DEV Community

Cover image for Building "AI's Flight Recorder" for Algorithmic Trading: A Deep Dive into VCP-IBKR Reference Implementation

Building "AI's Flight Recorder" for Algorithmic Trading: A Deep Dive into VCP-IBKR Reference Implementation

TL;DR: We've open-sourced a production-grade reference implementation demonstrating how to create cryptographically verifiable audit trails for algorithmic trading with Interactive Brokers. Think of it as a flight recorder for your trading algorithms—every decision, every order, every fill becomes tamper-evident and independently verifiable.

📦 Repository: github.com/veritaschain/vcp-ibkr-rta-reference


Table of Contents

  1. The Problem: Why Trading Logs Fail
  2. The Solution: Three-Layer Cryptographic Architecture
  3. VCP Sidecar: Zero Modifications to Your Trading System
  4. Deep Dive: FIX Protocol to VCP Transformation
  5. Cryptographic Primitives
  6. Merkle Trees for Completeness Proofs
  7. Running the Verification Script
  8. Regulatory Alignment
  9. Getting Started
  10. What's Next

The Problem: Why Trading Logs Fail

Traditional trading audit logs have a fundamental flaw: they require trust in the log producer.

Consider this scenario:

Traditional Audit Log:
09:30:00.123 BUY AAPL 100 @ 185.50 → FILLED
09:30:01.456 SELL MSFT 50 @ 425.00 → FILLED
09:30:02.789 BUY GOOGL 25 @ 180.00 → REJECTED (?)
Enter fullscreen mode Exit fullscreen mode

When regulators or auditors review this log, they must trust that:

  • No events were deleted between entries
  • Timestamps weren't manipulated
  • The log producer didn't show different views to different auditors (split-view attack)

Even with database-level access controls and file checksums, a malicious operator with admin access could:

  1. Delete inconvenient events before archiving
  2. Modify historical records to hide manipulation
  3. Present different views to different stakeholders

This isn't just theoretical. In the 2024-2025 prop trading firm crisis, over 80 firms shut down amid allegations of hidden trade rejections, phantom fills, and manipulated performance metrics. Traders had no way to independently verify what actually happened to their orders.

The Aviation Parallel

Commercial aviation solved a similar problem decades ago with flight data recorders (black boxes). Every critical decision—throttle position, control inputs, sensor readings—is recorded in a tamper-evident format that survives crashes and manipulation attempts.

VeritasChain Protocol (VCP) brings this same principle to algorithmic trading: cryptographically verifiable audit trails where any tampering is mathematically detectable.


The Solution: Three-Layer Cryptographic Architecture

VCP v1.1 implements a defense-in-depth approach with three distinct integrity layers:

┌─────────────────────────────────────────────────────────────────┐
│                    LAYER 3: External Anchor                     │
│     "Timestamp Authority anchors Merkle Root to external time"  │
│                    (Third-party verifiable)                     │
├─────────────────────────────────────────────────────────────────┤
│                    LAYER 2: Merkle Tree                         │
│        "All events combined into single cryptographic root"     │
│                  (Completeness guarantee)                       │
├─────────────────────────────────────────────────────────────────┤
│                    LAYER 1: Event Hashes                        │
│          "Each event individually hashed with SHA-256"          │
│                    (Integrity guarantee)                        │
└─────────────────────────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

Layer 1: Event Integrity (SHA-256)

Every trading event is individually hashed:

def compute_event_hash(event: dict) -> str:
    """VCP v1.1 Section 6.1.1"""
    # Separate header (minus EventHash) from payload
    header = {k: v for k, v in event['Header'].items() if k != 'EventHash'}
    payload = {k: v for k, v in event.items() if k != 'Header'}

    # Canonical JSON (RFC 8785 style)
    canonical = json.dumps(header, sort_keys=True, separators=(',', ':'))
    canonical += json.dumps(payload, sort_keys=True, separators=(',', ':'))

    return hashlib.sha256(canonical.encode('utf-8')).hexdigest()
Enter fullscreen mode Exit fullscreen mode

What this proves: If any field in an event is modified after hashing, the hash will change. Tampering with individual events is detectable.

