AI-First Principles for Crypto Scalping, Each With the Test That Breaks It

"AI-first" is usually an adjective. It sits in a README, it survives every code review, and nobody can say what would have to be true for it to be false. I spent a while auditing my own crypto scalper against a test that answers that question in two lines — and the honest result was that 0 of 108 modules were at the intersection of AI and crypto. Not one.

That is not a confession of failure. It is what happens the first time you replace an adjective with an experiment. Below are the eleven principles that survived, each stated the only way a principle is worth stating: with the condition that breaks it.

The instrument: two lines that decide it

Every component gets screened on two questions.

Leg A — delete every learned model. Does the component still do its job and return a non-vacuous result? If yes, it is not AI-native. The model was decoration.

Leg B — move it to S&P equities. Does it still work? If yes, it is portable, and therefore not crypto-native.

A component sits at the AI × crypto intersection only if it fails both. Passing either one makes it portable-or-classical. That is the whole test, and its asymmetry is deliberate: AI-NATIVE is the harder verdict to reach and the safer one to trust, because reaching it requires failing to find a pre-ML precedent — and absence of a precedent is weaker evidence than presence of one.

Run over my research tree, 108 modules:

Verdict	Count	Share
Portable / classical (survives at least one leg)	85	78.7%
Crypto-native (dies on equities, survives model deletion)	14	13.0%
AI-native (dies on model deletion, portable to equities)	9	8.3%
Intersection (dies on both)	0	0.0%

Nine modules genuinely need a learned model. Fourteen genuinely need crypto. The overlap is empty. And the entire learned surface underneath those nine turned out to be one ONNX embedding artifact plus one hosted completion endpoint.

I. Where the AI sits

The model supplies vocabulary, not judgement

Delete every learned model from a research loop and what remains — propose, pre-register, hold out, correct for multiplicity, gate, promote — is a research committee with a t-test. Single-use holdout is Larson 1931 and Stone 1974. Family-wise correction is Bonferroni 1936 and Holm 1979. The collective-N argument is Lo & MacKinlay 1990, published the year my counterfactual 1990 trading desk is set in.

The loop survives Leg A completely. What dies is the generator.

This is not a smaller claim than it sounds, and 2026 measured it from two directions. From Hypotheses to Factors (arXiv:2604.26747) builds exactly this shape — an agent proposes falsifiable factor hypotheses while a deterministic engine enforces fixed splits, selection gates and transaction costs — and reports "a 44.55% annualized return and Sharpe ratio of 1.55 in the 2024-2026 pure out-of-sample period after a 5 basis point one-way trading cost." Meanwhile When Agents Trade (arXiv:2510.11695) benchmarks agents live across markets and finds that "agent frameworks display markedly distinct behavioral patterns... whereas model backbones contribute less to outcome variation."

The scaffold is the variable. The model widens the candidate space at near-zero marginal cost, and that is the whole of its contribution.

The corollary is the part people get backwards. The caps — five hypotheses a week, one deployment, dataset retirement at twenty reads — are not friction against the AI. They are the only thing that makes an unbounded proposer statistically admissible.

Breached when you cannot say what the loop would lose if the model were replaced by a fixed enumeration over the same vocabulary.

No plane holds both a model and the engine

A 1990 desk already split the trader's judgement from the clerk's execution and the compliance officer's signature. The separation is organisational and it predates every technical argument now made for it.

What is new is that you can make it an import graph instead of a review convention, and an import graph fails at import time rather than at review time. Give the execution plane a ban on model clients, give the control plane a ban on the engine, and something surprising falls out: no single process can hold both, so the composition root cannot exist as one program.

