The desk

A trading desk needs three kinds of decision, and they run at three different clocks. Kestrel's agent architecture (OSS ADR-0032) makes that desk literal across two model tiers and a deterministic floor:

The strategist is not on a schedule. It is event-driven: it authors the frame at the OPEN, re-frames on a SHOCK or a regime break, and answers when the watcher escalates. Everything in between belongs to the cheaper clocks.

Status framing: ADR-0032 is a proposed design with a working tracer behind it, run end to end on the practice tier. Nothing on this page is a performance claim.

Intent flows down. Veto flows up.

The tiers do not speak a private protocol. The interface between them is Kestrel's existing surfaces, read at the tier boundary:

• Plan is standing authority. The strategist arms it; the runtime fires it at machine speed, fire-then-inform; the watcher manages inside it.
• View is what the watcher watches: a token-lean screen the strategist chose, cheap enough to read on every wake.
• Mandate is the hard envelope, and it is the sole admission input. The runtime's Gate reads the Mandate and nothing else.
• Brief is the soft channel: the thesis, in directional English. It shapes the watcher's judgment and is structurally barred from admission. Guidance never authorizes anything.
• Wake, read at the tier boundary, is the escalation channel: a watcher-authored Wake means "wake the strategist."

PLAN atm-rider budget 0.5R ttl +60m
  WHEN phase open
  DO buy 1 atm C @ lean(bid, fair, 0.5)

A Plan like this is a bounded-risk contingent program, never arbitrary authority: the budget is a type, the TTL expires the authority, and the obligations (bracket, invalidation, TTL) are enforced by the runtime no matter which tier is managing the position. Intent flows down the cascade. Veto flows up from the Gate.

The safety keystone

Every action the watcher authors passes the same fail-closed admission Gate as any other agent: sell floored at intrinsic, budget clamp, never naked, the bounded-risk envelope. The watcher authors above the determinism line exactly like the strategist does, and its turn crosses into the Gate, never around it.

The consequence is the whole point of the design: a weak, mis-prompted, or even adversarial watcher cannot exceed its mandate. The worst a bad watcher can do is trade badly inside its envelope, which the Grade will punish. It can never trade outside it, which the Gate makes structurally impossible.

The watcher buys judgment. The runtime keeps authority.

Escalation: when the watcher calls the PM

The watcher's authority is tactical: manage an armed Plan, reload or exit a position the Plan already authorizes, size within budget, reschedule its own wake, stand down. When its best judgment would need more than that, it does not guess. It escalates via a Wake:

• Mandate edge: the right action would sit outside its tactical authority.
• Low certainty: its own confidence drops below threshold: "call the PM."
• Regime shift or SHOCK: re-framing is definitionally the strategist's job.
• A Brief-flagged event class: the strategist pre-declares what it always wants to be woken for.

WAKE fast-move
  WHEN velocity(1m) > p99
  DELIVER zoom-1m KEYFRAME

A Wake spends attention, never risk: escalating costs a frontier call, not an unbounded action. On escalation the strategist is re-invoked with the watcher's journal and the current book state, issues a new Plan, Brief, and optionally Mandate as a normal supersede, and goes back to sleep.

What the tracers measured

Three live tracer runs exist. All are N=1, on a synthetic practice-tier tape, with a prompted (un-fine-tuned) watcher; nothing here is rankable and none of it is a performance claim. No run used Fable-class weights: "Fable-class" names the strategist tier in the architecture, not the model behind any number below.

Tracer 1 (Claude Opus 4.1 strategist + Claude Haiku 4.5 watcher): the cascade ran end to end to one graded Bus and replayed byte-identically with no model calls at either tier, and the frontier brain woke twice, once at the OPEN and once because the watcher called. That, and only that, is what tracer 1 establishes: the cascade is wireable. It is a feasibility proof, not a measured economics result.

We previously quoted this run as reaching the same flat grade at 34.8% of the frontier-only cost and 47% of the wall time. We withdraw that as a measured economics claim, for three reasons, and we do not replace it with a different number:

• The watcher was mis-prompted, the same way tracer 2 was. The tracer driver never pinned the watcher's promptProfile here either, so this watcher also inherited the default arming prompt. The escalation profile that produced the ratio therefore never measured a manage-only tier — the very thing the number was quoted to price.
• The flat grade is a null on both sides. Neither arm authored a valid Plan (price-anchor errors, refused fail-closed) and neither ever traded. "Same grade" is null-vs-null, not matched performance, so the ratio prices two runs that both did nothing.
• N=1 on Bedrock at temperature 0 is not reproducible. Tracer 3 established that this population does not reproduce run to run, so a single draw was never a rate.

