Design PFX: Architecture of a complete exchange

Lesson 1.1

Architecture of a complete exchange

What you'll learn

The three-tier shape — stateless edge, deterministic core, asynchronous post-trade — and why state placement is the whole game.

Building on

The four jobs (0.1) and the requirements map (0.2). Here they become boxes with arrows.

Every design decision in this course flows from one question: where does state live? The answer produces three tiers with very different characters:

flowchart TB
    T["Traders — apps, brokers, market makers"]
    subgraph edge["EDGE — stateless, replicated freely"]
        OG["Order gateways"]
        MG["Market data gateways"]
        AG["Account and admin APIs"]
    end
    subgraph core["TRADING CORE — stateful, deterministic, tiny"]
        SEQ["Sequencer"]
        RISK["Pre-trade risk"]
        ME["Matching engine"]
        MDP["Market data publisher"]
    end
    subgraph post["POST-TRADE — asynchronous, eventually consistent"]
        CLR["Clearing and netting"]
        SET["Settlement"]
        SUR["Surveillance"]
        REP["Reporting and audit"]
    end
    T --> OG --> SEQ --> RISK --> ME
    ME --> MDP --> MG --> T
    T --> AG
    ME -- trade feed --> CLR --> SET
    ME -- event copy --> SUR
    ME -- event copy --> REP

The three-tier architecture. Arrows into the core are commands (may be rejected); arrows out are facts (immutable history). Post-trade consumes facts and can lag or replay them.

The edge is stateless. Gateways authenticate sessions, validate message syntax, and translate protocols (FIX or binary in, internal format onward). Because they hold no authoritative state, you can run twenty of them behind a load balancer and lose any of them harmlessly — even at three nines, the edge is effectively free to replicate.

The core is stateful and deliberately tiny. Order books, positions, and risk limits live here. It processes one totally-ordered stream of events (lesson 1.7 makes this precise). Small surface area is a feature: this is the part that must never be wrong, so it must be small enough to reason about exhaustively.

Post-trade is asynchronous. It consumes the core's output feed. If clearing falls five minutes behind, trading continues; it catches up. This decoupling is your first availability lever — it removes four whole subsystems from the critical path, which lesson 0.3 showed is where budget bleeds.

Design note

Real venues follow this shape closely: NASDAQ's INET, LMAX, and most crypto exchanges are "thin deterministic core + wide stateless edge." The pattern's name in the literature is the replicated state machine, and it is the single most important idea in this course.

Key ideas

Stateless edge / deterministic core / asynchronous post-trade.
Commands in, facts out. Post-trade lives off the fact stream.
Keep the part that must be perfect small.

Architecture of a complete exchange

See what actually stuck.