RESEARCH_ONLY · PAPER_TRADING_ONLY · PUBLIC_MARKET_DATA_ONLY · USD_ONLY · NO_REAL_ORDER_CAPABILITY
OV
OV Research Desktop
Codebase-derived project showcase

Architecture

The verified request chain, reconstructed from actual imports and route definitions — not a design document.

Verified chain

  1. React user interface (apps/desktop/src)
  2. Typed API client (@ovr/api-client, packages/api-client)
  3. Tauri/Rust security bridge (apps/desktop/src-tauri/src/main.rs)
  4. FastAPI service (services/ml-api/app.py)
  5. Research-domain modules (src/*)
  6. Binance public-market adapter (src/market_data)
  7. Feature calculation (src/market_analysis)
  8. Strategy and source governance (src/paper_execution/governance_gate.py, src/validation)
  9. Semantic validation (src/extraction, src/validation)
  10. Candidate/rejection decision (src/paper_execution/governance_gate.py)
  11. Paper-observation engine (src/paper_execution/observation_engine.py)
  12. Capital analytics (src/capital)
  13. Reporting and presentation (src/research_terminal/presentation.py, packages/presentation)
  14. Persistence and indexes (data/, vector_store/)

Backend binds to 127.0.0.1 (loopback only) on port 8766 — verified via apps/desktop/src-tauri/src/main.rs's BACKEND_PORT constant and a live loopback check.

System architecture

CODE-DERIVED VISUALISATION
React Desktop UI (apps/desktop/src) Typed API Client (@ovr/api-client) Tauri / Rust Security Bridge (src-tauri/src/main.rs) FastAPI Service (services/ml-api/app.py) Research-Domain Modules (src/*) Binance Public Market Adapter (src/market_data) Capital Engine + Persistence (src/capital, data/, vector_store/)
High-level system architecture generated from verified module/route relationships in this repository.

Frontend-to-backend request flow

CODE-DERIVED VISUALISATION
React screenuseDesktopPayload(path) @ovr/api-clientinvoke("desktop_request") Rust call_backend()adds x-desktop-session FastAPI route_require_session() + _require_csrf() Research-domain module(src/capital, src/research_terminal, ...) redact_sensitive()strips session_id/csrf_token before JS
Frontend-to-backend request flow generated from verified module/route relationships in this repository.

Authentication and Keychain boundary

CODE-DERIVED VISUALISATION
  1. 1User enters credentials in the native login screen (never in a web view field the backend can log)
  2. 2Rust desktop_login calls /api/desktop/login, receives session_id + csrf_token in the JSON body
  3. 3Rust stores the bundle in the macOS Keychain (keyring crate)
  4. 4Every subsequent desktop_request attaches x-desktop-session + x-csrf-token headers
  5. 5redact_sensitive() strips those values from any response before it reaches React

Tauri commands (verified from source)

bootstrap_app desktop_backend_diagnostics desktop_request desktop_login desktop_logout desktop_setup_start desktop_setup_verify desktop_recovery_start desktop_recovery_confirm subscribe_desktop_events

Native desktop build architecture

CODE-DERIVED VISUALISATION
  1. 1React + Vite build (apps/desktop) produces dist/
  2. 2Tauri bundles dist/ with the compiled Rust binary
  3. 3cargo build --release produces the native ovr_desktop executable
  4. 4tauri build packages the .app and .dmg
  5. 5Installed .app hash is compared against the freshly built hash before being trusted