Mine became two OS processes with JSON on disk between them:

scripts/control/hypothesis_backtest.py   (AI plane — spawns, never imports the engine)
        ↓  hypothesis.json  — a plain mapping, never a Hypothesis object
scripts/bt_hypothesis.py                 (engine — never imports the control plane)
        ↓  metrics.json     — deliberately omits p_value

Two details carry the weight. The child receives a mapping, not a rich object, so it cannot grow a method that reaches back. And the child does not compute its own p-value, because a backtest that scored its own significance would be self-certifying. Significance belongs to an independent verifier, and the gate fails closed without one.

A plane scan over 156 files reports zero offenders and no undeclared directory. The test that matters, though, asserts against the rule table itself rather than against the file tree — it fails the moment any plane is permitted both.

Breached when a model client and an order path appear in one import graph — or when the object crossing the boundary is rich enough to carry behaviour instead of data.

II. What earns the badge

A crypto-native input does not make an AI-native model

This is the principle I got wrong for longest, and the one I would most want a 2026 reader to take.

Funding rates, mark-versus-index basis, liquidation intensity, on-chain deposit bursts — none of these has an equities analogue. Reading one feels like it should confer the badge. It confers exactly half of it: Leg B. Leg A is untouched.

The counterexample is direct and recent. Funding-Aware Optimal Market Making for Perpetual DEXs (arXiv:2605.06405) treats the funding rate as a stochastic state variable — inventory creates both a mark-to-market exposure and a state-dependent funding cash flow, and the coupling between those two is the whole extension — then solves the reduced control problem "with a monotone finite-difference Hamilton-Jacobi-Bellman scheme." No learned model anywhere: a PDE solved on a grid. With funding calibrated on Hyperliquid ETH, BTC and SOL perpetual data, "the funding-aware HJB improves mean ETH/BTC performance while lowering inventory RMS relative to classical Avellaneda-Stoikov" — better P&L and less risk carried, out of 1980s-vintage machinery given one more state variable.

Crypto-only input. Classical method. Better result.

I like this paper more for what it declines to claim: the SOL gains, it says, are not a Pareto improvement once a risk-scaled Avellaneda-Stoikov diagnostic is included. That is a paper reporting the leg where its own result is weakest, which is rarer than it should be.

So when I finally decoded the mark-price stream in my own capture path — funding rate, next funding timestamp, mark, index, all of it sitting there unread — I shipped it badged crypto-native × classical, and moved the intersection count by zero. It is a subtraction and a division. Nothing fits anything.

Breached when a component claims AI-nativeness on the strength of its inputs, or a module quietly inherits a badge from the package it was filed under.

The badge needs a derivation next to it

When I ran the census over my own docstrings, I expected them to be wrong. They were. What I did not expect was the direction: eleven docstrings claimed more AI-nativeness or crypto-nativeness than their code supported, and none claimed less. An error that only points one way is a bias, not noise.

One module described itself as "the AI-native function par excellence — it exists only because models are first-class." Its actual computation is Decimal division, integer summation, dict grouping, SHA-256 and an inverse-Herfindahl. Swap one foreign key for a trader ID and every line is unchanged.

There is a second trap on the other side of the same ledger, and it is worse because it looks like progress. Under any scheme that tags a verdict with a build status, the cheapest way to score well is to specify a learned crypto-native mechanism and never build it. A SPECIFIED / UNBUILT row at the intersection is a liability, not an achievement. I have two of them. They are debt.

Breached when the adjective is in the docstring and the derivation is not — or when your designed-but-unbuilt count is rising while the deployed count stays at zero.

III. What a measurement owes you

An unwarmed statistic is not a small one

A p99 over ten samples is the maximum of ten. That is arithmetic about order statistics, not a modelling opinion, and it cost me three separate bugs that all turned out to be the same mistake at different depths.

Measured, in my own feature set: [1.0]*9 + [50.0] returned 45.59 against a true maximum of 50.0. The same distribution at n=200 returned 1.00. My sweep detector gates on that p99, so early in every run its threshold was "the largest bucket seen so far" and ordinary flow cleared it — 42 sweeps before the fix, 30 after, and all twelve that vanished sat inside the warmup window.

