# TokSeq – full engineering documentation

TokSeq (Tokarev Sequence) is a privately operated research and analytics platform for financial market microstructure. It runs its own data acquisition layer, its own hypothesis-testing engine with multiple-comparison control, a live multi-core decision engine, and a set of paper trading desks used for forward validation. The platform is engineering work first and a product second: every claim it makes about a market effect has to survive a pre-registered statistical gate before it is allowed anywhere near a live surface.
The platform is built around one uncomfortable finding, established on its own data and repeated six independent times: short-horizon price direction is not predictable at any level this platform can measure. Fifteen thousand directional experiments produced an area under the ROC curve of about 0.52 and zero validated edges. That result is not hidden in a footnote. It is enforced in code – the directional family of hypotheses is frozen, and registering a new one raises an exception unless the freeze is explicitly lifted for a control run.
What is predictable, on the same data and under the same gates, is volatility and market regime. Realized volatility expansion, the transition between regimes, and the premium of implied over realized volatility all clear the gates with substantial margins. The platform's current program follows that evidence: it works on volatility, on regime, and on the structures that monetize them, and it does not sell a directional forecast it cannot defend.

# What TokSeq is

Source: https://docs.tokseq.ru/overview/

A research platform for market microstructure, its scope, its operating principle and the results it is built on.

TokSeq (Tokarev Sequence) is a privately operated research and analytics platform for financial market microstructure. It runs its own data acquisition layer, its own hypothesis-testing engine with multiple-comparison control, a live multi-core decision engine, and a set of paper trading desks used for forward validation. The platform is engineering work first and a product second: every claim it makes about a market effect has to survive a pre-registered statistical gate before it is allowed anywhere near a live surface.

The platform is built around one uncomfortable finding, established on its own data and repeated six independent times: short-horizon price direction is not predictable at any level this platform can measure. Fifteen thousand directional experiments produced an area under the ROC curve of about 0.52 and zero validated edges. That result is not hidden in a footnote. It is enforced in code – the directional family of hypotheses is frozen, and registering a new one raises an exception unless the freeze is explicitly lifted for a control run.

What is predictable, on the same data and under the same gates, is volatility and market regime. Realized volatility expansion, the transition between regimes, and the premium of implied over realized volatility all clear the gates with substantial margins. The platform's current program follows that evidence: it works on volatility, on regime, and on the structures that monetize them, and it does not sell a directional forecast it cannot defend.

## Scope

The platform covers three layers, each an independent service with its own data ownership:

- Acquisition – continuous collection of market microstructure, derivatives, on-chain and macro series into a single source of truth. Forty-five distinct streams are collected today.
- Research – offline hypothesis generation and testing against the collected history, under pre-registration, purged walk-forward validation and family-wise multiple-comparison control.
- Live decision engine – ten decision cores running on closing bars, producing regime, volatility, risk and structure assessments, with an explicit abstain path whenever the evidence is insufficient.

Order execution is manual, or simulated on paper desks and exchange demo environments. The platform does not run automated live trading with real money, and the exchange bridge refuses a production trading host by construction.

Instrument coverage is deliberately narrow at the base and is now being widened. The research history and the live engine were built on three primary assets, because three correlated instruments keep the effective sample honest while the machinery itself is being validated. Coverage is currently being extended across a considerably wider instrument set, and a second, unrelated market is being added for the volatility program – in both cases after a pre-registered transfer probe rather than before it. What is being scaled, what it is waiting on and what was deliberately closed are described in the current program.

## Operating principle: honesty-first

The design rule that shapes everything else is that a system which cannot tell the difference between an edge and luck is worse than no system. Three mechanisms enforce it.

- Abstention is a first-class output. When the direction cores disagree beyond a threshold, when a quorum of committee members is stale, when volatility vetoes, or when a required input is missing, the engine emits an explicit abstain with a machine-readable reason instead of a number. Every suppression is recorded and shown.
- Every retrospective claim carries its sample size and a Wilson confidence interval. Effective sample size is used rather than nominal count, because overlapping labels at a five-minute cadence inflate apparent independence by an order of magnitude.
- Negative results are stored, published internally and acted on. Rejected architectures are not quietly dropped; they are recorded with the number that rejected them.

## Scale of the work

| Layer | Measured volume |
|---|---|
| Data streams collected | 45 (microstructure, derivatives, on-chain, macro, news, prediction markets) |
| Second-by-second completeness | 0.9933 to 0.9938 across the three primary assets |
| First research generation | 74 488 configurations generated, 65 267 completed across five stages |
| Second research generation | 25 187 tasks, 419 945 result rows in the current stage |
| Directional experiments before the family was frozen | 15 003 |
| Live decision journal | 264 723 recorded decisions |
| Paper desk forward record | 152 agents, 36 642 executed trades |
| Instrument coverage | Three primary assets at the base, transfer probe passed on 12 of 20 additional instruments, extension in progress |
| Forward windows open | Volatility premium desk on a pre-registered 30-day window, long-volatility cards, an agent pool accumulating to the end of October |

## What this documentation is

These pages describe how the platform works: the architecture, the data, the statistical method, the models, the confirmed and rejected findings, the desks and the observability layer. Specific thresholds, entry rules, model weights and roster composition are deliberately omitted – they are the operating parameters, not the method.

This documentation is not investment advice, not an offer of any service, and it makes no claim about future returns. Numbers quoted here are measurements of past behaviour on the platform's own data, with their sample windows stated.

# System architecture

Source: https://docs.tokseq.ru/architecture/

The service boundaries, the decision pipeline, the dependency graph between cores and the invariants that hold the whole thing together.

The platform is a monorepo of independent services, each owning its own data, its own documentation and its own deployment unit. Services communicate through files and read-only contracts, not through shared mutable state. There is exactly one writer per dataset.

## Service layout

| Service | Responsibility |
|---|---|
| Collector | Continuous acquisition of market data into the single source of truth. The only writer of that tree. |
| Feeds | Isolated experimental acquisition of candidate sources. Writes to a separate root, never into the source of truth, and computes no derived features. |
| Core | The live decision engine, its dashboard backend and the paper desks. Reads the data tree read-only. |
| Research | Offline hypothesis generation, execution and validation against collected history. Never touches live data feeds. |
| Edge and telemetry | TLS termination, authentication, rate limiting, service health and alerting. |

The separation between Collector and Feeds is deliberate. A candidate source with an unstable schema or an unverified provenance must not be able to corrupt the tree that research and the live engine both depend on. Feeds asserts its isolation on every write and refuses to start if its root is nested inside another service's root.

## The decision pipeline

The live engine runs a fixed pipeline per cycle:

1. Data feed – closed bars and aggregates are read from the silver layer, read-only. If the data lag exceeds its bound, every signal in the cycle is marked stale before anything else happens.
2. Feature store – features are computed once per cycle and memoized by (name, asset, timeframe). An unknown feature name raises rather than returning a default.
3. Cores – ten decision cores execute in topological order of a lightweight dependency graph.
4. Resolve – a chain of one-way downgrade rules. Rules may suppress a signal, never promote one.
5. Post-resolve aggregates – narrative, agreement and a single structured situation object.
6. Snapshot – a versioned contract written to the dashboard store and served by the API.
7. Decision journal – every signal of every cycle, including suppressed ones, written to a diagnostic-only branch.

Two cadences drive it: a fast cycle on the five-minute close carrying the cheap cores and the transferred heavy cache, and a heavy cycle on the hourly close that recomputes everything including the committee. A daily maintenance pass settles the journal, runs the degradation monitor, drives the kill engine and evaluates a shadow-null placebo.

## The dependency graph

Cores declare what they require and what they produce. The runtime performs a stable topological sort over those declarations at startup. Two properties fall out of this and both are enforced loudly:

- A cycle in the graph, or a requirement with no producer, is a startup failure rather than a runtime surprise.
- If a required input is missing or not in an OK state, the dependent core is not computed at all. It publishes an abstain carrying the reason `missing_dependency` – it does not silently substitute a default.

Risk requires volatility and regime. Volatility requires regime. Direction deliberately requires nothing, so that a failure elsewhere cannot manufacture a directional opinion.

