Architecture — Mithraeum Agora

How it fits together

Four programs, three trust boundaries

The interesting decisions in this project are almost all about what is not allowed to travel, and which program is permitted to know what.

Read the arrows as dependencies, not data flow. The Mithraeum depends on the Agora for identity and on the Control Plane for a release manifest; the Agora depends on the Control Plane for entitlement. Nothing depends on Your data except the component sitting beside it on the same node — which is the property the whole arrangement exists to produce. The two small rectangles on each component are its provided and required interfaces.

What actually crosses

Direction	What travels	What never does
App → Agora	Who you are: a sign-in, a session, a support message you chose to send.	Positions, orders, balances, symbols, strategy logic.
Agora → App	A signed entitlement saying which features your account may use, and for how long.	Anything about anyone else's account.
Agora → Control Plane	Subscription questions, on a server-to-server channel that never touches your browser.	Market data. The Agora has none to send.
App → Control Plane	"Is there a newer version?" — answered with a signed manifest.	Any identifying detail about what you are running or trading.

The line in the middle is the whole design. A trading application that phones home with your positions is a trading application that can lose your positions. This one cannot, because the parts that face the internet were never given them. That is a structural property, not a setting, and it is not something a future version can quietly relax without rewriting the boundary itself.

The two programs on the right of the line each get their own treatment: the Agora — the community site, its screenshots and the strategy library — on its own page, and the Control Plane in the section below this one.

Why four programs rather than one

The signing key lives alone. Entitlements and software releases are cryptographically signed. Exactly one program holds the key that does it, and that program has the smallest job and the smallest exposed surface of the four.
The internet-facing program holds no commercial authority. The service that accepts sign-ins cannot mint an entitlement or publish a release. It has to ask, over a separate channel, with a credential scoped to exactly that question.
The application verifies rather than trusts. It checks signatures against keys it has already pinned. A server that starts answering differently — or an impostor answering in its place — cannot talk it into anything, because the answer has to carry a signature the app already recognises.
The workbench never ships. Operational tooling, test runners, backup commands and build machinery live in a fourth program that is not part of any release. The thing customers install stays a clean application rather than an application with a maintenance hatch in it.

Fail closed, and say so

A recurring rule across all four programs: when something cannot be determined, the answer is never a cheerful default. An unreachable data source records absence rather than zero, because "there were none" and "we could not tell" are different facts and only one of them is evidence. Charts draw the gap as a break rather than joining the line across it. A permission check that cannot resolve denies. A monitoring reading that cannot be taken is missing rather than invented.

It sounds obvious written down. It is surprisingly easy to get wrong, and a system that quietly reports zero when it means "unknown" will eventually convince you that nothing is wrong at exactly the moment something is.

Note. This page describes architecture at the level of shape and intent. It deliberately omits internal addresses, file layouts, credential handling and other operational specifics — a public description of a system's interior is a convenience for the wrong reader. Nothing here is investment advice or an offer of any product.

Licensing and releases

The Control Plane

The smallest of the four programs, and the only one that holds a signing key. It answers two questions: what is this account entitled to, and what is the current version of the software.

Entitlements are signed, not asserted

When the application asks what features an account may use, the answer comes back cryptographically signed with a key the application has already pinned. That has a few consequences that shaped the rest of the design.

It works offline. A signed entitlement is valid for a period, so an aeroplane, an outage or a bad hotel connection does not lock you out of software you are entitled to run.
It cannot be forged by whoever answers. The application is not trusting a server; it is verifying a signature. A different server, or an impostor in the middle, cannot produce one.
A new key cannot introduce itself. If a signature arrives under a key the application has never seen, that key can only be accepted through a separate, independent channel — never on the say-so of whoever just sent the message. An update host can never authorise its own key.
Rotation is deliberately awkward. Reusing a previous key identifier is refused outright, since it would shadow the retired key and silently invalidate everything that key had signed. Retired keys are never automatically discarded — removing one is an explicit act, taken knowingly.

Updates the application checks but never installs

Refusal means silence. Showing any part of a message that failed verification — even "an update may exist" — would mean the failure had already influenced what you see. The right-hand box is the deliberate design, not a missing feature.

An unverified manifest surfaces nothing. Not a version number, not a URL, not a checksum, not a "there may be an update available". Showing a partial result from a message that failed verification would mean the failure had already influenced what you see.

One version, a binary per platform

A release is one version shipped as several binaries — the application now builds for two desktop operating systems — and the signed manifest carries each platform's entry inside the signature, so no platform's download can be swapped without breaking it. The application reads its own platform's entry and nothing else: a manifest with no entry for it is answered with nothing, and a platform name outside the known set is refused rather than matched loosely. A manifest from before there was a second platform is read as describing the original one, and only that.

