Add deterministic offline journal for IBKR paper acceptance

[seathatflowsinourveins]

Scope

Add a durable offline journal for IBKR paper acceptance, with explicit identity,
integer quote clocks, decimal cash/fees, request reserves and restart reconciliation.
Unknown fees, conflicting broker observations and uncertain submissions halt
admission. Native IBKR order admission remains held by the selected rc5 adapter's
unresolved identity, commission-finality and recovery-completeness contract.

• Base: dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e; reviewed head: 0d423ee3bfe7cb6be237291e8eb4196cf19078cc.
• Lane: lane:trading.
• Owned paths: engine-nautilus/ibkr-native-paper/state.py, its offline-FREEZE.md, and tests/test_ibkr_native_paper.py.
• This draft adds no broker connection, native transport, credential handling, runtime change, scheduled writer or manifest change.

SOTA sources

• Selected NautilusTrader 2.0.0rc5, commit 1b0a49d2792a9432a3aca3fcb617ce7a630d905e: native execution/report trait and IBKR event normalization. These identify required future native observations; no native integration is claimed here.
• Repository acceptance contract, Section 4, with the fixture's exact limits frozen in the added offline-FREEZE.md.
• Selected existing ledger reference: account mutex, durable journal and deterministic request/risk state.
• SQLite's maintained WAL contract and transaction contract; Python 3.13's decimal, fcntl and unittest result callbacks.

Evidence-class table

Claim	Evidence class	Retained evidence
49 offline cases pass with zero failures/errors/skips	synthetic / local_integration	fix1-green-20-native-rc5.json, SHA256 abe30b82262e0dc2e294a95b36da9b17efdc9dc871b7a42bf2051e78a3c477e0; fake broker observations derive independently from transport/injected facts, not journal values
Source repair accepted after five Important findings and two result-reporting defects	source_review	Independent Astra/max reviewed the complete original-base diff and repair, plus retained red/green evidence; no reviewer rerun
Repository integrity/scope validation passes	local_integration	Actual exit0, components69 / hashed_files9409 / profiles4 / receipts187; this checker does not qualify broker behavior
Native broker qualification	unproved	No broker request/order/recovery ran; Python and Rust source reviews retain the full-contract rc5 HOLD

All twenty repair attempts and the original ten-attempt history remain private and
retained, including failed fixtures and the intentionally rejected required-skip
child. A report appendix corrects two overstatements: the backoff case has no
restart; rejection recovery reaches ready=true without a subsequent submission.

Local commands run

rtk proxy python3 -m unittest discover -s tests -p test_ibkr_native_paper.py
exit 0; 49 tests; OK

rtk proxy python3 scripts/validate.py
exit 0; components69 / hashed_files9409 / profiles4 / receipts187

rtk git diff --check
exit 0

The dedicated evidence-producing suite also ran with the installed selected-rc5
Python runtime, using --evidence-dir and --attempt; that environment label does
not convert synthetic cases into native acceptance. Passing source inputs are
unchanged since these retained runs.

Decision record

Private coordination records: CODEX-IBKR-RC5-NATIVE-PLAN-20261003.md, its Task1
report/review, CODEX-IBKR-RC5-EVENT-CONTRACT-20261003.md and
CODEX-IBKR-RC5-RUST-CONTRACT-20261003.md. The full native recovery gate remains
unmet. Reconsider it only against supported primary-source evidence and an
independently frozen native trial; this draft cannot waive it.

Checklist

• No credential values, raw account identifiers or private host configuration are committed.
• No paid hosting or new billing surface.
• Peer-owned files and worktrees preserved.
• Historical freezes and failed attempts retained.
• Source review and synthetic evidence remain separate from paper qualification.

Custody review and repairs, 2026-10-04

• A Claude Opus cross-family read at bdf795e6 returned ACCEPT with eight P2s.
• GPT-6.1 Sol repair 643-p2:
  • Decimal conversion errors become Refused;
  • money arithmetic runs under an explicit decimal context;
  • stop() is ordered;
  • fresh-journal refusal tests assert every binding reason, including the live ports 127.0.0.1:4001 and :7496 and broker ALPACA;
  • branch tests are added;
  • the FREEZE dependencies are stated.
    An Opus delta read returned ACCEPT with two P2s.
• GPT-6.1 Sol repair 643-p3:
  • guards the booking arithmetic (risk latch, SELL loss quantization, quantity times price) inside the refusal path, which latches invalid_execution_economics;
  • adds the existing-position plus 5e25-fill, SELL-overflow and product-overflow tests;
  • makes the identity-contradiction test assert the reconcile reasons.
    Red against the unrepaired state: 65 tests, 3 errors. Final: 65 tests, OK, 0 skips, run directly without RTK. An Opus delta read returned ACCEPT.
• The registry is in the last commit. The PR's three owned files are registered.

