Multi-model research, evidence, and accountable decisions.

Defense in depth: twelve layers, each closing a specific threat

PolyMind is a financial system that acts with real money, so it is engineered the way security people expect: no single control is trusted to be perfect, and the layers are arranged so a bypass of one still lands on the next. Every layer below was validated by an independent AI red-team pass. Mechanisms are described in general terms; no secrets, endpoints, or bypass details are exposed.

An independent red-team pass (network exposure, dependency CVEs, prompt injection, cross-site scripting, log hygiene, path traversal) drove most of these controls, and the audit trail of what was tested, fixed, and verified is itself part of the repository. The discipline is periodic, not one-off: the September 2026 whole-tree review ran five independent read-only reviewers over the entire tree and its history, triaged thirty-one findings and nine synthesized attack chains, confirmed that all but one were already-hardened controls, findings inside untracked vendored tooling, or operator-side actions no code change can perform, and fixed the one real code-level gap with a regression test in the same change. A fix registry ties each historical incident to the exact test that now keeps it closed, and labels the few that are enforced by written procedure rather than by code, because a materially weaker guarantee deserves its own name.

Reviewable skills and integration boundaries

This section illustrates component responsibilities and evidence boundaries. Private inventories, thresholds, and activation settings are intentionally omitted.

The closed loop, traced end to end

Here is the honest version, because a technical audience respects precision. PolyMind does not fine-tune the underlying models. It runs a genuine closed feedback loop where real market outcomes rewire which models it trusts and what context it feeds them. Ground truth comes from an external market API, never from a model grading itself, and that is the hard part done right. Since July 2026 the loop has grown a second layer, a self-learning substrate that measures each model's settled record, refuses to publish a rate without its null, and mints skills only from evidence; the September 2026 review of that layer is summarized below, with what it measured, what the system refuses to claim, and what changed when a check found a flaw.

What the substrate measures, what it refuses to claim, and what changed when a check found a flaw

This example distinguishes evaluation from activation. No private stage census, enabled-state inventory, or operating schedule is published.

Learning claims require observed execution, traceable outcomes, and a documented evaluation method. A design diagram alone does not establish those results.

PolyMind on Azure, specified the way an architect would actually ship it

This section illustrates component responsibilities and evidence boundaries. Private inventories, thresholds, and activation settings are intentionally omitted.

This is an architectural example. Current operating status, runtime measurements, and private configuration are not verified or published here.

Every row was checked against the current codebase and carries its source in the page data. Where a claim could not be confirmed it is written as a mechanism, not a number.

Which AI model runs inside each part, and why that one

The roster is not one model called many times. It is a deliberate mix routed by task: expensive reasoning only where it pays, a cheap seat for adjudication, an independent family for verification, open-weight seats for diversity, and one on-device advisor that is excluded from consensus by rule. Every seat is a declared entry in the pipeline registry; a seat that reaches a row without its provider wire is a loud failure, not a silent bill against a shared key.

How big each thing actually is, re-checked against what exists

This is an architectural example. Current operating status, runtime measurements, and private configuration are not verified or published here.

What runs on a schedule, in what order, and what each stage writes

This section illustrates component responsibilities and evidence boundaries. Private inventories, thresholds, and activation settings are intentionally omitted.

One hub VNet, five subnets, zero public data plane

Every data service is reached only through a Private Endpoint inside the VNet, resolved by Private DNS. The single public entry is Front Door Premium with WAF, which forwards to Application Gateway (WAF_v2) and then API Management. Nothing in the data tier has a public IP. The workers and jobs share the apps subnet and reach models and data only through managed identity.

Every guardrail, and which layer enforces it

"Guardrails" is not one setting. It is policies across four layers: the model boundary (Content Safety), the platform (Azure Policy, RBAC, network), the application (the evidence gate, the paper-only boundary, the atomic settlement claim, the auth guard, the epoch-marker rule), and the human gate. No single layer is trusted alone.

Microsoft Sentinel detections designed from the failure classes this system has actually closed

The July design detected prompt injection end to end. It still does. The detections below are designed around failure classes the platform has met and closed with a control: each names the class, the control that closes it, the analytics rule that pages first, and the playbook. The KQL is a sketch of the detection logic, written against the tables Container Apps and Postgres already emit into Log Analytics.

What kind, what tier, and how many

Exactly what the search service does

AI Search is the research memory and grounding engine. It is not a keyword box; it is a hybrid vector store with a reranker, so "have we researched something like this, and what was true" returns cited, ranked, relevance-scored evidence the models can ground on.

