Nyquist Roadmap

Q1 2025

Foundation — stack, workspace, first hardening

INF-01Shipped

Vue 3 + FastAPI + Postgres baseline

Single repo, two long-running services. JWT auth, async SQLAlchemy, Vite + Tailwind, deploy-on-push from main.

Vue 3.4 + TypeScript 5.3 + Vite 5 + Tailwind 3.4 + Pinia 2.1 on the frontend
FastAPI 0.115 + Python 3.11 + Uvicorn + SQLAlchemy 2 async + asyncpg on the backend
PyJWT (HS256) + bcrypt + Fernet-encrypted API keys + slowapi rate limiting
Single project: gateway + backend + Postgres + frontend wired on internal networking

Lines: ~12kServices: 4

ML-01Shipped

First risk hub — VaR, stress, blotter

CVXPY + NumPy + SciPy in a pure Python compute layer. Historical, parametric and Monte Carlo VaR; scenario stress; portfolio-table UX.

FinancialBaseModel auto-rejects NaN/Inf and enforces Pydantic v2 field bounds at the API boundary
asyncio.to_thread() wraps CPU-heavy sync math; FastAPI loop never blocks
Reference tests pinned to known textbook outputs — no fuzzy financial truth in CI

Endpoints: 23Coverage: 84%

UI-01Shipped

NsHubShell — one component, 15 hubs

A single ~750 LOC Vue component owns topbar, navbar, status bar and chrome for every portal hub. Tokens scoped to .ns-hub; no per-hub design drift.

Light-ink canon: paper #F6F6F4, cream #FBFAF6, ink #0B0E14, blue accent #2D6BFF
Hub pages pass brand · label · code · pages · subTabs · breadcrumb · statusItems as props
Page-level scroll with sticky topbar/navbar/status — no nested overflow traps
Burger toggles sidebar via CustomEvent('nyquist:toggle-sidebar') — no prop drilling

UI-02Shipped

Command palette — ⌘K + slash navigation

Bloomberg-style muscle memory. ⌘K opens, slash filters, history routing. All hub components lazy-loaded for cold-start budget.

Every hub component declared via defineAsyncComponent() — mandatory; direct imports inflate initial bundle
10 application modules, each with its own routes.ts; legacy URLs preserved as redirects
Composition API only (<script setup lang="ts">); zero Options API in new code

INF-03Shipped

Circuit breakers + health poller

Per-node Redis-backed state machine. 3 failures in 10 s → open 30 s → half-open probe. Per-route adaptive timeouts. Liveness and breaker state stay orthogonal.

Asyncio health poller per gateway replica; 3-layer jitter (replica offset + per-cycle ± 0.25s + exponential backoff cap 30 s)
Per-route timeouts: /api/backtest 120 s · stress 60 s · risk/var 10 s · default 30 s
Opt-in local fallback (ALLOW_LOCAL_FALLBACK=true) — off by default for prod safety
Admin force-close via POST /health/routers/reset/<ENV> — whitelist-validated

Phase 24

Q2 2025

Backend hardening — boot isolation, node split

INF-02Shipped

Boot isolation — manifest-driven routers

A failed router can no longer crash the gateway. Single source of truth in router_manifest.py; /health/ready reflects only critical-router health.

Manifest entries declare module · attr · prefix · tags · deps · critical · node_env
Router init crash → _ROUTER_STATUS[name]={state:"failed"}; gateway continues; domain returns 404
Critical routers locked at three: auth, admin, datasource_health (enforced by test)
Test test_manifest_is_sole_router_registration_path bans secondary include_router paths

Phase 23

INF-04Shipped

5 specialized services

auth-node · admin-node · stress-worker-node · backtest-worker-node · ingest-node. Gateway proxies via ordered GRANULAR_ROUTING; ingest pinned to a single replica to respect upstream rate limits.

ingest-node single-replica hard rule — enforced by test_ingest_single_replica_pinned
Critical routers locked at three (auth, admin, datasource_health) — enforced by test_critical_routers_exactly_three
Rollback path: unset <NODE>_NODE_URL → router stays unregistered locally (Phase 23 skip logic)

