# The desk (/docs/concepts/the-desk)



A trading desk needs three kinds of decision, and they run at three different
clocks. Kestrel's agent architecture (OSS ADR-0032) makes that desk literal
across two model tiers and a deterministic floor:

| Tier                                       | Clock               | Cost per decision | Job                                                             |
| ------------------------------------------ | ------------------- | ----------------- | --------------------------------------------------------------- |
| **Strategist** (frontier model)            | a few times a day   | dollars           | sets the frame: the day's Plan, Brief, Mandate, and View        |
| **Watcher** (small, fast model)            | every wake, seconds | pennies           | manages the armed book inside the strategist's frame            |
| **Deterministic runtime + admission Gate** | microseconds        | \~free            | fires armed Plans at the tick; admits, never trusts, both tiers |

The strategist is not on a schedule. It is **event-driven**: it authors the
frame at the OPEN, re-frames on a SHOCK or a regime break, and answers when the
watcher escalates. Everything in between belongs to the cheaper clocks.

Status framing: ADR-0032 is a proposed design with a working tracer behind it,
run end to end on the practice tier. Nothing on this page is a performance
claim.

## Intent flows down. Veto flows up. [#intent-flows-down-veto-flows-up]

The tiers do not speak a private protocol. The interface between them is
Kestrel's existing surfaces, read at the tier boundary:

* **Plan** is standing authority. The strategist arms it; the runtime fires it
  at machine speed, fire-then-inform; the watcher manages inside it.
* **View** is what the watcher watches: a token-lean screen the strategist
  chose, cheap enough to read on every wake.
* **Mandate** is the hard envelope, and it is the **sole admission input**. The
  runtime's Gate reads the Mandate and nothing else.
* **Brief** is the soft channel: the thesis, in directional English. It shapes
  the watcher's judgment and is structurally barred from admission. Guidance
  never authorizes anything.
* **Wake**, read at the tier boundary, is the escalation channel: a
  watcher-authored Wake means "wake the strategist."

```kestrel
PLAN atm-rider budget 0.5R ttl +60m
  WHEN phase open
  DO buy 1 atm C @ lean(bid, fair, 0.5)
```

A Plan like this is a bounded-risk contingent program, never arbitrary
authority: the budget is a type, the TTL expires the authority, and the
obligations (bracket, invalidation, TTL) are enforced by the runtime no matter
which tier is managing the position. Intent flows down the cascade. Veto flows
up from the Gate.

## The safety keystone [#the-safety-keystone]

Every action the watcher authors passes the **same fail-closed admission Gate**
as any other agent: sell floored at intrinsic, budget clamp, never naked, the
bounded-risk envelope. The watcher authors above the determinism line exactly
like the strategist does, and its turn crosses into the Gate, never around it.

The consequence is the whole point of the design: a weak, mis-prompted, or even
adversarial watcher **cannot exceed its mandate**. The worst a bad watcher can
do is trade badly inside its envelope, which the Grade will punish. It can
never trade outside it, which the Gate makes structurally impossible.

**The watcher buys judgment. The runtime keeps authority.**

## Escalation: when the watcher calls the PM [#escalation-when-the-watcher-calls-the-pm]

The watcher's authority is tactical: manage an armed Plan, reload or exit a
position the Plan already authorizes, size within budget, reschedule its own
wake, stand down. When its best judgment would need more than that, it does not
guess. It escalates via a Wake:

* **Mandate edge**: the right action would sit outside its tactical authority.
* **Low certainty**: its own confidence drops below threshold: "call the PM."
* **Regime shift or SHOCK**: re-framing is definitionally the strategist's job.
* **A Brief-flagged event class**: the strategist pre-declares what it always
  wants to be woken for.

```kestrel
WAKE fast-move
  WHEN velocity(1m) > p99
  DELIVER zoom-1m KEYFRAME
```

A Wake spends attention, never risk: escalating costs a frontier call, not an
unbounded action. On escalation the strategist is re-invoked with the watcher's
journal and the current book state, issues a new Plan, Brief, and optionally
Mandate as a normal supersede, and goes back to sleep.

## What the tracers measured [#what-the-tracers-measured]

Three live tracer runs exist. All are **N=1, on a synthetic practice-tier tape,
with a prompted (un-fine-tuned) watcher; nothing here is rankable and none of
it is a performance claim**. No run used Fable-class weights: "Fable-class"
names the strategist tier in the architecture, not the model behind any number
below.

**Tracer 1** (Claude Opus 4.1 strategist + Claude Haiku 4.5 watcher): the
cascade ran end to end to one graded Bus and replayed byte-identically with no
model calls at either tier, and the frontier brain woke twice, once at the OPEN
and once because the watcher called. That, and only that, is what tracer 1
establishes: **the cascade is wireable**. It is a feasibility proof, not a
measured economics result.