An operator trail that cannot be quietly edited

Administrative actions — issuing, lapsing, granting, rotating a key, publishing a release — are appended to a hash-chained log. Each entry commits to the one before it, so removing or altering a line is detectable rather than invisible, and the log reports the exact point where the chain breaks. It is appended to and never rewritten, because a record that can be tidied afterwards is not evidence of anything.

Three audiences, one door

The service answers to three kinds of caller: anyone at all, for the small number of things that must be public before any credential exists; the identity service, for the specific questions it is allowed to ask; and me, for administration. Which caller may reach which capability is decided by a single explicit map, and anything not named in it is treated as administrative — so a newly added capability is unreachable by a lesser credential by default, rather than reachable until someone remembers to restrict it.

That default was the fix for a real hole rather than a precaution. The map used to name the restricted paths, which meant every capability added afterwards was public until somebody noticed — and one of them, added later, would have let any caller at all close any account. Naming the permitted ones instead inverts the failure: the mistake you can now make is a capability that refuses a caller it should have allowed, which is visible immediately, rather than one that admits a caller it should have refused, which is visible only afterwards.

The commercial authority is this service's alone. The identity service used to carry an administrative page for conferring subscription tiers — which meant the credential held by the internet-facing process could grant any tier on any account for years at a time, with only a role check inside that same process standing in the way. It is gone. The rule that replaced it is mechanical and a test enforces it: every capability the identity service can reach which changes anything lives under one prefix, and every administrative path it can reach is read-only. A customer's own purchase and an administrator conferring a tier are separately recorded, because the trail is evidence and it must not blur who acted.

Descriptions on this page are deliberately general. Specific endpoints, credential handling, key storage and deployment details are omitted — publicly documenting the interior of a security boundary mostly assists people you would rather not assist. Nothing on this site is investment advice or an offer of any product or service.

A personal project. Not advice. Nothing for sale.

This site describes a personal engineering project, written and run by one person in their own time and published under the name Mithraeum Agora. There is no company behind it, no team and no other contributor. It is not a product and not a business. Nothing here is for sale — there is no account to open, nothing to buy, no subscription, no waiting list, and no service is being offered or solicited. Sending a message through the note form creates no customer, client or contractual relationship of any kind. The note form on the contact page is the way to reach me, and it is the only one.

Nothing on this site is investment advice, financial advice, tax advice, or a recommendation, solicitation or offer to buy or sell any security or financial instrument. I am not a financial adviser, a broker, an investment manager or a regulated firm, and nothing here should be relied on as though I were. If you are making decisions about money, take advice from someone qualified and regulated to give it.

Figures do appear on this site, inside screenshots, and none of them is a performance claim. Every one is a demonstration instance's own arithmetic over price series the application generated itself — synthetic data, with no real market behind it — shown to illustrate what the tools display. They are hypothetical and simulated: no capital was at risk, no orders were placed, and a result computed over history with the benefit of hindsight carries limitations that live trading does not forgive. Hypothetical results are not indicative of future returns, and past performance — real or simulated — predicts nothing.

No brokerage, market-data vendor or other company is named anywhere on this site, and where a name appeared inside a screenshot it has been redacted out of the image. Nothing here states or implies that any company is associated with this project, endorses it, sponsors it, supplies it or has reviewed it. None is, and none has.

What this site collects. Nothing, unless you write to me. There is no analytics, no tracking, no advertising, and nothing at all is loaded from another domain. If you use the note form it takes the name, address and message you type, stores them privately where only I can read them, and keeps them for up to a year before they are deleted — sooner if you ask, and you do not have to give a reason. Your IP address is not kept. One thing is stored on your own device: the colour theme you pick, remembered by your browser so the site does not change appearance every time you arrive. It is written only when you choose a theme, and it identifies nothing and nobody. The preference itself never leaves your browser, but the screenshots follow it, so the pictures your browser fetches from this site are the ones drawn in that palette. The contact page answers all of this in more detail.

Terms of use. This site is provided as is and as available, with no warranty of any kind, express or implied. It describes software under active development: anything here may be incomplete, out of date or simply wrong, and it may change or disappear without notice. Nothing on it is a contract, a term of service for any product, or a promise that anything described will be built, released or kept running. To the fullest extent the law allows, I accept no liability for any loss or damage arising from use of this site or from reliance on anything it says. Nothing here excludes or limits any liability that cannot lawfully be excluded or limited.

Trading involves risk of loss.