@reefclaw/openclaw-plugin 0.1.13 → 0.1.15

package/bridge/bridge.d.ts

@@ -66,11 +66,26 @@ export declare class Bridge {
     private stopThrottleTimer;
     private handleRequest;
     private handleStateChange;
-    /** Today every authenticated session carries operator.write via the
-     *  relay-level Clerk token. This method exists as the enforcement seam —
-     *  a future PR can drop per-session roles in here without restructuring
-     *  the dispatcher. Returning true keeps current behavior identical. */
-    private hasOperatorWriteScope;
+    /** Whether operator-write methods are allowed for the current session mix.
+     *
+     *  This is NOT a per-frame credential check, and does not claim to be. The
+     *  real authorization boundary for operator-write methods is layered
+     *  OUTSIDE this method:
+     *    1. Transport: every frame reaching handleRequest arrives over the relay
+     *       connection, which authenticated the per-user rc_ token against the
+     *       user-bound relay room before any frame flows (relay/src/auth.ts).
+     *       There is no other ingress to this dispatcher.
+     *    2. State-mutating tools: the plugin independently refuses
+     *       set_trading_mode / set_exchange_credentials /
+     *       clear_exchange_credentials / set_bracket_requirement /
+     *       test_exchange_credentials without the `operator_token` provenance
+     *       proof (audit F12) — a compromised bridge still cannot flip trading
+     *       state.
+     *  While every relay session is an operator session by construction, this
+     *  returns true; it is the seam where per-session roles attach if a
+     *  non-operator ingress is ever added, without restructuring the
+     *  dispatcher. */
+    private operatorWriteAllowed;
     /** Handle a set_trading_mode request. Returns 'responded' if the handler
      *  already wrote the response frame (e.g. on validation failure), otherwise
      *  returns the structured outcome for the caller to wrap in a success

package/bridge/bridge.js

@@ -326,15 +326,15 @@ export class Bridge {
     async handleRequest(frame) {
         const { id, method, params } = frame;
         try {
-            // ---- Operator-write scope gate ----
-            // Methods in OPERATOR_WRITE_METHODS require an elevated scope. Today,
-            // all connected sessions inherit operator.write from the relay-level
-            // authentication (Clerk-issued token), so this check is effectively a
-            // whitelist — it exists so a future PR can attach per-session roles
-            // without restructuring the dispatcher. Emergency methods are on the
-            // list for the same reason (they are already covered today, but the
-            // list is the forward-compatible gate).
-            if (OPERATOR_WRITE_METHODS.has(method) && !this.hasOperatorWriteScope()) {
+            // ---- Operator-write gate ----
+            // Methods in OPERATOR_WRITE_METHODS are dashboard-operator actions. The
+            // enforcement is layered and documented on operatorWriteAllowed():
+            // transport auth at the relay (token↔room binding — the only ingress to
+            // this dispatcher) + plugin-side operator_token provenance on every
+            // state-mutating tool. This branch is the forward-compatible seam for
+            // per-session roles; it does not itself verify credentials. Emergency
+            // methods are on the list for the same forward-compatibility reason.
+            if (OPERATOR_WRITE_METHODS.has(method) && !this.operatorWriteAllowed()) {
                 audit('operator_write.denied', { method, id });
                 this.connector.sendResponse(id, false, undefined, {
                     code: 403,
@@ -578,11 +578,26 @@ export class Bridge {
         logger.info(TAG, `Connector state: ${state}`);
     }
     // ---- Operator onboarding (PR2) ----
-    /** Today every authenticated session carries operator.write via the
-     *  relay-level Clerk token. This method exists as the enforcement seam —
-     *  a future PR can drop per-session roles in here without restructuring
-     *  the dispatcher. Returning true keeps current behavior identical. */
-    hasOperatorWriteScope() {
+    /** Whether operator-write methods are allowed for the current session mix.
+     *
+     *  This is NOT a per-frame credential check, and does not claim to be. The
+     *  real authorization boundary for operator-write methods is layered
+     *  OUTSIDE this method:
+     *    1. Transport: every frame reaching handleRequest arrives over the relay
+     *       connection, which authenticated the per-user rc_ token against the
+     *       user-bound relay room before any frame flows (relay/src/auth.ts).
+     *       There is no other ingress to this dispatcher.
+     *    2. State-mutating tools: the plugin independently refuses
+     *       set_trading_mode / set_exchange_credentials /
+     *       clear_exchange_credentials / set_bracket_requirement /
+     *       test_exchange_credentials without the `operator_token` provenance
+     *       proof (audit F12) — a compromised bridge still cannot flip trading
+     *       state.
+     *  While every relay session is an operator session by construction, this
+     *  returns true; it is the seam where per-session roles attach if a
+     *  non-operator ingress is ever added, without restructuring the
+     *  dispatcher. */
+    operatorWriteAllowed() {
         return true;
     }
     /** Handle a set_trading_mode request. Returns 'responded' if the handler