Phase 30

INF-05Shipped

Async job queue — Redis Streams

Heavy compute (stress, backtest, execution) submitted as 202 + job_id; polled via /job/<id>. At-least-once delivery, 64 KB payload cap, 24 h result TTL.

nyquist:jobs:stress · nyquist:jobs:backtest · nyquist:jobs:execution streams
XADD / XREADGROUP / XAUTOCLAIM for orphan reclaim after reclaim_idle_ms
Per-job HASH job:<uuid> with status / progress / result / error; EX 86400
Failed jobs are not auto-retried — worker XACKs on exception, status stays failed until TTL

Q3 2025

Alt-data adapters + feature flags

ONT-02Shipped

23+ alt-data adapters

Satellite, seismic, sanctions, maritime, labor, web. 4-file adapter skeleton; lazy-import in run() for hermetic parser tests.

USGS (seismic) first to ship, followed by NASA EONET, Sentinel imagery, AIS maritime tracks
Each adapter writes Observation records with dot-namespaced phenomenon strings
Vendor financial feeds (ЦБ РФ, ECB SDW, BoJ, RBI, HKMA, PBoC) stay in the market-data pipeline — they are CDC'd into the ontology, not written through the adapter pattern

INF-07Shipped

Feature flags — self-hosted Flagsmith

Wrapper flag_enabled() / flag_value() in observability layer. 60 s cache + 3-failure circuit breaker. CI enforces a flag check on every new route handler.

Naming convention: phase-NN-* kill-switch · canary-NN-* percentage · beta-NN-* per-tenant segment
Every flag evaluation logged on the request line as flag_evaluations
Flagsmith downtime cannot degrade Nyquist latency — circuit-open returns hardcoded default
180-day key rotation cadence

W1-05

Q4 2025

Distributed tracing + first 3 anchor agents

INF-06Shipped

Distributed tracing — OTel + Tempo

Auto-instrumented spans across the gateway and 5 backend nodes. 1% on /health*, 10% baseline, 100% on 5xx via tail-sampling. X-Trace-Id on every response.

FastAPI + httpx + Redis + SQLAlchemy auto-instrumented through create_node_app() factory
Redacting span processor strips authorization, api-key, cookies, user contact fields before export
Tempo retention via Cloudflare R2 — 30 days
Every structured log carries trace_id + span_id for log↔trace drill-down

W1-01

AGT-01Shipped

3 anchor agents — moat-quality, macro-asymmetry, tail-risk

pydantic-ai + Anthropic Claude. YAML personas with prompt + forbidden + corpus + tools + model + settings. Tool whitelist enforced in the runtime, not the LLM prompt.

Personas in backend/src/agents/personas/*.yaml — 5-layer schema
Tool exceptions → sanitised {"error": "tool error: <TypeName>"} — no traceback leak
Eval harness: golden Q&A in agents/eval/golden/<agent>.jsonl; substring-containment grader; alert at >5 pp drop
Session state in Redis LIST nyquist:agents:<agent_id>:<session_id>; 48 h TTL refreshed on append

Phase 32

CDF-01Shipped

OTC desk v1 — bilateral quote + confirmed trade flow

Bilateral RFQ → quote acceptance → confirmed trade dict pushed into the shared nyquist:otc:positions namespace for downstream settlement. First piece of the CeDeFi vertical.

NyquistOTCDesk quote engine + counterparty risk check + spread_bps pricing
Confirmed trades persisted in Redis LIST nyquist:otc:positions:<account_id>, 24 h TTL
Cross-node bridge to cedefi-engine for daily off-exchange settlement
Same namespace later consumed by the TradFi-CeDeFi bridge (EXE-02) for unified P&L netting

OTC Phase 2

Q1 2026

Debate cycle, ontology, execution MVP, MCP

AGT-02Shipped

Debate cycle + pgrep-replayable audit trail

Every query runs claim → counter → tail-check → consensus. Each step logged with agent ID, tag, payload. Replayable via grep on the audit log.

