Replay of a real run — captured 2 Jul 2026
Tribunal
Surveillance Adjudicator
Every step below is a real trace event from the signed run ledger.
sc-tribunal
Transcript
I'll work through this systematically. First, let me read the raw episode before hearing any argument.
Good. Raw evidence read. Now I'll commission both arguments simultaneously.
I now have the raw episode and both structured arguments. Let me weigh them carefully.
Evidence Assessment
Order-to-trade ratio: Six sell orders totaling 36,000 shares (O-SP-1 through O-SP-6), zero sell executions, against a single 200-share buy fill (X-SP-1). That is a 180:1 cancelled-quantity-to-executed-quantity ratio.
Cancellation timing: Every sell order cancelled within 2–3 seconds of placement — uniformly, across both waves. This is not the profile of a trader reconsidering market conditions; it is consistent with a pre-programmed cancellation window.
Book impact: Ask-side depth jumped from 900 → 19,000 shares (≈21×) between T=1782138600000 and T=1782138602000, driven almost entirely by the first wave of spoof orders (O-SP-1 through O-SP-3, totalling 16,000 shares of new sell-side depth). This is a textbook false-depth signal.
Price of the genuine fill: O-SP-FILL was a buy limit at $50.00, placed when the prevailing ask was $50.01. Without intervention a passive limit below the ask sits unexecuted. It filled at $50.00 — inside the spread — against ACC-MM (execution X-SP-1, T=1782138601000). This price improvement requires explanation.
Two systematic waves: The pattern repeats with escalating sizes (5 k → 6 k → 7 k per order), at T=601–605 and T=606–609, arguing against a single fat-finger or reconsideration event.
Weighing the Arguments
Prosecution's strongest point
The 180:1 order-to-trade ratio, combined with uniformly 2–3 second cancellation windows across two escalating waves, and the direct correlation between fake ask-side inflation (900 → 19,000 shares at T=1782138602000) and a buy fill executed below the prevailing ask at the same second, establishes a coherent spoofing mechanism grounded in concrete book and order data. This is not superficial resemblance; every marker is present.
Defence's strongest point
Sell orders O-SP-1 and O-SP-2 were posted at T=1782138601000 — the same timestamp as execution X-SP-1 — meaning, at the resolution available, the spoof orders and the fill appear simultaneous. If the fill preceded the spoof orders within that second, the spoof orders could not have caused the price improvement, and the defence argues the account obtained $50.00 within the prevailing spread without manipulation.
Why the prosecution prevails
The timing defence has real logical weight but does not survive scrutiny when all the evidence is considered together:
-
The buy was placed before the spoof orders. O-SP-FILL was entered at T=1782138600000 at $50.00, with the ask at $50.01 — a passive limit inside the spread that would not normally fill. The spoof orders arrived at T=1782138601000. The mechanism is consistent with the spoof orders arriving micro-seconds before the fill within that same second, inducing ACC-MM's algorithm to cross down.
-
The second wave (O-SP-5 / O-SP-6, T=1782138606000) is inexplicable on the defence theory. The buy had already filled. There is no subsequent buy order. Yet the account places 14,000 more shares of sell orders, cancelled within 2–3 seconds, after which the ask fell from 50.01 → 50.00. Legitimate order management does not produce a second wave of large cancelled orders with no fill intent and no news catalyst.
-
Uniformity of cancellation windows. Six orders across two waves, each lasting exactly 2 or 3 seconds, is not consistent with a trader reacting to changing conditions. It is consistent with a timed spoofing routine.
-
No alternative innocent explanation fits all markers. Rebalancing would leave fills. Testing depth would not require six orders in two waves. Fat-finger would not repeat systematically with escalating size. There is no news context.
The defence's timing argument defeats a narrow causal inference about the single fill but does not undermine the pattern as a whole. The prosecution's case rests on concrete, verifiable evidence — specific order IDs, cancellation timestamps, and book snapshots — that the defence cannot explain away.
The decision brief
Tribunal Ruling — EP-SPOOF
Verdict: SUBSTANTIATED (confidence: 0.87)
Summary
| Dimension | Finding |
|---|---|
| Account | ACC-SPOOF / ACME on XNAS |
| Genuine order | O-SP-FILL — 200-share buy, filled X-SP-1 @ $50.00 |
| Spoof orders | O-SP-1 through O-SP-6 — 36,000 shares sell, 0 filled |
| Order-to-trade ratio | 180 : 1 |
| Cancellation windows | Uniformly 2–3 seconds across all 6 orders |
| Book impact | Ask-side depth: 900 → 19,000 shares at T=1782138602000 |
Why Prosecution Prevailed
The prosecution's decisive point: six large sell orders in two escalating waves (5 k → 6 k → 7 k per order), all cancelled within 2–3 seconds, inflated the visible ask side by 21× and directly coincided with a buy limit fill below the prevailing ask — a fill that had no mechanical path to execution without that artificial pressure.
Why the Defence Fell Short
The defence's best argument — that O-SP-1/O-SP-2 share timestamp T=1782138601000 with execution X-SP-1, making causation ambiguous — is genuine but insufficient. It cannot account for: (a) the genuine buy being placed inside the spread before the spoof orders with no other reason to fill; and (b) the second wave (O-SP-5/O-SP-6 at T=1782138606000, cancelled T=1782138608000–T=1782138609000) placed after the buy already filled, which the defence offered no coherent explanation for.
Driving Evidence
The verdict rests concretely on: the 2–3 second cancellation cadence common to all six orders; the ask-side book explosion from 900 → 19,000 shares at T=1782138602000; the systematic two-wave structure with escalating order sizes; and the buy fill at $50.00 against an ask of $50.01 with no news or market event to explain it otherwise.