BL-TR-003: The Shadow Harness

BIJECTIVE LABS

BIJECTIVE LABS . SEP 7, 2026

BL-TR-003: The Shadow Harness

Status: RELEASED

Classification: PUBLIC

Revision: 1

Date: 2026-09-07

1. What shadow is for

Shadow runs the complete strategy against the live market in real time, computing net expectation from the first day, and placing no orders.

It is layer 7 of the falsification chain and the most expensive layer, because it can only be paid for in calendar time. It is also the only layer that tests what the earlier six cannot: that the signal survives in real-time data with real gaps, that the cost model holds against live spreads, and that the strategy behaves when a feed does something unexpected.

Two hypotheses in this record reached it. Neither passed.

2. The zero-order guarantee

A shadow process must be structurally incapable of placing an order, not merely configured against it.

The distinction is the whole design. A flag is a decision somebody can change, or fail to set, or set correctly in one environment and not another. A process with no execution wiring compiled into it cannot place an order regardless of what any configuration says.

The read-only recorder for the second venue was built this way. It has no execution path at all, and the guarantee is enforced at the process level.

3. Isolation, and the invariant it protects

Shadow strategies run as sidecar containers rather than as threads inside the trading process.

This costs memory and buys something worth more. A strategy accumulating a clean forward record is an asset, and the sample is destroyed the moment the process restarts. Running research in the same process as a strategy under evaluation means every deployment of the former resets the latter.

The invariant is stated as a rule: new work runs as an additive parallel shadow and never disturbs a running strategy. No restart, no recreate, no attaching to a running container to change something.

It was written down after a four-variable redesign broke a working configuration and no post-mortem could say which of the four was responsible. R-15 and R-16 both come from that episode.

4. The parallel portfolio

The harness runs several shadow strategies at once against shared state.

That capability was not designed. It fell out of separating ingestion from strategy, and it was discovered when the question was asked whether the architecture was locked to a single strategy. It was not: data published to a shared substrate, universes combined additively, and nothing on the hot path assumed one consumer.

The effect on research rate was large. Three variants ran concurrently in the maker era where the previous cadence had been one per day. In the July stretch on the second venue, three exit mechanisms were tested and closed in five days.

5. Net from day one

A shadow record computed gross is worse than no shadow record, because it carries the authority of live data while measuring the wrong quantity.

That is not hypothetical. For most of the first programme, shadow trades were recorded with a realised return computed as the difference between entry and exit mid-price, with no fee, spread, slippage or funding anywhere in the path. Every verdict drawn from that record was a gross number wearing a net label, and the correction moved one strategy from a reported +1.38 basis points to -5.6.

The harness now applies the full cost model at record time rather than at analysis time, so a shadow trade is written with its cost decomposition attached and cannot be read as gross by a later consumer.

BL-IN-002 is the case study.

6. One substrate, one code path

Shadow and live must consume the same data through the same code.

A strategy in the archive read market data from a streaming feed in shadow and was intended to use a request-based client live. The two disagreed in coverage, in timing, and in which fields were populated, which meant the shadow record was measuring a different strategy from the one that would run.

The remedy was to rebuild the strategy on a single client used in both. This is the least glamorous item in the harness design and one of the most important, because the discrepancy is invisible from inside either environment. Nothing in the shadow record looks wrong. It is simply not the same strategy.

7. What shadow cannot test

Three things, stated so a reader does not over-read a passing shadow result.

Whether your order fills. Shadow places none. Fill probability is estimated by a separate instrument and every estimate in this record is labelled as one.

The 823 triggers and zero fills from the one live venue touch are the cost of this gap made concrete. The strategy had a signal, the signal fired, and no order would have been filled.

Market impact. Nothing ran at a size where its own transacting moved the book.

Behaviour under loss. Not a measurement problem, and out of scope for a research record, but it is the remaining gap between a validated shadow result and a live deployment and it should be named rather than ignored.

8. Acceptance

A shadow run is not evidence until it reaches its declared sample and passes the evaluation standard in BL-D-004. Two failure modes were seen often enough to name.

A healthy container is not a valid edge. Uptime, loop counts and zero error counts say nothing about whether the sample is any good. One verdict in this record was computed on a sample that was 87 percent a single junk instrument while every health metric was green.

Liveness is not delivery. A feed reporting itself connected was delivering nothing for more than nine days, and a strategy waited on it the entire time.

The harness therefore reports trade production rate and sample composition alongside health, and R-19 requires the decomposition before any verdict.

9. Cross-references

BL-D-001 section 7 for layer 7. BL-D-010 for the full gap decomposition. BL-IN-002 and BL-IN-004 for the two acceptance failures. BL-TR-001 section 6 for the research separation. BL-D-009 rules R-15, R-16 and R-19.