What gets embedded, with what, and where it lands

One embedding model, two homes. Everything memorable becomes a vector representation from text-embedding-3-large, written to pgvector for the operational brain and mirrored into AI Search for grounded research. Retrieval is always hybrid, then reranked, then filtered for freshness. Retrieved context enters a prompt as untrusted data, never as an instruction.

What Grafana and the monitors actually show

The operator keeps the same operations dashboard, now rendered by Azure Managed Grafana from Managed Prometheus and Azure Monitor. Every model call is a traced span in Application Insights, and everything lands in one Log Analytics workspace that Sentinel also watches. The lesson since July: a healthcheck that passes on process existence cannot see a hung loop, so every worker's health is the age of the artifact it is supposed to be producing.

The full toolchain, not just Visual Studio

Visual Studio is where code is written; it is a small part of the stack. Here is the real toolchain an engineer would use to build, provision, test, and operate this estate, including the multi-agent discipline the repository already runs on.

Smarter tools to add when it scales

The build above is complete on its own. These are the upgrades a platform team would reach for as usage grows, each earning its place rather than added by default.

The budget, engineered like risk

This is an architectural example. Current operating status, runtime measurements, and private configuration are not verified or published here.

Technical data flows, drawn stage by stage, with the words the system uses when it does not know

Explore example research stages, the artifacts they produce, and the evidence required before a result can guide a decision. Diagram states are illustrative vocabulary, not current runtime measurements. Open each stage for its responsibility and review boundary.

Pipeline examples show responsibilities and possible states, not live schedules or private stage counts.

This example distinguishes evaluation from activation. No private stage census, enabled-state inventory, or operating schedule is published.

Legend: teal, a measurement with a denominator; dashed teal, measured but thin or deadlocked; gray, not measured, not run, not scheduled, or not available; black, a hard verdict (unearned, synthetic, dead signal, abstain, reset).

A prediction becomes a paper trade, is graded against the real result, and only real evidence feeds what changes

This section illustrates component responsibilities and evidence boundaries. Private inventories, thresholds, and activation settings are intentionally omitted.

One market, from venue scan to graded outcome

The trading spine, drawn as a swimlane flow. The evidence gate sits in the middle on purpose: it is the one door every learning path must pass, and it is closed to synthetic placeholders through three independent channels. Settlement is atomic, a void is neither a win nor a loss, and the outcome ledger stamps a single field that every downstream statistic depends on.

Calibration by research domain and evaluation period

Evaluate calibration separately for each model and research domain. Missing calibration should remain explicit. A controlled evaluation process can gather evidence before any method is promoted; absence of evidence must not become a confident default.

Measure, validate, mint; recognize bad skills without touching original thinking; count every stage

The substrate is a set of writers and readers that are only allowed to claim what they can prove. The builder mints a skill only when a rate clears its price-implied null on the same population. The bad-skill recognizer partitions a seat's core styles out before any adjudication. A census names every scheduled stage and says out loud when one did not run, and a registry makes a half-wired seat fail loudly rather than silently bill the wrong key.

Recovery and method transfer without transferring an earned record

A recovery policy can open a new evaluation period while retaining history. A method may be transferred for testing, but its donor's performance and calibration do not transfer. Private thresholds and activation settings are omitted.

Evidence to next action, by printed rules, with no model in the loop

Explicit decision rules connect evidence quality to review actions. The example below describes decision categories; it does not reproduce private policy settings or authorize execution.

# Conceptual review categories, not an executable policy
NOT_MEASURED  Required evidence is unavailable or invalid.
REVIEW_RECOVERY  A recovery policy calls for review while preserving history.
ABSTAIN       Data quality, calibration, or authorization is insufficient.
REVIEW_EXPOSURE  Evidence warrants reassessing simulated exposure.
EVALUATE      Continue an authorized evaluation under its declared controls.

Scheduling, dependencies, and explicit activation gates

A scheduler coordinates dependent research stages and reports skipped or unavailable work. Deployment-specific intervals, enabled states, and runtime measurements are not published in this conceptual view.

This example distinguishes evaluation from activation. No private stage census, enabled-state inventory, or operating schedule is published.

Crypto, forex, and options: loss and drawdown review concepts, in contrast

Different research domains need distinct evidence and review policies. Availability and authorization remain explicit.

Paper research, security review, service boundaries, and release verification

Scheduling, health monitoring, and release verification are distinct responsibilities. Their private operational settings are not included in this conceptual view.