": PolymarketDataClientConfig(
                    instrument_config=provider,
                    base_url_http=http_url,
                    base_url_ws=ws_url,
                    base_url_gamma=http_url,
                    base_url_data_api=http_url,
                    base_url_rtds=ws_url,
                    resolve_poll_enabled=False,
                    http_timeout_secs=2,
                )
            },
            exec_clients={
                "POLYMARKET": PolymarketExecutionClientConfig(
                    instrument_config=provider,
                    signature_type=SignatureType.Eoa,
                    funder=SIGNER,
                    private_key="0x" + "1" * 64,
                    api_key="00000000-0000-0000-0000-000000000001",
                    api_secret="dGVzdA==",
                    passphrase="fixture",
                    base_url_http=http_url,
                    base_url_ws=ws_url,
                    base_url_data_api=http_url,
                    heartbeat_enabled=True,
                    max_retries=0,
                    http_timeout_secs=2,
                )
            },
            exec_engine=LiveExecutionEngineConfig(reconciliation=False),
            logging=LoggerConfig(
                stdout_level=LogLevel.ERROR,
                is_colored=False,
                buffered_stdout=False,
            ),
            delay_post_stop_secs=0,
            timeout_connection_secs=3,
            timeout_disconnection_secs=2,
        ),
        data_factories={"POLYMARKET": PolymarketDataClientFactory()},
        exec_factories={"POLYMARKET": PolymarketExecutionClientFactory()},
    )
    probe = Probe()
    node.add_strategy(probe)
    handle = node.handle()
    cache = node.cache
    task = asyncio.create_task(node.run_async())
    try:
        await asyncio.wait_for(started.wait(), 6)
        # Parent writes only after observing the native failure log (or readiness
        # for the healthy control). No fixed post-response sleep authorizes submit.
        command = await asyncio.wait_for(asyncio.to_thread(sys.stdin.readline), 15)
        if command.strip() != "SUBMIT":
            raise RuntimeError("Parent did not authorize the diagnostic submission")
        print("TRACE creating_and_submitting_new_order", flush=True)
        order = probe.order_factory.limit(
            instrument_id,
            OrderSide.BUY,
            Quantity.from_str("10.00"),
            Price.from_str("0.5012"),
            time_in_force=TimeInForce.GTC,
            post_only=True,
            quote_quantity=False,
        )
        probe.submit_order(order)
        await until(
            lambda: any(e in events for e in ("OrderAccepted", "OrderDenied", "OrderRejected"))
        )
        cached_order = cache.order(order.client_order_id)
        assert cached_order is not None
        result = {
            "nt_version": version("nautilus-trader"),
            "python": platform.python_version(),
            "platform": platform.platform(),
            "control": healthy,
            "heartbeats": heartbeats,
            "order_http_requests": len(payloads),
            "order_status": str(cached_order.status),
            "order_events": events,
            "requests": requests,
        }
        print("RESULT=" + json.dumps(result, sort_keys=True), flush=True)
    finally:
        handle.stop()
        await asyncio.wait_for(task, 8)
        node.dispose()
        for ws in sockets:
            await ws.close()
        await runner.cleanup()


async def parent(healthy: bool, assert_blocked: bool, output: Path | None) -> int:
    command = [sys.executable, "-u", str(Path(__file__).resolve()), "--child"]
    if healthy:
        command.append("--healthy-control")
    process = await asyncio.create_subprocess_exec(
        *command,
        stdin=asyncio.subprocess.PIPE,
        stdout=asyncio.subprocess.PIPE,
        stderr=asyncio.subprocess.STDOUT,
    )
    assert process.stdout is not None and process.stdin is not None
    lines: list[str] = []
    released = False
    result = None
    try:
        async with asyncio.timeout(35):
            async for raw_line in process.stdout:
                line = raw_line.decode()
                lines.append(line)
                print(line, end="", flush=True)
                trigger = "TRACE strategy_started_after_readiness" if healthy else FAILURE_LOG
                if trigger in line and not released:
                    marker = (
                        "TRACE parent_observed_readiness"
                        if healthy
                        else "TRACE parent_observed_native_failure_log"
                    )
                    lines.append(marker + "\n")
                    print(marker, flush=True)
                    process.stdin.write(b"SUBMIT\n")
                    await process.stdin.drain()
                    released = True
                if line.startswith("RESULT="):
                    result = json.loads(line.removeprefix("RESULT="))
            returncode = await process.wait()
    finally:
        if process.returncode is None:
            process.kill()
            await process.wait()
        if output is not None:
            output.write_text("".join(lines))
    if returncode or result is None or not released:
        raise RuntimeError("Reproducer did not complete; inspect native output")
    if assert_blocked and result["order_http_requests"] != 0:
        print("FAIL: a new order reached the mock after NT logged heartbeat authentication failure")
        return 1
    return 0


