@reefclaw/openclaw-plugin 0.1.12 → 0.1.14

package/index.js

@@ -29,6 +29,7 @@ import { loadUserDataStreamMode, loadUserDataStreamTunables, loadUserDataStreamD
 import { TradeStoreClient } from './ingest/trade-store-client.js';
 import { ProposalManager } from './live/proposal-manager.js';
 import { ProposalDecisionListener } from './live/proposal-decision-listener.js';
+import { ApprovalListenerLifecycle } from './live/approval-lifecycle.js';
 import { PositionDecisionsClient } from './ingest/position-decisions-client.js';
 import { PositionStateStore } from './live/position-state-store.js';
 import { PendingEntryStore } from './ingest/pending-entry-metadata.js';
@@ -48,7 +49,8 @@ import { queryReviewOutcomesTool } from './tools/query-review-outcomes.js';
 import { loadPositionReviewMode } from './config/position-review-config.js';
 import { installSignalHandlers } from './lifecycle/install-signal-handlers.js';
 import { SerialTradingOperationLock } from './lifecycle/trading-operation-lock.js';
-import { readPluginConfig, readOpenClawConnection, loadStopWatcherIntervalMs } from './config/plugin-config-io.js';
+import { readPluginConfig, readOpenClawConnection, loadMicroLiveConfig, loadStopWatcherIntervalMs } from './config/plugin-config-io.js';
+import { verifyOperatorProvenance } from './config/operator-provenance.js';
 import { startConnectorSupervisor, hasBundledBridge } from './connector-supervisor.js';
 import { ToolGate } from './config/tool-gate.js';
 import { gateStore } from './config/gate-store.js';
@@ -795,6 +797,7 @@ const TOOL_PARAMS = {
     set_exchange_credentials: {
         type: 'object',
         properties: {
+            operator_token: { type: 'string', description: 'Operator provenance — injected automatically by the ReefClaw dashboard path. Agent-initiated calls are refused without it.' },
             apiKey: { type: 'string', description: 'Binance API key' },
             secret: { type: 'string', description: 'Binance API secret' },
             testnet: { type: 'boolean', description: 'Use Binance testnet (default: false)' },
@@ -804,6 +807,7 @@ const TOOL_PARAMS = {
     set_trading_mode: {
         type: 'object',
         properties: {
+            operator_token: { type: 'string', description: 'Operator provenance — injected automatically by the ReefClaw dashboard path. Agent-initiated calls are refused without it.' },
             mode: { type: 'string', enum: ['PAPER', 'MICRO_LIVE', 'LIVE'], description: 'Target trading mode' },
             acknowledged: { type: 'boolean', description: 'Required when moving to LIVE — explicit operator acknowledgment' },
         },
@@ -821,6 +825,7 @@ const TOOL_PARAMS = {
     clear_exchange_credentials: {
         type: 'object',
         properties: {
+            operator_token: { type: 'string', description: 'Operator provenance — injected automatically by the ReefClaw dashboard path. Agent-initiated calls are refused without it.' },
             confirm: { type: 'boolean', description: 'Must be true — safety gate against accidental probe wipes' },
         },
         required: ['confirm'],
@@ -832,6 +837,7 @@ const TOOL_PARAMS = {
     set_bracket_requirement: {
         type: 'object',
         properties: {
+            operator_token: { type: 'string', description: 'Operator provenance — injected automatically by the ReefClaw dashboard path. Agent-initiated calls are refused without it.' },
             flag: { type: 'string', enum: ['requireStopLoss', 'requireTakeProfit'], description: 'Which requirement to flip' },
             value: { type: 'boolean', description: 'New value. False disables the requirement and returns a warning banner copy.' },
         },
@@ -1171,23 +1177,123 @@ const paperTradingPlugin = {
         if (positionDecisionsClient) {
             logger.info(TAG, `Journal close-on-reduce-only-fill ${closeOnReduceOnlyFill ? 'ENABLED' : 'disabled'}`);
         }
-        // ---- Create exchange adapter based on trading mode ----
-        let adapter;
-        // Hoisted so the SIGTERM handler (declared after this block) can drain it
-        // on shutdown.  Only populated in live modes when dbWrite=on + env present.
