AI-Native Trading Principles
The 24 principles distilled from the Crypto Scalper specs — the constitution that defines what “AI-native” means. Each principle is a mechanical control, not a convention. Together they form the architecture for bounded, graded, evidence-gated autonomous trading.Architecture4 principles
Authority4 principles
Safety4 principles
Evidence4 principles
Learning5 principles
Operational3 principles
Architecture
4 principles1
AI control plane, deterministic execution plane, and safety kernel share zero imports, zero runtime, and zero credentials. Communication is file-based artifacts only.The system is divided into three planes with a hard invariant: no plane may import, call, or share runtime with any other plane. The AI control plane (models, no credentials, no hot path) writes artifacts to disk. The deterministic execution plane (Nautilus, no models, no HTTP-to-LLM) reads a closed PolicyBundle schema. The safety kernel (separate process, separate venv, separate language) reads nothing from AI and shares no imports with execution. The meta-monitor is a Go binary — not Python, not an LLM. If a plane can import another, the invariant is broken.Three-Plane Separation
NN#1, NN#15Mission anchor
planning-ai-native/001, 003, 004, 010Planning spec
2
Proposer ≠ Verifier ≠ Guardian. Separate identities enforced by the deterministic promotion state machine. One identity cannot sign two roles for the same policy.The proposer emits typed, clamp-validated PolicyBundles. The verifier independently reconstructs evidence from raw catalog artifacts through a separate code path. The guardian monitors engine health and emits GuardianAction receipts. No identity may hold WRITE permission on two roles' output artifact types for the same policy. This is enforced at the deterministic promotion state machine, not by convention. The proposer cannot sign a verifier verdict. The verifier cannot propose or activate. The guardian cannot propose or verify.Role Disjointness (No Self-Approval)
NN#3Mission anchor
planning-ai-native/005Planning spec
3
AI proposes; math clamps; deterministic code executes. The execution engine treats every AI proposal as untrusted. No model or model-bound HTTP call exists in any order path.Everything on the AI side is advisory until it crosses a deterministic gate. The Nautilus TradingNode is the single strategy code path across backtest, paper, and live. The RiskEngine treats every policy as untrusted — enforcing notional, leverage, price bands, order rate, and HALT flag. Strategy cannot override. The JournalWriter is the source of truth: every fill is journaled idempotently before any consumer reads it. AI emits a versioned, signed, expiring PolicyBundle; deterministic code interprets it. This wall is what makes the autonomy budget meaningful.The Deterministic Wall
NN#1, NN#5Mission anchor
planning-ai-native/003, 008, 009Planning spec
4
Every AI action carries immutable input/output hashes, authority versions, and timestamps. Append-only ledgers make silent deletion impossible.Every AI proposal, verdict, promotion, runtime action, and rollback carries immutable input/output hashes and authority versions. GATE_LOG.md, holdout_reads.jsonl, guardian-actions/, and the hypothesis registry are all append-only with separate OS user ownership. The goal is tamper-evidence, not tamper-proofness — the operator owns root. The system's job is to make the reckless path require a deliberate, recorded, deliberately awkward act. Missing or invalid evidence never degrades into permission.Artifact Chain Integrity
NN#8Mission anchor
planning-ai-native/007, 060Planning spec
Safety
4 principles9
A daemon (separate process, separate venv) evaluates 11 conditions continuously. Writes HALT file before any network call. Independently verifies flatten.The kill switch daemon runs as a separate process, separate venv, zero shared imports with the agent. It evaluates 11 conditions continuously: loss velocity (5 losses in 60s or 3 in 10s), daily loss halt, consecutive loss halt (≥6), session loss limit, reconciliation break, latency SLO triple-breach, heartbeat gap (>20s), anomalous PnL, autonomy budget exhausted, model confidence collapse (>2σ below rolling mean), exchange-reported anomaly. The daemon writes the HALT file first, then executes the full flatten sequence, then PAGEs the human. It independently verifies that positions are flat by polling the exchange. A human CAN also trigger it but doesn't need to.Self-Triggering Kill Switch
NN#7 (revised)Mission anchor
planning-ai-native/014, 031Planning spec
10