The second was worse because it was silent. I fed an EWMA's warmup transient into its own percentile distribution, so every settled volatility reading sat above p95 of a set dominated by the ramp: 93% of quotes labelled EXTREME, which silently refused every one of the 42 sweeps the detector had found. A detector and a filter, each individually plausible, cancelling to nothing.

The repair is a statement about order statistics rather than a knob anyone can lower to make a detector fire sooner:

def required_samples(q: float) -> int:
    return math.ceil(1 / min(q, 1 - q))

p99 needs 100 observations. p95 needs 20. The quartiles need 4.

And the discipline that prevents the whole family: return None when unwarmed, never 0.0. A zero z-score reads as "no signal" and correctly fails an entry test — then reads as LOW and wrongly passes a regime gate. The same substituted zero blocks one path and unblocks another.

Breached when a feature returns a number where it means "I don't know".

Score against the curve, not the constant

My one learned artifact is a gradient-boosted fill hazard, frozen to a coefficient table the execution plane evaluates with math alone. It scored −0.0074 out-of-sample skill against the constant base rate on 24,000 rows, and −0.0030 on 8,000 — more negative with more data, which is what overfitting looks like from outside. So predict() raises rather than returning, and reading it at all requires a keyword-only shadow=True.

Refusing it was right. But here is the part worth internalising: against a constant baseline, passing would have been as uninterpretable as failing. A null hypothesis is only informative when it is the thing you would otherwise have done, and nobody would otherwise have predicted the base rate.

The honest nulls for fill probability are published and cheap. The effect of latency on optimal order execution policy (arXiv:2504.00846) works fill probability, limit price and order submission latency as one joint relationship, and derives "closed-form approximations" of those quantities that "perform well in the practical regime of interest" — closed form, so evaluating it costs one arithmetic expression and zero parameters fitted from your data. That is the curve a learned fill model has to beat before it has learned anything about fills, and it is a hard curve precisely because latency is already inside it: the 200 ms–2 s band a non-colocated scalper lives in is within the regime it approximates, not outside it. And KANFormer (arXiv:2512.05734) shows what the measured version looks like — survival analysis over time-to-fill that "integrates the actions of agents related to LOB dynamics and the position of the order in the queue," scored on right-censored log-likelihood and integrated Brier score rather than on accuracy.

My model had neither queue position nor agent labels. It was a member of the class KANFormer outperforms, scored against a baseline that could not have told me either way.

Breached when the reported baseline is buy-and-hold, a constant, or the base rate — and no structural alternative was ever fitted.

Report the average configuration, not the selected one

The Red Queen's Trap (arXiv:2512.15732) is a post-mortem of a hybrid system — LSTM/Transformer perception coupled to a genetic survival mechanism, the pairing routinely hypothesised to be the "holy grail" of adaptive trading — and its two headline numbers belong on a wall: validation APY > 300% against capital decay > 70% live. Same system, same code; one number from the selection environment and one from the market. The paper does not settle for "it overfit." It names the cause as "the mathematical impossibility of overcoming microstructure friction without order-flow data," and argues that "increasing model complexity in the absence of information asymmetry exacerbates systemic fragility" rather than compensating for it. A gap that wide between validation and live is not a tuning problem you iterate out of — it is the selection procedure measuring itself.

The generalisation: choosing a configuration after seeing the result spends degrees of freedom nobody counted. It is the objection that produced pre-registration, restated for hyperparameters. A result reported from the selected run and not from the distribution across seeds is a result about your selection procedure.

Breached when a headline number comes from a configuration chosen after the result was visible, and the spread across seeds is not printed beside it.

Only monotone loops may run fast

I was asked for a five-minute loop. The refusal is arithmetic, not taste, and I think the arithmetic is the most transferable thing in this post.

Take a proposer capped at five hypotheses per call, against a dataset that retires for gating at twenty registered hypotheses. At five minutes per iteration with the cap saturated, the twentieth hypothesis lands on the fourth iteration — twenty minutes — after which nothing on that dataset can be gated again, permanently.