X-Agent-ID propagation through gateway middleware → Sentry tag + structured log field + outbound tool calls
Output is either consensus or marked dissent — never a single confident answer
Inspection-ready evidence: built to be pulled during a CRO's weekly review

ONT-01Shipped

Bitemporal ontology v1 — 32 object types

ClickHouse-backed typed graph. Event time (valid_from / valid_to) + system time (recorded_at / superseded_at) on every object. URN scheme nq:<kind>:<local-id>.

Financial seed: instrument · counterparty · position · trade · risk_limit · stress_scenario · regulatory_norm
Alt-data layer: observation · sensor · indicator · geo_entity · data_source
ReplacingMergeTree under the hood — historical state survives every update, never overwritten
Pydantic v2 discriminated union on kind field — adding a new type requires schema + URN regex test

Phase 33C

AGT-03Shipped

Agent-Ontology bridge v1 — context injection

Pre-fetch observations + inject into the system prompt. Persona whitelist defined as phenomenon:<glob> prefixes — agents see only what their domain authorises.

No tool-calling layer in runtime.py — context injection is the primary semantic bridge
Each persona's corpus YAML field declares allowed phenomenon globs
ClickHouse outage degrades gracefully — agent still answers from base context, marks observation set as stale

Phase 33D

INF-08Shipped

MCP server — 10 curated tools

External agent runtimes (Claude Desktop, IDE plugins) talk to Nyquist via Model Context Protocol. API-key gated, served from a dedicated service.

mcp-node uses --factory get_app + --workers ${WEB_CONCURRENCY:-2}
Module-level app = ... would break multi-worker — factory is mandatory
10 tools cover risk lookup, ontology query, agent-debate triggers, position read
NYQUIST_MCP_API_KEY rotated quarterly

Phase 33A

EXE-01Shipped

Execution Layer MVP

Two services: OMS-node (state, enqueue) + connectivity-node (worker). Redis stream nyquist:jobs:execution carries submit/cancel; fills stream is sole authority for FILLED state.

POST /api/orders/submit → 202 with {order_id, client_order_id, status, job_id}
BrokerAdapter abstraction across multiple TradFi venues (US equities + MOEX)
Error taxonomy: TransientBrokerError (retryable) vs PermanentBrokerError (immediate REJECTED)
Connectivity-node pinned to 1 replica — extra workers would double upstream WS subscriptions
Schema: orders.filled_quantity · avg_fill_price · broker_order_id · slippage_bps + fills table with UniqueConstraint(order_id, broker_fill_id)

CDF-02Shipped

OES daily netting — TradFi + OTC unified

cedefi-engine reads the union of OTC trades and TradFi fills from the shared nyquist:otc:positions namespace, computes daily P&L netting across venues, emits VaR snapshots to the ontology.

Reads nyquist:otc:positions:<account_id> across all account IDs at daily cut-off
Venue label "TradFi-{Broker}" vs "OTC-{counterparty}" preserves provenance per fill
Spread economics tracked separately from exchange fills (spread_bps=0 for TradFi)
Net P&L roll-up emitted into the ontology as a typed VaRReport snapshot — feeds risk hub, agents and audit log

ML-02Building

Domain SLM — compact model on 7,553 reg docs

Fine-tuned on Basel III/IV, BCBS 239, FSB resolution, EBA guidelines, IOSCO, FATF, EMIR/Dodd-Frank, MAR. Domain reasoning that generalist LLMs trained on Reddit cannot approximate.

Model: compact open-weights SLM · 3.8B parameters · pre-trained, then domain fine-tune on 7,553 documents
Live runtime gated by GPU procurement; the SLM artefact is shipped
Bet thesis: rentier-stack on top of GPT-5 API is the wrong economic model for regulated finance — margin stacks vertically

Q2 2026

Now — operator mode, persona roster, ontology v2

Current quarter

ONT-03Shipped

Ontology v2 — 9 new computed-analytics object types

Risk results, model state and market-data snapshots become first-class typed objects. AI agents reason semantically over the graph instead of running ad-hoc SQL across 5+ tables.

