§03 · Mechanics

From raw data to a signed order, with a human in the middle.

Seven stages. Five agents. Three artifacts. One signature. Every stage writes before the next reads — no in-memory handoffs. The artifact is the contract.

§03.1The Signal Lifecycle

STAGE 1

Ingest

Trading Spoke

Alpaca bars · FRED macro · broker research · CB RSS

→ market-data/{date}/*.json

STAGE 2

Narrate

Grok Narrative

Raw data + FRED macro

→ snapshots/{date}/pre_market.json

STAGE 3

Watch

Watchdog

Live positions + thresholds

→ alerts/{date}/L{1,2,3}.jsonl

STAGE 4

Propose

Analyst

TV signal + pandas-ta + corpus

→ analysis/{id}.json

STAGE 5

Size

Risk Manager

Proposal + book + 8 rules

→ risk-check/{id}.json

STAGE 6

Approve

Operator · human

Full evidence chain, schema-locked

→ order-submission/{id}.json

STAGE 7

Execute

Execution

Signed bundle, 4 pre-flight gates

→ Alpaca ticket + fill record

Each stage writes before the next reads. No in-memory handoffs. Every artifact is the contract between stages.

§03.2Agent Contracts

Contract A

Analyst → Risk

Producer writes analysis/{id}.json with thesis · catalyst · stop · target. Consumer reads, returns risk-check/{id}.json. fail: missing field → decline

Contract B

Risk → Operator

Producer writes risk-check/{id}.json with rule_results[] + sign_off. fail: approved=false → no decision card

Contract C

Operator → Execution

Producer writes order-submission/{id}.json with operator_approved: true (enum-locked). fail: missing → refuse

Contract D

Spoke → Agents

Producer writes R2 JSON on cron. Consumers read on session open. fail: no file → halt, never hallucinate

File-based comms (ADR-003). No tmux peer messaging. Audit trail is the filesystem.

§03.3Where Data Lives

R2 · Cloudflare

plutus-trading bucket

Market data, snapshots, alerts, reports. Public-read for dashboard. Write via n8n service account. Retention: indefinite.

SQLite · VPS

trading.db

Trade log + signal log, append-only. Survives VPS restart via volume mount. Retention: indefinite.

FastAPI · VPS

Alpaca pass-through

Live account + positions. No persistence. CORS scoped to trading.boas.dev.

Broker

Alpaca Paper

Authoritative order state. Paper until ≥90-day track record.

No Alpaca credentials in the browser (ADR-004). Dashboard reads R2 + proxy, never the broker direct.

§03.4The Human's Seat

"Every consequential action requires a signed order bundle. The schema refuses to submit without it."

Sees

Four-agent vote, explicit dissent, risk budget impact, cited evidence.

Signs

Order bundle with thesis_context · risk_parameters · sign_off · operator_approved.

Prevents slip

operator_approved: enum:[true] — absence = automatic refusal.

The gate is a schema, not a policy. Enforcement cannot drift from the document.

§03.5Failure Modes

Missing data. Spoke pipeline failed → agent refuses to read missing file. Halts with status-line note. Never fills in from memory.

Dissent. Analyst and Risk disagree → Operator sees both reads + dissent chip + triggering rule. Surfaced, not averaged away.

Hard rule fail. Any of 8 risk rules triggers → proposal killed before Operator sees it. Logged, not silenced.

Broker outage. Alpaca returns non-200 → Execution returns structured error, never retries silently.

Kill switch. Operator command voids open proposals, pauses watchdog writes, marks session halted in session-log.

The system is designed to fail loud, not quiet.

§03.6What It Is / Is Not

This platform is

An intelligence department for one fund
Code and data owned by Viska
Schema-enforced human approval on every order
A paper-trading record being built over 90 days
An institutional risk framework (1/5/20/8)
Auditable to the artifact level

Is not

A signal SaaS with many subscribers
A hosted product Viska rents
An autonomous trading bot
A live-capital system on day one
A retail Kelly-sizing gamified tier
A black-box recommendation engine

Five of the six rows are architectural commitments, not missing features.