Nishi Sovereign ProgramUS marketevidence-first
Car-Flip ROI Engine
A sovereign engine that buys only winning used cars: identify every part → its failure probability, repair cost, ease of repair, and 3D-printability → and gate the purchase on downside-positive ROI.
The decision rule. All-in = purchase + repair + recon + transport + fees + holding. Profit = resale − selling − all-in. BUY only when the P10 (bad-case) profit ≥ 0 — not the P50. Most flippers lose because they price the happy path and get killed by a repair they didn’t see. Pricing the repair bill as a distribution is the entire edge.
2026-07-25 — the engine went multi-asset, on live feeds
The same downside-first engine now runs five organs behind one regression gate: nx_flip_worklist (what to inspect) → nx_flip_score (part-by-part flip points + coverage gate) → nx_flip_real (real value vs nominal + triangulated manipulation gate) → nx_flip_defl (real gain vs monetary debasement) → nx_flip_gate (21/21 GREEN, every claim below re-runnable).
Two further gates keep the inputs honest, not just the arithmetic: nx_feed_gate (7/7 GREEN, runs hourly) forks the real fetcher at every external data feed and asserts a live 200 — because on 2026-07-25 a shared-fetcher change silently broke three feeds for a day and nothing caught it; and nx_p384_ecdh_gate (7/7 GREEN) proves our P-384 elliptic-curve key exchange against the published RFC 5903 test vectors, in both directions plus two negative controls — that code was deployed but had never once executed against a known answer, since no server had yet chosen the curve. A fourth, nx_tls12_prf_gate (7/7 GREEN), proves the TLS 1.2 key-derivation function against its published vector, and carries a control that deliberately corrupts an expected byte to prove the comparator can actually report a mismatch — a test that cannot fail is not evidence. 48 assertions across four gates, each re-runnable and each emitting a machine-readable verdict — and now a single command that answers whether all of them are green, which raises its own alarm when they aren’t.
The alarm finally rings. Getting a failing check noticed took four separate steps, and each one looked finished from the outside. The check had to actually run; then it had to record its result, because the scheduler throws away what a job prints; then something had to read those records; and finally something had to speak up without being asked. That last step is done: when the roll-up finds a failure it files an item on the work board, which is already the first thing read at the start of every session. No new dashboard, no new notification system — it reports into the channel that is read anyway. It is deliberately worded identically every time, so a fault that persists for a week raises one item rather than a hundred and sixty-eight.
Recorded is not the same as noticed. Last step made every check write its own dated verdict to a file. That fixed the silence but created a subtler version of it: a failure sitting in a file nobody opens has still gone unnoticed. So there is now one command that reads every check’s latest verdict and answers the only question that matters — are we green? It refuses to guess: a check whose record is missing, empty, or unreadable counts as failed, not as fine, because “I couldn’t tell” reading as “all clear” is precisely the failure being designed out. Proven in both directions, including pointing it at a check that doesn’t exist to confirm it goes red rather than shrugging. The roster is a config line per check, so adding one never means editing code.
We checked whether “runs hourly” actually meant anything — and it half didn’t. The scheduler really does run these checks on schedule; that part was true. But reading its code showed it only records that a job ran, never whether the job passed, and it discards what the job printed. A failing check would have failed in silence. Rather than change a scheduler every other job depends on, each check now writes its own dated verdict to a durable file. Proven in both directions: a normal run records a pass, and a deliberately broken run records a failure with the specific checks that broke. Still honest about what is left — the record persists, but nothing yet raises an alarm from it, and the other scheduled jobs remain blind to their own exit codes.
Real commodity positioning data is in. Reading the futures regulator’s weekly positioning report required teaching the client to reassemble responses that arrive in pieces — without that, the data came back cut off mid-record, and the framing markers leaked into the numbers. Now it reads clean: as of 21 July, speculators in Chicago wheat held 109,575 long against 116,584 short — net short — while commercial hedgers sat net long. That is exactly the kind of divergence the engine is built to price. A fifth source, the Department of Agriculture, also came within reach as a side effect.
And commodities still refuse to score — correctly. Five inputs are mandatory before a commodity gets a verdict; three now have real data and three do not. The engine will not produce a number from a partial picture, which is the same rule that stops a half-inspected car being called a good buy. Positioning is a useful signal, not a substitute for knowing what the thing costs to produce.
We audited our own work and found we had repeated ourselves. The three test harnesses built this week had each grown a private copy of the same half-dozen helper routines — the exact drift an earlier part of the system had already paid to fix. Left alone, a correction to one copy silently fixes only one harness. So the shared version was extracted and all three folded onto it, one at a time, each required to produce the identical number of passing checks before the next was touched. Every count matched: 7, 7, and 11. The code is around 1,900 characters smaller and the tests prove exactly what they proved before — which is the only acceptable outcome for a cleanup.
