The agent never touches the button

§1A fleet that researches together

The build is an automated research system for a quiet, thinly traded market — a domain where a wrong answer, acted on, costs real money and cannot be un-acted. The subject matters less than the constraint; the method below would be the same for any system whose output can become an irreversible action.

The work is done by a fleet of AI agents from different vendors, deliberately mixed so they do not share failure modes. They collaborate the way a distributed engineering team does: one private repository, one branch per agent, and a pull request for every contribution. Nothing lands on the main line because its author is confident. It lands because a different agent tried to break it and failed.

Governance lives in a single file at the root of the repository, and every agent reads it before contributing. The platform tier could not enforce branch protection, so no setting makes the process mandatory — the file and the review culture are the entire enforcement mechanism. That turned out to be a feature to design for rather than a gap to apologise for: when a rule cannot live in a machine, it has to live in text that every session loads first, and in reviewers who treat it as law.

§2The button stays human

The system’s authority ends at a signal. It watches licensed market data, evaluates its setups, and produces a recommendation with the evidence attached — what it saw, what rule fired, what it expects. It does not act on any of it. Every order is entered by hand, by me, in a separate application that no agent can reach.

This is not a temporary training wheel. It is the permanent architecture, and it follows from sizing autonomy by consequence rather than by capability. The fleet is easily capable of executing. Capability was never the question. The question is how much consequence the system should carry when a confident answer is wrong — and in a domain where wrong is unrecoverable, the answer for execution is none.

The boundary also keeps the accountability honest. When a human enters every order, no outcome can be blamed on the fleet. The system’s job is to be right in writing, ahead of time, where its reasoning can be audited.

§3What adversarial review is for

The review rule earned its keep almost immediately. One contribution arrived as a complete, internally consistent system — ported from elsewhere, tests passing, output plausible. Adversarial review found a hardcoded trading calendar carrying weekday assumptions from a different venue. Every date-dependent result it produced was quietly shifted, and nothing in its own checks could have noticed, because the error sat in an assumption the whole contribution shared.

The port is still marked pending. It does not merge until an independent agent reproduces its results against a separately verified reference — not because anyone doubts the effort, but because the standard is the standard. A fleet without that rule is one confident wrong assumption away from building on sand.

§4An inverted hypothesis is still a result

The most intuitive idea the fleet tested — the reflex of buying weakness, the one every backtest was quietly expected to confirm — came back worse than random. It was not filed as a failure and deleted. It was inverted: the pattern now lives in the system as a warning list, a thing the system flags precisely because the evidence points the other way.

A separate challenger strategy died the same week under an expected-value audit, and its corpse stayed in the repository with the evidence attached. This is most of what a research fleet is actually for. The ideas it kills, with receipts, are as much produced work as the ideas it ships — and keeping them findable is what stops the next session from proposing them again.

§5Paper first, frozen config

Before any output is allowed to matter, the whole system runs a multi-week paper window: live data, real signals, zero consequence. The configuration is frozen for the duration, and the runner fails closed if it detects drift — a halted window is evidence; a window measured across a config change is nothing at all.

ASSERT   the window runs on the configuration it started with
BECAUSE  a result measured across a config change measures nothing
ON DRIFT fail closed — halt the runner, keep the evidence
NOTE     safety tests pin the preconditions they assume; a test
         that inherits live state is testing whatever today is

That last line was paid for twice. Safety tests that read the live configuration passed or failed depending on what the config happened to be that day — which means they were not testing the safety property at all. Pinning the precondition inside the test made the assertion mean the same thing on every run.

§6Who owns which decision

The clean split that emerged is worth stating, because it generalises well past this build.

The fleet argued, correctly, that my safety gate costs expected value. The gate stayed. That is the whole arrangement in one exchange: the models own the arithmetic, the human owns the appetite, and both of those are written down where the next session can read them.