Skip to content

Full System Audit: Build 922Z Baseline & Security Check#1

Merged
mkalhitti-cloud merged 18 commits into
fix/task-23-sima-account-syncfrom
audit/full-codebase-review
Feb 27, 2026
Merged

Full System Audit: Build 922Z Baseline & Security Check#1
mkalhitti-cloud merged 18 commits into
fix/task-23-sima-account-syncfrom
audit/full-codebase-review

Conversation

@mkalhitti-cloud
Copy link
Copy Markdown
Owner

Comprehensive security and logic audit for the V12 strategy.
Focus areas:

  • Thread Safety & Race Conditions in SIMA fleet sync.
  • REAPER Grace Logic (Naked Audit).
  • Identity Chain restoration (GHOST-FIX).
  • Scalar quantity overflow guards.
  • Log Throttling logic.
    Perform a full sweep of the entire codebase for common NinjaTrader 8 vulnerabilities or logic leaks.

mkalhitti-cloud and others added 18 commits February 11, 2026 07:38
…o 6 focused modules

Orders.cs (2,023 lines) → Orders.Callbacks.cs + Orders.Management.cs
UI.cs (2,245 lines) → UI.IPC.cs + UI.Compliance.cs + UI.Sizing.cs + UI.Callbacks.cs

Zero logic changes — verbatim method relocation into partial class files.
All source files relocated to src/ directory. deploy-sync.ps1 updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ntryV2

ExecuteRMAEntryV2 now receives pre-calculated int contracts from the caller.
Internal CalculatePositionSize call removed; ATR stop distance retained for
bracket price computation. Defensive guard added for contracts <= 0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…Entry

ExecuteMOMOEntry now receives pre-calculated int contracts from caller.
Internal CalculatePositionSize call removed; stop distance retained for
bracket price computation. Defensive guard added for contracts <= 0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…thods

ExecuteLong, ExecuteShort, and EnterORPosition now receive pre-calculated
int contracts from caller. Internal CalculatePositionSize call removed from
EnterORPosition. Defensive guards added for contracts <= 0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… methods

ExecuteTRENDEntry and ExecuteTRENDManualEntry now receive pre-calculated
int contracts from caller. CalculateTRENDStopDistance() helper extracted
for use by UI layer callers. Defensive guards added for contracts <= 0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…y methods

ExecuteRetestEntry and ExecuteRetestManualEntry now receive pre-calculated
int contracts from caller. Defensive guards added for contracts <= 0.
CalculateRetestStopDistance() helper extracted to encapsulate the
isRetestRmaMode conditional multiplier selection for use by A7 UI layer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
UI.Callbacks.cs now computes stop distance and CalculatePositionSize before
each entry call. Chart clicks (RMA, MOMO) and hotkeys (L/S OR) all pass
pre-calculated contracts to the updated entry method signatures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
UI.IPC.cs now computes stop distance and CalculatePositionSize before every
entry call. Updated: LONG/SHORT single-account, OR_LONG/SHORT (both sync and
non-sync paths), manual TREND, manual RETEST, and auto TREND/RETEST paths in
ToggleStrategyMode. SIMA fleet RMA path was already pre-calculating via
CalculateATRStopDistance+CalculatePositionSize into ExecuteMultiAccountMarket/
ExecuteMultiAccountBracket — verified unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…d stop

Added naked position audit to AuditApexPositions(): detects any account
with actualQty != 0 but no working broker-side stop order. If naked,
queues an emergency StopMarket at MaximumStop ticks via TriggerCustomEvent.
ProcessReaperNakedStopQueue() handles submission on strategy thread.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
BUG-I2: TriggerCustomEvent for naked stop now wrapped in try/catch matching
the repair/flatten pattern (consistent with lines ~202/232).
BUG-M2: _reaperNakedStopInFlight HashSet prevents duplicate emergency stop
submissions across REAPER cycles. Guard cleared after CreateOrder (success)
or in catch (failure -> retry next cycle). All HashSet accesses lock(stateLock).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
## Core Fix (1102Z-D)
- PropagateMasterEntryMove: removed Account.Change() primary path (silent
  no-op on Apex/Tradovate). Cancel+CreateOrder+Submit is now the sole path.
- Signal name uses fresh timestamp suffix (_MGE_+ticks%10000000, max 40 chars)
  so NT8 treats resubmitted order as a new identity.
- StampReaperMoveGrace() retained before Cancel for 5-second REAPER suppression.
- Method reduced from 79 to 48 lines.

