架构

四个阶段，一只手。每一个箭头都是一个决定；每一个决定都被记录。

以度量为凭，而非空口承诺

来自您此刻赖以阅读本页的系统的四个数字。

我们承揽什么

三件事。此外别无承诺，而这三件绝不外分。

接口

我们置于您引擎之侧的全部东西 — 它的每一行，没有依赖、 没有暗中的调用。在让它靠近您的钱之前，先读它。我们这一侧的机房依旧关闭； 在您屋子里运行的东西，皆归您审计。

# put one engine under guard
POST https://api.matchtopalgorithm.ai/v1/guard/engines
Authorization: MT-••••-••••-••••      — one key, one operation
Content-Type: application/json

{
  "engine":    "eurusd-hf-01",
  "watch":     ["uptime", "latency", "drawdown", "intrusion"],
  "on_breach": { "halt": true, "seal": true, "notify": ["telegram", "email"] },
  "window":    "24/5",
  "clock":     "Asia/Singapore"      — reports arrive in your hour
}

202 Accepted
{
  "guard_id":   "g_7f3a91c4",
  "watchtower": "live",
  "since":      "2026-10-24T06:12:09Z"
}

"""MatchTop · engine guard — the piece that sits beside your engine.
Standard library only. Nothing we did not write runs with these rights."""

import hmac, json, os, time
from hashlib import sha256
from urllib.request import Request, urlopen

KEY   = bytes.fromhex(os.environ["MT_KEY"])   # one key per engine, never on disk
EDGE  = os.environ["MT_EDGE"]                  # no address baked into the build
GRACE = 3                                     # one lost beat is the network. three is a decision.


def seal(payload: bytes, beat: int) -> str:
    """Every beat is signed and numbered. A replayed beat is not a beat."""
    return hmac.new(KEY, b"%d." % beat + payload, sha256).hexdigest()


def read_verdict(answer: dict, beat: int) -> str:
    """An answer counts only if it comes back signed, for this beat and no other."""
    ours = hmac.new(KEY, b"%d.%s" % (beat, answer["verdict"].encode()), sha256).hexdigest()
    if not hmac.compare_digest(ours, answer.get("seal", "")):   # constant time, always
        return "halt"                                          # unsigned is not trusted
    return answer["verdict"]


def pulse(engine, beat: int) -> str:
    payload = json.dumps({
        "engine":   engine.name,
        "at":       time.time_ns(),           # UTC nanoseconds. local clocks lie.
        "alive":    engine.alive,
        "latency":  engine.latency_ms,
        "drawdown": engine.drawdown,
    }, separators=(",", ":")).encode()

    call = Request(EDGE, payload, {
        "Content-Type": "application/json",
        "X-MT-Beat":    str(beat),
        "X-MT-Seal":    seal(payload, beat),
    })
    with urlopen(call, timeout=4) as answer:      # we dial out. nothing dials in.
        return read_verdict(json.load(answer), beat)


def guard(engine) -> None:
    beat, missed = time.time_ns(), 0
    while True:
        beat += 1
        try:
            verdict, missed = pulse(engine, beat), 0
        except Exception:
            missed += 1
            verdict = "halt" if missed >= GRACE else "run"   # silence is not consent

        if verdict == "halt":
            engine.halt()                     # stop the money first
            engine.seal()                     # then close the path
            return                            # and stay down until a human says otherwise

        time.sleep(engine.beat_seconds)

无法被复制的东西

不是我们挑选的功能。而是这座房子的形态。

这些都不是一份功能清单，而这正是它无法被压价夺走的原因。 一家有销售部的公司无法把它的工程师交给您。一家每年都得把账单做大的公司 无法拿掉任何东西。一家只负责看守的公司无法修复。 它们并非落在我们身后 — 它们生来结构不同，若要跨越过来， 便不再是它们自己。

这也是本页为何没有价目表的原因。我们先度量运作本身， 再按度量所得报价。