Every number defends itself — Field Notes

A wrong option price looks exactly like a right one. That single fact shapes everything about how QuantFlex is engineered — anchors for every pricing path, three independent witnesses for every Greek, and a static gate that keeps the "hand-rolled" claim from quietly becoming a lie.

Most software tells you when it's broken: the page 404s, the test goes red, the user files a bug. Numerical software doesn't extend that courtesy. A Monte Carlo engine with a subtle drift bug will happily print 13.58 where the truth is 13.62, with the same confident formatting, forever. Nobody's eye catches it. No exception fires. The only defence is to build the system so that every number has to survive an ambush before it's allowed on screen. In QuantFlex that discipline has three layers.

Layer one: anchors

The house rule is blunt: no pricing path ships without an anchor test. An anchor is a case where the truth is known exactly, so the engine can be checked against reality rather than against itself:

Closed-form Black–Scholes. Set the model to plain GBM and a European vanilla has an analytic price. The Monte Carlo and PDE engines must reproduce it to tolerance — not "look reasonable", reproduce it.
Put–call parity. A model-free identity: if C − P ≠ S·e^−qT − K·e^−rT, something is wrong somewhere, and the test refuses to care about excuses.
Cross-method agreement. The Crank–Nicolson PDE solver and the Monte Carlo engine share no code, no discretisation, no failure modes. When two strangers agree on an American option price to a few basis points, that agreement is evidence. When they drift apart, one of them is lying and the build fails until I know which.

Anchors work because they're independent of the thing they check. A unit test that asserts the code does what the code does is a tautology with a green checkmark. An anchor asserts the code agrees with mathematics.

Layer two: three witnesses per Greek

Greeks — the sensitivities desks actually trade on — are more dangerous than prices, because a plausible-but-wrong delta actively mis-hedges you. QuantFlex computes every Greek three ways:

the hand-built AAD tape — the product code path, automatic differentiation written from scratch;
JAX — an industrial autodiff system that shares zero lineage with my tape;
finite differences — the dumb, slow bump-and-reprice that's hard to get subtly wrong.

Agreement between all three is required before a Greek is believed. The reasoning is jury logic: any one witness can be fooled — the tape by a bug I wrote, finite differences by step-size noise — but they fail differently, so collusion is close to impossible. It's the same instinct as the PDE-vs-MC anchor, applied one derivative deeper.

Layer three: the import gate

QuantFlex's pitch includes the phrase "hand-rolled solvers", and a claim like that rots silently: one convenient scipy.linalg.solve_banded in a hot path, eighteen months from now, and the README is fiction. So the claim is enforced by machine: a static AST walk over the numerical core's import graph fails the build if a library solver appears outside the clearly-marked anchor lane — the one place SciPy is welcome, because checking your work against a reference implementation is the entire point of a reference implementation.

I'd generalise this further: any claim you make about your architecture should be a test. "The core has no network calls", "the parser never throws", "this module doesn't import that one" — all of these are one AST walk away from being guarantees instead of aspirations.

The supporting cast

Two smaller disciplines hold the layers together. Fixed seeds: every simulation is reproducible by construction, because "it failed once, randomly" is the worst bug report in numerical computing and seeded streams make it extinct. Fail-fast parameter guards: Heston with 2κθ < ξ² violates the Feller condition, and the engine refuses the input with a named reason instead of returning a number that looks fine and means nothing. A rejected request is annoying; a silently garbage price is a trap.

Why bother, for a free web tool?

Because the correctness machinery is the product. Plenty of repos price options; the interesting question a quant interviewer — or a user — should ask is "why should I believe your numbers?", and QuantFlex's answer is designed to be better than "trust me": here are the anchors, here are the three witnesses, here is the gate that keeps the claims honest, all running in CI on every commit. The walkthrough in the screening room ends on exactly that beat, because it's the beat that matters.

The transferable version, for any domain where wrong output looks like right output — pricing, ML pipelines, analytics, payroll: find your closed forms, hire independent witnesses, turn your architectural claims into tests, and make invalid inputs loud. Correctness isn't a property you have; it's a property you keep proving.