The venue that publishes how much it trusts its own price

Every exchange shows you a number. Openfield shows you the number and its confidence, then spends that confidence on your leverage, your margin and the order in which a failing book is unwound. This page documents the mechanism, the formulas and the limits, including the parts that are not finished.

What Openfield is

Openfield is a derivatives venue built around one claim: a price is an estimate, and an estimate without its uncertainty is a liability. The engine aggregates several independent sources per market, measures how far they disagree and how stale they are, and turns that measurement into a number it publishes as price confidence. Confidence then drives the three things that actually decide whether a trader survives a bad hour: how much leverage is available, how much margin a portfolio must post, and how a losing book gets unwound.

The pre-launch runs on real money. Prices, spreads, confidence and the entire margin engine were built and shown first, on paper, for a year; custody came only once the risk core had been proven in the open. Accounts settle in USDC on Solana. A deposit goes to an address that is yours alone and is credited when it is final; withdrawals go to an address you have proved you control, are approved by the operator and signed by the venue's vault; the books are reconciled against the chain every hour and payouts stop the moment they disagree.

Why it exists

Perpetual venues solved distribution and matching, then handed the risk decisions to whoever deploys a market. Listing an illiquid asset with the margin logic of a liquid one is how a contract falls 45% from its opening print in an afternoon. A pricing error on a third-party market leaves a user with nobody to go to. And a continuously quoted contract on a reference market that closes at the weekend is a gap waiting to happen.

The common thread is not bad luck. It is that the risk decision was separated from the party who bears its consequence. Openfield puts market definition, oracle, leverage limits and halting behaviour under one roof, and writes down the escalation order before listing rather than voting on it after an incident.

Truth layer

Every market carries up to eight independent sources, the majors all eight. On each tick the engine takes a bulk snapshot from every venue, learns each source's structural basis, then computes an estimate and its confidence.

Basis learning

A USDT-quoted venue and a USD-quoted venue do not print the same number, and they never will. Punishing that constant offset would mean permanently distrusting a perfectly healthy market. The engine keeps a slow exponential average of each source's deviation from the median and treats it as that source's basis. Confidence then penalises deviation from the learned basis, not the basis itself.

The quoting floor

Sources cannot agree more tightly than their own quoting granularity. On an asset priced at $0.0000035, one exchange tick is already tens of basis points. The engine subtracts half the prevailing spread before charging any divergence, so a micro-priced market is judged on real disagreement rather than on tick size.

Source roles

Not every source is a tick source. An official daily FX fixing is an anchor: it belongs in the divergence check but has no business being penalised for age. Sources carry a role, and reference-role sources are exempt from the freshness term. This is stated in the code and in the confidence breakdown the terminal shows on click.

Every crypto market now reads up to eight sources: Binance, OKX, Bybit, KuCoin and Bitget in USDT, Coinbase and Kraken in dollars, and Hyperliquid, a perpetual-futures DEX whose mids arrive in one call and whose basis to spot is learned like any other. A venue that does not list a pair is noticed on the first ticks and excluded from the count rather than carried as a dead source. A source is no sharper than its own spread: a book quoting five times wider than the others does not define the disagreement, though it still counts for freshness and for the number of live sources. And with four or more sharp sources, one venue lagging is not a disagreement: the median has already ignored it, and the divergence is the second-widest deviation. With three sources every one counts, as it always did.

The three constants in the confidence formula are heuristics, and the replay reports how much the regime depends on them: moving the divergence scale a quarter either way changes the regime on about one minute in seven and the ceiling on one in three; the freshness constants cannot be tested on candle data and their sensitivity on the live venue is unmeasured.

Market regimes

Confidence maps onto five named regimes. The point of five rather than two is that the engine never has to choose between "fine" and "halted", and it never takes an arbitrary price from a thin book at the moment the book is thinnest.

Full ≥ 97% · Divergence ≥ 90% · Degraded ≥ 75% · below that, Unavailable.

