Wire the order-contract boundary into every Alpaca paper submit (local refusal before any network call) - #198

…e; first 1x leverage-ladder attempt (needs_attention) (#212)

Native-fault receipt.json is now the 2026-09-24 18:58Z run on the #198 order-contract engine (native_faults_passed, bound to main 3b7ae71, with an independent observation). The 14:39Z receipt is retained as receipt-20260924t143905.json. The first 1x leverage-ladder attempt (ladder-1x-20260924a) is retained as a failure: needs_attention after 190 s on a false-positive fill-precision refusal (the #205 class; broker FILL activities show on-grid executions), flat and reconciled, peak leverage 0.151. Rate-limit evidence regenerated (705/14). No gate status changes.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…review findings

Merges origin/main (which carried #198's order-contract boundary and its
own runner.py/source-hashes.json changes) into the paper-lane
corporate-action guard branch, resolving the runner.py/source-hashes.json/
manifests/evidence.json conflicts, and folds in the independent review's
fix round for the guard itself:

- CRITICAL (1): widen the corporate-actions fetch window to anchor-7d..
  anchor+90d (Alpaca filters by process/payable date, not the ex_date this
  guard checks) and filter locally in evaluate_guard; treat a result at the
  page/limit cap as ambiguous; native re-check recorded in
  corporate-actions-native-check-20260924.json.
- HIGH (2): run the corporate-action refresh off the asyncio event loop in
  a worker thread, bounded by wait_for and an in-flight flag; pin a request
  timeout and cut retries on the underlying alpaca-py client; do the first
  fetch before run_native's tick loop starts.
- HIGH (3): a failed/stale refresh no longer overwrites a previously
  confirmed action with "lookup failed" -- the last good result is kept,
  with needs_attention added, so a confirmed flatten is never cancelled by
  a later failure.
- MEDIUM (4): evaluate_guard's date check is now an inclusive
  today<=action_date<=next_session_date range, catching a weekend/holiday
  governing date.
- MEDIUM (5): the run-outcome corporate-action guard summary
  (pending_must_flatten) is read by _honest_overnight_hold, so a symbol
  still flagged must_flatten at the run boundary forces needs_attention/
  recovery instead of a false held_overnight.
- MEDIUM (6): added the 2027 NYSE holiday/early-close calendar to
  sessions.py; a session-calendar failure now blocks-and-flags only, never
  force-flattens every holding.
- MEDIUM (7): fixed silent pass-throughs -- an omitted symbol defaults to
  lookup-failed; the refresh throttle is now keyed on the fetch window too;
  an unmapped corporate-action type fails closed instead of being dropped;
  unit-split alternate_symbol is mapped.
- MEDIUM (8): the guard is wired into the strategy only when
  overnight_holds is enabled; failures retry on a short ~60s interval
  instead of the full refresh interval; a guard summary is added to the
  run outcome.
- LOW (9): a symbol flagged by both the corporate-action guard and the
  gap-risk stop now gets exactly one sell action.
- LOW (10): a resting buy order for a symbol newly blocked this tick is
  cancelled.
- NIT (11): the decision event only carries the corporate_action_* keys
  when the guard is actually wired in (restores the byte-identical-when-off
  claim); a guard event is only re-emitted when the decision changes.

Adds targeted tests for each finding (corporate_actions.py's
CorporateActionMonitor/evaluate_guard/AlpacaCorporateActionsSource,
native_strategy.py's rebalance() wiring, and runner-level tests of the
fetch window, wiring decision, and threaded/bounded refresh scheduling).
Recomputed blueprints/us-equities/adaptive-paper/source-hashes.json and the
matching manifests/evidence.json entries programmatically from the changed
files' actual on-disk content.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… fill-precision branch

Conflicts were registries and counts only: took main's copies, regenerated the
rate-limit evidence (1693 trading, 16 data headers), re-pinned this branch's five
sources in source-hashes.json and re-registered its files in the evidence manifest.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…-09-24/25 merges (#225)

Updates four checkpoint entries: the paper lane, the simulation lane, alpaca-paper-operational and corporate-action-data. They now reflect #198, #199, #212, #218, #219 and #222. tests.test_grand_dashboard passes, and all state strings satisfy progress.py's public-token rule.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…tale-review rule and local reviews to the Codex gate

