🏛️ Enterprise Architecture Review

Hermes AI Trading Platform · July 30, 2026 · Confidential

Overall Score

Enterprise Maturity: Intermediate

Not ready for financial institution production. Strong foundation, critical gaps in testing, HA, DR, and security posture.

Category Scores

Category	Score	Rating	Key Finding
Architecture	5.5/10	Intermediate	Good layering, no microservices, tight coupling between bot instances
AI Platform	7/10	Production	Strong Hermes agent with skills/memory/cron. Missing eval framework.
Trading Engine	4/10	Beginner	No backtesting pipeline, no walk-forward, no Monte Carlo
Infrastructure	5/10	Intermediate	Containerized but no orchestration. No HA. Single VPS.
Security	6/10	Intermediate	Centralized creds, no RBAC, no encryption-at-rest for secrets
Reliability	3.5/10	Beginner	No DR plan, no failover, no circuit breakers in trading path
Performance	5/10	Intermediate	Adequate for current load, no async in bot loops, no DB indexing
Code Quality	4.5/10	Beginner	No tests, no CI/CD, configuration duplication across 4 envs
Trading Standards	3/10	Beginner	No Sharpe/Sortino tracking, no Kelly sizing, no correlation analysis
Production Readiness	3/10	Beginner	Single point of failure on every component

Top 20 Weaknesses

#	Severity	Category	Weakness
1	CRITICAL	Reliability	Single VPS — no HA, no failover, Total platform failure if host goes down
2	CRITICAL	Trading	No backtesting pipeline with walk-forward validation — strategies selected by live performance gambling
3	CRITICAL	Code Quality	Zero automated tests (no pytest, no CI/CD) — every change is a blind deploy
4	HIGH	Production	No circuit breakers or retry logic in order execution path
5	HIGH	Trading	No slippage modeling — strategies assume they get limit price every time
6	HIGH	Infrastructure	No container orchestration (K8s/Nomad) — manual process management with shell scripts
7	HIGH	Security	API keys in multiple .env files with 600 perms but no encryption at rest
8	HIGH	Code Quality	Config duplication across 4 environments with known drift history (strategies would balloon past cap)
9	HIGH	Trading	No portfolio correlation tracking — strategies can be all on same side of a crash
10	HIGH	Architecture	Tight coupling between strategy discovery and production trading in same process
11	HIGH	Production	No disaster recovery plan — no off-site backup of trading state
12	MEDIUM	AI Platform	No LLM evaluation framework — model upgrades are blind (can't detect regressions)
13	MEDIUM	Infrastructure	No structured logging (all bot logs to single flat file per instance)
14	MEDIUM	Security	No audit log of credential changes — can't trace who changed what key when
15	MEDIUM	Performance	No database indexing on Postgres — queries slow as data grows
16	MEDIUM	Architecture	No API versioning between components — gateway, bridge, dashboard tightly coupled
17	MEDIUM	Trading	Kelly criterion not used for position sizing — fixed fractions instead
18	MEDIUM	Infrastructure	Docker image not version-pinned — `latest` tags could break on restart
19	MEDIUM	Security	No dependency scanning — vulnerabilities in 150+ Python packages unmonitored
20	MEDIUM	AI Platform	Single model provider (DeepSeek) — if DeepSeek goes down, AI assistant is blind

Top 20 Improvements

#	Priority	Effort	Improvement
1	CRITICAL	3 weeks	Write a proper backtesting harness with walk-forward validation. Stop using live P&L as strategy selector.
2	CRITICAL	2 weeks	Add pytest suite with CI/CD (GitHub Actions). Test order flow, risk checks, config loading.
3	HIGH	1 week	Implement circuit breaker pattern on Alpaca API calls — stop trading if API latency spikes.
4	HIGH	1 week	Add slippage model to backtesting — track fill vs limit price gap per strategy.
5	HIGH	2 weeks	Consolidate 4 env configs into a single source with env-specific overlays (Hydra/OmegaConf).
6	HIGH	2 days	Add structured logging (JSON) to all bots — ship to Grafana Loki or similar.
7	HIGH	1 week	Implement Kelly position sizing and portfolio correlation matrix.
8	HIGH	2 days	Pin all Docker image versions — never use `latest` in production.
9	HIGH	2 days	Add dependency scanning (pip-audit, Safety, or Dependabot).
10	HIGH	3 days	Set up a fallback provider chain for AI (DeepSeek→OpenRouter→Anthropic).
11	HIGH	1 day	Add Monte Carlo simulation to all strategy backtests — probability distributions of returns.
12	MEDIUM	1 week	Deploy second VPS as hot standby with database replication.
13	MEDIUM	2 days	Add database indexing to Postgres — queries for historical P&L currently scan all rows.
14	MEDIUM	3 days	Create an LLM eval harness — benchmark responses before/after model changes.
15	MEDIUM	2 days	Add GRPC or async message queue between components — decouple discovery from execution.
16	MEDIUM	1 day	Encrypt credentials.env with GPG or SOPS — decrypt only at runtime.
17	MEDIUM	3 days	Add API versioning (v1/v2 prefixes) to all internal HTTP endpoints.
18	MEDIUM	1 day	Track Sharpe/Sortino ratios per strategy over rolling 30-day windows.
19	MEDIUM	1 day	Add credential audit log — timestamp every change to credentials.env.
20	MEDIUM	2 days	Add readiness/liveness probes to all services — not just bot process checks.

