There is no approval gate. The math is the guardrail.
No separate step vetoes an LLM decision after the fact. What replaces it is stricter: the agent cannot execute a mistake the sizing math itself refuses to compute. A "no trade" verdict from any gate is a correct answer, not a fallback.
Kelly, on the conditional payoff
Sized from Conditional payoff — E[win|win] / E[loss|loss] — rather than the naive max/max ratio, which is measurably biased toward buying premium. The probability that feeds it is not what the agent stated; it is that number shrunk toward the agent's own measured calibration. A 90%-caller who's right half the time gets cut down hard. A 70%-caller whose 70%s actually land 70% of the time earns the full fraction.
Unbounded loss is refused outright
Kelly refuses any structure with unbounded loss — a naked short is never sizeable, full stop. Unbounded profit is fine: a long call is not a naked short, and the asymmetry runs entirely one direction on purpose.
Capped three ways at once
Per-position, per-underlying, and whole-book, all denominated in dollars of defined max loss — nested so a position can never exceed its underlying's share, which can never exceed the book's. A payoff the sizing tool can't verify against a real simulated structure refuses to size at all, rather than falling back to an optimistic estimate.
Exit rules are the agent's own commitments
One signal registry: every rule reads a signal, compares to a threshold, debounces against quote artifacts. Thesis-level stops watch the underlying, not the noisy option mark — a percent-of-debit stop is routinely a coin flip on path noise if it's expressed as a percent of the wrong base.
Two rules the agent cannot override.
Every other exit rule is authored by the agent itself, per position. These two are not — they exist regardless of what any thesis claims.
Every position is closed before the competition deadline, no exceptions — holding into an event the record can't be scored past is not a risk worth taking for its own sake.
If a leg disappears at the broker (early assignment), the survivor of a broken spread can be an unbounded naked position — worse than the one it replaced. This rule exists so that scenario is never left open, deliberately or by omission.
One number the operator sets, and the agent cannot.
Everything above is earned — the ladder decides how much size the record justifies. Risk appetite is the one quantity on that posture the agent did not earn and may not touch: a single scalar in config.yaml, clamped to [0.25, 2.0], where 1.0 means "the posture the ladder alone would choose".
One multiplication, four scopes
It scales the book cap, and the per-name cap, per-position cap and exploration floor all derive from that — so one number reaches every risk scope at once and they cannot drift apart. Two clamps in the original design were dropped after measurement: one provably could never fire, and the other became wrong once the floor derived. What remains is a single absolute ceiling on the share of the account that can be at risk at all. The lever moves the growth/variance tradeoff; it never moves the ruin bound.
It scales size, not selectivity
The EV gate sits upstream of every multiplication, so no setting buys a trade that isn't worth taking — maximum appetite on a structure with no claimed edge still returns zero contracts. Turning it down does not make the agent pickier, and that is deliberate: a lever that loosened the gate would buy bets with lower expected return and higher variance. There is no curve to sit on there.
A knob that cannot silently do nothing
Above 1.75× the book cap pins at its absolute ceiling and further turns are absorbed. So the posture reports its realised appetite beside the requested one, the health check flags a divergence, and the sizer now names which of five limits set every size. This project's most expensive bug class is code that runs and does nothing; a risk knob is a prime candidate for it.
Never a self-improvement lever
The Coach can change prompts. It cannot reach this: it writes only to its own lever directory, never to config, and the rule that nothing it can move may score its own trial makes that structural rather than a policy. Risk appetite is the principal's preference, not the agent's. The agent is told the number so its reasoning matches its budget — and told plainly that it scales size, not what is worth trading.
It currently sits at 0.50×, and the arithmetic is the argument: it reproduces the book's existing position size exactly at its current rung, so the mechanism landed without changing a single trade. The honest case for going lower is on the table and deliberately not taken yet — at neutral, a >20% drawdown becomes more likely than not even when the thesis is right, and for a book that has resolved forecasts but zero attributed positions, the growth-maximising setting is the minimum.
Facts and models, never mixed.
Payoff at expiry, max loss, and breakevens are arithmetic on the contract — labelled FACT everywhere they appear on this site, exactly as on every trade page. Probability of profit and expected value need a distribution and are labelled MODELLED. The agent sees them under separate headings, on purpose, so neither is mistaken for the other.
Costs are charged before the decision.
Two expected-value columns sit side by side: EV under the market's own drift — where a fairly priced structure is worth about nothing, so after friction it's negative for everything, always — and EV under the drift the thesis actually claims. A thesis that can't move the second column is decorative.