Reconcile trading records with merged evidence (runtime-target, snapshot gate, dashboard, new-host EdgarTools receipt)

[seathatflowsinourveins]

Closes audit gap from the 2026-09-24 trading wiring audit (native-agent-stack-71).

This commit only updates records. No gate status changed: trading_gates.py lists no flip candidates.

(a) catalogs/us-equities/runtime-target.json:

• retained-equity-replay now reads status spy_lean_parity_passed_one_zero_case, and executed_evidence_ref points at blueprints/us-equities/engine-nautilus/spy-parity/verdict-v2.json (PASS, 136 checks, 0 failed, 0 skipped, preregistration_qualifying true). The scope text lists the limits: the six v2 replays that ran before review, one case only, and an open-fill proxy that is not a general market-on-open equivalent. The old summary.json#/rows/6 is kept as earlier_evidence_ref.
• adaptive_practice gains native_paper_capacity plus an evidence path to order-throughput/evidence/index-20260924.json: 180 actions/min in 5 full windows, 496 submits and 496 cancels, 0 HTTP 429, clean reconciliation, at the observed 200/min limit. It is labelled as reported by the harness itself; the independent listing matched the order counts only. 1000/min was not measured. native_synthetic_capacity is kept.
• The separate-paper-adapters scope now points at broker-state-failures for native faults and at the measured 200/min for throughput.
• broker-state-failures already matched native-fault-behaviour being established.
• The engines-strategies card (json and md) said runtime-target still records the BLOCKED status. My change would have made that false, so I rewrote it: parity is now established, and the old status is kept as history. The test-required phrases are kept.

(b) snapshot-promotion-gate, in catalogs/us-equities/gates-20260922.json and blueprints/us-equities/data/README.md:

• The gate was already established and is not a flip candidate, so status, evidence_class (synthetic) and receipt_path are unchanged. Only the note and the README changed.
• Both now cite trials/20260923g-main-passed/ingest-receipt.json and gate-result.json from ingest_snapshot.py (Add the real promotion-gate snapshot ingest and a bounded scheduled paper trial #84): 480 rows, 12 of 12 checks pass, input_sha256 equals snapshot_sha256, and the paper command then passed.
• The limits are stated: the snapshot CSV was not kept, the gate that ran was the promotion_gate.py from 843dc8f (its bytes differ from the current file), and this is not the full production ingest.

(c) observability/grand-dashboard/state.json:

• recorded_at_utc is updated.
• alpaca-paper-operational: native fault gate established 2026-09-24, covering definitive rejection and repeat cancel only.
• alpaca-paper-rate: shows the capacity result, and evidence_ref now points to the order-throughput index.
• The emitter snapshot() accepts both rows.
• Secret-storage practice: per-host 0600 store, agent read guard hook + deny rules, managed-profile install, names-only checker #182 (secret storage) is not a lane and has no dashboard entry, so nothing was added.
• Not touched, though now stale: the macos gate still says "target host pending" after macOS arm64 SYN evidence for the adaptive-paper engine and mover trial mode #176 and Alpaca paper lane end to end on macOS (second physical machine): SIP trial passed, STOP drill, native-fault C01/C02 #188.

(d) New file blueprints/us-equities/catalyst-provenance/new-host-native-network-20260924.json, registered in manifests/evidence.json receipts[] as native-sec-new-host-20260924 (kind native_cli_e2e, with a host_scope saying it does not replace the 2026-09-19 receipt). access-resolution.md gets a short new-host section.

• I read the private output in full before copying. It has no '@', no host path and no contact text.
• It does contain identity_sha256, an unsalted SHA-256 of the contact. Anyone with a guessed contact could confirm it against that hash, and the 2026-09-19 precedent never published one, so I left it out of the committed copy. The receipt records the original's sha256 (ed92e340…) and the committed copy's hash.
• Checked: cohort 371, and the five selected CIK/accession rows equal the 2026-09-19 raw headers. The installed runtime's packages exactly match requirements.lock, checked when the receipt was written.
• Stated as limits: the command line was not kept, and I don't claim a second physical machine.
• It is not a host_receipts.py receipt, because that recorder reruns its commands. I added the id to manifests/stack.json edgartools evidence_ids, but test_stack_lifecycle then needs blueprints/token-native-focus/saturation-audit.json to match, so I reverted that. The receipt is not linked from the component.

manifests/evidence.json was updated in code (ensure_ascii=False). Only the changed files' hashes and the one new receipt entry changed.

Tests. Full suite, run like CI: uv run -q --no-project --python 3.12 --with numpy --with jsonschema --with pyyaml python -m unittest. Result: 4018 tests, OK, 415 skipped, 0 failures.

An earlier run had 1 failure (test_stack_lifecycle, caused by the stack.json evidence_ids edit). I reverted that edit and the rerun passed.

These are this repository's own tests and checks, not unchanged upstream tests. No broker, SEC or model call was made in this session.

Validation. Every check below exited 0 on the final tree:

• scripts/validate.py: passed, 144 receipts, 5282 hashed files
• scripts/validate_catalogs.py
• scripts/landscape.py --root .
• scripts/evidence_manifest.py --check
• scripts/verdict_review_gate.py --base origin/main --root .: no verdict rows changed
• scripts/trading_gates.py --check: passed, 0 flip candidates, sim and paper ready
• scripts/host_receipts.py validate
• scripts/build_ecosystem.py --check

These also passed, all exit 0, on the tree before the stack.json revert:

• scripts/component_matrix.py --check
• scripts/new_host_grand_list.py --check
• tools/sota-convergence/build_verdicts.py --check
• tools/sota-convergence/gap_crosswalk.py build --check
• blueprints/blind-catalog-convergence/audit_reports.py --check
• scripts/validate_foundation.py
• scripts/release_due.py --strict-if-repinned origin/main

gitleaks dir on the new receipt: no leaks. No independent review was run; that is still needed before merge.

Independent review. Severities: medium, low, low, low, low, info, info, info. Fix round 031de300: fixed 1, rejected 0.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.