## The ten cores

| Core | Produces |
|---|---|
| Regime | Current regime, probability of change within the hour, next-state distribution, multi-timeframe coherence |
| Volatility | Trailing realized volatility, an expansion probability, a quantile forecast band, and a binary risk veto |
| Structure | Levels, swings, sweeps, compression and liquidity structure |
| Direction | Committee aggregate, with abstention as the default outcome |
| Risk | Stop distance as a regime-dependent multiple of ATR, position size, volatility-targeted leverage with an expansion damper |
| Context | Cross-asset and macro correlation, cross-asset regime coherence |
| Knowledge | Retrospective hit rates per regime with sample sizes and confidence intervals, plus live forecaster scoring |
| News | Multilingual sentiment of the news feed with an age guard |
| Delta | State deltas over 15, 30 and 60 minutes, streaks and a 24-hour memory |
| Micro | Order-flow sensor over one-minute aggregates |

The micro core carries an explicit invariant: it is a sensor describing what is happening now, not a directional predictor. The platform's own audit found no directional edge in order flow, and the core is not allowed to claim one.

## Committee aggregation

Where a directional opinion exists at all, it is produced by a committee of trained stacking ensembles rather than by a single model, and the aggregation across committee members is deterministic. There is no learning in the live path. The aggregation applies, in order: a freshness filter on member signatures, a monotone probability calibration map per committee, reliability weights with a maturity guard so that an immature member cannot dominate, a reliability-weighted median across calibrated probabilities, a quorum requirement, and a disagreement threshold.

The median rather than the mean is the load-bearing choice: one broken member moves a mean and does not move a median.

## Invariants

These hold across the whole platform and each of them was written after an incident, not before:

- No online learning. Nothing refits in the live path. Calibration maps are trained offline, applied statically, and monitored for drift as a one-way degradation signal.
- One-way gates. Every resolve rule can only downgrade a signal. No rule can raise confidence or restore a suppressed direction except the explicit volatility recheck, which is symmetric by design and logs both directions.
- Fail loud, not quiet. An unknown model architecture, an unknown feature, a non-monotone calibration map or a broken dependency graph raises an exception. Silent fallback to a default is treated as a defect class of its own.
- The decision journal is diagnostic-only. The live path never reads it, so no feedback loop can form. A journal failure raises an alert and does not stop the cycle.
- Binary composition admission. If any active member of a live composition breaks its registered out-of-sample interval, the whole composition falls back or freezes. There is no re-weighting, no threshold tuning and no partial degradation in production. Recovery is offline re-validation only.
- Manual state-write failsafe. If the reliability engine cannot persist its state, it freezes the composition, writes a marker that survives a restart, and requires an operator to clear it.

# Data acquisition

Source: https://docs.tokseq.ru/data/

What is collected, at what granularity, how much of it there is, and the quality controls that decide whether a row is allowed to exist at all.

Everything the platform claims rests on data it collected itself. No third-party dumps are ever merged into the source of truth. The provenance rule is clean-room: every row originates from the platform's own poll of a documented public API, performed by the platform's own code, with the response timestamped on arrival.

## What is collected

Forty-five distinct streams are running. They fall into seven families.

- Microstructure – trade-by-trade tape, order book depth aggregates, liquidation events and derived order-flow aggregates for the three primary perpetual-futures assets.
- Price history – OHLCV for perpetual and spot instruments across eight timeframes, from one minute to one day, plus open interest across six timeframes and the funding series.
- Volatility and options – implied volatility indices, at-the-money implied volatility, risk reversals, skew and term-structure slope, and full option chains by strike with mark implied volatility, open interest, volume and greeks.
- Cross-asset and macro – equity index and dollar-index proxies, a gold proxy, and a set of macro series covering policy rates, the yield curve, money supply and central bank balance sheet.
- On-chain – active addresses, transaction count and volume, hashrate, difficulty, fees and mempool state, plus stablecoin supply and exchange net flow computed from a registry of exchange addresses built from the exchanges' own disclosures.
- Positioning and cross-venue derivatives – open interest and funding compared across several venues, long-short ratios, taker volume balance, insurance fund levels and public large-holder positions.
- Narrative and events – fourteen news feeds across crypto, policy and macro, a global event database, and a curated economic calendar of scheduled releases.

Two barrier-ladder prediction-market sources are also collected, as an implied distribution of market expectations rather than as a price series.

## Granularity

The microstructure layer samples once per second, offset from the second boundary, and aggregates into one, five, fifteen and sixty-second tiers. The trade tape and liquidation events are stored raw, one row per event. Book state is stored as a forty-bucket depth heatmap around the mid, with a per-asset band width, in two time tiers.

The polling layer runs at cadences declared per source: ninety seconds for the fast market cycle, roughly fifteen minutes for the full timeframe set, five minutes for volatility and positioning snapshots, ten minutes for news, an hour for the slower on-chain and supply series.

One rule is worth stating because it is unusual: a second-level row is written only if that second was actually observed. A second during which the socket said nothing produces no row at all, rather than a row of zeros. Gaps are never interpolated, anywhere in the platform, at any layer.

## What is deliberately not collected

- Raw level-by-level order book with queue positions. The exchange cap makes the marginal coverage gain small, and taking it would cost a five-fold degradation in sampling cadence. The trade-off was measured and declined.
- Full differential depth streams, whose bandwidth cost was measured at over three gigabytes per day per venue for a use case that has no confirmed consumer.
- Any source requiring the scraping of a third party's rendered page, and any source whose terms forbid derived public use.
- Paid data feeds. When a keyless public endpoint degrades, the stream stops and is documented as stopped. It is not replaced by a purchase.

## Volume and depth

| Measurement | Value |
|---|---|
| Storage occupied | 60.3 GB of 154 GB, growth about 228 MB per day |
| Microstructure store | 12.5 GB, growth about 173 MB per day |
| Per-second row completeness over 24 hours | 0.9937 / 0.9938 / 0.9933 for the three primary assets |
| Book quality share over 24 hours | 1.0, with zero desync events and zero resync timeouts |
| Deepest price history | Hourly bars from March 2020 for the first asset, 55 063 bars |
| Longest supply series | From November 2017, 3 184 daily partitions |
| Option chain snapshot | 682 to 702 rows per poll |
| News corpus | 9 683 headlines, about 81 per day |

Coverage is asymmetric by design. Second-level microstructure is collected for three primary assets, because a socket per instrument at a one-second cadence is the most expensive stream in the system and the research it feeds needs depth rather than breadth. Price history, derivatives context, macro and on-chain series cover a wider set. That base is now being extended: the instrument screen is being widened after a pre-registered transfer probe, and a second market with its own option series is being added for the volatility program. Storage was sized for that expansion in advance – about ten additional gigabytes a year against 86 free.

Storage is partitioned by day in a columnar format with compression, with per-stream retention declared in configuration: two years for order-flow aggregates and liquidations, four hundred days for the raw trade tape with an emergency reduction under disk pressure, and keep-all for news and snapshot series.

## Quality control

Data quality is not a review step, it is a set of refusals built into the write path.

- Schema is verified on every write. A mismatch refuses the write rather than coercing the row.
- Each row carries two timestamps: the event time reported by the source, and the receive time stamped when the response arrived. Partitioning uses event time; joins and replays use receive time. This is what makes point-in-time reconstruction honest, and a clock-skew measurement confirmed there is no host clock offset, while the real hazard – publication lag – reaches a 95th percentile of several minutes on some slow endpoints.
- Deduplication uses a declared natural key per source, not a single timestamp. This rule exists because a timestamp-only deduplication once reduced a nine-row cross-venue update to one row and a seven-strike ladder to one strike, while reporting success.
- Four independent detectors for data that is silently frozen: consecutive successful-but-empty polls, a minimum coverage floor for composite sources, wallet-rotation detection for address-based streams, and a freshness bound per dataset derived from its own cadence.
- Writes are atomic through a temporary file, an fsync and a rename. An unreadable batch is quarantined rather than deleted, and raises an error with a count in the status file.
- Unformed bars are dropped before they reach the lake; on a timestamp collision the fresher version wins.

## Known limitations

The platform documents its own data defects publicly to itself rather than fixing history retroactively, because a retroactive fix is indistinguishable from a fabrication:

- The liquidation side field carries the side of the liquidated position, which is the inverse of the naive reading. This was established empirically, not assumed, and the semantics differ between venues – two major venues use opposite conventions, and the price column means different things in each.
- Before a fix in late July 2026, roughly eighteen per cent of seconds were lost, and the cumulative volume delta series contained thirteen resets over 459 550 rows.
- A host clock jump of forty-nine seconds means cross-stream rows before that date require an embargo to be usable.
- Several composite sources needed key normalization before their history became comparable, and the part of the history preceding that normalization is not recoverable.

Each of these is recorded with its date, its magnitude and its effect on downstream use.

# Research methodology

Source: https://docs.tokseq.ru/method/

Pre-registration, purged walk-forward validation, multiple-comparison control, and the acceptance gate a finding has to clear before it is called an edge.

