Research
Architecture narratives
6 docs · source on GitHubIngest pipeline — the one canonical data path, projector, replay and backfill
How a Stellar ledger event becomes a row in our trades hypertable. Galexie → MinIO → ledgerstream → dispatcher → per-source decoders. The one canonical path.
Pricing and aggregation — from raw trade to served price
The policy chain from raw trade to served price — class filter, outlier filter, VWAP, freeze gate — plus how a market's directions and aliases fold together, cross-rate routing and thin markets.
Supply pipeline and asset identity
Three-domain supply derivation: XLM hard-coded, classic from ledger entries, SEP-41 from event sums. Per-asset refresh cadence. ADR-0011 in full.
Oracles — manipulation defense, SEP-40 and onboarding a generic oracle
Attack catalogue and the defensive layers we run, the SEP-40 serve surface, and how a new on-chain oracle is discovered and onboarded.
High-Availability and Infrastructure Plan
What keeps the service up today, the planned in-region HA build and R2/R3 regions, failure modes, backups and the decisions that bind them.
SemVer policy for Stellar Index
What bumps the major / minor / patch on every binary release. Public types in pkg/* are SemVer-stable; internal/* moves freely.
Operations runbooks
3 guides · source on GitHubThe recipes any new operator (or auditor) would want to read before standing up their own copy. Per-alert on-call runbooks stay private; these four are the cross-cutting procedures.
Release process — cutting a Stellar Index binary release
How a binary release is cut. CHANGELOG promotion, tag push, cross-compiled binaries, SHA256SUMS, and an automated GitHub release with auto-extracted notes. Includes the manual fallback path when CI is unavailable.
Deploy workflow — pushing a tagged release to a region
Pushing a tagged release into a region. Stage → backup → atomic install → restart → health probe → automatic rollback on failure. Operator-triggered, never automatic on tag.
Incident (SEV) Playbook
Incident response procedure. Severity classification (SEV-1 / SEV-2 / SEV-3), responder roles, customer-comms cadence, postmortem requirement.
Architecture decision records
51 records · source on GitHubAccepted
Fiat price basis rule — a single-venue fiat book yields to the USD-anchored derivation
ContractCallDecoder routing walks the whole auth call tree
Multi-region HA — active/active pricing, R1-authority lake, off-site lake and Postgres backups
Anonymous access, open self-service registration, and passkey auth (no payment surface)
Serve by query shape — the account-movement archive is ClickHouse-native
Pre-P23 classic-movement reconstruction from the lake
MAD-based outlier filtering for VWAP inputs
SEP-40 on-chain oracle read adapter — defer generic reader; serve surface already ships
Explorer rendering moves from static export to edge SSR
Backup + restore strategy — offsite repo2, ClickHouse lake protection, drilled restores
The v1 wire shape — Unit-D collapse, slug-route discriminator, freeze contract
Ingest durability semantics — cursor advance, lake sink defaults, drop visibility
Completing contract-identity gating (phoenix, defindex, aquarius, comet)
Soroban contract current-state reader — read-time decode from the lake
Network explorer (full Stellar + Soroban) over the certified lake
Factory-anchored contract gating for Soroban decoders
Tiered data architecture — ClickHouse raw lake, Postgres served tier
Completeness verification — substrate continuity, recognition, projection reconciliation
Per-source tables are projections of soroban_events
Coverage signal is data-derived from authoritative stores
Per-source coverage invariant
Tokenized real-world assets as AssetType "rwa
LCM cache tiering — local galexie-archive as hot, aws-public-blockchain as cold
Stablecoin → fiat proxy is late-binding aggregator policy, not eager ingest normalisation
Caddy trusts Cloudflare for client-IP signal via CIDR-pinned static list
Redis HA via Sentinel (not Cluster)
SEP-41 supply observer — mint / burn / clawback event-stream tracking
Classic-supply observers — Trustline / ClaimableBalance / LiquidityPool / ContractData entry tracking
AccountEntry observer — live home-domain + reserve-balance tracking
Chart API contract — timeframe + granularity + price_type
Anomaly response policy and confidence scoring — per-asset statistical baselines
API consistency surfaces — closed-bucket, tip, and observations
Archive completeness invariants and dual-archive integrity model
API rates served from last-closed bucket, never in-progress
Crypto tickers as AssetType "crypto
Adopt go-stellar-sdk/xdr for SCVal decoding in source connectors
Three-domain supply algorithm — XLM hard-coded, classic from ledger entries, SEP-41 from event sums
Off-chain fiat currencies as AssetType "fiat
API latency budget
Per-region HA topology
Redis as hot-path cache + rate-limit + ephemeral state
TimescaleDB for price time-series storage
Monorepo with a single Go module
Tier-1 three-validator aspiration (post-launch)
i128 / u128 values preserved end-to-end; never truncated to int64
Self-hosted storage is S3-compatible (MinIO), not local filesystem
Horizon is not in the Stellar Index architecture
Why we publish all of this
Stellar already has Horizon. The reason a second pricing stack adds value is methodology — what gets included in the VWAP, how we handle cross-pair triangulation, what triggers a freeze, how we audit a Soroban contract before flipping BackfillSafe. None of that is useful behind a closed door. Every choice has an ADR with a "Why this not the alternative" section; every alert has a runbook.