Risk genome

Gold, bitcoin and a memecoin cannot share one margin formula. Each instrument carries a machine-readable profile of its own risk physiology, and the profile is what stops a new listing from inheriting a major's leverage ceiling by accident.

Adaptive leverage

Maximum leverage is not a constant in a config file. It is the genome ceiling multiplied by three factors the engine measures continuously, and every deduction is printed rather than implied.

The ceiling is for what is already open. New risk enters a step below it. A position may be opened at no more than four fifths of the current ceiling, rounded down, and the trader may choose less; the leverage chosen at entry is a property of the position from then on. A position opened at the ceiling would sit within two percent of maintenance; entering below it widens that band, and the replay measures what it is worth. The terminal shows both numbers: the entry cap and the ceiling.

Maintenance, and why it is capped

Maintenance is the smaller of two numbers: six tenths of the initial requirement, and two per cent of the position. The reserve for closing out sits on top. The cap exists because initial margin rises as the engine cuts the ceiling, so a maintenance band defined only against the requirement grew every time the venue became careful, and a trader at eleven times was closed after a 3.2% move while a fixed twentieth tier survived to 4.5%. That is the opposite of the intent, and the replay shows what it cost in an ordinary fortnight before it was changed.

Inherited leverage, and when it ends

A position is margined at the leverage it was opened under. A later fall in the ceiling governs what may be added and puts the account into reduce-only, and it does not re-margin the book. That rule exists because the first version of the replay did the opposite and liquidated accounts the price had never touched.

The inheritance now has an end, because the other side of that rule is a venue carrying positions at ceilings that no longer exist. While the ceiling sits below the leverage a position was opened at, the position is left alone for six hours. After that its margin is re-computed toward the live ceiling on a twelve hour half-life, so within about a day the book is priced at what the engine currently believes. If the ceiling recovers, the clock resets and the position keeps what it had. The terminal states this on the position itself: the leverage it was opened at, the ceiling now, and the moment re-margining starts.

What this costs the trader is written where it happens: a rising requirement on a position that has not moved. What it protects is the account of everyone else, since inherited leverage that never expires is a claim on the insurance fund that nobody agreed to underwrite.

Portfolio margin

One portfolio view, not one netting pool. Every position on the account is margined together and the buffer is one number, but credit for offsetting risk is given only inside a risk family, and inside crypto only up to a quarter. Gold against bitcoin in one account is two risks that share a balance and nothing else. The number on the landing page that says a hedge is cheaper was measured inside crypto, which is the weakest offset we recognise, and that is the largest saving the engine will ever grant.

Cross-margin buys capital efficiency and sells hidden leverage. The dangerous part is not the netting, it is netting a relationship that only existed in calm markets. Openfield recognises offsets inside a risk class only, and only at a credit that survived observed stress.

The close-out reserve exists so the act of liquidating does not itself consume what is left of the account. That is the line item missing from most of the 2026 cascades.

Why a single leg has no liquidation price

Under portfolio margin, the price at which one position is liquidated depends on the whole book. Publishing a per-leg liquidation price as if it were a fact is a comfortable lie. The terminal therefore leads with the portfolio buffer to maintenance in dollars and in survivable adverse move, and shows each position's contribution to the maintenance requirement. The old per-leg estimate is still there, in a tooltip, labelled as an estimate that assumes everything else stands still.

Liquidation as transfer

Liquidation is a transfer problem, not a sell button. When depth disappears, accelerating market orders into an empty book is what turns one bad account into a systemic event. The engine slows down instead.

All four steps are live. In liquidation the engine takes one step every three seconds: inside the risk family with the most margin it reduces opposing positions together, so what reaches the market is net risk; the slice is offered to the book inside a band that starts at the penalty and widens by 25 basis points on every unfilled attempt, up to three percent or the bankruptcy price; if nobody takes it before bankruptcy, the family's fund takes the position at that price and unwinds it itself. Every liquidation fill pays the penalty into the family fund. A cash shortfall after the book is closed is covered by the family fund, then the general reserve, and only then by deleveraging the most profitable accounts on the other side, each of which is told so on the chain. Fund balances and every movement are on the status page.

