Delphi: Conformal Risk Control Condor

Delphi is an autonomous options agent on Alpaca paper trading. Each cycle it prices a 0DTE SPY iron condor and asks: does the market pay more for the band than the band is certified to pay out? The short strikes sit at or beyond a radius certified by conformal risk control on 620 historical sessions (buyer's expected payout at most 10% of the wing). The trade goes only if credit/wing at the expected fill is at least 0.15: the certified level plus a 0.05 cost margin. Around it sit 31 pre-registered hard gates, from sizing to an independent reconciliation through the Alpaca CLI. AI: open-weight models on Featherless (DeepSeek-V3.2, Qwen3-30B) return categories only: a three-call regime vote (disagreement is abstention), a critic verdict, the journal prose. Every number that reaches an order comes from code; every decision lands in an append-only audit log with the git and config hashes that produced it. A formal core of 13 theorems is proved in Lean 4. Alpaca: Trading API via alpaca-py (chains, multi-leg orders, positions, IEX bars), the CLI as a second, independent view of the account, the MCP server for operator inspection in Claude Code. Paper trading is enforced at start-up. Judged account PA31SEVJV9P9 (new, $100,000, options level 3), 2026-09-03: the market offered 0.005 to 0.0725 of the wing for the certified band against the 0.15 gate, so no order was sent. At the close SPY stood outside the certified interval; the band would have paid out 0.338 of the wing, four times the best credit offered. Zero trades, P&L $0, and the refusal was the right decision. A one-contract pilot the day before, on a separate development account, exercised the full path (+$14) and is shown labelled, not counted. We claim no Sharpe ratio and no edge; with a handful of sessions those are noise. We claim a certified bound, a risk process that behaved exactly as specified, and a ledger anyone can recompute with one script (scripts/reproduce.py). MIT.