System architecture
Private by default. Explicit at every boundary.
The browser does not reach private services or brokers directly. Identity, policy, lane state, and execution authority are carried through a layered request path.
Request path
From interface intent to external outcome.
Read top to bottom. Each boundary narrows context before work reaches an account or external provider.
- 01Browser terminalAuthenticated views, local interaction state, and same-origin requests
- 02Next.js BFFSession-aware normalization, identity context, and streaming endpoints
- 03Go gatewayAuthentication, routing, policy, and service boundary enforcement
- 04Stocks + crypto enginesLane-specific account state, strategy, risk checks, execution, and reconciliation
- 05Intelligence servicesSignals, predictions, agents, model routing, research, and automation orchestration
- 06External boundariesAlpaca, Coinbase, market-data sources, and configured model providers
Identity and transport
- Browser requests stay on the application origin
- The BFF carries the active profile and account scope
- The gateway authenticates and routes to private services
- Broker secrets are not exposed to client-side code
- Streaming and request-response paths retain user context
Decision and execution
- Discovery, signals, and models produce evidence and proposals
- Stocks and crypto retain separate account semantics
- Trading engines revalidate state at the mutation boundary
- Durable intent reduces ambiguous or duplicate submissions
- Broker acknowledgement and fills are reconciled explicitly
Operations and safety
- Per-lane controls and kill states remain visible
- Limits and confidence gates are configuration, not assumptions
- Missing or stale critical state is handled as uncertainty
- Automation and service health are separate from trading outcomes
- Audit state connects proposals, actions, and broker results