Record the 2026-09-24 trading-star refresh: 15 new stars and 6 re-reviews in the star audit

[seathatflowsinourveins]

Scope

• What this PR changes: it records the 2026-09-24 trading-star review in the star audit and coverage. The 15 stars missing from the 2026-09-19 audit (357 now, no removals, all public) are added as pinned source_review entries. Six earlier targeted_candidate entries are updated in place from their re-review. The decision index, manifest counts and evidence manifest are regenerated to match.
• Base commit: cbbd589
• Lane: lane:shared. star-audit.json, star-audit.md, coverage.json and decision-index.json are foundation files under a trading path (see docs/lanes.md in Document interim foundation/trading lane ownership (docs/lanes.md) #180), so both lanes must acknowledge before merge.
• Paths touched:
  • Trading: catalogs/us-equities/manifest.json, catalogs/us-equities/README.md and the new receipt catalogs/us-equities/star-refresh-20260924.json.
  • Foundation files under the trading path: star-audit.json, star-audit.md, coverage.json and decision-index.json.
  • Foundation: blueprints/token-native-focus/saturation-audit.json (four count lines) and the root README.md (three numbers).
  • Shared hot file: manifests/evidence.json, in the last commit only.
  • blueprints/us-equities/adaptive-paper/** (Mover mode's first Alpaca paper runs on the Mac (trials A and C) and the partial-fill precision fix #205) is not touched.

What the review decided

Group	Result
15 new stars	4 already_covered (LEAN, vectorbt, alpaca-py, FinRL-Trading), 2 alternative, 4 outside_north_star, 2 obsolete_or_ineligible, 1 overlaps_established, 1 targeted_candidate (trycua/cua, the lume-only trial from agent-ecosystem PR #30) and 1 reject_security_risk
6 re-reviewed candidates	atilaahmettaner/tradingview-mcp becomes obsolete_or_ineligible and pydantic/pydantic becomes overlaps_established. whchien/ai-trader, HKUDS/Vibe-Trading, tradermonty/claude-trading-skills and shiyu-coder/Kronos stay targeted_candidate. Each entry keeps its earlier decision in limitations, for example "2026-09-19 audit decision: targeted_candidate at ; re-reviewed 2026-09-24 at ".
Security	MIgHTy-alIeN/ai-trader-bot is a fund-draining contract pattern. star-audit.md cites every finding with a line link at db429bd.
alpaca-py	0.44.0 is already the latest release on GitHub and PyPI, and its tag resolves to the reviewed cc4cb3b. No bump is needed.
Boundary	Nothing was installed, cloned, built, deployed or executed. README text was treated as data.

The four already-catalogued repositories move from beyond_stars to stars as catalog_reviewed: 46 starred catalog repositories (was 42) and 102 beyond-star (was 106). The decision index grows from 844 to 850 identities: 357 starred and 493 beyond.

Date scoping

scripts/validate_catalogs.py requires the checked_at of the star audit and of coverage to equal the catalog manifest's. That same date also binds the four catalog files and models.json, which this refresh did not re-check. So all JSON headers keep 2026-09-19, and no unrelated catalog file changes date. The refresh time (2026-09-24T17:33:14Z) is recorded in:

• latest_public_refresh.checked_at_utc in both files;
• the new receipt;
• the new method.date_scope note;
• each entry's source pin and date.

How the review files were folded in

• Extra fields. latest_release, acceptance_case, wiring_verdict, wiring_notes, order_authority, data_rights, bump and security_findings have no counterpart in the entry schema. They are folded into limitations with fixed prefixes, such as Wiring verdict (2026-09-24):, Proposed acceptance case (2026-09-24, not run): and Security finding, <file> <lines> (<pinned URL>):.
• Prospective workflows. prospective_workflow and workflow_scope stay only where the pinned example still applies: ai-trader and Kronos (same commit, still targeted). They are dropped for Vibe-Trading (new commit) and for tradingview-mcp and pydantic (no longer targeted).
• New decision value. reject_security_risk is defined in method.decision_meanings.
• Starred timestamps. Per-repository starred_at values are not published, because method.private_handling excludes the star timeline.