It gets worse on the statistics. A week of five-minute iterations is 2,016 calls against a cap of 5. Bonferroni-corrected, the two-sided evidentiary bar moves from 2.58σ to 4.22σ. And with one deployment admitted per week, 2,015 of those 2,016 iterations could not have deployed whatever they found. A five-minute research clock spends its holdout in twenty minutes and then runs forever without the ability to conclude anything.

So "every five minutes" names a supervision cadence, not a research one. The guardian loop may run 288 times a day precisely because every action available to it — tighten, demote, halt, flatten — reduces exposure. A loop that can only close doors is safe at any frequency. A loop that can open one is not.

The corollary bit me on the way in: re-timing a faster safety loop down to five minutes is the one edit a guardian may never make, because it delays a tightening. My breakers run at 1s and my incident sweeps at 60s; the five-minute review is layered above both and replaces neither.

Breached when a cadence change slows any action that reduces exposure — or when a fast loop acquires an action that grants one.

IV. What acts on you

Optimising fill probability optimises toward the fills that lose money

A resting order is filled by someone who wanted to trade against it. Adverse selection is not a friction bolted onto market making — it is what the spread is compensation for, and Glosten & Milgrom 1985 said so.

The 2026 version is measured live, on the instrument in question. The Market Maker's Dilemma (arXiv:2502.18625) runs a live trading experiment on the Binance BTC perpetual and documents a negative correlation between maker fill likelihood and post-fill returns, concluding that "viable maker strategies often require a contrarian approach, counter-trading the prevailing order book imbalance." The taker side is no kinder, and its asymmetry is worth knowing separately. The good, the bad, and latency: exploratory trading on Bybit and Binance (Quantitative Finance, 2025) sends live market orders across both venues and reports "a consistent disadvantage to the trader, pointing to an adverse selection effect for taker orders: profitable orders... tend to achieve worse-than-expected outcomes, while unprofitable orders typically achieve their expected (adverse) outcomes." Different order type, same direction — and a symmetric slippage constant cannot represent it.

The sign fell out of my own data unprompted, which is the part I trust most. In the fill-hazard panel, order-book imbalance averaged 0.0047 on filled rows against 0.0446 on unfilled — fills arrive when imbalance runs against the resting order. I had not gone looking for that.

Two qualifications, because this is exactly the sort of finding that gets over-read.

First, the mechanism. A Zenodo preprint on the "fill flip" argues that in any discrete-price FIFO book, once the queue is exhausted "repricing is unavoidable and occurs without any further trade decision by the agent" — structural adverse selection independent of anyone's alpha. That would promote the finding from one venue's result to a general expectation. It is also a self-published preprint with no peer review, which is precisely the caveat the next principle is about, so I am citing it as a mechanism sketch and not as evidence.

Second, the horizon — and this is the qualification that most changes what you would build. The Quarter-Hour Effect (arXiv:2607.09426) documents, across six Binance perpetual contracts, periodic bursts in volatility and volume at the one-minute, five-minute and quarter-hour marks — an algorithmic clock imposed on the market by the schedulers trading it — and finds that "opening order imbalance predicts returns over four to twelve hours, with much weaker effects at finer clock-time frequencies." Read the two halves together: that is a continuation result on the same venue and instrument class as The Market Maker's Dilemma's reversal result, separated by roughly four orders of magnitude in holding period. Neither refutes the other. The sign of order-book imbalance may genuinely flip between the touch and four hours, which is an argument for pre-registering it per horizon rather than assuming either answer — and a warning that a paper's sign is portable to your horizon only if you check that it is.

Breached when a fill model has one head. Predicted fill probability and predicted post-fill markout have to be fitted together, or the model steers you into the adverse half of its own distribution.

