Building Self-Evolving Trading Agents

Trading agents are beginning to move from answering questions to holding durable state, monitoring markets and acting with standing authority. Once an agent can operate for hours or days, a harder question appears:

Can the agent improve itself without gaining the power to redefine success, loosen its own risk limits or approve its own changes?

Today we are introducing the Governed Challenger Loop, a proposed architecture for bounded self-evolution in trading agents.

The production agent remains fixed. A separate challenger receives one small, typed change and runs against the same market information in replay and shadow. An independent control plane decides whether the challenger improved the intended behavior without breaking safety, participation or unrelated capabilities. If it passes every gate, the challenger may become the new production version. If it fails, the incumbent stays in place and the failed attempt remains in the record.

The agent may propose an amendment. It may not change the constitution, judge its own amendment or grant itself authority.

This is a research architecture and falsifiable experimental protocol. We have not yet demonstrated that it improves trading performance, and we are not using it to auto-promote agents with live capital. The first experiment is deliberately smaller: one agent family, one mutation class, paper or shadow authority only and controls designed to prove the loop wrong if its measurements are weak.

Two kinds of improvement

“Improving an agent” can refer to two very different processes.

Model improvement changes the underlying model weights through supervised fine-tuning, preference optimization, reinforcement learning or another post-training method. The output is a new model checkpoint that may improve many agents at once.

Agent improvement leaves the model weights fixed and changes the artifacts surrounding one agent: a threshold, a typed decision rule, a retrieval policy or a piece of evidence memory.

The Governed Challenger Loop focuses on the second process. We call it self-evolution when the agent's own operating history contributes to proposing those changes.

This distinction matters because most trading failures are not solved by “making the model smarter.” A strategy may repeatedly mishandle one liquidity regime, rely on stale evidence, enter too readily under weak confirmation or apply a useful rule in the wrong context. These are often system and policy failures. They can potentially be repaired without retraining the foundation model.

But giving an agent unrestricted access to its own prompt, tools, risk settings or execution logic creates a more serious problem than the one we started with.

Why markets make self-improvement difficult

In software, a candidate change can often be tested against a stable suite. Markets are different.

Outcomes are noisy. Regimes change. A profitable decision may have been poorly reasoned and a sound decision may lose money. Historical data gets reused. Repeated search makes lucky strategies look intelligent. Transaction costs and market impact turn paper gains into real losses. A system can also improve an evaluator by learning not to participate.

Imagine a challenger that appears to reduce bad trades by 40 percent. That sounds good until we discover that it reduced all trades by 60 percent. Or imagine a challenger optimized for a five-minute markout that quietly worsens one-hour outcomes. Or one that learns which cases a semantic judge rewards and produces more persuasive explanations without making better decisions.

These are not edge cases. They are predictable consequences of optimization pressure.

The system that benefits from a change should not control the rules by which that change is measured. This is the same reason a strategy should not choose its own backtest period, hide failed trials or move the target after seeing the result.

The Governed Challenger Loop

The loop separates creativity from authority.

There are six important roles:

1. The incumbent is the currently authorized agent version. It is never edited in place.
2. The challenger is a separate version created from the incumbent plus one admitted mutation.
3. The proposer identifies a failure, suggests a change and states what should improve.
4. The admission compiler constructs the challenger and rejects any change outside the allowed surface.
5. The evaluator compares both versions without exposing mutable criteria to the proposer.
6. The promotion controller changes the active version only when every preregistered condition passes.

The challenger is not simply the same model at a higher temperature. Creativity may help generate hypotheses, but it is not the mechanism of self-evolution and it is not a safety boundary. The deployed change must be typed, bounded, attributable and reversible.

The constitution

The constitution is the part the agent cannot amend.

It contains execution authority and risk controls: signer access, venue access, allowed assets and instruments, position limits, leverage limits, sizing ceilings, circuit breakers, accounting rules and deployment controls.

The initial editable surface is intentionally narrow. A challenger may propose operations such as:

SET_BOUNDED_SCALAR
ADD_TYPED_RULE
EDIT_ONE_RULE_FIELD
DEPRECATE_RULE
APPEND_EVIDENCE
SUPERSEDE_EVIDENCE
MARK_STALE
MARK_UNKNOWN

It may not rewrite prompts, add tools, change subagent topology, expand venue or signer access, alter risk limits, modify the evaluator or widen its own mutation permissions.

An autonomy envelope makes those boundaries machine-readable:

editable:
  thresholds: true
  typed_rules: true
  evidence_memory: true
  prompts: false
  tools: false
  risk: false

budgets:
  max_edits_per_30d: 3
  max_concurrent_challengers: 1
  max_fields_per_edit: 1
  max_relative_scalar_change: 0.03

deployment:
  research_ceiling: paper
  live_auto_promotion: false

The key property is not that the agent has no freedom. It is that its freedom has a typed boundary. The proposer can be imaginative inside that boundary. The admission compiler decides whether the proposed idea can become an actual challenger.

Same market, same moment

Comparing two trading agents is meaningless if they see different worlds.