We previously quoted this run as reaching the same flat grade at 34.8% of the
frontier-only cost and 47% of the wall time. **We withdraw that as a measured
economics claim**, for three reasons, and we do not replace it with a different
number:

* **The watcher was mis-prompted, the same way tracer 2 was.** The tracer driver
  never pinned the watcher's `promptProfile` here either, so this watcher also
  inherited the default *arming* prompt. The escalation profile that produced the
  ratio therefore never measured a manage-only tier — the very thing the number
  was quoted to price.
* **The flat grade is a null on both sides.** Neither arm authored a valid Plan
  (price-anchor errors, refused fail-closed) and neither ever traded. "Same
  grade" is null-vs-null, not matched performance, so the ratio prices two runs
  that both did nothing.
* **N=1 on Bedrock at temperature 0 is not reproducible.** Tracer 3 established
  that this population does not reproduce run to run, so a single draw was never
  a rate.

The honest status: the cascade's economics are **unmeasured**. The real number
waits on a properly-prompted, reproducible, N>1 run, and we will print it when
we have it. The watcher's single escalation from the run is still worth quoting
verbatim, an artifact of the run, not copy:

> RE-BRIEF: Spot 501.26 — HELD decisively above 501 gamma wall. Tape shows
> sustained push from 500.08 to 501.58 HOD with no rejection. IV skew flat, but
> price is NOT collapsing back through range. Breakout thesis (not fakeout) now
> in play. Original fade mandate is invalidated. Require strategist re-frame
> before arming new thesis.

That is the design working: the watcher hit the edge of its thesis, did not arm
a new one, and called the PM.

**Tracer 2** (Claude Opus 4.8 strategist + an untuned Qwen3 32B watcher; N=1,
practice tier) stress-tested the keystone. In the run we recorded, the watcher
reached for authority it did not have, and **every attempted over-reach was
refused at the tier boundary**; zero watcher authority ever crossed. That is
the Gate doing the one job the whole design rests on, under live load rather
than in an argument. This run cost 99.5% of the frontier-only bill: because
every wake escalated, the strategist ran nearly as often as in the baseline.
The honest reading is architectural, not a number: **any saving is gated on
escalation discipline, which is exactly what watcher training targets.** An
over-reaching watcher converts the cascade into frontier-plus-overhead; the
Mandate holds either way.

**Tracer 3** (2026-07-14) then withdrew the tracer-2 *explanation*, and the
correction is worth more than the claim it retires.

Tracer 2 read its own result as a model trait: a small model that keeps trying
to seize authority. The run could not support that reading, and the reason is a
single line of **our harness**. The tracer driver never pinned the watcher's
`promptProfile`, so the watcher inherited the default authoring prompt, the one
that teaches a model to *arm* Plans, instead of the manage-only profile that
says in as many words: do not author, manage what you were handed. Prompt and
behavior were confounded, so the published run measured our instrument, not the
model.

Say exactly this and no more: **our harness mis-prompted the watcher, so the
run we published cannot support the claim we made about model behaviour. We
withdraw the claim. We do not replace it with its opposite.**

Three consequences we hold ourselves to:

* **The counter-evidence is a signal, not a finding.** With the correct prompt
  pinned we saw zero over-reach attempts across 4 runs at 32B and zero at 8B.
  That is **N=4, one cell, one prompt, practice tier**. It does not establish
  that small models do not over-reach; it establishes that our published run
  cannot tell you either way.
* **We no longer quote 7 of 7 as a rate**, for over-reach or for authoring
  validity. Tracer 3 also established that Bedrock at temperature 0 is **not
  reproducible run to run** (invalid-turn counts of 6, 0, 0, 0 across four
  identical runs), so a single-run count was never a rate to begin with. The
  honest statement is the one above: in the run we recorded, every attempted
  over-reach was refused.
* **The keystone is untouched, because it was never a claim about the model.**
  It is a claim about the boundary. A watcher running the wrong prompt is
  exactly the "weak or mis-prompted watcher" this design exists to survive, and
  it did: the Gate refused every attempt, whatever caused them. A mis-prompted
  agent and a correctly prompted one both stay inside the envelope. That is the
  property being sold here.

**The open question, stated plainly, and under measurement.** Whether a
correctly prompted small watcher over-reaches at all, and how that varies across
model family, size, and training regime (prompted, CFG-constrained,
fine-tuned), is not settled by anything on this page. It is precisely the
**breakout map** (ADR-0032 §7), and an SFT/RL and CFG hill-climb is running
against it now. Role discipline in small models is an open research question
here, not a solved one. We will publish what replicates, when it replicates.

All three runs also surfaced the same frontier-tier authoring friction the
[grammar page](/docs/concepts/grammar) covers: the strategist repeatedly failed
to arm a valid Plan on its first attempts, and every failure failed closed to
a pass. Costly in opportunity, never in money.

## Where this goes [#where-this-goes]

Roadmap, not shipped: the prompted watcher is the cold start by design. The
program is SFT distillation from frontier trajectories over the frozen View,
then RLVR against the honest Grade, with grammar-constrained decoding for
loop-speed validity. The headline research question is the **breakout map**:
across model family, size, and training regime, where does viable in-loop
trading judgment emerge, and how cheap is the smallest model that holds the
grade? Today's tracer-1 economics are the most expensive the cascade should
ever be, and that claim will be measured, not assumed.

Determinism is untouched throughout: both tiers are ordinary agents above the
determinism line, a recorded cascade replays byte-identically, and the Grade
attributes across tiers so the two-tier thesis stays falsifiable. See
[Evidence](/docs/concepts/evidence) for what a Grade certifies and
[The four statements](/docs/concepts/statements) for the surfaces the tiers
speak.