PRICE LAYER
Dexter does not treat every incoming price as immediately tradable.
Dexter cross-checks reference families first, then promotes a mark into executable venue state.
Main reference family.
Independent confirmation.
The engine trades the venue mark.
Reduced quorum only when allowed.
Every accepted mark is explainable.
The price layer decides which references are acceptable, how a mark is formed, and when a market must move from normal trading into a constrained, session-closed, or degraded posture.
| Price-layer responsibility | What it controls |
|---|---|
| Source intake | Which external references are allowed to enter the venue |
| Source selection | Which reference path is active when multiple sources exist |
| Mark construction | How the tradable mark is derived from index, book, and venue state |
| Degradation logic | When a market should tighten, close, or halt |
| Settlement context | Which source posture is later bound to committed state |
#From reference intake to executable mark
The runtime ingests external references through a multi-source path.
In production that means a primary Hermes / Pyth path plus redundant HTTP oracle paths. That Hermes + HTTP mux is the normal posture. If venue-side exchange context is consulted at all, it belongs only to an explicit degraded-policy exception, not to the normal production source family.
The goal is not to maximize the number of prices.
The goal is to maintain one defensible reference path for each market at any point in time.
Production posture is therefore opinionated: cross-check is the normal rule and multi-source agreement is preferred. If one source family drops out temporarily, a degraded fallback path may be enabled explicitly for liveness and only for as long as the venue is willing to accept reduced quorum. That state should still be treated as degraded, not as normal pricing.
The venue is expected to explain why a mark was accepted, not simply present a tick and call it tradable.
The engine then turns that reference path into a tradable mark rather than trading directly on a raw tick.
It uses the reference anchor together with venue skew, spread conditions, depth checks, max-move rules, and prior-mark continuity to decide what the market should trade on inside Dexter.
That distinction matters because funding, liquidation, and risk checks depend on a price that is executable in the venue, not simply visible somewhere outside it.
| Check | Purpose |
|---|---|
| Freshness window | Reject stale references before they become venue truth |
| Source agreement and deviation bounds | Prevent one bad publisher from dominating the mark |
| Depth and spread checks | Stop thin books from defining the executable mark |
| Recovery lag | Force stabilization after a broken or stale period |
external references enter
-> mux and source policy checks
-> freshness and deviation validation
-> mark construction from reference + venue state
-> market posture update
-> oracle-source context is published with the next settlement state#Price posture and session honesty
These controls feed directly into market-state decisions.
They determine whether a market can remain live, should move into close-only, should be treated as session-closed, or must be halted.
That last distinction is important.
Not every asset trades like crypto.
Metals, energy, equities, and other session-based markets can be perfectly healthy while the underlying venue is closed.
Dexter therefore separates session closure from oracle failure.
An off-session market should read as off-session.
A broken reference path should read as degraded.
The same source posture is also part of what gets committed with published state, so the settlement layer later knows not only what balances existed, but what price-source configuration the runtime believed when it produced that state.