Governed Self-Evolution for Autonomous Investing: A Multi-Agent LLM System with an Invariant Core
Steward is a multi-agent LLM trading system designed to act on live Web data while keeping its safety constraints intact as it learns. The paper introduces governed self-evolution: a deterministic gate and typed proposal system let the agent rewrite its own prompts, but an invariant core of risk rules, order arithmetic, and discipline-agent prompts is unreachable by any self-edit. In a five-month live paper-trading deployment the authors record every input, output, and grading event to evaluate whether the architecture survives real market noise, prompt injection, and its own reflection loop. The release of the full code, prompts, and replay harness makes this one of the most transparent live-agent studies to date.
The paper's primary contribution is architectural: a rigorous boundary between evolvable prompts and an invariant safety core enforced by typed schemas and deterministic code. The five-month live deployment (102 trading days, 1,632 LLM calls, $455 API spend) is genuinely forward-looking and avoids the pre-training leakage that plagues backtested LLM trading studies. Trading performance is mixed—absolute return of +5.0% underperformed SPY's +12.4%—and with only one applied quarterly evolution cycle the evidence for self-improving edge remains thin, though the authors candidly note that "alpha is not identifiable over 102 days, and no claim of this paper rests on it" (Section 5.5).
The motivation is well-founded: Huang et al. (2024) show that LLMs "struggle to self-correct their responses without external feedback," which supports driving evolution with code-graded outcomes rather than model reflection. The type-enforced governance architecture is the standout strength: every agent emits a Pydantic object with mandatory chain-of-thought fields, shared memory is assembled by code rather than generated by agents, and the deterministic gate applies learnings under twelve invariants that exclude absolutes and cannot target protected agents. The grounding audit and adversarial replay back this up: 99.9% of cited numbers are traceable to inputs, and injected instructions were followed in zero of 30 replays because "injected content could at most change what an agent wanted, and here it did not achieve even that" (Section 5.5).
The live window is too short and too favorable to the safety narrative to support conclusions about self-improving returns. The portfolio underperformed SPY by more than seven percentage points while running a beta of only 0.16, meaning it missed most of the rally, and the authors honestly admit that "The evidence comes from one configuration traded on a paper account through one rising window, with overlapping forward horizons, simulations that ignore fill risk and two quarterly cycles, one applied" (Section 6).
The abstract also contains an editorial slip ("lost 1.351.35 points"), and the bold novelty claim in Section 5.1—that Steward is "the first self-evolving LLM agent evaluated over months of live operation"—is impossible to verify without access to proprietary trading systems.
The evidence strongly supports the governance and safety claims but only weakly supports the investment usefulness of the multi-agent design. Typed replay shows a single model given the same raw data traded more often and lost $-1.35 \pm 0.44$ points against SPY over five days where the joint design was flat, confirming that the decomposition adds discipline rather than raw alpha. However, the core backtest compares the full rule set against ablations rather than against a passive benchmark, and the live portfolio's Sharpe of 1.39 came at the cost of large tracking error versus SPY. The related-work comparison is fair: the authors correctly note that prior agents "are evaluated on historical data, where pre-training leakage is hard to exclude" (Section 2), a concern well-documented by Lopez-Lira and Tang (2026).
Reproducibility is unusually strong. The authors release the code, prompts, and replay harness, record every LLM call with model name, tokens, cost, and (from April 12) complete inputs, and report exact hyperparameters such as a $0.5\%$ equity risk budget per trade, a $1.2$ minimum risk/reward, and a $20\%$ position cap. The 20-minute session kill-switch, seven-retry failover to a second vendor, and write-ahead order logging are documented in Appendix F. The main gap is that the specific frontier models are not named, only described as "frontier models from two vendors" (Section 5.1), which limits exact replication if those models are later deprecated; however, the structured-output schemas and replay inputs should make it feasible to rerun on newer models.
LLM agents that act on live Web data must combine heterogeneous evidence, remember what they have done and improve from outcomes without weakening their own safeguards. We study this problem in autonomous investing, where every action is irreversible and based on untrusted Web content. We present Steward, a multi-agent LLM system that draws the boundary of self-evolution in its type system. First, nine role-specialised agents decide jointly: four analysts read news feeds, SEC filings, macroeconomic series and market data and emit typed reports, from which a Portfolio Manager sets target positions that a protected Risk Manager audits. Second, a seven-layer shared memory, assembled by code from the system's own record, gives each decision its position context, the market narrative, calibration and the agent's past decisions. Third, the system improves itself by review: code grades every trade and forecast nightly and writes the grades into memory, and each quarter a reflector proposes prompt learnings that a deterministic gate applies reversibly and replay of recorded inputs verifies. All three operate around an invariant core of order arithmetic, risk rules and discipline-agent prompts that no self-edit can reach. In a five-month live deployment (102 trading days, 1,632 LLM calls), the system contained a 24.6% sector drawdown to a 0.3% loss; in replay of its recorded inputs, a single model given the same raw data traded more and lost 1.35 points against the market over five days where the joint design showed no significant loss, and no injected instruction was followed; and a 2015-2026 backtest shows the core alone lowering the maximum drawdown under all 50 random entry policies. The reflector traced the dominant failure to its root cause, and the gate applied a learning that the agent adopted on trigger evenings and on no control evening. Code: https://github.com/yebof/quant-agent
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.