The incumbent and challenger must receive the same observations, timestamps, tool results, portfolio state and deterministic seeds. Their decisions are evaluated as a pair. If input parity cannot be demonstrated, the episode cannot support a claim that the mutation caused the difference.

Historical replay is useful for screening, but it is not enough for promotion. The history may contain outcomes shaped by the incumbent, and repeated use turns the replay archive into part of the optimization process. A challenger that survives replay must therefore advance to prospective shadow evaluation using observations that did not exist when the change was proposed.

This gives the loop two clocks:

• The decision clock is the normal production cadence. A trading agent may reason every few minutes.
• The research clock is slower. A challenger may be replayed and observed for days or weeks before there is enough evidence to accept or reject it.

Challenger runs are internal research work. They do not create another user-visible production tick or a second charge.

Promotion is not one score

A single scalar reward is easy to optimize and easy to misunderstand. The Governed Challenger Loop uses a conjunctive gate instead. Every required condition must pass.

Semantic model judges can help where deterministic measurement is impossible, but no model judge should have sole promotion authority. Realized profit and loss is also insufficient by itself. It is delayed economic evidence and an important risk signal, but a noisy outcome should not become the only fast reward.

Every attempted challenger is counted, including crashes, non-activations and rejected changes. Otherwise the system can search repeatedly, forget its failures and report only the winner. In trading, that is another form of backtest overfitting.

A concrete example

Suppose a production agent repeatedly enters a strategy when its confirmation signal is marginal. The proposer identifies the pattern and suggests a small change: require the agent's confirmation score to reach 0.70 before entering instead of 0.68. The score is a normalized measure from zero to one of how strongly the required signals support the trade.

The proposal must include:

• the parent agent version;
• the issue being addressed;
• the one typed mutation;
• the market slice where it should matter;
• the predicted improvement;
• the minimum number of activations needed to test it;
• possible harms;
• the rollback target; and
• the evidence that motivated the change.

The admission compiler creates the challenger from the incumbent. The challenger does not submit an arbitrary replacement configuration.

Both agents then receive identical observations. The evaluator checks whether the challenger improves the chosen process measure, continues to participate when it should, preserves every hard invariant and avoids regressions elsewhere. If replay looks promising, the challenger runs prospectively in shadow.

If any gate fails, nothing changes in production. If every gate passes, a governed promotion operation can move the active version pointer to the challenger. The prior version remains available by ID.

If the incumbent has an open governed position, the simplest initial rule is to refuse the version switch until that position is flat. Exit logic should not silently change in the middle of a trade.

How we will try to break it

The first experiment is designed to falsify the architecture, not decorate it.

We propose four experimental arms:

1. A frozen incumbent with no adaptation.
2. An unbounded reflection baseline that may revise free-form memory or prompts but never receives live authority.
3. Bounded mutation without evaluator isolation, where the proposer can observe evaluator feedback.
4. The full Governed Challenger Loop with typed mutation, sealed evaluation, complete trial accounting, prospective shadow and rollback receipts.

The controls matter as much as the challengers:

• Invalid mutations try to change forbidden fields, exceed edit limits, use a broken parent hash or alter the kernel. Every one must fail admission.
• Neutral mutations are valid but irrelevant. They estimate how often the gate promotes noise.
• Adverse mutations try to improve a visible metric by abstaining, trading less or selecting easy cases.
• Replay controls permute challenger identities and verify input parity to detect accidental asymmetry.

One accepted invalid mutation stops the experiment. A false-promotion rate above the preregistered bound invalidates the gate. Repeated reversal between replay and future shadow invalidates the surrogate. An apparent gain driven by non-participation is not a gain.

The right response to those failures is not a larger optimizer. It is a repaired measurement contract, a narrower claim or abandonment of that mutation class.

What exists in Avalon today

Avalon already contains several primitives the loop can reuse:

• deterministic execution constraints outside model discretion;
• tighten-only overrides that can narrow, but not expand, signed-off limits;
• versioned agent artifacts and an active-version pointer;
• governed evidence controls for model improvement;
• execution lineage that supports conservative position continuity.

The complete challenger loop is not yet implemented or validated end to end. The remaining work is specific: typed mutation admission, append-only challenger receipts, matched-input evaluation, a preregistered promotion gate, governed promote and rollback operations and a guard against switching versions while an attributable position remains open.

This does not require a second trading-agent runtime. It requires a control plane around the version system that already exists.

What comes next

The first scientific step is a preregistered paper-only experiment. It will use one agent family, one mutation class, one frozen evaluator specification and no signing authority. The mutation class will be chosen only after confirming that the required matched observations and outcomes exist.

If the experiment succeeds, the next question is whether a user-authorized autonomy envelope can support safe, automatic promotion inside explicitly granted limits over longer periods.

If it fails, that result is still useful. It would show that bounded artifact evolution cannot overcome the available signal, evaluator or regime limits under the tested contract.

Self-evolving trading agents should not be defined by how much of themselves they can rewrite. They should be defined by whether they can propose bounded changes, test them against comparable evidence and earn narrowly scoped authority without controlling the constitution or the judge.

That is the Governed Challenger Loop.