Methodology, architecture, and the case for measuring calibration instead of selling prediction.

Goldeneye is a research and decision-support terminal. It synthesizes market data into explainable forecasts, runs counterfactual scenarios, simulates paper trades, and keeps a scored record of every analytical decision its users log. It was built commodity-first — natural gas is the showcase desk, with crude, products, and metals alongside — because commodity markets supply the richest public fundamental data (EIA storage, CFTC positioning, weather) against which honest validation is possible.

Three boundaries are architectural, not legal fine print. Goldeneye never connects to a broker or real-money venue — the paper-trading engine is a self-contained simulator and no such integration exists in the codebase. It never gives personalized financial advice — every AI output passes through a safety layer that rejects advice-shaped language before it can reach a screen (§08). And it never claims certainty — every forecast ships inside an uncertainty envelope with a confidence band, caveats, and its data provenance.

An analyst who calls a rally at 85% conviction and gets stopped out learns almost nothing from the loss alone: good decisions lose all the time, and bad ones get paid. The professionally useful signal is not the outcome but the calibration gap — across all of your 85% calls, how many actually resolved your way? That number is knowable, actionable, and almost never measured, because measuring it requires infrastructure: decisions logged before resolution with stated conviction, resolved mechanically against real prices with no retroactive editing, and bucketed into a reliability curve with honest sample-size guardrails.

Goldeneye is that infrastructure. The same discipline is applied symmetrically: the platform’s own models are scored by the same machinery as its users’ judgments, and the results are published either way. A tool that grades your judgment is only credible if it grades its own first.

Research honesty fails quietly: a synthetic-data property becomes a product claim, a failed probe never gets written up, a doc drifts from the code it describes. Goldeneye’s answer is to make each commitment mechanical — something a test can fail.

Directional signals come from an ensemble of four deliberately simple, fully inspectable models: a moving-average directional read, a Holt trend model (pure-numpy exponential trend), a factor composite (a transparent rules-based blend of storage surprise, positioning, and momentum with hand-set weights), and a walk-forward logistic regression — the one genuinely trained voter, refit on each call from only past closes so it is look-ahead-safe by construction. Each voter reports direction plus its supporting and contradicting factors; the ensemble vote derives a coarse confidence band from agreement, down-modulated by predicted range width, and each model’s weight is scaled by its own persisted calibration record — chronically overconfident models are automatically down-weighted. A volatility-regime classifier stamps context (calm / normal / elevated / crisis) on every row but does not vote. Per-asset-class configuration parameterizes thresholds and bands so the same engine runs natural gas, crude, metals, an equity index, and rates without commodity constants leaking across classes.

The honest frame, and the part that distinguishes this engine from most forecast products: every directional model in the lineup has been tested walk-forward on roughly a decade of real prices, and none earned an edge. Price-only models scored below a drift-aware naive baseline across all tested horizon-commodity cells; feeding fourteen years of real CFTC positioning and EIA storage into the factor model made it measurably worse, not better; and no model produced a usable confidence gradient. Rather than tuning until something flattered, the terminal encodes the finding: direction surfaces are labeled views with attributed reasoning — useful as structured argument, never sold as probability.

Volatility clusters; tomorrow’s turbulence is forecastable from today’s in a way tomorrow’s direction is not. Goldeneye turns that one durable regularity into its core quantitative product: a forward price-range band at stated coverage. The estimator stack is an EWMA baseline and a log-space HAR model (heterogeneous autoregression over daily, weekly, and monthly realized-vol components, fit in logs so vol explosions cannot over-extrapolate) — log-HAR won the pre-registered walk-forward comparison and is the default, with EWMA selectable. Band quantiles are empirical, learned walk-forward from each series’ own scaled-return distribution rather than assumed normal, which is what makes the fat-tailed 95% band honest.

The claim is measured as coverage: on ~10 years of real daily prices across six commodities, walk-forward with no tuning on the evaluation data, the 80% band covers 78–81% of realized outcomes and the 95% band 93–95%; the vol forecast correlates 0.44–0.59 with subsequent realized volatility at the one-week horizon. Two things are true at once and the platform says both: these numbers are real, replicated, and out-of-sample — and vol autocorrelation is table stakes, a known market fact rather than proprietary alpha. The differentiation is not a secret signal; it is that the stated coverage is actually true, continuously re-measurable, and presented with its provenance.

All external data flows through protocol-based adapters — market prices (delayed), EIA storage, CFTC Commitments of Traders, NWS weather, and RSS news — each with a mock twin that returns realistic fixtures, so the full system runs with zero keys and real sources drop in behind the same interface via environment config. Provenance is observed, not configured: the platform inspects what the database actually holds (real rows, fresh within release cadence) rather than trusting its own settings, after a live incident in which an upstream vendor silently renamed a field and a “real” adapter fell back to mock without saying so. Feature queries are symbol-scoped and as-of dated: a backtest for crude can only ever see crude’s positioning as it stood on the decision date — a correctness class the test suite guards with red-proof tests.

