A self-evolving trading agent rewrites its own prompts, but Steward locks risk rules beyond the type system and lost just 0.3% in a 24.6% sector drawdown
Synopsis
Autonomous investing agents must learn from outcomes without rewriting their own risk rules. Steward separates editable prompts from an invariant core: nine role-specialised agents decide jointly, code grades every trade nightly, and a quarterly reflector proposes only typed prompt edits that a deterministic gate applies reversibly. Over 102 trading days and 1,632 model calls in a paper account, the portfolio lost 0.3% while the semiconductor sector fell 24.6%, and no injected instruction was followed.
Interpretation
Self-evolution is confined to a boundary drawn in the type system: order arithmetic, blocking risk rules and the discipline agents' prompts form an invariant core that no self-edit can name. Earlier LLM trading agents combined analyst roles, memory and reflection, but their learning loops ran on the model's own reflection or on backtests, and nothing separated what may change from what must not. In a 2015–2026 backtest, the core alone applied to LLM-free weekly entries lowered the maximum drawdown under all 50 random entry policies (median 37% to 28%) and under momentum entries (61% to 33%).
Evolution is driven by code grading rather than self-assessment: each night code scores every trade and forecast against realised outcomes and writes the grades into memory, and the quarterly reflector proposes prompt learnings from that record. Models grade themselves optimistically and do not reliably self-correct, so a feedback signal taken from the model's own judgment would point evolution in an untrustworthy direction. The Evening Analyst graded 134 of 163 sells correct, while outcome-scored review showed lots closed by agent decisions went on to gain US$19.9k beyond the US$0.8k realised, against US$0.7k beyond US$3.7k for lots closed by mechanical stops.
A deterministic gate makes every edit auditable and revertible in one step, and cannot reach risk controls: the proposal type can name only six editable agents, and the Risk Manager and Position Reviewer are excluded. An agent that can rewrite its instructions can also rewrite its safeguards, and earlier systems did not separate the two. In Q2 the gate withheld a 282-character learning on its 200-character length invariant and logged why; in Q3 it applied a 185-character learning as a single-file commit that one git revert undoes.
Replay turns whether a learning helps into a measurable experiment: recorded inputs pass through the prompt before and after an edit, and the outputs are compared structurally. The gate guarantees a learning is short, novel, reversible and confined to the periphery, but it cannot tell whether the learning changes a decision. The withheld learning moved every weight within the noise of re-running the baseline (1.8 points per name at the median) across ten wrong-BUY mornings and five controls; the applied learning appeared in 5 of 20 trigger replays and 0 of 20 control replays.
Perspective
The demonstrated scope is one configuration, one brokerage paper account over 102 trading days from April 8 to September 10, 2026, and two quarterly evolution cycles, one of them applied; replays of 14–20 inputs expose behavioural differences but cannot rank variants by return.
The evidence comes from a single rising window, forward horizons overlap, and simulated fills ignore fill risk; the authors state that alpha is not identifiable over 102 days and that no claim rests on it.