Qualify the isolated NautilusTrader rc6 runtime candidate

[seathatflowsinourveins]

Scope

Qualify the clean rc6 runtime candidate in its isolated HOME, and freeze separate
SPY runner/comparator/engine-binding copies with truthful reviewed-source
identities and explicit zero-rate MakerTakerFeeModel. The original rc5 files,
economic method and selected destination remain unchanged. The first rc6 SPY case ran once after the accepted Opus read and5f's actual
source-bound approval; replay/comparator each exited0, all136checksPASS.

• Base: ecfa112 (current origin/main).
• Lane: lane:trading only; this PR stays DRAFT.
• Source additions: run-rc6.py, compare-rc6.py, mapping-manifest-rc6.json,
  candidate history, preregistration addendum, full changed-line table and local
  fixture controls. Existing source/receipt classes remain separate.
• Registry is the FINAL commit; no runtime-target, broker/order, credentials,
  shared runtime or original preregistration changes.

Every changed runtime line and reason

File / candidate lines	Change and reason
trading-2604-runtime/pyproject.toml:13	Bind the requested vendor release 2.0.0rc6
install-trading-2604.sh:91–92	Bind the exact project/lock SHA256 values before copying
install-trading-2604.sh:99	Bind official quickstart source commit 7b766f8825b2539c5b2ac1375e9d97b41c509edb
install-trading-2604.sh:101	Match unchanged rc6 quickstart SHA 4c097d21c5501e5f0b804bca552fe25527f194cfa247e76d115fea7591d27da2
install-trading-2604.sh:164	Keep the direct dependency assertion consistent with the variant
accept-trading-2604.sh:14	Check the same official example hash
accept-trading-2604.sh:21	Check the installed rc6 distribution
uv.lock:45,57,59–77,232,234,236,704,706,708,843,849,851,1509,1511,1513–1516,2632,2689,2691,2693–2704	Native full re-resolution: engine and five transitive version/archive changes; every changed block is enumerated in changed-lines.json

All other runtime-script lines remain byte-identical to the base: HOME-derived
path, isolation, shared sync vector, Python 3.12.3, uv 0.12.17, cutoff
2026-10-06T04:00:00Z, every other direct pin, images and adapter. The project SHA
is 721c3a9e40cb2a1f5220d302fd4fad4bae9dbf83983f15bc80e4c713fbe482da;
the lock SHA is 853ad0a1ee272087bd0e79646dc1255150a6a9f0f45d0dbbf207ed084f7035b4.
Lock entries stay 188, with no additions/removals. Transitives change:
aiohttp 3.14.3→3.14.4, cachetools 7.2.0→7.2.1, filelock 4.0.10→4.0.12,
google-auth 2.59.1→2.60.0 and wcwidth 0.9.1→0.9.2.

SOTA sources

• Official rc6 release,
  nautechsystems/nautilus_trader@7b766f8825b2539c5b2ac1375e9d97b41c509edb:RELEASES.md:73,145–148,248–249,259,262.
  The published_at field is 2026-10-05T03:03:18Z; release prose instead names October 4 UTC.
• Fix ancestry to rc6
  and comparison to rc5:
  #4946 fix ed6fc8bf47fd37dda97d63b9b2df160719ee2bac is in rc6 and not rc5.
• The same rc6 pin's docs/getting_started/quickstart.py:131,221: executable
  delta is MakerTakerFeeModel plus explicit zero rates; prerequisite prose also
  narrows to Python 3.12–3.14. Use the unchanged vendor example; no rebuild or fork.
• native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60:blueprints/us-equities/runtime-2604/README.md:73–113,122–140;
  install-trading-2604.sh:91–101,164,223–231; sync-trading-2604.sh:8–21.
• uv 0.12.17 locked project workflow.
• Docker rootless client setting:
  explicit DOCKER_HOST selects the existing rootless daemon with isolated HOME.
• The base pin's docs/lanes.md:94–128, scripts/host_receipts.py:710,
  docs/acceptance-evidence-policy.md:26–33 and clean-release cooldown exception
  docs/decisions/2026-10-03-omniroute-3851-pin.md:14–17.
• J2 contract in draft #760
  at 5617096; harness/oracle files remain at ecfa112.
• MADR 4.0.0 template.

Evidence-class table

Claim	Evidence class	Boundary
Release/fix ancestry, 42 CI checks (40 success / 2 skipped), open #5007/#5057/#5060	source_review	Official metadata at pinned release; not local qualification
Lock and 12 recipe tests	local_integration / synthetic	Packaging/static contract only
Installation and 24 returned recipe rows	Actual native execution with per-check classes	Exact co-op host/runtime/input scope
Unchanged rc6 quickstart	native_proven	Synthetic upstream workflow only
Import/version/isolation/adapted smoke probes	local_integration	Not an unchanged upstream suite or risk/order qualification
Case reruns, canonical pin, C1–C4	Pending	Owner inputs/binding/route and 5f gates

Candidate source freeze: source_review;210fixture/source checks are synthetic/local_integration. No copied source ran on the native engine, and the independent review remains pending. The source receipt retains the boundary.