All four blocked feeds are open. Labor statistics, Treasury, water data, and now commodity-futures positioning — every one returning real data over a channel where the other end has proven who it is. The last holdout signed with a stronger hash than anything we had implemented, so we built that verifier from the existing one, changing only the three things that actually differ. It verified against the live server on the first attempt, and its sabotaged twin still refuses. Positioning data is what the commodity and currency models have been missing.
Three of the four blocked feeds now return real authenticated data. US Treasury exchange rates and USGS water data both come back as verified JSON, alongside labor statistics. Getting there meant fixing two bugs the authentication work exposed. Different agencies sign with different key sizes, and only one size was wired — so Treasury and USGS were being rejected as malformed when their signatures were simply shorter. And the client had a request line hardcoded from an unrelated project, so it authenticated perfectly and then asked every server for the wrong page — which is why the replies looked like “not found” rather than a failure.
The same read turned up something more serious: the client was attaching a stored API credential to every outbound request, whatever host it was pointed at. We checked before assuming — the credential file does not exist on this machine, so the header always went out empty and nothing was ever transmitted. The code has been removed regardless. A credential belongs to one destination, never to whatever address it is handed.
The lock is closed — the blocked government feeds are now usable. Validating a certificate proves only that someone holds a certificate for that name; certificates are public, so an impersonator can present the real one while substituting their own key. What closes that gap is the server signing the key exchange with the certificate’s private key. That signature is now verified, and against the Bureau of Labor Statistics the channel reports authenticated: a four-certificate chain, plus a valid 4096-bit signature binding this specific key exchange to that certificate. Real data now flows with no override.
The claim is only worth what its counter-test is worth, so there is a deliberately sabotaged twin of the client — byte-identical except one flipped bit in the signed material. It must refuse, and it does. Both the success and the sabotage run hourly: if the signature check ever goes soft, the twin starts passing and the gate turns red.
Half the lock is now built. The older-protocol channel now performs full certificate validation — chain of trust, hostname, and expiry — against the same Mozilla root store our modern stack uses, by translating the older message format into the newer one so the already-proven validation code does the work. Against the Bureau of Labor Statistics it validates a real four-certificate chain. More importantly it can refuse: a certificate issued for the wrong hostname, an expired one, and a self-signed one each get rejected with a different diagnostic code — so the validator is discriminating between failures, not just failing. A validator that can never say no would launder a hostile certificate into a green light, so that rejection is itself now a standing hourly test.
We can now reach the blocked government feeds — and we deliberately refuse to use them yet. Four sources we want (labor statistics, commodity futures positioning, Treasury, water data) only speak an older encryption protocol our stack didn’t support. We found a client for it already built in-house, and it works: a complete handshake to the Bureau of Labor Statistics, real data decrypted. But reading the code showed it never checks who it is talking to — no certificate validation, no signature verification — while its own output announced an “AUTHENTICATED” response and declared itself ready to ship. An impersonator would have produced identical output. So the channel is now fail-closed by construction: it refuses to hand over any data at all unless a caller explicitly types an override, and that refusal is itself a gated test — if a future change ever makes the unauthenticated path emit data by default, the gate goes red. Market data that can’t prove its source is worse than no data, because you would act on it.
The guard that blocked its own fix. Adding two of those gate cases was refused by our build-time rule enforcement: it counted ten new “magic numbers” and told us to run the auto-fixer. The auto-fixer reported nothing to do. Both were right — every one of those ten numbers lives inside a string (test arguments like 2011-10), which the fixer skips by design and the counter did not. A refusal whose prescribed remedy was provably impossible. We fixed the counter to match the fixer, and proved it two ways before shipping: a local replica reproduced the live numbers exactly (57 and 67), and a deliberately planted probe confirmed the corrected counter still catches real violations rather than simply returning zero. Counts can only fall and each baseline re-records on the next build, so nothing that built before can newly fail. The two blocked cases then built and passed.
Money supply, measured against itself. With live US Federal Reserve data (M2, 2011–2026) the engine reads the long window bluntly: an asset up +140% in nominal dollars since October 2011 is up −0.21% in real terms — the money supply grew 140.5% over the same span. Priced in wheat, the picture is worse: wheat fell 3.8% nominally and 13.3% in real terms over the last two years. Same engine, same discipline, now on both euro and dollar numeraires.
Live demonstration, real central-bank data. Euro-area M2 (ECB, 30 monthly observations through 2026-05, fetched over the sovereign TLS stack): money supply grew +8.40% over the window 2023-12 → 2026-05. An asset that gained +8% nominal over that window is a real loss (−0.37%) — verdict ILLUSORY. A +30% gain kept only ~2/3 of itself after debasement. Nominal gains are not wealth; the measuring unit shrank.