The research loop is deliberately hostile to its own findings. The platform generates tens of thousands of candidate configurations; at that scale the best result of a pure noise process is a large number, and any method that does not price the search itself will produce a confident, reproducible, worthless answer. Most of the engineering below exists to price the search.

## The loop

Hypotheses are declared, either by hand or by an algorithmic generator, then fingerprinted and deduplicated. A budget gate prices each one in compute. The whole population is pre-generated, filtered for feasibility, and only then executed by a parallel executor. Planning does not run concurrently with execution, so the result set is independent of the order in which it was produced.

Execution builds features, labels regimes, runs purged walk-forward validation, scores the result, and applies the significance gate. Results are written whether they are positive or negative. A validation pass then attacks the survivors with ablation, robustness, leakage detection, feature importance and combinatorial cross-validation. Surviving signals seed the next generation of hypotheses.

Between one and two per cent of the pre-generated population are placebo configurations whose labels are known to carry no information. They are not a formality: they are the empirical monitor of the pipeline's own false-positive rate. If placebos start passing, the pipeline is broken, regardless of what the real hypotheses say.

## Pre-registration

Before a run starts, the platform writes down what would count as a finding: the effective sample size computed over non-overlapping blocks, the multiplicity correction for the declared number of trials, and the threshold the metric must clear. That record cannot be overwritten. A finding produced without a matching pre-registration record is annulled – not argued about.

Every pre-registration carries two controls alongside the hypothesis: a directional control whose expected discrimination is confined to a narrow band around chance, and a placebo control built by shuffling features in day-long blocks.

## Validation

- Purged walk-forward. Splits are chronological. A label spanning a horizon contaminates the end of the training window, so that tail is purged, and an embargo scaled to the horizon separates train from test. A fold with too few surviving rows is skipped; if no valid fold remains, the run fails rather than reporting on a degenerate split.
- Overlapping labels. Nominal sample count is never used for inference. Effective sample size divides by the horizon, because a five-minute cadence with a four-hour label produces rows that are anything but independent.
- Combinatorial cross-validation and the probability of backtest overfitting. Performance is evaluated across all balanced train-test partitions of the block matrix; the fraction of partitions where the selected configuration ranks below median out of sample is the overfitting probability. Pure noise gives about one half; a real effect drives it toward zero.
- Costs. Every result is net of costs. Taker fees and slippage are charged against turnover, and the position construction includes a dead zone and smoothing so that only an edge which survives its own turnover survives at all.
- Leakage. A non-physical Sharpe, a shuffle that does not destroy the result, or an embargo stress test that does not degrade it, all raise a leakage flag on the run.

## Multiple-comparison control

Multiplicity is counted inside a declared family – volatility, regime, direction, conditional direction, positioning, seasonality, inversion, volatility premium – rather than across the whole population, and the correction uses the number of hypotheses rather than the number of variants. Assets are pooled by default, so that the same hypothesis measured on three correlated assets counts once.

The search stage and the confirmation stage use different machinery on purpose:

- Search uses false-discovery-rate control with a block bootstrap across assets, blocked by day, and an effective count of independent trials derived from a correlation clustering of the candidate space. Here the deflated Sharpe ratio is a ranking component, not a gate.
- Confirmation uses pre-registration, a correction against the number of candidates that entered, forward evaluation with confidence sequences, and e-value evidence accumulation. Here the deflated Sharpe ratio is a hard gate.

The choice of correction was itself measured rather than assumed. A synthetic benchmark of 720 trials over 250 daily blocks, with realistic correlation between variants and sixty repetitions per scenario, was run across eight regimes of effect size, calibrated to the effect sizes the platform actually finds. The variant originally planned – false-discovery control with an estimated null proportion – failed to hold the error rate in five of eight scenarios, with a worst-case false discovery proportion of 0.333. The plain variant held control in all eight scenarios at a worst case of 0.117, at the cost of power, and was adopted on that evidence.

## The acceptance gate

A result is called significant only when all three of the following hold simultaneously:

1. A permutation test breaking the link between forecast and forward return rejects at the declared level.
2. The lower bound of a block-bootstrap confidence interval on the Sharpe ratio is above zero.
3. The deflated Sharpe ratio clears its threshold, where the deflation prices the number of trials, the sample length, and the skew and kurtosis of the return distribution, using effective sample size for overlapping labels.

Hyperparameter search is not free: the number of tuning trials inflates the trial count that deflation is computed against.

Verdicts are discrete – edge, fragile edge, needs validation, no edge, regime detector – and the default is not "promising". It is "insufficient evidence".

## Sample size is declared in advance, not discovered

Minimum sample size is treated as a rate per unit of time rather than an absolute count, because an absolute floor transplanted into a shorter window silently permits empty cells in every fold. Where a forward window is required, its power is stated before it starts: for a desk whose daily result has a standard deviation in a stated range, a thirty-day window can distinguish a mean daily effect of a stated size and nothing smaller. That sentence is written down before the window opens, so that a null result at the end is a result and not a disappointment.

## Reproducibility

Every run records the random seed and the hashes of the dataset, the feature set, the configuration and the model. Research is offline: experiments never pull live data, they read a frozen store. Profit and loss is always net of cost. And nothing is asserted without the sample it rests on.

# Features and models

Source: https://docs.tokseq.ru/models/

The feature families, the model classes that were tried, how ensembles are built, how probabilities are calibrated and how uncertainty is reported.

## Feature families

Features are organized into named blocks so that a hypothesis declares which blocks it consumes and the search space over feature sets is explicit rather than accidental. Roughly twenty-five blocks span about a hundred and fifty columns.

- Price and momentum – returns, multi-horizon momentum, trend strength, channel position.
- Volatility – realized volatility over several windows, average true range and its normalization, band width, compression ratios.
- Statistics and information – autocorrelation, skewness, kurtosis, variance ratio, Hurst exponent, permutation entropy, spectral features.
- Oscillators and trend extensions – the classical indicator set, kept as a controlled baseline rather than as a belief.
- Seasonality – cyclic encodings of hour, day and month, plus session flags.
- Market structure – levels, swings, compression, liquidity structure with equal-high and equal-low detection and sweep flags, and on demand shape matching by dynamic time warping and matrix-profile motifs. Thirty-eight structural columns exist; the expensive shape blocks are computed only when a configuration asks for them, which is the difference between a sub-second and a several-minute feature build.
- Derivatives context – funding level and change, open interest change and z-score, implied volatility level and change.
- Cross-asset and macro – equity and dollar index returns, a metals proxy, policy rate, curve slope, money supply, balance sheet, and rolling cross-correlations with lead-lag variants.
- On-chain – activity, throughput, security and fee metrics as z-scores, plus mempool state.
- Narrative – news counts and sentiment by category, event proximity, event impact and event-window flags.
- Order flow – depth level and trend, book skew, taker imbalance and cumulative delta slope, spread z-score, and a liquidation cascade measure against a causal daily quantile.

Two disciplines apply to all of them. Every feature is past-only: a bar at time t sees nothing after t, and only closed bars are used. Every threshold inside a feature is a causal rolling quantile of the feature's own distribution, not a constant tuned once on the whole history.

## Model classes tried

The search was not restricted to one family. What was executed, in rough order of complexity:

- Linear – standardized logistic regression, kept throughout as the honest baseline.
- Rule banks – classical strategy logic across moving-average crossovers, oscillators, breakout channels, directional index and mean reversion, combined by majority vote, conjunction and disjunction. No fitting at all. These exist to answer whether the machine learning is earning its keep.
- Gradient boosting – two independent implementations.
- Tree ensembles – random forest and extremely randomized trees.
- Neural sequence models – multilayer perceptrons, long short-term memory and gated recurrent networks.
- Deep forecasting architectures – a transformer family including patch-based, frequency-decomposed, inverted and exogenous-aware variants, alongside decomposition-linear, basis-expansion, hierarchical-interpolation and temporal convolutional models.

An unknown architecture name is a hard error. It is never silently downgraded to the baseline, which is a specific defect the platform found in its own history: results once attributed to a tree ensemble had in fact been produced by logistic regression because the dispatch branch did not exist. Those results were withdrawn and the audit that found it is documented.

## Ensembles

Five aggregation methods were implemented and compared: mean, performance-weighted mean, majority vote, regime routing, and a trained stacking combiner over out-of-sample member probabilities plus the regime state.

The measured result is unambiguous and it is the reason the live system looks the way it does: only the trained stacking combiner works. Averaging, voting and regime routing are dead. Every member of the live registry is a stack.

