One System: the engineering behind AlgoTrada

The oldest failure mode in algorithmic trading is the two-systems split: a research stack that produces beautiful backtests, and a production stack that trades something subtly different. The two drift (a rounded threshold here, a different candle alignment there) until the live system's results have no provable relationship to the research that justified deploying it.

AlgoTrada's answer is architectural, not procedural: there is exactly one compiled decision core, written in Rust, and every consumer drives it through the same interface. The live engines feed it a dual-stream of 15-second and 1-minute bars in strict causal order; the research harness feeds it the same bars from the historical tape at unbounded speed. Ninety days of decisions replay in about eighty seconds, and they are byte-faithful to live decisions by construction, because they are the live decision path, not a reimplementation of it.

                       ┌──────────────────────────────┐
   live tape ────────► │                              │ ────► order gates ► venue
   (15s + 1m, causal)  │    ONE compiled decision     │
                       │    core (Rust state machine) │
   historical tape ──► │                              │ ────► graded ledger
   (same bars, ~85s    └──────────────────────────────┘        (win/loss, R,
    for 90 days)          identical code, identical maths        exit reason)

The honesty of this claim has a boundary, and we state it: replay fidelity covers decisions, not execution. Fills, partial fills, latency, and thin-book behaviour live between a decision and money, and are observable only live. Every backtest therefore declares its fill model explicitly: optimistic fill assumptions are banned as a matter of policy, because they once produced the two-systems split this section exists to prevent. When a replayed number and a live number disagree, the fill model is the first suspect, and the discrepancy is treated as a defect to be explained, never as noise to be waved away.

"Is the system healthy?" is an unanswerable question. "Is the wall clock healthy? The candle feed? The calibration governor? The dispatch consent gate? The fill-to-trace reconciliation?": those are answerable, one at a time. AlgoTrada decomposes its entire pipeline, from candle ingestion to order management, into individually named components, each carrying a stable identifier in what we call CXX notation: C01, C02, … C47 and counting.

Each row in the component registry answers five questions: what is this component (name and code anchor), where does it run, how do we probe it live (one command, machine-readable verdict), how do we pin it offline (its regression test), and who owns a red (the autonomous layer, or a human decision that must never be automated). A scheduled runner executes every probe a few times an hour and publishes a green/red matrix; a red row explains every red below it, so diagnosis is top-down instead of archaeological.

Two properties make this more than a status page. First, the identifiers are stable and never reused, so incident write-ups, dashboards, tests, and agent runbooks all speak the same language: "C42 is red" means the same thing in every context, forever. Second, acceptance is graded, not claimed: a component is done when its probe runs green on the host it describes, not when someone says it works. The matrix is the system's own, continuously re-earned proof of readiness, the same artifact an algorithmic-trading self-assessment framework asks firms to produce annually, except ours regenerates every few minutes.

A system that runs on more than one machine grows status surfaces the way harbours grow barnacles: a CLI here, an admin API there, a chat-bot card, a dashboard, a skill file for the AI operator. Each one re-derives the same facts (what runs where, what "fresh" means, which alias maps to which strategy), and each copy drifts independently. We measured this on our own stack: the same freshness primitive re-implemented in eighteen files; a strategy-alias table maintained in four places, one stale copy of which caused a live-routing incident; and a probe pack that, when run on the second host, raised nine alarms of which seven were false: the probes simply assumed the first host's topology everywhere.

The fix is to make the system's description of itself data. One registry file declares every host, every service with its interface and log location, and every CXX component with its probe, transport, host scope, and owner. Everything the operator looks at is a projectionof that file: the federated status command that merges both hosts into one matrix, the per-host acceptance runner, the operator dashboard, and the AI operator's own skill file, regenerated from the registry, so the agent's knowledge of the system cannot silently rot.

                  ┌────────────────────────────────┐
                  │   SYSTEM REGISTRY (one file)   │
                  │  hosts · services · C01–C47    │
                  │  probe · scope · logs · owner  │
                  └───┬────────┬─────────┬─────┬───┘
                      ▼        ▼         ▼     ▼
              federated    per-host   operator  AI-operator
              status cmd   acceptance dashboard skill file
              (both hosts, runner     (web)     (regenerated,
               one matrix) (timer)              never hand-kept)

The registry also carries the class of checks no single machine can make about itself: does each host run exactly the code that version control says it should? Does every deployed binary trace to a commit? Does the messaging channel actually round-trip? Does every routing key the fire pipeline can emit resolve to a credential? These federation probes exist because each encodes a real incident: the day we added them, the very first run caught two hosts quietly diverged from the repository and a credential-resolution path that could never have succeeded. Drift is not prevented by discipline; it is prevented by a probe that turns red.

Entry signals get the attention; exits move the money. This section walks through one complete research cycle on the exit side, including the methodology that makes the numbers trustworthy and the negative result that stopped us from over-applying the winner.