Layer 2: Completeness Guarantee (RFC 6962 Merkle Tree)

All event hashes are combined into a Merkle tree:

def rfc6962_leaf_hash(data: str) -> str:
    """RFC 6962 leaf hash: SHA256(0x00 || data)"""
    return hashlib.sha256(b'\x00' + bytes.fromhex(data)).hexdigest()

def rfc6962_node_hash(left: str, right: str) -> str:
    """RFC 6962 node hash: SHA256(0x01 || left || right)"""
    return hashlib.sha256(
        b'\x01' + bytes.fromhex(left) + bytes.fromhex(right)
    ).hexdigest()

def build_merkle_tree(event_hashes: List[str]) -> str:
    """Build Merkle tree and return root"""
    nodes = [rfc6962_leaf_hash(h) for h in event_hashes]

    while len(nodes) > 1:
        new_nodes = []
        for i in range(0, len(nodes), 2):
            if i + 1 < len(nodes):
                new_nodes.append(rfc6962_node_hash(nodes[i], nodes[i + 1]))
            else:
                new_nodes.append(nodes[i])  # Odd node carries up
        nodes = new_nodes

    return nodes[0]
Enter fullscreen mode Exit fullscreen mode

What this proves: The Merkle root is a single 64-character string that uniquely represents ALL events in a batch. If any event is deleted, added, or modified, the root changes. This provides a completeness guarantee—you can prove that no events were omitted.

Layer 3: External Verifiability (Timestamp Authority)

The Merkle root is anchored to an external timestamp authority:

{
  "AnchorID": "IBKR_ANCHOR_20250106_193500",
  "MerkleRoot": "b632b62f4350aed34bf8e3ac508ceb8ba5a33b4663ca0cc81dc99880c6356c9c",
  "AnchorTarget": "TIMESTAMPING_AUTHORITY",
  "AnchorFrequency": "DAILY",
  "TimestampISO": "2025-01-06T19:35:00+00:00"
}
Enter fullscreen mode Exit fullscreen mode

What this proves: A trusted third party (TSA) has certified that this exact Merkle root existed at this exact time. The log producer cannot retroactively modify historical data without the TSA anchor revealing the tampering.


VCP Sidecar: Zero Modifications to Your Trading System

One of VCP's key design principles is non-invasive integration. You don't need to modify your trading algorithms, risk management systems, or order management systems.

┌─────────────────────────────────────────────────────────────────┐
│                 EXISTING TRADING INFRASTRUCTURE                 │
│                   (NO MODIFICATIONS REQUIRED)                   │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐         │
│  │  Trading    │    │    Risk     │    │   Order     │         │
│  │  Algorithm  │    │  Management │    │  Management │         │
│  └──────┬──────┘    └──────┬──────┘    └──────┬──────┘         │
│         │                  │                  │                 │
│         └──────────────────┴────────┬─────────┘                 │
│                                     │                           │
│                              ┌──────▼──────┐                    │
│                              │  FIX Engine │                    │
│                              └──────┬──────┘                    │
│                                     │                           │
└─────────────────────────────────────┼───────────────────────────┘
                                      │
                           ┌──────────▼──────────┐
                           │                     │
                           │   VCP FIX SIDECAR   │ ◄── Parallel Process
                           │   (Non-invasive)    │
                           │                     │
                           │  • Message Capture  │
                           │  • Event Transform  │
                           │  • Hash & Sign      │
                           │  • Merkle Build     │
                           │  • Anchor Submit    │
                           │                     │
                           └──────────┬──────────┘
                                      │
                                      ▼
                           ┌─────────────────────┐
                           │  VCP Evidence Pack  │
                           │  (Verifiable Data)  │
                           └─────────────────────┘
Enter fullscreen mode Exit fullscreen mode

The sidecar simply observes FIX messages flowing between your system and Interactive Brokers, transforms them into VCP events, and produces cryptographically verifiable evidence packs.

