Five parts, and Postgres is the only thing they share. The browser signs; the API verifies and queues; the relayer reads the venues, computes both indices, settles and keeps the oracle fresh; the contracts hold the money and enforce the rules; the database is the record every part reads.
| Part | Does | Reads | Writes | Runs |
|---|---|---|---|---|
| Browser | One wallet signature for a session; the session key then signs orders and closes | The snapshot and its stream | Signed intents, to the API | On demand |
| Web API | Verifies each signature, nonce, deadline and size; rate-limits by address and IP; queues the intent | Postgres | Intents, sessions, the paper ledger | Per request, serverless |
| Relayer | Reads the venues, computes C-VIX and FR-BASIS, fills paper intents, pushes the oracle, settles batches, indexes events, liquidates | Deribit, Derive, Binance, Hyperliquid, Lighter; the chain | Postgres; keeper and settlement transactions | Every 15 s, settlement every 2 s; one process, under a lease |
| Contracts | Verify every order again, hold USDG, escrow the 8× payout, band the oracle, charge borrow and carry | Keeper pushes | Positions, balances, events | Robinhood Chain Testnet (46630) |
| Postgres | The record: ticks, candles, intents, positions, the ledger, the relayer's lease, errors | — | — | Managed, beside the relayer |
When something breaks
A position that has lost 90% of its margin to price, borrow and carry is liquidated: anyone may call liquidate() for 5% of the forfeited margin, and the relayer does so every round. There is no hedge, tranche or counter-order behind it; the pool is every position's counterparty, and the escrow it set aside at open is what pays.
- A stale feed — no keeper push for 120 s — freezes opens, closes and liquidations on that market, because a stale price is a free option. Free balances stay withdrawable. The owner can pause withdrawals if feeds desynchronise, for three days at most and not twice back to back.
- Pausing opens stops new positions and leaves closes, liquidations and withdrawals working.
- One relayer writes at a time: it holds a lease in Postgres, and another instance waits as a standby until the lease lapses. Its heartbeat, the feeds' freshness and its keys' gas balances are what /api/health reports and what the watchdog pages on.
- Each order settles in its own call inside a batch; the vault, oracle and skew engine are fixed at deployment and make no callbacks.