Deterministic trading.
Replay-verified state.
Anvil is the event-sourced Rust runtime where a backtest and a production run are the same program: every market event journaled, every state reproducible bit for bit, every strategy sealed behind a compile-time boundary.
Determinism
Determinism is the product
Systematic trading at scale needs more than fast execution. It needs a platform where every state transition is reproducible and every risk decision is auditable. Anvil makes determinism a property you can check — not a hope.
Pure reducer
Every state transition is a pure function of the current state and one event. No hidden clocks, no ambient I/O, no nondeterministic iteration order in the core.
- Single reducer entry point
- Deterministic event ordering
- Seeded RNG via rand_chacha
- No wall-clock reads in the reducer
State hash
After each applied event the runtime folds state into a blake3digest. The hash is the state's fingerprint — a single value that either matches on replay or doesn't.
- Per-event state digest
- Hash-chained journal
- Tamper-evident by construction
- O(1) divergence check
Replay verification
On shutdown Anvil replays the entire run from the journal and halts on any hash divergence. Determinism is checked on every run, not assumed once and trusted forever.
- Bit-for-bit replay
- Halts on hash mismatch
- Recovery is replay from journal
- Backtest is the same code path
Architecture
Three layers, one seam
Infrastructure, the SDK boundary, and strategy logic are separated into three layers. The seam between them is enforced by the Rust compiler and by cargo deny check bans — not by convention or code review.
journal, feed ingestion, order management and exchange adapters, the risk gateway, the replay engine, and monitoring. None of it knows what a strategy does.Strategy trait and a compile-time strategy-registry. Strategies receive state and emit order intents; they never hold an execution handle or reach the exchange directly.Event sourcing
The journal is the source of truth
Anvil does not mutate state in place and hope. Every change is an event appended to a typed, hash-chained journal. State is a fold over that journal — which makes recovery, audit, and backtest the same operation: replay.
A typed event envelope, append-only and causal
Each event carries its correlation chain, so any state can be traced back to the market events and intents that produced it. Encoded as NdJson for inspection or CBOR for density — and chained by blake3 so tampering is detectable.
{
"seq": 184213,
"ts": "2026-06-30T14:02:11.480Z",
"event": "OrderIntentAccepted",
"correlation": "c-9f2a…",
"causation": "e-184211",
"state_hash": "b3:7c41a9…",
"prev_hash": "b3:1d88f0…"
}
// state = fold(reduce, genesis, journal[..])Risk integrity
Strategies propose. The gateway disposes.
A strategy never places an order. It emits an intent that must pass a multi-stage risk gateway before any exchange adapter sees it. The boundary is structural — there is no path around it.
Every intent is gated
Order intents are proposals, not commands. Each one crosses the Risk Gateway before it can become a live order — there is no fast path that skips the checks.
Strategies can't bypass it
The SDK seam means strategy code never holds an execution handle. It cannot place orders directly or reach around the gateway — the compiler won't let it.
Multi-stage checks
Position, exposure, rate, and sanity stages run in a fixed, deterministic order. A single rejection stops the intent and is recorded to the journal with its reason.
Money is a type, not a float
No raw f64 for monetary values. Every price, size, and notional is a rust_decimal-backed newtype — exact arithmetic, no silent rounding drift.
Operational robustness
Boring in a good way
A system that manages real capital should be predictable under failure, observable in flight, and conservative about what reaches production. Anvil reads like infrastructure because it is.
Crash recovery
Rebuild exact state by replaying the journal from the last checkpoint. No partial writes, no manual reconstruction.
Startup reconciliation
On boot, Anvil reconciles journal-derived state against the venue before it will accept a single new intent.
Checkpoint snapshots
Periodic snapshots bound replay time — recovery reads the latest snapshot, then only the journal tail.
Metrics & health
Prometheus metrics, health endpoints, and structured JSON tracing across the runtime via the tracing stack.
Read-only operator console
anvil-tui renders live runtime state with no ability to mutate it — observation, never intervention.
Paper-validation gate
A 30-day paper-trading evidence window stands between a strategy and live capital. Promotion is earned, not toggled.
The Ferro family
Built on the Ferro suite.
Anvil is built on the Ferro suite, MorphIQ Labs' reusable engines for market data, replay, signal analytics, pricing, risk, and matching. Anvil supplies the deterministic runtime — the engines supply focused capability.
Built on the Ferro suite from MorphIQ Labs.
Positioning
A system you run, not a product you consume
Anvil is the platform tier of the MorphIQ portfolio. It promises determinism, reliability, and an enforced strategy boundary — never a trading outcome. The runtime is the product.
- Every state transition is reproducible: identical code, configuration, and market events produce an identical state and an identical
blake3hash. - The infrastructure / strategy seam is enforced by the Rust compiler and
cargo deny check bans— strategy logic physically cannot reach platform internals. - Conservative by design: correctness over cleverness, explicit state over implicit mutation, auditable determinism over unconstrained flexibility.
- Crypto-first today for data availability and iteration speed; the architecture targets a multi-asset trading-firm OS across crypto, futures, and equities.
Talk to us
Anvil runs MorphIQ's own strategy teams today, with external licensing as the mid-term direction. Reach out for a platform walkthrough or an evaluation conversation.
hello@morphiqlabs.comTell us about your runtime
- Your venue model — single-venue, multi-venue, asset classes
- Determinism & audit requirements — replay, journaling, recovery
- Strategy boundary needs — SDK seam, registry, promotion workflow
- Deployment posture — internal platform vs. licensed runtime