+        // Reconciler-driven close-bypass cleanup, installed on EVERY live adapter —
+        // the boot one below AND every reconnect-built one (via
+        // runtime.onAdapterCreated; audit 2026-07-26 F9 — previously boot-only, so
+        // a dashboard mode/credential reconnect silently lost the journal cleanup).
+        // The reconciler emits 'drift_detected' on every poll; we filter for
+        // 'closed' drifts (position observed flat on exchange while local thinks
+        // it's open). Fires for bracket SL/TP fills, opposite-side market orders,
+        // and external closes — all paths that bypass close_position() and would
+        // otherwise leave webapp DB + state-store stale.
+        // See plugin/src/ingest/reconciler-cleanup.ts.
+        const installDriftCleanup = (a) => {
+            a.on('drift_detected', (result) => {
+                for (const drift of result.drifts) {
+                    if (drift.type !== 'closed')
+                        continue;
+                    void onReconcilerObservedClose({
+                        decisionsClient: positionDecisionsClient,
+                        stateStore: positionStateStore,
+                        userId: positionDecisionsUserId,
+                        lastPriceFn: (sym) => a.getLastPrice(sym),
+                    }, {
+                        symbol: drift.symbol,
+                        lastContracts: drift.localContracts,
+                        observedAtMs: new Date(result.timestamp).getTime(),
+                    }).catch((err) => {
+                        logger.error(TAG, `reconciler cleanup failed for ${drift.symbol}: ${formatError(err)}`);
+                    });
+                }
+            });
+        };
+        // ---- Ingest + approval wiring (audit 2026-07-26 F10: BOOT-MODE-INDEPENDENT) ----
+        // Built whenever credentials allow — NOT only on live boots. Every real
+        // trader onboards in PAPER and goes live later from the dashboard; wiring
+        // that only a live BOOT could construct silently never existed on their
+        // box (no audit-trail ingest, no approval listener), and "restart the
+        // container" is not an instruction we can hand a trader. These clients
+        // are passive until a live adapter carries them — F9's runtime wiring
+        // threads them into every adapter build, boot and reconnect alike.
         let tradeIngest;
-        // Approval-mode Phase A — set when APPROVAL_SHADOW_MODE=1 + ingest deps present.
-        // Read by the create_order tool below to dual-write proposals. See §12 of
-        // docs/APPROVAL_MODE_DESIGN.md.
+        {
+            const dbWriteMode = loadUserDataStreamDbWrite();
+            let cfgForIngest;
+            try {
+                cfgForIngest = readPluginConfig();
+            }
+            catch {
+                cfgForIngest = undefined;
+            }
+            const ingestToken = resolveIngestToken(cfgForIngest);
+            const reefclawUserId = resolveReefclawUserId();
+            // The Binance read path only runs when userDataStream.mode != 'off';
+            // the HL user stream ALWAYS runs in live (no mode ladder), so on that
+            // venue dbWrite + credentials alone decide (audit F26).
+            const wsReadPathActive = venue === 'hyperliquid' || loadUserDataStreamMode() !== 'off';
+            if (wsReadPathActive && dbWriteMode === 'on' && ingestToken && reefclawUserId) {
+                const ingestBaseUrl = getUserDataStreamIngestBaseUrl(cfgForIngest);
+                tradeIngest = {
+                    client: new TradeStoreClient({ baseUrl: ingestBaseUrl, ingestToken }),
+                    userId: reefclawUserId,
+                    // Venue-derived FillEvent.exchange — half of the audit-trail
+                    // idempotency key; sourced from fillExchangeId, never a literal.
+                    // (Reconnect builds re-stamp it from the TARGET venue — F9.)
