Methodology - GMX E1 shadow monitor

Methodology back to dashboard

Contents 1 Measured quantities - 2 Harm ledger - 3 Loss budget - 4 Incident machine - 5 Pre-gate - 6 Exit dial U - 7 TaR - 8 LP outflow - 9 Verification - 10 Operations - 11 Provenance glossary - 12 Live constants - 13 Known limitations

1. Measured quantities

quantity	definition	source
S (net skew)	(long - short open interest) x index price, signed USD per market; positive = traders net long = LPs net short.	GMX DataStore at a pinned block, every 2 min; second RPC referees every read to exact integers.
index price P	mid of the oracle min/max at the poll.	GMX tickers API.
sigma gate	per-market volatility per sqrt-hour: the maximum of an EWMA of wall-dt returns, a short-window range estimator, and a floor.	computed from the poll series.
impact pool	per-market protocol bucket of accumulated net price impact, index-token denominated, repriced per tick.	DataStore POSITION_IMPACT_POOL_AMOUNT.

2. Harm ledger: X, D, C_mark

The continuous attribution ledger X accrues the LP side of mark-to-market on standing skew, loss-positive, with LEFT-LIMIT inputs (the skew standing BEFORE a move gets the attribution; a mid-interval fill affects only later intervals):

\[\mathrm{d}X=\sum_{m}\;S^{\mathrm{prev}}_{m}\,\frac{P^{\mathrm{now}}_{m}-P^{\mathrm{prev}}_{m}}{P^{\mathrm{prev}}_{m}}\qquad X=\sum_{\mathrm{intervals}}\mathrm{d}X\]

Intervals are wall-clock; a failed read prices nothing and HOLDS X.

Worked example (illustrative): S_prev = +1,600,000 (traders net LONG, BTC), P 65,900 -> 66,100 (+0.30349%) over one 2-min interval: traders gain, LPs lose; dX = +1,600,000 x 0.0030349 = +4,856 into the ledger (loss-positive).

D = X - X_anchor, the harm attributed to the CURRENT incident; the anchor is set (backdated) to when the incident's sustain began. C_mark banks the final D of every lossy incident close - one-way, max-then-add; profitable incidents never offset it. Why mark-to-market counts as real: GM pool pricing embeds open trader PnL continuously, so an LP redeeming today exits at a value already reduced by today's D; at abort the open MtM becomes the literal bill.

3. Loss budget B_net

\[B_{\mathrm{net}}(t)=\min_{\tau\le t}\Bigl(\mathrm{pool\ cash}(\tau)-\mathrm{committed\ boost}(\tau)\Bigr)\]

MONOTONE NON-INCREASING: drawdowns bite immediately; unrealized gains and pool inflows never loosen the dial (they count only at a governed reset). The funding-source question (one pot or two) sets the basis - open item, conservative branch running, labeled.

4. Incident machine

state	enters when	exits when
IDLE	-	an episode label opens (a) or the pre-gate (b)-opens.
INCIDENT	\|S\| >= E_hi sustained 5 min (t0 and the X-anchor BACKDATED to sustain-begin), or (b)-open adopting the pre-gate's provisional anchor.	quiet (\|S\| < E_lo, 30 min) AND margin restored AND 60-min cooldown; a lossy close banks D into C_mark.
RED_LATCHED	U >= 1, an invalid divisor (red-equivalent), or an external red reason.	two-key clear only (PI restored + human clear). Ledgers keep accounting under the latch; recovery is recorded, never a clear.

5. Pre-gate (early warning)

\[d_{\mathrm{prov}}=X-\min_{\mathrm{window}}X\qquad\mathrm{ARM\ when}\quad d_{\mathrm{prov}}+\mathrm{tail}\;\ge\;\alpha\,B_{\mathrm{net}}\]

Arms BEFORE any episode label opens, so a fast-developing situation is never invisible during its first minutes; a subsequent (b)-open adopts the provisional anchor, making D continuous from the true start.

6. The exit dial U (the alarm)

\[U=\frac{\max(D,0)+C_{\mathrm{mark}}+\mathrm{tail}}{B_{\mathrm{net}}}\]

The tail prices the abort path itself: exposure keeps growing during the pre-abort window (detect 4 + decide 30 + revert 20 = 54 min, ASSUMED pending the SLA answer and the timed drill), then a stressed unwind to 114 min total:

\[\sigma^{\mathrm{stress}}_{m}=\max\bigl(\sigma^{\mathrm{gate}}_{m},\ \mathrm{floor}_{m}\bigr)\qquad|S_{m}(s)|=|S_{m}|+g_{m}\min(s,L_{\mathrm{pre}})\]

\[a(s)=\sum_{m}|S_{m}(s)|\,\sigma^{\mathrm{stress}}_{m}\quad(\mathrm{correlation}\ 1)\qquad\mathrm{d}V=\int_{0}^{L_{\mathrm{total}}}a(s)^{2}\,ds\qquad\mathrm{tail}=k_{\mathrm{stress}}\sqrt{\mathrm{d}V}\]

Red line at U = 1: past it, even stopping immediately no longer fits the budget - the pre-commitment is to abort while reversal remains affordable. Abort = restore the PI override to 1.0; positions do not close, but full rebate incentives return for whoever flattens the imbalance. A companion projection (hours until U = 1 on the stressed path) drives the yellow warning.

