hjnormey/siloqy
Public Access
1
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

PINK: E2E trace analysis — Pass 14 serde edges/backup diffs/market data (Q1-Q12)

Browse Source 
Fourteenth pass: fromisoformat can't parse Rust Z-suffix timestamps on Python
< 3.11 — crashes every timestamp deserialization (Q1/Q6/Q12 High), MarketSnapshot
timestamp type inconsistent float vs datetime in same file (Q5 High), no
#[serde(deny_unknown_fields)] — misspelled fields silently default (Q2 Medium),
no upper-bound price validation (Q7 Medium), threading.Event.wait uses platform-
dependent clock NTP jump risk (Q10 Medium). Backup diff reveals 6 critical bug
fixes between backup and current. 275 total flaws across 14 passes.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
This commit is contained in:
Codex
2026-06-02 12:00:22 +02:00
parent b922f5ff1c
commit 062b929caf
2 changed files with 261 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
PINK_DITAv2_FLAW_ANALYSIS_2026-05-31.md
View File

@@ -28,7 +28,8 @@
| N | Pass 11 (Async/Sync Seams/Locks/Threading) | 10 | 4 | 1 | 3 | 1 | 1 |
| O | Pass 12 (Sync/Async Wider Scope) | 11 | 0 | 3 | 7 | 1 | 0 |
| P | Pass 13 (FFI Safety/Dangling Pointers/Coverage) | 9 | 1 | 3 | 3 | 1 | 1 |
| **Total** | | **263** | **21** | **73** | **76** | **64** | **29** |
| Q | Pass 14 (Serde Edges/Backup Diffs/Market Data) | 12 | 0 | 4 | 3 | 2 | 3 |
| **Total** | | **275** | **21** | **77** | **79** | **64** | **34** |
---
@@ -366,6 +367,27 @@
---
## Q-Series: Serde Edges, Backup Diffs, Market Data/Timestamps (Pass 14)
*Full detail in TRACE doc under "PASS 14 — SERDE EDGE CASES, BACKUP DIFFS, MARKET DATA/TIMESTAMPS."*
| # | Flaw | Layer | Severity |
|---|------|-------|----------|
| Q1 | `fromisoformat()` can't parse Rust `Z` suffix on Python < 3.11 | Bridge | **High** |
| Q2 | No `#[serde(deny_unknown_fields)]` — misspelled fields silently default | Rust | Medium |
| Q3 | `indexmap` new dependency in current code | Rust | Info |
| Q4 | Backup diff: 6 critical bug fixes between backup and current | Rust | Info |
| Q5 | `MarketSnapshot.timestamp` type inconsistent — float vs datetime in same file | Data Feed | **High** |
| Q6 | `fromisoformat()` Z-suffix fail on all 5 timestamp deserialization sites | Bridge | **High** |
| Q7 | No upper-bound price validation — 1e300 passes all guards | Bridge | Medium |
| Q8 | `_first_invalid_intent_field` does not reject zero/negative price or zero size | Bridge | Low |
| Q9 | Rust/Python clock sources diverge — transition timestamps mixed source | Rust | Low |
| Q10 | `threading.Event.wait()` uses platform-dependent clock — NTP jump risk | Venue | Medium |
| Q11 | Backup had no STALE_STATE_RECONCILING guard in on_venue_event (info) | Rust | Info |
| Q12 | All 5 fromisoformat() sites fail on Python < 3.11 (duplicate of Q1) | Bridge | **High** |
---
## H-Series: Edge Domains — Dependencies, Error Handling, Types, Contracts (Pass 5)
*Full detail in TRACE doc under "PASS 5 — EDGE DOMAINS."*