Leverage-ladder gates require achieved leverage (all_of/greater_than conditions), not needs_attention alone

[seathatflowsinourveins]

Closes audit gap from the 2026-09-24 trading wiring audit (native-agent-stack-71).

Audit gap #5 is closed: the leverage-ladder gates no longer flip on needs_attention == 0 alone.

What changed:

• scripts/trading_gates.py: added two condition types, each with validation. greater_than compares exactly (as Decimal) and accepts a JSON number or a decimal string, because the runner writes Decimal values as strings. It rejects booleans, NaN, Infinity and anything that is not a number. all_of takes a non-empty list of equals, array_contains_id or greater_than conditions. It cannot be nested and cannot contain exists. Every condition pointer must now start with '/'.
• catalogs/us-equities/gates-20260922.json: each of the leverage-ladder-1x, 2x and 4x rows now uses an all_of with five checks:
  • /needs_attention == 0
  • /leverage/config_max_leverage == "1", "2" or "4"
  • /leverage/next_lower_rung_ceiling == "0.5", "1" or "2"
  • /leverage/peak_achieved_leverage greater than that threshold
  • /leverage/seconds_above_next_lower_rung_ceiling > 0
    Each note now sets out the rung receipt format in advance: {schema_version 1, kind leverage_ladder_rung_receipt, rung, needs_attention, leverage}, where leverage is the run's paper-output.json leverage block copied unchanged. The titles now name the threshold.
• blueprints/us-equities/adaptive-paper/leverage.py: added ONE_X_MINIMUM_EXPOSURE = 0.5. next_lower_rung_ceiling(1) now returns 0.5 instead of None, so the 1x receipt records time above 0.5x. It still returns None below 1x. The 1x config's entry budget allows up to 0.9x.
• runner.py is unchanged (same bytes), so the native-fault receipt still matches the runner.py, safety.py and transport.py hashes in source-hashes.json. Its inline comments that say the 1x threshold is None and that no gate reads these fields are now out of date. README-safety.md says so.
• Updated to match: the three rung config notes, README-safety.md (a new "Gate condition" paragraph), README.md, mover-v3/README.md, and the existing unit tests that expected None at 1x.
• source-hashes.json and manifests/evidence.json: only the entries for changed registered files were updated, programmatically. No verdict-review-gate trust input was touched.

Limits:

• These are offline unit tests on synthetic receipts and traces. No paper trial was run and no rung receipt exists.
• There is no minimum time above the threshold: any positive time passes the checker. How long a rung was actually used is left to the manual review before a dated flip commit.
• seconds_above is approximated tick by tick.

Tests. New tests:

• tests/test_trading_gates.py: greater_than on numbers and decimal strings, including booleans, NaN and Infinity; all_of passing only when every member passes; shape errors rejected. New class LeverageLadderFlipConditionTests covers three things. The repository conditions are checked. A clean trial whose peak is at or below the lower cap with no time above it does not satisfy any rung. Each required field is needed on its own: needs_attention 1, peak not above, zero time above, a missing field, a missing leverage block, the old 1x threshold of None, the wrong rung config and a boolean for seconds all fail. GOOD_RECEIPTS and BAD_RECEIPTS now include the three ladder gates.
• tests/test_adaptive_paper_runner.py: new AchievedLeverageGateTraceTests. It runs per-tick traces through runner._leverage_achievement_step with each rung's threshold, then checks the result with the repository gate rows. Traces that never go above the lower cap fail; traces that go above it pass; a peak seen only on the first tick records no time and fails.
• tests/test_adaptive_paper_leverage.py: the 1x threshold is 0.5, and every rung's threshold is below its own cap. The existing native integration test now expects next_lower_rung_ceiling "0.5" at 1x.

Results:

• Pinned paper runtime (Python 3.12.3, nautilus-trader 2.0.0rc5): test_adaptive_paper_runner, test_adaptive_paper_leverage, test_trading_gates, test_adaptive_paper_strategies and test_adaptive_paper_safety ran 293 tests, all OK, 0 skipped. This includes the native 1x/2x achieved-leverage integration tests.
• Full suite CI-style (uv run -q --no-project --python /usr/bin/python3 --with numpy --with jsonschema --with pyyaml python -m unittest): 4028 tests, OK, 415 skipped. This ran before the final doc-only edit to mover-v3/README.md and evidence.json; the validators were rerun after that edit.
• After the final edits, system python3 ran the three touched test modules: 197 tests, OK, 34 skipped (native-only).

Validation. All required validators pass (exit 0) on the final tree:

• python3 scripts/validate.py: passed, 5281 hashed files.
• python3 scripts/validate_catalogs.py: passed.
• python3 scripts/landscape.py --root .: passed.
• python3 scripts/evidence_manifest.py --check: passed.
• python3 scripts/verdict_review_gate.py --base origin/main --root .: "no verdict rows changed (base 2d11464)".
• python3 scripts/trading_gates.py --check: passed, no errors and no flip candidates. The three ladder gates show "receipt missing" and stay not_established.

All 48 entries in source-hashes.json match the files on disk (5 refreshed). runner.py, safety.py and transport.py are unchanged, so the hashes bound by the native-fault receipt still hold.

Independent review. Severities: medium, medium, low, low, low, info, info. Fix round b54ad77c64: fixed 2, rejected 0.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.