Seven breakers in a hierarchy: micro → velocity → session → daily → weekly → confidence → market regime. Higher overrides lower. Non-recoverable within session.Micro breaker: 3 consecutive losses → block entries 5 minutes. Velocity breaker: 5 losses in 60s → flatten + HALT 1 hour. Session breaker: session loss limit reached → HALT until next session. Daily breaker: daily loss halt → HALT until next UTC day plus recovery gate. Weekly breaker: weekly drawdown cap → HALT until Monday. Confidence breaker: agent confidence < 0.3 on 3 consecutive signals → close-only mode, alert human. Market regime breaker: volatility EXTREME or spread WIDE → block entries, tighten stops. Each breaker has a specific condition, a specific action, and a cooldown. Higher overrides lower. Non-recoverable within session.Circuit Breakers with Escalation
NN#6, NN#14Mission anchor
planning-ai-native/031, 032Planning spec
11
A Go binary, not Python, not an LLM, running as a separate OS user. Polls exchange balance vs journal PnL every 60s. Discrepancy > $1 → separate HALT.The meta-monitor is the defense against correlated failure — both the agent AND its safety daemon being wrong. It runs as a Go binary (different language, different toolchain), separate OS user, with read-only exchange API access (balance + positions, no trading keys). It polls exchange balance vs journal PnL every 60 seconds. Any discrepancy > $1 → writes to a separate HALT file that the kill switch daemon checks. Cannot be touched by the Python/LLM process. If the meta-monitor itself crashes, a separate watchdog (stale > 120s) PAGEs the human. This is the highest-reliability safety layer.Meta-Monitor (Uncorrelated Safety Layer)
NN#7Mission anchor
planning-ai-native/004 (bundled with watchdog + kill switch)Planning spec
12
The AI process cannot write to limits.yaml, GATE_LOG.md, the hypothesis registry, or the kill switch script. File permissions owned by separate user.The AI process CANNOT write to: trading/risk/limits.yaml (enforced by file permissions owned by human user), trading/lifecycle/GATE_LOG.md (append-only, gate evaluator runs as separate user), the hypothesis registry (append-only, separate OS user ownership), the kill switch script, or trading/configs/realism.py (gate presets). The goal is tamper-evidence, not tamper-proofness. The operator owns root and can bypass every barrier. What they cannot do is bypass silently — and that is the honest, achievable goal for a one-person desk.OS-Level Write Barriers
NN#16Mission anchor
planning-ai-native/018, 074Planning spec
Evidence
4 principles13
Every AI claim is decomposed into a machine-checkable predicate and recomputed deterministically from raw journal rows. Ungroundable prose cannot influence promotion.When the AI claims 'win rate when spread < 1.5 bps was 0.62,' that claim is decomposed into a machine-checkable predicate and recomputed deterministically. A hand-rolled predicate checker (pure Python, zero LLM, zero framework, PRAGMA query_only=ON) translates the predicate into a parameterized SQL SELECT, recomputes verified_value from raw journal rows, and scores groundedness: |claimed − verified| > 0.05 → grounded = 0. The grade is mechanical: lift × persistence × support. This converts the LLM from narrator to hypothesis generator with a scoreboard. A 24-position golden journal with known ground truth (including 2 adversarial fixtures) verifies the checker's correctness.Claims-Verified by Construction
NN#9Mission anchor
planning-ai-native/051–055, 057Planning spec
14
Ungroundable prose is rendered in visually distinct style. The speculation field cannot influence promotion. Prose that sounds insightful but can't be verified is decoration.Every PositionAnalysis carries a speculation field for claims that cannot be expressed as predicates over the journal. Ungroundable prose renders in visually distinct style in every UI surface. The promotion state machine ignores speculation=true entries — they cannot satisfy gates, cannot provide evidence, cannot influence the promotion decision. Consecutive ungrounded claims from the same annotator trigger a flag; a high ungrounded rate triggers a model review. This principle ensures that the system never confuses an LLM's fluent storytelling with actual trading insight.Speculation Marking
NN#9Mission anchor
planning-ai-native/056, 059Planning spec
15
The LLM emits a template-ID enum + validated params. A Python dispatcher binds pre-written parameterized SELECTs. PRAGMA query_only=ON. No text-to-SQL engine.The LLM never sees or produces SQL text. It emits a Pydantic discriminated union of template-ID + validated params (e.g., POSITION_SUMMARY with position_id and date_range). A Python dispatcher validates the template-ID against an allowlist (nl_ops_templates.yaml), binds params into pre-written parameterized SELECTs, executes over journal.db?mode=ro with PRAGMA query_only=ON, and returns results. No code path exists that concatenates LLM output into a SQL string — this is verified by a CI grep gate. No text-to-SQL engine anywhere in the codebase. 'A prompt is not a boundary.' This is the bridge between AI insight and database safety.Closed-Template NL-Ops (No Generated SQL)
— (constitutional guard)Mission anchor
planning-ai-native/101Planning spec
16
