An AI agent that trades options on an Alpaca paper account with no human in the loop, built to show off a safety architecture rather than a strategy. The strategy is a written charter (CHARTER.md) loaded at the start of every run. Everything else is the wrapping: the agent never holds an API key and never talks to the broker directly. Every call goes through a gateway that serves only tools a human admitted through a two-key ceremony, checks every order against dollar caps signed into a locked envelope, and writes every request, grant, and refusal to an append-only audit tape.
Built for a trading hackathon on safe-agents. The one-page write-up the challenge asked for is WRITEUP.md.
NOTE: This project contains code that was written with AI.
Scheduled claude -p runs wake the agent a few times a day. Each run reloads
the charter, reads the market through the gateway, and either acts inside its
caps or stands down with reasons on the record. Between runs, a deterministic
supervisor with no model in it holds the exits: it compares live position
values against the take-profit and stop values stamped into a ledger at entry,
and closes what the stored rules require. If the agent process dies, the
supervisor keeps running on its own timer under its own principal, whose
manifest contains no order-placing operation of any kind.
The order path itself is a defined-risk shim. The only acting operation the agent can reach refuses any structure whose maximum loss is not computable, any position over the per-position cap, and any order that would push the book's total open risk over the book cap. The caps are enforced in the shim and signed into the charter lock; changing the caps, the shim, the manifests, or the charter without the re-key ceremony quarantines every trading grant before the next run acts.
The live dashboard, rebuilt from the tape after each run, is at wjatx.github.io/mandate/dashboard.
Two different guarantees back the record, and neither is "tamper-proof":
- The audit tape is a hash-chained, self-consistent record. Verification proves no record was edited, dropped, or reordered in place. It does not prove more: anyone who can write the file can rewrite it whole and recompute every hash. Stronger claims need off-device append-only storage, which this build does not use.
- The charter lock is tamper-evidence, not tamper-proofing. An editor who also holds the HMAC key can re-sign whatever they like. The point is that a change through any normal path either re-keys deliberately, leaving a signed and chained record of exactly what moved, or stops the next run.
The account ran from 2026-08-28 to the contest deadline at 10:00 CT on 2026-09-04, then froze and closed flat at 14:15 CT. It finished at $85,529 against $100,000 at the start, down 14.5 percent. The strategy lost money. The controls held.
What the record shows, in order. On 08-29 a scripted probe asked for a stock order through a tool no human had admitted, and the broker denied it; the same probe through the admitted tool was refused by the shim on the per-position cap. On 08-31 the broker connector died for ninety minutes of market hours, and neither the agent nor the supervisor could act; a dead safety layer can miss an exit and can never admit an entry. On 09-02 five runs in a row stood down on a rule that could not act on a two-sided market; the agent filed the gap instead of reading past it, and the charter was amended and re-keyed after the close. On 09-03 three runs died on upstream model outages before any tool call while the supervisor closed eight positions in fifteen minutes on their stamped stops. On 09-04 the machine slept with the lid closed; the supervisor still ran on the short wakes macOS allows, and found nothing to close. The last run of that day closed the book flat on a ruling recorded in research/WATCHLIST.md.
Every position was defined risk inside a signed cap, every order went through the gate, and every refusal is on the tape. The unbounded component all week was the human: the rulings the agent asked for took minutes to an hour to arrive, and the one measured wait cost about $1,085.
Everything here runs against an Alpaca paper account. The floor is a Python
3.12 venv with safe-agents[mcp] installed from the tag this stack runs,
credentials in a broker-side secrets file the agent never reads, and the
bootstrap ceremony (snapshot, propose, ratify, seed, lock) run once before the
schedules arm. The run scripts and launchd schedules in run/ are the
exact ones the machine is on.
MIT, copyright Wes Jackson. See LICENSE.