Two further ensemble results are worth stating because they are counterintuitive:

- A committee does not reliably beat its own best member. Across 23 898 comparisons, committees beat their best member in 22.5 per cent of cases, with a median difference of −0.0294.
- Committees built from rejected members pass their own screen at a rate close to the screen's chance level, which is exactly what a screen should do and exactly what an unvalidated pipeline would not show.

A published-looking claim that a stacked combiner beats voting collapsed under a fair stratification: the effect measured on a biased stratum was five times its unbiased size, and the unbiased comparison was not significant.

## Live aggregation

The aggregation across committee members in the live engine is deterministic. There is no learning in the live path, and a trainable orchestrator is admissible only as a pre-registered research stage.

Freshness is checked first – member signatures older than their bound are dropped. Surviving probabilities are mapped through a per-committee calibration map; a member without a map is used with halved confidence rather than trusted. Weights come from live reliability tracking with a maturity guard, so an immature member carries neutral weight, and a floor prevents any member from being weighted out entirely. The aggregate is a reliability-weighted median. A quorum requirement and a dispersion threshold both produce explicit abstention rather than a low-confidence number.

## Calibration

Probability calibration uses isotonic regression, exported as monotone piecewise-linear maps, trained offline and applied statically. There is no Platt scaling anywhere in the code, and there is no refitting in the live path. A map that fails a monotonicity check at load time raises rather than loading.

Maps can be conditioned on regime. The multi-class regime transition model uses per-class isotonic calibration with renormalization. Training scripts hold out the final third of the out-of-sample period to measure calibration error on data the map never saw, then build the shipped map on the full out-of-sample period.

Calibration drift is monitored as a one-way degradation signal over a rolling window of about thirty thousand rows. It can trigger a freeze. It never triggers a refit.

The decision to calibrate at all was itself tested by removing the map: expected calibration error rose from 0.0187 to 0.0306, Brier score from 0.2495 to 0.2515 and log loss from 0.6922 to 0.7261, against 0.6931 for the constant one-half forecast. A separate attempt to refit the committee calibration produced an area under the curve of 0.5263 and was refused by its gate.

## Uncertainty

Uncertainty is reported, not hidden in a point estimate:

- The realized-volatility forecast is a quantile model producing a tenth, fiftieth and ninetieth percentile band rather than a symmetric interval.
- Every retrospective statement carries its count and a Wilson interval.
- Committee dispersion is published as an explicit disagreement metric with its own trend, and crossing its threshold produces abstention.
- Expected calibration error is tracked alongside discrimination, because a well-ranked but badly calibrated probability is useless for sizing.
- Effective sample size replaces nominal count wherever labels overlap.
- A shadow-null placebo runs daily in the live system: outcomes are shifted by one and the hit rate must sit at about one half. A placebo that starts winning is a leak, and it is treated as one.

## Registered forecasters

Three models are registered in the live engine, all gradient boosting, each with a declared gate it had to clear:

| Model | Task | Registered performance |
|---|---|---|
| Volatility expansion | Binary, will hourly realized volatility expand | Out-of-sample AUC 0.744, calibration error 0.000, on 126 000 bars |
| Regime transition | Multi-class next regime | Change-AUC 0.695, per-class AUC 0.79 for stress, 0.77 for squeeze, 0.72 for thin liquidity |
| Realized volatility forecast | Quantile regression on log volatility | Pinball loss 11.5 per cent better than persistence, and required to beat a heterogeneous autoregressive benchmark as well |

The 0.744 figure carries a mandatory caveat wherever it is quoted, including here. It is walk-forward out-of-sample on the training epoch of the artifact, not a measurement of live behaviour, and the target compares future realized volatility to a trailing estimate, so a substantial part of the absolute number is the trivial mean reversion of a noisy estimator. On a synthetic series with constant volatility the trivial score reaches about 0.83. The honest margin of the benchmark model over the trivial one on real five-minute bars is 0.02 to 0.04. Reading 0.744 as "expansion is called correctly three times in four" is wrong.

The gate for the regime model is deliberately change-AUC rather than macro-AUC, because regime is persistent and macro-AUC is inflated by that persistence into a number that looks impressive and means nothing.

# Findings

Source: https://docs.tokseq.ru/results/

What the platform confirmed, what it rejected and with which numbers, including the central negative result that direction is not predictable.

This page is the point of the platform. It lists what survived and what did not, with the measurement that decided each case. The rejections are longer than the confirmations, which is the expected shape of an honest research record.

## The central negative result: direction

Short-horizon directional prediction was tested six independent ways and failed every time.

| Measurement | Result |
|---|---|
| Out-of-fold evaluation over 730 days | AUC 0.52 |
| First-stage systematic search | 0 edges over 15 003 experiments, best deflated Sharpe 0.329 against a 0.90 threshold, best score 36.42 against a threshold of 40 |
| Paper desk journal | Directional hit rate 0.51 |
| Second-generation canary sample | 0 significant results out of 24, verdict "no edge" on all |
| Conditional direction, restricted to declared states | 445 hypotheses, 0 survivors |
| External corroboration | Nine months of a documented public record of short-horizon directional trading, and published work on a large prediction-market dataset where one per cent of traders capture most of the profit and seven in ten lose |

The decisive number is not the AUC, it is the comparison against the search. The best result of the directional family sat at 3.52 standard deviations of the Sharpe estimator, while the expected maximum of pure noise across fifteen thousand trials is about 3.96. The family's best finding was weaker than noise should have produced.

The structural diagnosis is straightforward. Tens of thousands of hypotheses, three assets whose daily returns correlate at 0.80 to 0.87, a forward window measured in weeks and horizons of five minutes to an hour, produce an effective sample of a few dozen daily blocks of a single underlying factor against a multiplicity of tens of thousands. Any effect in the range these searches surface, a few thousandths to a few hundredths of AUC, drowns in the correction.

The directional family is therefore frozen in code. Registering a new directional hypothesis raises an exception, and lifting the freeze requires an explicit flag intended for control runs.

## Confirmed

| Finding | Measurement |
|---|---|
| Volatility is predictable | Benchmark model reaches AUC 0.73 against 0.69 for the trivial predictor, with an R-squared of 0.63 to 0.66 on log volatility |
| Regime change is detectable | Change-AUC 0.695 in the registered live model, 0.7285 on a half-hour target in the research prototype |
| Heavy models earn their cost for regime, and only for regime | 87 wins out of 95 paired comparisons, a gap of +0.0717 in balanced accuracy, zero negative comparisons |
| Volatility risk premium exists and is conditional | Implied exceeds realized on 64 per cent of days for the first asset and 78 per cent for the second, with median premia of +4.0 and +12.9 volatility points |
| The premium is strongly state-dependent | In the richest implied-volatility tercile the premium rises to +8.2 and +16.2 points, on 78 and 92 per cent of days. In the cheapest tercile it disappears entirely, at −0.8 points on 47 per cent of days |
| Microstructure is an early signal for regime change, not for direction | Pooled incremental AUC +0.031, interval [+0.0159; +0.0480], on 195 995 observations |
| A cascade precursor reproduces | Compression of taker-flow dispersion before liquidation cascades, one-sided p-values 0.0070, below 0.0001 and 0.0005 across three independently computed assets |
| Two anomaly signals qualify as a risk gate | Taker-dispersion compression reaches AUC 0.671, interval [0.634; 0.709], with an increment of +0.099 over the core baseline at five minutes of lead time; a volume-burst signal reaches 0.640 with +0.082 |
| A clock-boundary microstructure regularity | Excess activity in the last seconds before quarter-hour boundaries, ratio 1.144, 1.117 and 1.126 across three assets against a control ratio of 1.00, driven by trade count rather than volume |

The live record of the volatility forecasters, measured on the full journal rather than a recent window, is a hit rate of 0.692 to 0.708 for volatility expansion against a base rate of 0.48, and 0.643 to 0.654 for regime change against a base rate of 0.52.

