fix(trading): accept paper host version paths in capacity env URLs - #1069

Scope

Accept the paper host's /v2 env-file form while keeping every request pinned to transport.PAPER_URL. Parse the URL strictly and normalize only HTTPS, the exact paper host, no port or port 443, no userinfo/query/fragment, and paths "", /, /v2, /v2/. Invalid values keep the existing non_paper_base_url refusal.

• Base commit: 107bcca66133db379e9bf31560ba617519c59bec (fresh origin/main).
• Lane: lane:trading.
• Owned paths: blueprints/us-equities/order-throughput/capacity.py, tests/test_order_throughput.py, and that test's hash/byte registration in manifests/evidence.json.
• One commit, as directed. No real credential file was read and no broker request was made.

SOTA sources

• alpacahq/alpaca-py v0.44.0, pin cc4cb3b7ba50ae250e621983c2779047fb16bb28: alpaca/common/enums.py:9 defines BaseURL.TRADING_PAPER as https://paper-api.alpaca.markets; alpaca/common/rest.py:36,64 defaults/stores API version v2, and lines 107–109 append the version separately. Verified in the pinned upstream mirror; exact blobs are retained for review.
• The existing adaptive-paper transport at the base remains unchanged. Env-file host/path text never replaces this transport's request host. Internal CapacityConfig.validate() still requires the canonical PAPER_URL.

Evidence-class table

Local commands run

TMPDIR=<task /var/tmp scratch> python3 -m unittest tests.test_order_throughput.PaperEnvURLTests -v
main production source: exit 1, CLI non_paper_base_url; 1 failure / 7 errors
fixed production source: exit 0, 3 tests / 0.055 seconds

TMPDIR=<task /var/tmp scratch> python3 -m unittest tests.test_order_throughput -v
exit 0, 79 tests / 7.997 seconds, 1 existing skip

TMPDIR=<task /var/tmp scratch> python3 scripts/validate.py
exit 0; 71 components, 11878 hashed files, 4 profiles, 240 receipts

python3 scripts/evidence_manifest.py --check
exit 0

git diff --check
exit 0

PR-range gitleaks and publication/privacy checks run before publication; their complete outputs are retained in the review packet.

Decision record

This PR records the CC's strict URL compatibility correction. Its private hashed attachment packet retains the main source, upstream pin, fail-first/fixed logs, complete module and validator results. capacity.py has no current files[] registration; runtime receipts compute its source hash automatically. Only the registered changed test hash is refreshed. Historical capacity receipts and source hashes are preserved.

The wider check covers every env_base_url call site (the CLI and tests), missing/invalid env values, strict internal config validation, and the unchanged request transport. The CLI no longer uses rstrip('/'), which previously admitted repeated trailing slashes. URL-parser control stripping cannot bypass the raw-input checks. No owner-managed env file is modified. Paper attempt a2 remains a separate operation after review and landing.

Follow-ups

None identified within this correction.

Host evidence

Not applicable; no evidence/hosts/ changes.

Checklist

• No GitHub Actions or workflow permissions changed.
• No real credentials read, printed or committed; only fake-key temporary fixtures were used.
• No broker request, paid hosting or new billing surface was introduced.
• Peer-owned files and worktrees were preserved.