Prediction is not the hard problem.
Proving authority is.
Three proprietary-capital systems and a separate observer: live execution, explicit authority boundaries, and a dated account of what the evidence still cannot close.
Its own capital only — no external money, ever. Not an investment product, fund, or advisory service.
Most systems ask: how do we make the model smarter?
This one asks: how do we contain the damage when the model is wrong?
What this public snapshot can support
A capital-redacted, cycle-specific extract. Process completion is separated from evaluability; open findings and blind checks are first-class results, not footnotes.
Step completion is reported separately from evaluability. A return code is process evidence, not a verdict that the underlying check could see.
31 gates were observed enforcing, 2 advisory and 14 not exercised in this cycle; 89.1% of the recorded gate evaluations were vetoes. These are not order or fill counts.
Coverage is partial. Machine-initiated and unattributed arming events remain open evidence, including a human-only class.
Nine remediations were adopted. Zero is deliberate non-credit: no change is called effective without a preregistered observable and a sufficient post-change window.
The normal cycle closed the targeted taxonomy gap, produced a non-blind scoped replay, preserved the machine-initiated-event guardrail, and delivered ordinary evidence updates through protected main history. The campaign remains OBSERVING with zero effect-verified; this receipt does not replace the morning snapshot.
Authority must be explicit, bounded and observed.
Most automated systems are built to be right — more data, more parameters, a sharper edge. But in anything that touches real money, prediction is the easy part. Models are wrong constantly: regimes shift, data lies, an edge decays the week after you find it. Being right more often is a marginal game with a ceiling.
The hard problem is authority — what a system is permitted to do when the model is wrong, which is often, and confidently wrong, which is worse. A model that can act on its conclusions is a model that can act on its mistakes: at machine speed, against live capital, while no one is watching.
So Neurobrick inverts the usual question: rather than sharpen the model, make authority explicit and observable. Every proposal — to buy, to sell, to do nothing — is checked against invariants and veto rules before anything reaches a broker. The design target is asymmetric: automation may tighten guardrails and reduce risk inside a bounded envelope; opening or expanding live authority should require a human. The latest audit also found exceptions and unattributed events, so that boundary is presented as an open conformance problem, not a finished guarantee.
This is not a safety feature bolted onto a strategy. It is the system. The prediction layer is replaceable; the governance layer is the point. Most of the engineering goes not into being right, but into surviving being wrong — because over a long enough run, the second is what keeps the capital.
Being right is an input. It is never a permission.
Where the architecture came from
The architecture did not come from a theory of how the system should work. It came from watching what actually broke — and the model was rarely the problem. A box went dark and raised nothing. A hash chain forked on a clock tie. An order nearly filled twice. A risk limit sat defined but never read. Each was the system doing something it was never supposed to be able to do. Everything that follows is the accumulated answer to one question: what must never be possible?
One discipline. Three live systems.
Three independent trading systems run on separate machines. They share a governance discipline, implemented locally rather than through one runtime. The intended boundary is human-opened and machine-tightened; current audit coverage is partial and has found exceptions, so conformance remains open.
Arming is not per-order approval; it is bounded execution authority granted per system and account, after which the system trades unattended inside its local gates. The intended upstream path keeps proposals separate from execution, while the observer audits authority and actuator access for departures from that design.
What the architecture is trying to make difficult
Each property is separated from its current evidence. Some are enforcing controls, some are scoped observations, and some remain open audit findings.
An ambiguous timeout cannot become a duplicate order
The network drops the acknowledgement, not the order — so a timeout is ambiguous, and the reflexive retry is how you fill twice.
An ambiguous submission is quarantined as maybe-sent and never automatically retried; it is resolved by reconciling against the broker's own record. Each enforcing system implements this independently — a write-ahead, hash-chained submission ledger that fail-closes a duplicate submit on one, a durable order intent with a database-unique key on the other.
Implemented in the two enforcing systems; the third only detects and pages. Drilled off-box against a mock broker: under an injected ambiguous timeout, each enforcing system resolved to one order, zero duplicates.
The decision log cannot be quietly rewritten — and it caught itself forking
An audit trail you can edit is not evidence; a log ordered by wall-clock corrupts under sub-millisecond ties.
On the two larger systems, every proposal, accepted or vetoed, is SHA-256 hash-chained per entity. The verifier caught a real fork — two entries written close enough to tie on the same millisecond could not be ordered by the clock; ordering moved to insert sequence, not time, and concurrent appends are serialized behind an advisory lock.
Tamper-evident, not tamper-proof. A rejected order leaves the same audit-grade trace as an executed one.
Risk controls fail safe — including when the control itself fails
The dangerous failure is the safety device that fails open because reading its own state threw.
The latest observer census found 47 gates: 31 enforcing, 2 advisory and 14 not exercised in that run. Where being wrong costs capital, covered entry paths are designed to fail toward paper or no action; de-risk exits retain explicit carve-outs so safety machinery does not strand risk.