+                    exchange: fillExchangeId(venue),
+                };
+                logger.info(TAG, `User-data stream dbWrite=on — WS audit-trail ingest wired to ${ingestBaseUrl} (userId=${reefclawUserId.slice(0, 8)}…)`);
+            }
+            else if (wsReadPathActive && dbWriteMode === 'on') {
+                logger.warn(TAG, `User-data stream dbWrite=on but ingest token (plugin-config connectionToken / WEBAPP_INGEST_TOKEN) or REEFCLAW_USER_ID missing — audit-trail ingest disabled`);
+            }
+        }
+        // Approval mode is resolved PER READ (config + env), not snapshotted at
+        // boot: a config change applies on the next create_order call and the
+        // next adapter swap — no restart (F10; see docs/CLAUDE/approval-mode.md).
+        // per_trade beats shadow when both are set (no point dual-writing shadow
+        // rows while collecting real ones). See docs/APPROVAL_MODE_DESIGN.md §12.
+        const approvalShadowEnabled = (process.env.APPROVAL_SHADOW_MODE ?? '').trim() === '1';
+        const resolveApprovalMode = () => {
+            try {
+                if (readPluginConfig().approval?.mode === 'per_trade')
+                    return 'per_trade';
+            }
+            catch { /* config unreadable — env-only fallback below */ }
+            return approvalShadowEnabled ? 'shadow' : 'off';
+        };
+        // Proposal manager + listener credentials: built whenever ingest
+        // credentials exist (passive HTTP client), so a later approval.mode or
+        // trading-mode change finds them ready instead of needing a restart.
         let proposalManagerCtx;
         let proposalListenerCredentials;
-        // Approval mode read at init from env + plugin-config.json; passed to the
-        // create_order tool so it picks the right branch (off / shadow / per_trade).
-        let approvalModeForTool = 'off';
-        // Approval-mode Phase B — listener that fires operator-approved proposals.
-        // Started below only when config.approval.mode === 'per_trade' AND we have
-        // ingest credentials. See docs/APPROVAL_MODE_DESIGN.md §2 + §7.3.
-        let proposalDecisionListener;
+        {
+            let cfgForUrl;
+            try {
+                cfgForUrl = readPluginConfig();
+            }
+            catch {
+                cfgForUrl = undefined;
+            }
+            const ingestToken = resolveIngestToken(cfgForUrl);
+            const reefclawUserId = resolveReefclawUserId();
+            const bootApprovalMode = resolveApprovalMode();
+            if (ingestToken && reefclawUserId) {
+                const ingestBaseUrl = getUserDataStreamIngestBaseUrl(cfgForUrl);
+                proposalManagerCtx = {
+                    manager: new ProposalManager({ baseUrl: ingestBaseUrl, ingestToken }),
+                    userId: reefclawUserId,
+                };
+                proposalListenerCredentials = { ingestToken, userId: reefclawUserId };
+                if (bootApprovalMode !== 'off') {
+                    logger.info(TAG, `Approval wiring active (mode=${bootApprovalMode}) → ${ingestBaseUrl} (userId=${reefclawUserId.slice(0, 8)}…)`);
+                }
+            }
+            else if (bootApprovalMode !== 'off') {
+                logger.warn(TAG, `approval mode=${bootApprovalMode} but ingest token / REEFCLAW_USER_ID missing — proposal path disabled (orders fire directly)`);
+            }
+        }
+        // ---- Create exchange adapter based on trading mode ----
+        let adapter;
         if (tradingMode === 'MICRO_LIVE' || tradingMode === 'LIVE') {
             // Per-VENUE credential presence (rehearsal find #4): this safety check
             // predated the venue seam and tested only the Binance shape, so a
@@ -1203,21 +1309,9 @@ const paperTradingPlugin = {
                 tradingMode = 'PAPER';
             }
             else {
-                // Read micro-live config
-                let microLiveConfig;
-                try {
-                    const rcConfigPath = join(homedir(), '.reefclaw', 'plugin-config.json');
-                    if (existsSync(rcConfigPath)) {
-                        const rcConfig = JSON.parse(readFileSync(rcConfigPath, 'utf-8'));
-                        if (rcConfig?.microLive) {
-                            microLiveConfig = {
-                                sizeCapPercent: rcConfig.microLive.sizeCapPercent,
-                                maxPositionUSDT: rcConfig.microLive.maxPositionUSDT,
-                            };
-                        }
-                    }
-                }
-                catch { /* already read above, best-effort */ }
+                // Micro-live cap — same loader every runtime reconnect uses
+                // (buildAdapter), so boot and reconnect can never disagree (F8).