Loss waterfall

Every loss has an owner assigned before listing, and the order is not renegotiated after the event. A promise that can be rewritten under stress was never a promise.

Reference markets and continuity

A continuously quoted contract on an instrument whose reference market closes is the cleanest example of gap risk there is. The engine carries real exchange calendars rather than one hard-coded week, and searches forward for the next state change instead of hand-deriving each boundary.

• CME / NYMEX — Sunday 22:00 UTC to Friday 21:00 UTC, with a daily break from 21:00 to 22:00.
• Spot FX — Sunday 21:00 UTC to Friday 21:00 UTC, otherwise continuous.
• US cash equities — 13:30 to 20:00 UTC on weekdays.

While the reference is shut the hedge is unavailable, so the genome's closed multiplier applies for the whole window: gold and the indices halve, energy takes a deeper cut. The terminal marks the exact boundary on the price axis and counts down to it.

Order book and protocol-side liquidity

Every market has a central limit order book of our own: price-time priority, one queue per side, orders matched between accounts. A venue with an empty book has nothing to fill against and hired makers will not quote an empty venue, so the protocol quotes first. A house account rests eight levels a side around the engine's mid on every market, at a half-spread and a size that follow the same confidence the traders see: wider and thinner as sources disagree or volatility rises, thinner again in Degraded, gone in Unavailable. Its quotes skew to flatten its own inventory. The house is an ordinary account with two exemptions: it is never liquidated and never on the leaderboard. Its equity, inventory and profit and loss are on the status page, and every one of its fills is on the chain like anyone else's.

The terminal shows this book, with the house share of the depth stated, and the tape is our own prints. Self-trade prevention cancels the resting order and lets the taker continue. Post-only orders that would cross are refused rather than converted.

The conflict, and how the house steps back

A venue that quotes its own book is price source, counterparty and liquidator at once. With money on the table that is the first accusation, and a fair one. Four things are in place. The mark that margins and liquidates every account comes from the external sources described above, never from our book, so the house cannot move the price it is judged by. The house trades with its own capital, in its own account, separate from the funds in the loss waterfall, and its profit and loss is published. Its share of every market's depth is printed in the terminal and on the status page. And its size shrinks automatically as other makers rest orders near the mid, down to a floor of fifteen percent of its normal presence, so on the day a maker programme quotes a market the house is mostly gone from it without anyone deciding. What remains to decide is who else quotes, and that is a hiring problem, not an engine one.

Orders and fills

• Market. An immediate-or-cancel walk of the book, capped at a protective price one percent from the mark. What the book cannot fill inside that band is not filled; the response says how much.
• Limit. Crosses whatever rests at or better than its price, and the remainder rests in the book at that price and fills as a maker when a taker arrives. Post-only refuses to cross.
• Stop. Arms above or below the mark and fires a market order when touched. An order that would fire instantly is refused at entry rather than accepted and immediately triggered.
• Trailing stop (type: "trail", trail_bps 5 to 2000). A stop whose trigger follows the mark at a fixed distance and never moves back: a sell trail ratchets up behind a rising mark, a buy trail ratchets down behind a falling one. The order reports its current ref and trigger; the sweep updates them every tick.
• TWAP (type: "twap", slices 2 to 100, interval_s 3 to 3600, at most 24 hours and five schedules per account). The total is cut into equal slices, each sent at market on its own tick; the schedule is margin-checked once, at entry, for the whole size. It appears under twaps in the account report with its progress, is cancelled like an order by id, and journals twap_placed, twap_slice, twap_done. Three rejected slices in a row stop the schedule with the reason.
• OCO (oco label on a limit, a stop or a trail). Orders that share a label are one pair: when one fills as a maker or fires as a trigger, the engine cancels the rest with reason: "oco". Place both legs in one batch; cancelling one leg by hand leaves the other.
• Scaled ladder. Not an engine type: the terminal sends a batch of equal limits between two prices. The batch endpoint accepts up to twenty orders and answers per order.
• Take profit and stop loss. Attached to the position rather than sitting as separate orders, so partial closes and flips cannot orphan them. In the terminal both lines can be dragged on the chart; releasing sends the new level.
• Reduce-only. Available on every type, and enforced automatically in Degraded and in every non-normal margin mode.

