API design
REST for CRUD and domain actions today. WebSockets later for live order/execution updates.
| Capability | Standard | Reason |
|---|---|---|
| Versioned routes | `/api/v1/*` | Safe evolution |
| Stable envelopes | `{ ok, data }` / `{ ok, error }` | Consistent clients |
| Business actions | `POST /orders/:id/approve` | Workflow clarity |
| Idempotency | Unique keys for writes | No duplication |
| Deterministic lists | Sort + pagination rules | Reproducible UX |
| Capability | Examples |
|---|---|
| Portfolios | POST/GET /portfolios · GET /portfolios/:id · POST /portfolios/:id/rebalance/generate |
| Compliance | POST /compliance/checks/pre-trade · POST /compliance/overrides · GET /compliance/results/:id |
| Orders | POST/GET /orders · POST /orders/:id/approve · POST /orders/:id/cancel |
| Executions | POST /executions · GET /orders/:id/executions |
| Post-trade | POST /trades/confirm · POST /settlements/update · GET /trades/:id |
| Risk | POST /risk/jobs · GET /risk/results/:portfolioId |
| Copilot | POST /copilot/explain-risk · suggest-rebalance · summarize-portfolio |
We can publish a read-only demo dataset and strict rate limits for evaluation.
Cross-links across the public site for architecture, trust, specialty modules, and rollout.

Modular monolith approach with extraction-ready boundaries.

Bounded contexts for core and expansion capabilities.

Lifecycle states for portfolio, compliance, orders, and settlement.

Port-based adapters for external providers and systems.

Authorization, approval controls, and trust posture.

Top-level public documentation index.