Governed Self-Evolution for Autonomous Investing: A Multi-Agent LLM System with an Invariant Core

1 Introduction

• Steward’s motivation is that Web agents must combine weak heterogeneous evidence, remember decisions and outcomes, and improve without weakening constraints.The paper argues that self-grading can be optimistic and that agents able to rewrite instructions can also rewrite safeguards.Source: §1 · p. 1
• Prior LLM trading agents combine roles, memory, and reflection, but are evaluated on historical data and lack a boundary between editable and protected system components.Steward’s live record was created before the outcomes existed, and its proposals and rejections were logged.Source: §1 · pp. 1–2
• Steward draws the self-evolution boundary in its type system: code grades outcomes, while a deterministic gate applies reversible prompt changes without reaching the invariant core.The core includes order arithmetic, blocking risk rules, and discipline-agent prompts.Source: §1 · pp. 1–2
• Nine agents trade a US equity portfolio through a brokerage API in six daily sessions without a human in the trading loop.Four analysts read news, filings, macroeconomic series, and market data; a Portfolio Manager sets target positions and a protected Risk Manager audits them.Source: §1 · p. 1
• The system recorded 102 trading days, 1,632 LLM calls with complete outputs (95% also with complete inputs), and 438 broker round trips, evaluated forward on live data.Source: §1 · p. 2
• The reported outcomes include a 0.3% loss, no followed injected instruction, and lower drawdowns across four crashes in a 2015–2026 backtest of the core alone.The record also reports 99.9% of numbers cited in recorded reasoning as grounded in agent inputs.Source: §1 · p. 2

Self-improving and self-evolving agents

• Self-improving systems use critique, prompt optimisation, skill libraries, memory, or reflection, while concerns about unreliable self-correction and overconfident verbal confidence motivate code-computed outcomes and gated changes.The cited works include Reflexion [25], Self-Refine [20], Voyager [27], Promptbreeder [7], and OPRO [37].Source: §2 · p. 2

Text, machine learning and LLMs in finance

• Finance research studies text signals and LLMs as readers, while Steward frames its contribution as governance of a live agent rather than a trading signal.The cited literature evaluates signals in backtests; the passage notes that LLM financial facts can hallucinate without retrieval and tools [13].Source: §2 · p. 2

LLM agents for trading

• Prior trading agents are evaluated historically or in simulation, whereas Steward is evaluated forward in live trading and evolves around a core its loop cannot reach.The cited systems’ learning signals come from model reflection or backtests; Steward grades live outcomes by code.Source: §2 · p. 3

Security of LLM agents

• Steward places its invariant core among architectural defenses that bound agent actions after reading untrusted input, and adds the agent’s own record as a channel to a reflector that rewrites instructions.The security literature includes execution isolation [33], capability and information-flow control [3] [4], and bounded-action patterns [2].Source: §2 · p. 3

Frameworks, structured output and Web agents

• Prior frameworks coordinate specialised agents through natural language and structured messages, while Steward uses schemas as the reasoning procedure, audit artefact, and boundary on evolution.The passage also situates the work among Web-agent evaluation and calls to report cost and reproducibility [14].Source: §2 · p. 3

3 Problem Statement

• The formal setting maps Web evidence and instructions to decisions and actions, then uses independently revealed outcomes and the system’s recorded history to revise instructions.The assumptions include unreliable factual recall and self-assessment, untrusted evidence, and free text that is not machine-checkable.Source: §3 · p. 3
• The loop can fail through optimistic self-grading, weakened discipline, unauditable edits, or changes that pass checks but affect no decisions.The four failure modes are designated F1–F4.Source: §3 · p. 3
• Governed self-evolution requires typed records, deterministic outcome grading, typed proposals tied to graded evidence, reversible gated application, and replay verification.The proposal type cannot name the invariant core of arithmetic, blocking rules, and discipline-agent prompts.Source: §3 · p. 3
• The research questions ask what system layers contribute, what agents and memory add over one model, how evolution changes decisions, whether the invariant core holds, and whether cited numbers are grounded.The paper says §4 instantiates the requirements and §5 answers the questions.Source: §3 · p. 3

