The pre-existing guard covered only publish(). The attribute/coercion block above it
(int()/str()/.metadata.get() on intent+order) was UNGUARDED, and kwarg binding happens
before the body runs at all — so a signature skew sailed straight past a defence that
existed precisely to prevent this, and orphaned 6 live positions.
Everything that can raise now lives inside one try. Failures log loud and are swallowed;
the order path is never affected. Proven against: exploding plane, poisoned intent
coercion (the formerly-unguarded region), and absent plane.
ARCHITECTURAL DEBT (raised by HJ, not fixed here): telemetry has no business being called
inline on the exec path at all. Correct shape = fire-and-forget enqueue drained by the M6
journal lane. This commit makes it harmless, not absent.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Line 154 held mutant debris: KernelControlSnapshot(mode="live", mode="live"") — duplicate
kwarg + unterminated string. Committed since a55501b, it made the ENTIRE dita_v2 suite fail
collection, so nobody has run it. That is why no test caught the bingx_venue telemetry
signature skew that orphaned 6 live positions tonight.
The test was fantasy besides: asserted read.arming == "DARK" (no such field) and
mode == "live" (KernelMode is NORMAL|DEBUG). Rewritten to assert a real invariant —
the second write must flip the buffer and become visible.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
M5 (native_artifact.py + rust_backend build_verified_artifact/verify_artifact hooks)
existed ONLY in the uv/exec-refactor worktree. Canonical never received it, so
vendor_sync.sh downgraded the vendored copy back to a raw 'cargo build' — the same
mechanism by which M1's relock clobbered the bingx_venue telemetry fix and orphaned
6 live positions. Canonical is the source of truth; M5 belongs here.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
M1 re-vendor (89a1f1a) clobbered the T0-DEVIATION fix (20ad493): submit()/submit_async()
pass order_id=/client_order_id= post-ack, the signature dropped them. Every ENTER raised
TypeError AFTER the venue POST returned 200 OK -> rust_backend synthesised REJECTED ->
FSM rollback, while the venue kept the position. Flight-4: 8 bridged promotions, 6 orphan
SHORTs live on VST with a kernel that believes it is flat.
Two fixes:
1. signature accepts order_id/client_order_id again; snapshot prefers them (order is None
on the submit path, so the ack row is the only id source).
2. post-ack telemetry wrapped: observability can never again veto an accepted order.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Architecture: DuckDB for persistence + full in-memory materialization for reads.
All reads served from Python dicts (sub-microsecond). DuckDB only hit on writes.
Performance evolution (get_asset benchmark):
V0 (raw DuckDB): 876µs per call
V1 (LRU cache): 2.3µs per call (380x)
V2 (in-memory): 0.2µs per call (4380x)
All reads now sub-microsecond:
get_asset: 0.2µs (was 876µs)
query(blockian): 6.6µs (was 2.2ms)
query(sector): 6.6µs (was 3.2ms)
exchange lookup: 12.5µs (was 1.5ms)
full scan: 5.9µs (was 1.8ms)
behavior: 0.4µs
Write path: sync_from_profiles batch-inserts all data, then materializes
into Python dicts. Resync: 76ms (was 210ms, 2.8x faster).
Data integrity: DuckDB WAL provides crash recovery. In-memory dicts are
reconstructed from DB on every sync/close-reopen cycle. Zero data loss.
MAX_HOLD: PARITY (base 250 + 4 modulation branches + bar quantization; fallback
120 loud-only). SL: value PARITY -1.2% (catastrophic-floor override), UV strictly
tighter. TP: NOT AT PARITY — UV 0.35% vs BLUE live 0.20%, no OB modulation
(x1.40/x0.60/x0.75), no TP_FLOOR; UV trailing is a different mechanism. Tie order
divergent (BLUE TP-first, UV SL-first). Price basis+cadence divergent (OBF-mid
per-scan vs BingX-mark 1s). Remediation order proposed, no build without operator.
Real colnames (timestamp/u_prefix_client_id, anomaly_events.ts), query/VST
errors FAIL never PASS (no green-by-error), openOrders wrapper unwrap,
check(d) CH_ALLOWLIST_DBS attribution (BLUE OBF writer no longer flagged).