Every order is margin-checked against a simulated post-trade state before acceptance, not after: a market order at the worst price it could fill at inside the band, a limit at its price. Once the account falls below maintenance, resting orders that would add risk are cancelled; reducing ones stay, because they are the way out. Liquidation steps are taken through the book, capped at the penalty price, and only if nobody is inside that band does the venue take the step itself.

Fees and funding

Funding is a premium index. Every minute the mid of our own book is compared with the engine's mid; the hourly rate is the hour's average premium plus a small interest term (0.01% per 8h on crypto, 0.005% on macro), clamped at ±0.05% an hour, charged hourly to open positions. Longs pay when the book trades above the engine's price and shorts pay when it trades below, so the rate is the market's own statement about which side is crowded, and it is printed live in the terminal.

Pre-trade preview

Before an order is sent, the engine simulates it against a copy of your book and returns the whole picture: the margin the position would need standing alone, what it actually costs inside your portfolio, what your existing book saves you, and how the trade moves your buffer to maintenance.

Accounts

Three doors, and the first two ask for nothing about you.

• Wallet — sign a nonce with an Ethereum or Solana wallet. The address is the account. Ethereum signatures are recovered with a dependency-free keccak256 and secp256k1 implementation; Solana signatures verify natively as ed25519.
• Account key — 32 random bytes shown once. Only its hash is stored, so the key is the account: it cannot be reset, emailed or recovered, and the interface says so plainly.
• Email — optional, with verification and TOTP two-factor for people who prefer a familiar login.

An anonymous browser session starts trading immediately, and whichever door you later walk through claims that session's positions and history.

Before the first order the account accepts the terms and the risk disclosure once; the acceptance is a record on the account's chain and the API answers terms_required until it exists. From the account page you can link an X account (read access only, no token kept), turn on email alerts for thin margin, export everything the chain holds about the account with its hashes, sign out every other device, and close the account, which removes the sign-in identity and wipes the book while the pseudonymous chain records remain.

Points

The table below is read from the engine when this page loads, so it says what the engine actually credits.

Points are a record of participation, computed from the public chain and nothing else. Anyone can recompute a balance from the exported history. They have no monetary value, cannot be transferred, and entitle you to nothing; the rules can change and the changelog says so first.

The weights are deliberate: a single day of trading outweighs any social action, and everything social together is worth less than a week of use. Nothing is deducted for a liquidation, because that is the event the engine exists to study, and a penalty would teach people to hide from it. We do not verify identity, so we cannot enforce one account per person and do not claim to; what we can do is read the journal, where farming is visible, and remove the points it produced. The leaderboard shows an X handle where one is linked and a shortened account id otherwise.

Public API

Read endpoints are open and unauthenticated. Account endpoints take a bearer token of either account_id:token or sess:<session>.

Pre-launch: accounts, deposits, withdrawals

An anonymous account can be opened from the terminal (with an invite code while the venue requires one, see the pre-launch page) and can watch the engine, read every page and preview orders. The account opens in USDC on Solana the moment it links an identity: a passkey, an e-mail, a wallet or an account key. A deposit address is issued per account; USDC and USDT on Solana are credited when finalized, and the balance appears in the terminal and on the ledger at the same time. Withdrawals are requested from the account page to an address the account has bound and proved, or confirmed by e-mail; each one is held out of collateral the moment it is asked for, approved by the operator, signed by the vault and paid on chain. The terms carry a pre-launch section (version 2026-09-02) and the terminal asks for acceptance before the first order.