Local commands run

nice -n 19 mise exec uv@0.12.17 -- uv --no-config lock --project blueprints/us-equities/runtime-2604/trading-2604-runtime --python <MANAGED_CPYTHON_3_12_3> --no-python-downloads --prerelease if-necessary --default-index https://pypi.org/simple --exclude-newer 2026-10-06T04:00:00Z --upgrade
0; matching --check without --upgrade also 0
TMPDIR=<OWNED_CACHE> nice -n 19 python3 -m unittest tests.test_trading_2604_lock
0; 12 tests in 0.226s
nice -n 19 python3 scripts/validate.py
0; 69 components, 4 profiles, 213 receipts, 10279 hashes
nice -n 19 python3 scripts/component_matrix.py --write / --check
0; 32 rows, no flip violations; output unchanged
nice -n 19 python3 scripts/new_host_grand_list.py --write / --check
0; 32 layers, 66 winners; output unchanged
nice -n 19 git diff --check
0

Executor disclosure: ns2604-coop's verified NativeStack2604 session ran:

env TMPDIR=<J4_TMPDIR> nice -n 19 mise exec uv@0.12.17 -- env HOME=<J4_HOME> DOCKER_HOST=unix:///run/user/1000/docker.sock bash blueprints/us-equities/runtime-2604/install-trading-2604.sh
env TMPDIR=<J4_TMPDIR> nice -n 19 mise exec uv@0.12.17 -- env HOME=<J4_HOME> DOCKER_HOST=unix:///run/user/1000/docker.sock bash blueprints/us-equities/runtime-2604/accept-trading-2604.sh

Step	UTC start / end	Exit / result
Install	00:00:57–00:01:11 on 2026-10-06	0 / PASS
Acceptance	00:01:11–00:02:02	0 / 24 PASS, 0 FAIL, 0 BLOCKED

Before/after hashes of all four runtime inputs match. The earlier Codex-tool
attempt exited 64 before package work because WSL_DISTRO_NAME was absent. It is
retained separately; no guard bypass or self-restored distribution variable was
used. Root independently inspected the actual rc/time/status/hash files and
isolated 3.12.3/rc6 metadata. This observation is not cross-family acceptance.

Owner ruling, exact first replication and case table

The owner/co-op Q22 interpretation permits strict engine/extension/active-source
identity bindings and the explicit native MakerTakerFeeModel, with every original
and economic predicate unchanged. Opus accepted 910351f with findings 0. Its
review record SHA a59062bcea9013f3b25584adc0d11be411b4aa046f82ea08f4fa70413e84a311
was committed byte-identically at 10700d1. 5f's actual acceptance SHA
28315835b1d34da729ee0d74d051a46a3b278a8390f086226e2a85a25645b7b1 was committed
byte-identically at 057541d. Both bind exactly the same seven unchanged files.
No fake approval, smoke, dryrun, native test invocation or retry occurred.

The FIRST rc6 SPY invocation ran 06:00:00–06:00:05Z on 2026-10-06, comparator
06:00:21Z; each exit0. The final documented-env launcher-equivalent form used
nice 19, Python-I, .venv/.python/repo/dataRO, fresh namespaces, five clearenv
values and one owned output. Actual mounted checkout 9af14ec contains the
records; reviewed source identities are 910351f. Physical rc6 ABI matches the
recorded da5fd063a9f0df9f1e6d0b8dfcdfcc9d9691fe6f8d4eeb89562c96c508805178.

Case	Actual result	Scope
SPY one_zero	Replay0/comparator0; full136PASS/0FAIL/0SKIP; complete=true; candidate preregistration_qualifying=true	rc6 candidate replication of the copied method;106executionchecks are a SUBSET, not another total
AAPL baseline	BLOCKED/notrun	Retained input absent; FixedFeeModel/plan/oracles unchanged; this job runs SPY only
AAPL fee_slippage_stress	BLOCKED/notrun	Same source/input/route hold, no guessed replacement case

Observed 725 bars, 2 fills, fees 0.00, distributions 428.64, native end cash 90734.08,
matching two internal engine runs and 0 ERROR lines each. This is historical
local_integration evidence from the existing harness, not an unchanged upstream
suite, broker/risk-cap acceptance, catalog aggregate or pin promotion. Independent
review of this execution publication remains pending; 5f owns C1-C4/engine cap
and destination selection.

The publication receipt names the files that ACTUALLY ran:
evidence/receipts/nautilus-rc6-spy-first-replication-20261006.json.
Its four primary outputs under
evidence/artifacts/nautilus-rc6-qualification-20261005/spy-first-20261006
are byte-identical actual native receipt/verdict/replay stdout/comparison stdout.
They pass explicit privacy scans; raw engine/report files remain private.
The native receipt's prose still carries v2 locators, accepted by Opus; the explicit
actual-file list/vectors in the publication receipt correct that limitation
without editing any reviewed file.