Maiden live runs by Fable caught all 6; PASS8 fixed same-night.
Formalizes the CEX-010 E-feed account plane (protocol + InMemoryZincPlane +
real plane). This code flew 33h on UV-PRIME flight-1 via the vendored copy
(T0-DEVIATION mid-edit vendoring) but was never committed upstream — the
2026-07-11 clean vendor_sync regressed it and broke the E-feed at boot
(AttributeError publish_account). Committing the flight-proven bytes closes
the vendor-law gap. Authorship: pre-existing WIP in /mnt working tree
(T0-era, likely codex), committed verbatim by Fable for vendor integrity.
Read-only auditor for arming-checklist §4 anomalies, the instrument for the
72h-clean finish-line clock. 5 checks against CH + VST (all read-only):
(a) venue order without matching BRIDGE exec_journal row
(b) exec_journal row without venue order
(c) venue order without 'u-' clientOrderId prefix
(d) CH write outside dolphin_uv.* in runner window
(e) tripwire_ok=false occurrences
Authored by cmd-PASS1.2 (PASS8), provenance /mnt/vp-PASS8 bf55777
(agent/oa-violetPASS8). Landed by content (cross-clone fetch hung); files
SHA256-identical to source. Fable verification: 20/20 pass; mutation litmus
RED (inverting the check-(c) prefix guard fails 6 tests incl. PASS8's own
test_c_mutation_* guards — the doctrine's litmus baked into the suite);
read-only confirmed (no writes on any path).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Per Fable #f0fb09ff090feb1f: corrected UTC boundary (gate 08:43:47 CET =
06:43:47 UTC). Re-sliced cached pull by journal_ts. Verified: era A
(incident tail 06:00-06:43:47 UTC) holds 1 of 180 BRIDGE rows (0 pairs,
NET +0.00); era B (clean/certified) holds all 75 paired trades + all 25
bridged-no-venue rows, NET -758.48. Fable's hypothesis (era A carries most
of -758) INVERTED — the full -758.48 is the certified-era number. 0 of 25
no-venue rows are incident-era; they are a clean-era reconciliation gap.
No venue re-fetch. Rollback tag rollback_pre_PASS10_audit_era_20260711190153.
Completes the trade-audit friction half omp could not reach (his sandbox
had no BingX VST DNS). Signed read-only BingX VST pulls (allOrders +
user/income) joined against dolphin_uv.exec_journal BRIDGE rows since
2026-07-10 06:00 UTC. 75 paired SHORT trades, 25 bridged-no-venue-fill gaps.
NET-of-fees P&L = -758.48 USDT (gross -565.35 - fees 198.16 + funding +5.03).
Read-only; VST sandbox only. Rollback tag in /root/violet.git.
NO content authored here — this commits the long-uncommitted LIVE hotfix from
incident 2026-06-12 (bars_held UInt16 poison jammed 18M rows 1.5d): poison rows
retried individually after CH_POISON_ATTEMPTS, then quarantined to dead_letter;
includes the ids loop-variable bugfix. Uncommitted live code was one checkout
away from loss.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Heals reverse vendor drift: the ASEx AccountProjectionV2 adapter was committed on
the vendored copy (violet.git main 824c5cf) instead of upstream, violating the
edit-upstream-then-sync doctrine. Test was orphaned on the PASS9 worktree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Upstream-canonical commit of the ~366 lines that sat uncommitted in the working
tree (surveyed in DITAV2_SOA_SURVEY_20260702). Venue telemetry published at every
venue boundary (submit/cancel/reconcile) over the zinc venue_region; SOA per
UV DITAv2 adjudication 2026-07-03.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PASS 4 completed on worktree agent/oa-violet4 (/mnt/vp-oa4). Recorded in the review queue the two
caveats the OA agent reported — also flagged in-code as prominent banner comments + empty marker
commits on that branch:
- Task 17 exec_intent: explicit reference_price required (ShadowDecision has notional, no price).
- Task 18 alpha_data_feed: parse/feed-port only, no live NT/Binance in unit code.