+                const microLiveConfig = loadMicroLiveConfig();
                 // Bracket-orders feature flag read from plugin-config at construction time.
                 // Default 'off' keeps legacy stop-watcher behaviour while the feature rolls out.
                 const bracketMode = loadBracketMode();
@@ -1232,95 +1326,8 @@ const paperTradingPlugin = {
                 if (userDataStreamMode !== 'off') {
                     logger.info(TAG, `User-data stream enabled in mode=${userDataStreamMode}`);
                 }
-                // TRADE_AUDIT_TRAIL_PLAN Phase 1 — opt-in WS audit-trail ingest.
-                // Activates only when ALL of:
-                //   - userDataStream.mode != 'off'  (read path running)
-                //   - userDataStream.dbWrite = 'on' (operator opted in)
-                //   - ingest token resolvable      (plugin-config connectionToken,
-                //                                   else legacy WEBAPP_INGEST_TOKEN env)
-                //   - REEFCLAW_USER_ID env set     (trader identity)
-                // Any missing field → no ingest wired (silent dead-code default).
-                const dbWriteMode = loadUserDataStreamDbWrite();
-                let cfgForIngest;
-                try {
-                    cfgForIngest = readPluginConfig();
-                }
-                catch {
-                    cfgForIngest = undefined;
-                }
-                const ingestToken = resolveIngestToken(cfgForIngest);
-                const reefclawUserId = resolveReefclawUserId();
-                if (userDataStreamMode !== 'off' &&
-                    dbWriteMode === 'on' &&
-                    ingestToken &&
-                    reefclawUserId) {
-                    const ingestBaseUrl = getUserDataStreamIngestBaseUrl(cfgForIngest);
-                    tradeIngest = {
-                        client: new TradeStoreClient({ baseUrl: ingestBaseUrl, ingestToken }),
-                        userId: reefclawUserId,
-                        // Venue-derived FillEvent.exchange — 'binance_futures' for the
-                        // binance venue, i.e. byte-identical to the pre-venue literal
-                        // WsIngest defaulted to. Half of the (exchange, exchange_trade_id)
-                        // audit-trail idempotency key; never a fresh string literal.
-                        exchange: fillExchangeId(venue),
-                    };
-                    logger.info(TAG, `User-data stream dbWrite=on — WS audit-trail ingest wired to ${ingestBaseUrl} (userId=${reefclawUserId.slice(0, 8)}…)`);
-                }
-                else if (userDataStreamMode !== 'off' && dbWriteMode === 'on') {
-                    logger.warn(TAG, `User-data stream dbWrite=on but ingest token (plugin-config connectionToken / WEBAPP_INGEST_TOKEN) or REEFCLAW_USER_ID missing — audit-trail ingest disabled`);
-                }
-                // ---- Approval-mode wiring ----
-                // Two switches gate proposal-related behaviour:
-                //
-                //   1. config approval.mode='per_trade'  → THE feature. create_order
-                //      returns pending_approval (does NOT fire). ProposalDecisionListener
-                //      polls /pending-decisions and fires when the operator approves.
-                //
-                //   2. env APPROVAL_SHADOW_MODE=1        → Phase A telemetry only.
-                //      create_order dual-writes a shadow proposal row AND fires the
-                //      real order. Used to collect proposal-shape distribution before
-                //      flipping per_trade. Retired once per_trade has soaked.
