A trading system is the sum of the assumptions it refuses to violate. Kyoto is built on three.
Implied volatility on Indian indices reliably trades at a premium to realised volatility. The platform is biased — by design — toward systematically selling that premium through defined-risk structures, not toward predicting direction.
A model that can place an order is not a trading system. A model that cannot place an order without passing eighteen SEBI-aware pre-trade checks — ELM, calendar-spread margin, illiquid-strike guards, cost hurdle, vega event warning — is.
Nine narrow servers, each fluent in one concern, expose tools through MCP. The language model orchestrates. Every server is independently deployed, individually testable, and owned by a single phase of the trade lifecycle.
Read the diagram top to bottom: data, then decision, then survival, then edge. Servers within a phase converse through Redis Streams; events between phases follow a small set of standardised contracts.
Live REST surface against Upstox v3 — get_spot_price (5s cache), get_option_chain (30s), get_historical_candles (1h, v3 historical), get_futures_data (5s). WebSocket market-feed shipping protobuf-decoded ticks into Redis pub/sub + a live_ticks hypertable. Instrument-master ingester resolves ~96k NSE keys.
Five tools live — calc_iv (Newton-Raphson + Brent, matched broker IV within 0.5%), get_greeks, get_skew, get_term_structure, get_vol_regime (now reads India VIX from iv_history), get_iv_rank / get_iv_percentile (12 yrs of EOD across four indices).
Seven tools live — get_oi_heatmap, get_pcr, get_max_pain, get_oi_buildup, get_oi_velocity, get_support_resistance, get_fii_dii_data. Snapshot writer captures the chain every three minutes; a 30s synthetic interpolator fills the gaps with confidence above 0.7.
Five tools live — calc_payoff, calc_stt_impact, get_all_greeks, get_margin, suggest_strategy. Cost-adjusted POP is PDF-weighted (chunk 2.6a) so near-spot probability mass dominates the ranking, not far-tail grid points.
The gate. Eight tools live — check_risk runs all eighteen pre-trade checks (12 chunk-3.1 + 6 SEBI) in strict mode, calc_position_size clamps to a 2% hard cap, emergency_stop / re_enable_trading / get_kill_switch_status / set_daily_limit manage the kill switch, get_sebi_compliance_report exports the audit trail. A 60s lifespan trips the kill switch on daily-loss / drawdown / margin / session-capital / consecutive-losses / API-failures breach.
Nine tools live — place_strategy dispatches to Demo / Paper / Live executors (atomic 4-table Postgres txn), arm_live reopens the live path after a kill-switch trip, square_off_all flattens on emergency, reconcile_now diffs our state against the broker on demand (60s lifespan also runs continuously), set_trading_mode + read_events drive the autonomous loop. Live placement is Risk-Manager-gated — no per-trade human confirmation. Real Upstox v3 broker integration; sandbox + prod auth verified.
Five tools live — log_trade upserts manual annotations, get_stats returns Sharpe / Sortino / max-drawdown over the daily P&L roll-up, analyze_patterns detects late-session drawdown anti-patterns, get_pnl_report aggregates daily / weekly / monthly P&L, get_trade_review surfaces last-N trades with outlier flags. XGROUP / XACK Streams consumer on events:strategy; eight-year retention; market context (VIX / PCR / regime / spot) captured at fill time.
Six tools live — get_events, scan_news, get_earnings_calendar, get_institutional_events, alert_vol_event (operator-pushed). FinBERT INT8 sidecar plus a nine-rule YAML keyword catalogue, hot-reloaded via Redis pub/sub. Recall benchmark 1.000 / 1.000 on a stratified 145-event gold set. Emits institutional-event contracts that the Risk Manager / Vol Engine / Strategy Builder consume to size down or block trades.
Six tools live — run_backtest, get_report, compare_strategies, evaluate_graduation, detect_drift (KS + Welch's t live-vs-backtest), run_parameter_sweep (cartesian-product param grid up to 256 cells with shared snapshot pre-load). Monte Carlo + walk-forward + per-VIX-regime split + automated graduation gate. Gate-4 evidence run: 810 trades over 39 months, MC ruin 0%, WF degradation -0.107, gate PASS (synthetic-spot caveats documented).
