IBKR acceptance recipe: pin protobuf==5.29.6 beside nautilus-ibapi 10.45.1 (vendor ib-extra pin)

[seathatflowsinourveins]

Scope

• What this PR changes:
  • The IBKR acceptance recipe, blueprints/us-equities/engine-nautilus/ibkr-acceptance/README.md, now installs protobuf==5.29.6 beside nautilus-ibapi==10.45.1 in the independent ibapi environment.
  • The README cites why.
  • The registry row is updated in the last commit (hot-file protocol).
• Base commit: cb339488e3e0 (origin/main).
• Lane: lane:trading. No probe code changes.

SOTA sources

• nautilus-ibapi 10.45.1 on PyPI (https://pypi.org/pypi/nautilus-ibapi/10.45.1/json): requires_dist is null, and the wheel METADATA has no Requires-Dist.
• The wheel's own generated code: ibapi/protobuf/*_pb2.py (203 modules). Each says "Protobuf Python Version: 5.29.5" and calls _runtime_version.ValidateProtobufRuntimeVersion(5, 29, 5, …).
• nautechsystems/nautilus_trader 1.231.0 on PyPI (https://pypi.org/pypi/nautilus_trader/1.231.0/json): the ib extra requires nautilus-ibapi==10.45.1, protobuf==5.29.6 and defusedxml<1.0.0,>=0.7.1. The vendor's pin is adopted, not a self-chosen version.

Evidence-class table

Claim	Evidence class	Command / receipt
The recipe as written cannot import ibapi	local_integration (fresh uv environment, Python 3.12)	uv pip install … nautilus-ibapi==10.45.1, then import ibapi.client: ModuleNotFoundError: No module named 'google'
The fixed recipe imports ibapi and its protobuf messages	local_integration	uv pip install … nautilus-ibapi==10.45.1 protobuf==5.29.6, then import ibapi.client, ibapi.wrapper; from ibapi.protobuf import AccountDataEnd_pb2: ok
The same pin runs the order path	native_paper (#741)	the 1.231.0 environment behind the 2026-10-05 14:26Z paper-orders pass holds protobuf 5.29.6, from the ib extra (uv pip list in that environment)
The gencode floor also runs read-only acceptance	native_paper_readonly (NativeStack2604, coordinator-relayed)	2604's passing read-only ibapi_probe environment holds nautilus-ibapi 10.45.1 plus protobuf 5.29.5 and nothing else, per each environment's own uv pip show (co-op ledger row 142915Z). Both 5.29.5 and 5.29.6 meet the floor of at least 5.29.5 that protobuf's runtime check sets for this generated code. This recipe adopts the vendor's 5.29.6.

Local commands run

$ python3 -m unittest tests.test_ibkr_acceptance   OK
$ python3 scripts/validate.py                    exit 0
$ python3 scripts/evidence_manifest.py --check   exit 0
$ git diff --check                               exit 0

Review

The command center asked for this recipe fix after NativeStack2604's read-only acceptance hit the missing dependency. A Claude session (5f) wrote it; a GPT cross-family read follows.

Checklist

• No GitHub Actions or workflow changes.
• No secrets printed, logged or committed.
• Paper only; no live endpoint, mode or key is touched.

🤖 Generated with Claude Code

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 4b9ffa31f5fc3ed5036c159fda172beaef549dce. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned FINDINGS at 1fe02660bbf8; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with no P1 item.

Observed main 13ea7f88e490188f2aa734692f1e734a81f3a861. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main 13ea7f88e490188f2aa734692f1e734a81f3a861 head 4b9ffa31f5fc3ed5036c159fda172beaef549dce base cb339488e3e004b04e8a4e5b4fd246442a275e3c merged-tree 3521748c76e5ea1d01fefb61ce6af5674dd39e40 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 2, outside PR-owned 0 []
ok   3: main drift 71 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 1, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (10172 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 3521748c76e5ea1d01fefb61ce6af5674dd39e40)

Required checks at this head: 7 pass . Unresolved review threads: 0.

macOS (advisory). The user decided on 2026-10-05 that macOS checks are advisory. Ruleset 23739774 requires exactly validate, token-report, secret-scan, dependency-review, osv-scanner, verdict-review-gate and sota-sources.

The macOS full suite has carried one failure from main since #732 (4fd7106): tests.test_runtime_worker_openhands_push_gate OwnedPathGateTests.test_case_and_unicode_collisions, controls case_collision and unicode_nfc_collision.

• Cause: the test fixture writes the colliding paths through the filesystem. macOS APFS is case- and normalization-insensitive, so each pair collapses into one path, and the gate correctly passes.
• Scope: a test-fixture defect, not a gate defect.
• Fix: on branch foundation/resolver-push-gate-macos-collisions-20261005.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 6cf063c4fd7d82e9cc56c02f29dcc68f51d40b09 (parent 13ea7f88e490188f2aa734692f1e734a81f3a861), tree 3521748c76e5ea1d01fefb61ce6af5674dd39e40. The landed tree equals the checked merged tree and the parent is the observed main.