-                //
-                // If both are set, per_trade wins — no point dual-writing shadow rows
-                // when we're collecting real ones. The ProposalManager itself is the
-                // same instance either way; `origin` on each insert distinguishes them.
-                //
-                // See docs/APPROVAL_MODE_DESIGN.md §12.
-                const approvalShadowEnabled = (process.env.APPROVAL_SHADOW_MODE ?? '').trim() === '1';
-                try {
-                    const cfg = readPluginConfig();
-                    if (cfg.approval?.mode === 'per_trade') {
-                        approvalModeForTool = 'per_trade';
-                    }
-                    else if (approvalShadowEnabled) {
-                        approvalModeForTool = 'shadow';
-                    }
-                }
-                catch {
-                    // Config read failed; fall back to env-only.
-                    if (approvalShadowEnabled)
-                        approvalModeForTool = 'shadow';
-                }
-                if (approvalModeForTool !== 'off' && ingestToken && reefclawUserId) {
-                    let cfgForUrl;
-                    try {
-                        cfgForUrl = readPluginConfig();
-                    }
-                    catch {
-                        cfgForUrl = undefined;
-                    }
-                    const ingestBaseUrl = getUserDataStreamIngestBaseUrl(cfgForUrl);
-                    proposalManagerCtx = {
-                        manager: new ProposalManager({ baseUrl: ingestBaseUrl, ingestToken }),
-                        userId: reefclawUserId,
-                    };
-                    proposalListenerCredentials = { ingestToken, userId: reefclawUserId };
-                    logger.info(TAG, `Approval wiring active (mode=${approvalModeForTool}) → ${ingestBaseUrl} (userId=${reefclawUserId.slice(0, 8)}…)`);
-                }
-                else if (approvalModeForTool !== 'off') {
-                    logger.warn(TAG, `approval mode=${approvalModeForTool} but WEBAPP_INGEST_TOKEN or REEFCLAW_USER_ID env missing — proposal path disabled`);
-                    approvalModeForTool = 'off';
-                }
+                // (Ingest + approval wiring is hoisted above the mode branch — F10:
+                // it must exist on PAPER boots too, so a runtime live-flip finds it.)
                 // Venue-dispatched construction (multi-venue Phase 0). For 'binance'
                 // this is a pure pass-through to `new LiveAdapter(...)` — identical
                 // args, identical behavior; the unsupported-venue arm is unreachable
@@ -1334,6 +1341,10 @@ const paperTradingPlugin = {
                             credentials: hlCredentials,
                             mode: tradingMode,
                             marketSlippagePct: readPluginConfig().hl?.marketSlippagePct,
+                            microLive: microLiveConfig,
+                            // F26: same wiring object as the Binance arm — the SIGTERM
+                            // drain covers both venues because it drains this client.
+                            tradeIngest,
                         },
                     }
                     : {
@@ -1350,31 +1361,9 @@ const paperTradingPlugin = {
                         ],
                     });
                 adapter = liveAdapter;
-                // Reconciler-driven close-bypass cleanup. The reconciler emits
-                // 'drift_detected' on every poll; we filter for 'closed' drifts
-                // (position observed flat on exchange while local thinks it's open).
-                // Fires for bracket SL/TP fills, opposite-side market orders, and
-                // external closes — all paths that bypass close_position() and
-                // would otherwise leave webapp DB + state-store stale.
-                // See plugin/src/ingest/reconciler-cleanup.ts.
-                liveAdapter.on('drift_detected', (result) => {
-                    for (const drift of result.drifts) {
-                        if (drift.type !== 'closed')
-                            continue;
-                        void onReconcilerObservedClose({
-                            decisionsClient: positionDecisionsClient,
-                            stateStore: positionStateStore,
-                            userId: positionDecisionsUserId,
-                            lastPriceFn: (sym) => liveAdapter.getLastPrice(sym),
-                        }, {
-                            symbol: drift.symbol,
-                            lastContracts: drift.localContracts,
-                            observedAtMs: new Date(result.timestamp).getTime(),
-                        }).catch((err) => {
-                            logger.error(TAG, `reconciler cleanup failed for ${drift.symbol}: ${formatError(err)}`);
-                        });
-                    }
-                });
+                // Journal close-bypass cleanup — shared installer (see its definition
+                // above; the runtime re-installs it on every reconnect-built adapter).
