The fleet audits itself.
From a separate box, it can't trust.
A read-only tier that re-runs the fleet's own code, re-derives its own gates, and reconciles its own books — on a different machine, deterministically, holding no actuator. It has authority to find and propose, never to act. Below: what each check does, and the honest limit it ships with. Every claim cites file:line you can open.
An adversary living inside the system it judges is self-review, not independent challenge. So the checks run as a separate brain — deterministic where the answer must be exact, capital-redacted, and structurally unable to reach the order path. When a check can't answer honestly, it says so and names the gap; it does not fabricate a clean number.
Feature-generation look-ahead probe
flagshipWe re-run each strategy’s own version-pinned code off-box against an independently reconstructed point-in-time price series, and diff the recomputed feature against the value the live system actually emitted.
Most “no look-ahead” claims stop at pairing a signal with a forward return. This catches leakage one layer earlier — at feature-generation time — by executing the real module against a strictly as-of-then series and against a peek series, then classifying: PIT-clean (matches the honest series, differs from the peek), leakage-suspect (matches the peek), or non-discriminative. A match that cannot fail proves nothing, so non-discriminative events are excluded from any claim — the vacuity doctrine. It already flagged one suspect and we adjudicated it down to a stale data feed, not up to a headline.
Pilot scope: a named set of modules whose inputs are reconstructible (cointegration pairs, a few KR/US books). In-session emissions and cross-sectional universe selection are not diffed. It probes the reconstructible modules — it does not prove the whole fleet leak-free.
scanner/feature_replay.py (verdicts :28, vacuity :30, FB_FR_Z_TOL :91) · 70 tests · state/candidate-feature-replay*.jsonl · docs/adjudication-googl-stale-feed-2026-07-16.mdAnytime-valid sequential test (e-process)
Cross-validation with multiple-testing correction handles how many strategies we tried. The orthogonal risk — how many times we peek at a live edge — is controlled with an e-process (a test-martingale) that keeps its error guarantee at any stopping time.
A daily forward gate looks at an edge ~52 times a year; a fixed-window p-value inflates under repeated looks. Ville’s inequality bounds the false-positive rate no matter when you decide to stop (Waudby-Smith & Ramdas, 2023). The e-value is stamped on results and tracked over time.
Observe-only. The e-value is a diagnostic — it does not veto trades. We monitor it; it does not gate capital. It is mildly conservative on right-skewed returns, which is a safe direction to be wrong.
src/neuropublic/engine/brain/_anytime_valid.py (evalue_mean_positive :33) · tests/test_anytime_valid.py · wired into the hypothesis tracker + confidence sizingCorrelation-adjusted effective bets
We measure real diversification against live capital weights: N_eff = 1 / (wᵀRw) — the correlation-aware generalization of the naive 1/HHI count, computed on a de-overlapped ledger. And when it can’t be computed honestly, we publish “not-evaluable” with a coverage map instead of a number.
Naive bet-counting assumes zero correlation (R = I). The real number folds in the correlation matrix of the strategies at their actual weights, after de-overlapping the rolling P&L snapshots into genuine non-overlapping realizations — so books that look diversified but are secretly one bet are exposed.
Today the joint number is deliberately reported as not-evaluable: our attributor observes strategies in largely disjoint runs, so the live book is rarely seen jointly. We surface the construct and the coverage limit — not a single headline figure that would misrepresent what we can actually observe. Binance-only.
scanner/cio_risk_budget.py (thesis :12, de-overlap :269, N_eff :319) · 29 tests · state/candidate-cio-risk-budget.jsonlDeterministic reconciliation-break resolution
When a broker-vs-ledger reconciliation break halts trading, we independently reconstruct the lots by FIFO from the raw broker order ledger, name the exact orders at fault, and draft the correcting entries — pure arithmetic, no model in the loop, so book contents never leave the box.
The trading system already detects the break (halts on >1% drift) and classifies it. This layer turns the classification into a specific, hash-identified correction proposal: which orphan sell has no cost basis, which P&L was over-recorded — each with a content hash for a future operator-gated apply.
Report-only, v1. It proposes; it applies nothing and lifts no halt. It covers two break classes and flags only the orphaned portion of a fill. It is a settlements-desk assistant, not an auto-reconciler.
scanner/break_resolution.py (report-only + content_hash :35, FIFO basis :119) · 34 tests · 16 real proposals in state/candidate-break-corrections.jsonlSecret-leak defense, audited and closed
Our whole posture is that no secret is captured. The enforcing mechanism: entropy-based log redaction and subprocess environment allow-listing, with the known leak classes pinned by tests — after a real 2026-07-09 audit caught a bot token leaking through an exception string, closed it, and pinned it.
A structlog processor scrubs high-entropy tokens from every log record; subprocess spawns get a scrubbed, allow-listed environment rather than the full process env. The specific historical leak shapes are frozen as regression tests so they cannot silently return.
Redaction and allow-listing, not a cryptographic guarantee — a genuinely novel secret shape could slip a redactor. The honest claim is that tests pin the known leak classes, not that a secret in a log is impossible.
src/neuropublic/engine/brain/security_utils.py (scrub :228, redact processor :241, clean_subprocess_env :97) · test_alert_token_redaction.py + siblingsSigned inter-machine messages with replay windows so a dead peer can't be forged “alive” (ipc_signing.py); a schema-drift tripwire on the critical order paths that fails loudly before a daemon can swallow a dropped argument and keep “running” while placing nothing (test_schema_drift_sentinel.py, motivated by a dated live incident); and position-by-position reconciliation of exchange truth against shadow ledgers (binance_position_reconciler.py, built after a shadow ledger held four phantom positions for 196 hours). Each ships with the tier it covers named, not implied.
Every file:line above is real — and the repos are private, so this is a citation, not an invitation to clone. The honest limit: an outsider can check this page for specificity and internal consistency, not re-run the named tests or read the emitted proposals in state/candidate-*.jsonl and the adjudications in docs/. Where a check is a pilot, observe-only, or report-only, we said so on the same line as the claim.