Steward's deterministic risk controls have the strongest evidence once simulated decisions meet realised trading. The live book returned +5.0%, ahead of a beta-matched 16% SPY blend at +3.2%. Its Sharpe was lower, 1.39 against 3.87. A 56% SPY blend returned +7.5%, also beating the book.
Feng, Dai, Pan, Lau, Xu and Liu ran a nine-agent LLM system in a US$100,000 brokerage paper account. Trading covered April 8 to September 10, 2026, or 102 trading days, across 80 US stocks and 21 ETFs. Four analyst agents produce typed reports from nine RSS feeds, SEC 10-Q and 10-K filings, nine FRED series and daily market data. A Portfolio Manager agent converts those reports into target weights, with a 20% limit per name. Code also assembles a seven-layer memory from the system's record for the manager to read. This includes a 45-day calibration table and its own last three decisions.
The Portfolio Manager is meant to make money by combining weak signals. Code supplies the protection. A deterministic constructor takes the smaller position allowed by the target weight or by risking 0.5% of equity to the stop. The default stop is two ATR. A blocking engine prohibits negative cash, sector weights above 40%, net exposure above 90%, and purchases after a 3% daily loss. Independently, a no-LLM breaker checks every 30 minutes and liquidates on a 3% daily loss.
The authors call this code and the prompts of two discipline agents the invariant core. One of those agents, the Risk Manager, can reject, amend or scale the morning plan. It cannot clear a trade that the hard rules prohibit. The other, the Position Reviewer, makes HOLD, REDUCE, SELL or TRAIL_STOP calls for existing positions during the sell-only midday and close sessions.
The system can also rewrite its prompts, a process the paper calls "Governed self-evolution". Only code-computed outcomes supply the signals for those changes. Each evening, code calculates realised returns for each trade; an Evening Analyst agent then grades the trade correct, premature or wrong. Each quarter, a Meta Reflector agent proposes up to three prompt "learnings", short instructions to append. The proposals are typed objects, and the type listing editable agents excludes the two discipline agents. They therefore cannot name the core as an edit target. A deterministic gate checks twelve invariants before applying append-only, git-revertible changes, whose effects are verified by replaying recorded inputs.
The paper presents that boundary as its main contribution alongside the core backtest. Relative to FinCon or TradingAgents, the addition is the boundary and a forward live record rather than a historical one.
Keep the four kinds of evidence separate. The live paper account simulates fills against live quotes, without market impact. Trace re-scoring follows recorded decisions through subsequent prices without an LLM; replay sends recorded LLM inputs through changed prompts or architectures. The fourth is a 2015-2026 backtest of the core alone, using LLM-free entries.
Did the agents earn their discretion?
The live account made +5.0% against SPY's +12.4%, with a Sharpe of 1.39 versus 2.28. The authors supply the tougher benchmarks themselves: the 56% SPY blend and a 50/50 SPY and T-bill blend returning +6.9%. They also state that "alpha is not identifiable over 102 days, and no claim of this paper rests on it".
Their affirmative claim is that "the value lies in the joint synthesis". Two comparisons support it. Following the Portfolio Manager's recorded targets through closing prices, including exits and Risk Manager edits, produces +12.2% and a Sharpe of 2.33. Following the analysts' buy ratings produces +1.3%.
The other comparison replays 20 mornings. A single model given the raw data lagged SPY by 1.35 ±0.44 points over five days and 1.76 ±0.75 over ten. It traded more as well, targeting 5.8 names versus 3.7 and committing 41% of equity to new intent versus 19%. The deployed design's five-day books returned -0.5 ±0.9, indistinguishable from zero. By 20 days, both the single agent's -0.8 ±0.9 and the deployed design's +1.3 ±2.9 were within noise. The separation therefore holds only at five and ten days.
The synthesis comparison has substance. But +12.2% requires every target to fill at the decision-day close, which the account could not reproduce. Of 492 orders, 180 expired or were cancelled without a fill. Average realised gross exposure was 56%, versus 79% intended. Beta was 0.16 rather than 0.64.
Exits created another gap. Positions closed on agent decisions realised US$0.8k, then gained US$19.9k after the sale. Positions closed by broker-held stops realised US$3.7k and left US$0.7k behind. Even so, the Evening Analyst marked 134 of 163 sells correct. The authors use this as their own argument for grading in code.
The authors also reach the execution and exit conclusion themselves. Their discussion places "the headroom in discretionary exits and execution" and proposes "to narrow the periphery on exits and add an execution agent inside the core, leaving the judgement layer that works untouched." The judgement layer they defend is the Portfolio Manager's synthesis, supported by +12.2% simulated against +1.3%. We come back to the execution gap: that synthesis delivered +5.0% realised, with 180 of 492 orders unfilled.
