The method
How a decision is made
Everything here is written to be argued with. A method that cannot be attacked cannot be trusted, so the evidence checks, the tolerances, the policy semantics and the decision set are all fixed in public before anything runs against real money.
The two questions, answered separately
A proposed action reaches the gateway before it reaches the broker or tool. Nobulex asks two questions that are deliberately kept apart, because collapsing them is what makes a control brittle.
Are the facts trustworthy? The decision-critical evidence is checked against independent references under a declared method. That produces an evidence status: PASS, FAIL or INDETERMINATE.
Is the action permitted? A deterministic policy is evaluated over the action and the evidence. That produces an execution decision: PERMIT, BLOCK or ESCALATE.
Evidence status is a statement about the world. Execution decision is a statement about your policy. A system that reports only one of them cannot tell you whether it stopped because the facts were bad or because your rule was strict, and those need different responses.
Why INDETERMINATE is a real state
Truth is not always binary. A halt, crossed feeds, an ambiguous symbol, a corporate action one source has applied and another has not: in each case an honest system does not know. Reporting that as FAIL creates false alarms and trains operators to bypass the control. Reporting it as PASS is the failure this product exists to prevent.
So it is neither. INDETERMINATE is returned, and policy decides what that means for this specific action. On a money-moving order it escalates or blocks. On a low-risk read it can permit and log. That choice is the buyer's and it is written in the policy, not assumed by us.
What the evidence checks are
| Check | What it establishes |
|---|---|
| Identity binding | The instrument returned is the instrument requested, resolved across symbology rather than trusting a ticker string |
| Freshness | Observation age measured against the market calendar and session state, not a fixed wall clock |
| Completeness | The observations the requested window should contain are present, so silent truncation is visible |
| Corporate-action basis | Splits and dividends, and whether the adjusted or unadjusted basis in use is the one assumed |
| Source agreement | Independently entitled references compared within a tolerance fixed before the run |
Tolerances are pinned in the policy before execution, so a result cannot be reinterpreted into a pass after the fact. Source agreement requires the buyer to hold entitlements to more than one reference. Where only one source is available, that is stated on the decision rather than silently downgraded.
The policy is deliberately small
The policy language is total and bounded by design: no loops, no network access, no unbounded computation, no side effects. Over an authenticated and complete context, evaluation is deterministic and terminating by construction.
That constraint is the point. The original claim behind this work was that verifying behaviour against a stated commitment is always decidable. That was too broad. It is decidable only if the language is bounded and the context is authenticated, and whether an external financial fact is knowable can still be INDETERMINATE. The narrower claim is the defensible one.
A model may help you author a policy. It is never the final arbiter of a hard limit on money.
What a receipt proves, and what it cannot
Every decision produces a receipt: the action hash, the policy version and its content hash, the evidence references with their observation times and payload hashes, the evidence status, the decision, and the execution result where one occurred. Each receipt carries the previous receipt's hash.
A signature establishes that a named signer attested to that exact object. It establishes integrity and provenance. It does not establish that the world was correctly represented by those sources. Cryptography cannot turn a false oracle into a true one, and any product claiming otherwise is selling the same well-formed lie it promises to catch.
A hash chain held entirely by one operator does not prevent that operator rewriting it wholesale. Detecting that requires periodically committing a checkpoint to storage the customer controls, or to an independent transparency service. Until that is wired up, a chain here is tamper-evident to anyone holding a later checkpoint and no stronger than that. Stated plainly rather than implied.
The signer itself is the same kind of gap. A key ID names which key signed, but there is no persistent issuing identity behind it yet: no PKI, no revocation, no durable public anchor. Until that exists, "a named signer attested" means a signature verifies against a public key, not that the key is bound to a specific person or company in a way a stranger could check.
Receipts hold references, not payloads
A receipt stores hashes, identifiers and decision metadata. It does not, by default, retain raw market or customer data. That keeps licensing, privacy and retention exposure low while preserving the ability to prove which evidence set a decision rested on. Nobulex runs against feeds the buyer already licenses and does not redistribute market data.
Observe before enforce
Observe Mode computes the complete decision and never blocks. It exists because asking an organisation to let a new gateway stop production orders on day one is not a reasonable request, and a safety product that causes an outage has failed at its own job.
The sequence is: mirror one path, replay a fixed corpus of well-formed-but-wrong conditions against it, measure catch rate and false-block rate and added latency, then enable enforcement on one bounded action type with explicit break-glass. Every break-glass override is itself signed. Per action type, the buyer decides whether gateway unavailability fails open or closed.
Coverage is measured, never assumed
Perfect receipts over partial traffic mean nothing. If an automated system can reach the broker without passing the gateway, the gateway is decoration. Coverage is reported as its own number, and the deployment pattern puts the downstream credentials behind the gateway so that bypassing it is a configuration change rather than a default.
Who pays
The buyer, always. Never the data vendor, and never the tool being checked. The moment revenue depends on a checked party's satisfaction, the decisions are worth nothing. This is the same rule the earlier register carried and it is the one part of that design that needed no revision.
What this refuses to claim
| It does say | It does not say |
|---|---|
| These sources, observed at this time, agreed within this tolerance | That the sources were correct about the world |
| This policy version evaluated this way over this context | That the policy was the right policy. You author that |
| This action was permitted, blocked or escalated, and why | That permitting it was profitable, or that blocking it avoided a loss |
| What passed through the gateway, including every override | Anything about traffic that bypassed it |
| Evidence a supervisor can inspect and reproduce | That using this satisfies any regulatory obligation. Supervisory rules continue to apply to the firm |
Nobulex is not a broker, an investment adviser, a fiduciary or a guarantor of any data source. It is an evidence and control layer. Where a remedy is warranted, that is a licensed counterparty's product, and a decision record is an input to it.
No score
There is no universal rating for an agent or a tool. A number between zero and a hundred invites the exact behaviour these checks exist to prevent, which is glancing at a figure instead of reading what was actually verified. Ten thousand correct read operations do not entitle a system to move ten million dollars, and reliability with equity quotes says nothing about wire transfers.
Where enough signed decisions accumulate, they can be reported as a profile scoped to one capability and one window, derived only from receipts. That is auditable. A score is not.
Where the method actually is
This page is the method in readable form. The checks in runnable form are at github.com/arian-gogani/nobulex-registry, MIT licensed: the harness, the probes, the cause taxonomy and the self-test. Read it, run it, and attack it. A decision produced by a suite nobody can inspect is not evidence, it is an opinion with a procedure attached.
You can settle one claim right now, from a terminal, without trusting anything on this page. The offline example feeds fictional data through the actual classifier and checks three expected outcomes:
git clone https://github.com/arian-gogani/nobulex-registry.git
cd nobulex-registry
python3 examples/wrong_window.pyIt exits nonzero if any of the three change. Python 3.11 or newer, no credentials, no network call after cloning.
Current status, without decoration. The evidence checks and the verdict discipline are built and open source. The inline gateway and Observe Mode are the current work. Nobody is blocking live orders through Nobulex today, and this page will say so until that changes.
Disputes and corrections: nobulex.dev@gmail.com. If something here overstates what the software does, send it and it gets fixed in public.
See a decision →