RIST.shRIST.sh
BlogProjectsDownloadsThoughtsAboutContact

Stay in the loop

Get notified about new posts and updates.

Connect

RistArchitect@gmail.com

RIST.sh

Systems that run: trading engines, security tooling, AI agents and self-hosted infrastructure, documented as case studies.

© 2026 RIST.sh. All rights reserved.

HomeProjectsRed Box Protocol
AArchitect11 min readMay 25, 2026

Red Box Protocol

Multi-vector autonomous trading platform — one risk engine governs CEX, DEX, and stock execution. Live on Binance with audit-grade trade decisions across a 10-rule risk manager and 3-tier analysis pipeline.

ActiveSolo architectStarted Mar 2026
Stack
Python 3.12FastAPIPostgreSQL 16 + TimescaleDBRedis 7HashiCorp VaultReact 18 + TypeScriptVite + TailwindCSS
Red Box Protocol

Most retail trading bots watch one chart on one venue and call it a strategy. They miss the move when gold spikes, a central bank pivots, or a domino chain begins in one market and cascades into three others. Red Box Protocol runs three markets at once — centralised crypto exchanges, decentralised exchanges, and stock CFDs — under one risk engine, one decision audit trail, and one operator.

The problem it solves

Building a real autonomous trading desk privately is a multi-year exercise. A serious quant team budgets $150K-300K per year on Bloomberg seats, exchange data feeds, and SaaS execution infrastructure, then hires three engineers to wire it together. Most operators never finish — they get a Binance bot working, they get a stock screener working, and the two systems never share a risk model, never see the same signal, and never compare PnL on the same axis. The trades that should have been routed to the venue with the best fees go to whichever bot saw them first.

The cost of getting it half-done is real: an unaccounted-for funding rate eats 4-6% per year on directional crypto positions; missing the cross-asset domino (gold → BTC → alts → small caps) costs the move every cycle; running three separate engines means three separate risk failures and no single kill switch when something goes wrong. The market punishes fragmented execution daily, and rebuilding the missing pieces from scratch — risk manager, position lifecycle, multi-tenant isolation, audit trails — is a 12-month job for a team that has not done it before.

Who needs this most

  • Quant founders and prop-desk leads operating across two or more asset classes — anyone running both crypto and CFD positions and tired of reconciling PnL across two engines on Sunday evenings. The moment this hurts: any month when a strategy looks profitable on crypto and loses on stocks because the two engines used different position-sizing rules and the operator could not tell which one was right.
  • Crypto fund managers reporting to LPs with multi-asset mandates — the quarterly review where the question is "show me the per-strategy attribution across venues" and the honest answer used to be a hand-stitched spreadsheet. They need one audit trail across CEX futures, DEX arbitrage, and stock shorts, not three.
  • Trading-software operators selling to other traders — anyone building a managed trading product who needs multi-vector execution, a multi-tenant user model with role-based access, deposit-to-balance plumbing, and a 10-rule risk gate already wired in. Buying the platform takes 90 days; rebuilding it takes 18 months.

The common thread: situations where the cost of a missed trade or a risk-rule failure is five to six figures, and the decision repeats weekly.

The solution — in plain terms

Red Box Protocol is an autonomous trading platform that does in one engine what most teams do in three. It watches markets across centralised exchanges (Binance, Bybit), decentralised exchanges on five chains, and stock CFDs through MT5-class brokers. When a signal appears — a chart anomaly, a sentiment shift, a cross-asset domino chain — every venue sees the same signal, scored on the same confidence scale, gated by the same risk rules, and either executed or rejected with a full audit trail attached.

Operationally, the platform is built around a six-stage pipeline. A shared market scanner runs once across all tracked tickers (single WebSocket fan-out, no per-user duplication). Anomalies are detected across momentum, trend, volatility, volume, and structure indicators. Anomalies are correlated into domino chains — patterns where movement in one asset historically triggers movement in others. Domino chains are promoted into signals tagged with a protocol (Quick for intraday, Swing for days-to-weeks, Thesis for months-to-year). Each signal passes through a 10-rule Risk Manager — portfolio heat, asset exposure, correlation guard, circuit breaker, leverage discipline, liquidity gate, funding rate gate, adverse selection, black swan, profit lock — and only an approved signal becomes a position. A Position Manager then runs smart exits in real time rather than waiting blindly for stop-loss/take-profit levels.

For the operator, this means one dashboard, one risk model, one audit trail, and three independent execution engines that never share state in ways that cause race conditions. For a software business reselling this capability, it means a multi-tenant platform with four user roles (God Architect, Administrator, Moderator, User), invitation-based onboarding, deposit-to-balance crypto plumbing, configurable product packaging, and a referral system already wired in.

