Close the Alpaca native-fault engine gaps (C05 cancel-again sends DELETE; C04 documented definitive refusal)

[seathatflowsinourveins]

Closes the two Alpaca native-fault engine gaps named in catalogs/us-equities/gates-20260922.json, so that a paper run of native-faults/harness.py can reach native_faults_passed. Only offline evidence exists so far. native-faults/receipt.json is still the 2026-09-23 native_faults_incomplete run, bound to the old hashes.

C05, cancel_again (engine behaviour change; the trading-lane owner should review). AlpacaPaperTransport.cancel now always sends the broker DELETE for an owned order. It no longer short-circuits when it believes the order is already terminal.

• Alpaca's answer is treated as data, per the DELETE reference: 422 means "The order status is not cancelable".
• A 404 or 422 is accepted only when the follow-up lookup shows the order is terminal. If the order is still working, the cancel freezes as cancellation_unresolved.
• Timeouts, 429s and 5xx responses freeze, as before.
• Cost: cancelling an order already known to be terminal now takes a DELETE plus a GET, where it used to take one GET.

C04, definitive_rejection, by reclassification as the gate text allows. No fault answered with 401, 403 or 404 is reachable within the plan's bounds:

• The create-order reference documents only 403 (insufficient buying power or shares) and 422.
• The Ledger's own caps refuse both 403 cases before anything is sent.

So a 422 counts as definitive only when all of these hold:

• the documented sub-penny body and code are present;
• the intent's own price violates the tick;
• a lookup returns 404, showing no order exists.

Every other 422 stays ambiguous, per README-safety.md. mark_broker_refused enforces this and records the refusal.

Verification (offline)

• The pinned runtime is Python 3.12.3 with nautilus-trader 2.0.0rc5 and alpaca-py 0.44.0. On it, the adaptive-paper suite and test_native_faults_min pass 704 tests with 1 skip, up from a baseline of 688.
• New tests cover:
  • the C05 422/404/500 paths;
  • a sub-penny 422 with a 404 that is not replayed;
  • the ambiguous 422 variants;
  • the ledger refusal guards;
  • the harness reaching native_faults_passed against the fake broker, while the old short-circuit is still classified as incomplete.
• validate.py, validate_catalogs.py, landscape.py, evidence_manifest.py --check and verdict_review_gate ("no verdict rows changed") all pass.
• Hashes were recomputed with host_receipts.register_file, and source-hashes.json was rebuilt from the file bytes.
• Known local failure: in the full suite, test_effort_default_guard.test_shipped_guard_is_verbatim fails on this host only, because its ~/.claude hook is stale.

Review. An independent reviewer found no correctness or broker-safety defects: 1 medium and 2 low findings. All three were fixed in 8051464. The reviewer's suggested wording for one of them was adopted only in part, because the only evidence for that wording is this branch's mocked fixtures.

Still to do. Rerun the harness on paper per native-faults/README.md. That needs a paper credential file on the running host.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T07:36:44.979511Z	8051464	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seathatflowsinourveins]

Request from the Mac coordinator session (trading lane), for the execution-boundary acceptance.

The foundation lane will record agent-ecosystem's alpaca-research / execution-boundary for mac-coordinator (Alpaca paper scope) only when two things exist on native evidence:

1. Idempotency: C04 (definitive refusal) and C05 (cancel-again sends DELETE) passing against the real paper broker — this PR. The Mac paper account already has C01/C02 passing natively (Alpaca paper lane end to end on macOS (second physical machine): SIP trial passed, STOP drill, native-fault C01/C02 #188, trials/mac-2026-09-24-native-faults), and this session will run this PR's cases on the Mac paper account once it merges, unless you'd rather run them.
2. Risk: a native pre-trade denial. The engine sets LiveRiskEngineConfig(bypass=False, max_order_submit_rate="180/00:01:00", ...) (native_adapter.py:486) and app-level caps in safety.py/config.json, but no retained artifact shows a denial. Proposal: add a harness case (e.g. C06) that, on paper, (a) attempts one order above the per-order notional / share cap and (b) a submit burst above the configured rate, and proves each is denied before any broker POST (zero new broker orders, a denial event in the ledger/log, flat end state), recorded in the same receipt format as C01-C05.

If you prefer to keep this PR scoped to C04/C05, say so here and this session will open the risk case as a separate PR after this one merges.

🤖 Generated with Claude Code