- nas_land.sh: R comes from LANDING_REPO, default native-agent-stack/native-agent-stack. GitHub
  redirects the old slug (github/docs@be38ec5d transferring-a-repository.md:62) until a repository
  is created at the old location (:68-69).
- Both scripts (CC correction #198): the no-reply author is LG_AUTHOR_LOGIN, default
  seathatflowsinourveins, and R's owner only when it is unset. A login of another shape is refused
  before any call (exit 11). The form <id>+<login>@users.noreply.github.com is unchanged
  (email-addresses-reference.md:47).
- codex_gate.py (CC correction #200): a review shown running with no connector activity for 90
  minutes gives 5. This is the CC's operational block, ported byte for byte.
- Local reviews: LOCAL_REVIEWS, with its alias CODEX_LOCAL_REVIEW, names normalized review files,
  and the gate decides from them alone:
  - 2 for a file that is malformed, of another head or not completed;
  - 4 for a P0 or P1 finding;
  - 0 otherwise, with P2 and P3 counted.
  lg_gate passes on the heads that carry the read head's change (lg_same_change).
- review_normalize.py writes the normalized files from a `codex review` rollout
  (openai/[email protected]) or from the /code-review plugin's comment
  (anthropics/claude-plugins-official@f359d43b).
- The new tests fail at c63c83a (104 failures, 7 errors) and pass here (133 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…eview rule and local reviews for the Codex gate (#1061)

* Land on the organization's repository as the merging account; add a stale-review rule and local reviews to the Codex gate

- nas_land.sh: R comes from LANDING_REPO, default native-agent-stack/native-agent-stack. GitHub
  redirects the old slug (github/docs@be38ec5d transferring-a-repository.md:62) until a repository
  is created at the old location (:68-69).
- Both scripts (CC correction #198): the no-reply author is LG_AUTHOR_LOGIN, default
  seathatflowsinourveins, and R's owner only when it is unset. A login of another shape is refused
  before any call (exit 11). The form <id>+<login>@users.noreply.github.com is unchanged
  (email-addresses-reference.md:47).
- codex_gate.py (CC correction #200): a review shown running with no connector activity for 90
  minutes gives 5. This is the CC's operational block, ported byte for byte.
- Local reviews: LOCAL_REVIEWS, with its alias CODEX_LOCAL_REVIEW, names normalized review files,
  and the gate decides from them alone:
  - 2 for a file that is malformed, of another head or not completed;
  - 4 for a P0 or P1 finding;
  - 0 otherwise, with P2 and P3 counted.
  lg_gate passes on the heads that carry the read head's change (lg_same_change).
- review_normalize.py writes the normalized files from a `codex review` rollout
  (openai/[email protected]) or from the /code-review plugin's comment
  (anthropics/claude-plugins-official@f359d43b).
- The new tests fail at c63c83a (104 failures, 7 errors) and pass here (133 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Carry Codex's verdict into the local review gate and make the /code-review arm advisory

The CC's follow-up to the first commit of this pull request.

- review_normalize.py carries Codex's overall_correctness verbatim, and overall_confidence_score when
  present. openai/[email protected] rubric.md:85 fixes "patch is correct" | "patch is incorrect",
  while the wire type is a free String (protocol.rs:3507). The mirror at 092d3acd6 holds the same
  bytes as the tag.
- codex_gate.py:
  - "patch is incorrect" blocks (4), whatever the findings' priorities;
  - any verdict other than exactly those two stops (2), as does a set with no completed
    codex-review (the required arm).
- The /code-review arm is advisory until the review-replay addendum measures it (arms E and F).
  Below a score of 80 the plugin does not proceed to its comment (code-review.md:26), and it
  skips a pull request it already reviewed (:11). So its issues are counted and a missing comment
  is noted, and neither stops the gate.
- The new tests fail at a6c8bf7 (134 tests: failures=76, errors=2) and pass here (134 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fix the reviews at c999eee: bind the review's base, stop on a set empty variable, refine the stale rule, drop host-only digests

From the CHANGES_REQUESTED reads at c999eee: the CC's Claude read, the CC's /code-review probe and
Astra's read.