Benefits of Sidecar Architecture

Challenge Sidecar Solution
Server privileges required No—operates client-side only
Impact on existing systems None—completely independent process
Trading latency impact Zero—parallel, non-blocking capture
Vendor lock-in Standards-compliant, portable
Gradual adoption Start with PoC, expand incrementally

Deep Dive: FIX Protocol to VCP Transformation

Interactive Brokers uses FIX 4.2 for order routing. The VCP sidecar transforms FIX messages into structured VCP events.

FIX Message Example (NewOrderSingle)

8=FIX.4.2|35=D|49=IBKR_ALGO_CLIENT|56=IBKR|115=U12345678|
34=1|52=20250106-09:30:00.123|11=IBKR20250106.000001|
55=AAPL|207=SMART|54=1|38=100|44=185.50|40=2|59=0|
60=20250106-09:30:00.123|9882=IBKR_ADAPTIVE|10=001|
Enter fullscreen mode Exit fullscreen mode

Corresponding VCP Event (ORD)

{
  "Header": {
    "Version": "1.1",
    "EventID": "01943af3-21fc-796e-96cb-c02b045bb6e9",
    "EventType": "ORD",
    "TimestampISO": "2025-01-06T09:30:00.060Z",
    "TimestampInt": 1736155800060000,
    "HashAlgo": "SHA256",
    "SignAlgo": "ED25519",
    "ClockSyncStatus": "NTP_SYNC",
    "TimestampPrecision": "MICROSECOND",
    "PrevHash": "43c8eb47442162f5128711f7c00383ab3b65f1fcf64e18b4cdeed0413fdb216b",
    "EventHash": "8847a27530cc686d2270d0b76d536b184e09044ae5cf463d708d73c50142ac7e"
  },
  "Trade": {
    "Symbol": "AAPL",
    "ClOrdID": "IBKR20250106.000001",
    "Side": "BUY",
    "Volume": 100.0,
    "Price": 185.5,
    "RoutingDestination": "SMART"
  },
  "Governance": {
    "AlgorithmName": "IBKR_ALGO_SUITE",
    "AlgorithmVersion": "2.1.0",
    "DecisionReason": "FIX NewOrderSingle processed",
    "FIXCorrelation": {
      "MsgType": "D",
      "MsgSeqNum": "1",
      "Direction": "OUTBOUND"
    },
    "IBKRAlgorithm": "IBKR_ADAPTIVE"
  },
  "PolicyIdentification": {
    "Version": "1.1",
    "PolicyID": "org.veritaschain:vcp-ibkr-production-v1",
    "ConformanceTier": "GOLD",
    "RegistrationPolicy": {
      "Issuer": "VeritasChain IBKR Production Issuer",
      "PolicyURI": "https://veritaschain.org/policies/ibkr-production-v1"
    },
    "VerificationDepth": {
      "HashChainValidation": true,
      "MerkleProofRequired": true,
      "ExternalAnchorRequired": true,
      "SignatureVerificationRequired": true
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

FIX Tag Mapping Table

FIX Tag FIX Name VCP Field Notes
35 MsgType Header.EventType (derived) D→ORD, 8→varies by ExecType
11 ClOrdID Trade.ClOrdID Client order identifier
55 Symbol Trade.Symbol Instrument
54 Side Trade.Side 1=BUY, 2=SELL
38 OrderQty Trade.Volume Quantity
44 Price Trade.Price Limit price
40 OrdType Trade.OrderType 1=MKT, 2=LMT
207 SecurityExchange Trade.RoutingDestination SMART, NYSE, etc.
52 SendingTime Header.TimestampISO Primary timestamp
150 ExecType (Event derivation) 0=ACK, 2=EXE, 8=REJ

