Prediction is not the hard problem.
Authority is.
One governance discipline, three live trading systems, three machines — proprietary capital, human-armed, designed, built, and operated end to end by a single architect.
Its own capital only — no external money, ever. Not an investment product, fund, or advisory service.
Most systems ask: how do we make the model smarter?
This one asks: how do we contain the damage when the model is wrong?
Intelligence proposes. It is never allowed to act.
Most automated systems are built to be right — more data, more parameters, a sharper edge. But in anything that touches real money, prediction is the easy part. Models are wrong constantly: regimes shift, data lies, an edge decays the week after you find it. Being right more often is a marginal game with a ceiling.
The hard problem is authority — what a system is permitted to do when the model is wrong, which is often, and confidently wrong, which is worse. A model that can act on its conclusions is a model that can act on its mistakes: at machine speed, against live capital, while no one is watching.
So Neurobrick inverts the usual question: rather than sharpen the model, deny it direct authority over capital. Intelligence proposes; it is never allowed to act. Every proposal — to buy, to sell, to do nothing — is checked against explicit invariants and veto rules before anything reaches a broker. The default is to do nothing. A human arms every live-capital authority — opening the live envelope, expanding exposure, clearing a halt; automation may only tighten guardrails and shrink sizing within that human-armed envelope, never open live or grow a position.
This is not a safety feature bolted onto a strategy. It is the system. The prediction layer is replaceable; the governance layer is the point. Most of the engineering goes not into being right, but into surviving being wrong — because over a long enough run, the second is what keeps the capital.
Being right is an input. It is never a permission.
Where the architecture came from
The architecture did not come from a theory of how the system should work. It came from watching what actually broke — and the model was rarely the problem. A box went dark and raised nothing. A hash chain forked on a clock tie. An order nearly filled twice. A risk limit sat defined but never read. Each was the system doing something it was never supposed to be able to do. Everything that follows is the accumulated answer to one question: what must never be possible?
One discipline. Three live systems.
Three independent trading systems run on three separate machines. All three carry the same governance discipline, implemented independently in each rather than shared at runtime. The gates exist not to run the systems but to stop them. Each is separately armed, and none can arm itself.
Arming is not per-order approval; it is the operator granting bounded execution authority — per system, per account — after which the system trades unattended inside its gates. Arming changes nothing upstream: models still emit proposals only, and every proposal must clear the same deny-by-default checks before it can reach a broker.
What it makes impossible
Each property is stated as an outcome first, then why it matters, then how it works. None of the techniques is novel; the point is that all four are enforced on a live money path.
An ambiguous timeout cannot become a duplicate order
The network drops the acknowledgement, not the order — so a timeout is ambiguous, and the reflexive retry is how you fill twice.
An ambiguous submission is quarantined as maybe-sent and never automatically retried; it is resolved by reconciling against the broker's own record. Each enforcing system implements this independently — a write-ahead, hash-chained submission ledger that fail-closes a duplicate submit on one, a durable order intent with a database-unique key on the other.
Implemented in the two enforcing systems; the third only detects and pages. Drilled off-box against a mock broker: under an injected ambiguous timeout, each enforcing system resolved to one order, zero duplicates.
The decision log cannot be quietly rewritten — and it caught itself forking
An audit trail you can edit is not evidence; a log ordered by wall-clock corrupts under sub-millisecond ties.
On the two larger systems, every proposal, accepted or vetoed, is SHA-256 hash-chained per entity. The verifier caught a real fork — two entries written close enough to tie on the same millisecond could not be ordered by the clock; ordering moved to insert sequence, not time, and concurrent appends are serialized behind an advisory lock.
Tamper-evident, not tamper-proof. A rejected order leaves the same audit-grade trace as an executed one.
Risk controls fail safe — including when the control itself fails
The dangerous failure is the safety device that fails open because reading its own state threw.
A ladder of 30+ pre-trade checks, each explicitly fail-open or fail-closed. Where being wrong costs capital the default is fail-closed: the executor forces paper when it cannot even read the live-gate state, so an unreadable gate defaults to not-live rather than live. De-risk exits are exempted from entry gates, so a stop-loss can never deadlock behind the machinery meant to block new risk.
No single layer is trusted to be sufficient.
Unvalidated research cannot reach live capital
A backtest is a hypothesis, and a hypothesis tested enough times will pass by luck alone.
A new signal carries zero weight until it clears out-of-sample validation that corrects for the number of trials — Combinatorial Purged Cross-Validation plus a Deflated Sharpe. A stricter method ships behind a flag, the old one kept byte-for-byte as default, both verdicts compared in a ledger before the new one may gate a live decision.
Enforced on the flagship research pipeline. The discipline, not the math, is the rare part.
The model was almost never what broke.
Lessons, stated the way they were learned
Surprises from operating a governed capital system. Each one changed the architecture. None is a slogan; each is a thing that was, at some point, wrong.
A monitor that lives on the box it watches is not a monitor.
