Raxx · internal docs
internal · gated
Internal documentation for Raxx — runbooks, architecture decisions, agent specs, security reports, business + finance + legal. Auto-generated from docs/ on every push to main.
Architecture
"What Could've Been" (WCB) — Architecture Design ADR 0001 — WebAuthn / Passkeys as the Only Authentication Factor ADR 0002 — No Stored Credentials (Enforcement) ADR 0003 — GDPR by Default ADR 0004 — iOS App Stack: Native Swift/SwiftUI ADR 0004 — raxx-console Stack: Flask + Jinja2 + HTMX + Tailwind CDN ADR 0005 — iOS WebAuthn: Reuse raxx.app as the RP ID (scope: web + iOS only) ADR 0006 — iOS Offline Posture: Read-Only Cached State ADR 0007 — iOS subscription billing: Apple In-App Purchase ADR 0008 — Alpaca integration mode: OAuth 2.0 (user-delegated) for v1 ADR 0009 — OAuth access token at rest: documented invariant exception ADR 0010 — v1 per-user compute: shared Raptor process, per-request OAuth scope ADR 0011 — Premium "fully-hosted workflow" tier: Fargate + Firecracker microVM candidate ADR 0012 — Console WebAuthn: Separate RP ID (console.raxx.app) ADR 0013 — MBT: Raxx-native paper-trading engine, displacing per-user Alpaca OAuth for paper ADR 0014 — Alpaca scope: server-side market-data account + Pro+ live-broker handoff only ADR 0015 — MBT defaults are profile-driven, not fixed config knobs ADR 0016 — Founders Trial: Celery beat for daily sweep, not APScheduler ADR 0017 — E2E Encryption with Opt-In Shadow Analytics: Architecture Posture ADR 0017 — Founders Referral: 6-byte base64url slug for link identifiers ADR 0018 — Founders Referral: cookie-primary attribution with URL-param fallback ADR 0018 — Shadow-analytics data goals + consent-UX consequences ADR 0019 — Founders Grace: business-day calendar library choice ADR 0020 — Branch promotion model: tag + environment approval gate ADR 0021 — Trace Storage: Timescale vs Plain Postgres vs ClickHouse vs Others ADR 0022 — Event Log: Append-Only + Hash Chain for Tamper Evidence ADR 0023 — Render ID Granularity: Per-View vs Per-Component vs Per-Field ADR 0028 — Intentional friction on prod deploys: manual gate over full automation ADR 0029 — Console staging retirement: why console retires staging while API keeps it ADR 0031 — Platform Auth Posture: Defense-in-Depth Across Surface Classes ADR 0032 — Customer account recovery: A+B only (multi-passkey + backup codes; no email recovery; no agent re-enrollment) ADR 0033 — CI runner posture: transient-failure retry + Ubicloud migration trigger ADR 0042 — Auth Unification: Hybrid Identity Model ADR 0047 — Track B: CORS origin allowlist for raxx.app on raxx-api-prod ADR 0048 — Track B: Align deploy-antlers.yml tag trigger with release-please tag format ADR 0049 — Track B: v1.0 Alpaca credential shape — single operator set, paper only ADR 0050 — Fidelity API surface: target WIX (Wealthscape Integration Xchange), fallback FDX read-only ADR 0050 — Trunk-based SDLC affirmed; Gitflow rejected; hardening plan for drift and revert friction ADR 0051 — Drift prevention: layered structural controls ADR 0051 — Fidelity auth flow: 3-legged OAuth 2.0 with PKCE; no credential hand-off to Raxx ADR 0052 — Broker adapter interface: BrokerAdapter ABC with registry, not extending alpaca_integration.py ADR 0052 — New-surface hosting tier classification ADR 0053 — New-surface deploy workflow template structure ADR 0054 — Reasonator deployment target: Heroku Standard-2X ADR 0055 — Reasonator API contract: REST with sync + async endpoints ADR 0056 — Reasonator service auth: bearer token in vault ADR 0057 — Reasonator re-scoring: model SHA as first-class provenance field ADR 0058 — Unified Customer Audit: Single