package/bridge/config.js

@@ -11,6 +11,12 @@ const OPENCLAW_DIR = join(homedir(), '.openclaw');
 const CONFIG_PATH = join(OPENCLAW_DIR, 'openclaw.json');
 const DEFAULT_RELAY_URL = 'wss://reefclaw.radunlupsa.partykit.dev';
 // ---- Read/write OpenClaw config ----
+//
+// Scope contract: these helpers touch ONLY the ReefClaw skill entry
+// (skills.entries.reefclaw.config — the token/userId/relayUrl the USER pasted
+// during onboarding) and preserve every other key verbatim. They exist so the
+// connector can pick up a connection the user saved via chat and persist it
+// across restarts — not to manage OpenClaw's own configuration.
 /** Read the OpenClaw config file and extract ReefClaw skill settings.
  *  Prefers the schema-valid nested shape (entry.config.*), falls back to the
  *  legacy flat shape per-field. */

package/bridge/gateway/gateway-config.d.ts

@@ -1,3 +1,4 @@
+import { type VenueId } from '@reefclaw/shared';
 export interface GatewayConfig {
     /** Full gateway URL, e.g. "http://localhost:18789" */
     gatewayUrl: string;
@@ -5,10 +6,16 @@ export interface GatewayConfig {
     gatewayToken: string;
     /** Trading symbol, e.g. "BTC/USDT" */
     symbol: string;
-    /** Intelligence service URL (optional — regime classification) */
+    /** Intelligence service URL (regime classification + trade-result reporting) */
     intelligenceUrl?: string;
     /** Connection token for intelligence service auth */
     connectionToken?: string;
+    /** Trading venue this box is configured for. Decides how a canonical symbol
+     *  is spelled in the intel DB ('BTC/USDT' → 'BTCUSDT' vs 'BTC/USDC' →
+     *  'HL_BTC'), so every skill↔intel symbol crossing depends on it.
+     *  Optional so a hand-built config (tests, embedders) stays valid; every
+     *  consumer treats absent as 'binance', the historical behaviour. */
+    venue?: VenueId;
 }
 /** CLI args specific to gateway provider */
 export interface GatewayCliArgs {
@@ -20,17 +27,21 @@ export interface GatewayCliArgs {
 /**
  * Resolve gateway connection config with priority:
  * 1. CLI args (--gateway-url, --gateway-token, --symbol)
- * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL)
- * 3. OpenClaw config file (~/.openclaw/openclaw.json)
- * 4. Defaults (localhost:18789, BTC/USDT)
+ * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL,
+ *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE)
+ * 3. Config files (~/.openclaw/openclaw.json, ~/.reefclaw/plugin-config.json)
+ * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com)
  *
  * Returns null for gatewayToken if it can't be resolved (caller must handle).
+ * `intelligenceUrl` is never null — see DEFAULT_INTELLIGENCE_URL for why that
+ * matters.
  */
 export declare function resolveGatewayConfig(args: GatewayCliArgs): {
     gatewayUrl: string;
     gatewayToken: string | null;
     symbol: string;
-    intelligenceUrl: string | null;
+    intelligenceUrl: string;
+    venue: VenueId;
 };
 /**
  * Validate that the resolved config has all required fields.