Papers and external sources may inspire hypotheses. Only local deterministic evidence (backtests on holdout, paper soak, parity check) can satisfy promotion gates.The P0R research evidence library may supply planning briefs with snapshot-pinned citations. These may propose a hypothesis, expose a risk, or constrain a design. They cannot supply local performance evidence, satisfy a phase gate, expand authority, or prove an edge transfers to this venue/fee/latency regime. The PolicyBundle's evidence field carries a source taxonomy: local_backtest, local_paper, local_live are promotion-eligible; external_literature, external_vendor, ai_generated are rejected by the deterministic promotion state machine. make evidence-verify fails if any gate-satisfying claim traces to an external source. Contradictory evidence must be rendered explicitly — the proposer cannot cherry-pick supporting papers.Literature Informs; Local Evidence Promotes
NN#17, NN#18Mission anchor
planning-ai-native/103Planning spec
Learning
5 principles17
Hypothesis hash committed to hypotheses/<id>.yaml BEFORE backtests run. You cannot see the result and then claim you predicted it.Before any backtest runs, the Research Agent commits the hypothesis statement, features used, dataset range, and numeric success criteria as a YAML file with a SHA256 hash. make research-verify fails if the gating hypothesis lacks a pre-registration hash — and it checks the timestamp to verify the hash was committed BEFORE the backtest timestamp. The temporal ordering contract is enforced at the tool level: the research CLI's propose step must complete before the backtest step can begin. This is HARKing prevention (Hypothesizing After Results are Known) as a mechanical control.Pre-Registration
NN#13Mission anchor
planning-ai-native/061Planning spec
18
Bonferroni correction, holdout ledger, dataset retirement, weekly caps, and similarity detection are enforced by counters and file permissions — not by trusting the operator.Every anti-overfitting measure is a mechanical control: Bonferroni correction (α = 0.05/N, counted per dataset, similarity check prevents trivial-variant evasion at <5% param difference), holdout read ledger (holdout_reads.jsonl append-only, >1 read on a gating hypothesis → gate fail), dataset retirement (20 total reads → dataset retired for gating, new range must be pinned), weekly caps (≤5 hypotheses/week, ≤1 deployed/week, research mutex via PID file), hypothesis similarity detection (two hypotheses differing only in numeric params within 5% → counted as the same for Bonferroni), lookahead bias prevention (chronological split_ns, research CLI has no flag to query holdout), survivorship bias mitigation (all hypotheses recorded including failed, graveyard tracks retired strategies). Each is enforced by counters, file permissions, and make research-verify — not by trusting the operator to be disciplined.Anti-Overfitting as Mechanical Controls
NN#13Mission anchor
planning-ai-native/062–070Planning spec
19
New policy runs in shadow (same data, no orders). Mechanical comparison (JSON diff), not narrative. Must beat champion net-of-fees. Retired strategies keep a graveyard row.When a candidate policy passes all gates, it enters shadow mode: same live data feed, same feature snapshots, same report.json schema — but zero orders placed. The comparison against the active champion is mechanical: a JSON diff of the canonical run report, not an LLM narrative. The candidate must beat the champion net-of-fees on the same evaluation window with stated statistical significance. If it does: candidate becomes champion, old champion recorded in graveyard with retirement reason. If it doesn't: candidate recorded in graveyard, champion stays. Three consecutive failed revalidations → retired. The graveyard is how you avoid re-inventing a failure — every row carries what it was, why it retired, and when.Champion/Challenger with Graveyard
NN#4 (revised)Mission anchor
planning-ai-native/046, 047Planning spec
20
8-component objective: PnL primary; penalties for kill-switch activation, gate hugging, low frequency, time-shifted risk. Any metric you give the AI, it will optimize.The objective function is the steering function for ALL autonomous behavior. Components: (1) Total net PnL from exchange-reconciled records — primary, externally verifiable, prevents journal-optimization. (2) Penalty for every kill-switch activation — discourages high-variance gambling that triggers halt. (3) Penalty for gate-boundary hugging — discourages PF=1.31, DD=7.9% exactly at limits. (4) Penalty for low trade frequency — discourages 'don't trade' as optimal strategy. (5) Minimum gross PnL threshold — must clear absolute bar in USDT. (6) Minimum trade count — N ≥ 400 for gate-grade. (7) Time-decayed rolling window — cannot optimize against known fixed period end-date. (8) Penalty for time-shifted risk — 23:59 UTC bets flagged. Weights are human-owned in limits.<env>.yaml. The scoring function is pure Python, mechanically computed, byte-identical on replay. Goodhart's law acknowledgment: 'When a measure becomes a target, it ceases to be a good measure' — the multi-component design with explicit anti-gaming penalties is the defense.Multi-Component Objective with Anti-Gaming Penalties