The accepted addendum freezes all variant/oracle hashes and every changedline:
86 binding lines plus 156 historical source-identity lines, 242 total. The candidate
history preserves the original fullprefix and both known J2rc5fullFAILs, then
appends this actual first rc6 attempt with its complete seven-file map. It is rehashed/
registered LAST. No further replay qualifies; no retry is authorized. The
source/fixture checks below stay separate from actual native observations.

Added local verification

nice -n 19 python3 -B -m unittest tests.test_nautilus_rc6_candidate tests.test_spy_parity tests.test_nautilus_equity_replay tests.test_native_nautilus_ci tests.test_trading_2604_lock
# rc0:210tests; OK (6candidate controls +204existing source/fixtures)
nice -n 19 python3 scripts/component_matrix.py --write
# rc0:32rows,0flip violations; reports unchanged
nice -n 19 python3 scripts/new_host_grand_list.py --write
# rc0:32layers,66winners; reports unchanged
nice -n 19 python3 scripts/validate.py
# rc0:69components/4profiles/214receipts/10288hashedfiles
nice -n 19 python3 scripts/validate.py --scan-file blueprints/us-equities/engine-nautilus/spy-parity/run-rc6.py --scan-file blueprints/us-equities/engine-nautilus/spy-parity/compare-rc6.py --scan-file blueprints/us-equities/engine-nautilus/spy-parity/mapping-manifest-rc6.json --scan-file blueprints/us-equities/engine-nautilus/spy-parity/PREREGISTRATION-ADDENDUM-rc6-20261006.md --scan-file tests/test_nautilus_rc6_candidate.py --scan-file evidence/receipts/nautilus-rc6-candidate-addendum-20261006.json --scan-file evidence/artifacts/nautilus-rc6-qualification-20261005/candidate-changed-lines-20261006.json
# rc0:7explicit scans
nice -n 19 git diff --check
# rc0

Source/syntax checks confirm copied comparator functions are byte-identical
except its CLI label; candidate history preserves the complete original prefix. Local
negative fixtures show old ABI/review/approval, wrong fee descriptor and altered
price/fee/cash still fail. The first fee negative used unused fee_usd; the fixture
was corrected to fill.fee, with no production predicate/tolerance change. That
failed fixture log remains private, alongside the passing rerun. These are
synthetic/local checks, not upstream acceptance, native parity or independent
review. All future native results get a new rc6 candidate replication receipt.

Additional SOTA locators for these copies: native-agent-stack@ecfa11276:
blueprints/us-equities/engine-nautilus/spy-parity/run.py:46-48,161-166,240-273,297-343,724-725,782-804;
compare.py:74-100,263-344,692-855,1101-1118; tests/test_spy_parity.py:673-684,1093-1198
supplies reused comparator fixtures. Official fee API:
rc5 default,
rc6 Python stub
and official quickstart.
The source-freeze and line table identify pins for every change. A14's runtime
cells remain unchanged from the acceptance-passed candidate; 5f owns their pin
review and C1-C4 risk-cap/order procedure. Same-lane completeness critique is a
source-review lead only; the requested Opus read is still pending.

Decision record

docs/decisions/2026-10-06-nautilus-rc6-runtime-candidate.md remains proposed;
independent review, supplemental Python ratification and the canonical pin
decision are not inferred from 24 offline checks.

Host evidence

Sanitized receipt: evidence/receipts/nautilus-rc6-runtime-2604-20261006.json;
artifact folder evidence/artifacts/nautilus-rc6-qualification-20261005/ retains
source hashes, changed-line blocks, raw-log proof hashes and both attempts.

Checklist

• All 212 main receipt entries preserved; candidate metadata mirrors its receipt.
• Canonical target, historical evidence and three sealed harness files unchanged.
• Only A14 runtime cells changed; no rebuild/fork or rootful Docker.
• Draft, one lane label, registry-only final commit; no merge or main push.

Paper-window correction from 5f/co-op 2026-10-06T05:04:26Z: no heavy phases or
user-manager restart 10:35-13:45Z on 2026-10-06 or 19:50Z on 2026-10-06 through
00:10Z on 2026-10-07. Pause between steps; never kill a running case.
J2 evidence source: native-agent-stack@5271c87dbf8ebbc745afe3b9ee22c4d8528c4770:
blueprints/us-equities/engine-nautilus/evidence/j2-sim-rc5-20261005/spy-one_zero-launcher-equivalent-20261006T044147Z.json;
both run0/comparator1 outcomes stay unqualified, not rc6 observations.

Post-run publication checks:4raw primary privacy scans0;5published artifact/receipt
privacy scans0; registry rebuilt from currentmain and owned records; validate0
(69components/4profiles/215receipts/10295files); matrix/grand-list0/unchanged;
diffcheck0. No rerun of the case/comparator or reviewed-file modification.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[seathatflowsinourveins]

Superseded by #824 (90f9d32), amended by #847 (28af9b9). The rc6 qualification is on main, and the evidence hashes match. Closed as a legacy disposition.