Risk layer: VaRReport · StressTestResult · GreekSnapshot · RegimeState
Model layer: PricingModel · ModelCalibration
Market-data layer: VolSurface · YieldCurve · CorrelationMatrix
Architectural commit (2026-05-09): ВСЯ вычисленная аналитика материализуется в bitemporal ontology — без этого AI не может рассуждать семантически
ClickHouse outage degrades gracefully — write to ontology is always background, log + continue on failure

Phase 34H

EXE-02Building

Cross-margin bridge — TradFi fills into OES

Every committed TradFi fill bridges into the shared nyquist:otc:positions:<account_id> namespace via position_bridge.py. CeDeFi off-exchange-settlement reads both OTC trades and TradFi fills for daily P&L netting.

Venue label "TradFi-{Broker}" overrides default "OTC-{counterparty}"
spread_bps=0 for exchange fills (no bilateral spread)
Bridge failures are caught and logged — never unwind a committed fill

AGT-04Building

Persona roster expansion — +33 agents

From 3 anchors to the full 36-agent swarm. Each named for a public investing methodology, on a published corpus — books, public speeches, shareholder letters, papers — mapped to a decision domain.

Roster by methodology: contrarian-value, reflexivity, stat-arb, all-weather, margin-of-safety, growth-at-a-reasonable-price, global-value, activist, mean-variance, factor, adaptive-markets, macro-trend, execution-cost, technical, financial-instability, debt-cycle, central-bank, systemic-resilience, lender-of-last-resort, market-cycle + others. Lineage and disclaimer on /architecture
5-layer YAML schema generated by backend/scripts/generate_personas.py from the source roster
Each persona gets its own golden Q&A set + eval baseline before going live
Names are stylistic homage to public methodologies — not affiliated with or endorsed by individuals or estates

UI-03Building

Semi-automatic operator mode

Accept · reject · override on every agent verdict. Branchable reasoning trees, full audit log, OMS-grade approval workflow. Hardening ahead of design-partner pilots; not in the public demo.

Operator scopes each question; agents narrate at every step
Recompute on every operator edit, inline risk flags
Per-step audit-merge layer still under design-partner hardening
Public demo continues to run in automatic mode end-to-end for hands-off exploration

ONT-04Building

Agent-Ontology bridge v2 — persistent semantic memory

Agents read typed bitemporal context, not only 48-hour Redis history. Closes the long-horizon-memory gap that limits multi-day reasoning chains.

Bitemporal context means agents see what was known at each point in time — recover prior beliefs, detect regime shifts
Ontology query DSL exposed to agents through the existing tool whitelist
Long-horizon reasoning is the architectural prerequisite for back-testing committee memos against later outcomes

CDF-03Building

OTC desk v2 — atomic inventory, multi-replica safe

DeskInventoryStore upgraded to atomic HINCRBYFLOAT for inventory ops. Multi-replica desk routing for HA; persistent state (no TTL) — operator-only clear.

Inventory HASH nyquist:otc:desk:inventory:<desk_id>: field=instrument, value=USD notional (signed: + long, − short)
Phase 7 → Phase 8: HINCRBYFLOAT replaces HGET + HSET — races between concurrent fills eliminated at Redis level
Multi-replica desk routing — failover without losing inventory state
No TTL on inventory key — only operator-initiated clear; downstream OES depends on this persistence

OTC Phase 7→8

Q3 2026

Audit bundle export + NIM on-prem runtime

AGT-05Building

Audit bundle export — regulatory evidence package

Agent traces + ontology snapshot + recompute drift → single audit_bundle.json export. CRO inspection-ready, formatted for regulator filing.

Bundles every debate cycle into a self-contained evidence artefact
Includes the deterministic recompute calculator output (the number the model proposed vs the number that shipped)
Endpoint POST /api/admin/audit-bundle/<debate_id> — admin-gated

ML-03Next

NVIDIA NIM — on-prem SLM runtime

Same compact domain SLM, deployable on-prem (air-gap option) or in the Nyquist managed cloud. Same audit trail, same recompute pipeline, same access control.

