OA² Governance Harness for Autonomous Trading

OA² trades iron condors on SPY, QQQ and IWM. That strategy is deliberately ordinary — chosen so it could be held constant while the safety architecture was tested. The architecture came first. Six stages: Signal → Thesis → Critic → Risk Guard → Execution → Monitor. Exactly one may call a language model — Thesis, which writes a rationale. It cannot reject, modify or delay a trade. That is structural, not a prompt. Two MCP instances run with different toolsets. The read instance, which the model reasons through, exposes 30 tools; place_option_order is not among them. The exec instance exposes 41, and it is. A direct order call on the read session returns "Unknown tool", recorded in audit/capability_proof.md. Both counts are asserted at every startup. The path that reasons cannot transmit; the path that transmits does not reason. Eleven deterministic gates, each logged pass or fail. 361 tests, 65 adversarial cases none misrouted, and a mutation check forcing every gate to always-approve and always-reject: 20 of 20 caught. A green suite proves nothing on its own. Every significant failure produced a plausible result, not an error. The option chain truncates at 100 contracts silently — unpaginated, seven of nine chain-days reported clean no-trades. A broker rejection returned as a normal tool result made the engine log a previous order as a new fill. One shape, repeatedly: an error arriving through the success channel. Every state that matters is re-read from the broker each cycle, so the engine believed false things and nothing downstream did. Ten round trips. −$294.00 realized. Final equity $99,687.31 against a $100,000 baseline, −0.31%. Not a winning week. The corrected P&L is worse than the engine's first report — that correction is the deliverable. Paper trading only; not investment advice. Fills are synthetic, the feed is indicative, and parameters were chosen from one rehearsal session rather than calibrated.