Eleven states. Five pre-trade checks. One audited path to fill.

Every order in Modir is owned by a tradeOrderWorkflow in Temporal. The workflow walks through eleven states — draft, submitted, checks_running, checks_failed, pending_approval, approved, routing, working, partial, filled, cancelled — and each transition is a signal, not a database write. State is durable; if the worker restarts mid-route, the order picks up exactly where it was.

Pre-trade checks run as Open Policy Agent decisions in data.ai_actions and data.suitability packages. The five checks — suitability (risk tolerance vs instrument risk), restricted-list (per-tenant, per-jurisdiction blocklists), concentration (single-position limits), AML (large cash, structuring, jurisdiction-mismatched transfers), and jurisdiction (per-residency rules) — return one of allow, warn, deny. A warn surfaces in the UI but does not block; a deny blocks.

Approval routing is policy-driven: orders above a notional threshold for a given client risk tier require senior-advisor or supervisor approval. The approver sees the OPA decision rationale (per check, with the matching policy data row) and signs off — or rejects with a reason. Approved orders route to the FIX gateway: a Spring Boot service running QuickFIX/J 2.3, with NewOrderSingle out and ExecutionReport back via webhook into the API.

For staging, an embedded FIX simulator answers as a counterparty would: partial fills, cancels, rejects, mass-cancel events. CI runs the full state machine against the simulator on every PR.