Event Type Derivation Logic

def derive_event_type(msg_type: str, exec_type: str = None) -> str:
    """Map FIX MsgType to VCP EventType"""
    if msg_type == "D":  # NewOrderSingle
        return "ORD"
    elif msg_type == "F":  # OrderCancelRequest
        return "CXL"
    elif msg_type == "G":  # OrderCancelReplaceRequest
        return "MOD"
    elif msg_type == "8":  # ExecutionReport
        exec_map = {
            "0": "ACK",  # New (acknowledgement)
            "1": "PRT",  # Partial fill
            "2": "EXE",  # Fill (execution)
            "4": "CXL",  # Canceled
            "5": "MOD",  # Replaced
            "8": "REJ",  # Rejected
        }
        return exec_map.get(exec_type, "UNK")
    return "UNK"
Enter fullscreen mode Exit fullscreen mode

Cryptographic Primitives

VCP v1.1 uses battle-tested cryptographic standards:

Hash Algorithm: SHA-256

  • Standard: FIPS 180-4
  • Output: 256-bit (64 hex characters)
  • Collision resistance: ~2^128 operations
  • Use case: Event integrity, Merkle tree construction

Signature Algorithm: Ed25519

  • Standard: RFC 8032
  • Key size: 256-bit (32 bytes)
  • Signature size: 512-bit (64 bytes)
  • Properties: Deterministic, fast verification, short signatures
# Ed25519 key example (public key only - private in HSM)
{
  "kty": "OKP",
  "crv": "Ed25519",
  "x": "1A3WTnVfh6Rt5G_0K4Lf...",
  "kid": "vcp-ibkr-prod-2025-001"
}
Enter fullscreen mode Exit fullscreen mode

JSON Canonicalization: RFC 8785

To ensure consistent hashing regardless of JSON formatting:

def canonicalize_json(obj: Any) -> str:
    """RFC 8785-style canonical JSON"""
    return json.dumps(
        obj, 
        sort_keys=True,           # Alphabetical key ordering
        separators=(',', ':'),    # No whitespace
        ensure_ascii=False        # UTF-8 preservation
    )
Enter fullscreen mode Exit fullscreen mode

Why These Choices?

Primitive Alternative Considered Why VCP Chose This
SHA-256 SHA-3, BLAKE3 Widest hardware support, regulatory acceptance
Ed25519 ECDSA, RSA Faster, smaller signatures, no RNG dependency
RFC 8785 JCS, custom IETF standard, deterministic

Post-Quantum Readiness

VCP includes SignAlgo and HashAlgo fields to support crypto agility. When NIST finalizes post-quantum standards (Dilithium, Kyber), VCP can migrate without protocol changes:

{
  "SignAlgo": "DILITHIUM3",  // Future PQC algorithm
  "HashAlgo": "SHA3-256"     // Alternative hash
}
Enter fullscreen mode Exit fullscreen mode

Merkle Trees for Completeness Proofs

The Merkle tree is VCP's secret weapon for proving nothing was deleted.

How It Works

                    Merkle Root
                   ┌─────────┐
                   │ b632... │
                   └────┬────┘
                        │
           ┌────────────┴────────────┐
           │                         │
      ┌────┴────┐               ┌────┴────┐
      │ 3d96... │               │ bcf1... │
      └────┬────┘               └────┬────┘
           │                         │
    ┌──────┴──────┐           ┌──────┴──────┐
    │             │           │             │
┌───┴───┐    ┌───┴───┐   ┌───┴───┐    ┌───┴───┐
│27e2...│    │19f1...│   │7a3f...│    │65f0...│
└───┬───┘    └───┬───┘   └───┬───┘    └───┬───┘
    │            │           │            │
   ...          ...         ...          ...
    │            │           │            │
┌───┴───┐   ┌───┴───┐   ┌───┴───┐   ┌───┴───┐
│Event 1│   │Event 2│   │Event 3│   │Event 4│
│ORD    │   │ACK    │   │EXE    │   │...    │
└───────┘   └───────┘   └───────┘   └───────┘
Enter fullscreen mode Exit fullscreen mode

Inclusion Proofs

An inclusion proof lets you verify that a specific event exists in the tree without seeing all other events. This is crucial for privacy-preserving audits.