Value delivered — what you get

  • One risk engine across CEX futures, DEX arbitrage, and stock CFDs — no more reconciling three position-sizing rules at month end; the same 10-rule gate fires on every signal regardless of venue, producing a single defensible PnL story.
  • Audit-grade decision trail for every signal — every approved, rejected, and force-executed trade is logged with confidence score, all 10 risk-check outcomes, the underlying anomaly/domino chain, and the operator who triggered it. The kind of trail an LP, a risk committee, or a regulator can read without hand-holding.
  • Replaces a ~$150K-300K/year stack of Bloomberg seats, multi-venue execution licences, and analytics SaaS — the platform self-hosts on a single VPS, ships everything as Docker containers, and has no per-strategy licensing.
  • Catches the cross-asset domino chains that single-venue bots cannot see — gold spikes detected as an anomaly are linked to historical BTC/alt cascades, and the corresponding stock-sector reactions are queued on the same pipeline.
  • Scan-once-distribute-to-all architecture saves roughly 500x in exchange API calls — 20 unique tickers × 3 timeframes = 60 calls per scan cycle, regardless of whether 1 user or 500 users are subscribed. The platform stays under exchange rate limits even at SaaS scale.
  • Multi-tenant from day one with four-tier RBAC and force-execute audit — God Architect, Administrator, Moderator, User roles; every database table carries user_id; the platform is positioned for SaaS resale, not just operator-only use.
  • Trading-product packaging already wired in — four product tiers (CEX/$99, DEX/$149, STK/$149, PRO/$299), one-time and monthly billing, internal balance ledger funded by USDT/ETH/BTC crypto deposits, deposit address generation per user, and 30-minute deposit sessions with blockchain monitoring.
  • Smart exits, not blind SL/TP waiting — the Position Manager re-evaluates open positions against regime changes, new anomalies, and momentum shifts; partial closes at TP1/TP2 with trailing stops follow protocol rules rather than fixed numbers.

Where it delivers outsized value

  • Multi-asset proprietary desks — quant teams running both crypto futures and stock CFDs who need a single risk surface and a single execution stack, especially when the same fundamental narrative drives positions in both markets. Narrative-driven shorts (the "Bobby Axelrod" thesis mode for failing-narrative scandals) are first-class, not bolted on.
  • Trading-software SaaS operators — anyone building a productised trading service for retail or pro traders who needs the full back-office (users, roles, deposits, packages, referrals, support tickets, withdrawals, leaderboards) already standing rather than built from scratch.
  • Crypto fund managers operating across CEX and DEX simultaneously — desks that historically split execution between centralised venues and DEX arbitrage have one audit trail and one Risk Manager covering both, with funding rates and gas costs treated as first-class PnL inputs.

The common pattern across these contexts: the cost of fragmented execution is paid every week, and the platform pays for itself once a single five-figure missed trade or risk-rule failure is avoided.

Distinctive features — why this over the alternatives

  • Independent per-vector pipelines under a shared risk engine — CEX, DEX, and stocks each run their own scanner, anomaly detector, and execution engine, but every signal passes through the same 10-rule risk gate before it becomes a position. The architecture supports the vectors that exist today and the ones added next year without rewriting the core.
  • Three-tier confidence engine with explicit caps — Tier 1 (technicals) capped at 30 points alone; Tier 2 (macro-sentiment from the Rabbit Hole Tornado feed) adds up to 40 more; Tier 3 (LLM narrative reasoning) adds the final 30. The cap structure forces sentiment and LLM to actually agree with the chart before a high-conviction trade fires. No black-box scores, no single-source overrides.
  • The ADSD pipeline — Anomalies → Dominos → Signals — anomalies are raw chart events tagged by category (momentum, trend, volatility, volume, structure); dominos are cross-asset correlations confirmed against history; signals are confluence of 2+ categories on the same ticker. The structure makes false positives observable and tunable at every stage.
  • Force Execute with a separate audit channel — operators can override a Risk Manager rejection, but the override is logged separately, scored against outcome, and surfaced on the admin trade-decisions board. Discretion is preserved without losing accountability.
  • Smart position exits, not fixed SL/TP — the Position Manager re-evaluates open positions against regime changes, fresh anomalies, and momentum shifts, then decides partial-close / trail / full-exit by protocol rules. Strategies that would have stopped out on noise survive the volatility windows that would otherwise close them prematurely.
  • Full SaaS back-office included — invitation-based onboarding, four-tier RBAC, per-user API keys encrypted via Vault, deposit address generation (BTC via BlockCypher, ETH via eth-account, USDT via tronpy), 30-minute deposit sessions monitored against three blockchain APIs, four product tiers, monthly subscription expiry, multi-link referral attribution with KOL tracking, leaderboards, phantom-user growth seeding, support ticketing, withdrawals queue.

Under the hood — built to last

The backend is FastAPI on Python 3.12 with async throughout — a single uvicorn worker handles the API, the scheduler, the price gateway, and the background monitors as cooperating asyncio tasks. State lives in PostgreSQL 16 with the TimescaleDB extension for OHLCV hypertables, Redis 7 for ephemeral live state, and HashiCorp Vault for every secret the platform touches (API keys, seed phrases, wallet privates). The frontend is React 18 + TypeScript on Vite with TailwindCSS, Zustand for state, and Lightweight Charts (the library used by actual exchanges) for the trading terminal. Everything ships in Docker — five containers stand up the entire stack on a single VPS, behind Nginx with Let's Encrypt automation. Self-hostable end-to-end, no SaaS dependency on any critical path, built to keep running for years rather than to chase the framework of the season.

