Architecture at a glance

Four engines around one commons.

Three trust boundaries hold it together: no RPC or imports (coupling is files + git), validated bundles are frozen (machine-built, never hand-edited), and signals can’t skip the gate (a new primitive must be requested and implemented, not smuggled in).

Lifecycle data flow

One idea, traced through the filesystem.

Every row is append-only or content-addressed. The journal threads them together, so any fill can be walked back to the search that produced it.

HEURESIS · role & stack

Discovery, two ways — exhaustive and creative.

Grid mode enumerates a parameter space deterministically, cheapest-first. Hypothesis mode prompts an LLM for novel candidates, then validates its output through a strict schema. A YAML template sends both down a deterministic path before anything leaves the building.

HEURESIS · architecture & differentiators

It talks to the validator through a subprocess and a folder — nothing else.

• Never imports EPISTEME. It shells out to the epi CLI and reads/writes AGORA files — discovery and validation stay fully decoupled.
• Deterministic template path. Campaign configs are frozen, thresholds load from the shared schema, and a config hash is recorded — same config, same candidate sequence.
• Two-tier KB, three-layer de-dup. Its own knowledge base plus the validator’s history mean no candidate is ever paid to validate twice.
• Hallucination containment. If the LLM invents a signal that doesn’t exist, HEURESIS files a structured request — it cannot edit the validator to make itself pass.

HEURESIS · maturity

Small, sharp, strictly typed.

Actively developed — recent work adds an autonomous, agent-driven campaign mode that drives multi-round discovery and digests the validator’s feedback.

EPISTEME · role & stack

A 13-rung ladder that halts the moment a candidate fails.

The largest and most important platform. A spec climbs rungs spanning data quality, causality, costs, signal selection, walk-forward validation, significance, path risk, generalization, adversarial stress, Monte Carlo and deployment readiness. On green, it emits an executable bundle.

EPISTEME · architecture

Forty-two single-purpose packages in an enforced layering.

• Atomic libraries. One concern each — features, labels, cross-validation, portfolio, microstructure, regime, Monte Carlo, lifecycle — composed into the ladder.
• The dependency graph is law. An import-linter contract forbids upward imports; a violation fails CI. The architecture can’t silently rot.
• Fail loud. Typed exceptions only; a failed gate halts the run rather than quietly compensating later.
• The validator core is human-authored. Only two narrow, schema-bound LLM nodes (intake and red-gate explanation) ever touch a live run.

EPISTEME · differentiators

The verdict is trustworthy because it can’t be argued with.

• Pre-committed, immutable thresholds. Every pass/fail line is fixed in advance and audited. You cannot tune the gate to admit a marginal strategy.
• Byte-identical reproducibility. The same spec and fixtures produce identical artifacts down to the byte — checked twice on every commit.
• Institutional memory. Every run is content-addressed and kept; the archive of what didn’t work is itself an asset.

EPISTEME · maturity

The most heavily engineered platform in the stack.

Driven by dozens of consumer-feedback release cycles — the platform is in continuous, disciplined evolution.

KAIROS · an elective capability

Off to the side of the core pipeline — by design.

KAIROS · architecture & differentiators

EPISTEME’s discipline, pointed at regime models.

• Two verdicts. A classifier must first prove it identifies the right state, then that it gets the timing of state changes right — identification before duration.
• Diagnostic rungs can never gate. Look-ahead-using evaluation rungs are allowed for insight but are mechanically barred from affecting the verdict.
• Thresholds cite the literature and are immutable; drift fails CI.
• Sibling-authored adapters. Other teams ship a classifier as a module behind a documented protocol — KAIROS validates it with zero per-candidate engineering.

KAIROS · maturity

Newest sibling, same rigor.

Correctness is held not only by coverage but by a matrix of known-good and known-bad fixtures: every rung must return the expected verdict on every fixture, byte-for-byte.

PRAXIS · role & stack

Exchange-agnostic, and paranoid by design.

PRAXIS loads validated bundles, re-verifies them, and runs them live. Strategies are loaded as self-contained modules — PRAXIS holds no signal logic of its own; it is the disciplined runtime around someone else’s proven edge.

PRAXIS · architecture & differentiators

One process, many strategies, total isolation.

• Determinism re-checked at load. Each bundle is replayed against its fixtures before it can trade; non-reproducible code never reaches the exchange.
• Per-strategy crash isolation. Separate namespace, state and risk envelope per strategy — one blowing up halts only itself.
• Two-layer circuit breaker. A portfolio drawdown ramp plus a fat-tail-aware stop, sized to respect the moves crypto actually makes.
• Reconciled against reality. Positions and balances are reconciled against the exchange on a loop; drift beyond tolerance halts trading.

PRAXIS · maturity

Production-grade, and tested like it.

Ships containerised with documented runbooks for deploy, promote, halt, reconcile and key rotation — operations are first-class, not an afterthought.

AGORA · role & surfaces

A message bus with no server — just files and git.

AGORA · architecture & differentiators

The boring choice that makes everything auditable.

• Tracked vs ephemeral. Bundles, schemas and the journal are permanent; candidates and results are working files, swept by a garbage collector that refuses to touch protected paths.
• The journal is the spine. An append-only event log — one source of truth for “what ran on a given day” that no single platform’s local state can answer.
• A packet broker gives cross-team requests a real state machine (open → acknowledged → replied → closed) instead of ad-hoc messages.
• Integrity by hashing. Every bundle file is SHA-256-mapped; tampering is detectable.

AGORA · maturity

Small surface, heavy guarantees.

CI runs scheduled safety cycles and disaster-recovery drills — the commons polices its own integrity, not just its code.

How they coordinate

The whole contract, on one page.

No row in this table is a function call. Every one is a file in a git history.

Plain-language glossary

The acronyms, defined.

Why the architecture is the moat

Anyone can write a backtest. Almost nobody builds this around it.

• Determinism end-to-end — discovery logs its seeds, the validator is byte-reproducible, the executor refuses non-reproducible code.
• Hard gates over judgement — thresholds are pre-committed and immutable in two independent validators (strategies and regimes).
• Zero runtime coupling — five projects that can fail, evolve and deploy independently, joined only by an auditable commons.
• The whole archive is evidence — every run, rejection and hand-off is kept and traceable. The discipline compounds.