How ETA Runs

Serves the public site and the gated member app from a global edge network.

Two separated delivery lanes. What ships is versioned, contract-checked, and verified against a production-surface contract on every change.

The operator command center runs on separate infrastructure from the public edge.

Deliberate platform isolation: an incident on the public lane cannot reach the command center, and vice versa. Access is token-gated and fails closed.

Identity, sessions, and records are enforced at the database layer, not just the interface.

Passwordless sign-in only. Row-level enforcement means a page bug cannot leak a record the database refuses to serve.

Every candidate system must earn receipts before any promotion conversation exists.

A single canonical evidence gate rules on sample size, quality, and receipts. Rejections are recorded, not hidden. No verdict can be edited into existence.

Mode, gates, risk, and incidents in one operator truth surface.

The cockpit answers "what is the system doing and is it safe" before anything else. A sanitized public status view exists; the controls do not leave the cockpit.

A discovery fabric that generates and stress-tests candidates, walled off from execution.

Research tooling has no route to order flow and no execution credentials. Ideas leave this tier as evidence submissions, never as trades.

The execution engine and its market line run on dedicated, isolated infrastructure.

Order paths, routing, and runtime internals are never rendered on any public or member surface. Live capital stays behind manual, operator-only gates.

Health, incidents, drift, and receipts are continuously watched and recorded.

Every meaningful action leaves a typed event. Silence is treated as a fault, not a success.

Doctrine, approval gates, and human sign-off own every allocation-affecting decision.

Automation can prepare a decision; it cannot take one that touches capital. That separation is written down, tested, and enforced in the pipeline.