King Hippopotamus

Case study

How this VPS runs

Nine methods, one host. The map: research programmes, source admission, a governed platform, and a gate that refuses on the way out.

Context

Nine chapters on this site describe nine methods. Not one of them shows the thing they are part of, and a reader asked to assemble it from nine documents will not assemble it at all. This page is the map.

The estate is one virtual server. One person built it over 4 complete months of dated artifacts, using agent tooling for the mechanical work. There is no cost figure anywhere in it — no measured spend, no compute or storage accounting was ever kept — so the only honest statement about cost is the bounded one: one host, one operator, no fleet, and every scheduled job on it enumerable in a single command.

And nothing here has been audited by a third party. Every number on this site was measured on the host it describes, by the person who built it. The defence against that is not a credential. It is that each figure carries the command that produced it, and that the claims which did not survive verification were withdrawn before publication rather than restated.

What I built

Read the map left to right. A programme is written before a build: vision, objective matrix, source census, gates. Sources are admitted one at a time, each becoming a collector with its own schema contract and crash-resume. Collection runs on a clock — 54 scheduled jobs, 43 timer units and 11 cron lines. What lands is governed: 397,679,393 rows across 28 named surfaces, one writer per database, a nightly contract that names the holes by name. Watchdogs reconcile the collectors from outside. A security office spans the whole width. Work is delegated against written charters — declared write scopes, fixed escalation paths, a hard tool-call cap per stage. Seven seats are chartered; the four that constitute the data office are designed governance rather than a running office, because the shared state store their charters require is absent from the host. Everything published leaves through one gate.

Order of construction: the security office opened in March, the session changelog in April; the dead-man's switch armed and the gate ledger opened in June; the secrets consolidation, the identity-hygiene law and the live transcript feed all landed in July; August was audits.

What review has caught: an INNER JOIN hid more than half of a corpus's text from every query that read it. A review found a date fallback joining calls to the wrong quarter. A continuity cursor sealed a filing family against every future run. None of them raised an error.

The nine chapters: research and discovery; source admission; platform architecture; automation and reliability; security and governance; agent operations; products and tooling; outputs and the honesty loop; transcript intelligence.

System map — layers left to right, the gate on the exit, the verify lane severed

System map of the estate SECURITY OFFICE · permission matrix · risk register · decision log (4 rulings, 510 lines) · host sensor, 10 layers, 1,611 lines PROGRAMMESOURCE ADMISSIONON A CLOCKGOVERNED PLATFORMAGENT ORGANISATIONOUTPUTS WATCHDOGS · reconciliation against an independent expectation · incident ledger · dead-man’s switches that watch from outside INDEPENDENT VERIFY — severed lane vision · matrixcensus · gates schema contractcrash-resume 54 jobs: 43 timers+ 11 cron lines 54 databases397,679,393 rows 7 seats charteredwrite scopes, caps reports · packageshonesty loop re-runs the previous stages’ commands from a fresh context; sees only the raw record and the built page. First verdict returned: FAIL. publicsurface GATE one writer per database 4 designed, not operating no shared context Left to right: the programme is written first, sources are admitted one at a time, collection runs on a clock, everything published leaves through one gate. The verify lane is drawn severed because it is: it re-derives the numbers rather than reading how they were derived.

Decisions

  • Chose one host with declarative scheduled units over a distributed stack with an orchestrator, because the failure I actually fight is absence of data mistaken for knowledge, and a surface I can enumerate in a single command makes absence loud where a fleet would bury it.

  • Chose a refusal at write time over a review step after publication, because a coverage contract that raises at the call site cannot be argued with — and a contract older than 36 hours counts as no contract at all, with no override parameter to reach for.

  • Chose an independent verification stage that re-runs the previous stages' commands from a fresh context over a self-report from the stage that did the work, because a gate that only ever passes is decoration — this one returned FAIL on the first case study, with six claim-level mismatches.

Evidence

Research artifact · evidence ledger

ClaimHow it was checkedStatus
The data platform holds 105.4 GB (98.2 GiB) of database files across 54 files; the whole platform tree is 114.4 GB (106.5 GiB).find $FIN/Data -name '*.db' -type f -printf '%s\n' | awk '{s+=$1}END{print s}' ; du -sb $FINpublished
397,679,393 rows sit under governance across 28 named surfaces.row count per surface, read-only, summed over the 28 surfaces in the figures ledgerpublished
The scheduled surface is 54 jobs: 43 timer units loaded and scheduled, plus 11 active cron lines.systemctl --user list-timers --all --no-legend | wc -l ; crontab -l | grep -vcE '^\s*(#|$)'published
The security decision log carries 4 dated rulings over 510 lines; the rulings run 2026-07-23 to 2026-08-23, and the file's earliest referenced date is 2026-03-30.grep -cE '^## 20' <office>/DECISION-LOG.md ; wc -l ; dates of the first and last ## 20… section headspublished
The host sensor is a single file of 1,611 lines using the standard library only, and samples 10 named layers.wc -l <sensor> ; layer table in the sensor sourcepublished
The agent organisation is 8 charter files covering 7 distinct seats, with 1 role retired to an archive.ls -1 <roster>/*.md | wc -l ; grep -h '^name:' <roster>/*.mdpublished
The transcript corpus is 12,171 deduplicated calls across 3,652 tickers, 2021-03-10 to 2026-08-21.SELECT COUNT(*), COUNT(DISTINCT ticker), MIN(call_date), MAX(call_date) FROM calls (mode=ro)published
The three published Python packages install and run from a clean environment at their published versions.fresh-install check per package into a clean environment — install from the public index, then run the CLI --help, and for the CAD server import the installed server module: CAD server 0.2.2 PASS, vault 3.2.2 PASS, XBRL server 2.1.1 PASS; the end-to-end harness returns 15 pass / 1 fail, the one failing check being the one that reads the currently published site, which predates this runpublished

12 claims tested · 8 published · 4 withdrawn before publication. Full evidence record available on request — king.hippopotamus@yahoo.com.

Published claims and the verification policy →

Limitations

  • Nothing here has been audited by a third party. Every figure was measured on the host it describes, by the person who built it; the command is the only warrant offered.

  • There is no cost figure. No spend, compute or storage accounting was ever recorded, so cost can only be stated as a bound — one host, one operator, 4 complete months — never as a number.

  • Figures measured on one date do not generalise to another. The integrity run covered 40 of 40 databases in scope on 2026-08-09; the estate holds 54 today, and the difference is not a claim about the other 14.

  • This is not a claim that the pipeline has never missed a night, and not a claim of adoption for anything shipped. What the record supports is that the dead-man's switch has written no missed-run alert since it was armed on 2026-06-05.

  • This is a private research estate, not a licensed or redistributable market-data product, and nothing here carries redistribution rights.

Links

Evidence

No demo — The estate is a private operating environment, not a demo: it carries live data and a public identity, so there is nothing to open. Every claim below is shown as the command that produced it instead.

Authorship

I am the architect and author of record; drafts were produced by agent tooling under my protocol and every sentence was approved by me before publication.

Author approval — 2026-08-23, hash 5a3efb34