Piper

Private independent project · Current · Published October 6, 2026

An agent runtime for live capital operations. A model may decide that a spend should happen; deterministic gates it cannot widen decide whether it may.

Thesis

Piper is a runtime that researches, proposes, gates, places, watches, and accounts for positions on a live venue, continuously, under bounds a human owner set and only that owner may loosen. It acts between human glances, against a counterparty that does not forgive a mistake.

Its design rests on a few separated units. The unit of specialization is one venue plus one mechanism. The unit of learning is a thesis: a stated mechanism, a stated way it could be false, put on with real size, and settled from the venue's own records. The unit of authority is a hop: a signed mandate, a type-gate, an atomic claim, then exactly one write. Nothing else moves money.

There is one root agent. It is the front door, the orchestrator, and the implementer, and it calls three faculties: research, execute, and monitor. The set is closed. It is not a growing desk of agents that argue.

The design treats four things as the same class of mistake: a single model call wrapped around a hardcoded rubric, a model that emits an order, a chat surface that maps a phrase to a webhook and calls the result an operator, and a risk check that looks like one and is not. Each puts a model or a placeholder where a mechanism should be.

Two work classes

The runtime is one container image deployed in two work classes, split on the order path rather than on cadence.

• The trade class is in the order path. It holds the signing credential, runs the risk clock, and claims execution jobs. It never listens on a port.
• The think class is everything else. It perceives the venue, runs research, evaluates triggers, and hosts the front door the owner talks to. It holds strictly fewer secrets, and none of them can sign.

A missing or unrecognized class refuses to start. It never defaults, and above all never defaults to the class that signs, because a typo that silently starts the signer is the expensive direction to fail.

Each class holds a lease so that only one live process of it exists, even during a redeploy, when the platform briefly runs old and new side by side. A lease has an owner and a counter does not, so the lease is checked on renew and on release. Clocks are of two kinds. The risk clock is an interval. The others are boundaries, which ask whether the boundary containing this instant has already been serviced, so a restart neither misses one nor fires it twice.

Every durable fact is a Postgres row. Redis holds liveness, locks, and leases, and it is never the authority. Exact decimals travel as strings, and a missing value stays NULL rather than becoming zero.

The signer boundary is a build property

The research class holds no signing key. The whole design leans on that sentence, so it is enforced twice, by two independent mechanisms.

The first is the process. The research class's environment does not contain the key, the signer's address, or any broker credential.

The second is the build. A test walks the import graph of the research class's entry module and asserts that it never reaches the signing modules, the hop, or the loop that operates. A module that cannot be imported cannot be called, however a future edit is written. The walk discovers its starting points from the filesystem rather than from a list, because a hand-kept list is the defect a reachability check exists to catch. It also runs a positive control, walking from the live adapter and asserting that it does reach the signer, so the check cannot pass because the signing code was deleted.

This shaped the code that both transports share. The owner's conversation lives in one module that declares the execution path it needs, and each transport supplies one. The owner's shell supplies the live path. The front door supplies a read-only path, and a request to open a position through it is refused by name.

The credential that does sign is trade-only. Its allowlist names the order actions and nothing else. Withdrawal and transfer are absent, and widening the allowlist is a visible commit.

Autonomy is a class

Human-in-the-loop is a class, not a default. Binary governance, either fully locked or simply trusted, is a failed design. There are four classes, and each selects which human step sits in front of the same gate. None deletes the gate.

• Observe reads and mints no write.
• Advise mints a reviewable for the owner to read.
• Act with approval proposes one write, which needs a fresh confirmation on that exact reviewable.
• Act autonomous writes under a standing register: a mandate the owner minted, with a cap and a kill, from the owner's own shell.

A missing register fails closed to act with approval, and so does a register that has expired. Neither invents a write.

The hop

A spend is a settlement hop. A signed mandate carries an intent, an amount cap, an expiry, and exact counterparties. A wildcard counterparty fails closed. A live mandate must deny withdrawal and name a live parent.

The type-gate is synchronous and pure, and it reads no database. It checks that the mandate's intent matches the reviewable's, that the reviewable's intent matches the catalog entry for its plan, and that the plan is feasible on the very read the order is about to be priced from.

Plans are discrete and enumerable: a small, versioned catalog of resting orders, a flatten, and an unwind. A model selects among them; it does not compose an order. The catalog contains no market-order plan, and the gate refuses one by name.