Every order — paper or live — flows through the same seven stages. The Risk Manager sits in the middle as a hard gate: a rejected proposal never reaches the broker.
Spot, depth, candles and option chain pulled from Upstox; cached at 5s / 30s.
IV surface fit, rank, term spread, full Greeks and pricing models.
PCR, max pain, OI clusters; interpolation across NSE 3-min snapshots.
A defined-risk structure is proposed — typed, scored, costed.
18 SEBI-aware checks. ELM, settled cash, OI limits, cost hurdle, kill-switch state.
Demo (instant), Paper (sim against live tape), or Live (human confirms, broker routes).
Every fill, slippage, fee and decision rationale persisted for eight years.
★ The gate is non-negotiable. A strategy that cannot pass Risk — for instance, an ITM short on expiry day where projected STT exceeds 30% of premium collected — is rejected at stage five and never reaches an executor. The same gate runs in paper and live; only the destination changes.
From signal capture to post-trade attribution, every position traverses the same controlled lifecycle. Pre-trade risk is a binding gate; post-trade output re-enters the next decision cycle.
Cross-instrument market and event surface.
Quantitative inference over the captured surface.
Translation of conviction into a defined-risk expression.
Mandatory validation against regulatory, exchange and internal limits.
Rejection is binding — there is no override path.
Order construction, venue routing and fill management.
Active management of every open position from fill to flat.
Settlement, attribution and feedback into the next cycle.
Every server speaks MCP. Every server returns the same response shape: a one-line summary, structured data, freshness/source context, and a list of related tools the model might call next.
The single source of truth for spot, depth, option chains and historical candles. Wraps Upstox v2 with circuit-breakers and short TTL caches; emits live tick streams the rest of the platform subscribes to.
Black-Scholes pricing, full Greeks, IV rank and percentile, the variance risk premium against rolling realized vol, EWMA forecast, quartic smile fitting. The desk's calculator.
Concentration heatmaps, put/call ratio, change-in-OI clustering, max-pain, NSDL FPI derivative-flow z-scores. Synthetically interpolates OI between the NSE three-minute snapshots when confidence permits.
Constructs verticals, iron condors, butterflies, broken-wing, jade lizard. Returns typed proposals with payoff models, breakevens, cost-adjusted POP after STT + slippage, plus a mid-trade adjustment advisor (close / roll / take-half / hold).
Eighteen pre-trade checks aware of SEBI rules — ELM on expiry, calendar-spread margin nullification, settled-cash verification, vega-event warnings, delta-based OI limits — plus portfolio Greeks aggregation, ±1σ/±2σ scenario stress, drawdown-derisk autopilot, and vol-targeted sizing.
Single MCP surface dispatching to DemoExecutor, PaperExecutor, or LiveExecutor. Live trades use marketable LIMIT pricing at the touch (BUY @ best_ask, SELL @ best_bid) for ~2 bps/leg slippage savings vs blind MARKET. Reconciliation every 60 seconds against Upstox.
Every proposal, gate decision, fill, slippage and fee persisted with eight-year retention. Weekly per-template attribution, behavioral pattern detectors (revenge / overtrading / FOMO / size-inflation), structured for the Backtester to replay decision context.
FinBERT INT8 sidecar plus a YAML-driven keyword → risk-multiplier map. Recall benchmark 1.000 on a stratified 145-event gold set. Emits regime-change and event-alert contracts the Risk Manager and Vol Engine subscribe to.
DuckDB-backed OLAP over historical chains and journal events. Monte Carlo, walk-forward, regime split, KS + Welch's t live-vs-backtest drift, vectorized parameter sweep. Strategies must clear backtest before paper, paper before live.
The Trade Executor is the only path to a fill. The same MCP tools — place_strategy, modify_order, cancel_all, square_off_all — operate identically across modes; only the executor behind them changes.