NIM packaging lets enterprise security teams audit the runtime independently
On-prem path closes the "data leaves our perimeter" objection for tier-1 buyers
Managed-cloud path keeps mid-market deployment cost flat

EXE-03Next

Execution Quality Engine — TCA dashboard + slippage attribution v1

First production-grade layer above the TCA-worker node. Per-order implementation shortfall, VWAP/TWAP benchmarks, slippage decomposition into venue / latency / spread / impact components. Surfaces what the broker dashboards quietly hide.

Reads from fills table + ontology execution.fill.<broker>.<order> stream
IS / VWAP / TWAP / arrival-price benchmarks computed per order, aggregated per desk / strategy / venue
Slippage attribution: total = spread + latency + venue + impact + residual — decomposes the number that usually arrives as a single bps figure
New hub: EXE-Quality — sits in execution-oms-node, reads from existing TCA-worker
Foundation for EXE-04 closed-loop scorer (Q4 26) and EXE-05 autonomous routing tuner (2027)

Direction: Execution Quality Engine · Stage 1 of 3

ONT-09Next

Market Safety-Car Intelligence — cross-asset stress correlator v1

Continuous cross-asset correlation surveillance over the bitemporal store. When equity vol, credit spread, FX skew, rates curvature and crypto funding move in lockstep — flag a regime-coupling event before each individual signal trips its own threshold.

Reads ontology marketdata.correlation_matrix.* snapshots — already a first-class ObjectType from Phase 34H
HMM regime-state classifier extended cross-asset (currently per-asset in signal.regime.<asset>.<model>)
Emits signal.regime.cross_asset.coupling.<score> observation when joint move > 3σ on the rolling 30-day baseline
Naming after F1: when conditions deteriorate, the safety car deploys before any single car crashes
Stage 1 of 2 — Stage 2 (ONT-10 in Q4 26) wires the signal into the auto-throttle pipeline

Direction: Market Safety-Car Intelligence · Stage 1 of 2

ML-04Next

Strategy Decay Engine — alpha drift scorer v1

Every shipped strategy degrades. Capacity caps, regime shift, factor crowding, broker fee creep — the decay is usually visible in the rolling P&L attribution before it shows up in a Sharpe drop. v1 scores each strategy's drift continuously and surfaces the first regime under which it broke.

Reads backtest replay (backtest.<strategy>.<metric>) + live fills (execution.fill.<broker>.<order>) — same ontology, no parallel pipeline
Drift score: rolling z-score of out-of-sample vs in-sample Sharpe, correlated against the active regime state (HMM from ONT-09)
Surfaces the regime under which decay accelerated — actionable, not just a warning light
Stage 1 of 2 — Stage 2 (ML-07 in 2027) closes the loop with autonomous reweight / retirement proposals
Direct dependency on existing backtest-worker-node + ClickHouse bitemporal store

Direction: Strategy Decay Engine · Stage 1 of 2

Q4 2026

GA — 48 hubs, 6 commercial suites, federated learning

UI-04Next

48 hubs across 19 functional domains

Full breadth of the analytical surface — from ALM to XVA, from ILS to ESG. Each hub a typed view onto the same ontology, the same agent stack, the same audit trail.

Landing in full: ALM, Treasury, XVA, Collateral, Sec-lending, Structured products, OMS, Indices, Allocation, Pricing, Climate, Macro Lab, Investor Comms, ILS, Trade Finance, Data Quality, Newsroom, Screener, Reference, Charting, Sentiment, Compliance, Execution, Forwards, Regimes, Swaps, Trading, ESG & Suptech extensions
All hubs share the NsHubShell contract — one shell change updates 48 surfaces

UI-05Next

6 commercial suite-apps GA

Persona-scoped surfaces: derivatives · regulator · broker · asset-manager · treasury · credit. Same agents, same ontology — packaged for one buying-centre at a time.

Per-app service, already provisioned
Each app exposes a curated hub subset + suite-specific defaults
Single sign-on via auth.nyquist.pro across all six

ONT-05Next

Federated learning v1 — multi-design-partner

Cross-institution model improvement without raw data exchange. Differential-privacy budget per round; Redis-coordinated state machine with WATCH/MULTI/EXEC optimistic locking.