{
  "EventID": "01943af3-21c0-7440-a7cf-924998626557",
  "EventHash": "6cbb105a74e5942190e62692ed44b958e5f48766cc94b1b7ab41d597b80d2181",
  "LeafIndex": 0,
  "MerkleRoot": "b632b62f4350aed34bf8e3ac508ceb8ba5a33b4663ca0cc81dc99880c6356c9c",
  "AuditPath": [
    {"position": "right", "hash": "511db3c512107beedb6c6a61d9bf5231f2c28e35ed9ea2ac04e07e621b5d6c9f"},
    {"position": "right", "hash": "65f03150d6f8da5cec8ebf4d6acac2702a924fd296ea5905d9422c41efc3e217"},
    {"position": "right", "hash": "7a3f8c84bca406f5ec324a6da07c7ba8b447f4a1350cfa49a3896cfa3255cd2b"},
    {"position": "right", "hash": "19f1929ebbc38ffc373fb7b86b04c5013a1ad5baf01239324243fa3970250b84"},
    {"position": "right", "hash": "bcf15506948cbd3af00051e90bde4bc011f492d8ff45921a2585cb3b23d28bfe"}
  ]
}
Enter fullscreen mode Exit fullscreen mode

Verifying an Inclusion Proof

def verify_inclusion_proof(event_hash: str, audit_path: List[dict], merkle_root: str) -> bool:
    """Verify that an event is included in the Merkle tree"""
    current = rfc6962_leaf_hash(event_hash)

    for step in audit_path:
        sibling = step['hash']
        if step['position'] == 'left':
            current = rfc6962_node_hash(sibling, current)
        else:
            current = rfc6962_node_hash(current, sibling)

    return current == merkle_root
Enter fullscreen mode Exit fullscreen mode

Key insight: To verify inclusion, you only need O(log n) hashes, not the entire dataset. For a batch of 1 million events, you need only ~20 hashes.


Running the Verification Script

The evidence pack includes a standalone verification script that requires only Python standard library:

# Clone the repository
git clone https://github.com/veritaschain/vcp-ibkr-rta-reference.git
cd vcp-ibkr-rta-reference/evidence_pack

# Run verification
python verify.py
Enter fullscreen mode Exit fullscreen mode

Expected Output

======================================================================
VCP Evidence Pack Verification Report
VCP v1.1 Full Compliance Edition
======================================================================
Evidence Path: /path/to/ibkr_evidence_pack_v1_1_production
Verification Time: 2026-01-06T11:32:45.562552+00:00

Specification: VCP v1.1
Generator: VCP.IBKR.Production.v1.1
Conformance Tier: GOLD
PolicyID: org.veritaschain:vcp-ibkr-production-v1
Total Events: 26
Total Batches: 1
Total Anchors: 1
Protocol: FIX 4.2

VCP v1.1 Compliance Verification:

  ✓ Specification declared: VCP v1.1
  ✓ Global PolicyIdentification present
    ✓ PolicyID: org.veritaschain:vcp-ibkr-production-v1
    ✓ ConformanceTier: GOLD
    ✓ RegistrationPolicy.Issuer: VeritasChain IBKR Production Issuer
    ✓ VerificationDepth present:
      - HashChainValidation: True
      - MerkleProofRequired: True
      - ExternalAnchorRequired: True

  Event-level PolicyIdentification:
    ✓ All 26 events have PolicyIdentification

  Three-Layer Architecture (Section 6):
    ✓ Layer 1: EventHash (REQUIRED) + PrevHash (Chained)
    ✓ Layer 2: Merkle Tree RFC 6962 (REQUIRED)
    ✓ Layer 3: External Anchor via TSA (REQUIRED)

  ✓ External Anchor present (1 anchor event(s))
    - AnchorID: IBKR_ANCHOR_20250106_193500
    - AnchorTarget: TIMESTAMPING_AUTHORITY
    - AnchorFrequency: DAILY

VCP v1.1 Compliance Check: ✓ FULLY COMPLIANT

----------------------------------------------------------------------

Layer 1 - Event Hash Verification (SHA-256):
  ✓ All 26 event hashes cryptographically verified

Layer 1 - Hash Chain Verification (OPTIONAL in v1.1):
  ✓ Hash chain present and verified (enhanced integrity)