Working keyless feeds today (all over our own TLS 1.3 stack, no API keys): SEC EDGAR XBRL (equity fundamentals) · EDGAR full-text search (enforcement-practice discovery) · NHTSA recalls + complaints (vehicle failure priors) · ECB data portal (FX daily + euro M2) · World Bank API · Federal Reserve H.6 (historical). Asset-class catalogs are live for CAR, REALESTATE, EQUITY, COMMODITY, FOREX and HARDASSET — classes without price feeds refuse to score and instead print an itemized list of exactly which mandatory data is missing. Absent input is a finding, never a neutral.
Honest gaps (do not trade on these numbers). Repair/lift figures in the demo deals are illustrative; commodity spot prices need one free FRED API key (endpoint proven reachable); CFTC positioning data sits behind a TLS 1.2-only wall (a named next arc); manipulation evidence rows carry a regulatory column only and stay UNPROVEN until triangulated across three independent evidence classes.
Why recalls alone lie — a live example
Real NHTSA data, pulled over the sovereign TLS stack for a 2013 Ford Focus (a classic cheap-to-buy flip candidate): 12 safety recalls — fuel-system stalls, door latches, wiring, a block-heater fire risk.
But the car’s #1 real-world failure has ZERO recalls here. The DPS6 dual-clutch (PowerShift) transmission — shudder, clutch and TCM failure — was handled by warranty extension and class action, not a safety recall. A recall-only failure feed rates this car clean and walks you into a $1,500–3,500 trap. This is exactly the blind spot the engine exists to catch: failure priors must fuse recalls + complaints + TSBs.
Vehicle system taxonomy (the explode tree)
All 16 SAE-standard systems — the top of the exploded-view hierarchy — seeded and verified in the sovereign store (carflip-sys-). The safety fence lives in the data, not in a promise:
| System | Fail freq | ROI impact | 3D-print | Safety fence |
|---|
| Engine | high | high | partial | fenced |
| Fuel & air | high | med | med | fenced |
| Cooling | high | med | med | partial |
| Transmission | med | high | low | fenced |
| Electrical | high | med | low | open |
| Electronics/ECU | med | high | low | open |
| Suspension | high | high | low | fenced |
| Steering | med | high | none | fenced |
| Brakes | high | high | none | fenced |
| Wheels/tires | high | med | none | fenced |
| HVAC | med | med | med | open |
| Body/glass | med | med | high | partial |
| Interior/trim | low | low | high | partial |
| Restraints/ADAS | low | high | none | fenced |
| Fluids/wear | high | med | low | open |
The 3D-print safety fence (rule 26 for road-parts)
Printable parts — clips, brackets, trim, ducts, housings, shrouds — can be made in-house for filament cost instead of OEM markup, which lowers all-in cost and flips more cars positive. But this is hard-bounded by construction: any load-bearing, brake, steering, crash, or airbag part is fenced from printing. A print candidate that is structural without a fence returns VERDICT RED, the same never-brick gate discipline the ecosystem uses for firmware. A printed part that fails can kill someone — so the fence is not optional and not a runtime flag.
Object model (DV2.0, schema-first)
PartNode → { WearPart · MechanicalPart · ElectronicPart · BodyPart }
Eight satellites hang off hub_part × hub_vehicle, joined by link_vehicle_part (the BOM): sat_part_taxonomy (explode vector + mesh), sat_part_failure, sat_part_repair, sat_part_ease, sat_part_printable (with legal_safety_flag forcing printable=NO), plus a per-vehicle mileage-conditioned failure prior.
Explode view on the sovereign 3D stack
The Nishi render stack already has scene-graph, trimesh-zbuffer, asset-io, and STL export (graphics coverage 804‰). An exploded view is a scene-graph where each part node translates along its explosion axis — composable on what exists. Each part in the explosion is annotated with its failure probability, repair cost, ease, and ROI impact, and printable parts export straight to STL for the shop printer.
Team & RACI
Owned by the real Nishi crew — not placeholder names:
| Rung | Responsible | Accountable | Consulted | Informed |
|---|
| Charter | pm | operator | architect | all-crew |
| R1 Failure feed (NHTSA) | researcher | pm | librarian, analyst | modelwright |
| R2 Repair-cost feed | researcher | pm | data_curator | modelwright |
| R3 Resale comps | analyst | finance | researcher | product |
| R4 Explode view | architect | product | ux, librarian | operator |
| R5 Print + fence | engineer | warden | legal, security | host_operator |
| R6 ROI scorer | modelwright | analyst | critic | finance |
| R7 Taxonomy fill-out | librarian | architect | data_curator | researcher |
Provenance
Failure data is real NHTSA (vPIC + recalls; complaints + TSBs next). Parts prices and labor hours will come from real catalogs and labor guides — no fabricated numbers. System taxonomy and the safety fence are seeded and byte-verified in the sovereign store. Built on the never-brick sovereign stack; every write cap is scoped, audited, and revocable.