## Rejected, with the number that rejected it

| Approach | Verdict |
|---|---|
| Averaging, voting and regime routing as ensemble methods | Dead. Only the trained stacking combiner works |
| Committees beating their best member | 22.5 per cent of the time, median difference −0.0294 |
| A regime router as a portfolio brain | Ceiling of the entire idea, oracle minus best constant, is +16.92 basis points with an interval crossing zero and p 0.087. The actual router delivered −2.12 basis points |
| The hybrid portfolio assembly | The measured arm delivered +15.55 basis points, and a shuffled-label placebo delivered +13.22 with a 95th percentile of +34.48. Gate not passed |
| Meta-labelling of entries | Negative twice. The second attempt reached +2.02 basis points against a placebo 90th percentile of +2.31 |
| Smart execution | −0.078 basis points against a placebo of −0.079. Short-horizon price drift is unpredictable, with a negative out-of-sample R-squared |
| Delta-neutral funding carry | −2.93 per cent annualized above the risk-free rate, interval [−3.61; −2.06]. The entire 45-cell parameter grid fits inside 0.78 percentage points against a shortfall of 2.5 to 3.3 points |
| Cross-venue basis arbitrage | Basis flat at +4.5 to +6.2 basis points, with only one tradable leg |
| Crowding features for regime change | Significantly harmful on the first asset, incremental AUC interval [−0.0426; −0.0192] |
| Microstructure in the production feature set | Not adopted. The volatility increment interval crosses zero, and the regime increment of +0.0048 falls below the adoption threshold once any family correction is applied |
| Improved volatility models over the heterogeneous autoregressive benchmark | Six variants tried. None beats it at the daily horizon |
| Alternative regime definitions by change-point detection and cumulative-sum methods | 248 configurations, no change in screen behaviour |
| Rule-based strategies over declared states | 336 configurations, zero rejections of the null |
| News as a feature | Gate failed. No news feature reaches an AUC of 0.55 against volatility expansion, and every increment over the volatility baseline is negative. The baseline itself reaches 0.74 to 0.78 |
| Large language models as a second opinion | No edge. Against a frequency baseline the best cloud model gains +0.059 in precision-at-one with an interval crossing zero, p 0.199. The live local run produced 10 914 forecasts and zero abstentions, and matched a constant |
| Spread as a level feature | Rejected by its own measurement. The daily 95th percentile equals the median to three decimals |
| A cascade detector as a threshold switch | Pooled onset AUC 0.4943 on 13 322 observations. Confirmed as a feature, refused as a switch |
| The one apparent edge of the first research generation | Withdrawn. Forward evaluation gave median Sharpe ratios of −7.92, −7.94 and −0.98 across three assets |

That last row is the one worth reading twice. A stacked committee cleared every gate of the first research generation and was the platform's only validated directional edge. Its forward window destroyed it, an erratum was issued, and the finding was retracted rather than defended.

## Selection overfitting, measured

Two candidate groups that passed the significance gate were then tested for backtest overfitting. One reached an overfitting probability of 0.599 with 23 per cent positive forward periods; the other 0.393 with zero per cent. Both were refused. This is the reason the combinatorial cross-validation stage exists at all: passing the significance gate is necessary and nowhere near sufficient.

## Forward record

Over five and a half weeks of paper forward testing with 152 agents, turnover reached 323 million dollars, gross profit was positive at about 25 000 dollars, and the net result after costs was a loss of about 369 000 dollars – minus 11.4 basis points on turnover, with fees consuming a quarter of deployed capital. Twenty-three agents out of 152 finished positive, and two had a confidence interval whose lower bound stayed above zero. Over that same window the three underlying assets rose 22.7, 29.5 and 41.4 per cent.

That is the honest shape of the problem. Cost is the dominant term, the beta of the window swamps the signal, and a naive reading of gross performance would have been off by an order of magnitude and the wrong sign.

# The volatility program

Source: https://docs.tokseq.ru/volatility/

Why the platform moved from direction to volatility, what the premium measurements show, and how the current program is pre-registered.

The platform's current program follows its own evidence. Direction did not survive; volatility, regime and the premium between implied and realized volatility did. Everything now under construction sits on that side of the line.

## Why volatility

Three properties make volatility a different problem from direction, and the platform measured all three rather than assuming them.

- It is persistent and mean-reverting, so a forecast has something to hold on to. The benchmark model reaches an AUC of 0.73 against 0.69 for the trivial predictor, and explains 63 to 66 per cent of the variance of log volatility.
- Its premium is a compensation for bearing risk rather than a prediction of price, so it does not require anyone to be wrong for it to exist.
- It is conditional in a way that can be tested. The premium is large when implied volatility is rich and the market is quiet, and it vanishes or inverts when implied volatility is cheap or realized volatility is already elevated. That conditionality is what makes it a research object rather than a slogan.

## What was measured

On the first asset, over 343 days, implied volatility exceeded subsequent realized volatility on 64 per cent of days, with a median premium of +4.0 volatility points. On the second asset, over 153 days, on 78 per cent of days with a median of +12.9 points. Conditioning changes the picture sharply:

| Condition | First asset | Second asset |
|---|---|---|
| Richest implied-volatility tercile | +8.2 points, 78 per cent of days | +16.2 points, 92 per cent of days |
| Cheapest implied-volatility tercile | −0.8 points, 47 per cent of days | +1.8 points, 57 per cent of days |
| Quietest trailing-volatility tercile | +8.7 points, 86 per cent of days | +13.9 points, 88 per cent of days |
| Most turbulent trailing-volatility tercile | −0.7 points, 46 per cent of days | +10.4 points, 69 per cent of days |
| Worst single day for the premium seller | −169.7 points | −67.5 points |

That last row is the whole risk profile of the strategy family in one number, and it is quoted deliberately alongside the favourable ones.

The effect replicates on a separate market with its own volatility index and no relationship to the first: over 913 trading days the premium measured +9.2 points with 88 per cent of days positive, and it was positive in every calendar year of the sample. Priced from option quotes on individual underlyings rather than from the index, the premium ranged from +3.0 to +11.7 points with the share of positive days between 0.66 and 0.79.

## Transfer, tested before it was assumed

Before extending coverage beyond the original three assets, the platform pre-registered a transfer probe over twenty additional instruments. Twelve of twenty passed the declared threshold, against a requirement of ten, so coverage was widened.

The same pre-registration recorded, before the run, the honest caveat that the probe then confirmed: at a one-day horizon the benchmark model adds nothing over the trivial statement that volatility reverts to its mean, on any of the instruments. At the one-hour horizon it adds 0.03 to 0.05 across all twenty-three. The consequence is stated rather than smoothed over: the wide coverage ranks the probability of one-hour expansion and the regime state; the premium itself is computed only where options actually exist.

## The risk layer

A short volatility position is short a tail, so the program's first component is not the entry rule but the gate that refuses to open. A set of candidate anomaly signals was pre-registered against a single question – does this signal precede an adverse move over the next one to twenty-four hours – with three acceptance criteria declared in advance.

Two signals passed on two assets: compression of taker-flow dispersion, reaching an AUC of 0.671 with an increment of +0.099 over the core baseline at five minutes of lead time, and a volume burst reaching 0.640 with +0.082. Both hold at fifteen minutes of lead with slightly lower numbers.

Book depth, spread, resting-size structure, liquidations, funding and open interest, implied volatility and news all failed the same gate. News in particular reached 0.56 with an increment on the edge of the threshold, which is exactly the kind of result a less disciplined process would have shipped.

The resulting gate is deterministic, runs on a seconds cadence, has a declared maximum latency and a fail-safe that assumes the adverse state when its inputs go stale. It can reduce exposure to zero and it can refuse to open. It cannot open a position, which keeps it one-way like every other gate in the platform.

## Controls: every desk has a twin

No desk in the platform runs without a naive twin. The twin trades the same instrument on the same schedule with the filters removed. The pairwise difference between a desk and its twin, bootstrapped over daily blocks, is the only number the platform treats as evidence, because the absolute result of either arm is dominated by the market of the window.

That design earned its keep immediately. On paper prices the filtered arm beat its twin by 116 dollars a day with a 90 per cent interval of [+44; +203] over 25 days. On real quotes, the same rules produced a difference of 17 dollars a day with an interval of [−67; +106] over 26 days – not significant.

The reason for the gap was found rather than explained away: the synthetic pricing used by the paper arm was selling volatility on average 4.23 points richer than the market, which at the measured vega accounted for about 43 per cent of the apparent advantage. The conclusion recorded was that the real-quote arm is the honest curve, and the paper arm is not.

A second defect of the same kind was found and fixed on the demo desk: position size had been pinned to the exchange minimum lot rather than the model size, so the desk was measuring execution divergence and not profit and loss.

## The current window

The live volatility desk runs inside a pre-registered thirty-day window with five acceptance criteria declared before it opened: a minimum number of closed structures, a paired difference against the twin whose bootstrapped lower bound must exceed zero, a positive result for the filtered arm on its own with the same interval requirement, a tail constraint on both maximum drawdown and worst single day, and a coverage band on the ratio of entry days between the two arms.

The bootstrap is blocked by day with twenty thousand replications. The window does not get extended, the thresholds do not move, and any single failure makes the verdict a failure. There is an early stopping rule on cumulative loss.

The desk is two-sided: it sells the premium where the premium is rich, and it buys volatility where an expansion is forecast against cheap implied volatility. The two mechanics are separate cards with separate twins and separate gates.