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--healthy-control", action="store_true")
    parser.add_argument("--assert-blocked", action="store_true")
    parser.add_argument("--output", type=Path)
    parser.add_argument("--child", action="store_true", help=argparse.SUPPRESS)
    args = parser.parse_args()
    if args.healthy_control and args.assert_blocked:
        parser.error("--assert-blocked applies only to the failure scenario")
    if args.child:
        asyncio.run(child(args.healthy_control))
    else:
        sys.exit(asyncio.run(parent(args.healthy_control, args.assert_blocked, args.output)))

[investlink-ai]

Thanks—that distinction is helpful. I propose rejecting new submissions once heartbeat health is declared unhealthy, rather than queuing potentially stale orders, and reopening admission only after reconnect and a fresh heartbeat acknowledgement. Cancel and query operations would remain available, and the existing heartbeat failure thresholds would remain unchanged. I have a locally tested native-adapter patch covering single/batch submissions, modifications, rate-limit waits, and reconnect. With the locally rebuilt wheel, the loopback Strategy.submit_order reproduction produces OrderDenied and zero create-order requests after the heartbeat 401. Separate adapter tests cover already-accepted orders and requests racing with heartbeat loss. These remain exposure until authoritative order events or reconciliation establish their outcome; heartbeat loss alone does not mark them canceled. The tests use mocks and do not verify Polymarket’s live cancellation timeout. Would maintainers support a focused PR implementing and documenting these semantics, and would you prefer a tracking issue first? If someone is already working on this, I’m happy to coordinate and share the patch and regression tests. Regards, Sam

…

On Mon, 21 Sept 2026 at 03:06, Erol Tasci ***@***.***> wrote: I would treat this as a fail-closed safety boundary, and your reproduction exposes a gap between heartbeat health and order admission. In the documented contract at the commit you linked <https://github.com/nautechsystems/nautilus_trader/blob/b2f61748ba90dd0adb8e5b9918ce56ddc97970eb/docs/integrations/polymarket.md>, a missed heartbeat leads Polymarket to cancel open orders after its timeout, while the adapter reports disconnected after heartbeat failures and asks the operator to reconnect. I do not see a documented guarantee that submit_order is locally rejected during that disconnected interval, so the behavior you observed is consistent with the current wording. For an order-safety heartbeat, I would expect new submissions to be rejected or held until a heartbeat is acknowledged again. The venue timeout is still important for orders already accepted by the venue; a local gate cannot replace that cancellation contract. It would help to make the intended behavior explicit for both new submissions and orders racing with a heartbeat failure. A focused regression test could acknowledge the initial heartbeat, force a retryable failure or auth rejection, call Strategy.submit_order, and assert that no create-order request is sent until reconnect and heartbeat acknowledgement. A separate assertion should cover the fate of an order that was already open at the venue. — Reply to this email directly, view it on GitHub <#5021?email_source=notifications&email_token=B6FVOINP2GVJYJ4IWKWZUV35QAFAZA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBVGI4TMNBUUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-18529644>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B6FVOIIMK2PYV2XZPMIERPL5QAFAZAVCNFSNUABIKJSXA33TNF2G64TZHMYTGOBVGUZDCOJWHNCGS43DOVZXG2LPNY5TCMBYGQYTOMRZUF3AE> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/B6FVOIIHTXXZNM6APCISNGT5QAFAZA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBVGI4TMNBUUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVJTG633UMVZF62LPOM> and Android <https://github.com/notifications/mobile/android/B6FVOIJE7WVWVNO2LUJJOBT5QAFAZA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBVGI4TMNBUUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVZTG633UMVZF6YLOMRZG62LE>. Download it today! You are receiving this because you authored the thread.Message ID: <nautechsystems/nautilus_trader/repo-discussions/5021/comments/18529644@ github.com>