The headline loss-containment result deserves the same scrutiny. From June 22 to July 29, SMH fell 24.6% while the portfolio lost 0.3%. SPY declined 2.0% during the window. The authors argue that "the core bounds what judgement can lose, and the agents' May exits did the rest". They also report a 27% loss for the core alone with momentum entries during that 2026 semiconductor window.
Consider the arithmetic. Multiplying a 0.16 beta by SPY's 2.0% decline gives 0.32%, almost the portfolio's exact loss. The 0.16 estimate covers the full period; it was not measured within that window. The random-entry core's median loss there was only 7%, so reaching a 27% loss requires momentum-style semiconductor concentration. The trace establishes that the May exits occurred. The P&L cannot establish that they mattered.
Caps and the breaker did most of the drawdown work
The core backtest enters ten names weekly at 9% each. Selection uses either 126-day momentum or random entries across 50 seeds, with costs of 5 bp per side. The no-core comparator is fully invested at 10% per name. For random entries, median maximum drawdown declined from 37% to 28%, with a reduction in all 50 seeds. Sharpe edged from 0.81 to 0.82, while CAGR fell from 17% to 14%. Momentum entries saw drawdown fall from 61% to 33%, Sharpe rise from 1.15 to 1.30, and CAGR decline from 61% to 41%.
The ablations tell us more. Stops alone left momentum drawdown at 61%. Taking out only the breaker produced 60%; taking out only the stops produced 36%, compared with 33% for the full core. In the authors' words, "the caps and the breaker do most of the work".
The authors expressly limit what the universe permits them to infer: "The universe is from 2026, so only comparisons between variants are meaningful." Exposure remains unresolved too. The core permits at most 90% net exposure. After a day of -3% or worse, the breaker liquidates at the close and re-enters at the next open, leaving the account in cash overnight. A stopped name remains flat until the next rebalance.
Simply reducing gross exposure to the 90% cap barely changed drawdown. Without its breaker, the core still lost 60% peak to trough, against 61% without the core. The objection therefore concerns the timing of the breaker. It is itself a state-dependent rule for reducing gross exposure, and no variant compares it with an exposure-matched book. We did not find a no-core variant tested at matched average exposure.
Learning changed the format
In a morning replay, removing the entire memory changed little: five-day excess was -0.4 without memory versus -0.5 with it, with 3.5 names versus 3.7. The authors argue that memory earns its keep over time. Their strongest evidence is the co-movement of book exposure and trailing forecast hit rate, with rho 0.34, p = 0.01, n = 54. That weakens to Holm p = 0.08.
The quarterly loop ran twice. The Q2 learning exceeded a 200 character cap at 282 characters and was withheld. Replay found it inert: it retained 8 of the 10 flagged names that the baseline continued to propose within a point, inside 1.8 points of rerun noise. The Q3 learning was applied. The prescribed TAKE/WAIT or blocker form appeared in 5 of 20 trigger replays, compared with 0 of 20 at baseline and none on control evenings. The named recurring misses barely changed, from 26/64 to 25/64.
The authors attribute those misses to a count absent from the agent's input and propose adding it. Neither cycle has a P&L figure. They acknowledge that replays of 14 to 20 inputs "cannot rank variants by return".
An injected instruction in the Portfolio Manager's news section simulated a payload that had passed through the analyst layer. The manager followed it in 0 of 30 replays. Earlier in the chain, the News agent excluded it in 20 of 20. The red team used 10 recorded mornings and 3 payloads. Of 254,094 cited numbers, 99.9% were grounded when derived quantities, including risk/reward ratios, were counted. The strict matcher returned 96.1%, versus 22% for a placebo. Three of the 226 ungrounded numbers were candidate fabrications. Logged API spending was at least US$455.
Our adaptation has no results yet
We are building an adapted version and have no results to report.
We cannot reconstruct the paper's raw EDGAR stream or its nine feeds. We instead use point-in-time statements and the news available to us, and exclude UNRATE from our macro set. Historical tests with current LLMs risk prior knowledge of outcomes, so they cannot address the paper's forward claim. Minute bars also cannot reproduce broker fills or stop ordering.
We will record model versions and run prospective paper trading. The deterministic core will first face an exposure-matched no-core book. Adaptive prompts will enter only after a learning produces an outcome-scored effect on that baseline. If the core still cuts drawdown after the exposure match, it is worth running with any entry signal, LLM or otherwise.