## What is deliberately not claimed

The premium is not free money and the platform does not present it as such. It is compensation for a tail, its measurement windows are short by the standards of the claim, the figures for the second asset rest on the youngest window in the set, and the cost model matters as much as the signal. The thirty-day window exists to find out whether the effect survives contact with real quotes, real fills and real fees. Until that verdict is in, the correct summary is that the effect is measured in the data and unproven in execution.

# Desks, risk and forward validation

Source: https://docs.tokseq.ru/execution/

How paper desks are constructed, how fills and costs are simulated honestly, what the risk gates do, and what a strategy has to prove before it is promoted.

Between a research finding and any claim about money there is a forward stage, and the platform treats it as a separate discipline with its own failure modes. A backtest that passes every statistical gate can still be destroyed by fills, fees and the market of the window – and in this platform's history, it was.

## Paper desks

The paper desk layer is a consumer, not a participant. It reads published engine snapshots and closed bars, and maintains independent synthetic portfolios. It has no path into the live decision loop and cannot influence a single signal.

Design rules:

- Agents trade the engine's own signals – regime, expansion probability, change probability, risk context, order-flow state – rather than indicators of their own. An agent is therefore a test of the engine, not a competing strategy.
- Indicator-based and random agents run alongside as controls. The random tier exists specifically to measure the distribution of "best of N on pure noise", which is the number that any leaderboard has to beat before it means anything.
- Horizons are adaptive. The exit decision is re-evaluated on every bar rather than fixed at entry.
- Everything is net of cost, including funding at its settlement times.

Agents are organized in tiers – controls, validated, hypotheses – and in density layers: base cards, parametric mutations of those cards, and noise seeds. Context twins duplicate a card with an added information source so that the marginal value of that source is measurable rather than assumed.

## Honest fills

Fill simulation is deliberately pessimistic in every ambiguous case:

- Entry fills at the open of the following bar, never at the signal bar's close.
- Bracket orders resolve by touch of the bar's high or low. If a bar touches both the stop and the target, the stop is taken.
- A gap through a stop executes at the bar's open, which is worse than the stop. A gap through a target in the position's favour is not credited.
- Funding is charged at real settlement times, not amortized.
- The cost model charges taker fees on both sides plus slippage proportional to the absolute change in position, and position construction includes a dead zone and smoothing so that turnover is not manufactured by noise around a threshold.

## Exchange demo bridge

Where a desk needs real quotes and real fills, it runs against an exchange demo environment through a bridge with one architectural safeguard: the demo host is a constant, verified in the constructor against an allowlist. The bridge will not accept a production trading host from an environment variable or from an argument. That is a structural property, not a convention.

The bridge signs requests with a rotating timestamped signature, enforces idempotency through client order identifiers so that a retried request cannot become a second position, retries only on network errors and a declared allowlist of response codes, and polls executions rather than trusting an acknowledgement.

Two operational rules follow from live incidents: a limit order that does not fill produces an explicit no-fill event rather than a silent retry, and a two-legged structure where only one leg fills is an incident that is unwound immediately.

## Risk gates in the live engine

Gates are applied in a fixed order and every one of them can only downgrade:

| Gate | Effect |
|---|---|
| Data lag | If the data layer falls behind its bound, every signal in the cycle is marked stale |
| Staleness | A signal older than its declared lifetime relative to the freshest signal in the batch is stale with zero confidence |
| Volatility veto | When the volatility core vetoes, any directional signal is suppressed. The veto outranks direction by design |
| No volatility estimate | Without a fresh volatility assessment, direction is not shown at all |
| Regime scope | A signal validated only for one regime is suppressed outside it |
| Volatility recheck | When an hourly direction is carried into a five-minute snapshot, it is re-tested against current volatility, and both suppression and restoration are logged |
| Quorum | Below the required share of live committee members, the output is abstention |
| Disagreement | Above the dispersion threshold, the output is abstention |
| News age | A stale news feed suppresses the sentiment contribution rather than ageing it |

The veto rule itself is a pre-registered heuristic: stress regime, or realized volatility above a causal high quantile of its own distribution. It is intentionally conservative, because a false veto costs an abstention while a missed one costs a position.

Position sizing risks a fixed small fraction of the account per trade, caps size at unlevered notional, sets stops as a regime-dependent multiple of average true range, targets a fixed profit-and-loss volatility per unit time, caps leverage, and damps leverage further when expansion probability is high. Leverage depends only on volatility. Directional confidence is never mixed into it.

## The kill engine

Live compositions are monitored per member. Each member's probability output is logged, settled against closed bars, and compared to the out-of-sample interval registered at admission.

Admission is binary and so is removal. If any active member breaks its registered interval, with a confirmation requirement to avoid acting on a single reading, the entire composition falls back to a previously registered alternative or freezes. There is no re-weighting, no threshold adjustment and no partial degradation in production. Member status moves in one direction only: active, watch, retired. Return to service requires offline re-validation.

If the engine cannot persist its own state, it freezes and writes a marker that survives a restart, and only an operator can clear it. Until then, direction abstains across all assets. The reasoning is that an unobservable risk system is worse than an absent one.

## Promotion gates

A desk agent is promoted from hypothesis to validated only against frozen thresholds, evaluated on forward trades exclusively and never on the backtest:

- A minimum number of forward trades overall and a minimum per regime, so that a result cannot be carried by a single market state.
- A deflated Sharpe ratio above its threshold.
- A probability of backtest overfitting below its threshold, computed by combinatorial cross-validation over the performance matrix.

The default verdict is "insufficient evidence". A card that has not met the counts is not "promising", it is unproven, and it is displayed as such.

## What forward testing actually produced

Over five and a half weeks with 152 agents: 323 million dollars of turnover, gross profit about 25 000 dollars, net result about minus 369 000 dollars after costs, which is minus 11.4 basis points on turnover. Fees consumed roughly a quarter of the capital deployed across the agent pool. Twenty-three agents finished positive; two had a lower confidence bound above zero. The three underlying assets rose 22.7, 29.5 and 41.4 per cent over the same window.

The platform publishes that number to itself in exactly this form, because it is the single most useful thing it has learned about execution: at retail cost levels, on short horizons, transaction cost is not a correction term. It is the dominant term.

# Observability and verification

Source: https://docs.tokseq.ru/observability/

The decision journal, the health contract, degradation monitoring, and how the platform's accuracy claims can be checked by a third party.

A system that produces probabilities has to be auditable after the fact, otherwise its numbers are decoration. The platform's observability layer exists so that any published figure can be traced back to the rows that produced it.

## The decision journal

Every signal of every core in every cycle is written to a journal, including suppressed signals and errors. Each row carries the state, the confidence, the value, the explanation payload, the suppression reason, the regime context, the horizon and the schema version, keyed on cycle timestamp, cycle type, core, asset and signal kind.

The journal has one invariant that is enforced rather than intended: it is diagnostic-only. The live path never reads it. There is no feedback loop from the record of past decisions into the making of new ones, so no self-confirmation can develop. A journal write failure raises an alert and does not stop the cycle.

The journal is the dataset the platform trusts most, because it was written before the outcome was known. It currently holds 264 723 decisions.

## The health contract

Every snapshot carries a health block: the cycle type, the data lag, the state of every core, a line-by-line report of which resolve rule fired and why, feature-store hit and miss counts, and three deterministic aggregates.

Those aggregates are computed, not generated. There is no language model anywhere in the live decision path.

- A one-sentence narrative of the cycle.
- An agreement score describing whether the overall picture is coherent or self-contradictory.
- A single structured situation object combining cross-asset regime coherence, data health across the source families, a deterministic consistency check between the expansion probability and the volatility forecast band, ranked factors for and against with their impact, recent changes and a stability measure.

The consistency check deserves a note: it compares two independently trained models that should agree, and reports contradiction explicitly. A platform that only shows agreement is not measuring anything.

## Degradation monitoring

A daily pass produces a degradation report served through the health endpoint. It covers calibration drift over a rolling window of about thirty thousand rows, the state of the kill engine, and a shadow-null placebo in which outcomes are shifted by one so that the hit rate must sit at chance. A placebo that starts winning indicates leakage and is treated as an incident rather than as good news.

Alerts fire on state change only, with a cooldown per key and state that survives a restart, so that a persistent condition does not generate a stream of identical messages. Every action of the kill engine – a freeze, a fallback, a pending confirmation – raises its own notification.

Metrics are stored as a narrow time series in the dashboard store rather than exported to a general-purpose metrics stack. That was a deliberate choice for a single-node deployment: fewer moving parts, and the metric history lives beside the data it describes.