State machine in RedisFedCoordinator; 7-day TTL on round metadata, 30 days on published global model
Includes Circle USDC monthly attestation parsing and DeFiLlama stablecoin DeFi-dependency breakdown for the CeDeFi reserve surface

Phase 33C cedefi

EXE-04Next

Execution Quality Engine — closed-loop venue scorer

v2 turns measurement into action. Continuous per-venue scorecards (fill rate, IS, latency, rejection rate) feed back into the OMS routing weights. The engine doesn't auto-trade — it proposes the routing weight delta, the operator signs off.

Daily per-venue scorecard published as ontology object — auditable lineage from order → fill → score → routing decision
Scoped supervision applies: the engine emits a proposal, the operator confirms / overrides — same pattern as agent verdicts (DOC-03)
Builds on EXE-03 (TCA + slippage attribution) — same data, different decision layer

Direction: Execution Quality Engine · Stage 2 of 3

INF-09Next

Zero Trust Trading Layer — mTLS + per-trade attestation v1

Every inter-node hop authenticated mutually; every order carries a signed attestation chain (origin agent → debate verdict → operator signature → OMS). Replaces "trust the perimeter" with "verify every hop."

mTLS rolled across all *_NODE_URL proxy traffic — cert rotation via the secret store
Per-order signed envelope: origin → audit-bundle hash → operator JWT → broker submit — verifiable end-to-end
X-Agent-ID propagation (already in place) becomes a signed claim, not just a tag
Stage 1 of 2 — Stage 2 (INF-10 in 2027) moves keys into hardware (HSM / KMS)

Direction: Zero Trust Trading Layer · Stage 1 of 2

ONT-10Next

Market Safety-Car — auto-throttle on regime collapse

When the cross-asset coupling signal (ONT-09) crosses a tenant-defined threshold, the system deploys a safety car: pauses autonomous-mode strategies, downgrades agent recommendations to advisory-only, raises a single consolidated alert. Operator restarts the green flag explicitly.

Tenant-configurable threshold matrix — per desk, per strategy class
Safety-car deploys produce an ontology event (action.safety_car.deploy) and a consolidated CRO alert
Auto-throttle never closes positions on its own — it pauses new entries, preserves existing book, alerts the human chain
Stage 2 of 2 — completes the Safety-Car Intelligence direction

Direction: Market Safety-Car Intelligence · Stage 2 of 2

ONT-11Next

Synthetic Market Replay — L2 capture + replay infrastructure

Full L2 order-book capture with deterministic replay against the ontology. Today our backtest is on bars; this lets us replay a strategy or an agent debate against the actual tape — flash crash, fed surprise, COVID open — exactly as it happened.

L2 capture node (ingest-node singleton extension) writes to ClickHouse bitemporal store as marketdata.l2.<venue>.<symbol>
Replay engine emits the same observation stream agents see live — same prompts, same context, deterministic outcome
Curated replay set: 2008-09, 2010 flash crash, 2020-03 COVID, 2022-09 LDI, 2023-03 SVB
Stage 1 of 2 — Stage 2 (ONT-12 in 2027) makes replay a regression suite for every shipped strategy

Direction: Synthetic Market Replay · Stage 1 of 2

2027 →

Horizon — full ontology, CeDeFi prime brokerage, orchestrator

ONT-06Next

Business action graph — typed Action Types

open_position · run_var · calibrate_model · approve_model_for_production · escalate_risk_breach · change_regime_state. Every business action becomes a first-class causal node — auditable causality across the organisation.

Lineage from filing → number → model → action → P&L impact, end-to-end
Replaces ad-hoc workflow tools that lose causal context at every hand-off
CDC from Postgres orders/fills already proven — Action graph extends pattern to org-level events

Phase 34I

ONT-07Next

Full ontology — Lineage + Approvals + Multi-tenant

Umbrella for Phase 34J-N. Lineage paths walkable from any filing/observation to its downstream impacts; typed approval workflows (model governance, risk breach escalation); per-tenant isolation for prime brokerage and suite-apps; opt-in cross-tenant federation.

