Skip to content
Cadre
Library

Markets

New

Lookout

Trade Surveillance Monitor

Always-on multi-signal surveillance over an account's order and trade activity. Runs a deterministic signal battery (spoofing, layering, wash, marking-the-close, insider timing) and raises an evidence-backed alert only where manipulation is concrete, leaving legitimate trading under passive monitoring.

sonnet11 tools5 eval cases2 connectors

The case it handles

A representative case

Case fileclean-volatility
Window · Account
ACC-CLEAN
Window · Symbol
FLUX
Window · From
1,782,147,540,000
Window · To
1,782,148,500,000
Raw scenario input (JSON)
{
  "window": {
    "account": "ACC-CLEAN",
    "symbol": "FLUX",
    "from": 1782147540000,
    "to": 1782148500000
  }
}

The contract

What it takes, does, and returns

Give it
  • Window · Account
  • Window · Symbol
  • Window · From
  • Window · To
It does
  • Get ordersget_orders
  • Get executionsget_executions
  • Get bookget_book
  • Get printsget_prints
  • Get news windowsget_news_windows
  • Signal spoofingsignal_spoofing
  • Signal layeringsignal_layering
  • Signal washsignal_wash
  • Signal marking closesignal_marking_close
  • Signal insider timingsignal_insider_timing
  • Raise alertcommitraise_alert
It returns · Action
  • Monitor
  • Open Case
  • Refer To Tribunal

How it's checked

Checked against golden cases

5golden cases4baseline1adversarial
  • clean-volatility

    FLUX two-way volatility, both sides fill, no self-match, no close burst, no news edge → no alert.

  • spoofing

    ACME layered non-bona-fide sells cancelled near the touch, high order-to-trade ratio, small genuine buy fills → spoofing.

  • layering

    Same ACME footprint assessed as layering: cancelled sells stacked across multiple price levels on one side.

  • insider-timing

    ORBT concentrated buy ~6 minutes before a material FDA-approval headline, unwound after the pop → insider timing.

  • noisy-but-legit

    VOLT genuine large parent order worked in child slices that mostly fill, one repriced cancel away from the touch, low order-to-trade ratio. Superficially resembles layering; must NOT false-alert.

Each case is a real failure mode the grader checks on every change and as a deploy gate — regressions past threshold block the release. Adversarial cases probe the failure modes the golden set doesn't.

Briefing

Briefing

  • Always-on surveillance across an account's orders and trades: runs a battery of deterministic detectors over the raw microstructure and decides whether the window warrants an alert.
  • Scores the named manipulation typologies — spoofing, layering, wash trades, marking the close, trading ahead of news — with the detectors' own numbers, not hunches.
  • Holds that a noisy detector is a useless one: clean and legitimate-but-noisy windows raise no alert, and the reason a window is clean is stated precisely.
  • Knows the legitimate look-alikes — a large parent order worked in slices that mostly fill is not spoofing, two-way volatility is not manipulation, and buying ahead of news that turns out immaterial is not insider trading.
  • Evidence is id-level or it is not evidence; patterns that look real but are contestable go to adversarial adjudication rather than a unilateral verdict.

Where it stands in the operation

Trade Surveillance·Always-on surveillance