Layer 2 - Merkle Root Verification (RFC 6962):
  ✓ Merkle root verified: b632b62f4350aed34bf8e3ac508ceb8b...
    Tree rebuilt from 24 event hashes

Layer 2 - Merkle Inclusion Proof Verification:
  ✓ Event 01943af3-21c0-7440... inclusion verified
  ✓ Event 01943af3-2544-7cab... inclusion verified
  ✓ Event 01943af3-2bf2-775b... inclusion verified

Layer 3 - External Anchor Verification:
  ✓ Anchor IBKR_ANCHOR_20250106_193500 verified
    Target: TIMESTAMPING_AUTHORITY

Event Type Distribution:
  ACK: 4
  CXL: 2
  EXE: 3
  INIT: 1
  MOD: 2
  ORD: 5
  PRT: 1
  REJ: 1
  SIG: 5
  VCP_ANCHOR: 1
  VCP_BATCH: 1

======================================================================
Overall: ✓ CRYPTOGRAPHICALLY VERIFIED

This evidence pack is fully compliant with VCP Specification v1.1:
  - Section 5.5: PolicyIdentification ✓
  - Section 6: Three-Layer Architecture ✓
  - Section 2.1: External Anchor REQUIRED ✓

All hashes, proofs, and anchors have been independently verified.
======================================================================
Enter fullscreen mode Exit fullscreen mode

Manual Hash Verification

Don't trust the verification script? Here's how to verify manually:

import json, hashlib

def verify_single_event(event):
    """Manually verify one event's hash"""
    header = {k: v for k, v in event['Header'].items() if k != 'EventHash'}
    payload = {k: v for k, v in event.items() if k != 'Header'}

    canonical = json.dumps(header, sort_keys=True, separators=(',', ':'))
    canonical += json.dumps(payload, sort_keys=True, separators=(',', ':'))

    computed = hashlib.sha256(canonical.encode()).hexdigest()
    stored = event['Header']['EventHash']

    print(f"Computed: {computed}")
    print(f"Stored:   {stored}")
    print(f"Match:    {computed == stored}")

# Load and verify
with open('events.json') as f:
    data = json.load(f)

verify_single_event(data['events'][0])
Enter fullscreen mode Exit fullscreen mode

Regulatory Alignment

The evidence pack demonstrates alignment with multiple regulatory frameworks:

SEC Rule 17a-4 (US Records Retention)

Requirement VCP Implementation
Immutability Three-layer cryptographic architecture
Retention Period 6 years minimum (configurable)
Audit Trail Complete order lifecycle
Accessibility Machine-readable JSON format

FINRA Rule 4511 (Books and Records)

Requirement VCP Implementation
Order Records All orders logged with timestamps
Modification Records Full MOD event chain
Cancellation Records CXL events with reason
Execution Records Fill details with venue

MiFID II RTS 25 (EU)

Requirement VCP Implementation
Timestamp precision MICROSECOND (Gold Tier)
Decision logging Governance.DecisionReason
Algorithm identification AlgorithmName/Version

EU AI Act Article 12

Requirement VCP Implementation
Automatic logging Continuous event capture
Traceability Hash chain + Merkle proofs
Event reconstruction Complete state machine

GDPR Compliance: Crypto-Shredding

For EU operations, VCP supports crypto-shredding to comply with GDPR Article 17 (Right to Erasure) while maintaining audit integrity:

┌─────────────────────────────────────────────────────────────────┐
│                    CRYPTO-SHREDDING ARCHITECTURE                │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│   VCP Event (Stored)           │   Encryption Layer            │
│   ┌─────────────────────┐      │   ┌─────────────────────┐     │
│   │ Header (Clear)      │      │   │ KEK (Master Key)    │     │
│   │  - EventHash ✓      │      │   │ ↓                   │     │
│   │  - Timestamp        │      │   │ DEK (Per-User Key)  │     │
│   ├─────────────────────┤      │   │ ↓                   │     │
│   │ PII Fields (Enc)    │◄─────┼───│ Encrypted PII       │     │
│   │  - AccountID: ***   │      │   │ (Delete DEK =       │     │
│   │  - Name: ***        │      │   │  Crypto-Shred)      │     │
│   └─────────────────────┘      │   └─────────────────────┘     │
│                                │                               │
│   Hash computed over           │   Erasure method:             │
│   encrypted data →             │   Delete DEK, data becomes    │
│   Hash remains valid           │   irrecoverable               │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