Immediate Fixes (Do This Week)

Pin Docker images — replace latest with explicit version tags. A docker pull on restart could break everything.
Add AI fallback provider — if DeepSeek is down, the entire Telegram assistant is blind. Configure OpenRouter as fallback.
Add structured logging — JSON logs to a dedicated file per service. Grepping flat files for errors is not production.
Encrypt credentials.env — GPG encrypt the central credential file. Decrypt into memory at startup, never write plaintext to disk.
Pin strategy rankings — the daily review cron needs a minimum-trades threshold before swapping (currently swaps on 3 trades). Change to 10.
Add circuit breaker on Alpaca order endpoint — if 3 consecutive orders fail, stop trading for 5 minutes.
Track slippage — log fill_price vs limit_price on every order. This data is critical for backtest accuracy.
Pin Python package versions — requirements.txt should lock all transitive deps, not just top-level.

Nice-to-Have Improvements

Kubernetes migration for container orchestration and auto-scaling
Time-series database (InfluxDB/TimescaleDB) for tick-level market data
WebSocket-based real-time order status feed instead of polling
Grafana dashboards for live strategy P&L, drawdown, and correlation
Automated strategy promotion pipeline (DEV→QA→PROD→LIVE) with gating
Machine learning model registry (MLflow) for tracking strategy versions
Feature store for market data features shared across strategies
A/B testing framework for strategy variants
Chaos engineering exercises for the trading pipeline
Post-mortem templates and incident runbooks

Risk Matrices

🔴 Security Risks

Risk	Likelihood	Impact	Mitigation
Credentials leaked via git	Medium	Critical	.gitignore + credentials.env outside repo (done). Add git hooks to block accidental commits.
Dependency with known CVE exploited	Medium	High	No scanning. Add dependabot or pip-audit to weekly cron.
Telegram bot token compromised	Low	Medium	Token in .env with 600 perms. Rotate quarterly.
Prompt injection via Telegram	Medium	Medium	No guardrails on user input to LLM. Add system prompt hardening.

🔴 Trading Risks

Risk	Likelihood	Impact	Mitigation
Strategy selected by luck (not backtesting)	High	High	Build walk-forward backtest harness. This is the #1 risk today.
All strategies correlated in a crash	Medium	Critical	No correlation matrix today. Add portfolio correlation tracking.
Budget gate wrong — over-trading	Low	High	Budget gate works. But no circuit breaker if it fails.
Alpaca API outage	Low	High	No alternate broker configured. Single point of broker failure.
Order fills worse than backtest assumption	High	Medium	No slippage tracking. Add fill vs limit price logging.

🔴 AI Risks

Risk	Likelihood	Impact	Mitigation
DeepSeek API outage	Low	High	No fallback provider configured. Add OpenRouter.
Model regression on upgrade	Medium	Medium	No eval harness. Build LLM benchmark suite.
Context window overflow on long session	Medium	Low	Hermes has auto-compression. Monitor compression frequency.
LLM hallucination in trading decision	Low	High	LLM only assists, doesn't execute. Risk is low by design.

🔴 Production Risks

Risk	Likelihood	Impact	Mitigation
Single VPS host failure	Low	Critical	Total platform loss. Deploy second VPS with replicated DB.
Disk full (logs)	Medium	High	No log rotation configured on all services. Add logrotate.
Memory exhaustion from 4x bot instances	Medium	High	11GB used/15GB — 4GB free. Monitor with alert at 2GB free.
Container restart loses running state	Low	Medium	Bots are nohup processes outside container lifecycle. Inconsistent.

