Limen-Capital is an experimental SNN-HFT research stack. It is not a production exchange gateway. Default configuration assumes a single-user, loopback-trust host.

• Live capital / mainnet order routing
• Exchange API key management
• Multi-tenant host hardening beyond user-scoped IPC defaults
• ZAP / client public-key allowlisting for CURVE (see open issue on optional ZAP)

Research default is plain ZMQ on loopback.

Not end-to-end yet: only the Julia brain path currently has CURVE hooks. The bundled Rust publisher/subscriber peers still use plain ZMQ. Setting ZMQ_CURVE=1 on the brain alone will break MarketPulse / ReadoutPacket links until both sides use compatible CURVE roles and keys. Treat this as a future dual-side upgrade (tracked with optional ZAP allowlisting).

When both ends support CURVE:

1. Set ZMQ_CURVE=1 on every peer (brain and muscle).
2. Provide real CURVE material via env only (never commit keys):
   • ZMQ_SERVER_KEY / ZMQ_CLIENT_KEY (and any peer public keys your build expects).
3. Do not treat CURVE alone as multi-user authentication until an allowlist (ZAP) lands.

Do not use a world-predictable path such as /tmp/spikenaut_signals.ipc.

• Default: $XDG_RUNTIME_DIR/limen-capital/signals.ipc when XDG_RUNTIME_DIR is set; otherwise /tmp/limen-capital-$UID/signals.ipc (numeric OS UID). For defaults only, Capital creates the directory and requires mode 0700 (failures abort setup).
• Override: LIMEN_JSON_IPC must be ipc:// + absolute filesystem path with no .. segments (e.g. ipc:///run/user/1000/limen-capital/signals.ipc). Invalid overrides are rejected. An empty override is treated as unset (falls back to defaults). Same-UID isolation applies to default endpoints; override parents are not auto-created or chmod’d — the operator must secure them.
• IPC ownership: before ipc:// bind, the publisher holds flock(LOCK_EX|LOCK_NB) on *.owner.lock for the process lifetime. This counters libzmq’s unlink-on-bind steal of a live socket among cooperative Capital publishers. The lock file is left on disk (not deleted on shutdown) so ownership stays tied to a stable inode; the flock ends when the process exits or shutdown closes the fd. Non-flock binders on the same path are outside this protocol and are not protected.
• Publisher (strategy/signal_broadcaster.jl) and consumer (execution, LIMEN_WIRE=json) must agree.

If other users can run processes on the same machine:

• Prefer binary loopback with host firewall / namespace isolation, or disable unused listeners.
• Always use user-scoped IPC (defaults above) or a private path via LIMEN_JSON_IPC.
• Treat any non-loopback bind as out of scope for this research threat model.
• Do not place secrets in the tree; use env vars and ignore rules (.env, vault dirs).

1. No ZAP allowlist — CURVE encrypts but does not yet restrict which client keys are accepted.
2. Loopback is not multi-tenant security — co-located attackers with the same privileges can still talk to local sockets.
3. Ghost ledger only — accidental wiring to a live broker is operator error; this repo does not ship exchange keys.

Private vulnerability reports: use GitHub Security Advisories for this repository —

https://github.com/rmems/Limen-Capital/security/advisories/new

Do not file public issues that include live credentials or private keys.