IBKR paper orders on the destination engine: NautilusTrader 2.0.0rc5 C1-C4 passed (runner around upstream exec_tester; runner-enforced notional bound, #4946)

[seathatflowsinourveins]

Scope

• What this PR changes: a bounded IBKR paper C1-C4 order trial on the selected destination engine, NautilusTrader 2.0.0rc5, through its own IB adapter. It lives at blueprints/us-equities/engine-nautilus/ibkr-paper-orders-rc5/, and contains:
  • run.py, a thin runner around upstream's examples/live/interactive_brokers/exec_tester.py, with safety.py (account lease and order journal), plan.json, the README and its tests;
  • three retained native run receipts: the passing run 3 and two earlier failed attempts;
  • the archived harness bytes for every receipt, so that each harness_sha256 resolves: evidence/harness/run.py.{188e0078fc8f,67429251370f,5a061ff06f41} (r2, r3, r4);
  • the #4946 entry and re-run trigger in catalogs/us-equities/runtime-target.json;
  • the registry, in the last commit (hot-file protocol).
• Merge of main ecfa11276: the registry united at the entry level, six alpaca-py pin_source citations remapped in the Foundation catalog (158 → 159, after this PR's #4946 entry shifted the line), and the new-WSL handbook regenerated.
• Base: main ecfa112764c664d35377dd66b8cfcb67e5a94d60. Head: 3e23f71abf3ae29c63483ef35c8506b8347e2c56.
• Lane: lane:shared. The merge edits a Foundation-owned catalog (docs/lanes.md:24,145-150), so it needs both the trading and the Foundation acknowledgement.

SOTA sources

• nautechsystems/nautilus_trader v2.0.0rc5 (commit 1b0a49d2):
  • examples/live/interactive_brokers/exec_tester.py and _common.py;
  • the built-in ExecTester (nautilus_trader.testkit.ExecTesterConfig);
  • nautilus_trader.live.LiveNode;
  • the IB data and execution client factories.
• Source reads at the tag:
  • crates/risk/src/engine/mod.rs L1203-1233 against L1597-1603: the notional check is skipped when account_for_venue(SMART) is None;
  • crates/adapters/interactive_brokers/src/execution/core_orders.rs L32-47: post-only orders are denied;
  • crates/live/src/python/node.rs L912: the cache is a live view;
  • crates/model/src/orders/market.rs L108 and L533-558: a materialized external order is rebuilt with reconciliation=false.
• nautilus_trader#4946: closed. Its fix ed6fc8bf4 is in v2.0.0rc6 (published 2026-10-05), not in rc5.
• The official IB TWS API Python client 10.45.1 (PyPI nautilus-ibapi), with protobuf 5.29.6, provides the client-92 pre-check, quote admission and flat proof.
• The NMS Limit Up-Limit Down plan's Tier 1 price bands, for the admission stress and the closing-period cutoff.

Deviations from upstream's example (all in the README)

• Risk engine. It stays ON with a USD 1,000 per-order cap, though that cap is not enforced on this route (#4946). The bound is held by:
  • qty=1;
  • quote admission at ask × 1.05 + 10 ≤ 1000, so 942.85 admits and 942.86 refuses (not requested at all on a preliminary refusal);
  • a round-trip bound of spread + 2.04 ≤ 5 USD (two per-order commission allowances plus a USD 0.02 margin each);
  • no run whose order and close window reaches the closing period, which starts at the liquid session end minus 25 minutes, so the latest start is 15:29 ET on a normal day and 12:29 ET on a 13:00 close.
• Post-only off. rc5's IB adapter denies post-only orders.
• Resting limit at half the admitted bid. A fill there would be a failed case, and close-on-stop stays at one share.
• Stop and cancels. Orders are cancelled individually on stop. The stop is deferred while an own order is in flight, which now counts from OrderInitialized.
• Ownership. Cases are mapped only from this run's own orders, by generated identity or by submission. An own order that later receives a reconciliation event stays owned, and its cases fail. Only orders this run does not own go to reconciled_external.
• Account lease. An exclusive host-local flock lease, keyed by account hash, runs from before the pre-check through the flat proof. It is cooperative: it excludes only runs that use the same lock path. The receipt records only acquired.
• Order journal. An append-only, fsync'd private journal, refused if it already exists for the run id. Residual: no durable intent before the venue send, because rc5's Python surface exposes no pre-send hook.
• Refusals before admission never overwrite an existing receipt; they are created only if absent.
• The parent keeps the child's evidence only when the per-run nonce matches.
• TWS_ACCOUNT is required, and private output must sit outside the repository.