## Accumulated Phase History
- PHANTOM-FIX: stopPx=0 ghost fill bug, StopMarket effectiveEntryPrice fix,
  PropagateMasterStopMove unfilled-follower guard.
- MOVE-SYNC (1102U): object-identity order lookup, dispatch-context follower
  resolution, PropagateMasterTargetMove/StopMove/EntryMove full chain.
- Build 1102Z-B: fleetEntryName as broker Order.Name (NT8 routing collision fix).
- Phase 7.2: SIMA dispatch Stopwatch instrumentation, StringBuilder batch log.
- Phase 7.1: ANCHOR-01/02 pre-fill anchor alignment, PARITY-01 tick rounding.
- Phase 9: NULL guards S-001/002/004/015, Symmetry TOCTOU, fleet snapshot lock.
- Phase 6.2: CalculateATRStopDistance refactor, SyncPendingOrders race fix.
- Phase 6.0: T1-T5 loop unification, isFlattenRunning guards, SIMA dead code.
- Universal Ladder Convergence: single CalculateTargetPrice oracle, deleted
  TargetPricingRole enum, renamed Target1FixedPoints/Target2Multiplier.
- Phase 7 Partition: Entries.cs monolith split into 6 mode-specific nodes.
- Phase 8/8b: concurrency hardening, volatile fields, stateLock Symmetry.
- Phase 6: broker-thread marshal, expectedPositions hydration, SIMA semaphore.

## Repo Hygiene
- Added: CLAUDE.md, README.md, CODEX.md, GEMINI.md, IDE_GUIDE.md, .claudeignore
- Added: docs/audits/, docs/brain/, docs/protocol/, docs/templates/
- Added: src/Entries.FFMA.cs, src/Entries.RMA.cs (Phase 7 partition nodes)
- Removed: acli.exe, src/StressTest.cs, src/V12StandardPanel_V12_001_Dev.cs
- Removed: CONSOLIDATED_AUDIT.md, HANDOFF_PROJECT_MANAGER.md,
  PROPERTIES_AUDIT_REPORT.md (moved to docs/audits/)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
These files were moved to docs/audits/ in the previous commit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…lementing repairs from Mo-bot diagnostic session
@mkalhitti-cloud mkalhitti-cloud changed the title Audit/full codebase review Full System Audit: Build 922Z Baseline & Security Check Feb 26, 2026
@mkalhitti-cloud mkalhitti-cloud merged commit a2eafc1 into fix/task-23-sima-account-sync Feb 27, 2026
@mkalhitti-cloud mkalhitti-cloud deleted the audit/full-codebase-review branch February 27, 2026 13:55
mkalhitti-cloud added a commit that referenced this pull request Mar 1, 2026
- Add _ipcRetryCount + _lastRetryLogTime throttle fields
- ConnectToStrategy() catch: only log on attempt #1 and then
  once per 60 seconds (was logging on every 3-second retry)
- Remove per-attempt 'Auto-reconnect attempting...' print from timer
- Remove 'Auto-reconnect failed' duplicate from outer catch
- Update success messages to cleaner format with checkmark
- Retry behavior (3-second interval) unchanged

Before: ~20 log lines/minute when market closed
After:  2 log lines total (attempt #1 + one per 60 s)
mkalhitti-cloud added a commit that referenced this pull request May 20, 2026
- Add _ipcRetryCount + _lastRetryLogTime throttle fields
- ConnectToStrategy() catch: only log on attempt #1 and then
  once per 60 seconds (was logging on every 3-second retry)
- Remove per-attempt 'Auto-reconnect attempting...' print from timer
- Remove 'Auto-reconnect failed' duplicate from outer catch
- Update success messages to cleaner format with checkmark
- Retry behavior (3-second interval) unchanged

Before: ~20 log lines/minute when market closed
After:  2 log lines total (attempt #1 + one per 60 s)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant