Anvil
Anvil
Deterministic, event-sourced runtime for systematic trading — pure reducer, hash-chained journal, replay-verified state, and a compile-time strategy boundary.
Anvil is a deterministic, event-sourced trading platform written in Rust. It
turns a stream of market events into reproducible state: every transition is a
pure function of the prior state and one event, every applied event folds into
a blake3 state hash, and on shutdown the entire run is replayed and verified
bit-for-bit. Determinism is something Anvil checks, not something it asks you
to trust.
Strategy code is sealed behind a compile-time boundary — it proposes order intents and never touches an exchange directly — and every intent crosses a multi-stage risk gateway before it can become a live order.
Why determinism
Systematic trading at scale needs more than fast execution. It needs a platform where every state transition is reproducible, every risk decision is auditable, and the boundary between infrastructure and proprietary logic is enforced — because the same code path that runs live is the one you replay to explain what happened. Anvil makes that path the only path: live, paper, backtest, and recovery all run the same reducer over the same journal.
The shape of the system
- A pure reducer. State transitions are
s' = f(s, e)— no hidden clocks, no ambient I/O, no nondeterministic iteration in the core. - A hash-chained journal. Every change is a typed event appended to an append-only journal; state is a fold over that journal, and the journal is the single source of truth.
- Replay-verified state. On shutdown Anvil replays the run from the journal and halts on any state-hash divergence.
- A compile-time strategy boundary. A three-layer workspace (platform → SDK →
strategies) enforced by the Rust compiler and
cargo deny. - A multi-stage risk gateway. Strategies emit intents; the gateway disposes. There is no path around it.
Where to go next
- Runtime architecture — the three layers, the event flow, and the determinism model.
- Strategy SDK — the
Strategytrait, the intent boundary, and how strategies are selected at compile time. - Runbook / ops — operating modes, recovery, and the read-only operator console.
- Reference — the event envelope, the journal contract, and the typed domain model.
Relationship to the Ferro engines
Anvil is the runtime under the Ferro engine family. Today it is built on FerroFeed, which normalizes market data and delivers it over a shared-memory ring buffer that Anvil's feed layer consumes. The wider family is composed as strategies and the platform need it: FerroReplay is on the roadmap as the shared deterministic clock and replay foundation (Anvil runs its own replay and journal today); FerroWave and FerroRisk are engines that custom strategies can build on; FerroMatch is the matching reference. Anvil supplies the deterministic runtime — the engines supply focused capability.