NN#4 (revised)Mission anchor
planning-ai-native/102Planning spec
21
Nine things the system must never do. Each enforced by a mechanical control (CI lint rule, staleness gate, OS barrier) — not a convention.The nine forbidden patterns: (1) No online weight updates/RL — enforced by CI lint rejecting import torch/tensorflow/flax in trading/. (2) No continuous retraining without re-eval — enforced by model inventory staleness gate: any model whose last_validated exceeds next_review_due is rejected. (3) No AI-written execution code — enforced by make trade-test asserting zero eval()/exec() calls in trading/. (4) No persistent memory across sessions — enforced by byte-identical output test at T0 vs after 500 trades. (5) No unbounded research — enforced by counters + make research-verify. (6) No self-approval — enforced by identity check in deterministic promotion state machine. (7) No generated SQL — enforced by closed-template dispatcher + PRAGMA query_only=ON + grep gate. (8) No literature as promotion evidence — enforced by evidence-source field check. (9) No holdout peeking — enforced by OS-level DAC (grader user owns holdout, research user has no read). Each is a mechanical control with a CI-gateable test. Any forbidden pattern that lacks a mechanical enforcement is a spec bug.Forbidden Patterns as Constitutional Guards
NN#3, NN#15Mission anchor
planning-ai-native/104Planning spec
Operational
3 principles22
Every mechanism names what it cannot protect against. Slow granular bleed, objective function gaming, operator root access. Tamper-evidence, not tamper-proofness.Even the best safety cage cannot protect against: (1) Slow granular bleed — 0.5 bps/trade over thousands of trades looks identical to random noise. The cumulative-expectancy tracker is reactive with minimum 200-trade detection lag. (2) Objective function gaming — the AI will find a way to maximize any metric that isn't 'make money for the operator.' The multi-component objective with anti-gaming penalties is the best available defense, not a perfect one. (3) Operator root access — every OS-level barrier, file permission, and separate process can be bypassed. The goal is tamper-evidence: making silent bypass visible and the reckless path deliberately awkward. (4) Exchange counterparty risk — Binance could freeze withdrawals, get hacked, or change terms. (5) Operator budget override — the dual-control cool-off is temporal, not cryptographic. A determined operator can wait it out. Acknowledging the ceiling is itself a principle — it prevents the architecture from claiming more than it delivers.The Honest Ceiling
— (cross-cutting)Mission anchor
planning-ai-native/082, 084, 089 (distributed)Planning spec
23
Every net result decomposes into Signal + Execution + Fees + Funding + Residual. |residual| > 0.01 USDT per position → fail. Non-closing identity = bookkeeping bug.Every net result decomposes into five components: Signal (mid(exit) − mid(entry), signed by direction — what the idea earned at frictionless prices), Execution (entry + exit slippage vs decision mids), Fees (maker/taker actually charged), Funding (actually paid/received), and Residual (realized − sum of above). make tca fails if |residual| > 0.01 USDT per position. A non-closing identity means the attribution model, fee accounting, or journal is wrong — and an attribution that doesn't reconcile is worse than none, because it launders errors into a plausible story. This is the cheapest possible detector for a whole class of bookkeeping bugs. The decomposition also makes 'we made money despite the signal' visible: positive net with negative signal component means the edge is execution luck, and it will not survive.PnL Attribution Must Close
— (production standard)Mission anchor
planning-ai-native/095Planning spec
24
Five conditions trigger automatic L1 reversion (advisory-only, budget → zero). Human must re-enable each tier with fresh cool-off. Autonomy is a lease, not a right.Any of five conditions triggers automatic L1 reversion: (1) Three unexplained kill-switch activations in 30 days — the system is halting for reasons it can't diagnose. (2) Cumulative net PnL negative over any 90-day window — autonomy is losing money. (3) Single loss > 5× the per-trade risk budget — the safety cage failed. (4) Human intervention required > 2×/month for non-PAGE reasons — autonomy is not actually autonomous. (5) Any adversarial scenario detected in live trading — model gaming, silent bleed confirmed. Reversion is itself automated: autonomy budget → zero, agent degrades to L1 (advisory-only). The human must explicitly re-enable each autonomy tier with a fresh cool-off period. Autonomy is a lease that expires on evidence of failure, not a permanent grant of authority.Kill Criteria with Automatic Reversion
NN#14Mission anchor
planning-ai-native/014, 015Planning spec