Method.The replay harness records, for every historical fire, a bar-by-bar forward envelope: how far price moved in the trade's favour and against it, at 15-second resolution, from entry to horizon. Because the envelope is recorded once, every candidate exit policy can be evaluated on identical price paths: the comparison is exit versus exit, never run versus run. The window is pinned (same fires, same bars for every arm), results are split in-sample/out-of-sample, and a champion must sit on a broad parameter plateau: a spike that wins at exactly one setting is treated as an artifact.

The problem.Our futures strategy's shipped exit banked many small wins: 74.4% of trades positive over the 90-day study window, but with a trailing stop that repeatedly cut the rare multi-hour swings that pay for everything. The obvious alternative, ride every trade to a structural price target with no trail, more than doubled the return sum but dropped the win rate twelve points. The question: is that trade-off fundamental, or routable per trade?

The finding. A per-trade oracle (perfect exit choice in hindsight) showed the trade-off is not fundamental, and the separating variable turned out to be early conviction: whether the trade achieves +1.5R of favourable movement before −0.5R of adverse movement within its first fifteen minutes. Trades with early conviction rode to large targets profitably; trades without it were poison to ride and fine to trail. The champion policy routes on that signal, protects matured rides with a single break-even bump, and otherwise never trails a ride.

The negative result, and the rule it produced. The same chassis transplanted onto our corridor strategy, evaluated on 218 of its real, ledger-recorded round-trips, lostto that strategy's shipped exit on every market and in both sample halves. The diagnosis: the ride chassis cures a disease the first strategy had (a trail strangling long swings) that the second strategy simply does not have: its exit already rides its own structure to completion. The standing rule this minted: never transplant an exit across strategies without an envelope-level A/B on that strategy's own fires.Exit research is routed by what the entry's winners look like, not by what worked elsewhere.

No strategy earns live capital by being impressive in research. Every strategy cell, a (strategy × market) pair, climbs an explicit ladder: PAPER → SHADOW → MICRO → LIVE, one rung per gated review, with quantitative promotion criteria (sustained win rate on a sufficient sample of resolved trades) and no rung-skipping. Demotion is automatic and faster than promotion: a calibration governor watches every cell's rolling performance and self-disarms a cell that degrades, re-arming it only after it re-proves itself out-of-sample. Several of our cells are disarmed at any given time. This is the system working, not failing.

   PAPER ──► SHADOW ──► MICRO ──► LIVE
     │           │          │         │
     no orders   real-time  smallest  full size
     logged      decisions, real      │
     decisions   no money   orders    │
     ▲           ▲          ▲         │
     └───────────┴──────────┴─────────┘
        calibration governor: automatic demotion
        on rolling-window degradation, re-arm only
        after out-of-sample re-proof

Around the ladder sit the fail-closed gates, controls that block when in doubt, in the spirit of the pre-trade risk-control frameworks that regulated algorithmic trading operates under. An order reaches a venue only if allof the following hold: the operator's explicit, dated consent for that venue lane is present and fresh (consent expires; silence is a "no"); the venue shows a live, two-sided market at fire time (a missing mark degrades the fire to shadow rather than guessing); per-trade session windows authored in configuration allow this second of the trading day (hot-reloaded, no restart); the day's realised loss has not tripped the daily circuit breaker; and the order carries an idempotency key so a retry can never double-fill. After the fill, a reconciliation loop plays the role of a drop-copy check: every venue fill must trace back to a decision with full context, and untraceable fills raise a component red (C42) until a human or an agent explains them.

AlgoTrada is operated by a small team working withautonomous AI operators: agents that read the same component matrix, run the same probes, and follow runbooks generated from the same registry as every human surface. When a row turns red, an agent investigates the way a good engineer would: pull the component's logs, reproduce the failure, form a causal chain, and either fix it or escalate. The industry calls this pattern an "AI SRE"; we have been converging on it from the trading side, where the discipline is older: every action must be justifiable to an auditor after the fact.

The trust model is human-on-the-loop, and it is encoded in data, not in vibes: every registry row carries an owner. Rows owned by the autonomous layer (restart a stalled feed, rebuild a stale artifact, repair a broken probe) may be fixed by an agent unprompted. Rows owned by the operator (live-trading consent, capital exposure, anything that changes what real money does) may be diagnosed by an agent but never acted on: the agent's job ends at presenting the evidence and the options. The boundary is checkable, because it is written down per component, in the same file everything else reads.

Two working rules keep agentic operations honest. Causal chains with cited evidence:an agent's conclusion is a sequence of claims, each anchored to a probe output, a log line, or a ledger row: "the exit inverted because the side field arrived capitalised differently and the comparison was exact-match" is acceptable; "the exit seems flaky" is not. Graded, not claimed: a fix does not exist until the probe that was red runs green, the same acceptance rule the rest of the system lives under. In practice the agents find what post-hoc review would have found weeks later: the morning we introduced the federation probes, they surfaced hosts drifted from version control and a credential path that could never resolve, before the trading session, not after.