The shared core

One architecture, five commitments.

ORDR products serve very different desks — treasury, risk, security, operations, intelligence. Underneath, they keep the same five promises, because the buyers they serve all ask the same question: can you prove it?

01

Deterministic engines

Where money or risk is computed, ORDR products use pure, deterministic engines: same inputs, same outputs, byte for byte. Randomness, hidden state and 'model drift' are not acceptable explanations for a number a CFO has to sign.

In the codebases

ORDR Treasury runs a 60-module deterministic kernel; ORDR Aegis seals every run into a canonical envelope and re-runs it in CI to prove the bytes match; ORDR Fund allocates to the decimal.

02

Append-only proof

The record of what happened is written once and never edited. Per-tenant SHA-256 hash chains and Merkle trees sit under treasury decisions, agent actions, trade history and security events — so tampering is not just forbidden, it is visible.

In the codebases

WORM chains in Treasury, Aegis, Mind, Journal and Connect; ZeroMythic anchors events in immudb under a 256-depth sparse Merkle tree with offline-verifiable proofs.

03

Fail-closed governance

When authorization is missing, the answer is no. Four-eyes pipelines, separation of duties, promotion gates and customer-held cryptographic vetoes make the safe path the only path.

In the codebases

Treasury's SANDBOX→STAGING→LEDGER pipeline; ZeroMythic's customer co-signature requirement on every privileged action; Mind's walk-forward gate that synthetic data can never pass; Connect's ten compliance CI gates.

04

AI as assistant, never autopilot

AI across ORDR explains, drafts, detects and coaches — under budgets, tool allowlists, confidence thresholds and kill switches. It does not write to ledgers, it does not sit inside calculation loops, and it does not act without a human or a signed policy above it.

In the codebases

Treasury's advisory-only assistant cannot touch WORM tables; Aegis keeps LLMs out of the calculation loop entirely; Connect routes agent actions below 0.7 confidence to human review.

05

Hard tenant isolation

One customer can never see another — enforced in the database, in the message broker and on the chain, then asserted by integration tests rather than promised in a slide.

In the codebases

Forced Postgres row-level security in Treasury, Mind and Connect; per-tenant NATS operator accounts in ZeroMythic where cross-tenant reads are broker-rejected; per-tenant Merkle chains in Aegis.

The core is the product. The products are the proof.