Live Verified Beta
This page is the current external-facing verification snapshot for professional integrations. It is written for market makers, liquidity providers, and HFT-style teams that need to know what is live, what was tested, and what still requires account-level conformance before production use.
The credentialed 30-minute BSL HTTP canary below was run on July 7, 2026
and remains historical evidence; it was not silently re-dated. HTTP across all
five markets, BSL Direct TCP, FIX 4.4, FIXP/SBE, DNS/TLS, and production-route
reachability were credential-tested again on July 25, 2026. Current
placement availability must still be read from GET /api/v1/readiness.
External market-maker measurements — September 2026
An external market maker (eleven engine accounts, twenty price levels per side on twelve books, 68,422 BSL submits between 2026-08-30 and 2026-09-04) measured every lane from a client with a 29.6–30.0 ms network round trip to the venue. These are single-order conformance samples for FIX and FIXP and live-fleet percentiles for BSL HTTP, not capacity claims.
| Lane | Client round trip | Venue share above network | Confirmation |
|---|---|---|---|
| FIX 4.4 order → ExecutionReport | 29.2–29.8 ms | 0.3–0.4 ms | In the ack |
| FIX 4.4 cancel → ExecutionReport | 29.9–32.2 ms | 0.3–0.4 ms | In the ack |
| FIXP/SBE order → ack | 31.0 ms | ~1 ms | Ack yes; ExecutionReports delivered 4.7 s later although the engine applied within 66–190 ms |
BSL HTTP /bsl/orders/compact submit | p50 79 ms · p90 110 ms · p99 158 ms · max 7,339 ms | ~49 ms at p50 (TLS, HMAC, signature verify) | Receipt p50 70 ms · p90 162 ms · max 14,880 ms |
| BSL Direct TCP | Handshake/heartbeat within network noise | not measurable | Wallet-signed frames rejected with GatewayReject 202; no order was accepted on this lane |
Engine capacity was never the constraint: the fleet used about 45 actions per
second against a budget of 4,000 per second and account. Two defects surfaced
that a client must design around: acknowledgements and receipts have a tail of
several seconds on every lane, and an accepted BSL response can arrive without
order ids (accepted BSL response did not include order ids), which forces
local derivation of child order ids from the signed payload.
What Is Verified
Production lane canaries — July 25, 2026
These are credentialed production tests with funded internal-beta accounts.
FIX and FIXP order timings are single-order conformance samples (n=1), not
percentiles or capacity claims.
| Lane | Scope | Result |
|---|---|---|
| HTTP signed actions | Binary market 1 and spot markets 2–5; depth, matches, Post-only, IOC, FOK, Reduce-only, Split/Merge, PnL, algo orders, and cleanup | Passed |
| BSL Direct TCP | 10/10 matched trades, alternate maker/taker roles | 0 rejects; maker ACK p50 42.627 ms / p99 55.875 ms; taker ACK p50 42.461 ms / p99 47.639 ms; trade visibility p99 63.624 ms |
| BSL compact HMAC, spot | CKT/USDC SpotQuoteReplace; stale machine nonce recovered from the server-provided floor and re-signed | HTTP 200; 1/1 accepted; local and server-derived order id matched |
| BSL restart recovery | Idle-core-restart Unix regression suite 8/8; gateway v165 deployed; then 4/4 matched BSL/TCP trades | 0 rejects; cleanup passed; gateway healthy with zero restarts |
| FIX 4.4 binary | Market 1, D/H/G/F/q/AF | Passed; New 294 ms, Status 36 ms, Replace 338 ms, Cancel 449 ms |
| FIX 4.4 spot | Market 4 CKT/USDC, D/H/G/F/q/AF | Passed; New 268 ms, Status 66 ms, Replace 374 ms, Cancel 581 ms |
| FIXP/SBE | 8/8 golden vectors, Negotiate/Establish, binary market 1 and spot market 5 | Passed; market 1 New/Cancel 288/441 ms; market 5 New/Cancel 400/656 ms |
These canaries prove the tested account and lifecycle. Every unattended market maker still needs account-policy, rate-limit, COD, drop-copy, and recovery conformance for its own credential set.
60-minute multi-lane production soak — July 25, 2026
Three funded internal-beta wallets rotated through maker, counterparty, and taker roles. Every market sweep exercised the binary market plus all four spot markets and ended with no open orders or locked balances for either participant.
| Metric | Result |
|---|---|
| Runtime | 60.332 minutes |
| Full market sweeps | 36 |
| Signed action submissions | 5,904, including intentional boundary rejects |
| Algo / BSL Direct TCP / FIX / FIXP canaries | 6 / 6 / 6 / 6 |
| Child runs | 63 passed, 0 failed |
| Readiness gates | 36 / 36 passed |
| Durable batch progress during sampled gates | 71,780 → 75,981 |
| Maximum checkpoint-persist / engine-truth lag | 0 / 0 batches |
| Transient recoveries | 0 |
| Maximum signed-submit total / read-model visibility | 1,429 / 1,493 ms |
| BSL Direct TCP | 48 submissions, 24 matched cycles, 0 rejects; client RTT p50 43.997 ms / p95 78.720 ms / p99 167.967 ms |
| Final cleanup | AC, AB, and BC all passed |
The BSL RTT values in this soak are from the public client path and are not co-location or engine-only latency claims. During the same production review, checkpoint 644 finalized with four accepted validator results, zero failed, and a required quorum of three.