Technical Debt

Config duplication — 4 identical config.yaml files with known drift. Single source with overlays needed.
Script sprawl — 70+ cron jobs, 20+ shell scripts in /opt/data/scripts/, many untracked in git (now fixed).
No type hints — Python codebase has minimal type annotations. MyPy would catch 50+ bugs.
Strategy discovery vs execution coupling — same process discovers AND trades. Should be separate microservices.
No API contracts — internal HTTP APIs have no OpenAPI specs. Breaking changes go undetected.
Logs as source of truth — trading state is read from log files and strategy_performance.json. Should be in Postgres.
Bash as orchestrator — keepalive, watchdog, scout all in bash. Shell scripts are fragile (quoting bugs, trap handling).
No dependency lockfile — pip installs unpinned packages every time. Reproducibility is broken.

Suggested Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────┐
│                        PUBLIC INTERNET                                  │
├─────────────────────────────────────────────────────────────────────────┤
│  Tailscale Funnel  │  ttyd :4860  │  Telegram Bot  │  Email/SMTP       │
└──────┬──────────────┴──────┬──────┴───────┬─────────┴───────────────────┘
       │                     │              │
┌──────▼─────────────────────▼──────────────▼────────────────────────────┐
│                      REVERSE PROXY (port 80)                           │
│  routes: /dashboard → :9119 · /cloud → :8082 · /api → :8766           │
└──────┬──────────────────────────┬──────────────────────────────────────┘
       │                          │
┌──────▼──────────┐    ┌─────────▼──────────────────────────────────────┐
│  HERMES GATEWAY │    │              TRADING BOT FLEET                  │
│  :8642          │    │                                                  │
│  Telegram ──────┤    │  ┌─────────┐  ┌─────────┐  ┌─────────┐          │
│  Skills/Memory  │    │  │   QA    │  │  PROD   │  │  DEV    │          │
│  MCP Servers    │    │  │ paper   │  │ paper   │  │ paper   │          │
│  Cron Jobs      │    │  │ $4K     │  │ $4K     │  │ $4K     │          │
└─────────────────┘    │  └────┬────┘  └────┬────┘  └────┬────┘          │
                       │       │            │            │               │
                       │  ┌────▼────────────▼────────────▼────┐          │
                       │  │         SHARED SERVICES            │          │
                       │  │  ┌────────┐ ┌────────┐ ┌────────┐  │          │
                       │  │  │Alpaca  │ │Postgres│ │Grafana │  │          │
                       │  │  │Paper API│ │:32772 │ │Cloud+  │  │          │
                       │  │  └────────┘ │Langfuse│ │Local   │  │          │
                       │  │            │n8n     │ │:8742   │  │          │
                       │  │            │Dify    │ └────────┘  │          │
                       │  │            │Swamp   │              │          │
                       │  │            └────────┘              │          │
                       │  └────────────────────────────────────┘          │
                       └──────────────────────────────────────────────────┘

Suggested Folder Structure

/opt/data/
├── hermes-workspace/          # Git repo (3-copy sync)
│   ├── live/            # LIVE bot
│   ├── qa/                    # QA paper bot
│   ├── prod/                  # PROD paper bot
│   ├── dev/                   # DEV paper bot
│   ├── scripts/               # Git-tracked scripts
│   │   └── infra/             # Infrastructure scripts mirror
│   ├── dashboard/             # Trading dashboard
│   ├── secure-docs/           # Security-sensitive docs
│   ├── shared-kb/             # Obsidian-compatible KB
│   └── docs/                  # Design docs, architecture
├── scripts/                   # Live scripts (some in git)
│   ├── reverse-proxy-80.py
│   ├── service-keepalive.sh
│   ├── bot-watchdog.sh
│   ├── trading-review.py
│   └── strategy-scout.sh
├── shared-kb/                 # Obsidian vault (separate git)
├── .credentials.env           # Central secrets (chmod 600)
├── config.yaml                # Hermes agent config
├── .env                       # Hermes agent env
├── SOUL.md                    # Personality definition
└── logs/                      # All service logs

Suggested Technology Stack

Layer	Current	Recommended
Container Runtime	Docker + s6-overlay	Docker Compose → Kubernetes (if scaling)
Orchestration	None (manual nohup)	Docker Compose with restart:always
Database	Postgres (self-hosted)	Postgres + TimescaleDB for market data
Cache	In-memory dicts	Redis for rate limiting, signal cache
Message Queue	None	NATS / RabbitMQ for order events
Monitoring	Grafana Cloud + self-hosted	Grafana + Loki + Prometheus + AlertManager
Secrets	Plain file chmod 600	HashiCorp Vault / SOPS / Mozilla sops
CI/CD	None	GitHub Actions + pytest + ruff
Logging	Flat files	JSON → Loki → Grafana
Feature Store	None	Feast / Tecton for market features
ML Registry	None	MLflow for strategy versioning

