Aegis: a trading agent you can audit

Ask a language model for a trade and it will give you one. It will sound reasoned and cite the Greeks, and nothing checks whether the numbers it reported match the market. The agent reports its own inputs, sizes its own positions and judges its own output: it controls every gate meant to constrain it. Aegis inverts that. A human-authored YAML mandate states the limits. The model is asked for exactly one thing, a written thesis, and has no channel to affect anything else: strikes come from the option chain, sizing from the mandate and live account state. A test asserts the trade is byte-identical with and without an LLM in the loop. Orders pass five gates, and the agent controls none of them. Mandate check; observation verifier reconciling claimed delta, open interest and earnings distance against a freshly fetched chain; a deterministic risk guard; a human approval token bound to a SHA-256 hash of the proposal and expiring in 120 seconds; then the broker. Every refusal is written to a hash-chained audit log before it is raised. Three ideas carry it. Max loss is derived from the OCC strikes, not read from the proposal, and limits are checked against the worse of the two. On a discrepancy the verifier refuses rather than quietly substituting the observed value. Anything unverifiable is a refusal: a missing delta, an absent open-interest figure, an earnings date that cannot be established. Exits pass the same five gates. Entry-only clauses record "not applicable to a closing trade" with a reason rather than being skipped. Market data comes through Alpaca's MCP server. Orders do not: every order goes through one gate, and MCP's order-placing tools are deny-listed so that path cannot be taken accidentally. 394 tests, no network calls. Every gate is mutation tested. A property-based red-team suite generates 600 proposals a run plus twelve named attacks, each asserting the specific clause that refused it. Writing it found seven defects in code that was already green.