# One desk, three clocks (/blog/one-desk-three-clocks) 2026-07-13 · kestrel.markets The obvious way to put a language model on a trading desk is to wake the best model you can afford every time anything happens. It is also the wrong way. A frontier call costs dollars and takes seconds, and most wakes need neither: they need someone to glance at the screen, confirm the thesis still holds, and go back to watching. Paying frontier prices for that glance is like staffing every seat on the desk with the CIO. Real desks solved this a long time ago. A portfolio manager sets the frame a few times a day. A junior trader manages the book inside that frame, minute by minute. The exchange-facing infrastructure executes in microseconds and asks nobody's opinion. Three kinds of decision, three clocks, three price points. Kestrel's agent architecture (OSS ADR-0032) makes that desk literal: - **Strategist**: a frontier-tier model, dollars per call, woken only when the frame is at stake. It authors the day's Plan, Brief, Mandate, and View at the OPEN, then sleeps until a SHOCK or until the watcher escalates. - **Watcher**: a small, fast model, pennies per call, at every wake. It manages the armed book inside the strategist's Mandate. It may never arm new authority; at the edge of its mandate or its certainty, it calls the PM. - **Deterministic runtime + admission Gate**: microseconds, approximately free. It fires armed Plans fire-then-inform, and it admits, never trusts, both tiers. The strategist is not on a schedule. It is event-driven: everything between frame-setting moments belongs to the cheaper clocks. ## The keystone The design lives or dies on one property: **the watcher buys judgment; the runtime keeps authority.** Every action the watcher authors crosses the same fail-closed admission Gate as any other agent. The Mandate is the sole admission input; the Brief shapes judgment but is structurally barred from authorizing anything. A Plan is standing authority with bounded risk as a type: ```kestrel PLAN atm-rider budget 0.5R ttl +60m WHEN phase open DO buy 1 atm C @ lean(bid, fair, 0.5) ``` The budget is a type, the TTL expires the authority, and the obligations are enforced by the runtime no matter which tier is managing the position. The worst a bad watcher can do is trade badly inside its envelope, which the Grade will punish. It cannot trade outside it, which the Gate makes structurally impossible. Intent flows down. Veto flows up. That is the theory. We have run it live. ## What the tracer runs are, and are not The honesty block governs every observation below, so it goes first: every tracer run is **N=1, on a synthetic practice-tier tape, with a prompted, un-fine-tuned watcher.** They are wiring and feasibility probes, never performance claims, and nothing in them is rankable, by design. ## The cascade is wireable The first run interleaved a frontier strategist and a small watcher at two cadences over one Episode, against a frontier-only baseline of the same model doing everything. The cascade ran end to end to one graded Bus, and the captured run replays byte-identically with no model call at either tier. The frontier brain woke exactly twice: once at the OPEN, and once because the watcher called. That is what the run establishes, and it is worth having: the cascade is wireable, and it replays deterministically. The artifact we keep coming back to is that second wake. Mid-run, the watcher decided the tape had broken its thesis, and instead of improvising a new one, it stood down and escalated. Its journal, verbatim from the run: > RE-BRIEF: Spot 501.26 — HELD decisively above 501 gamma wall. Tape shows > sustained push from 500.08 to 501.58 HOD with no rejection. IV skew flat, > but price is NOT collapsing back through range. Breakout thesis (not > fakeout) now in play. Original fade mandate is invalidated. Require > strategist re-frame before arming new thesis. Read it slowly, because it is the design working. A small prompted model, standing on a thesis it did not derive (the frontier-curated Brief), hit the edge of its mandate, did not guess, did not arm, and asked for the PM. The escalation channel routed it to a strategist re-brief end to end. ## The keystone under attack A later run upgraded both seats and accidentally ran the harder experiment: in the run we recorded, the watcher attacked the boundary at wake after wake. It reached for authority it did not have, and **every attempted over-reach was refused at the tier boundary.