One execution path, and the journal underneath it. Nothing in the system has a second place a fact lives, which is the only reason every number can be recomputed from the record.
cli -> daemon -> loop -> guardian -> executor -> journal
^ ^ |
| +-- curriculum, reflection, maintenance -> lessons
+-- evidence ingest (broker fills) -> evaluator -> attributionWhat owns what
| component | owns |
|---|---|
guardian | the hard limits. Every order is checked here, independently of whoever proposed it, and a non-finite limit is refused rather than treated as no limit |
executor | the broker call, and nothing else. It cannot decide |
journal | every cycle and every event, append-only, the only source of truth |
evaluator | PnL attribution: which of signal, model, strategy, allocation, execution or cost produced the result |
research | candidate generation and offline screens. Quarantined: production code cannot import it, checked by a gate |
doctor | 52 check classes over the code and the running system |
How the record survives itself
The journal rotates at a size cap. A generation reaching the horizon is moved into journal-archive/ and read back first, so the record is the whole record and not a rolling window. If a rotation cannot archive, the append fails rather than deleting history to keep going.
There is no copy anywhere else. The archive keeps the record from being deleted on one host; nothing ships it off that host, and no test claims otherwise.
What the loop changes
- The strategy's own rule decides first. The model may override it only with a reason, and both are recorded.
- A strategy is admitted on recorded evidence, screened offline, and retired on its own decisions. The reason travels with the transition.
PAUSEDis a holding pattern, not a graveyard: the daemon returns one paused strategy to probation per pass, on journalled evidence.