Current maturity

Red Box Protocol is in active development with Phase 1 roughly 90% complete. The CEX execution engine is live on Binance with real money — verified flows include spot BUY/SELL on ADA/BTC/NEAR, futures LONG ATOM 5x with exchange-side stop-loss execution, and futures LONG DOT 5x with three take-profits plus stop-loss placed and manually closed. The full ADSD pipeline (Anomalies → Dominos → Signals → Risk Manager → Execution → Position Manager) is operational. The shared-scan refactor lifted the platform's capacity to roughly 500-1,000 active users on a single 8 vCPU / 16 GB VPS, with documented scaling paths to 5,000+ via read replicas and distributed scanner workers. The codebase is approximately 50,000 lines of code across 28K Python and 22K TypeScript, spanning 60+ frontend pages, 35+ API namespaces, and 63 backend test files. Project work spans roughly 2026-03-20 through 2026-05-22. The remaining Phase 1 work is auto-execute live verification, Bybit live testing, and VPS deployment; the deployment script, Nginx config, and SSL automation are already complete.

Roadmap — what's next

The next milestone is production deployment as a multi-tenant SaaS product. The path runs through three concrete steps: Bybit live verification (the second crypto venue, mirroring the validated Binance flow), VPS deployment under a public domain with Let's Encrypt and the existing referral/landing/waitlist flow, and the Phase 2 build-out of the DEX vector — the Rust execution core, MEV protection, flash-loan integration, and atomic arbitrage across Ethereum, BSC, Solana, Polygon, and Arbitrum. Phase 3 adds the Stock vector through MT5 / AMarkets with the same risk-manager gating, with particular focus on narrative-driven shorts that exploit failing-narrative scandals across pharma, tech, and consumer-sector tickers.

The longer arc connects the platform's three vectors and the macro-sentiment feed into a productised offering — a managed trading platform where retail and pro traders subscribe to a vector or a tier, the operator's strategy is enforced by the global Risk Manager, and individual users override only the parameters within their authority via copy-on-write. That positions Red Box Protocol as both a trading desk and a SaaS execution platform, with monetisation already wired in (USDT/ETH/BTC deposit ledger, four product tiers, monthly and lifetime billing, multi-level referral commission).

Working with the architect

Red Box Protocol is available in three engagement modes. A trading desk or fund can commission a custom build modelled on this architecture, tuned to their specific venue mix, strategy library, and compliance posture. An existing trading team can extend their own platform with the ADSD pipeline, the 10-rule Risk Manager, the multi-tenant back-office, or the shared-scan capacity model — integrated directly into their codebase rather than imported as a SaaS dependency. And teams already operating their own multi-venue infrastructure can engage in strategic advisory on risk-manager design, multi-vector execution methodology, and SaaS-grade trading-platform architecture. Reach out via sintegrium.io or LinkedIn for a 30-minute scoping call.


Built by Yurii Staryk · Solution Ecosystem Architect

Screenshots

Red Box Protocol

1 / 12
React
Share
Join
Discuss
Discuss on XDiscuss on Telegram

Related Posts

Audio & Video-to-Text Converter
7 min read

Audio & Video-to-Text Converter

Self-hosted YouTube-to-text pipeline — faster-whisper runs on a home GPU inside Docker, callable from any laptop on the LAN. Own your transcripts, no API fees, no rate limits, 99+ languages.

AArchitect· May 26, 2026
Read more →
LANpaster: Secure Local Network Sharing
8 min read

LANpaster: Secure Local Network Sharing

Self-hosted LAN clipboard for engineers running multiple machines on one network — paste text or files on one device, grab on another, with auto-expiring slots for API keys and zero internet dependency.

Docker
Scale
~50k LOC · 60+ frontend pages
Pipeline
6-stage ADSD · 10-rule risk gate
Coverage
5 chains · 4 venues · 3 protocols
Maturity
Phase 1 · live on Binance
Last activity
2026-05-22
Deployment
Docker · 5 containers · single VPS
Tags#autonomous-trading#crypto#saas-platform#fintech#risk-management#multi-vector#cex-dex

Table of Contents

  • The problem it solves
  • Who needs this most
  • The solution — in plain terms
  • Value delivered — what you get
  • Where it delivers outsized value
  • Distinctive features — why this over the alternatives
  • Under the hood — built to last
  • Current maturity
  • Roadmap — what's next
  • Working with the architect
AArchitect· May 26, 2026
Read more →
Cognition Factory For AI Agents
9 min read

Cognition Factory For AI Agents

A desktop wizard that authors complete cognition bundles — identity, skills, credentials, runtime memory — for multi-agent AI teams, sealed with AES-256 and ready to deploy to any runtime.

AArchitect· May 26, 2026
Read more →