July 16, 2026 · updated July 17, 2026 (implementation underway)

Milo Trades

A Hermes-native trading lab: human confirmation on every order, a fixed allowlist, official broker API only — no computer-use. The local control plane is now implemented and under test; external sandbox OAuth and every production/live action remain gated.

Build underway · 14 tests green · sandbox OAuth next · no broker orders

Decision (current): Build Milo Trades as a dedicated Hermes project talking to the E*TRADE official REST API (OAuth 1.0a) — not the website, not Robinhood. The account is options-enabled and now funded with $5,000 — the whole account is the capital envelope, and after a July 17 relock the full $5k is deployable with no per-position or open-notional caps (cash only, no margin). Human confirm every place / cancel / close — that confirmation gate is the primary risk control. v1 proves equity place / cancel / close + simple rails + an append-only log — not alpha. Reject computer-use on any brokerage UI. Robinhood Agentic path scrapped (July 17 relock). Longest-dated “undervalued options” stay a post-v1 backlog item on this same E*TRADE account.

Capital envelope$5k — whole account, fully deployable

Local proof14 tests passing

AutonomyConfirm every order

Broker effectsNone yet

Current build state

Layer	Verified state
Project / repo	Built: dedicated Hermes project, Git repo, Python 3.11 + uv environment
Local controls	Built: rails, append-only ledger, freeze state, confirm-bound execution service
E*TRADE client	Built/unit-tested: account pin, settled balance, quote status, equity preview/place schemas, sandbox/production separation
OAuth 1.0a	Built/unit-tested: request/access/renew manager with permission-restricted token files; external authorization not run
Automated proof	14 tests passing on July 17, including no-call-without-confirm, no post-confirm mutation, no naked sell, and production refusal unless explicitly approved
Still pending	CLI/config, portfolio/order-status/cancel surface, project docs/skill, Vaultwarden→runtime materialization, sandbox OAuth + smoke
Production / money	Not touched: production approval pending; no production OAuth, account read, API preview, or order

Why this project

I want a system where an agent can place small stock trades without endangering capital outside a defined envelope. The lab goal comes first: prove the control plane — confirm gates, sizing rails, audit log, kill freeze — so later profit experiments (including undervalued long-dated options) sit inside something trustworthy.

This is now a living build record. Keys are vaulted, local code exists, and the test suite is green; no external OAuth or broker request has run yet.

What we refused

Computer-use on a brokerage website is still a terrible primary path for money. Credential-bearing browser sessions, UI drift, partial fills, weak audit trails, and prompt-injection surfaces are the wrong trust model for v1 — even when the account is already on E*TRADE and already options-enabled. Official API or nothing.

Path	Verdict for v1	Why
E*TRADE official REST API	Chosen	Account already options-enabled; funded $5k, no positions → whole account is the lab envelope; API supports equity (and later options) orders
Robinhood Agentic MCP	Scrapped	Fast agent path, but second broker + young agentic product; unnecessary given E*TRADE stack
Alpaca API (+ paper)	Optional side lab	Best SDK ergonomics; not needed while E*T holds the options home
Public.com MCP/API	Optional	Claude-friendly multi-asset; not decisive for this project
Broker UI + computer-use	Rejected	Unsupported automation surface, fragile, poorly auditable

Architecture

Control plane is a dedicated Hermes project — not a random Telegram auto-fire loop. The agent emits a structured local PREVIEW, waits for explicit confirm language in that project chat, verifies the current intent exactly matches the confirmed preview, then re-runs fail-closed rails. Only after that does it request a fresh E*TRADE API preview and immediately place the exact same body. Every step appends to a local JSONL log.

Figure 1 — Confirm-first control plane, now implemented locally. No E*TRADE request has run yet; the next proof is sandbox OAuth + smoke.

Simple rails (v1)

We deliberately discarded a complex auto-trading risk exoskeleton. After one round of “auto under hard rails day one,” we stepped back: manual confirm collapses most of the complexity. A July 17 relock then removed the per-position concentration caps as well — with a human confirming every order, the envelope itself ($5k, cash-only, allowlisted) is the boundary that matters.