Table vs Federated Tables ADR 0059 — Shadow Tables: Postgres Triggers vs Application Dual-Write ADR 0060 — Unified Audit RBAC: Role-Gated Dimensions vs Feature-Flag-Gated Dimensions ADR 0061 — Ticket-State-Aware Notification: Two-Path Model for Dim-3 Operator Reads ADR 0062 — Deny-List + Per-Action Allowlist for State-Diff PII in Audit Rows ADR 0063 — Scale Tier Latency Budget + Numeric Upgrade Triggers for Shadow-Table Writes ADR 0064 — SOC-2 Retention SLA, Auditor Role, and Attestation Cadence ADR 0077 — Cloudflare WAF as Layer 1 of Raxx Layered Defense ADR 0081 — New-surface deploy/preview convention as Raxx standard ADR 0083 — Infisical Google OIDC SSO via Cloudflare Access ADR-0020: RBAC — Groups as the permission bridge; centralized identity authority ADR-0024 — Env Switcher: Session-resident selected_env vs DB column ADR-0025 — Env Switcher: RBAC gate on switching vs gate on mutation ADR-0026 — Feature Flag Persistence: DB table vs external store vs env-var-only ADR-0027 — Feature Flag Env Scoping: per-env rows vs single row with override ADR-0028 — Status Page Hosting: where does /api/status/public live? ADR-0029 — Status Surface Registry: where and how is the surface list stored? ADR-0030 — Status Page State Machine: canonical states, transitions, and actors ADR-0034 — Console-driven deploy flow with GitHub Actions status callbacks ADR-0035 — Staging-to-prod flag promotion: explicit promotion queue over ambient drift ADR-0036: Async Run-ID Resolution for Console Deploy Dispatch ADR-0037: Velvet — Service-Bus Subscription Model ADR-0038: Velvet — Three-Stage Operational Rotation Flow ADR-0039: Velvet — 401 Unauthorized as the Revocation Success Criterion ADR-0040: Velvet — Static Manifest for Consumer Registration (No Runtime API) ADR-0041 — Velvet consumer registration: runtime API + manifest bootstrap (supersedes ADR-0040) ADR-0043 — Auth Unification: RBAC Reconciliation ADR-0044 — Console Self-Deploy Web Layer: Option Selection + Topology ADR-0045 — Support Portal Topology: CF Pages + Raptor Proxy (Option A) ADR-0046 — Support Portal: FreeScout API Token in Infisical (not SSM) ADR-0054: Ticket-Scoped Role Grants — State in DB, Validated Per Request ADR-0055: RBAC Grant Mutations — Pre-Write Audit Pattern ADR-0056: Permission Resolution — Session-Embedded Cache (Option A) ADR-0057: Break-Glass Grant — Time-Limited, Justification-Required, Alert-First ADR-0065 — Queue v1: Strangler-Fig over Greenfield ADR-0066 — Queue v1: Co-location as Flask Blueprint Mounted in Raptor ADR-0067 — Queue: Signed JWT for Session Tokens (Offline Verification) ADR-0068 — Queue: Fail-Closed on Outage (No Credential Cache in Raptor) ADR-0069: psycopg2-binary as Raptor's Postgres driver ADR-0070: pytest-postgresql over testcontainers for Raptor test fixtures ADR-0071: Stripe Billing Tables — Queue as the Authoritative Store ADR-0072: SNS/SQS/SES Durable Email Delivery with DLQ at Both Layers ADR-0073: Stripe Billing v1 Implementation Home — Raptor Stopgap ADR-0074: Email Delivery v1 — Hybrid Architecture (Postmark + SNS/SQS/Lambda) ADR-0075: Billing Stays in Queue — Operator Override of ADR-0073 ADR-0076: Queue Phase 1 + Billing v1 — Aggressive 12-Day Plan (Python) ADR-0076: Queue Phase 1 + Billing v1 — C++ Implementation ADR-0078: Queue Cloudflare Edge Protection ADR-0079: WCB Snapshot-Only Storage with Compute-on-Render Trajectory ADR-0080 — Support Portal: API Contract, JWT Shape, and Privacy Boundary Algorithm ADR-0082 — Terraform deployment pipeline pattern (Option D: GH Actions + AWS OIDC) ADR-0084 — Burr v2: Multi-Region OIDC Gateway with R53 Latency Routing + Auth Down Failover ADR-0085 — Flag Reconciler: Bidirectional