Where a claim cannot be tested yet, the platform builds the evidence base instead of guessing: immutable, insert-only vintage archives snapshot the weather forecast and the futures curve daily, source-labeled, because forecast features can only be validated against what was forecast at the time — an archive you cannot reconstruct later. Each archive carries a pre-registered re-entry gate and a visible clock in the terminal’s admin view.

The decision journal is the product’s center of gravity. A logged thesis captures hypothesis, evidence, stated conviction, planned action, risk factors, and invalidation criteria; an auto-resolution loop scores it against real prices at its horizon with no retroactive editing. Resolved entries feed a reliability diagram — claimed conviction bucketed against realized hit rate — which is the calibration mirror most analysts have never seen. A parallel append-only decision ledger shadows every journal row with a SHA-256 hash chain and database-trigger immutability: the compliance-grade answer to “at the moment of decision, what exactly did you know?”

On top of the scored record sit deliberately conservative judgments. The skill-vs-luck verdict asks whether a desk’s hit-rate confidence interval clears a coin flip and refuses to crown streaks — blind momentum and random desks read “luck” by design, which is the test working. An LLM decision-quality coach mines resolved entries for the patterns in wins versus misses, and a devil’s-advocate reviewer steelmans the opposite of any thesis — both constrained to critique process, never to endorse trades. The public demo runs a fictional, clearly labeled sample analyst whose banner figure is derived from the same live calibration endpoint the page renders, so even the marketing copy cannot drift from the data.

LLMs do what they are good at — summarizing market state, explaining signal reasoning, narrating scenarios, critiquing theses, coaching decision quality, extracting structure from news — and are architecturally prevented from doing what they must not. Every call flows through a single explainer module (one choke point, cacheable, swappable). Prompts carry a persona contract with a hard-banned phrase list — every promissory and advice-shaped construction the behavior contract enumerates — require inference to be marked as inference, require at least one contradicting consideration with any directional view, and name the instrument explicitly so a model can never guess the commodity from a price level. Every output then passes a safety envelope that attaches confidence, caveats, timestamp, and disclaimer — and runs a forbidden-phrase scan that rejects the text outright rather than let advice-shaped language reach a screen. Rejections are counted, alerted, and surfaced in the admin view.

A Next.js 14 frontend (App Router, server components by default) talks REST and WebSocket to a FastAPI backend; Postgres with TimescaleDB stores time-series in hypertables alongside relational state; Redis provides hot-read caching and WebSocket fan-out. The backend enforces a strict layering — routers validate and delegate, services own logic, repositories own SQL, adapters own the outside world — and every model or LLM output crosses the safety wrapper before serialization. Shared API types are generated from the backend’s OpenAPI schema, with a CI lane that fails on contract drift, so the frontend cannot quietly disagree with the API about shapes.

Verification is layered the same way: ~1,000 backend tests and ~430 frontend tests behind a single health gate (lint, typecheck, and tests across both stacks); a database-integration CI lane that runs migrations and isolation tests against a real TimescaleDB container; the contract-drift lane; the drift-lock tests of §03; and a UI audit harness that renders every page at seven viewport widths and fails on overlap, spill, or clipped content — the definition of done for any UI change. Migrations go through Alembic only; observability is a request-ID structured log line, a Prometheus metrics endpoint, and safety-violation alerting.

Every row below is a pre-registered, walk-forward test on real market data, summarized as of July 2026. The terminal’s validation page renders the full drift-locked ledger with live numbers and the exact command that reproduces each verdict.

Goldeneye has no directional edge and does not pretend otherwise — that finding is now backed by real-data testing of every model in the lineup, including with real positioning and storage features. Its validated edge, calibrated ranges, rests on a market regularity every quantitative desk knows; the platform’s differentiation is honesty infrastructure, not secret alpha. The cross-asset configurations for the equity-index and rates classes are hand-set plausible scales proving engine portability, not validated calibrations — and they are labeled as such. LLM narratives, however constrained, remain generative text and carry their envelopes for a reason.

The forward path is deliberately evidence-gated rather than feature-gated. The weather vintage archive unlocks a degree-day forecast probe once it spans a winter (~January 2027). The vol-premium timing result — promising on two of three asset pairs, not crowned — earns a re-run against its original gate on a year of new data (~July 2027). The curve archive matures into a cross-sectional carry test at roughly two years (~mid-2028). Each gate is pre-registered now, while the outcome is unknown — which is the only time a gate is worth anything.