Passkeys. The terminal signs in with a passkey: Face ID, Touch ID or a security key, whatever the device offers. The credential is created in the device's secure element and never leaves it; the venue stores the public key and verifies each sign-in's signature over the authenticator data and the request challenge, on the standard library. Creating a passkey binds the browser's anonymous account to it and opens the account, like any other identity. A wallet signature, an account key and e-mail with a code remain available. On a phone installed to the home screen the passkey is the sign-in that fits.

Where the prices come from, and how fast

Since 2 September the crypto venues stream: Binance, OKX, Bybit, Coinbase, Bitget, Kraken and Hyperliquid each hold one WebSocket to the engine, written on the standard library like the rest of it, and the assessment runs every 1.5 seconds on quotes that are typically a few hundred milliseconds old. A socket that goes quiet for five seconds is replaced by the REST poll for that venue until it speaks again, so a dead feed costs latency, never a missing source. KuCoin, the macro reference feeds and the FX fixings stay on REST. The state of every feed, live or not, symbols, messages, reconnects, is on /api/v0/status under feeds and on the status page.

Why the regime does not flicker

The assessment runs every tick and a market's confidence hovers around a cut for hours at a time, so a naive mapping flips the regime on noise: on 2 September BTC went Full → Divergence → Full inside four seconds on 1.3 basis points of disagreement, and the leverage ceiling with it. Three rules now sit between the assessment and the regime. The effective confidence falls at once but recovers on a 45-second time constant, so a dip is honoured immediately and a recovery has to persist. A regime is left upward only when the effective confidence clears the cut by a full point: Divergence starts below 97, Full resumes only above 98; Degraded starts below 90, Divergence resumes above 91. And no regime is left upward inside 30 seconds of entering it. Leverage is derived from the effective confidence, so it comes down as fast as ever and goes back up carefully, which is the right asymmetry for a limit on risk. The raw confidence is still what the terminal shows and what the history records; conf_eff is in the snapshot for anyone who wants to check the arithmetic. Replay runs the raw assessment without these rules, on purpose: it measures the estimator, not the damping.

Calibration, 2 September

Hysteresis stopped the four-second flicker and then showed the real problem: over twenty hours BTC, the most liquid instrument there is, spent 43% of its minutes below the Full line, in episodes of seven to eleven minutes, on two to four basis points of disagreement between eight venues. A regime that fires on the ordinary life of the market has no information in it. The cause was the price of a basis point: divergence was charged at exp(−bps / 40), so one basis point cost 2.5 points of confidence and ten basis points between two venues already read as Degraded. The scale is now 120: one basis point costs 0.8 points, Divergence begins around 4 bps of disagreement on the judged sources, Degraded around 13, Unavailable around 35. On the same twenty hours that puts BTC in Full about 95% of the time, ETH and SOL about 90%, and leaves the eighteen-percent gap of 10 October 2025 exactly where it was. The regime lines themselves, 97 / 90 / 75, did not move: they are the product's vocabulary. The replay was recomputed with the new scale and its page carries the new numbers; the honest cost is visible there: a less nervous confidence hands out a little more leverage during an event, so the venue's own liquidation share in the replay rises from 41.7% to 46.1% against the conventional venue's 61.7%, with mean entry leverage 7.8× instead of 6.9×. When a market is below Full, the terminal now names the source pulling hardest from the mid next to the regime.

The forward look

Every venue shows the state of your margin now. Openfield can show what happens to it when the data gets worse, because here margin depends on the quality of the price. From 2 September the regime of a market does two things to a position already on the book, both fixed in configuration and both shown before you trade. Positions keep the leverage they were opened under; the regime never re-margins the initial requirement.

The forward look runs the same arithmetic with every market you hold placed at a representative confidence for the regime (98.5, 93 and 82 for Full, Divergence and Degraded; a scenario never improves on the live state) and reports the entry cap for new risk, the added maintenance, the buffer and the margin usage. It appears in three places: as a column on every open position, as a footer under the position table, and as three columns in the pre-trade preview. The numbers are honest about their own smallness: a hedged book in Divergence usually moves by a few hundred dollars, and that is the point.