Sync with Drift-as-Kill-Switch ADR-0085: vcpkg Version Pinning Policy for Tier-1 C++ Services ADR-0086: vcpkg Lockfile Policy — Defer for v1 ADR-0087: CI Guard for vcpkg Manifest Changes Agent GitHub identity Alpaca integration — scoped to market data + optional live-broker handoff Auth Unification — Hybrid Identity Model Auth Unification — RBAC Reconciliation Billing Data Model Branch Promotion Strategy — Soak Gate for Raptor / Antlers / Docs CF WAF Layered Defense Strategy CI Migration Candidates — Architect Filtering CI Notification Posture Cloudflare Pages projects — domain mapping Console Deploy — Async Dispatch (H12 Fix) Console Env Isolation — Vault Path Layout Console Environment Switcher — Design Console Feature Flag Management — Design Console Flag Promotion Flow — Staging to Prod Console Self-Deploy Web Layer Console-Driven Deploy Flow Credential-Boundary Test Pattern Customer Detail View — Design Doc Durable Email Delivery — SNS/SQS/SES with DLQ at Both Layers Email Routing — Platform Address Map Fidelity Broker API Integration — Architecture Design Flag Reconciler — Bidirectional Sync (Drift-as-Kill-Switch) Founders Grace Window + Paid-Tier Transition Founders Referral Service — link generation, click attribution, conversion tracking Founders Trial Engine — data model, state machine, scheduler, and rules engine JWT Access-Token TTL + Refresh-Token + Revocation Research MBT — Investor Profile Model + Educational Overlay MBT — Raxx-native paper-trading engine Multi-user Authentication & GDPR Architecture Natural-Language to Strategy DSL: Parsing Research Brief New-Surface Deploy/Preview Convention Passkey E2E Encryption with Opt-In Shadow Analytics Principle: Staging Is a Runtime Duplicate, Not a Parallel Admin Plane Prod-Deploy Gating — Universal Pattern + Console First Implementation Proposal — Market Calendar Service Queue C++ Scaffold Review — vcpkg Discipline Post-Incident Queue CF Edge Protection — Design Queue Phase 1 — C++ Foundation + Billing Queue — API Contract v1 Queue — Identity, Session, RBAC, and Customer Service Queue — In-Flight PR Disposition Queue — Migration Plan Raptor Postgres Migration — Phased Rollout Plan Raptor Postgres Migration — Sub-Cards for PM to File Raptor SQLite → Postgres Migration — Design Doc Raxx iOS Companion App — Architecture Sketch v1 Raxx RBAC — Role-Based Access Control Design (v1, First Pass) raxx-console — Operator Admin Console Architecture raxx-console — Operator Dashboard (Milestones 7–13) RBAC Antlers Surface Audit — Flag Inventory, Gap Report, and Denied-State Remediation RBAC V2 — API Contract RBAC V2 — Design RBAC V2 — Migration Plan RBAC V2 — SAML Claims-to-Groups Wiring RBAC V2 — SAML Group-to-Group Wiring Design Reasonator API Contract Reasonator Cost Model Reasonator Sequence Diagrams Reasonator — Sentiment Scoring Service Design Repo Split Strategy + Buildkite Migration Plan Session engine — REST + JWT + server-side revocation + per-tier rate limits status.raxx.app — Data Model, State Machine, and FreeScout Webhook Contract Stripe Billing Gap Analysis — 2026-05-13 UTC Stripe Customer Billing — Data Model support.raxx.app — Customer Support Portal Design Ticketing System — Build vs. Buy Analysis Track B — Backend wiring for raxx.app customer-facing launch Unified Customer Audit + Shadow-Table Architecture — v2 Unified Customer Audit API Contract — v2 Unified Customer Audit — Migration Plan v2 Velvet Handler-Author Guide Velvet v2 — Rotation Flows Design Workflow UUID Tracing — Replay + Support Transparency Design
Auto-generated from docs/ in raxx-app/TradeMasterAPI.
Gated behind Cloudflare Access. Re-deployed on every push to main.