Literature inspires a hypothesis; only local evidence promotes one

No paper can show that an edge survives your venue, fee schedule and latency. That has always been true. What is new in 2026 is that the corpus itself is adversarial, and specifically adversarial to scalping vocabulary.

In my local research corpus of 21,305 records, 121 titles are exchange referral-code SEO documents — "Bitmex Referral code 'SAVE20' Get Upto 50% On Trading Fees" — and 114 of them carry a Zenodo DOI, which makes them look peer-reviewed to any automated filter. They are invisible to a year filter. And they outscore real papers, because the vocabulary of a scalping paper — fees, rebate, maker, taker, discount — is also the vocabulary of fee-discount spam.

Measured on one fee-worded query: 42 spam records ranked above the first real paper on dense retrieval, and 59 on BM25. On conceptual queries the same filter dropped nought or one. The pollution is vocabulary-specific. It bites precisely when you ask the question you care about.

Two follow-ons I had to learn the hard way. Do not filter on the DOI prefix — 719 records in my corpus carry Zenodo DOIs and only about 100 are spam, so the shortcut silently drops real papers. And one record ranks well on fee vocabulary, is not spam by any filter, and has an abstract that is a verbatim user prompt — an LLM research artifact wearing a DOI.

While I am here: run both retrieval lanes and union them. Dense wins on conceptual queries; lexical wins when the query names a term of art. The Market Maker's Dilemma — the single most decisive paper in this whole post — ranked #1 on BM25 and did not appear in the dense top-45 for its own natural-language query. Read to depth 40–60, not 10. Top-k is recall.

Breached when a citation reaches a gate — or when an evidence manifest is machine-filled, which admits the spam wholesale.

The one that only shows up when your builder is an agent

I saved this for last because it is the newest of the eleven, and because it explains the zero at the top of this post better than any story about difficulty.

My test suite fails the whole session if a model API key is exported. That rule is correct — offline, fail-closed, credentials absent. It also has a side effect I did not see until six iterations had gone by: it makes a live model call unverifiable by the only feedback loop the project has. So every increment that can be verified is a deterministic increment, and the learned half is always the half deferred.

Six consecutive build iterations produced only deterministic plumbing. Not because the learned work was hard. Because an agent optimising for green tests will always produce the classical half. That is a mechanism, not a lapse of judgement, and it is a much better explanation of an intersection count of zero than any amount of "we didn't get to it".

The escape is to make one real model call verifiable rather than to relax the rule. I recorded a single live completion outside the test session — 601 prompt tokens in, 4,208 out, of which 3,494 were reasoning — froze it as a fixture, and pinned the SHA-256 of the prompt that produced it against the prompt rendered today. The suite stays keyless and offline while asserting against what a model actually returned. And because the digest is checked, changed prompt = changed model = new evaluation is enforced mechanically instead of remembered.

Before that, every AI path in the tree was tested against JSON a human had imagined a model would produce. Which tests the imagination.

Breached when your test suite cannot fail for the reason you actually care about.

So what

Put together, these eleven describe something narrower than "AI-first" and considerably more defensible: a bounded search, narrowed using evidence the system recomputed itself, where every widening is a human act.

The self-improvement does not live in weights — online updates are forbidden — and it does not live in memory across sessions, where the prompt stays a pure function of its context. It lives in two accumulations on disk: a graded-claim ledger, where every predicate the previous policy asserted gets recomputed and recorded as held or not; and a demotion record, so next week's proposer cannot re-propose a hypothesis already killed with only its numbers moved.

Almost every one of them has a pre-ML ancestor with an author and a year — the 1990 limit sheet, Bonferroni 1936, Glosten & Milgrom 1985, the arithmetic of order statistics. That is not a weakness in the list. It is the reason to trust it: the oldest ancestor here is Larson on single-use holdout, in 1931. A principle that has already outlived four decades of computing has survived more than a hype cycle.

Zero at the intersection is not the embarrassing part. The embarrassing part would have been shipping the adjective and never taking the count.