The house maker has its own page: share of depth on every market, its presence multiplier and how it steps back when external orders arrive, its inventory and P&L. Keyboard on the desktop terminal: / search, b s side, m l t order type, q size, p i o g tabs, w what-if, Esc close, ? the list.

Three things in the terminal now have addresses. app.openfield.markets/#m=BTC-USD&tab=instrument opens the instrument page for a market (genome, calendar, sources, fees, limits, regime history); #m=BTC-USD&tab=portfolio opens the portfolio page (exposure by class, where the requirement comes from, what closing any leg does, the forward look); #m=BTC-USD&tab=log&seq=123 lands on one journal record. Every market-scoped journal record also carries the venue's view of that market at the moment it was written: mark, confidence, regime and leverage ceiling, so a fill can be read against the state it happened in.

On a phone the terminal is a different product: monitoring first, trading second. The first screen is the portfolio: the buffer to maintenance, margin used, equity, the worst regime among held markets, what changed since the last visit (buffer, regime moves, positions opened or closed, events), and one card per position with its forward look. The market screen keeps the mark, the regime line and the leverage; the chart defaults to a price line with the doubt band and a taller confidence pane, because candles do not read at five centimetres. The ticket opens as a sheet from the bottom with leverage presets, the pre-trade preview directly above the button and a second tap to confirm. When the stream stops for more than nine seconds the numbers are marked stale and the ticket refuses to send until it is back.

Push alerts. Leverage here changes on its own while you are not looking, so the venue tells you. From the Account page (or the Portfolio screen on a phone) a device can subscribe to push notifications; every kind of sign-in works, because the subscription belongs to the account, not to an e-mail. What is sent: a regime change on a market you hold, phrased as what it did to you ("BTC → Divergence. Leverage 19× → 11×. Your buffer $210,000 → $140,000."); your account entering warning, reduce-only or liquidation; a liquidation step; a take-profit or stop-loss filling; a price source dropping on a held market. Nothing else. Each kind repeats at most once in ten minutes per account. Delivery uses standard Web Push (VAPID, aes128gcm), implemented on the standard library like the rest of the venue; the payload is encrypted to the device's key and the push service cannot read it.

The band of doubt on the chart is drawn in the same honest scale from the same day: its half-width is the widest source disagreement the engine saw in that bucket, in basis points. At 0.4 bps it is a hairline you may not notice; on a day when venues sit 18% apart it covers the screen. It used to be stretched for visibility, which said the opposite of what the number said. It also sits under the candles now, not over them.

Maker API

The maker API is the venue's answer to its own conflict of interest. The house quotes because somebody has to on day one; every order an external program rests inside 25 basis points of mid shrinks the house's size on that market, down to a 15% floor, and the current share is published per market as house_presence. Nothing about the matching changes for a program: the same price-time book, the same self-trade prevention, the same margin check per order, the same fees (1.2 bps maker, 4.5 bps taker), the same journal.

Keys

A key belongs to one account, carries explicit scopes (read, trade, cancel) and its own limits (orders per minute, open orders), and is shown once. At rest the venue keeps a hash. A key can read the account, preview, place and cancel; it cannot create keys, move deposits, accept terms or close the account. Those stay with the account token or a session. Ten keys per account, and revoking a key closes every socket that used it.

Send a key as Authorization: Bearer ak_xxxxxxxx:<secret> on any account endpoint listed above, on the order endpoints, and on the WebSocket handshake. A key on any other route is refused.

Orders

client_id (up to 36 characters of letters, digits, _ . : -) travels with the order into order_placed, fills and cancels, and DELETE /api/v0/order/:id accepts it in place of the venue id. Order budgets are per key (default 600 per minute, batch entries count individually); a refused order answers 429 rate_limited, a scope miss 403 scope.

WebSocket

Every request may carry an id, echoed on its answer. Answers to order operations do not include the margin report; instead the socket receives every account-scoped journal record as it is written ({op:"event", type, seq, t, ...}: order_placed, fill, order_cancelled, mode, tp_hit, sl_hit, liquidation and the rest) and, at most twice a second after any of them, a fresh {op:"account", report}. What the socket sees is what the chain holds; there is no second stream to reconcile against.

