AlphaForge is my risk-first trading platform for crypto and US ETFs. Strategies and an AI Lab can only propose; a deterministic risk engine decides; every fill lands in an append-only ledger. It paper-trades end to end on an Azure dev environment. Live trading is designed, not built, and switched off anyway.
TypeScript
React 19
AzureA price feed freezes while the job still reports Running. A backtest shines because it peeked at tomorrow. A fee posts a day late. A model writes an order quantity with total confidence. None of it throws an error; it turns up later as a number nobody can explain.
So AlphaForge runs on one rule from its own plan: if the platform can't prove what happened, why, and how it would stop itself, it doesn't touch real money. It's the evidence-first habit from my monitoring work, pointed at markets.
Even I can only propose. Every stage stores what it saw and decided in PostgreSQL.
Scheduled workers pull bars and quotes, keep each raw response beside exact decimals, and log stale data, gaps, and disagreeing sources as typed events.
Pure functions of price bars, with hashed inputs and outputs, so any tick can be replayed and checked. "No trade" is a stored answer with a reason.
Budget-capped model runs get read-only tools. The platform grades their strategy blueprints and stores their paper-trade proposals uneditable, with no order authority.
Checks losses, drawdown, exposure, cash, data health, and reconciliation, then answers approve, reject, or risk-reducing only. About 100 reason codes; unknown means reject.
Idempotency keys, a lock per account, and one last safety check before the network call. Fills come from an internal simulator or a broker's paper API.
The ledger is insert-only; a trigger answers edits with "append a compensating event instead." Positions and cash rebuild from it and reconcile against the broker.
The dangerous failures here don't crash. They agree with you.
"Running" isn't "working." A database restart killed the market-data loop, but a quote stream in the same process kept it alive, so Azure showed Running for two days while crypto prices sat frozen. The strategies rightly refused to trade. Now both halves fail together and exit, and a fleet-wide monitor watches every worker's heartbeat.
A reconciliation that could never fail. The simulator was checked against the platform's own records, so a missing position could vanish from both sides and understate risk. A clean result proved nothing. Now two independently built sets of books must agree, and I formally invalidated nine of my own earlier reports built on the old ones.
No peeking at the future. Backtests see only data up to the decision bar and must clear five bias checks, including look-ahead and survivorship. Paper fills needed the same rule: a regression test caught a simulated buy priced from a newer quote from another source. Now each fill is bound to, and stored with, the exact quote it was admitted on.
"Typically" is not a deadline. The broker posts crypto fees later, and its docs say only "typically" the next day. Inferring one from leftover cash would be easy and unprovable, so a missing fee opens an incident that blocks new risk on that account alone. One paper account has stayed blocked for weeks rather than guess.
Keeping models honest. The platform fills in every ID and rejects any quantity, price, or credential a model writes; models never grade themselves. The first real model run took four tries, each exposing a test fixture that didn't match the real service, and each fix kept it failing closed. Still open: a provider-enforced dollar ceiling per request.
Foundation: 17 of 17 v1 items done. Delivery: 4 of 17.
The first broker round trip was a $1 paper order in June. By late July, two crypto baselines had run unattended for about 45 days: 22 simulated fills, zero reconciliation differences. The AI Lab has made real, budget-capped model runs since July.
Dev's database is still on its late-July schema, twelve migrations behind. Everything since, including cash reservations and quote-bound fills, passes on throwaway PostgreSQL. The build gate is red on lint and bundle-size checks, not failing tests.
The global flag is off, the live allowlists are empty, human approval is required, and no live broker connection exists. Other exchanges are read-only or demo-only.
Ship to dev. Build the daily Watch view, a Create Lab flow that runs to outcomes, and a bounded mandate in place of per-promotion approvals. Then a tiny, isolated real-money pilot and seven straight days of scheduled operation.
The code stays closed, and so do strategy parameters, limits, and account details. Nothing here is investment advice or a performance claim; the numbers count evidence, not returns. Want to talk markets + automation? Reach out →