Key insight: The event hash is computed over encrypted PII fields. When you delete the encryption key, the PII becomes irrecoverable, but the hash remains valid. You can still prove the event existed and wasn't tampered with—you just can't read the PII anymore.


Getting Started

Prerequisites

  • Python 3.8+
  • Interactive Brokers account with FIX API access
  • (Optional) VCP Cloud account for anchor services

Quick Start

# 1. Clone the repository
git clone https://github.com/veritaschain/vcp-ibkr-rta-reference.git
cd vcp-ibkr-rta-reference

# 2. Install dependencies (minimal)
pip install -r requirements.txt

# 3. Verify the sample evidence pack
cd evidence_pack
python verify.py

# 4. (Optional) Run with your own IBKR FIX session
cp config.example.yaml config.yaml
# Edit config.yaml with your IBKR credentials
python sidecar/main.py
Enter fullscreen mode Exit fullscreen mode

Repository Structure

vcp-ibkr-rta-reference/
├── README.md
├── evidence_pack/
│   ├── events.json              # VCP events
│   ├── events.jsonl             # Events (line-delimited)
│   ├── batches.json             # Merkle batch with proofs
│   ├── anchors.json             # External anchor records
│   ├── fix_messages.jsonl       # Source FIX messages
│   ├── mapping.md               # FIX → VCP field mapping
│   ├── verify.py                # Verification script
│   ├── certificates/            # Per-event certificates
│   ├── keys/                    # Public keys (JWK/PEM)
│   └── verifier_outputs/        # Pre-computed reports
├── sidecar/
│   ├── main.py                  # Sidecar entry point
│   ├── fix_parser.py            # FIX message parsing
│   ├── vcp_transformer.py       # FIX → VCP transformation
│   ├── merkle.py                # Merkle tree implementation
│   └── anchor.py                # TSA anchor submission
└── docs/
    ├── ARCHITECTURE.md
    ├── FIX_MAPPING.md
    └── DEPLOYMENT.md
Enter fullscreen mode Exit fullscreen mode

What's Next

For Individual Developers

  1. Try the verification script on the sample evidence pack
  2. Study the FIX→VCP mapping in mapping.md
  3. Fork and adapt for your own broker integration

For Firms

  1. Request a PoC at enterprise@veritaschain.org
  2. Schedule a demo of VCP Cloud services
  3. Evaluate VC-Certified compliance program

Standards Development

VCP is on track for IETF standardization:

  • IETF Draft: draft-kamimura-scitt-vcp
  • Working Group: SCITT (Supply Chain Integrity, Transparency and Trust)
  • Status: Individual submission, seeking adoption

Conclusion

The VeritasChain Protocol transforms "trust me" into "verify this."

In an era where AI-driven trading systems make millions of decisions per day, cryptographic verifiability isn't a luxury—it's a necessity. The VCP-IBKR reference implementation demonstrates that:

  1. Non-invasive integration is possible via sidecar architecture
  2. Strong cryptographic guarantees can be achieved with standard primitives
  3. Regulatory compliance and verifiability can coexist with operational efficiency

We believe that open standards, not proprietary solutions, are the path to trustworthy algorithmic markets. That's why VCP is CC BY 4.0 licensed and we're pursuing IETF standardization.

The flight recorder for AI is here. Will your algorithms be transparent?


Resources


VeritasChain Standards Organization (VSO) is a non-profit, vendor-neutral standards body. This reference implementation is provided under Apache 2.0 license for educational purposes.


Tags: #cryptography #trading #algorithms #fintech #audit #compliance #security #blockchain #merkletree #opensource

Cover Image Credit: VeritasChain Standards Organization

Top comments (0)