Suggested AI Ecosystem

Component	Current	Recommended
LLM Provider	DeepSeek v4 Flash	DeepSeek (primary) + OpenRouter (fallback) + Gemini (vision)
Agent Framework	Hermes Agent	Keep — best-in-class for this use case
Memory	Hermes built-in	Add Honcho/Mem0 for persistent memory across restarts
MCP Servers	Zapier, SEC Edgar	Expand: add Yahoo Finance, Polygon.io, broker-specific MCPs
Vector DB	None	ChromaDB / Qdrant for strategy documentation RAG
Eval Framework	None	DeepEval / LangFuse for LLM response quality tracking
Prompt Mgmt	SOUL.md + skills	Add versioned prompt templates with A/B testing
Observability	Langfuse	Keep — add tracing to all gateway conversations

Enterprise Readiness Assessment

Requirement	Status	Notes
HA / Fault Tolerance	❌ Not Met	Single VPS hosts everything
Disaster Recovery	❌ Not Met	No DR plan, no off-site state backup
Change Management	⚠️ Partial	Git tracking exists, no code review, no CI/CD
Observability	⚠️ Basic	Grafana present, no structured logging, no alerting
Security Audit Trail	❌ Not Met	No audit log for config or credential changes
Compliance (SOC2)	❌ Not Met	No access controls, no encryption at rest
Testing Coverage	❌ Not Met	Zero automated tests
Documentation	⚠️ Partial	Architecture docs exist, no runbooks, no diagrams
Capacity Planning	⚠️ Partial	15GB RAM, 200GB disk — adequate now, no growth plan

Estimated Maintainability

Score: 4.5/10 — Below Industry Standard

Configuration complexity: 4 envs × manual sync × config drift. Consolidation is overdue.
Script hygiene: 20+ shell scripts with varying quality. Some have set -e, most don't.
Documentation: Handbook exists, architecture blueprint exists, but no runbooks for incident response.
Onboarding time: New developer would need 2-3 weeks to understand the full stack.
Change impact: Tight coupling means a change in one place often breaks something else.
Dependency management: No lockfile, transitive deps untracked. `pip install` can break at any time.

Estimated Scalability

Score: 3.5/10 — Limited

Horizontal scaling: Impossible without architecture rewrite — bots share filesystem state.
Vertical scaling: 15GB VPS — can upgrade to 32GB/64GB, but single-node bottleneck.
Strategy count: 5-10 strategies per env is fine. 50+ would overwhelm the in-process loop.
Symbol count: 10-20 symbols fine. 100+ would need distributed data fetching.
Database: Postgres can handle 100K+ trades. Indexing needed for query performance.
AI gateway: Single gateway handles all Telegram traffic. Under 100 users/day, but no horizontal scaling.

Final Verdict

Would I approve this platform for production in a financial institution?

No. Not without significant remediation.

This is a passionate solo developer's project with genuine architectural ambition — Hermes Agent integration, multi-env trading pipeline, MCP server ecosystem, Grafana monitoring — that has outgrown its bootstrap phase without the corresponding investment in production hardening.

The three dealbreakers for financial institution production:

No testing — zero test coverage means every deploy is a trust exercise. In a financial system, untested code loses real money.
No HA/DR — a single VPS failure takes down all trading, all monitoring, all AI assistance. No SLA possible.
No backtesting rigor — strategies are selected by live P&L over 10-20 trades, which is statistically meaningless. A strategy can win by luck and get promoted, or lose by luck and get demoted.

The platform scores well on architecture vision (layering, AI integration, multi-env pipeline) and developer velocity (fast iteration, automated cron pipelines, daily review cycles). For a solo trading setup with $4K paper budget, this is above average. But the gap between "trading as a hobby" and "trading as a financial institution" is wide — and visible in every category.

The good news: the foundations are solid. The Hermes Agent integration, the credential guardrails, the strategy cap enforcement, the daily review cron — these are production-ready components. What's missing is the testing/QA/DR layer that wraps them in reliability. About 4-6 weeks of focused engineering could close most of the gap.

Verdict: Conditional Pass at 60-Day Milestone
If the top 10 critical/high improvements are delivered within 60 days, re-review. The core platform has Enterprise DNA wrapped in a Startup shell.

Enterprise Architecture Review · Hermes AI Trading Platform · July 30, 2026
Principal AI Architect · Confidential