Covenant: Proof-Carrying Trading Agent

Covenant is a proof-carrying options trading agent built for Alpaca Paper Trading. Instead of letting an AI model directly place orders, Covenant separates proposal, safety, authority, and execution into strict boundaries. A trader begins in Mandate Studio, where a plain-English risk mandate is compiled into a typed policy. The Alpha Engine then proposes only defined-risk SPY and QQQ vertical spreads. Before an order can move forward, the Safety Kernel evaluates it against eight deterministic invariants covering maximum loss, portfolio heat, daily halt conditions, market session state, liquidity, duplicate exposure, exit constraints, and verified account and market snapshots. A qualifying trade still cannot execute automatically. Covenant issues an Ed25519-signed TradePermit bound to the exact option legs, quantity, price band, policy version, and snapshot hashes. The permit expires after 60 seconds and has a single-use nonce, so replayed, expired, mutated, or oversized orders are rejected before they reach Alpaca. The model may propose, veto, shrink, and explain. It cannot activate policy, sign permits, widen risk, or submit orders by itself. Covenant makes paper-trading authority verifiable rather than assumed.