Institutional Lane Parity
Senticore runs one matching engine and several entry lanes. The lane changes the wire protocol, latency profile, and operational contract; it must not change the economic semantics of an order. Use this page as the high-level certification matrix before onboarding a market maker or publishing a lane as production ready.
Product Contract
All institutional lanes share these invariants:
- one canonical account and risk model,
- the same market registry and lifecycle policy,
- the same price-time priority and self-trade-prevention modes,
- the same nonce, replay, idempotency, and backpressure posture for the lane's transport model,
- the same final state source of truth: private streams, drop-copy, gap-fill, account/order reads, and persisted receipts.
The lane-specific difference is only the client protocol:
| Lane | Best use | Auth model | Latency posture |
|---|---|---|---|
| HTTP signed trading | Wallet/app order entry and broad action coverage | Per-action wallet/delegated signature | Highest overhead, broadest compatibility |
| BSL compact HTTP | MM onboarding and compact batch fallback | Local action signature plus HMAC/lane credential | Stable fallback, CDN/HTTP overhead |
| BSL Direct TCP | Native quote-loop hot path | Per-action AuthSidecar; session-key AuthSidecarV2 for fast signing | Lowest Senticore-native live path |
| FIX 4.4 | OMS and desks with existing FIX engines | Session HMAC credential | Mature institutional compatibility |
| FIXP/SBE | Binary-FIX shops and SBE stacks | FIXP session credential | Binary session, codec-certifiable |
Functional Matrix
| Capability | HTTP signed / BSL HTTP | BSL Direct TCP | FIX 4.4 | FIXP/SBE |
|---|---|---|---|---|
| Spot limit/market place | SpotPlaceOrder | SpotPlaceOrder compact frame | D NewOrderSingle, spot market | Template 1 NewOrderSingle |
| Prediction YES/NO place | PlaceOrder / public OutcomePlaceOrder alias | PlaceOrder compact frame | D with Book(9100) | Template 1 with book |
| Cancel by order id | Cancel | Cancel with routingMarket | F OrderCancelRequest | Template 2 OrderCancelRequest |
| Cancel by ClOrdID | Route helper / client lookup | Client must resolve to order id | F with OrigClOrdID(41) | Template 2 with origClOrdId |
| Quantity amend | AmendOrder | AmendOrder with routingMarket | Use atomic replace | Use atomic replace |
| Atomic cancel/replace | SpotQuoteReplace / QuoteReplace | Compact frame group | G OrderCancelReplaceRequest | Template 3 OrderCancelReplaceRequest |
| Mass cancel | Protected helper / quote-replace fanout | Use quote-replace fanout or control helper | q OrderMassCancelRequest | Template 4 OrderMassCancelRequest |
| Order status | Account/order reads and receipts | Private streams/gap-fill/read APIs | H OrderStatusRequest and AF MassStatus | Template 5 OrderStatusRequest |
| Drop-copy / executions | Private WS/SSE/gap-fill | Private streams/gap-fill | Drop-copy session | ExecutionReport stream |
| Cancel-on-disconnect | Agent/control-plane sweep | Session-key scoped COD via TCP disconnect notice | Credential-level COD | Credential-level COD |
Important Non-Parity By Design
Some differences are intentional and must stay documented:
- Funding, withdrawals, settlement, market creation, asset administration, and internal credit actions are not low-latency order-entry lane features.
- FIX and FIXP do not accept arbitrary signed action JSON; they expose an OMS order-entry subset with status, drop-copy, mass-cancel, and COD.
- BSL Direct TCP is a compact frame hot path. Standalone cancel/amend signed
actions carry only
order_id, so clients must supplyroutingMarket. The sequencer treats it as routing context and rejects known mismatches. - BSL session keys can be temporarily narrowed with
BSL_SESSION_KEY_CANARY_ACCOUNTS, but the production lane is open to all active registered session-key accounts when that list is empty. Market-scoped session-key cancel/amend is accepted only when the hot path can prove the referenced live order belongs to the same account and routed market. Session-key cancel-on-disconnect is scoped to orders admitted through that session key, not every account order.
Certification Checklist
Before a lane is called institutional-grade for an account:
- Fetch
GET /api/v1/bsl/connectivityand verify advertised hosts, ports, SNI, schema URLs, compact account index, compact market indexes, chain ID, and verifying contract. - Prove codec compatibility:
- TypeScript SDK tests for signing, BSL Direct TCP, FIX, and FIXP.
- Rust FIXP golden vectors and SBE/SOFH roundtrips.
- Run order lifecycle:
- place resting bid/ask,
- marketable IOC,
- cancel by order id,
- replace/cancel-replace,
- mass cancel where the lane supports it,
- status/drop-copy reconciliation.
- Run failure cases:
- stale nonce,
- duplicate ClOrdID,
- wrong account in payload/session,
- unknown market,
- invalid
routingMarket, - backpressure and reconnect.
- Run operations cases:
- DB restart,
- gateway restart,
- TCP reconnect/resume where supported,
- signer/session credential revocation,
- COD sweep for BSL session keys and FIX/FIXP credentials with
cancelOnDisconnect=true.
Implementation Notes For Market Makers
BSL Direct TCP quote engines should keep one persistent TLS session per strategy shard, cache the connectivity bundle at startup, and sign locally. Do not call the HTTP hash endpoint in a quote loop.
FIX/FIXP clients should treat session establishment as account authority. Every order message still carries the account, and the gateway rejects cross-account payloads.
For final state, always reconcile from streams/drop-copy/gap-fill. Fast acks mean admission or sequencing progress, not fill truth.
Current Gaps To Track
These are not hidden; they are the remaining maturity gates:
| Gap | Current posture |
|---|---|
| BSL session-key Direct TCP | Implemented and generally enabled when BSL_SESSION_KEY_AUTH_ENABLED=true and the optional canary list is empty |
| BSL session-key cancel-on-disconnect | Supported via gateway SessionDisconnect notice and sequencer policy recheck; certify teardown drills per account |
| BSL market-scoped session-key cancel/amend | Supported for live known orders with account, order-id hash, routed-market, and allowed-market verification |
| FIXP cross-connection resume registry | Server-side bounded resume is wired; certify client reconnect/retransmit drills per account |
| Broad HTTP-only actions | Keep out of low-latency order-entry lanes unless they become true OMS functions |