The honest status: the cascade's economics are unmeasured. The real number waits on a properly-prompted, reproducible, N>1 run, and we will print it when we have it. The watcher's single escalation from the run is still worth quoting verbatim, an artifact of the run, not copy:

RE-BRIEF: Spot 501.26 — HELD decisively above 501 gamma wall. Tape shows sustained push from 500.08 to 501.58 HOD with no rejection. IV skew flat, but price is NOT collapsing back through range. Breakout thesis (not fakeout) now in play. Original fade mandate is invalidated. Require strategist re-frame before arming new thesis.

That is the design working: the watcher hit the edge of its thesis, did not arm a new one, and called the PM.

Tracer 2 (Claude Opus 4.8 strategist + an untuned Qwen3 32B watcher; N=1, practice tier) stress-tested the keystone. In the run we recorded, the watcher reached for authority it did not have, and every attempted over-reach was refused at the tier boundary; zero watcher authority ever crossed. That is the Gate doing the one job the whole design rests on, under live load rather than in an argument. This run cost 99.5% of the frontier-only bill: because every wake escalated, the strategist ran nearly as often as in the baseline. The honest reading is architectural, not a number: any saving is gated on escalation discipline, which is exactly what watcher training targets. An over-reaching watcher converts the cascade into frontier-plus-overhead; the Mandate holds either way.

Tracer 3 (2026-07-14) then withdrew the tracer-2 explanation, and the correction is worth more than the claim it retires.

Tracer 2 read its own result as a model trait: a small model that keeps trying to seize authority. The run could not support that reading, and the reason is a single line of our harness. The tracer driver never pinned the watcher's promptProfile, so the watcher inherited the default authoring prompt, the one that teaches a model to arm Plans, instead of the manage-only profile that says in as many words: do not author, manage what you were handed. Prompt and behavior were confounded, so the published run measured our instrument, not the model.

Say exactly this and no more: our harness mis-prompted the watcher, so the run we published cannot support the claim we made about model behaviour. We withdraw the claim. We do not replace it with its opposite.

Three consequences we hold ourselves to:

• The counter-evidence is a signal, not a finding. With the correct prompt pinned we saw zero over-reach attempts across 4 runs at 32B and zero at 8B. That is N=4, one cell, one prompt, practice tier. It does not establish that small models do not over-reach; it establishes that our published run cannot tell you either way.
• We no longer quote 7 of 7 as a rate, for over-reach or for authoring validity. Tracer 3 also established that Bedrock at temperature 0 is not reproducible run to run (invalid-turn counts of 6, 0, 0, 0 across four identical runs), so a single-run count was never a rate to begin with. The honest statement is the one above: in the run we recorded, every attempted over-reach was refused.
• The keystone is untouched, because it was never a claim about the model. It is a claim about the boundary. A watcher running the wrong prompt is exactly the "weak or mis-prompted watcher" this design exists to survive, and it did: the Gate refused every attempt, whatever caused them. A mis-prompted agent and a correctly prompted one both stay inside the envelope. That is the property being sold here.

The open question, stated plainly, and under measurement. Whether a correctly prompted small watcher over-reaches at all, and how that varies across model family, size, and training regime (prompted, CFG-constrained, fine-tuned), is not settled by anything on this page. It is precisely the breakout map (ADR-0032 §7), and an SFT/RL and CFG hill-climb is running against it now. Role discipline in small models is an open research question here, not a solved one. We will publish what replicates, when it replicates.

All three runs also surfaced the same frontier-tier authoring friction the grammar page covers: the strategist repeatedly failed to arm a valid Plan on its first attempts, and every failure failed closed to a pass. Costly in opportunity, never in money.

Where this goes

Roadmap, not shipped: the prompted watcher is the cold start by design. The program is SFT distillation from frontier trajectories over the frozen View, then RLVR against the honest Grade, with grammar-constrained decoding for loop-speed validity. The headline research question is the breakout map: across model family, size, and training regime, where does viable in-loop trading judgment emerge, and how cheap is the smallest model that holds the grade? Today's tracer-1 economics are the most expensive the cascade should ever be, and that claim will be measured, not assumed.

Determinism is untouched throughout: both tiers are ordinary agents above the determinism line, a recorded cascade replays byte-identically, and the Grade attributes across tiers so the two-tier thesis stays falsifiable. See Evidence for what a Grade certifies and The four statements for the surfaces the tiers speak.