Vanna: Federated FX Execution Intelligence

In last-look FX, a liquidity provider can show a beautiful quote and then reject the trade at deal time. Fill probability, rejection, slippage, latency and volatility decide what an order really costs, so the tightest displayed price is often the expensive one. Each desk only sees its own fills and rejects, too small a sample to tell a systematic rejection pattern from noise. And desks can't just pool order flow: that would move client identities, UTIs, positions and live intent between competitors, and a shared routing feed among rivals is a collusion problem.

Vanna’s answer is to move the model, not the data. Five desks each train on their own private execution history with Flower, and only model updates cross the wire. The histories are synthetic by design: 450 reproducible rows per desk standing in for private desk logs, because the point is the training and privacy architecture.

Two aggregation regimes, one trust boundary

The default path is FedXgbBagging. The signal I cared about is nonlinear, provider crossed with volatility, so each desk adds locally trained XGBoost trees and the server merges the boosters over three rounds. Feature gain on the saved ensemble ranks high volatility first, then the LP_A × high-volatility interaction, exactly what a linear model would miss. An opt-in secure mode runs under SecAgg+, where the server only reconstructs a weighted sum. A sum can’t merge trees, so secure mode switches to FedAvg on a transparent logistic model: secure summation, or tree ensembles the server can see. One ClientApp serves both, applying the SecAgg+ mod only to secure traffic, so the choice is a run-config flag, not a second codebase.

Flower can’t bundle an agent app with a federation app, so that platform rule became the trust boundary. Training and decisioning meet only through one typed evidence artifact: per-provider fill probability, rejection, slippage and latency, with a provenance label saying whether each field came from the federated ensemble, a server-side regression or a synthetic constant. The agent side re-validates the file and rejects it if a prohibited field, such as a client id or UTI, appears.

Six agents, a governor and a human

Vanna ranks providers with a deterministic executable-cost function. Specialist agents for last look, counterparty reliability, margin pressure and manipulation signals each return a typed assessment, and a governance agent consumes them all. It can allow the route, reduce size, fall back to local-only, send the ticket to a human, or suppress the collective output when routing looks synchronised or a query tries to isolate a rare participant. A shared model among competitors could become a coordination channel, so the system has to be able to refuse to publish the shared answer.

The language model only narrates a finished decision. It receives the typed result, is told to preserve the numbers, and runs in a bounded tool loop; if the endpoint fails, a deterministic renderer gives the same answer. Unsafe actions are unrepresentable: in the Pydantic schemas, fields such as automatic execution, automatic blacklisting, collective instructions and misconduct findings are typed Literal[False], so a malformed output fails validation, not just policy. The only consequential output is a PENDING_HUMAN_APPROVAL record tied to a digest of the run and marked as sending no broker order.

On the committed evidence, the provider with the tightest displayed quote costs 5.59 bps to execute, against 2.11 bps for the provider Vanna ranks first.

The stack: Python, Flower 1.35, XGBoost, NumPy, Pydantic, a Responses API client and a React/Vite terminal, with pytest covering privacy, both federation modes, every agent and the gateway.

The decisions I found most interesting were all about boundaries: what may move, what the server may see, and what an agent is allowed to say.

Built at Flower Cambridge, federated collaborative AI, 2026, where it placed in the top 5.