7. TaR (reporting only)

\[\mathrm{TaR}_{q}=k_{q}\sqrt{\mathrm{d}V_{\mathrm{exit}}}\qquad k_{95}=1.37\ [1.30,\,1.44]\ \mathrm{MEASURED}\]

The same stressed-exit variance at a measured quantile multiplier. Ledger rule 5: TaR is the forecast/reporting object; the exit test U is the alarm - never interchangeable. TaR holds no threshold, no alert, no decision role; it appears on the budget panel and in the strip as context. Keeping the objects separate prevents the alarm from acquiring a false statistical pedigree and the reporting quantile from becoming a gate nobody ratified.

8. LP outflow input (yellow only)

Rolling 168-hour net LP outflow fraction per market and aggregate, from GM token transfer events, published only on EXACT reconciliation against on-chain supply. Feeds a yellow flag - never the red path. Stale beyond 26 h holds the last value and says so.

9. Verification (five layers)

layer	proves	cadence	tolerance
dual-RPC referee	every live read matches a second source	every tick	exact integers
event-stream crosscheck	live readings reproduce from raw trade events by an independent path, joined at exact block timestamps	daily	exact zero
flow reconciliation	LP flow totals equal on-chain token supply	each refresh	exact
conformance vectors	the implementation reproduces the frozen SPEC Section-8 numbers	every deployment (blocks install)	printed precision
deterministic replay	the whole history re-derives from the logs	on demand	tight numeric bands

10. Operations

2-minute loop under macOS service supervision on an always-on machine; atomic checkpoints mean a restart NEVER zeroes risk state (kill, sleep, and update all field-tested). An independent watchdog checks liveness every 2 minutes and restarts a hung loop. The pager pipeline is built and tested but DARK: alerts write to a local outbox until the rota and ack SLA land; arming is a config flip plus secrets. A dev instance runs separately; a single-writer lock refuses concurrent writers per state directory.

11. Provenance glossary

tag	meaning
GOVERNED	a policy choice, owned and ratified by the experiment owner.
MEASURED	estimated from data with a stated method and interval.
PROVISIONAL	a working value awaiting measurement or ratification.
PLACEHOLDER	deliberately conservative stand-in; loud by design; dies at calibration.
ASSUMED	a design assumption stated as such (e.g. the 54-min pre-abort composition) pending an empirical answer.

12. Live constants (from configuration)

constant	value	provenance
poll interval	120 s	GOVERNED cadence
k_stress	2	GOVERNED scenario factor (no percentile claim)
L_pre / L_total	54 / 114 min	ASSUMED: 4 + 30 + 20; + 60 unwind
g USD/h (B/E/S)	8,000,000 / 6,000,000 / 4,000,000	PLACEHOLDER until D2
sigma stress floors	0.006 / 0.008 / 0.01 /sqrt-h	GOVERNED floors
episode E_hi	1,000,000 / 1,000,000 / 1,000,000 USD	PROVISIONAL floor pending D2 (known over-opener)
episode E_lo	500,000 / 500,000 / 500,000 USD	PROVISIONAL pending D2
LP outflow thresholds	0.20 per market / 0.15 aggregate	PROVISIONAL pending owner number (B-question)
k95 (TaR)	1.37	MEASURED [1.30, 1.44], churn calibrator, calm-2026
paging	DARK	unarmed until rota + ack SLA; alerts to local outbox

13. Known limitations (stated, not hidden)

U's level is placeholder-dominated pre-D2 (about 70 percent of a calm-day reading is the growth assumption); measured g replaces it at calibration.
E_hi is a floor and a known over-opener; current incident classification is exercise, not experiment harm.
The 54-min pre-abort window is a design assumption until the ack SLA lands and the revert drill is timed.
With OI caps suspended, nothing structural bounds an unresolved skew beyond the pre-registered terminal action - stated risk, open question.
The boost funding source (one pot or two) moves the budget basis about 40 percent - open item; the conservative branch runs, labeled.

generated 2026-07-23 23:04Z from gates_shadow.json | normative spec: SPEC.md (Section 8 conformance vectors) | full source and history: the shared repository