4 Design of Steward

• Steward instantiates the governed-evolution requirements with nine LLM agents, typed shared memory, safety enforced by construction, and evening grading, quarterly updates, and replay.The design separates model actions and reflection from code that records, grades, gates, and rewrites.Source: §4 · p. 3, §4.5 · p. 5

4.1 Agents and sessions

• Six daily sessions restrict position opening to the morning, use sell-only midday and close reviews, run a 30-minute LLM-free circuit breaker, and grade outcomes in the evening.The quarterly session reflects on graded outcomes; evidence comes from public Web sources and orders use a brokerage REST API.Source: §4.1 · p. 3

4.2 Shared memory and typed reasoning

• Code assembles seven memory layers for analyst signals, holding context, narrative and regime, size-based calibration, risk verdicts, prior decisions, and projected sector exposure.The Portfolio Manager reads the memory each morning, and its citable numbers come from code rather than another agent’s prose.Source: §4.2 · p. 4
• Typed outputs require reasoning fields and validate domain invariants, while storing each validated object with its exact input for grading, reflection, and replay.The invariant core protects order arithmetic, blocking rules, and discipline-agent prompts from self-edits.Source: §4.2 · p. 4, §4.3 · p. 4

4.3 Safety by design

• A deterministic constructor converts target-position intent into orders, sizes positions under a 0.5% equity risk budget, and skips entries beyond specified price or risk/reward thresholds.A blocking engine rejects buys that breach cash, position, sector, exposure, stop, or daily-loss rules before the LLM Risk Manager can review a plan.Source: §4.3 · p. 4
• Raw headlines and filings reach only News and Earnings agents; typed reports, deterministic checks, and independent risk review separate that untrusted text from order execution.The Risk Manager and Position Reviewer cannot be named in the proposal type, and prompt changes cannot alter how proposals become orders or relax constraints.Source: §4.3 · p. 4

4.4 Short-term self-evolution: evening grading

• Each evening, the system grades trades and forecasts, assigns root causes to wrong buys, and writes the grades and P&L to the record for code-aggregated signals.Recurring themes and root causes feed forward, while the prior evening’s sizing tilt is bounded at 20%.Source: §4.4 · p. 5

4.5 Long-term self-evolution: the quarterly loop

• Each quarter, a Meta Reflector proposes up to three typed prompt learnings from a digest of 90 days of graded outcomes, and deterministic gate checks govern reversible edits.Edits are allow-listed, logged, append-only, capped, and grouped into a version-control commit that can be reverted; cycles can be staged or live-applied.Source: §4.5 · p. 5

5.1 Live deployment, data and methodology

• Steward ran for five months in a brokerage paper account using real-time Web data, with decisions recorded before outcomes and no human intervention in trading.The deployment covered 102 trading days and logged 1,632 LLM calls; paper fills were simulated against live quotes, so market impact was not represented.Source: §5.1 · p. 5

5.2 RQ1: What each layer contributes

• The Portfolio Manager’s target weights returned +15.4% without exits, +11.6% with system exits, and +12.2% with Risk Manager edits, versus +1.3% for analyst buy ratings.The Risk Manager’s edits produced a higher Sharpe ratio than without them (2.33 against 1.80).Source: Table 1 · p. 6, Figure 2 · p. 6, §5.2 · p. 6

5.3 RQ2: The decomposition and the memory

• In replay, the single model lost 1.35 points against SPY over five days, while the deployed design’s returns were indistinguishable from zero.The single model targeted 5.8 names per morning versus 3.7 for the deployed design; removing memory changed almost nothing per morning.Source: Table 2 · p. 6, §5.3 · p. 6

5.4 RQ3: Two cycles of self-evolution

• The Q2 reflector traced 14 of 20 wrong BUYs to ignored macro warnings; the gate withheld its proposed sizing learning under a 200-character invariant.Replay found the withheld learning inert: weights moved within the noise of baseline reruns.Source: §5.4 · p. 7

