A self-hosted FRTB calculator where every number is a node in a Merkle DAG anchored to its inputs and to the function identity that produced it. Drift any of those — input bytes, schema contract, engine version, regime parameters — and the verifier identifies the exact node where the chain breaks.
Institutional infrastructure, not a self-serve product. Access granted after a brief conversation. Marketing pages, doctrine, roadmap, and verifier explainer are public.
Most FRTB programmes don't fail on the math. They fail because no two systems agree on which input row produced which capital number — and audit can't prove either. This calculator is built on the inverse premise: admissibility before calculation.
A capital figure is a node in a Merkle DAG anchored to its input leaves and to the function identity that produced it. Drift any of those — input bytes, schema contract, engine version, regime parameters — and the root hash changes. The verifier identifies the exact node where the chain breaks.
One make up brings up Postgres, the FastAPI backend, an nginx-fronted React UI, and the marketing site on a single host. Trades, sensitivities, and capital numbers never leave your infrastructure. Cloud deploy via Railway templates if you prefer.
FRTB SA — sensitivity scaling, within/across-bucket aggregation, DRC, RRAO — pinned to hand-computed expected values. IMA pipeline shipped: ES, multi-LH aggregation, IMCC, RFET, NMRF, SES. A stateless verifier replays every figure offline from the saved lineage.
Roll the doctrine out without breaking your existing upload paths. warn observes refusals as data. gate requires a paired-actor override token, scoped and single-use. block fails closed. Every refusal is a first-class, queryable persisted entity.
A row enters the system only after the caller has been shown its canonical form and echoed the hash back. A figure is produced only from inputs whose hashes are recorded under a registered function reference. An export ships only when the chain verifies. A refusal is itself a first-class persisted entity.
Validates the row against a registered schema contract — numeric fields must declare a unit. Returns the canonicalised payload, payload_sha256, per-row leaf hashes, and a pending_upload_id.
Only succeeds if the caller echoes payload_sha256 verbatim. Mismatches and double-commits return 409 plus a structured InadmissibilityEvent. On success, rows become provenance_node[input_leaf].
Builds input_leaves → function_node → output_root. The function node binds engine version + regime + parameter-set hash, so any drift breaks the chain on the next replay.
Excel exports carry a Provenance sheet with the root hash, the function reference, and per-row leaf hashes. In block mode the renderer refuses if any row lacks provenance.
Returns the full DAG as JSON. A regulator or auditor can run the verifier offline against the saved lineage and reconstruct every hash from leaves to root, no backend access required.
Lists every refusal — filterable by reason_code, mode, portfolio_id. The audit answer to "show me every refused computational state in the last quarter."
Set ADMISSIBILITY_MODE on the backend container. The intended adoption path is warn → gate → block. Migration from warn to gate makes every override a paired audit event; migration to block removes the override entirely.
A provenance gap on calc or export proceeds, but persists an InadmissibilityEvent so the gap is observable. Useful for rolling out the doctrine without breaking the legacy upload path.
Refuses with 423 Locked unless a single-use override token is presented. Tokens are scoped to (operation, portfolio_id, reason_code), expire in 5 minutes, and require different actors on issuance vs consumption.
Refuses with 409 Conflict. A bearer with a token in block mode still gets 409. Every figure that ships is anchored to a verified root. The doctrine, fully enforced.
The verifier (backend/app/admissibility/verifier.py) is a stateless function. Hand it a saved lineage payload and it recomputes every claimed hash from its claimed payload. Each failure mode below is provable in a unit test against a deliberately tampered fixture.
HASH_MISMATCH
Byte mutation in any leaf or interior payload — flagged at the tampered node, not at the root.
EDGE_LEAF_MISMATCH
A function_node whose payload claims a different set of leaves than its edges actually carry.
EDGE_FUNCTION_MISMATCH
An output_root pointing at a function_node not present in its edges. No silent re-parenting.
FUNCTION_REFERENCE_DRIFT
The function_node's claimed engine + regime + parameter-set hash differs from what the caller expects — silent parameter changes are caught.
ROOT_NOT_IN_NODE_SET
The lineage payload's claimed root has no matching node — orphan root, refused.
These five failure modes plus their happy-path counterparts are 9 of the 76 tests that run on every push. Read the verifier explainer → · Field note: FRTB programmes don't burn capital on math →
The product UI sits behind authentication in production. Each module corresponds to a tab in the frontend. Click any thumbnail to view full-size.
Live status, generated from the same source of truth that drives ROADMAP.md. Updated whenever a feature ships.
Self-hosted by default — no outbound traffic to a vendor cloud. Lifespan applies the admissibility schema migration idempotently on every start. A standalone migration runner is available for operators who prefer migrations as a distinct deploy step.
Docker Compose brings up Postgres, the FastAPI backend, an nginx-fronted React UI, and the marketing site on a single host. Trades, sensitivities, and capital numbers never leave your network.
/docspython -m scripts.migrateExcel exports include an Assumptions sheet with every scaling factor, correlation, and regime parameter applied — plus a Provenance sheet with the root hash, the function reference, and the per-row leaf hashes. So risk and audit teams reproduce any number without reading source.
The tool is institutional infrastructure, not a self-serve product. I'll get back within two business days. No marketing list, no automated nurture sequence — this routes directly to my inbox.