- P1, the base: a codex-review now records the merge base its request named (openai/[email protected]
  review_request.rs:21, :62-70; branch.rs:13-15), and lg_gate requires it to be
  git merge-base <head> origin/main. Base = head and base = head^ stop.
- P1, an empty variable: a set but empty LOCAL_REVIEWS or CODEX_LOCAL_REVIEW now selects local mode and
  stops (2), instead of falling back to the connector.
- P2, the order: a review of our head that ended other than Completed gives 4 before the stale 5. A
  trigger after a stall gets the NOSTART grace, and the eyes reaction with no Running row is bounded.
- #200's value: OpenAI's Codex docs state no review time limit. The README records the measured basis
  (nas#1056) and keeps the value in one constant.
- P3s:
  - LANDING_REPO must have the owner/name shape, and every -R "$R" is quoted;
  - users/<login> must be of type User;
  - Legacy rollouts are refused, fail closed (exec/src/lib.rs:1425-1432; rollout/src/policy.rs:141-155);
  - codex_wait gives a local 2 its own message;
  - the plugin comment is bound to --head by its full-SHA links.
- Astra P1-3: the README carries no digest or prefix of a host-only file any more, and a test refuses any
  digest that is neither a tracked file's nor a named public artifact's.
- Astra's follow-ups 1 and 2: a refused retry removes the earlier --out file, and a non-finite
  confidence stops the gate.
- The new tests fail at c999eee (144 tests: failures=164, errors=2) and pass here (144 tests).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Require local reviews on nas, let the latest review decide, revert the eyes bound, harden the digest guard

The fixes for the CC's Claude delta and Astra's read at 974090c, both
CHANGES_REQUESTED:

- nas_land.sh requires local reviews (the CC's ruling). With LOCAL_REVIEWS
  and CODEX_LOCAL_REVIEW both unset it stops with 2 before any call, before
  the lock, update-branch and ready. The one exception is
  LOCAL_REVIEW_WAIVER: a file whose last Waiver line reads "Waiver: local
  reviews for #<pr> at <head8>", checked in verdict_gate and again by
  final_gate. A waived landing asks the connector as before and records the
  waiver in its squash body, after the body GitHub offers for the squash
  (viewerMergeBodyText, where gh's own edit step starts). uet_land.sh keeps
  the connector path; neither the shared block nor codex_gate.py changes
  for this.
- codex_gate.py, Astra's P2: the latest review of our heads since the
  trigger decides. An earlier completion hid a later Cancelled review:
  beside a stale row of another commit the gate gave 5, and with no row
  running 0. Both give 4 now; a later completion still supersedes a
  failure. The base's test that pinned "any completion evidence passes" is
  flipped.
- codex_gate.py: the connector's eyes reaction with no Running row waits
  (3) with no bound again, as at c999eee; 974090c's 5 was a new opening.
- Sources cited: the users API's type and the owner/repo parameters
  (github/rest-api-description@58b1e0c0), the repository-name rule
  (github/docs@be38ec5d), the set-or-unset tests (bash(1), cpython
  v3.13.16 os.environ), os.replace and os.unlink, json's number parsing
  and math.isfinite.
- The digest guard reads any letter case and bare prefixes (a commit id
  must be a named public commit), the four scripts and, with
  LANDING_PR_BODY, a pull request's body; its known digests are the files
  git tracks.
- README: the requirement and the waiver, the latest-review rule, the
  eyes revert, the guard and its residuals, the clean-comment limit, the
  sources and the files as committed. manifests/evidence.json: the six
  records.

The module run against 974090c's tools/landing: 156 tests, FAILED
(failures=31, skipped=1). The guard's probes are measured against
974090c's guard, which finds none of them.

Follow-ups (P3 from the reviews at f9266fd; not changed here):
- GPT 1: pin a Git citation for the tracked-file selection.
- GPT 2: retry recovery still keeps output on a usage error; use a fresh output path per attempt before adding retries.
- GPT 3: digest coverage and evidence packaging stay bounded (README 585-587).
- GPT 4: keep the recorded adjacent boundaries (the clean plugin comment binds no head; the arm stays advisory).
- GPT 5: inherited hostname hygiene in the tests.
- Claude 1: README 98-99 still states the reversed Completed/Cancelled rule; the gate gives 4.
- Claude 2: README 203 and nas_land.sh 15-16 say a 5 proceeds; it now proceeds only under a waiver.
- Claude 3: README 345 and nas_land.sh 332 say uet_land.sh binds GPT_VERDICT; it binds the head prefix only.
- Claude 4: no same-second completion/failure tie test; no "waiver unreadable" test.
- Claude 5: a failed git rev-parse is read as "not a work tree" in the digest guard test.
- Claude 6: a set-but-empty LOCAL_REVIEWS passes the presence check; update-branch and ready run before exit 9.

Co-Authored-By: Claude Opus 5.5 <[email protected]>