Due diligence, run on ourselves

How the reviews work

Each review is written so that the next one can repeat it. The rules below are fixed across the series, because changing them would make the scores incomparable.

• A fixed audiencea prop firm, not an allocator

  The reviews assume the reader is a prop desk's technology team: controls, research integrity and change management. They do not assess strategy merit, capacity or expected return; those belong to the research record.

• Standards named firstheld constant across reviews

  Each dimension is scored against published guidance chosen before the first review, listed below.

• No score without a measurementevery finding carries its command

  A score may move only on a measurement taken again at that review. A score that was not re-measured is carried forward and marked as an assertion about the earlier date, not about today.

• Movement recordeda Δ and a reason for each change

  A score that improves because the standard was loosened counts as a regression. A fix that shipped but did not move its score is recorded as such, not edited away.

• A self-assessmentand it says so

  The reviews are written by the person who built the system, with AI assistance. They substitute for an independent check without replacing one, and the scale below is built to make that limit visible.

• Count only what was written herefirst-party, always

  A count across the repositories gave 12,223 tests; counting only first-party code gave 11,539. The rest were vendored code and virtual environments.

The scale

The step that matters is from 4 to 5. Every external framework, in the end, asks whether someone other than the builder has checked the work.

1. 0

   Absent.

2. 1

   Absent or failing in practice, whatever the intent.

3. 2

   Partial, or present but undocumented and unevidenced.

4. 3

   Documented and demonstrably operating.

5. 4

   Evidenced in production, with the evidence retrievable on demand.

6. 5

   Independently verified by someone who did not build it.

While one person builds and runs Nexus, a 5 is out of reach by construction and 4 is the practical ceiling. The reviews treat that cap as a finding in its own right, not as a quirk of the scoring.

Thirteen dimensions, three readings

Decisions the reviews changed

The value of the series is less the scores than what they pointed at. Each of these began as a finding.

• Losing the operator did not stop trading. Every automatic halt was a machine check: failed ticks, failed orders, a drawdown. With nobody at the desk, the book would have kept trading indefinitely. A dead-man switch now halts it after a set number of days, 14 by default, with no authenticated action by the operator. It halts new orders and keeps positions.
• The trading control plane had no authentication. The first review rated it critical. By the 9 September review, the trader's control routes required authentication.
• Model parameters had no provenance. Parameter rows carried no engine version and no promotion date, and each promotion overwrote the last. A promotion must now name its engine and date, and every write is audited. The book's gate blocks a book it cannot identify. Engine drift only warns, because blocking on it would halt the book whenever the engine changed.
• Unit failures raised no alert. At the second review, none of 113 system units had a failure handler. By 18 August, 85 of the 105 first-party units had one, along with a sweep that repeats the alert while anything stays failed.
• Pre-trade limits went from absent to evidenced. Price collars, a check for a missing limit, and a cap on order size. Limit verdicts were recorded 0, then 11, then 106 times across five reasons, each stored with its order. Production runs them in warn mode; Execute explains what block mode waits on.
• The deploy gate refuses rather than warns. A dirty working tree stops a deploy, and so does a release that would silently roll back commits already in production.
• Tests and CI reached almost everything. First-party test functions went from 3,376 to 11,539, CI from 4 of 13 repositories to 14 of 15, and secret scanning became a CI check that can fail.
• The kill switch stopped depending on the trader's database. A stop file that needs no database and no API is checked before every execution, and it counts as engaged if it cannot be read. Who may operate each stop is listed, and the switch was drilled on 9 August. Like every halt, it stops new orders and keeps positions.

When the score did not move

A fix that shipped without moving its dimension is the most useful thing the series produces. It means the fix was aimed at a symptom.

What is still open

As recorded at the 9 September review, in the order the review ranked them.

• No track record. Trading runs on broker demo accounts only. Under every applicable rule that is hypothetical performance. Funding waits for a strategy worth funding, which is the research programme's job.
• No edge demonstrated. Six searches have closed negative, each with a written verdict. The pre-registered flagship programme had booked no runs by 9 September. That is the framework working, and it is not yet a result.
• Multiplicity is corrected per study. Each study deflates its results for the trials it ran, but not for the selections made across all studies. The correction across the whole programme is open work.
• Recovery point. Backups are taken daily, copied offsite and test-restored, but the recovery point is the last dump. Continuous archiving of the database log would shrink it.
• One person. AI agents review each other's changes, and 78% of commits to the research service between the second and third reviews arrived through a pull request. One person operates them all, so this is change control with an audit trail, not independence.

What the reviews say not to buy

Scope discipline matters as much as the work. For a prop-desk audience, these would cost money and move nothing that matters.

• SOC 2 or ISO 27001 certification. A firm requests SOC 2 from its vendors; nobody expects a one-person build to hold it.
• GIPS verification, a fund administrator or a custodian. These answer an allocator's questions. A prop desk trades on its own infrastructure, where its own books are the record.
• An outsourced compliance officer. Valuable for a fund launch, and not what a desk assesses.
• Chasing the mean. Two dimensions at 4 and two at 1 average the same 2.5 as four at 2.5, and a reviewer reads them very differently, because the 1s are what get found.

Two clocks

The engineering programme moved the mean from 2.2 to 3.4 in six weeks. The research programme has not yet found an edge, and dimension 13 has not moved. The reviews are written to keep those two facts apart: a better-built instrument is not progress toward profit, and the average score should not be read as a distance travelled. What would change the picture is one pre-registered result that survives its own rules, with the multiplicity correction applied across the whole programme.