Evidence-class table

Claim	Evidence class	Receipt
Run 3 (r4 harness 5a061ff06f41): C1-C4 passed; net −2.04 USD; flat 0/0	native_paper	evidence/receipt-20261005-passed.json (18:55:11-18:56:01Z, exit 0)
Run 2 (r3 harness): reconciled same-day 1.231 fills tripped the case mapping; no order sent; flat	native_paper (failed, retained)	evidence/receipt-20261005-run2-failed.json
Run 1 (r2 harness): quote admission, in a separate client-92 session, reached its 30 s deadline; no node, no order	native_paper (not_connected, retained)	evidence/receipt-20261005-run1-not-connected.json
The runner at head (run.py af6c817e7393…, rounds r5-r8)	offline tests only; no native run yet	tests/test_ibkr_paper_orders_rc5.py (91 tests)
Acceptance steps 3-4 (reconnect with an open order, restart reconciliation, kill switch)	not exercised	blocked upstream (#5007, #5057, #5060)

Local commands run (at 3e23f71abf3ae29c63483ef35c8506b8347e2c56)

$ <rc5 venv>/bin/python -m unittest tests.test_ibkr_paper_orders_rc5        OK (91), no skips
$ python3 -m unittest tests.test_architecture_pin_source tests.test_catalogs \
    tests.test_new_wsl_handbook tests.test_stack_lifecycle                   OK
$ python3 scripts/validate.py                                                exit 0
$ python3 scripts/evidence_manifest.py --check                               exit 0
$ python3 scripts/build_new_wsl_handbook.py --check                          exit 0
$ git diff --check                                                           exit 0

Review

• Build. GPT-6.1 Sol built it through the packaged SDK worker, in rounds r1-r8. The coordinator (Claude session 5f) committed each round and ran the native trial.
• Cross-family reads:
  • Claude Opus, per round:
    • r1 FINDINGS: 1 P1 and 9 P2.
    • r2 to r4: ACCEPT with P2s, each fixed in the next round.
    • r5 FINDINGS: P1 (a reversible account hash in the receipt) plus 4 P2.
    • r6 ACCEPT, with 4 P3s fixed in r7.
    • The full-scope read at 7ee79f24f found FINDINGS:
      • P1: the r4 harness was not archived; it is now archived.
      • P2: the current runner's lack of a native run was not disclosed; it now is.
      • P2: the lane label; now lane:shared.
      • 3 code P3s, fixed in r8 (early-close cutoff, null quote evidence on refusal, robust receipt adoption).
  • GPT-6.1 Sol reads of r1 and r2.
• Review threads. The five chatgpt-codex-connector threads are answered: four fixed in r5-r6, and one outdated.

Recorded residuals

• No pre-venue journal barrier. rc5's Python surface exposes no pre-send hook (upstream's native BusTap is not exposed).
• Host-local, cooperative lease. The frozen 1.231 harness does not take it.
• The LULD stress is a bound, not a guarantee, against trading pauses and reopen auctions.
• Acceptance steps 3-4 remain blocked upstream, and the current runner has no native run. The next native run qualifies it.

Checklist

• No GitHub Actions or workflow changes.
• No secrets printed, logged or committed. The receipts carry no account id or hash of one. The unredacted Nautilus console stays private.
• Paper only. No live endpoint, mode or key is touched.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T19:08:10.671605Z	5207cfb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5207cfba6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".