The root may decide that a spend happens. The type-gate, the claim, the envelope, the loss check, the ownership claim, and the owner's cap decide whether this hop is legal. The model does not size, does not set risk, and does not hold the kill.

Only the owner widens

The owner talks to the operator through three callers: the shell, a front door served by the research class, and the loop itself, which acts with no owner present. All three call one verb module, because two implementations of a verb would be two operators.

Every caller may narrow a bound. Kill and pause are open to all of them, because a kill that is hard to reach is not there when it is needed. Only the owner's own shell may widen one: write the cap, resume anything paused, renew a standing register, or place on the approval-only surface. The rule is "shell only", not "not web", so the autonomous loop is held to it too. A clock that could raise its own cap would have no cap.

A position opened from the front door is a proposal. It waits in a state no consumer claims until the owner approves it. Approval is open to every caller, because it only moves a row from unclaimable to claimable inside bounds the owner already wrote. So the most a leaked front-door token can do is enqueue one position inside a cap and a register the owner already set, and a kill refuses even that.

Every refusal is a structured client error that carries the bound by name, never a server error. A refusal is the system working, and the owner most needs to read the bound at exactly the moment it refuses.

The claim and recovery

A mandate allows one hop. The claim is a row whose primary key makes a double claim impossible rather than unlikely, and the cap decrements in the same transaction as the claim insert. Redis sits in front for fast mutual exclusion, but it is not the guarantee. The primary key is.

A process can die while holding a claim, so the claim carries an owner, a lease, a heartbeat, and an in-flight mark written before the order is placed. On boot, before any new work, a sweep decides each lapsed claim:

• with no in-flight mark, no order can exist, so the claim is released;
• with a mark and a recorded outcome, the write landed, so the claim is settled;
• with a mark and no outcome, an order may have reached the venue while the record died, so the claim is settled and an incident is opened.

The ambiguous case fails closed and hands the truth to reconciliation rather than guessing in favour of availability. A release must own the claim it releases, so a stale handle cannot reopen spent capacity.

The same shape governs two orders that must succeed together. The venue's batch is not all or nothing, which a live probe showed, so atomicity is constructed. The intent is recorded before the first leg goes out. A pair is complete only when both legs fill, and a leg that may have opened is never assumed closed.

The model proposes, arithmetic judges

Every verdict is arithmetic over stored rows. A model proposes a thesis together with a falsifier, and the falsifier is an executable predicate, not prose.

Look-ahead is made inexpressible rather than discouraged. A deliberately planted look-ahead oracle passed the statistical defense completely, because deflation corrects for selection among honest backtests and has no mechanism against a contaminated information set. So the defense became structural. The proposer may only name features from a closed registry, generated into its output schema, and every feature is read point-in-time with a publication lag.

A thesis must then pass three instruments, and all three are required: a deflated Sharpe ratio for selection luck, the probability of backtest overfitting, and a held-out bootstrap interval. Ties go to the null. Missing data is a refusal to evaluate, never a pass. Every look at the data is written to a fleet-wide trial ledger before the number exists, so the bar for significance accounts for every attempt. Dead theses are archived with their evidence, so a later session does not propose them again.

A certified thesis is stress-tested again on its own mechanism before it is sized. Sizing is arithmetic over three bounds that must all be known: the owner's cap, the active capital rung, and the market's capacity. Unknown capacity is zero. At execution, the premise is re-read against the live venue.

An unknown halts

The risk kernel is built on one asymmetry. Refusing to trade on missing data costs an opportunity. Acting on missing data costs a position. So an unknown halts new intent, and an unknown never flattens.

Limits are layered, and none is redundant: the strategy's declared envelope, intersected with the kernel's caps and never unioned; a capital rung released by evidence in the ledger, never by a balance arriving; a drawdown ceiling anchored when the operator began; rolling loss windows rather than calendar ones; and a static catastrophe bound inside the one function that builds every order.

A halt must never block the exit. Every ceiling lets a reduce through, because a limit that blocks the exit traps the position. Reconciliation maps every venue position onto an owner on each tick. It reports what it finds and never corrects it, so it cannot manufacture the attribution an incident exists to question.

What it prevents

• A model that sizes an order, sets its own risk, or holds its own kill.
• A research process that can sign, however a future edit is written.
• An autonomous loop that loosens a bound the owner set.
• A crash that leaves capacity wedged or reopens capacity already spent.
• A backtest that can see the future and pass anyway.
• A safety system that becomes the incident by acting on data it does not have.