Lineage (34J): queryable causal paths — «which filing caused yesterday's VaR shift?» answers from the graph, not a forensic SQL session
Approval workflows (34K): ModelGovernance · RiskBreachEscalation · TradingLimitWaiver as typed objects — sign-off chain stored in graph, not a Confluence page
Multi-tenant (34L): per-design-partner isolation; orchestrator queries cross-tenant aggregations only with explicit consent + DP budget
Federation (34M): opt-in model improvement without raw data exchange — extends ONT-05 federated learning to typed-object level
Tenant cleanup (34N): right-to-be-forgotten flows for departing customers — bitemporal store retains the slot, deletes the data

Phase 34J-N

CDF-04Next

Institutional CeDeFi prime brokerage — final stage

Multi-venue clearing across CeFi exchanges, DeFi pools and OTC desks under one custody umbrella. Regulator-grade settlement trace from quote to final book entry. The destination CeDeFi has been climbing toward since OTC desk v1.

Aggregated liquidity: CEX (Binance / OKX / institutional API endpoints) + DeFi (Uniswap / Curve / Pendle / restaking) + OTC counterparty mesh
Single settlement clock — daily netting across all three venue classes, one consolidated NAV
Reserve attestation built in: Circle USDC monthly attestation + DeFiLlama dependency tree feed account-level reserve breakdown (nyquist:cedefi:circle:usdc:reserves + nyquist:cedefi:llama:stable:*)
Regulator-grade lineage trace from quote → fill → netting → settlement → book entry — every step in the ontology
Closes the full institutional crypto-finance loop: discover, quote, execute, clear, settle, attest, audit — one system

Final stage · CeDeFi vertical

AGT-06Next

N.Y.Q.U.I.S.T. orchestrator — full 36-agent swarm

Backronym that is a contract: Networked · Yield-aware · Quantitative · Unified · Intelligence · Synthesis · Terminal. Routes the swarm and recomputes every number through the deterministic calculator before delivery.

Every letter is a production constraint, not a marketing line
Orchestrator emits an audit trail at regulator evidentiary grade
Numbers come from calculators, not from a language model — the calculator layer is the last hop before delivery; the model writes prose around them

CDF-05Research

OTC Execution & Settlement Stack — multi-venue routing + RFQ aggregator

Today: one OTC desk, bilateral quote, OES daily netting. The horizon: an RFQ aggregator across the counterparty mesh — same quote semantics, n-way price discovery, settlement under one umbrella. Lineage trace from RFQ broadcast to final book entry stays in the ontology.

Builds on CDF-01 (OTC desk v1), CDF-02 (OES daily netting), CDF-03 (atomic v2), CDF-04 (prime brokerage)
RFQ aggregator broadcast → quotes-in → best-execution selection → fill → settlement → all logged as ontology objects
Multi-venue clearing across CEX / DeFi pools / OTC counterparties under one consolidated NAV

Direction: OTC Execution & Settlement Stack · Final stage

EXE-05Research

Execution Quality Engine — autonomous routing-policy tuner

Stage 3 closes the inner loop. The engine no longer just proposes routing-weight deltas — it learns the policy that produced the best venue-quality scorecard under each regime state, and rolls forward automatically inside operator-set guardrails. Outside guardrails, it falls back to advisory.

Policy learned per (strategy class, regime state, venue) tuple — narrow, auditable, not a black-box RL
Operator-set guardrails define hard envelopes (max venue concentration, min broker diversity) — engine never crosses them
Every autonomous rebalance emits an ontology action — full lineage from regime detection to routing change

Direction: Execution Quality Engine · Stage 3 of 3 (Final)

INF-10Research

Zero Trust Trading Layer — hardware-key attestation

Stage 2 moves signing keys into hardware (HSM / cloud KMS / TPM, per tenant choice). Every order envelope carries a hardware-signed attestation — provable to a regulator that the signing material never left the secure module, even on a compromised host.

Pluggable backends: cloud KMS (AWS / GCP), on-prem HSM, hardware TPM — tenant-selected at provisioning
Key rotation as a first-class ontology event with full lineage
Regulator-replayable: any past order's attestation chain can be re-verified from cold storage

Direction: Zero Trust Trading Layer · Stage 2 of 2 (Final)

ML-05Research

Federated Learning Engine — multi-tenant production

Extends ONT-05 (Q4 26 design-partner v1) into a multi-tenant production service. Cross-institution model improvement without raw data exchange, with per-tenant DP budget accounting, opt-in federation, right-to-be-forgotten flows, and a published global-model rotation cadence.