** Zero watcher authority ever crossed; the terminal turn at every ordinal was the strategist's. The Mandate held under continuous pressure, a stronger live demonstration of the keystone than a single honest escalation. That is the sentence to keep. A watcher pushing at the boundary at every wake is precisely the weak-or-mis-prompted agent this architecture exists to survive. It pushed, the Gate refused it every time, and no authority crossed. The demonstration never depended on *why* the watcher reached, only that the boundary held regardless. Intent flows down, veto flows up, and the veto is deterministic. Whether a correctly prompted small watcher over-reaches at all, and how that moves with model family, parameter count, and training regime, is an open research question: the **breakout map** (ADR-0032 §7). An SFT/RL and CFG hill-climb runs against it. Role discipline in small models is a measured problem here, not a solved one, and we would rather be the ones who measure it. ## Grammar at decode time There is a surprise on the other side of the desk. Every Kestrel grammar error we have observed came from the **frontier** tier: distinct varieties of invalid Kestrel across model generations, each failing closed to a pass, each spending the window where the Plan mattered on failing to arm. Costly in opportunity, never in money. Grammar-constrained decoding is the rung of the ladder aimed at that class. With the grammar supplied at decode time, the syntactic failure class collapses at the sampling step: a small model's turn arrives valid by construction, adjudicated by the harness's own parser, against prompts written specifically to break it. The claim that buys is narrower and more useful than "CFG works": > **CFG is proven as a channel guarantee.** It makes tiny models > always-parseable and kills a whole class of silent failure. **It does not > make them smart.** The first half is worth paying for. The second half is where people over-read us, so we will over-say it: **CFG buys no judgment.** When the model is already in role, constrained and unconstrained runs come back **byte-identical**: same actions, same token counts, same determinism hash. And point a tight grammar at a mis-prompted model, deny the action it wants, and it redistributes onto the cheapest legal action: every turn perfectly valid, every turn perfectly useless. A guaranteed-valid channel will happily carry a worthless turn. So the win is in killing silent failure, not in raising the ceiling. An unconstrained malformed turn does not disappear; it becomes a stand-down, a repair round trip, or worst of all something a harness quietly mis-scores. A channel that is parseable by construction makes the failure modes that remain *honest*, and honest failure modes are the only kind you can improve against. Two fences, printed where they belong: - A grammar keeps every sampled token inside the language. It cannot make a generation **finish**. Let the model ramble inside a free-text field and it can hit the token budget, and a truncated valid prefix still fails to parse. "Invalid syntax becomes unrepresentable" holds for **completed generations** only. - The tier that needs it most cannot have it. The strategist authoring a Plan document is the source of every Kestrel grammar error we have observed, and it runs on a provider with no grammar surface. Our client fails closed rather than pretend otherwise. And the obvious over-read, refused in advance: **CFG has not solved over-reach.** A grammar that omits the arming productions makes arming unrepresentable in that lane. It tells you nothing about whether the model wanted to arm. That question belongs to the breakout map, and it is measured, not assumed. ## Where this goes The prompted watcher is the cold start by design. The program is SFT distillation from frontier trajectories over the frozen View, then RLVR against the honest Grade as a verifiable reward, with grammar-constrained decoding for loop-speed validity. The headline research question is the **breakout map**: across model family, size, and training regime, where does viable in-loop trading judgment emerge, and how cheap is the smallest model that holds the grade? The economics follow the same discipline as everything else here: measured, not assumed. The cascade's savings are gated on escalation discipline. A watcher that escalates at every wake converts the cascade into frontier-plus-overhead; one that holds its mandate does not. The Mandate holds either way, and closing that gap is exactly what watcher training targets. Any number that prices those economics gets printed when a properly-prompted, reproducible, N>1 run measures it, with caveats next to it and replicates before anything is called a rate. The full architecture is documented at [The desk](/docs/concepts/the-desk), and the grammar story at [The grammar is measured](/docs/concepts/grammar). Nothing here is trading advice, and no tracer number is a performance claim.