Recorded residuals. Both are pre-existing, outside this repair's Decimal scope, and need absurd inputs:

1. A final commission between about 9.22e16 and 1e26 USD passes cents() but overflows SQLite's int64 binding. The OverflowError rolls back the transaction without a block.
2. A venue_order_id, order_id or perm_id longer than CPython's 4,300-digit integer conversion limit raises ValueError before the identity checks.
   Both fail without booking anything. A follow-up converts them to Refused with bounded magnitudes and lengths. Neither is reachable from the IBKR paper adapter's normal values.

[seathatflowsinourveins]

IBKR PR #643 required-skip test portability correction

2026-10-03T07:51Z. Retain the hosted failure at run 37105561915, validate job, head 0d423ee: 9871 tests, one error, 967 skips. The failing owned test was StateCases.test_acceptance_cli_rejects_required_skipped_case. It embedded the host's RTK wrapper in a Python subprocess invocation; RTK is not a dependency of this repository's CI.

Correction to prior passing local evidence: the local host's installed wrapper masked this test portability defect. The earlier 49 passing offline cases retain their original scope and do not establish wrapper-independent execution.

Before changing the source, the native command rtk proxy env PATH=/usr/bin:/bin /usr/bin/python3 -m unittest tests.test_ibkr_native_paper.StateCases.test_acceptance_cli_rejects_required_skipped_case reproduced exit 1, one error, with the returned diagnostic:

FileNotFoundError: [Errno 2] No such file or directory: 'rtk'
Ran 1 test in 0.065s
FAILED (errors=1)

Owned correction: remove rtk proxy from the program's argument list and directly invoke sys.executable. Shell tool commands continue to use RTK. Python 3.12's supported subprocess.run API is the primary upstream reference; this launches the existing Python child with the same arguments, output capture and required-skip assertions. It changes no production journal, acceptance condition, broker callback or paper source.

Post-repair native verification with PATH restricted to /usr/bin:/bin: the targeted test passed (one test, exit 0), then the supported acceptance CLI passed all 49 offline cases with zero errors/failures/skips and zero broker network calls. Actual returned CLI summary: Ran 49 tests in 3.720s, OK, exit 0. The newly retained artifact ibkr-rtk-portability-evidence/rtk-absent-repair-20261003T0753Z.json is 796781 bytes, SHA256 6057ff7f39dabe8d68beb6ef6988c76696d4bf681dd6ba2d7cc2e3d6e2db9b78.

Its deliberate required-skip child still records one test, one skip, exit 1 and blocked_required_skips; its artifact SHA256 is 76307a07273e4405f1174524dc3d46318b77609a49d5f03531fc9e1ab2a75869. Thus the repaired parent still verifies refusal of required skipped acceptance. This child is part of the 49 parent cases, not an additional passing qualification.

The repaired test module is 54652 bytes, SHA256 3fea5c00ceb7a696bf721d53fa2d2a314d264bb28fd00b37d43949fb8b582c33. The source diff is one invocation line. Native python3 scripts/validate.py returned exit 0: 69 components, 9409 hashed files, four profiles, 187 receipts; integrity/scope only. Publication and fresh hosted checks remain pending. No independent reviewer rerun or paper result is claimed.

Published replacement head bdf795e to the existing draft PR #643. Native pre-push lockfile inventory, blueprint classification and workflow coverage checks all passed (three tests, exit 0), and push returned exit 0. The exact repaired invocation retains every acceptance assertion. Production Task1 source and frozen offline plan are unchanged. Fresh hosted checks govern this new head; the original hosted failure remains recorded. No CI bypass, required-check weakening, manifest edit, broker request or qualification promotion occurred.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T19:15:18.347571Z	bdf795e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bdf795e672

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 01a8c597cacab18d3628f58a75068ade5a602e30. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at bdf795e6723f; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with no P1 item.

Observed main dd6972824bca625394ba01ef421023f935ed222c. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main dd6972824bca625394ba01ef421023f935ed222c head 01a8c597cacab18d3628f58a75068ade5a602e30 base dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e merged-tree 9ff6b698d2379119544284005e81803465a07197 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 4, outside PR-owned 0 []
ok   3: main drift 820 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 3, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9985 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 9ff6b698d2379119544284005e81803465a07197)

Required checks at this head: 8 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 43005a9f86ae6e5fcf0e4774ccf0cc3e7135e1d3 (parent dd6972824bca625394ba01ef421023f935ed222c), tree 9ff6b698d2379119544284005e81803465a07197. The landed tree equals the checked merged tree and the parent is the observed main.