## Accuracy accounting

The platform reports its own hit rates, and how those rates are computed is itself a documented decision.

- Directional accuracy and forecaster accuracy are computed over the full history – the live database together with all monthly snapshot archives – rather than over a rolling recent window. An earlier implementation capped the window at two weeks for direction and at a fixed row count for the forecasters, which on production cadence amounted to about three and a half days. Both caps are gone from the reporting path, and the labels state the sample explicitly.
- Effective sample size is used instead of nominal count. With a horizon of several hours at a five-minute cadence across three assets, nominal counts overstate independence by roughly an order of magnitude.
- Base rates are always shown next to hit rates. A hit rate of 0.69 against a base rate of 0.48 is a result; the same hit rate against a base rate of 0.70 is not.

Current live figures, over the full journal: volatility expansion at 0.692, 0.708 and 0.695 across the three assets against a base rate of 0.48, and regime change at 0.643, 0.652 and 0.654 against a base rate of 0.52, on an effective sample of 1 918. Directional win rates across the same base sit between 0.497 and 0.582 across six asset-horizon cells, which is the same story the research told.

## Third-party verification

Because internal consistency is not evidence, the platform produces a diagnostic export designed to be handed to an outside reviewer: the methodology stated in words and in the formulas taken from the code, the summary computed by the same functions that feed the panel, every permitted forecast as an individual row, every matured decision as a table, monthly aggregates, and self-checks that recompute the summary from the rows so that a discrepancy between the two is visible rather than assumed away.

The export is read-only and reproducible. The point of it is that someone who does not trust the platform can recompute its headline numbers from the underlying rows without asking the platform for anything.

## Interfaces

The live surfaces are private. A terminal presents the engine state per asset – regime, volatility band, risk context, order-flow state, forecaster consistency, core disagreement and data-source health – and a control panel presents telemetry, the security journal, the desk state and the accuracy block. Both sit behind authentication.

The dashboard has been through several generations, and the current one carries a mode selector rather than a single fixed layout, because a volatility workflow and a short-horizon workflow need different blocks in front of the operator. Colour semantics are unified across modes: one palette for entry direction, one for no entry, one reserved for the risk layer, with brightness carrying confidence.

# Engineering practice

Source: https://docs.tokseq.ru/engineering/

The stack, the deployment discipline, the security posture and the working rules that were written after incidents rather than before them.

The research is only as good as the machinery that produces it, and most of the rules below exist because something broke first.

## Stack

The services are Python, with a columnar store for market data and embedded databases for journals and dashboard state. Model training uses gradient boosting and, for the heavy search stage, GPU-backed sequence models. The live engine runs on a single node under process supervision with per-service resource quotas; the public edge runs in containers behind a reverse proxy that terminates TLS.

The deliberate absences matter as much as the choices. There is no message bus, no orchestration cluster and no general-purpose metrics stack. For a single-node deployment each of those adds a failure mode without removing one, and the platform's own incident history is dominated by coordination failures rather than by capacity.

## Deployment discipline

- One writer per dataset, enforced by configuration rather than convention.
- Releases are verified by content parity between the built artifact and what the server actually serves, because "deployed" and "running" turned out to be different states more than once.
- Child processes inherit the release explicitly. A release that reached the parent process and not its subprocesses produced a system that reported the new version while running the old code, and the fix is now part of the deployment contract.
- Static surfaces are served from a positive list. Anything not named explicitly returns a not-found, so a forgotten file cannot leak by default.
- Backups run in tiers with verified exit codes and file counts. A backup that was silently incomplete for two days is the reason the verification step exists.

## Testing and documentation as a gate

Each service carries a test suite and lint gates. Beyond that, the repository enforces its own bookkeeping with a documentation linter, and the rule it enforces is unusual enough to state:

A task may only be marked complete if the completion carries evidence – a file and line, a commit hash, a production acceptance date, or a test run result. The assertion "done" is not evidence. A deliberate refusal is also a valid closure, but it must carry the measurement that justified it.

That rule was written after an audit of 896 tracked items found 156 marked open while already implemented, 328 items from three reports that had never reached any task list, and 137 documents that contradicted themselves. The cost of a bookkeeping defect in a research project is not tidiness; it is repeated work and lost decisions.

The same audit produced a decision register: every operator decision is recorded in the repository, with its date and its wording, in the same session in which it was made. Agent memory is not a substitute, because the register has to be readable by anyone who reads the repository.

## Security posture

The platform holds no customer funds and no customer data, and its exposure is a private analytics surface. The posture is correspondingly plain:

- Everything except a small public surface sits behind authentication.
- Per-address rate limiting at the edge, with a tighter budget on expensive endpoints, after an audit showed a single endpoint could return tens of megabytes for a request of a few hundred bytes.
- Request-pattern blocking for reconnaissance paths and scanner signatures, applied to the request rather than to the address, so that a legitimate client behind a shared address is never banned by association.
- Firewall bans are constrained to ports that no shared service occupies. A ban that hits a shared port takes down more than the attacker.
- Secrets live in the environment only, never in code, and never in logs. Where a key is unavoidable in a log line, only a mask is written.
- Weekly image vulnerability scanning with alerting on fixable critical findings.
- Two structured penetration tests were carried out against the perimeter, and their findings are tracked as ordinary tasks with the same evidence requirement as everything else. The one high-severity finding is an accepted risk, documented as accepted rather than quietly closed.

## Working rules

A set of process rules is enforced across the project because each of them has a measured cost attached:

- Measure before refactoring. A planned refactor was cancelled by the measurement that showed the duplication it targeted amounted to under one per cent of the file.
- A deliberate trade-off is recorded together with its reason at the moment it is made. An unrecorded trade-off is indistinguishable from a defect at the next audit, and the time then goes into defending a decision that was already correct.
- A crashed multi-agent run is resumed, never restarted from scratch. Two full runs were burned before this became a rule.
- Fix and ship in one pass, to a working and accepted state, rather than to "the code is deployed". Returning to the same topic a second time is treated as a process defect.
- An operator decision is written down in the same turn it is given. Of 59 decisions lost in one audited period, 25 had left no trace anywhere.

## What runs where

Research runs offline against a frozen store, on the operator's own hardware, and never pulls live data. The live engine and its surfaces run on a single server. Data collection runs continuously and is the only writer of the source of truth. Nothing in the research path can write into the live path, and nothing in the live path can write into the collected history.

# Questions and answers

Source: https://docs.tokseq.ru/faq/

Direct answers to the questions most often asked about the platform, its results and its status.

## What is TokSeq?

TokSeq, also written Tokarev Sequence, is a privately operated research and analytics platform for financial market microstructure. It collects its own market data, tests hypotheses about market behaviour under pre-registration and multiple-comparison control, runs a live multi-core decision engine that publishes regime, volatility and risk assessments, and validates candidate strategies on paper desks before any of them is trusted. It is engineering and quantitative research work, not a signal service.

## Is TokSeq a trading bot?

No. Order execution is manual or simulated. The platform produces analytics, probabilities and risk context; the paper desks and the exchange demo bridge exist to validate them. The exchange bridge refuses a production trading host by construction, which is a property of the code rather than a policy statement.

## What has TokSeq actually proven?

That short-horizon price direction is not predictable at the level this platform can measure, and that volatility, market regime and the premium of implied over realized volatility are. Volatility expansion and regime change models clear their gates with substantial margins over their base rates, the volatility premium is present on a large majority of days and is strongly conditional on the state of the market, and a cascade precursor in taker flow reproduces across three independently computed assets.

## Does TokSeq predict price direction?

No, and it says so in code as well as in prose. Fifteen thousand directional experiments produced an area under the ROC curve of about 0.52 and zero validated edges, and the best result of the family was weaker than what pure noise should have produced across that many trials. The directional family of hypotheses is frozen: registering a new one raises an exception unless the freeze is explicitly lifted for a control run.

## How does TokSeq avoid overfitting itself?

By pricing its own search. Hypotheses are pre-registered with their thresholds and effective sample sizes before a run starts, and a finding without a matching pre-registration record is annulled. Validation is purged walk-forward with an embargo scaled to the label horizon, significance requires a permutation test, a bootstrap confidence bound and a deflated Sharpe ratio simultaneously, and survivors are then tested for backtest overfitting by combinatorial cross-validation. One to two per cent of every generated population are placebo configurations that monitor the pipeline's own false-positive rate.