Corrections to the inputs, found while verifying pinned sources

• ai-trader-bot: the review listed owner() as a missing function. It exists: address public owner at contract.sol line 76 generates it. The finding now names only withdrawETH(), getOwner() and TARGET_ADDRESS(). depositEth() and emergencyWithdrawAll() appear only in the NOTICE comment, so they are "not defined" rather than absent. withdraw() "can send any amount, up to the full balance", not "sends the full balance". I re-read every other cited line at db429bd as text, and each matches.
• pydantic: the re-review labelled its depth readme_license_overview at 0384c970, but read no pydantic file there. I read README.md and LICENSE (MIT) at that commit, so the label now holds. The review's pointer to "the existing … card in star-audit.json" no longer holds after an in-place update, so it now points to the retained 2026-09-19 line.
• alpaca-py: the review gave catalog_entry_ids: ["alpaca-py"], but the repository also backs data-alpaca-py. The validator requires both.
• Evidence refs: refs like catalogs/...json (id: ...) are not paths, so they became plain paths. Pseudo-paths (GitHub Releases, PyPI JSON, the PR Wire the order-contract boundary into every Alpaca paper submit (local refusal before any network call) #198 view) moved from reviewed_files into limitations and evidence_refs.
• rqalpha: the licensor's Chinese name is written as "Ricequant" to keep the JSON ASCII.
• trycua/cua: agent-ecosystem is a private repository, and this repository is public. Its PR ci: bump actions/setup-go from 6.4.0 to 7.0.0 #30 is named in prose but not linked from evidence_refs, because the link returns 404 for public readers. The public catalogs/landscape/upstream-snapshot.json is the resolvable reference. The other 92 pinned URLs in the new entries and section all return HTTP 200.

A fix outside the listed files

tests/test_stack_lifecycle.py failed after the index grew (AssertionError: 844 != 850). It ties saturation-audit.json counts.catalog_identities to the decision index. No precedence rule reproduces the recorded identity groups, which are a retained reconciliation. So, as PR-4 did, the six identities that are new to the union enter the star_review group (275 → 281). The totals become 850 identities and 781 non-selected. The test is unchanged.

Evidence-class table

Claim	Evidence class	Command / receipt
357 starred repositories: the 342 prior identities plus 15 additions, with 0 removals and 0 duplicates	metadata_only	The coordinating session's snapshot of authenticated GET /user/starred (star+json). Receipt: catalogs/us-equities/star-refresh-20260924.json (identity sha256 5bfcd767…).
All 15 additions are public, unarchived and starred by the viewer, so no private star is excluded	metadata_only	One gh api graphql query of isPrivate, isArchived, viewerHasStarred and databaseId: private 0, archived 0, not starred 0
20 decisions at pinned commits (14 new, 6 re-reviewed)	source_review	Coordinator review files G1–G4. The files read are listed per entry in star-audit.json.
trycua/cua is a targeted_candidate for the lume-only trial, with no trading role	source_review	gh api repos/trycua/cua/commits/HEAD → 210efbce. README.md and LICENSE.md (MIT) read at that commit. agent-ecosystem PR #30 (merged, private repository) and its coordinator-decision-2026-09-24.json. catalogs/landscape/upstream-snapshot.json.
ai-trader-bot fund-draining pattern (README lines 19-20, 30, 46, 48, 54, 56, 64 and 71; contract.sol lines 40-44 and 189-197)	source_review	The pinned files at db429bd were read as text only, never compiled or run. gh api .../commits shows "Update LICENSE" commits about twice a minute.
alpaca-py 0.44.0 is the latest release, so no bump	metadata_only	gh api repos/alpacahq/alpaca-py/releases/latest → v0.44.0 (2026-08-11). PyPI info.version 0.44.0. Tag v0.44.0 → cc4cb3b.
pydantic's targeted role is covered by NAS's own order contract	source_review	order_contract.py on main has no pydantic import. gh api .../pulls/198/files shows that #198 (still open) adds build_envelope() and no pydantic import.
Catalog joins, counts, decision index and evidence hashes are consistent	local_integration	The validators under "Local commands run"
Nothing was installed or executed	boundary statement	Only gh api/curl reads of pinned files and metadata were used. No install, clone, build or run command.

