BSL Operations

BSL operations exist to keep professional order flow bounded, observable, and recoverable. A market maker should receive a tested endpoint bundle, not a list of every internal route.

Live Metadata Checks

These checks are safe first probes in private beta:

Check	Expected beta behavior
GET /api/v1/bsl/connectivity	200, endpoint bundle, direct BSL/FIX rules, CompID derivation.
GET /api/v1/fix/connectivity	Same bundle, convenient for FIX-only onboarding.
GET /api/v1/bsl/limits	200, BSL contract headers/body, current rate envelope.
GET /api/v1/bsl/executions	200, stream/replay metadata.
GET /api/v1/bsl/sessions	200, possibly empty session list.
GET /api/v1/bsl/markets/{marketId}/quote-obligations	200, possibly empty obligations.
GET /api/v1/bsl/accounts/{account}/executions?cursor=0 without token	401, protected private-read behavior.

Submit Readiness

Before giving a client production quote capacity:

• Run node scripts/e2e/mm-docs-contract-audit.cjs.
• Verify signed compact order submit and cancel cleanup.
• Verify the exact route in the client's bundle:
  • beta alias: /api/order-entry/binary
  • direct compatibility route: /api/v1/mm/orders/batch.bin
  • canonical route after rollout: /api/v1/bsl/orders/compact
• Confirm result and response modes. In beta, start with x-bsl-result-mode: ack plus x-senticore-response-mode: detailed.
• Confirm private stream, FIX drop-copy, or account-read reconciliation path.

Backpressure Policy

BSL should reject early when latency cannot stay bounded:

Code	Operational cause
SHARD_BUSY	Market shard cannot accept more work without queue aging.
QUEUE_LIMIT	Ingress lane, backlog, or concurrency limit reached.
RISK_CREDIT_LIMIT	Credit or exposure reservation denied.
KILL_SWITCH	Account, market, or venue kill-switch active.
MARKET_HALTED	Market lifecycle gate blocked trading.

For professional clients this is a feature. A fast reject lets the strategy cancel, widen, or pause immediately.

Observability

Monitor these dimensions per account, market, and shard:

Metric family	Why it matters
Order-entry request latency	Separates edge, auth, signing, sequencing, and read-plane costs.
BSL reject counts by code	Shows whether clients hit queue, risk, market, or auth limits.
Per-shard exposure and locked credit	Protects the venue while allowing multi-market quoting.
Release lag for credit/order reservations	Finds stale locks that reduce quote capacity.
Private stream gap-fill rate	Detects stream disconnects or client lag.
FIX session rejects and resend rate	Catches sequence and conformance drift.

Client Handoff Checklist

• Endpoint bundle contains host, route, TLS/SNI mode, expected BSL result mode, and expected response verbosity.
• FIX bundle contains SenderCompID(49), TargetCompID(56), TargetSubID(57), account, host, port, and TLS SNI. Clients should get these from /api/v1/bsl/connectivity instead of guessing.
• Credential bundle uses institutional_agent HMAC for FIX/BSL machine access, with account binding, allowed markets, scopes, rate tier, cancel-on-disconnect policy, drop-copy entitlement, and FIX permission recorded during onboarding.
• Order-entry lane key is provisioned only when needed for dedicated limits.
• Client has tested behavior for SHARD_BUSY, QUEUE_LIMIT, RISK_CREDIT_LIMIT, KILL_SWITCH, and MARKET_HALTED.
• Cancel-on-disconnect is tested with a resting-order account before unattended quoting. Automatic cancel-on-disconnect applies to session-key BSL Direct TCP sessions (policy cancelOnDisconnect=true), FIX, and FIXP. Wallet-signed BSL TCP sessions do not get an automatic sweep - use the explicit cancel-on-disconnect endpoint or cancel-all instead.