A dated census, not proof that every gate ran or every surface was covered.
Research promotion is challenged, not presumed clean
A backtest is a hypothesis, and a hypothesis tested enough times will pass by luck alone.
Promotion logic uses out-of-sample and multiple-testing controls on covered pipelines, while an off-box challenge layer attempts to refute the resulting calls. The latest validation scan also found live modules below current thresholds and unregistered or fail-open paths.
Validation is real but not universal; closure remains an active audit surface.
The model was almost never what broke.
Lessons, stated the way they were learned
Surprises from operating a governed capital system. Each one changed the architecture. None is a slogan; each is a thing that was, at some point, wrong.
A monitor that lives on the box it watches is not a monitor.
A machine went dark for over eight hours and raised nothing, because every alarm it could send died with it. The watchdogs now run off-box — a machine can no longer take its own alarm down with it — and the machines watch each other. The realization generalizes past trading: a health check co-located with the thing it checks is decoration.
A limit you define but never enforce is worse than no limit.
On the equities system, a per-name concentration cap lived as a constant for months and was never read, while a single name sat at more than half the book. The dead limit was more dangerous than its absence — it manufactured confidence without enforcement. It now fails closed, but only after a retry: the broker read it depends on, get_holdings, flaked about 3,180 times over thirty days — roughly 106 a day, a measured baseline rather than an estimate. A naive fail-closed on a read that unreliable blocks more good orders than bad ones, so the gate retries first and only then fails closed. In a later thirty-day window it did not fail closed once across 6,386 evaluated orders — the retry absorbed every flake.
Attribution bugs disguise themselves as alpha and as risk.
A batch of orders shipped without a strategy label, got bucketed under a default name, and the per-strategy circuit breaker auto-paused that strategy at a deeply negative Sharpe — reacting to a labeling artifact, not a loss. The risk system fired correctly on data that was wrong. The fix lived upstream, at construction time; the breaker was never the problem.
The exchange's real rules are learned from rejections, not from docs.
The tick-size table matched KRX's published schedule and ETF orders were still rejected: certain ETFs use a flat tick regardless of price. A separate batch, priced in the 1,000–2,000 KRW band, came back rejected for the wrong tick unit — that one traced to the table's own boundary, not to the exchange. Snapping now reads the live order book to infer the actual increment per instrument and treats the documented table as a fallback only. The spec was a hypothesis; the rejection codes were the data.
A specification is not an enforcement.
There is an elaborate, typed, versioned contract layer that formally specifies every constraint in the system. The live money path does not import it. The enforcement that actually matters turned out to live in a smaller, less elegant service. It is easy to mistake the comfort of a formal spec for the safety of a running guard — and worth re-checking, periodically, which one is in the path.
Latency between a signal and its fill is an adverse-selection tax.
The broker reflects available cash roughly twenty seconds after an order is blocked for insufficient funds; by the time the cash showed up and the order finally filled, the signal that justified it was stale — a fill that lost because it was late, not because it was wrong. That balance-reflection delay is a fixed adverse-selection window, so the gate now carries a signal-freshness veto — armed, it refuses a submission whose signal has outlived its freshness window.
Safety state in the wrong place fails open.
In the control plane, the submit-time kill-switch chain once disarmed silently — fail-open, no alert — because the only copy of its armed state lived in a directory that was git-ignored, and a clean checkout wiped it. Armed state now has a sealed, off-worktree home with an explicit authority order — designed so that a fresh deploy cannot quietly leave the system unguarded.
Operated, not demoed
A system that has survived its own production incidents — and is changed, while live, without breaking. Not a prototype that has only seen the happy path.
The incident history is written into the codebase — a stop that froze and let a position run, a state oscillation between two writers, the clock-tie fork. Each is a place the happy path was not enough. The risk had migrated out of the math and into the operations.
Above the order-level gates sit slower loops: per-strategy circuit breakers, exposure gates, reconciliation against the broker's own records, and a risk register maintained by the observer's automated daily off-box review. Governance incidents are tracked the way losses are.
Behavior-invariant refactors
The order executor was reduced from 6,304 to 4,070 lines by extracting 34 pre-trade gates into a mixin via AST-verified extraction with method-resolution order preserved — staged across reviewed changes. The shape of the code changed; the gate logic, byte for byte, did not.
Observe-first deployment
Selected behavior changes use a flag-and-ledger pattern: the old path stays the default while both verdicts are compared before promotion. Repository history protection now rejects destructive main updates on the observer repository, but required-check enforcement, machine identity separation and source-to-runtime attestation are not universal. Green CI is evidence about a revision, not proof that every deployment was gated by it.
Scoped re-execution
Selected state and gate decisions have been reconstructed and re-run away from the live process. Decision replay and feature replay are separate instruments: the first exists for one system, while three representative system paths remain uninstrumented; the current main feature replay is not evaluable in the published snapshot. Replay and recovery are therefore published as coverage maps, not fleet-wide absolutes.