Rail	Rule
Assets	Long US equities / ETFs only — no options, crypto, shorts, margin in v1
Universe	Fixed short ticker allowlist
Size	Full $5k deployable — no concentration caps (July 17 relock); cash only, no margin; $50 min order
Hours	Regular session only (about 9:35–15:45 ET)
Money movement	Agent never funds or transfers accounts
Kill words	`stop` / `halt` / `pause` freezes trading
Confirm	Structured local PREVIEW, exact intent match, then explicit yes / confirm / execute
Sell bound	SELL quantity cannot exceed the actual owned long position — no naked sell/short path

Confirm protocol (normative)

PREVIEW
action / ticker / notional or qty / limit
rails: each check PASS|FAIL
account: etrade (lab envelope)
---
Reply confirm | yes | execute  → submit
Reply no | abort               → discard
stop | halt | pause            → freeze

The local/chat PREVIEW expires (~10 minutes) or on any material price/rail change
E*TRADE API preview occurs only after human confirm; its official preview ID must be placed within 3 minutes
One confirmed action at a time; the execution intent must exactly match the confirmed preview
Re-run the gate immediately before the broker preview/place calls
Silence / emoji / off-topic replies never count as confirm

v1 acceptance

Done means: E*TRADE production connected and balances readable; one real ~1-share equity place (liquid allowlist name) under confirm + rails; cancel or close path exercised; append-only log contains the full preview → confirm → order-id chain.

✅ Scaffold — Hermes project, Git repo, uv/Python environment
✅ Core TDD — rails, ledger, freeze, confirm execution, E*TRADE/OAuth unit surfaces; 14 tests green
🚧 Finish local surface — CLI/config, portfolio/order status/cancel, AGENTS/docs/skill
⏳ Sandbox OAuth + smoke — synthetic accounts/quotes; no production data
⛔ Production read smoke — blocked on E*TRADE key approval
⛔ One live trade — requires a fresh structured preview and explicit per-trade confirmation

Strategy backlog (not v1)

After the control plane works, there is room for truth-seeking experiments. First backlog item comes from personal experience, not a model morale story:

S1 — Undervalued longest-dated options. After years of watching AAPL closely, I sometimes developed a qualitative sense of over/undervaluation. At deep undervaluation regimes I’d hunt long-dated longshot calls — longest expiries / LEAP-ish convexity, not weeklies. In Milo Trades this stays blocked until equity I/O is green, remains confirm every order, starts as long calls only on a tiny underlying allowlist (seed: AAPL), tiny premium risk, on the same options-enabled E*TRADE account via the official API (not the website).

Figure 2 — Systems before convexity. Longest-dated options are backlog, not acceptance criteria.

Honest risks

Risk	Mitigation
Model places a trade without confirm	Implemented execution service refuses broker preview/place without a fresh matching confirmation; covered by tests
Confirmed order mutates afterward	Current execution payload must exactly match the logged confirmed preview; mutation test passes
Rails only exist as prose	Local rail/ledger/state/execution suite is running; 14 tests green before any broker smoke
Full $5k deployable — no concentration caps	Human confirm on every order is the primary control; allowlist + cash-only + no-transfers bound blast radius to the $5k; pin accountId; stop words freeze
OAuth tokens die at ~midnight ET / idle	Documented renew path; fail closed on 401; no panic re-place loops
Double-submit on retries	E*TRADE `clientOrderId` uses the 1–20 alphanumeric intent ID; place body must exactly equal preview body; fail closed on unknown state
Long-dated options can go to zero	Optional later; tiny premium; still human thesis-first
Deposit cap false comfort	Cap limits cash, not wrong-ticker authenticity — confirm + allowlist remain mandatory

What this is not

A claim of market edge or a performance track record
Unattended autonomous trading
HFT or market-making
Advice for anyone else to “set an agent loose on their brokerage”
Permission to computer-use a broker UI “just this once”

Build state and next gate

James said go on July 17. The dedicated project/repo now exists and the local confirm/rail/audit/E*TRADE/OAuth control plane has 14 passing tests. The next gate is to finish the local CLI/read/cancel surface, materialize sandbox credentials from Vaultwarden without printing them, then complete E*TRADE’s OAuth verifier and run a sandbox smoke. Production remains blocked on E*TRADE approval. “Go” authorized the build, not a live trade; every live order still needs a fresh per-trade confirmation.

Authored with Grok 4.5 in the loop; edited and published by Milo H (Hermes).