Self-hosted. Auditable. Fail-closed by default. AGORA is the control plane for autonomous market makers — built like infrastructure, not a SaaS product.
02. THE MANIFESTO
We built an execution engine that fails closed when it does not understand what it is doing. The kill switch is authoritative. The reconciliation is paranoid. The audit trail is append-only. Every byte that moves money runs in a container we own, on a VPS we pay for, talking to APIs we authenticated.
Most trading infrastructure is SaaS. AGORA is not. The Rust core enforces risk at the engine. Halts trip in microseconds. State survives container restarts. There is no cloud bus to fail, no vendor abstraction between the strategy and the exchange.
"We optimize for operator confidence at 3am, not investor pitches at 3pm."
Doctrine — falsifiable, mechanism-tied. Not brand poetry.
03. SAFETY PRIMITIVES
03.
if (cached_count != rest_count) → publish risk.recon_drift → halt FSM transitions ACTIVE → HALTED04.
append-only Parquet · every order, gate decision, operator action · 7-day Prometheus retention + indefinite Parquet05.
if (book_age_ms > 2000) → suppress quote cycle · cumulative_skips logged · CLAUDE.md checklist #506.
Redis unreachable | REST timeout | cert missing → bot refuses to start · no degraded-path assumption04. THE STACK
┌─────────────────────┐
│ HYPERLIQUID PERPS │
│ testnet → prod │
└──────────┬──────────┘
│ WS + REST
│
┌──────────────┼──────────────┐
│ │ │
┌─────▼─────┐ ┌─────▼─────┐ ┌────▼────┐
│ Rust │ │ Python │ │ Risk │
│ Core │◀▶│ Actors │◀▶│ Engine │
│ (NT 1.225)│ │ BTC/ETH │ │ + Gate │
└─────┬─────┘ └─────┬─────┘ └────┬────┘
│ │ │
└──────────────┼──────────────┘
│
┌──────────────┼──────────────┐
│ │ │
┌─────▼─────┐ ┌─────▼─────┐ ┌────▼────┐
│ Redis │ │ Prometheus│ │ AGORA │
│ 7.4 TLS │ │ v3.10 │ │ Console │
└───────────┘ └───────────┘ └─────────┘HYPERLIQUID PERPS
testnet → prod
WS + REST
↓
Rust Core (NT 1.225)
↕
Python Actors (BTC/ETH)
↕
Risk Engine + TradeGate
↓
Redis 7.4 TLS
Prometheus v3.10
AGORA Consoleservices:
trading-node:
container_name: mm-trading-node
env_file: .env
environment:
NAUTILUS_ENV: testnet # → mainnet for prod
TRADING_ENABLED: "true"
TRADE_GATE_KILL_SWITCH_FILE: /data/mm-bot.kill
TRADE_GATE_OPERATOR_FILE: /data/mm-bot.operator-enable
REDIS_USE_TLS: "true" # mTLS on prod
volumes:
- ./data:/data # audit log + flags
healthcheck:
test: curl -f http://localhost:9090/health/liveSingle binary. Two languages. Zero proprietary SaaS dependencies. Total deps: NautilusTrader 1.225.0, Redis 7.4, Prometheus 3.10, Grafana 12.4.
05. WHAT 3AM LOOKS LIKE
Volatility spikes find their way into every market making book. When ours does, the system halts before the operator picks up the phone. This is reconstructed from a single February 2026 testnet incident.
{
"ts": "2026-02-14T03:17:42.183Z",
"event": "spread_widened",
"symbol": "BTC-USD-PERP.HYPERLIQUID",
"spread_bps": 47,
"trigger": "volatility_spike",
"context": {
"ewma_var_delta": "+0.0034 -> 0.0083",
"concurrent_market_event": "BTC perp carry trade unwind on Asia open",
"vol_pct_rank_1h": 0.94
},
"next_action": "inventory skew check"
}
{
"ts": "2026-02-14T03:17:43.028Z",
"event": "inventory_skew_detected",
"net_long_usd": 1240,
"skew_threshold_usd": 1000,
"symbols": [
"BTC-USD-PERP.HYPERLIQUID",
"ETH-USD-PERP.HYPERLIQUID"
],
"context": {
"btc_delta_usd": 1038,
"eth_delta_usd": 202,
"skew_ratio": 1.24
},
"next_action": "halve quote size and hedge bid fill"
}
{
"ts": "2026-02-14T03:17:44.611Z",
"event": "quote_size_reduced",
"symbol": "BTC-USD-PERP.HYPERLIQUID",
"previous_quote_size_usd": 500,
"next_quote_size_usd": 250,
"controls": {
"anti_churn_cooldown_ms": 200,
"post_only": true,
"quote_mode": "defensive"
},
"next_action": "refresh book with widened limits"
}
{
"ts": "2026-02-14T03:17:46.294Z",
"event": "bid_hedged",
"symbol": "BTC-USD-PERP.HYPERLIQUID",
"hedge_price": 81204,
"hedge_notional_usd": 1006.72,
"execution": {
"venue": "hyperliquid_testnet",
"order_type": "post_only_limit",
"latency_ms": 38
},
"next_action": "watch realized loss threshold"
}
{
"ts": "2026-02-14T03:17:49.076Z",
"event": "kill_threshold_armed",
"daily_pnl_usd": -489,
"daily_loss_limit_usd": -500,
"armed_distance_bps": 10,
"controls": {
"hard_kill_at_usd": -500,
"warning_band_usd": 15,
"operator_override_allowed": false
},
"next_action": "notify operator if pnl deteriorates"
}
{
"ts": "2026-02-14T03:17:51.442Z",
"event": "operator_notified",
"channel": "telegram",
"severity": "WARNING",
"reason": "daily_loss_proximity",
"delivery": {
"dedupe_key": "risk.daily_loss_proximity.BTC-USD-PERP.HYPERLIQUID",
"anti_fatigue_window_s": 60,
"delivered": true
},
"next_action": "continue quiet quoting"
}
{
"ts": "2026-02-14T03:17:53.905Z",
"event": "volatility_normalized",
"symbol": "BTC-USD-PERP.HYPERLIQUID",
"vol_threshold": 0.0045,
"observed_vol": 0.0039,
"context": {
"spread_bps": 18,
"inventory_usd": 84,
"recon_drift_bps": 0
},
"next_action": "clear defensive sizing after cooldown"
}
{
"ts": "2026-02-14T03:17:54.318Z",
"event": "resume_quiet",
"enabled": true,
"quoting": "quiet",
"cooldown_s": 30,
"gate": {
"preflight_ok": true,
"reconcile_ok": true,
"kill_switch_active": false,
"operator_enabled": true
},
"next_action": "hold reduced size until cooldown expires"
}
{
"ts": "2026-02-14T03:18:24.019Z",
"event": "resume_active",
"symbol": "BTC-USD-PERP.HYPERLIQUID",
"quoting": "active",
"mid": 81243,
"spread_bps": 12,
"verification": {
"open_orders_match": true,
"position_drift_bps": 0,
"heartbeat_lag_ms": 141
},
"next_action": "close incident after stable 60s window"
}
No orders lost. No state diverged. No operator paged. The bot self-stabilized in 12 seconds.
06. OBSERVABILITY
Real-time view of the system. A single screen answers: Is it trading? Why did it halt? What exposure is live? What is the safest next action? The dashboard is live at /console — populated screenshot will replace this placeholder after current testnet soak completes.
07. ACCESS
Operator seats are limited by VPS capacity and by the number of strategies we can responsibly monitor. Request access to be considered.