5.5 RQ4: The invariant core under live and adversarial conditions

• Across 50 random entry policies, the deterministic core lowered median maximum drawdown from 37% to 28%, while the 2026 semiconductor window still lost 27% under momentum entries.Under momentum entries, maximum drawdown fell from 61% to 33%; the agents’ May exits further limited the live semiconductor-window loss to 0.3%.Source: §5.5 · p. 7
• On 102 trading days, the portfolio lost 0.3% during a semiconductor ETF drawdown of 24.6%; adversarial instructions were followed in none of 30 direct Portfolio Manager replays.The portfolio’s full-period return was +5.0% against +12.4% for SPY; alpha was not identifiable over 102 days.Source: §5.5 · pp. 7–8

5.6 RQ5: Grounding of cited numbers

• A deterministic audit grounded 96.1% of cited numbers under strict matching and 99.9% when derived quantities were included.The audit covered 254,094 cited numbers from 750 recorded chains of thought.Source: §5.6 · p. 8

6 Discussion

• The invariant core keeps order arithmetic, blocking risk rules, and discipline-agent prompts unreachable to self-edits; lower drawdowns across four crashes and failed injections are observable consequences.The authors frame this as making self-rewriting safe by construction.Source: §6 · p. 8
• Outcome-scored grading attributes value to Portfolio Manager synthesis and mechanical exits, while locating headroom in discretionary exits and execution.The Evening Analyst rated 134 of 163 sells correct, which would not have exposed that headroom; the proposed next step is to narrow exit discretion and add an execution agent inside the core.Source: §6 · p. 8
• The twelve-invariant syntactic gate cannot tell whether a learning changes decisions, whereas replay confirmed an applied learning was adopted only where intended.Replay also exposed that the Q3 learning presupposed a past-classification count absent from the Evening Analyst’s input, motivating an outcome-scored replay check before application.Source: §6 · p. 8
• Evidence is limited to one configuration on a paper account during one rising window, with overlapping forward horizons, simulations ignoring fill risk, and two quarterly cycles, one applied.Replays of 14–20 inputs show behavioral differences but cannot rank variants by return.Source: §6 · p. 8

7 Conclusion

• Steward combines role-specialised decisions over heterogeneous Web data, code-computed shared memory, and two-time-scale self-evolution around an invariant core unreachable by self-edits.The conclusion describes the trace as locating the method’s value and headroom layer by layer.Source: §7 · p. 8
• Five months of live operation recorded the system containing a sector drawdown and resisting injected instructions, while a backtest found lower drawdowns across four crashes for the core alone.The evolution loop diagnosed failures and made targeted, reversible edits whose effects replay verified at a cost of tens of dollars.Source: §7 · p. 8
• The authors release the system, trace, and scripts to support developing outcome-scored replay into a gate invariant on real inputs.Source: §7 · p. 8

Ethical Considerations

• The system traded a paper account, so no capital was at risk; inputs were public Web data used under providers’ terms, and no human subjects were involved.The released software is not investment advice, and the invariant core prevents self-modification from eroding risk discipline by construction.Source: Ethical Considerations · pp. 8–9

A Schema Excerpts

• The Portfolio Manager’s typed target position records a symbol, target weight capped at 20%, thesis, conviction, and named invalidation condition.Its reasoning record requires non-empty fields for steps including macro filtering, news and earnings checks, sizing logic, portfolio balance, and cash target.Source: A Schema Excerpts · p. 9
• Prompt-learning records specify an allow-listed agent, append-or-retract operation, learning text of 20–300 characters, and a justification that must cite numbers.The proposal type excludes the Risk Manager and Position Reviewer from editable targets.Source: A Schema Excerpts · pp. 9–10

B Agent Chain-of-Thought Schemas

• Each agent’s nested chain-of-thought fields are required and non-empty, so missing steps fail validation and trigger a retry; the steps are persisted with the decision.The News Intelligence agent instead uses structured narrative, state changes, and per-symbol alerts as its reasoning structure; the Portfolio Manager has optional continuity and premortem checks.Source: B Agent Chain-of-Thought Schemas · p. 10, Table 5 · p. 10