Cancel-on-disconnect. A maker that quotes many levels should not leave them standing when its process dies. {op:"cod", ms:700} arms it: when the socket closes for any reason, including a missed heartbeat or a venue restart, and no other socket for the same account has it armed within that window, every resting order is cancelled with reason: "disconnect" (or "shutdown") and the account gets a cod_triggered record. Reconnecting inside the window keeps the ladder.

Rate limits and load shedding

One program should not be able to make the venue worse for everybody else. The limits below are the whole policy. They live in one file, api/limits.mjs, with the reasoning for each number written next to it, so there is one place to read them and one place to argue with them.

Budgets are token buckets rather than counters in a fixed window. A bucket starts full, refills at a steady rate and holds at most its burst, which means a key can open with a full ladder and then settle into a sustained rate, and it also means a key cannot save up a minute of allowance and spend it in one millisecond.

Every budget is charged twice: once to the key that made the request, once to the account behind it. Ten keys on one account share the account's allowance, so minting keys buys nothing.

What a program gets

On the socket

Order and cancel operations sent over the socket are charged to the same buckets as the REST calls, so opening a WebSocket does not double a maker's allowance.

What a refusal looks like

A refused request answers 429 with a Retry-After header in whole seconds and a body that names the limit, so a client can back off by reading rather than by guessing.

Load shedding

Budgets bound one caller. A circuit breaker bounds everyone at once. It opens on any of three signals: the event loop running more than 750 ms behind, the truth tick arriving a whole tick late, or more than 96 requests being served at the same instant. The third is the one that moves under a real flood, where the loop keeps spinning happily while requests queue behind each other.

While it is open the venue refuses new risk with 503 and {"error":"venue_busy","why":"inflight","retry_after_s":2}, again with a Retry-After header. Order entry and batches are shed. Cancels, reads and market data are served throughout, because a venue that stops you from getting out while it is busy has the priority backwards. The breaker stays open for at least two seconds and closes on hysteresis rather than on the first quiet sample, so it does not flap.

GET /api/v0/health publishes what the breaker sees: event loop delay, truth tick lag, requests in flight, whether it is currently shedding, how many times it has tripped and how many requests it has refused.

Market catalogue

Loading the live catalogue…

Roadmap and gates

Each phase has a proof it must produce and a signal that would mean stopping. The gates are written down so they cannot be quietly moved.

Gate status, 1 September 2026. Risk core: the replay shows scenario margin beating a fixed tier on every disagreeing day and says what the maintenance rule costs. Truth layer: stale and diverging data step the regime down on the live venue and in the replay, and the drill demonstrates it per account. Exchange alpha: matching is our own book with price-time priority, and every account is rebuilt from the chain and compared with the live state on the status page. First macro instrument: eleven have run since v0.9 with real calendars; the weekend gap versus the reserve is measured but not yet exercised by a loss. Portfolio liquidation: all four steps are live and the funds are ring-fenced; the auction is bid into by the house and by whoever is in the book, not yet by a maker programme.

What can kill us

Where things stand

One matrix, kept current with each release, so that the docs, the terminal and the site say the same thing about the same feature.

Known limitations

Stated plainly, because a venue whose pitch is honesty about uncertainty cannot be coy about its own.

• Real money, with custody. Deposits on chain to an address that is yours, withdrawals approved and signed by the vault, an hourly reconcile against the chain. The venue runs on a single machine; the parts that are not yet in place are on the security page.
• Display data comes from reference venues. Candles, depth and prints are sourced externally; the mark, the confidence and every margin decision are ours.
• The liquidation auction has no maker programme yet. The staged auction is live and is bid into by the house and by whoever rests in the book; a dedicated liquidation-maker programme, with its own obligations, is next.
• Confidence history is young. The pane fills as the engine runs and says how many bars it actually has.
• Macro instruments with one source are labelled as such and carry a lower ceiling by genome rather than a manufactured second opinion.