+                installDriftCleanup(liveAdapter);
                 // Post-registration async init (fire-and-forget — register must be sync)
                 liveAdapter.initialize().then(async () => {
                     // After init, run a one-shot startup reconciliation between
@@ -1556,6 +1545,24 @@ const paperTradingPlugin = {
             });
         };
         wireWatcherJournalCapture(bootstrapWatcher);
+        // Journal capture for the paper take-profit leg. Same contract as the
+        // watcher wiring above: a target close bypasses close_position, so without
+        // this it would leave a phantom-open journal row (the issue #199 class).
+        // Wired once — the simulator instance outlives adapter swaps (every
+        // PaperAdapter is constructed around this same object), unlike watchers.
+        simulator.on('target_closed', (ev) => {
+            onStopWatcherClose(autoCapture, {
+                symbol: ev.symbol,
+                leg: 'exchange_target',
+                // The breached level and the price that breached it — the assessment
+                // records both, so a gap past the target stays visible in the journal.
+                stopPrice: ev.targetPrice,
+                markPrice: ev.markPrice,
+                order: ev.order,
+            }).catch((err) => {
+                logger.warn(TAG, `take-profit close capture failed: ${formatError(err)}`);
+            });
+        });
         const runtime = new PluginRuntime({
             adapter,
             mode: tradingMode,
@@ -1564,6 +1571,16 @@ const paperTradingPlugin = {
             marketFeed,
             operationLock: wave9OperationLock,
             onWatcherCreated: wireWatcherJournalCapture,
+            // F9: reconnect-built adapters get the SAME boot wiring — drift-cleanup
+            // listener + audit-trail ingest client + journal auto-capture — instead
+            // of silently reverting to bare adapters until the next restart.
+            onAdapterCreated: installDriftCleanup,
+            liveWiring: {
+                tradeIngestBase: tradeIngest
+                    ? { client: tradeIngest.client, userId: tradeIngest.userId }
+                    : undefined,
+                autoCapture,
+            },
         });
         // Periodic DB-vs-exchange sweep (issues #199/#203): the boot-only reconcile
         // left phantom-open journal rows alive for days between restarts. Runs for
@@ -1798,40 +1815,43 @@ const paperTradingPlugin = {
         // If the ledger failed to load, Wave 9 admission is disabled and generic
         // watcher behavior still starts normally here.
         bootstrapWatcher.start();
-        // Start the approved-order listener only after runtime, the shared
-        // mutation lock, and durable Wave 9 ownership state are fully resolved.
-        if (runtime.adapter.isLive
-            && approvalModeForTool === 'per_trade'
-            && proposalManagerCtx
-            && proposalListenerCredentials) {
-            try {
-                const approvalCfg = readPluginConfig().approval;
+        // Approved-order listener lifecycle (F10): follows ADAPTER SWAPS, not boot
+        // state. A PAPER-boot box that goes live from the dashboard starts the
+        // listener at the flip; a live→PAPER flip stops it (previously it stayed
+        // wired to the ORPHANED live adapter — an operator approval would have
+        // fired a real exchange order while the dashboard said PAPER); a
+        // credential swap rebinds it to the fresh adapter. Started only after
+        // runtime, the shared mutation lock, and durable Wave 9 ownership state
+        // are fully resolved — same ordering the boot-only version had.