Historical 30-minute BSL HTTP canary — July 7, 2026
The latest funded market-maker canary used the BSL HTTP order-entry path with private receipt/execution reconciliation. It did not use BSL Direct TCP.
| Metric | Result |
|---|---|
| Runtime | 30 minutes |
| Cycles | 90 / 90 successful |
| New trades | 90 |
| Applied receipts | 180 |
| Non-applied receipts | 0 |
| Maker submit p50 | 150.5 ms |
| Taker submit p50 | 126.4 ms |
Three maker submits retried after stale local nonce-window state from older
account activity; the server returned the nonce floor and the client recovered.
For unattended market making, clients should periodically refresh nonceFloor
from bootstrap or snap to the server-provided floor on any nonce reject.
Direct TCP is live-tested, but remains account-level conformance work after the BSL HTTP quote, reconciliation, and nonce-recovery path are green.
| Area | Result | Client impact |
|---|---|---|
| Public status | 200, operational | Clients can health-check the venue before connecting. |
| BSL metadata | GET /api/v1/bsl/limits, /executions, /sessions, quote obligations return expected beta contracts | Market makers can discover the live BSL envelope before submitting flow. |
| Protected BSL reads | Private execution replay without auth returns 401 | Private account data is not exposed by metadata routes. |
api_agent creation | Wallet-authorized api_agent with HMAC credential succeeds | Standard trading bots can use normal HTTP/private read flows. |
institutional_agent creation | Wallet-authorized institutional_agent with HMAC credential succeeds | Market makers can self-create the credential family used for BSL/FIX beta access. |
BSL submit with api_agent | Rejected with 403 | Standard bot credentials cannot accidentally enter institutional order-entry. |
BSL submit with institutional_agent | 200, one signed action accepted, derived order id returned | Professional compact order-entry is live on the canonical BSL route. |
| BSL cleanup cancel | 200 in the institutional conformance run | A resting test order can be cleaned up through the same BSL path. |
FIX Logon with institutional_agent | FIX 35=A Logon accepted | Raw TCP/TLS FIX is usable for provisioned institutional sessions. |
FIX Logon with api_agent | Connection rejected/closed | FIX uses the same institutional permission boundary as BSL. |
Historical HTTP integration timings
These timings are public-internet samples. They include client network path, Cloudflare/edge path where applicable, auth, proxying, and service response time. For the current long-canary order-entry numbers, use the table above.
| Flow | Latest sample |
|---|---|
Create api_agent + HMAC | 394 ms |
Create institutional_agent + HMAC | 169 ms |
| HMAC trading read | 108 ms |
| BSL sessions read | 279 ms |
| BSL execution replay metadata/read | 209 ms |
BSL submit rejected for api_agent | 368 ms |
BSL submit accepted for institutional_agent | 219 ms |
| BSL cleanup cancel | 258 ms |
| FIX institutional Logon | 318 ms |
FIX api_agent rejected | 419 ms |
For latency benchmarking, separate these integration timings from engine-local hotpath measurements. The important client-facing fact here is determinism: the correct credential gets a clear result, the wrong credential gets a fast reject, and the response contract is stable enough to automate.
Contract To Use
For professional beta order-entry, use the BSL compact route:
POST /api/v1/bsl/orders/compact
Content-Type: application/x-senticore-order-entry-batch
Accept: application/x-senticore-order-entry-batch-response, application/json
X-BSL-Result-Mode: ack
X-Senticore-Response-Mode: detailed
SC-Auth-Version: 2
SC-Key: <institutional apiKeyId>
SC-Nonce: <monotonic nonce>
SC-Timestamp: <unix ms>
SC-Passphrase: <apiPassphrase>
SC-Signature: <hmac over method/path/query/body>
The submitted action inside the compact batch must still be signed by the account or an authorized signer. The HMAC credential authorizes the machine session and business-line route; it does not replace per-action authorization.
Reproduce The Public Audit
From the repository root:
node scripts/e2e/mm-docs-contract-audit.cjs
The audit writes tmp/mm-docs-contract-audit-last.json and checks:
- platform status and BSL metadata,
- protected private-read rejection without auth,
- signed compact order submit on the canonical BSL route using the documented
compact signed action envelope (
SpotPlaceOrderfor spot markets,PlaceOrderfor prediction markets), - ACK-mode reconciliation against the open-order read model,
- nonce resync on a one-time stale nonce race.
The audit gate requires 200 on signed BSL submit and, when the test order
rests, 200 on cleanup cancel. The generated JSON report stores the exact
timings for the run.
The institutional conformance run used for onboarding additionally creates a
temporary institutional_agent, submits over BSL with HMAC, cleans up over BSL,
and validates FIX Logon over raw TCP/TLS.
Boundaries
| Topic | Current beta stance |
|---|---|
ACK result mode | Default for BSL beta submit. It proves accepted boundary, not terminal order state. |
DURABLE result mode | Use when an account needs a durability boundary in the response. |
FULL result mode | Provisioned account-level conformance required before relying on it for IOC/FOK/cancel/replace terminal truth. |
| Private streams/drop-copy | Must be validated per account before a market maker treats them as primary reconciliation. |
| FIX connectivity | Raw TCP/TLS direct endpoint; not an HTTPS route behind Cloudflare. |
| Production cutover | Requires account policy, rate tier, cancel-on-disconnect, drop-copy, and kill-switch review. |