A Shadow Decision System Found a Semantic Boundary Bug in 14 Minutes

juan gonzalez — Sun, 12 Jul 2026 11:18:00 +0000

I am running an experimental autonomous trading architecture called Darwin. During an audit of its agent-ranking and sizing authorities, I built a read-only shadow producer to compare a candidate constraint system against the existing runtime behavior.

The candidate had no operational authority:

no position or capital writes;
no lifecycle mutations;
no promotions or reproduction;
no writes to the operational sizing ledger;
separate persistence for shadow cycles, events and comparisons.

The first complete diagnostic cycle ran on July 11 at 18:22.

Results:

agents_evaluated: 25
matches: 8
mismatches: 17
max_absolute_delta: 0.5

Every mismatch had the same multiplicative shape:

expected candidate
0.500 1.000
0.425 0.850
0.350 0.700
0.275 0.550
0.200 0.400

This immediately suggested that one path applied a 0.5 constraint that the other did not.

The useful design decision was persisting the composition of each resolved multiplier, not only the final values.

The comparison data showed the semantic divergence:

expected_sources:
[reduce_50, anticonvergence_penalty]

candidate_sources:
[anticonvergence_penalty]

The discrepancy was therefore not primarily numerical. It was a disagreement about authority.
The legacy expected-value translator applied a 50% reduction whenever coherence was below 0.40.
The approved architecture defined two different domains:

0.30 <= coherence < 0.40
sizing authority
multiplier *= 0.5

coherence < 0.30
severe lifecycle condition
outside sizing authority

The candidate producer respected the new boundary. The dual-run oracle still encoded the legacy interpretation.
The bug was in the expected-value mechanism, not in the candidate.
The correction was committed at 18:36. The same condition was executed again at 18:37:

agents_evaluated: 25
matches: 25
mismatches: 0
max_absolute_delta: 0.0

The failed cycle was retained.
The operational databases remained unchanged, and the operational sizing ledger contained zero new events.

What made the diagnosis fast?
A shadow comparator that stores only:

expected_multiplier
candidate_multiplier
absolute_delta

can raise an alert.
A comparator that also stores:

expected_sources
candidate_sources
dominant_constraint
rule_version
input_snapshot

can produce a diagnosis.
That changes the debugging question from:
Where did the multiplication go wrong?
to:
Which rule was present on one decision path and absent on the other?
The second audit: residual authority
After correcting the mismatch, I opened a formal 48-hour observation window.
The population was supposed to remain fixed. Reproduction had already been disabled through:
REPRODUCTION_ACTIVE=false
However, an hourly cron entry still executed auto_promote.py.
No promotion occurred during the initial observation period, but the authority to mutate agent stages remained active.
The process was disabled, and the formal window was restarted from the first successful shadow cycle after the freeze.
This produced a useful distinction:
Absence of mutation is not absence of mutation authority.
For controlled observation, capabilities matter more than labels such as “reproduction disabled” or “read-only.”
General design principles
From this incident, I would extract five reusable rules:
Persist decision composition, not only resolved values.
Treat the expected-value oracle as a hypothesis, not as truth.
Separate permission to calculate from permission to enforce.
Preserve failed cycles as evidence.
Audit every component that retains authority over the observed state.

The shadow did not merely detect that two functions differed.

It made the semantic boundary visible.

La confianza no es una propiedad del agente. Es una propiedad de la arquitectura.

juan gonzalez — Tue, 07 Jul 2026 17:31:15 +0000

I Run 20+ Autonomous Trading Agents. Here Are the 5 Memory Failures That Almost Killed the System.

juan gonzalez — Sat, 11 Apr 2026 10:39:29 +0000

DEV Community: juan gonzalez

A Shadow Decision System Found a Semantic Boundary Bug in 14 Minutes

La confianza no es una propiedad del agente. Es una propiedad de la arquitectura.

I Run 20+ Autonomous Trading Agents. Here Are the 5 Memory Failures That Almost Killed the System.