+        const approvalLifecycle = new ApprovalListenerLifecycle({
+            resolveApprovalMode,
+            hasWiring: () => proposalManagerCtx !== undefined && proposalListenerCredentials !== undefined,
+            buildListener: (boundAdapter) => {
+                let approvalCfg;
                 let cfgForUrl;
                 try {
                     cfgForUrl = readPluginConfig();
+                    approvalCfg = cfgForUrl.approval;
                 }
                 catch {
                     cfgForUrl = undefined;
                 }
-                const ingestBaseUrl = getUserDataStreamIngestBaseUrl(cfgForUrl);
-                proposalDecisionListener = new ProposalDecisionListener({
-                    baseUrl: ingestBaseUrl,
+                return new ProposalDecisionListener({
+                    baseUrl: getUserDataStreamIngestBaseUrl(cfgForUrl),
                     ingestToken: proposalListenerCredentials.ingestToken,
                     userId: proposalListenerCredentials.userId,
-                    adapter: runtime.adapter,
+                    adapter: boundAdapter,
                     binanceApi,
                     autoCapture,
                     operationLock: wave9OperationLock,
                     checkWave9LiveSymbolOwnership,
                     pollIntervalMs: approvalCfg?.pollIntervalMs ?? 3_000,
                 });
-                proposalDecisionListener.start();
-                logger.info(TAG, `ProposalDecisionListener started (poll ${approvalCfg?.pollIntervalMs ?? 3_000} ms)`);
-            }
-            catch (err) {
-                logger.warn(TAG, `Failed to start ProposalDecisionListener: ${String(err)}`);
-            }
-        }
+            },
+        });
+        runtime.setOnAdapterSwapped((a) => { void approvalLifecycle.onAdapterSwapped(a); });
+        // Boot application — the same path every later swap takes.
+        void approvalLifecycle.onAdapterSwapped(runtime.adapter);
         const wave9ActivationClient = new IntelWave9ActivationClient(intelApiDeps);
         const getWave9AccountSnapshot = async () => {
             if (!runtime.adapter.isLive) {
@@ -2040,7 +2060,7 @@ const paperTradingPlugin = {
         installSignalHandlers({
             runtime,
             tradeStore: tradeIngest?.client,
-            proposalListener: proposalDecisionListener,
+            proposalListener: approvalLifecycle,
             stateManager,
         });
         // Warm the trading params cache (fire-and-forget — register must be sync)
@@ -2137,7 +2157,10 @@ const paperTradingPlugin = {
                     autoCapture,
                     proposalManager: proposalManagerCtx?.manager,
                     userId: proposalManagerCtx?.userId,
-                    approvalMode: approvalModeForTool,
+                    // Per-call read (F10): a config approval.mode change applies on
+                    // the NEXT create_order, not the next restart. The deps literal
+                    // is rebuilt per execute, so this re-resolves every call.
+                    approvalMode: resolveApprovalMode(),
                     wave9AdmissionGuard,
                     wave9ActivationCheck: () => wave9ActivationClient.getActivation(),
                     refreshPaperState: reloadState,
@@ -2615,16 +2638,26 @@ const paperTradingPlugin = {
             {
                 name: 'set_exchange_credentials',
                 label: 'Set Exchange Credentials',
-                description: 'Operator-only. Store Binance API key + secret in ~/.reefclaw/plugin-config.json. If current mode is live, reconnects the adapter. Never called by the agent.',
+                description: 'Operator-only. Store Binance API key + secret in ~/.reefclaw/plugin-config.json. If current mode is live, reconnects the adapter. Refused without dashboard operator provenance.',
                 parameters: TOOL_PARAMS.set_exchange_credentials,
-                execute: async (_id, params) => jsonResult(await setExchangeCredentialsTool(params, { runtime, adapterDeps })),
+                execute: async (_id, params) => {
+                    const prov = verifyOperatorProvenance(params.operator_token);
+                    if (!prov.ok)
+                        return jsonResult({ error: prov.error });
+                    return jsonResult(await setExchangeCredentialsTool(params, { runtime, adapterDeps }));
