Operating architecture / combined public view
The hardware, tooling, data, jobs and products behind Risk Dimensions and Kestrel.
Mark's desk, the primary runtime, Luke's support machine and the future observer.
Hardware names follow Mark's labels. Pink support relationships are Mark-described, not a fresh SSH access test. The dashed Dell lane is planned. On a small screen, swipe the map sideways.
The hardware labels are display names, not new DNS names. Support access is described at role level, not published as an access grant. It does not reopen the retired Dell production topology.
These are the rails that run and connect the system. Keep them separate from the products they support.
Open the operational tooling inventory → Search components, locations, owners, dependencies and evidence status.
n8n schedules workflow calls. Native systemd services and timers also run jobs; scheduler ownership is specific to each job.
Pages publishes sites. Workers run edge/proxy and intake logic. DNS and Tunnel connect approved product surfaces to their backends.
Private machine-to-machine transport for operating and support. Mark retains administrative control; Luke's support lane is shown separately.
Source history, isolated development, reviewed changes and release handoffs. A local build, a push and a production deployment are separate events.
Workload credentials stay in the protected service lane. Provider-specific brokers expose bounded operations, not unrestricted account access.
Mark sets direction and retains final authority. Coach is his subject-matter expert and strategic thinking partner, helping test assumptions, interpret evidence and develop strategy. Alfred is the COO, coordinating and executing approved work. Hermes provides the shared framework for running and coordinating agentic work across these roles and specialist agents. The roles remain distinct from—and more enduring than—the harness, models and tools that implement them.
Storage, provider integrations and serving interfaces are distinct parts of the operating system.
Market history, securities reference, risk analytics, company financials, macro/fiscal history and research context support approved consumers.
The retained inventory links feeds and datasets to their consumers. Protected aggregate Equity research includes the country-level Equity audit, without ticker or issuer disclosure.
Product interfaces serve approved data. Dispatch interfaces connect approved jobs to workers. These are different functions—not one undifferentiated API.
Governed read and assistance boundaries separate permitted context retrieval from unrestricted account or administrative access.
Documented integrations include financial-data vendors, official economic sources, business platforms and model adapters. A documented adapter is not a live-connection guarantee.
Canonical research, retained evidence and local working indexes complement relational data. Original-provider provenance and capture times remain important.
Map the executable chain, not just the job title. Each job needs an owner, input, route/entry point, output, schedule and freshness check.
This is a reading order, not a claim that every job follows exactly one route. Some jobs use native timers; not every workflow maps one-to-one to a worker. The map does not certify individual job execution or current permissions.
The product layer consumes the shared system. It should not be confused with the machinery that supplies it.
Cross-asset dashboard, securities universe, news, events and risk/outlier views.
Listed and bespoke return-series analysis, simulations and portfolio diagnostics.
Debt, deficit, maturity and fiscal-history monitoring.
Single-company research, comparisons, valuation and contextual Coach interpretation.
The documented shared curation/scoring component behind the product suite—not necessarily a fifth standalone public application. It joins curated data, Security Master tags, Themes, Couplets and frameworks to the interpretation surfaces.
Observation: what is happening.
Interpretation: why it matters through the selected frameworks.
Dialogue: questions and answers grounded in the permitted data and framework context.
Kestrel is the umbrella, not a claim that every unified feature is finished. The five-component suite is documented; the current public Kestrel surface is recorded as a landing page with one-pagers. This is a component map, not certification that every unified feature is complete.
Practical dependency: curated provider data + table-backed analytics + Security Master / Themes / Couplets / framework canon → Intelligence Engine → Pulse / Rationale / Coach and product views.
The older UI specification names Brief, Sunday Read, Scorecard, Players and Analyzer, with RHYMES and The Trim as interpretation controls. Those interface plans are not the same list as the five product components above; their current implementation state is not asserted here.
Cloudflare delivery, API contracts, data lineage, scheduled jobs and model/scoring versions remain separately inspectable dependencies—not hidden inside a single “Kestrel” box.
Research users consume approved data without gaining access to the underlying operating infrastructure.
CUNY / mentorship tooling — WIP Historical analyst-seat foundations do not certify a completed CUNY-specific rollout.
Approved research applications consume curated, read-only endpoints. Cohort onboarding, scope and per-seat acceptance remain explicit work.
Approved analysts can work through an allowlisted data rail with their own analytical workspace. Shared contributions require separate approval.
Orientation, Jupyter / Colab / Excel, starter notebooks and versioned calculations support research. Manager and cohort tooling are shown as WIP, not finished capabilities.
Explore the public catalogue → · Read the intelligence and memory architecture →
Role descriptions, documented components, planned work and WIP are different kinds of evidence.
The catalogue is a public-safe grouped view of the reviewed system. Full operational identifiers, service health, permissions, credentials and private records stay outside this public site. The workflow figures retain their source date and are not a live monitor.
Intelligence architecture · Compounding engine · Space between · Regime sentinel