Per-tenant differential-privacy budget tracked as ontology object — auditable consumption per round
Opt-in federation: tenants choose which model families to contribute to, per round
Right-to-be-forgotten: bitemporal store keeps the slot, deletes the contribution — tenant exit is a clean operation
Builds on existing RedisFedCoordinator + nyquist:fed:* namespace

Direction: Federated Learning Engine · Final stage

ML-06Research

Quantum-Inspired Optimization + Neural SDE

Two research bets bundled because they share the same infrastructure surface. Quantum-inspired solvers (annealing-style QUBO formulations on classical hardware) for high-dimensional portfolio optimisation. Neural SDE for local volatility surface calibration where parametric models break — both expose the same recompute-and-verify guarantee.

Quantum-inspired: portfolio optimisation reformulated as QUBO; classical annealing solvers (D-Wave hybrid, Fujitsu DA-style) for problem sizes where convex relaxation drops dominant constraints
Neural SDE: learned drift + diffusion coefficients fit to vendor surfaces, calibrated to market option prices, deployed as pricing_model ontology object — same governance as parametric models
Both gated by the calculator layer — the model's number is never the final number
If results don't beat the reference parametric models on the eval harness, they don't ship — research means "may not ship"

Direction: Quantum-Inspired Optimization + Neural SDE · Research

ML-07Research

Strategy Decay Engine — autonomous retirement loop

Stage 2 closes the loop on ML-04. When the drift scorer flags a strategy as decayed beyond the recoverable envelope, the engine proposes one of: capacity cut, parameter recalibration, full retirement. Operator signs off — engine executes the wind-down, books P&L attribution to the retiring strategy, logs the regime-of-death.

Proposal types: capacity_cut · recalibrate · retire — each ontology Action Type
Regime-of-death captured: which market regime did the strategy fail under? Feeds the next generation's design
Operator approval mandatory — engine never retires a live strategy autonomously, even under high decay score
Strategy archive becomes a research corpus, not a graveyard

Direction: Strategy Decay Engine · Stage 2 of 2 (Final)

ONT-08Research

Market Digital Twin — agent-driven forward simulation

Distinct from synthetic replay (which re-runs the actual past tape). Digital twin runs the agent swarm against a generative market model — counterfactuals, stress scenarios that never happened, gaming the regulator's next rulebook before it's written. The agents play; the operator watches; nothing routes to a real venue.

Generative market model: agent-based simulation seeded with regime parameters from the bitemporal store
Same 36-agent swarm operates inside the twin — debates, recomputes, proposes; nothing crosses the venue boundary
Counterfactual queries: "what would the desk have done if SVB resolved differently?" "how does the book respond to a 200bp BoJ surprise tomorrow?"
Distinct from ONT-11/12 synthetic replay: replay is historical truth, twin is hypothetical forward

Direction: Market Digital Twin · Research

ONT-12Research

Synthetic Market Replay — flash-crash regression suite

Stage 2 of ONT-11. Every shipped strategy and every agent debate cycle is regression-tested against the curated crisis replay set before promotion to production. If the strategy would have lost catastrophically in 2010 / 2020-03 / 2022-09, that's a release-blocking signal, not a footnote.

CI hook: any pull request touching /api/{strategy,backtest,risk} reruns the crisis replay suite
Pass criteria: drawdown / liquidity / margin call thresholds defined per strategy class
Failure produces a release-blocking PR check with the exact replay segment where catastrophe hit
Crisis set extends quarterly — chosen by the agent debate committee, signed off by the CRO function

Direction: Synthetic Market Replay · Stage 2 of 2 (Final)

No milestones match the selected categories. Reset filters above or pick another category.

What's shipped. What we're building. What's next.

Three bets the roadmap is built on.

Bet on unhobbling, not on model size.

Own the model. Don't pay the API tax.

Closed agent set, whitelisted tools, signed verdicts.