The architecture

1. 01Market data flows in from the deepest markets Kato can read.
2. 02Pricers turn it into a fair value for every instrument.
3. 03Strategies decide what to do with that price, and emit an intent: a plain statement of the trade they want.
4. 04The executor and signer check every intent against policy before anything is signed.
5. 05The risk core holds the limits and circuit breakers that can pull every quote at once.

For options, the deepest market is Deribit. Kato fits a volatility surface to Deribit's prices for each coin and reads a fair value for every option off it. Every quote Kato shows starts from that number.

Strategies decide what to do with a price: quote, hedge, close. They never touch a venue directly. Each one emits an intent, and every intent is recorded in Kato's ledger before it goes anywhere, so each order can be traced back to the decision that made it.

The executor and signer check every intent before it goes out. Anything that breaches a limit, uses an unapproved route or pays an address Kato doesn't own is rejected and logged. Every order is decoded and checked against policy before it's signed.

The risk core holds Kato's limits and circuit breakers. Stale data, a sharp move, a run of errors or a loss limit pulls every quote at once. See Risk and limits.

Around the pipeline sits the learning layer. Researchers and builders propose new settings and strategies, and everything they propose is clamped to protected bands. The executor, risk core and signer live in protected code that no agent can edit, including the ones that build Kato. See Rules it can't break.

Kato's keys follow the same design. Trading keys can trade and move capital between Kato's own accounts. They can't withdraw. If one ever leaked, the funds would stay where they are. Trading keys also expire, and are replaced every two weeks or so.