Operator-absence safe-halt
A dead-man drill: with operator check-in suppressed past the window, an off-box watch reached each armed system over SSH and engaged its existing kill — kill engaged, no further submissions, the transition written to that system's append-only audit trail, and cleared only by the operator. In standing operation the watch remains propose-only: a missed check-in pages the operator, who decides whether to halt. It adds no second person who can say no.
Governance is the system. Execution is incidental.
The intended path separates advisory output, constraints, execution authority and evidence. The current observer tests where the running implementation diverges from that structure.
Underneath, the larger systems retain durable decision and portfolio records that make scoped replay and audit possible. Coverage differs by system and module; no fleet-wide replay claim is made.
The system's most common output is inaction.
This page describes the governance surface. The strategy layer that rides on it is deliberately not described. This public surface was recalibrated against the 20 August 2026 observer snapshot. Claims are dated because the effective system can move faster than the website.
Where this is not bulletproof
The failure boundaries, stated plainly. This section is longer than most pages would allow, on purpose.
Single-operator bus factor
One person designed, operates, and is on call for all of it. That is the reason the system is coherent — and the reason its largest risk is one person.
Institutional structure is out of scope by design
No committees, no compliance department, no multi-operator workflow. Those exist to protect outside money and to give someone other than the operator the power to say no — there is no outside money here, and no one else who can say no. Gates, ledgers, and read-only observers that re-derive and argue against the system's own resolved calls cover the routine, repeatable part of that work; independent human challenge — a second person who can say no — is exactly what this scope forgoes. Its cost is the bus factor above.
Off-box safe-halt is a drilled capability, not a standing auto-halt
The operator-absence dead-man proved it can engage each armed system's existing kill off-box on absence — a bounded halt, never a liquidation. In standing operation it only pages; the halt is the operator's action, conditioned on the watch host being up. It does not reduce the single-operator bus factor and adds no one who can say no.
Recovery is not currently verified
The fleet is not a multi-region deployment, and the latest observer state contains no receipt that supports a full clean-box, end-to-end restore claim. Backups or partial recovery work are not presented here as recovery proof.
Authority closure remains open
The latest audit covered 18 of 56 authority surfaces and found machine-initiated and unattributed arming events. The intended human boundary is not yet a complete observed invariant.
Adoption is not effect verification
Across the current 36-day scoreboard, nine remediations were adopted and none yet reached the observer's effect-verified threshold. That zero is deliberate non-credit: a merge or quiet period is not called effective without a preregistered observable and sufficient post-change evidence.
Some non-critical paths fail open by choice
On non-critical async gates, availability is chosen over safety deliberately. Fail-closed is the default only where being wrong costs capital.
The formal contract layer is not in the money path
A beautiful spec the hot path does not call is decoration. The enforcement lives elsewhere; the gap is named, not hidden.
The governance “constitution” is not alignment
It is bypassable pattern-matching, not learned alignment. No claim of AI safety beyond architecture is made or implied.
Integrated, not authored
Part of the AI tooling runs on a self-hosted, open-source inference engine (exo) — operated and integrated here, not written here.
God-files remain
The largest modules are still several thousand lines, partially decomposed. The work is ongoing, and stated as ongoing.
Not a miniature institution.
A deliberate compression of one.
One person
One architect designed the governance discipline, built the event-sourced runtime, did the research, stood up the infrastructure, and is the person paged when a box goes dark at 3 a.m. Not a team that divided the work — one person who held all of it at once, against live capital, from the first live order onward. The first months alone surfaced enough real failures to reshape the architecture.
That is possible because many functions a firm would staff are compressed into machinery. Engineering help is AI-assisted; operator review is the working convention, while mechanical checks cover selected behavior-invariant changes. Oversight reads the fleet daily, records sourced facts, challenges the register's resolved calls and pages on drift. That independence is off-box, not a second human who can say no, and current CI or branch settings should not be confused with a universal merge veto.
The intended invariant for AI assistance is proposal before authority. The provenance window cannot yet prove that invariant end to end, so the claim stays narrower than the design.
This is stated as a fact, not a credential, because it cuts both ways. It is why the system is coherent: every layer was designed by the same person who has to operate it. It is also why its single largest risk is a bus factor of one. Both are true; the page would be dishonest to print only the first.
Most automated systems are built around prediction.
Neurobrick is built around refusal.
Open to a few conversations
Not raising capital, and not managing money for others. Open to conversations with engineers, quants, and researchers who have built systems that fail in interesting ways.
Neurobrick is a personal systems-engineering project that operates proprietary capital only. It is not an investment product, fund offering, or advisory service; it does not accept external capital; and it does not sell signals or manage money for others.
Architecture and methods on this page are described at a conceptual level by intent. The self-hosted inference engine (exo) is open-source; it is operated and integrated here, not authored.