Price-Source Consensus Check: Agreement Only After Eligibility and Quorum

Practical promise. Decide whether enough fresh, contract-compatible, independently owned sources agree - and return no price when the evidence does not support one.

Four feeds showing the same number may still be one observation copied four times. Four fresh prices may still be incomparable if one is an adjusted close, another is a midpoint, and two are last trades. The useful question is not "What is the median of these numbers?" It is:

Which observations are eligible, which independent owners agree, and does quorum survive the disagreement check?

This is a data-quality diagnostic. It does not estimate fair value, prefer a venue, repair bad inputs, or prove a market price is correct.

Eligibility comes before statistics

Every candidate row must match the same instrument, currency, price type, adjustment convention, and session. Its event time must be no later than the decision time and no older than the configured freshness limit. Its owner must also be unique in the snapshot.

The owner rule is intentionally conservative: if two labels map to one owner, both are excluded as shared_owner. Choosing one of them silently would add a source-selection policy to a consensus algorithm. Production systems should maintain ownership and upstream lineage in a governed registry; names alone do not prove independence.

FIX market-data definitions distinguish price, currency, entry type, time, market, and session fields, while Nasdaq ITCH defines price precision and event timestamps. These are examples of why a price has semantics, not just a numeric value. The package applies an exact-match policy and never performs implicit conversion or normalization.

Three outcomes, not one forced number

That distinction preserves the reason a value is unavailable. A stale-source outage is operationally different from two fresh clusters that disagree.

The takeaway is simple: availability, agreement, and final value are separate decisions.

The robust band

For eligible prices $x_1,\ldots,x_n$, compute:

$$m=\operatorname{median}(x_i),\qquad \operatorname{MAD}=\operatorname{median}(|x_i-m|),\qquad s=\frac{\operatorname{MAD}}{0.6745}.$$

NIST defines MAD and the 0.6745 normal-consistent scaling. The scaling gives standard-deviation-like units under a normal model; it does not assert that source prices are normally distributed.

The package then applies explicit engineering policy:

$$\tau=\max(a,ks),$$

where $a$ is an absolute floor and $k$ is a multiplier. A price is inside when $|x_i-m|\le\tau+10^{-12}$. The numerical epsilon preserves an inclusive boundary under binary floating-point arithmetic.

The policy also sets a maximum allowed tolerance $c$. If $\tau>c$, the result is disputed. That cap prevents an inflated MAD from widening the band until incompatible clusters appear to agree. NIST discusses masking as a general multiple-outlier risk; the cap itself is this package's conservative control, not a universal statistical rule.

Zero MAD is a defined branch

If at least half the eligible prices equal the median, MAD can be zero. The algorithm does not divide by zero and does not borrow scale from an earlier snapshot. It sets scaled MAD and adaptive tolerance to zero, so the applied tolerance is exactly the absolute floor.

• With a floor of 0, only prices equal to the median are inliers.
• With a floor of 0.03, a price exactly 0.03 away is included.
• The floor is a currency-unit policy, so it must be reviewed when price scale or currency changes.

This behavior is deterministic in both implementations and has a dedicated boundary test.

Worked example: one isolated error

Suppose four eligible, independently owned sources report:

The median is 100.0115 and MAD is 0.0065. Scaled MAD is about 0.00964. With k=3.5 and an absolute floor of 0.03, the applied tolerance is about 0.03373. A, B, and C remain inliers, D is named as an outlier, quorum of three holds, and the final inlier median is 100.009.

The static diagram uses distinct shapes and labels as well as color, so source membership remains understandable without animation.

Worked example: conflict rather than false consensus

Now let three owners report 100.00 and three report 101.00. The median is 100.50 and MAD is 0.50. With k=3.5, adaptive tolerance is about 2.5945 - far above the configured maximum of 0.15. The result is disputed, with no consensus price.

That is not a claim that either cluster is wrong. It is an admission that this check cannot justify choosing one.

Use the playground as an audit instrument

Open the interactive consensus lab. It contains 24 synthetic snapshots across four scenarios:

• a clean control with an isolated erroneous price;
• zero-MAD and inclusive-floor boundaries;
• stale, mismatched, and commonly owned inputs;
• split clusters and post-filter quorum loss.

Choose a scenario, then use Back, Step, Play, Pause, and Reset. Change the multiplier, floor, maximum tolerance, or freshness limit and observe all dependent outputs recompute. The initial screen is already informative; no interaction is required to discover the lesson. Reduced-motion preference turns Play into a single deterministic step.

Implementation and verification

Python and TypeScript implement the same sequence:

1. validate policy, UTC timestamps, and unique source IDs;
2. exclude duplicated owners, invalid prices, semantic mismatches, future events, and stale events;
3. return insufficient_sources if eligibility quorum fails;
4. calculate median, MAD, floor, and the maximum-tolerance gate;
5. partition sources with an inclusive boundary;
6. return disputed if inlier quorum fails; otherwise return the inlier median.

The shared operational fixture contains 24 deterministic decisions. Tests also cover duplicate IDs, non-UTC timestamps, invalid policy, future events, exact boundary equality, source ownership, semantic mismatch, broad conflict, and post-filter quorum loss. Passing them proves implementation parity, not market accuracy or investment value.

What can still go wrong

• Ownership metadata can be incomplete: separately branded vendors may share one upstream feed.
• Several independent systems can apply the same wrong split adjustment.
• A synchronized market repricing can be correct even when a stale consumer labels it an outlier.
• The floor and maximum tolerance are expressed in price units and do not transfer automatically across currencies or price scales.
• A last trade, midpoint, auction price, and adjusted close are different contracts even when their numbers are close.
• A price consensus is not a best-execution, benchmark, valuation, or trading recommendation.

Keep raw records, registry versions, exclusions, parameters, and the complete diagnostic output. Do not overwrite an observation merely because the check disagrees with it.

Why there is no historical provider example yet

This revision intentionally does not present a real provider disagreement. A credible example needs contemporaneous raw snapshots from at least three independently owned sources, redistributable licenses, exact price semantics, clock lineage, ownership as known at that date, and a later authoritative correction or explanation. A single vendor API cannot demonstrate cross-source consensus, and screenshots gathered at different times cannot prove a simultaneous discrepancy.

Until that evidence can be archived and redistributed, a named historical story would be anecdotal. The package therefore labels its 24 cases as synthetic mechanics tests and records historical-case acceptance criteria in REFERENCES.md.

Evidence ledger

Summary and next topic

A defensible consensus begins before the median. First establish comparable contracts, freshness, and independent ownership. Then apply the robust band, make zero-MAD behavior explicit, cap excessive dispersion, and recheck quorum. When evidence is insufficient or disputed, return no price.

Continue with Schema-Drift Detector to protect the input contract that this check depends on.

Primary references and visual assets

See REFERENCES.md for source roles, versions, limitations, and historical-case criteria.