+                },
             },
             {
                 name: 'set_trading_mode',
                 label: 'Set Trading Mode',
-                description: 'Operator-only. Move the plugin between PAPER / MICRO_LIVE / LIVE. Enforces the one-rung-at-a-time ladder. Never called by the agent.',
+                description: 'Operator-only. Move the plugin between PAPER / MICRO_LIVE / LIVE. Enforces the one-rung-at-a-time ladder. Refused without dashboard operator provenance.',
                 parameters: TOOL_PARAMS.set_trading_mode,
-                execute: async (_id, params) => jsonResult(await setTradingModeTool(params, { runtime, adapterDeps })),
+                execute: async (_id, params) => {
+                    const prov = verifyOperatorProvenance(params.operator_token);
+                    if (!prov.ok)
+                        return jsonResult({ error: prov.error });
+                    return jsonResult(await setTradingModeTool(params, { runtime, adapterDeps }));
+                },
             },
             {
                 name: 'test_exchange_credentials',
@@ -2636,9 +2669,14 @@ const paperTradingPlugin = {
             {
                 name: 'clear_exchange_credentials',
                 label: 'Clear Exchange Credentials',
-                description: 'Operator-only. Remove stored Binance credentials from plugin-config.json and de-escalate to PAPER mode if currently running in MICRO_LIVE/LIVE. Requires {confirm: true}. Never called by the agent.',
+                description: 'Operator-only. Remove stored Binance credentials from plugin-config.json and de-escalate to PAPER mode if currently running in MICRO_LIVE/LIVE. Requires {confirm: true}. Refused without dashboard operator provenance.',
                 parameters: TOOL_PARAMS.clear_exchange_credentials,
-                execute: async (_id, params) => jsonResult(await clearExchangeCredentialsTool(params, { runtime, adapterDeps })),
+                execute: async (_id, params) => {
+                    const prov = verifyOperatorProvenance(params.operator_token);
+                    if (!prov.ok)
+                        return jsonResult({ error: prov.error });
+                    return jsonResult(await clearExchangeCredentialsTool(params, { runtime, adapterDeps }));
+                },
             },
             {
                 name: 'get_bracket_config',
@@ -2650,9 +2688,14 @@ const paperTradingPlugin = {
             {
                 name: 'set_bracket_requirement',
                 label: 'Set Bracket Requirement',
-                description: 'Operator-only. Flip requireStopLoss or requireTakeProfit in plugin-config. Returns a warning copy when a flag is disabled so the dashboard can render the confirmation banner. Never called by the agent.',
+                description: 'Operator-only. Flip requireStopLoss or requireTakeProfit in plugin-config. Returns a warning copy when a flag is disabled so the dashboard can render the confirmation banner. Refused without dashboard operator provenance.',
                 parameters: TOOL_PARAMS.set_bracket_requirement,
-                execute: async (_id, params) => jsonResult(setBracketRequirementTool(params)),
+                execute: async (_id, params) => {
+                    const prov = verifyOperatorProvenance(params.operator_token);
+                    if (!prov.ok)
+                        return jsonResult({ error: prov.error });
+                    return jsonResult(setBracketRequirementTool(params));
+                },
             },
         ];
         // ---- Tool gate (central per-user config, slice 1) ----

package/ingest/event-loop-monitor.d.ts

@@ -0,0 +1,11 @@
+/** Start sampling. Safe to call repeatedly (idempotent). */
+export declare function startEventLoopMonitor(): void;
+/** Worst event-loop delay (ms) observed since the previous call, then reset —
+ *  so consecutive calls partition the timeline into non-overlapping windows.
+ *  Returns null when the monitor is unavailable or has no sample yet.
+ *
+ *  The histogram stores nanoseconds; `max` is Infinity-safe but can read as a
+ *  sentinel before the first sample lands, so anything non-finite → null. */
+export declare function sampleEventLoopDelayMs(): number | null;
+/** Test-only — drop the singleton so a fresh histogram is created. */
+export declare function __resetEventLoopMonitorForTests(): void;