For development & integration tests.
Realistic simulation against live tape.
Real orders, real money, real consequences.
SEBI's August-2025 framework around algorithmic trading — static IPs, registered strategies, per-broker order-rate limits — is not a deployment detail. It shapes the architecture.
ELM (+2% on expiry day), calendar-spread margin nullification, settled-cash verification, delta-based OI position limits, illiquid-strike guards, cost hurdle, vega-event warning.
Every proposal, gate decision, fill, modification and rationale persisted to a TimescaleDB hypertable with referenced SEBI circulars in sebi_regulatory_params.
Live trades require explicit operator confirmation within a configurable window. Default 60 seconds — silence is rejection. Confirmations are journaled.
emergency_stop() squares off every position and blocks new orders. Manual and automatic (drawdown, consecutive losses, broker API faults). Re-enable is explicit.
An earlier draft of this design carried primary-and-fallback broker logic. Indian KYC, SEBI algo registration, static-IP allow-listing, and per-broker SPAN margin allocations make true cross-broker failover infeasible at retail scale. So Kyoto uses Upstox v2 alone — and on outage, the kill switch fires and the operator intervenes.
The platform graduates by phase. Each phase ships a coherent slice of the trade lifecycle and is gated by tests and a working integration with the next phase down.
Market Data + Volatility Engine shipping thirteen tools with Redis caching. All four Phase-1 carve-outs (1.3b WebSocket, 1.4b instrument-master, 1.7b IV history, 1.7c India-VIX regime swap-over) closed 29 Apr 2026. WS-stable-during-full-session box ticked 4 May 2026 — 90,004 ticks across four indices over 09:15–15:30 IST, zero errors. iv_history holds 12 years of EOD across four indices.
OI Analysis + Strategy Builder shipping fourteen tools across the two servers. Operator-validation 5/5 closed 4 May 2026 — suggest_strategy live ranks, OI heatmap matched against NSE, PCR + max pain validated within 1%, FII-DII automation, calc_payoff geometry verified. NSDL FPI derivatives flow ingester adds T+1 institutional sentiment with 5-day z-score.
Risk Manager + Trade Executor + Journal — the gate, the dispatcher, the memory. Twenty-two tools live across the three servers. Disaster drill ran 10/10 (kill switch → flatten → re-enable → resume → journal). Eighteen pre-trade checks (12 + 6 SEBI) on every order. Portfolio Greeks aggregation + ±1σ/±2σ scenarios + CVaR-95, drawdown-derisk autopilot (-5% halve / -10% block), vol-targeted sizing, marketable-LIMIT pricing at the touch all shipped 4 May 2026. T+1 contract-note charge true-up live (chunk L.5).
News Sentinel (FinBERT INT8 + 9-rule keyword catalogue, recall 1.000) + Backtester (Monte Carlo, walk-forward, regime split, KS+Welch's t live-vs-backtest drift, vectorized parameter sweep up to 256 cells). Sprints A–E layered on top: VRP / EWMA forecast / quartic smile / FPI flow / depth ingestion / 3 new strategy templates / mid-trade adjustment advisor / weekly attribution / behavioral detectors. Sixty-plus MCP tools, 1280 unit tests green.
Thirty trading-day paper soak gating live capital. Day 1 of 30 ticking on account=default. Daily ops automated via kyoto-cron supercronic container — preflight, data-audit, daily-health, EOD verify-graduation, weekly Tier-3 checks. Operator monitoring via make daily-summary + ntfy push on cron failures. Mid-soak drift detector arms once a template accumulates ≥30 trades.
L.1–L.5 code-complete (LiveConfirm proposal manager, append-only audit log with 8-yr retention, paper→live verifier, capital-tier scaling, T+1 charge true-up). One regulatory blocker remains before flipping live: SEBI Aug-2025 static-IP whitelisting + order-rate-limit tier wiring. First live trade ramps in at 10% capital allocation, scales tier-by-tier per the roadmap matrix.