Five sections covering the structural decisions, the data model under them, and the operational characteristics you can show to an architecture review or a regulator.
§ 01
Consensus as a structural risk control
A single venue's order book can be manipulated, lagged, or mispriced. A strategy that fires on a single venue's signal is exposed to every quirk of that venue. The consensus gate solves this structurally: a signal must be agreed upon by at least N of M monitored venues (typical: 3 of 4) within a tight time window before any order is released. If Binance shows BTC at 71,200 and OKX, Bybit, Kraken all show 71,400, the gate refuses to act on the Binance-only outlier — until either the others confirm (signal becomes valid) or the divergence persists past the timeout (signal expires). This converts venue-specific risk into a hard "no" rather than a soft warning.
§ 02
ML scoring without ML autonomy
Every signal that survives the consensus gate is scored by a per-strategy ML head: features include order book imbalance, volume regime, recent volatility, microstructure latency, time-of-day priors. The score is an input to the order-sizing logic, not an autonomous decision-maker. A high-confidence score increases position size within the risk envelope; a low or anomalous score zeroes the trade. The ML scorer never overrides the consensus gate or the risk budget — it operates strictly within them. This bounded design is what makes the system defensible to investors: there is no path where the model takes a position that the structural controls would have prevented.
§ 03
Anomaly veto
Running parallel to the ML scorer is an anomaly detector — a separate model trained on what "normal" market behaviour looks like for each pair, calibrated rolling. When the detector sees something it doesn't recognise (a flash move, a venue-wide latency spike, an unusual volume pattern that matches historical exploit signatures), it issues a veto on the affected strategies. The veto pauses new orders for that strategy/pair and lets existing positions wind down according to their stop logic. The veto is asynchronous to the consensus gate — the two are independent layers of defence.
§ 04
Risk budget and VaR
Each strategy operates within a daily risk budget expressed as Value-at-Risk at a configured confidence level. The budget is updated continuously as positions move; a strategy that has consumed its budget cannot increase exposure without approval, regardless of signal quality. The risk service is the single arbiter — the strategy code asks "may I take this position?" and gets a yes/no with a budget-remaining value. There is no path to bypass the risk service. Drawdown breaches automatically reduce the next day's budget by a configured factor.
§ 05
High-water-mark fee with crystallisation
Performance fees on hedge funds are a permanent source of investor-manager friction unless they're mechanised correctly. The HWM model used here charges 5% on returns above the historical peak NAV per investor, crystallised quarterly. Crystallisation matters: it turns "fee earned in theory" into "fee paid to the fund", resetting the HWM. The investor portal shows current NAV, current HWM, fees earned-but-not-yet-crystallised, and a dated history of every NAV mark. Disputes are resolved against the on-ledger NAV history, not against a spreadsheet.