For Claude's later PASS-4 review (verify the caveats + non-vacuous tests).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
VIOLET_PART_SPEC_OA_TODO_PASS8.md — the V6 bible-layer remainder (ACB done; vol = PASS-4 §14;
sub-second SL guard = PASS-3 §10), six independent units extending contracts_v3 (Posture/
PostureEffect/MarasFingerprint/RegimeView/ActionCadenceDelta):
37. Regime/posture contracts (Posture literal == sizing.Posture).
38. Posture effects engine — 5-state entry-gate/flatten/size-cap, transcribed from the
orchestrator (HIBERNATE_HALT :365, STALKER 2.0 :613, TURTLE regime_dd_halt).
39. MARAS fingerprint consumer — role determined FROM CODE (modulating vs observability-only);
no invented effect.
40. Regime composite read-model (RegimeView; observability/divergence, NOT a sizing path).
41. Cadence shadow-actuation telemetry harness — evaluate-at-fastest / actuate-at-Q deltas (the
shadow evidence required before any Q loosening).
42. Posture/regime parity @gate vs BLUE (bit-identity of gating).
Framing: VIOLET CONSUMES posture/MARAS (BLUE's MHS owns them) — these units APPLY published
effects, they do not run the meta-health state machine. Faithful to the kernel; cite file:line; the
STALKER size-cap stays in sizing.py (this pass owns the entry-gate + observability).
This is the last bible-layer pass; PASS 9 (economics/observability completeness) remains. Added
PASS 8 to the review queue in VIOLET_TODO_CRITICAL.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
VIOLET_PART_SPEC_OA_TODO_PASS7.md — the V5 ladder layer as six independent units extending
contracts_v3 (AssetRank/SlotState/CapitalAllocation/SlotPolicy):
31. Selection contracts + SlotPolicy.
32. ARS ranking pipeline (faithful to AlphaAssetSelector.rank_assets + OB Sub-1 ±5/10% + IRP
alignment filter + stablecoin exclusion).
33. Multi-asset slot manager (max_slots, assignment by rank, hysteresis anti-churn, no double-occ).
34. Capital allocation across slots (BLUE notional = base_fraction × conviction × capital; no
invented normalization).
35. Selection→slot→intent multi-asset DARK flow harness.
36. Ranking bit-identity @gate vs the real AlphaAssetSelector.
NOTE (CRITICAL #1): the disappointing live parity (pick-match 1.5%, no-pick 86%, sizing near-
identical when aligned) implicates THIS selection/timing layer. PASS 7 PINS the ranking math
bit-for-bit (Task 36), which narrows the live-parity suspect to timing/join — but the
live-aggregate root-cause stays Claude's job (not this pass). Faithful to AlphaAssetSelector /
BIBLE §5; cite kernel file:line. New-file-only under selection/.
Standing ready for PASS 8–9. Added PASS 7 to the review queue in VIOLET_TODO_CRITICAL.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
VIOLET_PART_SPEC_OA_TODO_PASS6.md — the execution internals on top of PASS-5's mock, plus the
quirk-injection layer that flips PASS-5's QuirkProfile seams ON and proves each handler survives.
Six independent units extending contracts_v3 (AccountFrame/PositionFrame/ReconcileCorrection/
OwnershipPolicy):
25. Account/position frame contracts + ownership predicate (foreign-fill filter basis).
26. Fill-pump (ownership filter [quirk #2], dedup, idempotent) → ledger deltas.
27. Reconcile loop (zero-wb guard [#1], reseed-on-update, settle/funding event_seq order [#5]).
28. TTL requote / cancel-replace (+ setLeverage ordering [#7]) over PASS-5 venue + V2 driver.
29. Orphan detection (ORPHAN_VENUE adopt, ORPHAN_LOCAL quarantine — never silent flatten/resurrect).
30. Quirk-injection suite + @gate: flip every QuirkProfile flag ON, assert each is neutralized.
VIOLET's exec reconcile/quirk-handling mirrors PINK's production-tested logic (pink_direct.py is
the authoritative reference — transcribe + cite). New-file-only: quirk injection plugs into PASS-5's
existing seams via NEW fill/frame models, never editing the PASS-5 mock. Real-key boundary smoke
remains MANDATORY before V4-live (injection proves logic, not undocumented venue reality).
Standing ready for PASS 7–9. Added PASS 6 to the review queue in VIOLET_TODO_CRITICAL.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
