Firebreak

Inspiration Everyone is bullish on agentic trading — and every backtest is beautiful. We've watched too many strategies that looked inevitable fall apart out-of-sample. So instead of building a smarter predictor, we built the thing that says no: a deterministic firewall between "looks good" and "move money." WebMCP crystallized it — the front-end of the next era isn't a dashboard, it's an agent. Firebreak targets agents, not browsers.

What it does Firebreak is an investment-research agent whose job is to stop you — and any other agent — from admiring a beautiful backtest into trading. You hand it a research task in natural language. It plans a tool sequence, then a deterministic, LLM-free gate audits dataset provenance, data quality, out-of-sample walk-forward integrity, and production readiness — and either BLOCKED (anything that only looks good) or ELIGIBLE (evidence that genuinely survived every gate). Even when ELIGIBLE it never places an order: final authority is always human. Every decision is written to an immutable, chained-hash audit ledger you can verify yourself.

How we built it FastAPI + pandas/numpy deterministic backtests with fixed seeds — same input, same verdict. A constrained planner (Qwen, with automatic model fallback) that may only plan (PLAN_ONLY); the veto lives in four deterministic gates in code, never in the LLM, so a hallucination can't override a refusal. Contract layer: webmcp.json + llms.txt expose five typed tools. Reliability layer: 63 automated tests, property-based invariants (verdict is binary, order_intent_created is always false), an immutable chained audit log with tamper detection, and a public SECURITY_BENCHMARK.

Challenges we ran into The demo looked hardcoded — it always returned BLOCKED for the synthetic dataset; evaluators would read it as scripted. We fixed it by exposing an UNPROVEN / PROVEN evidence toggle: same system, same gates, BLOCKED for unproven data, ELIGIBLE for a source-verified dataset — proving the gate is live, not a fixed answer. Also, our default model had no quota, so we added automatic planner fallback (qwen-turbo/qwen-max), plus a deterministic rule fallback when no key is configured at all.

Accomplishments that we're proud of A refusal a hallucination can't override. Property-tested determinism. An immutable audit ledger with tamper detection. The UNPROVEN/PROVEN toggle as proof the system isn't scripted. And framing the plain page as a feature: the front-end is the tool contract an agent reads, not a candy dashboard for a human to click.

What we learned The highest-value property of an agent isn't more autonomy — it's giving a human a reason to trust its output. Provable (reproducible + auditable + test-locked) beats persuasive. And for WebMCP: the interface isn't pixels; the interface is the schema.

What's next for Firebreak Apply the same deterministic veto to more domains — order execution, approvals, data pipelines. Ship SECURITY_BENCHMARK as a cross-agent safety standard. Add live-broker integration that still can't auto-execute without human sign-off. And orchestrate multiple agents — any of them must sit behind the gate.