The AXIOS trading engine is private IP. This page documents verifiable engineering practice from that codebase — the discipline, not the alpha. All numbers are from CI-enforced gates as of 2026-07-01.
| Metric | Value | Enforcement |
|---|---|---|
| Core coverage (broker / execution / risk / core) | 95.7% | CI gate fails below 95 — ratchet-up-only |
| Second-ring coverage (strategy / governance / validation / observability / compliance) | 78% and climbing | Own CI gate, own ratchet floor |
| Test files | ~280 | Full suite green required to merge |
| Coverage floors ever lowered | 0 | Constitutional rule: floors only move up |
- Capital preservation outranks the return target. Always.
- Every safety check is fail-closed. An error inside a check blocks the trade — it never lets one through. Every happy-path test in the core has a "fails safely" twin.
- Coverage floors are never lowered, and live in two places (pyproject + CI) that must move together.
- Nothing merges without a green gate. One week = one sprint = one measurable exit gate.
- The live-arming switch belongs to a human. No model, no automation, ever sets it.
- Kill-chain engine — graded actions (pause → close positions → emergency stop) driven by drawdown, data-health, losing-streak and crisis inputs; hardest action always wins.
- Governed LLM layer — an LLM may propose; a deterministic baseline trades. Hard fallback on error/timeout/hallucination/low-confidence, drift monitoring (PSI), champion/challenger promotion only on realised out-of-sample returns.
- Hash-chained, HMAC-signed track-record ledger — no performance claim without a chain.
- Walk-forward validation harness — rolling out-of-sample only; promotion gates paper → testnet → canary → live, each with explicit exit criteria.
- Compliance core — immutable audit log (actor + reason required), trade reporting, capital plan gated by promotion stage, game-day fault-injection suite green in CI.
- Signal economics — the entire input stack runs at ~zero marginal cost (public market data, free-tier feeds, a proprietary geopolitical regime-classification system, and a budget-capped LLM layer). A system with zero marginal signal cost can wait indefinitely for its edge; one with a running bill dies of impatience.
The most instructive production incident wasn't a bad trade — it was an LLM cost leak.
- Symptom: the LLM signal layer consumed its full daily API budget day after day (700–1,350 calls/day where ~a dozen were expected).
- Root cause: a module-level factory built a fresh generator instance per call, so an in-memory panic-throttle timestamp never persisted — the 6-hour response cache was bypassed on every poll.
- Fix: persistent file-backed throttle + regression test; enforced budget aligned to the documented value; three independent cost backstops added.
- Lesson written into the system's own briefing: a trading system is a cost body first and a return machine second. Its first provably profitable decision was capping its own costs.
Full postmortem, runbooks and a postmortem template live in the private repo.
The moat of a trading system is calibrated parameters, strategy logic and its data edge. Publishing those would destroy the asset being demonstrated. What can be shown — architecture, testing discipline, governance, incident culture — is exactly what this reference repo and this page show. In an interview, deeper artifacts (redacted CI runs, gate reports, ADRs) can be walked through live.
Die Kennzahlen oben sind CI-erzwungen (Stand 2026-07-01): 95,7% Kern-Coverage mit Ratchet-Gate, zweiter Coverage-Ring mit eigenem Floor, ~280 Testdateien, Floors wurden nie gesenkt. Die Verfassung des privaten Systems: Kapitalerhalt vor Rendite, jede Sicherheitsprüfung fail-closed, kein Merge ohne grünes Gate, der Live-Schalter gehört ausschließlich einem Menschen. Der lehrreichste Produktions-Incident war kein Trade, sondern ein LLM-Kostenleck — Root-Cause, Fix und Regressionstest sind dokumentiert; die Lektion steht im System selbst: Ein Handelssystem ist zuerst ein Kostenkörper und erst dann eine Renditemaschine. Der Motor bleibt privat, weil der Burggraben eines Trading-Systems aus kalibrierten Parametern und Daten-Edge besteht — gezeigt wird hier die Ingenieursdisziplin, nicht das Alpha.