TokSeq documentation/Execution
How paper desks are constructed, how fills and costs are simulated honestly, what the risk gates do, and what a strategy has to prove before it is promoted.
Between a research finding and any claim about money there is a forward stage, and the platform treats it as a separate discipline with its own failure modes. A backtest that passes every statistical gate can still be destroyed by fills, fees and the market of the window – and in this platform's history, it was.
The paper desk layer is a consumer, not a participant. It reads published engine snapshots and closed bars, and maintains independent synthetic portfolios. It has no path into the live decision loop and cannot influence a single signal.
Design rules:
Agents are organized in tiers – controls, validated, hypotheses – and in density layers: base cards, parametric mutations of those cards, and noise seeds. Context twins duplicate a card with an added information source so that the marginal value of that source is measurable rather than assumed.
Fill simulation is deliberately pessimistic in every ambiguous case:
Where a desk needs real quotes and real fills, it runs against an exchange demo environment through a bridge with one architectural safeguard: the demo host is a constant, verified in the constructor against an allowlist. The bridge will not accept a production trading host from an environment variable or from an argument. That is a structural property, not a convention.
The bridge signs requests with a rotating timestamped signature, enforces idempotency through client order identifiers so that a retried request cannot become a second position, retries only on network errors and a declared allowlist of response codes, and polls executions rather than trusting an acknowledgement.
Two operational rules follow from live incidents: a limit order that does not fill produces an explicit no-fill event rather than a silent retry, and a two-legged structure where only one leg fills is an incident that is unwound immediately.
Gates are applied in a fixed order and every one of them can only downgrade:
| Gate | Effect |
|---|---|
| Data lag | If the data layer falls behind its bound, every signal in the cycle is marked stale |
| Staleness | A signal older than its declared lifetime relative to the freshest signal in the batch is stale with zero confidence |
| Volatility veto | When the volatility core vetoes, any directional signal is suppressed. The veto outranks direction by design |
| No volatility estimate | Without a fresh volatility assessment, direction is not shown at all |
| Regime scope | A signal validated only for one regime is suppressed outside it |
| Volatility recheck | When an hourly direction is carried into a five-minute snapshot, it is re-tested against current volatility, and both suppression and restoration are logged |
| Quorum | Below the required share of live committee members, the output is abstention |
| Disagreement | Above the dispersion threshold, the output is abstention |
| News age | A stale news feed suppresses the sentiment contribution rather than ageing it |
The veto rule itself is a pre-registered heuristic: stress regime, or realized volatility above a causal high quantile of its own distribution. It is intentionally conservative, because a false veto costs an abstention while a missed one costs a position.
Position sizing risks a fixed small fraction of the account per trade, caps size at unlevered notional, sets stops as a regime-dependent multiple of average true range, targets a fixed profit-and-loss volatility per unit time, caps leverage, and damps leverage further when expansion probability is high. Leverage depends only on volatility. Directional confidence is never mixed into it.
Live compositions are monitored per member. Each member's probability output is logged, settled against closed bars, and compared to the out-of-sample interval registered at admission.
Admission is binary and so is removal. If any active member breaks its registered interval, with a confirmation requirement to avoid acting on a single reading, the entire composition falls back to a previously registered alternative or freezes. There is no re-weighting, no threshold adjustment and no partial degradation in production. Member status moves in one direction only: active, watch, retired. Return to service requires offline re-validation.
If the engine cannot persist its own state, it freezes and writes a marker that survives a restart, and only an operator can clear it. Until then, direction abstains across all assets. The reasoning is that an unobservable risk system is worse than an absent one.
A desk agent is promoted from hypothesis to validated only against frozen thresholds, evaluated on forward trades exclusively and never on the backtest:
The default verdict is "insufficient evidence". A card that has not met the counts is not "promising", it is unproven, and it is displayed as such.
Over five and a half weeks with 152 agents: 323 million dollars of turnover, gross profit about 25 000 dollars, net result about minus 369 000 dollars after costs, which is minus 11.4 basis points on turnover. Fees consumed roughly a quarter of the capital deployed across the agent pool. Twenty-three agents finished positive; two had a lower confidence bound above zero. The three underlying assets rose 22.7, 29.5 and 41.4 per cent over the same window.
The platform publishes that number to itself in exactly this form, because it is the single most useful thing it has learned about execution: at retail cost levels, on short horizons, transaction cost is not a correction term. It is the dominant term.