A machine went dark for over eight hours and raised nothing, because every alarm it could send died with it. The watchdogs now run off-box — a machine can no longer take its own alarm down with it — and the machines watch each other. The realization generalizes past trading: a health check co-located with the thing it checks is decoration.
A limit you define but never enforce is worse than no limit.
On the equities system, a per-name concentration cap lived as a constant for months and was never read, while a single name sat at more than half the book. The dead limit was more dangerous than its absence — it manufactured confidence without enforcement. It now fails closed, but only after a retry: the broker read it depends on, get_holdings, flaked about 3,180 times over thirty days — roughly 106 a day, a measured baseline rather than an estimate. A naive fail-closed on a read that unreliable blocks more good orders than bad ones, so the gate retries first and only then fails closed. In a later thirty-day window it did not fail closed once across 6,386 evaluated orders — the retry absorbed every flake.
Attribution bugs disguise themselves as alpha and as risk.
A batch of orders shipped without a strategy label, got bucketed under a default name, and the per-strategy circuit breaker auto-paused that strategy at a deeply negative Sharpe — reacting to a labeling artifact, not a loss. The risk system fired correctly on data that was wrong. The fix lived upstream, at construction time; the breaker was never the problem.
The exchange's real rules are learned from rejections, not from docs.
The tick-size table matched KRX's published schedule and ETF orders were still rejected: certain ETFs use a flat tick regardless of price. A separate batch, priced in the 1,000–2,000 KRW band, came back rejected for the wrong tick unit — that one traced to the table's own boundary, not to the exchange. Snapping now reads the live order book to infer the actual increment per instrument and treats the documented table as a fallback only. The spec was a hypothesis; the rejection codes were the data.
A specification is not an enforcement.
There is an elaborate, typed, versioned contract layer that formally specifies every constraint in the system. The live money path does not import it. The enforcement that actually matters turned out to live in a smaller, less elegant service. It is easy to mistake the comfort of a formal spec for the safety of a running guard — and worth re-checking, periodically, which one is in the path.
Latency between a signal and its fill is an adverse-selection tax.
The broker reflects available cash roughly twenty seconds after an order is blocked for insufficient funds; by the time the cash showed up and the order finally filled, the signal that justified it was stale — a fill that lost because it was late, not because it was wrong. That balance-reflection delay is a fixed adverse-selection window, so the gate now carries a signal-freshness veto — armed, it refuses a submission whose signal has outlived its freshness window.
Safety state in the wrong place fails open.
In the control plane, the submit-time kill-switch chain once disarmed silently — fail-open, no alert — because the only copy of its armed state lived in a directory that was git-ignored, and a clean checkout wiped it. Armed state now has a sealed, off-worktree home with an explicit authority order — designed so that a fresh deploy cannot quietly leave the system unguarded.
Operated, not demoed
A system that has survived its own production incidents — and is changed, while live, without breaking. Not a prototype that has only seen the happy path.
The incident history is written into the codebase — a stop that froze and let a position run, a state oscillation between two writers, the clock-tie fork. Each is a place the happy path was not enough. The risk had migrated out of the math and into the operations.
Above the order-level gates sit slower loops: per-strategy circuit breakers, exposure gates, reconciliation against the broker's own records, and a risk register maintained by the observer's automated daily off-box review. Governance incidents are tracked the way losses are.
Behavior-invariant refactors
The order executor was reduced from 6,304 to 4,070 lines by extracting 34 pre-trade gates into a mixin via AST-verified extraction with method-resolution order preserved — staged across reviewed changes. The shape of the code changed; the gate logic, byte for byte, did not.
Observe-first deployment
Behavior changes ship observe-first — the same flag-and-ledger pattern as the validation gate above: the old path stays the default, both verdicts compared in a ledger before the new path may decide anything. Schema or contract drift fails the build; deploys of the largest system gate on a green main. The oldest live-money system now runs its full test suite in CI on every pull request and every push to its main branch, where the same suite was previously run only by hand.
Event-sourced replay
Every cycle is replayable from the captured log, fills and clocks included — drilled on the largest system two ways. State: two independent replays of the same past timestamp reproduced hash-identical state. The decision path: over a window where the gate code was unchanged, the pre-trade gate logic was re-executed off-box against inputs rebuilt from the order ledger and reproduced its recorded allow/veto verdicts — reason strings included — field for field, for the gates whose inputs come from the ledger alone. Backups are layered, with a daily client-side-encrypted off-site tier for site loss; one off-site archive was cold-restored on a clean cloud box and receipted across five checks — bytes against an independent off-box manifest, database integrity, clean-box provenance, RTO/RPO, and the audit chain's day-digests matched an independently-captured off-box anchor exactly. That corroborates the database tier restores. The largest system was then rebuilt end to end on that box — code, database, and the escrowed encryption key — and booted with its safety-gate pipeline evaluating under a forced-testnet dry run; broker keys were withheld, so it could not trade. Live arming, broker connectivity, and the other two machines were not drilled.