## What data does TokSeq collect?

Forty-five continuous streams: trade tape, order book depth aggregates and liquidations at second granularity, price and open interest history across eight timeframes, funding, implied volatility indices and full option chains, cross-asset and macro series, on-chain activity and exchange flows, positioning and cross-venue derivatives statistics, news feeds and an economic calendar, and prediction-market ladders as an implied distribution. Everything is collected by the platform's own code from documented public interfaces; no third-party dumps are merged, and gaps are never interpolated.

## How large is the research effort?

The first research generation produced 74 488 configurations, of which 65 267 completed, across five stages. The second generation currently holds 25 187 tasks with 419 945 result rows in its active stage. The live decision journal holds 264 723 decisions, and the paper desk record covers 152 agents and 36 642 executed trades.

## Why does the project publish its negative results?

Because the negative results are the findings. A research programme that reports only its successes has no way to tell an edge from a selection artifact, and the platform has already retracted a result that passed every gate of its first generation and then failed its forward window with a median Sharpe ratio near minus eight. Every rejected approach is recorded with the number that rejected it.

## Why volatility rather than direction?

Because that is where the evidence is. Volatility is persistent and mean-reverting, so a forecast has something to hold; its premium is compensation for bearing risk rather than a prediction of price, so it does not require anyone to be wrong; and its conditionality is testable, which makes it a research object rather than a slogan. The premium is large when implied volatility is rich and the market is quiet, and it disappears when implied volatility is cheap.

## Is the volatility result already making money?

Unproven, and stated as unproven. The premium is measured in the data across two independent markets and several years, but the live desk is inside a pre-registered thirty-day acceptance window with five criteria declared before it opened, including a paired comparison against a naive twin and a tail constraint. The window will not be extended and the thresholds will not move. Until it closes, the correct summary is that the effect is measured in the data and unproven in execution.

## How many instruments does it cover?

Three primary assets at the base, where the expensive second-level microstructure is collected, and a wider set for price history, derivatives context, macro and on-chain series. Coverage is currently being extended: a pre-registered transfer probe over twenty additional instruments passed on twelve, against a declared requirement of ten, so the instrument screen is being widened across the full set rather than to a hand-picked subset. A second, unrelated market with its own volatility index and about a dozen underlyings carrying liquid option series is being added for the volatility program.

## What is being built right now?

Three lines in order: the volatility desks through their pre-registered acceptance windows on the widened instrument set and the second market; the anomaly gate promoted from a measurement into a live one-way risk layer with its own kill criterion; and only then the interfaces – an instrument screen ranking expansion probability and regime, and a workspace that switches between a short-horizon and a volatility layout. Interfaces come last on purpose, after the thing they display has been measured.

## Does the platform sell signals, manage money or take deposits?

No. It does not sell signals, does not manage third-party funds, does not accept deposits and makes no claim about future returns. Nothing in this documentation is investment advice or an offer of any service.

## Can I use it?

Not at the moment. The platform is in a closed operating mode: the live terminal and the control panel both sit behind authentication, and the public demonstration surface that existed earlier has been withdrawn. This documentation is the public description of the work.

## How can the platform's numbers be verified?

Through the diagnostic export, which is designed for exactly that. It states the methodology in words and in the formulas taken from the code, computes the summary with the same functions that feed the operator's panel, includes every permitted forecast and every matured decision as individual rows, and recomputes the summary from those rows as a self-check so that a discrepancy is visible rather than assumed away. The reason it exists is that internal consistency is not evidence.

## What does the name mean?

Tokarev Sequence, abbreviated as TokSeq. It is a personal engineering project rather than a company, run by a single operator with an automated engineering pipeline.

# Current program and what is being built

Source: https://docs.tokseq.ru/program/

What the platform is scaling right now, which forward windows are open, and which research questions are queued with dates attached.

This page describes work in progress rather than results. It is written in the same style as the rest: with the sample sizes, the dates and the pre-registered verdicts that each item is waiting on. Items here are not claims. They are commitments to measure something.

## Instrument coverage is being widened

The research history and the live engine were built on three primary assets. That was a deliberate constraint, not a limitation of the design: three correlated instruments keep the effective sample honest while the machinery is being validated, and expanding coverage before the method is trustworthy only multiplies the multiplicity problem.

The method is now trustworthy enough to widen, and the widening was tested before it was performed. A pre-registered transfer probe over twenty additional instruments asked whether the volatility and regime models carry across, with the pass threshold declared in advance. Twelve of twenty cleared it, against a requirement of ten, so coverage is being extended across the full width rather than to a hand-picked subset.

The probe also recorded, before it ran, the caveat it then confirmed: at a one-day horizon the volatility benchmark adds nothing over the trivial statement that volatility reverts to its mean, on any instrument. At the one-hour horizon it adds 0.03 to 0.05 on all twenty-three instruments tested. The consequence is built into the design rather than glossed over. Across the wide instrument set the platform ranks the probability of one-hour expansion and the regime state; the volatility premium itself is computed only where option markets exist.

A second market is being added to the volatility program, with its own volatility index and roughly a dozen underlyings carrying liquid option series. It is unrelated to the first market, which is the point: an effect that reproduces on an independent market with different participants, different hours and different microstructure is a different class of evidence from an effect measured twice on the same one. The premium there measured +9.2 volatility points over 913 trading days, positive on 88 per cent of days and positive in every calendar year of the sample.

Storage was sized for the expansion before it started rather than discovered mid-way: current growth is about 228 megabytes a day, and the wider instrument screen plus the second market's underlyings add roughly ten gigabytes a year against 86 gigabytes free.

## Forward windows currently open

| Window | What it decides | Status |
|---|---|---|
| Volatility premium desk, 30 days | Five pre-registered criteria including a paired comparison against a naive twin, a tail constraint and a coverage band | Opened 7 September 2026, verdict due early October |
| Long-volatility cards | Whether buying expansion against cheap implied volatility survives costs, gated and pre-registered on the same pattern | Added to the demo desk in September, running alongside their twins |
| Paper desk pool, 152 agents | Distribution of forward performance including the noise tier, which is what any leaderboard has to beat | Accumulating to the end of October |
| Anomaly gate for the volatility desk | Implementation of the two signals that passed their measurement gate, with a kill criterion over a month of forward operation | Specification complete, implementation next |

None of these windows will be extended, and none of their thresholds will move. A window that fails is a result, and the pre-registration says so in advance so that the failure cannot be re-described later as a learning experience.

## Research queued, with the dates it is waiting on

The platform keeps a coverage registry of what has been collected against what has actually been tested, and the honest reading of that registry is uncomfortable: of forty-five collected streams, eighteen have taken part in experiments and twenty-seven never have. That is a wiring defect rather than a collection defect, and it is tracked as one. Roughly 480 experiment specifications are waiting on a crowding feature block and 240 on an option-surface block that do not yet exist.

Queued, each with a pre-registered verdict date rather than an intention:

- Order book depth structure as a feature family. Pre-registered, verdict not before late September, when the homogeneous history window reaches the declared floor.
- Liquidation events across venues and the remainder of the cross-venue derivatives family, entering the search stage with their coverage denominators recorded in the registry first.
- Crowding and gamma-exposure blocks, returning once their coverage floor is reached.
- Prediction-market ladders, large-order flow and long-short positioning as declared feature blocks, each with pre-registration written before the run.
- News as a feature, to be re-read exactly once when the history window reaches six months. The current gate failed – no news feature reaches the threshold and every increment over the volatility baseline is negative – and the re-read is scheduled rather than repeated opportunistically, because repeating a failed test until it passes is how false discoveries are manufactured.

## Deliberately not on the roadmap

An honest roadmap needs a section for what was closed, so that a future reader does not mistake silence for an oversight:

- Directional prediction, at any horizon this platform can measure. The family is frozen in code.
- Delta-neutral funding carry, cross-venue basis arbitrage and smart execution, each rejected by its own measurement.
- A large language model in the decision path. The measurement found no edge against a frequency baseline, and the live path remains fully deterministic. The contour is postponed rather than abandoned, and it will return only with a new question and a new pre-registration.
- Automated live trading with real money. The exchange bridge refuses a production trading host by construction, and that is not scheduled to change.

## What the next generation of the platform looks like

Three lines of work, in the order they are being executed:

1. Monetizable volatility first – the premium desk and the long-volatility cards through their acceptance windows, on the wide instrument set and on the second market.
2. The risk layer second – the anomaly gate promoted from a measurement to a live one-way gate, with its own kill criterion, because a short-volatility book without a tail gate is a bet rather than a strategy.
3. The surfaces last – an instrument screen ranking expansion probability and regime across the widened coverage, and a workspace that switches between a short-horizon layout and a volatility layout instead of pretending one layout serves both.

The ordering is deliberate. Interfaces are built after the thing they display has been measured, not before.