The LLM cannot sign a trade.

Weights, risk figures, and portfolio constraints are produced by deterministic code — not by a model’s next-token prediction. Language models are confined to narrow, auditable roles: articulating rationale, summarising context, translating between representations.

Numbers that bind are traceable to inputs and to code. Nothing about the weights shown in the IC memo originates in a probabilistic head.

A dedicated reviewer layer inspects each proposal. Its outputs never reach the decision maker directly. Dissents are logged, surfaced, and archived with the decision record — but the decider sees a governed summary, not raw reviewer text.

Reviewers challenge. They do not steer.

Every message between internal components is validated against a typed schema at the boundary. Malformed or out-of-bounds outputs are rejected before they propagate. There is no silent field drift, no loose stringly-typed contract between stages.

Prompt-injection cannot leak through as structured data, because there is no path by which unstructured text becomes structured input without validation.

Retries are capped. Anomalies trip circuit breakers and return control to a human operator. Degraded states are explicit: the system announces it is degraded and halts, rather than quietly continuing on best-effort.

There are no silent retries, no optimistic completions, no exception-swallowed edge cases.