Architecture narratives

How a Stellar ledger event becomes a row in our trades hypertable. Galexie → MinIO → ledgerstream → dispatcher → per-source decoders. The one canonical path.

The policy chain from raw trade to served price — class filter, outlier filter, VWAP, freeze gate — plus how a market's directions and aliases fold together, cross-rate routing and thin markets.

Three-domain supply derivation: XLM hard-coded, classic from ledger entries, SEP-41 from event sums. Per-asset refresh cadence. ADR-0011 in full.

Attack catalogue and the defensive layers we run, the SEP-40 serve surface, and how a new on-chain oracle is discovered and onboarded.

What keeps the service up today, the planned in-region HA build and R2/R3 regions, failure modes, backups and the decisions that bind them.

What bumps the major / minor / patch on every binary release. Public types in pkg/* are SemVer-stable; internal/* moves freely.