Building apps
App studio
An app on Markets OS is a directed acyclic graph — a DAG — of typed nodes. You build it by dropping nodes onto a canvas and wiring their outputs into the next node's inputs. The graph is the program: it says where data comes from, what is done to it, and where the result goes. There is no free-text back door, which is exactly what makes an app safe to review and safe to run.
The node types
Every node is one of a small, fixed set of kinds, and each kind has a declared input and output shape.
- Source — reads through an MCP connector: a Murex position, a TLM break, a Bloomberg curve. Read-only, allow-listed, audited.
- Transform — pure logic over its inputs: filter, join, aggregate, reprice. No side effects, so it is trivially reproducible.
- Model — calls a governed model (a pricer, a risk sensitivity, an LLM under policy) and returns its output as data.
- Gate — a human-in-the-loop checkpoint: the run pauses here until a person approves, so nothing consequential happens unattended.
- Sink — the only nodes that emit: a report, an alert, or a proposal a downstream service can act on under its own controls.
How a Champion builds one
You start an app, open its builder, and lay out the graph: a source node for the data, transform nodes for the logic, a model node where you need a pricer or a risk number, a gate where a human must look before anything leaves, and a sink for the result. Each save writes an immutable version, so the app has a full, comparable history rather than a single mutable blob.
A worked example: a rates Champion wires a source that reads the desk's swap book from Murex, a transform that buckets DV01 by tenor, a model node that reprices under a shocked curve, a gate for the desk head, and a sink that publishes the stress report. Ten minutes of wiring replaces a spreadsheet nobody could audit.
Versions, then a hand to governance
When the graph is right, you submit the version for review. Building is unconstrained; leaving the sandbox is not. Submitting is the moment the app crosses from "a Champion's draft" to "something the governance pipeline owns" — see the governance topic for what happens next.
Good to know
Because the graph is acyclic and typed, a reviewer can read exactly what an app does without running it — the structure is the specification.
A transform node has no I/O of its own, so the same inputs always give the same output. That is what makes a run reproducible.