Local commands run

$ python3 scripts/validate_catalogs.py
exit 0  {"beyond_star_catalog_repositories": 102, "models": 20, "public_stars": 357, "repository_entries": 154, "starred_catalog_repositories": 46, "unique_catalog_repositories": 148}
$ python3 scripts/validate.py
exit 0  {"components": 69, "hashed_files": 5304, "profiles": 4, "receipts": 145, "status": "passed"}
$ python3 scripts/evidence_manifest.py --check
exit 0  {"files": 5304, "status": "passed"}
$ python3 scripts/catalog_decisions.py --check
exit 0  repositories 850, public_star_repositories 357, beyond_public_stars 493, references 1999
$ python3 -m unittest tests.test_catalogs tests.test_catalog_decisions
exit 0  Ran 61 tests, OK
$ python3 -m unittest tests.test_convergence_contract tests.test_ecosystem_manifest tests.test_foundation_catalog tests.test_sota_convergence tests.test_stack_lifecycle tests.test_verdict_review_gate
exit 0  Ran 413 tests, OK   (before the saturation-audit fix: 1 failure, test_stack_lifecycle 844 != 850)
$ python3 scripts/component_matrix.py --check ; python3 scripts/new_host_grand_list.py --check
exit 0 ; exit 0   (--write regenerated both reports with no change)
$ python3 scripts/host_receipts.py validate ; python3 scripts/validate_foundation.py --root . --json ; python3 scripts/landscape.py --root .
exit 0 ; exit 0 (errors []) ; exit 0 (research_repositories 850)
$ python3 blueprints/blind-catalog-convergence/audit_reports.py --check ; python3 scripts/validate_convergence.py --all-recorded --root . --json
exit 0 ; exit 0
$ python3 tools/sota-convergence/build_verdicts.py --check ; python3 tools/sota-convergence/gap_crosswalk.py build --check
exit 0 ; exit 0
$ python3 tools/sota-convergence/gap_wave_ledger.py --wave gap-wave2-20260923 --wave gap-wave3-20260923 --owner gap-resolution --check
exit 0
$ python3 scripts/build_ecosystem.py --check ; python3 scripts/verdict_review_gate.py --root . --base origin/main
exit 0 ; exit 0 (no verdict rows changed)
$ python3 -m unittest   # full suite at head 1908c2c (also run at 642aabb, with the same result)
exit 1  Ran 4336 tests: failures=63, errors=40, skipped=522
        The same 103 test IDs fail at base cbbd589 (diffed), all in test_codex_lane, test_adjudicate,
        test_offhost_app_state, test_adoption_bootstrap_macos, test_order_throughput,
        test_adaptive_paper_metrics, test_research_workflow and test_native_maintenance. Causes: sandbox
        'Operation not permitted' and the sandbox's credentialed HTTPS_PROXY. None reads a changed file.

Decision record

There is no docs/decisions/ record. Each decision, with its overturn case, is in its star-audit.json entry: a proposed acceptance case in limitations, not run.

Left open

• The root README's "147 unique repositories in 152 layer decision cards" was already stale before this PR; the manifest says 148 in 154. It is left for its owner.
• The landscape freshness snapshot (foundation-owned, 2026-09-21) still reports 343 current stars and is not refreshed here.
• No proposed acceptance case (ai-trader, Vibe-Trading, claude-trading-skills, Kronos or the cua lume trial) was run.

Checklist

• No GitHub Actions or workflows changed.
• No secrets printed, logged or committed. The gitleaks pre-commit hook found no leaks on each commit.
• No paid hosting, subscription or billing surface was introduced.
• Peer-owned files and worktrees were preserved. Only this branch's worktree was edited.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seathatflowsinourveins]

Acknowledgement requested from both lanes (lane:shared). Foundation: the only foundation-owned edits are count updates in the root README (342→357 stars, 844→850 identities) and blueprints/token-native-focus/saturation-audit.json (catalog_identities 850, star_review 281), which keep test_stack_lifecycle consistent. Trading: catalog decisions for 15 new stars and 6 re-reviewed candidates; notably MIgHTy-alIeN/ai-trader-bot is reject_security_risk and tradingview-mcp is now obsolete_or_ineligible. Nothing was installed or executed. Not merging without both acknowledgements. (mac-coordinator)

[seathatflowsinourveins]

Foundation lane ack (lane:shared). I reviewed the foundation-owned hunks: README.md (342 to 357 stars; 844 to 850 identities, 493 beyond the stars) and blueprints/token-native-focus/saturation-audit.json (catalog_identities 850, nonselected 775 to 781, star_review 275 to 281, plus the scope sentence). They are count updates only and consistent with each other: 357 + 493 = 850, and the six new identities appear once in both the non-selected and star-review tallies. The star-audit files under catalogs/us-equities are foundation-owned per the interim lanes doc (#180), and pinned source reviews with nothing installed or executed are fine by the foundation lane. OK to merge with --match-head-commit once CI is green.