C Gate Invariants

• The deterministic prompt editor restricts proposed learnings by target-agent allow-list, length and justification limits, prohibited-word checks, similarity deduplication, and per-agent and per-cycle caps.It also uses atomic writes, logs acceptances and rejections, commits once per cycle, skips files with uncommitted human edits, and supports applying a human-reviewed proposal file.Source: C Gate Invariants · p. 10

• Ten minutes at the median, the morning session always finished within the 20-minute session limit.It runs four analysts, the Portfolio Manager and the Risk Manager.Source: D Sessions, Latency and Cost · p. 10, Table 6 · p. 10
• Half of the morning session’s cost comes from the Technical Analyst scoring the whole universe.Source: D Sessions, Latency and Cost · p. 10
• Figure 4 plots session wall-clock against the time limit and per-agent API cost, a lower bound because cost logging began on May 12.Source: Figure 4 · p. 10

• Forward returns are close-to-close over 1, 5, 10 and 20 trading days, market-adjusted by SPY, with daily means and daily rank IC.Policy simulations cap names at 20% and the book at 100%, with recorded exits and risk edits applied where specified.Source: E Additional Evaluation Material · pp. 10–11
• Figure 5 evaluates Technical Analyst ratings using market-adjusted forward returns and daily Spearman rank IC, reporting means and 95% day-clustered intervals.Source: Figure 5 · p. 11, E Additional Evaluation Material · p. 11
• Table 7 splits 438 broker round trips by exit mechanism and defines exit quality using post-exit 20-day return versus SPY and further gain to study end.Source: Table 7 · p. 11, E Additional Evaluation Material · p. 11
• Q2 replay compares Portfolio Manager prompts with and without a withheld learning; Q3 replays frozen evening inputs before and after the applied learning.Trigger evenings include a symbol classified as a missed value entry or trend-timing miss on at least three of the last ten evenings; Tables 8–9 define replay outcomes.Source: E Additional Evaluation Material · p. 11, Table 8 · p. 11, Table 9 · p. 11
• Table 10 reports Spearman correlations between trailing code-computed grades and next-morning behaviour, with raw and Holm-corrected p-values.Source: Table 10 · p. 11
• The 2015–2026 deterministic-core backtest uses weekly momentum or random entries; Figure 6 shows drawdowns and Table 11 scopes comparisons to variants.The protocol applies stops, sector and exposure caps, a cash-only rule and a breaker; the universe is from 2026.Source: E Additional Evaluation Material · p. 11, Figure 6 · p. 12, Table 11 · p. 12
• The grounding audit samples agent reasoning numbers and compares input, prompt or emitted-field matches, strict matches and placebo matches against another day’s input.The placebo reports numbers with at least three significant digits because shorter numbers can match by chance.Source: E Additional Evaluation Material · p. 12, Table 12 · p. 12
• The deployed design runs twice per morning to measure re-run noise.Source: E Additional Evaluation Material · p. 12

• News items are deduplicated and capped, filings are truncated, and code drops news-state changes unsupported by session inputs or prior state.News deduplication includes title-word Jaccard similarity above 0.7; at most 50 news items and 30,000 filing characters enter prompts.Source: F Web Input, Taxonomies and Failure… · p. 12
• Wrong BUYs receive root-cause and thesis-trajectory labels; missed moves use a separate taxonomy, while Risk Manager reason categories feed back to the Portfolio Manager.The missed-move categories distinguish risk-disciplined passes and noise rallies from counted misses.Source: F Web Input, Taxonomies and Failure… · p. 13
• The failure-handling rule is to remove an action rather than add one.Table 13 lists system responses by failure class.Source: F Web Input, Taxonomies and Failure… · p. 13, Table 13 · p. 13
• With momentum entries, the core’s drawdown is 36% without stops, 60% without the breaker, and 33% in full.Source: F Web Input, Taxonomies and Failure… · p. 13