Operator-absence safe-halt
A dead-man drill: with operator check-in suppressed past the window, an off-box watch reached each armed system over SSH and engaged its existing kill — kill engaged, no further submissions, the transition written to that system's append-only audit trail, and cleared only by the operator. In standing operation the watch is propose-only: a missed check-in pages the operator, who decides whether to halt — the same “intelligence proposes, it is never allowed to act” discipline the rest of the system holds, applied to its own safety actuator. It adds no second person who can say no.
Governance is the system. Execution is incidental.
Every action passes through layers that exist only to deny it, and must clear all of them before anything reaches a broker.
Underneath sits one reconciled portfolio state, read through a single interface; every decision references an immutable, event-sourced snapshot — which is what makes replay and audit possible.
The system's most common output is inaction.
This page describes the governance surface. The strategy layer that rides on it is deliberately not described. The claims here were audited, claim by claim, against the running fleet in July 2026; the two that did not survive were corrected.
Where this is not bulletproof
The failure boundaries, stated plainly. This section is longer than most pages would allow, on purpose.
Single-operator bus factor
One person designed, operates, and is on call for all of it. That is the reason the system is coherent — and the reason its largest risk is one person.
Institutional structure is out of scope by design
No committees, no compliance department, no multi-operator workflow. Those exist to protect outside money and to give someone other than the operator the power to say no — there is no outside money here, and no one else who can say no. Gates, ledgers, and read-only observers that re-derive and argue against the system's own resolved calls cover the routine, repeatable part of that work; independent human challenge — a second person who can say no — is exactly what this scope forgoes. Its cost is the bus factor above.
Off-box safe-halt is a drilled capability, not a standing auto-halt
The operator-absence dead-man proved it can engage each armed system's existing kill off-box on absence — a bounded halt, never a liquidation. In standing operation it only pages; the halt is the operator's action, conditioned on the watch host being up. It does not reduce the single-operator bus factor and adds no one who can say no.
Not highly available
The trading fabric is three machines, a homelab — not a multi-region deployment. It tolerates a box going dark; it does not tolerate the site going dark without a restore. The database tier was cold-restored on a clean cloud box — bytes matched an independent off-box manifest, the database passed integrity check, and the audit-chain day-digests matched an off-box anchor row for row — and the largest system was then rebuilt end to end on that box (code, database, the escrowed encryption key) and booted with its safety gates evaluating under a forced-testnet dry run, broker keys withheld. Live arming and a full three-machine restore have not been drilled.
Some non-critical paths fail open by choice
On non-critical async gates, availability is chosen over safety deliberately. Fail-closed is the default only where being wrong costs capital.
The formal contract layer is not in the money path
A beautiful spec the hot path does not call is decoration. The enforcement lives elsewhere; the gap is named, not hidden.
The governance “constitution” is not alignment
It is bypassable pattern-matching, not learned alignment. No claim of AI safety beyond architecture is made or implied.
Integrated, not authored
Part of the AI tooling runs on a self-hosted, open-source inference engine (exo) — operated and integrated here, not written here.
God-files remain
The largest modules are still several thousand lines, partially decomposed. The work is ongoing, and stated as ongoing.
Not a miniature institution.
A deliberate compression of one.
One person
One architect designed the governance discipline, built the event-sourced runtime, did the research, stood up the infrastructure, and is the person paged when a box goes dark at 3 a.m. Not a team that divided the work — one person who held all of it at once, against live capital, from the first live order onward. The first months alone surfaced enough real failures to reshape the architecture.
That is possible because the functions a firm would staff are compressed into machinery. Engineering help is AI-assisted; nothing it produces reaches the money path until the operator has reviewed it — and where a change must not alter behavior, the invariance is checked mechanically before merge. Oversight is an external brain that reads the fleet daily and pages the operator when something drifts — deterministic read-only scans, an evidence-bound risk register, and above them a challenge layer that re-derives the largest system's promotion-gate decisions off-box, with code that does not import the pipeline's gate, and argues against the register's own resolved calls. That independence is off-box, not a second human who can say no: every finding proposes, and it does not lower the bus factor below. The repeatable is automated; what cannot be delegated — arming live capital, and the final go on every merge and deploy — stays human.
The same invariant that governs the trading models governs the AI that helps run the system: it proposes. Patches, flags, digests — none of it acts on its own.
This is stated as a fact, not a credential, because it cuts both ways. It is why the system is coherent: every layer was designed by the same person who has to operate it. It is also why its single largest risk is a bus factor of one. Both are true; the page would be dishonest to print only the first.
Most automated systems are built around prediction.
Neurobrick is built around refusal.
Open to a few conversations
Not raising capital, and not managing money for others. Open to conversations with engineers, quants, and researchers who have built systems that fail in interesting ways.
Neurobrick is a personal systems-engineering project that operates proprietary capital only. It is not an investment product, fund offering, or advisory service; it does not accept external capital; and it does not sell signals or manage money for others.
Architecture and methods on this page are described at a conceptual level by intent. The self-hosted inference engine (exo) is open-source; it is operated and integrated here, not authored.