package/bridge/gateway/gateway-config.js

@@ -5,11 +5,27 @@ import { readFileSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import JSON5 from 'json5';
+import { parseVenue, VENUE_DEFAULT_SYMBOL } from '@reefclaw/shared';
 import { logger } from '../logger.js';
 const TAG = 'gateway-config';
 const DEFAULT_GATEWAY_PORT = 18789;
 const DEFAULT_GATEWAY_HOST = 'localhost';
-const DEFAULT_SYMBOL = 'BTC/USDT';
+/**
+ * Same default the plugin hardcodes (plugin/src/index.ts) so the two processes
+ * agree on the intel service without any operator configuration.
+ *
+ * ★ Before 2026-07-27 the skill had NO default and NO config-file fallback:
+ * `intelligenceUrl` came only from `--intelligence-url` or
+ * `REEFCLAW_INTELLIGENCE_URL`, and NOTHING in the repo ever set either one —
+ * not the installer, not a systemd unit, not a deploy script. The skill is the
+ * ONLY writer of intel's `trade_results` table, so on every default install
+ * every closed trade was dropped at debug level inside `reportTradeResult`.
+ * Downstream that meant `tradeCount` never reached `minTradesForKelly`, Kelly
+ * sizing was pinned at `cappedReason: 'insufficient_history'` forever, and
+ * `get_agent_profile` reported tier `novice` / 0 trades no matter how much the
+ * agent traded. Reads had a default; the write did not.
+ */
+const DEFAULT_INTELLIGENCE_URL = 'https://intel.reefclaw.com';
 // ---- Read OpenClaw config file ----
 function getConfigPath() {
     return process.env.OPENCLAW_CONFIG_PATH
@@ -28,18 +44,48 @@ function readOpenClawJson() {
         return null;
     }
 }
+// ---- Read the plugin's own config file ----
+function getPluginConfigPath() {
+    return process.env.REEFCLAW_PLUGIN_CONFIG_PATH
+        || join(homedir(), '.reefclaw', 'plugin-config.json');
+}
+/**
+ * Best-effort read of ~/.reefclaw/plugin-config.json — the file that already
+ * carries `intelligenceUrl` and `exchange.venue` for the plugin. Reading the
+ * same file here makes the two processes agree by construction rather than by
+ * convention (the skill previously had no way at all to learn either value).
+ * Fail-soft: null on a missing/unreadable/malformed file, which is the common
+ * case on a chat-install box that never writes this file.
+ */
+function readPluginConfig() {
+    const path = getPluginConfigPath();
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (parsed == null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        logger.debug(TAG, `Could not read plugin config from ${path}`);
+        return null;
+    }
+}
 // ---- Resolve gateway config ----
 /**
  * Resolve gateway connection config with priority:
  * 1. CLI args (--gateway-url, --gateway-token, --symbol)
- * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL)
- * 3. OpenClaw config file (~/.openclaw/openclaw.json)
- * 4. Defaults (localhost:18789, BTC/USDT)
+ * 2. Env vars (OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_TOKEN, REEFCLAW_SYMBOL,
+ *    REEFCLAW_INTELLIGENCE_URL, REEFCLAW_VENUE)
+ * 3. Config files (~/.openclaw/openclaw.json, ~/.reefclaw/plugin-config.json)
+ * 4. Defaults (localhost:18789, the venue's default symbol, intel.reefclaw.com)
  *
  * Returns null for gatewayToken if it can't be resolved (caller must handle).
+ * `intelligenceUrl` is never null — see DEFAULT_INTELLIGENCE_URL for why that
+ * matters.
  */
 export function resolveGatewayConfig(args) {
     const ocConfig = readOpenClawJson();
+    const pluginConfig = readPluginConfig();
     // --- Gateway URL ---
     // CLI > env > construct from openclaw.json port > default
     const port = ocConfig?.gateway?.port ?? DEFAULT_GATEWAY_PORT;
@@ -56,24 +102,34 @@ export function resolveGatewayConfig(args) {
     if (fileToken && !args.gatewayToken && !process.env.OPENCLAW_GATEWAY_TOKEN) {
         logger.info(TAG, 'Using gateway token from OpenClaw config');
     }
+    // --- Venue ---
+    // env > plugin-config.json exchange.venue > binance. Resolved BEFORE the
+    // symbol because it decides both the symbol default and the intel spelling.
+    // parseVenue surfaces a mis-spelled value instead of silently coercing it.
+    const { venue, unrecognized } = parseVenue(process.env.REEFCLAW_VENUE ?? pluginConfig?.exchange?.venue);
+    if (unrecognized) {
+        logger.warn(TAG, `Unrecognized venue '${unrecognized}' — falling back to binance`);
+    }
     // --- Symbol ---
-    // CLI > env > default
+    // CLI > env > the VENUE's default. A venue-blind 'BTC/USDT' default on a
+    // hyperliquid box is a symbol that venue rejects everywhere it's consumed
+    // (the issue-#174 class of bug).
     const symbol = args.symbol
         || process.env.REEFCLAW_SYMBOL
-        || DEFAULT_SYMBOL;
+        || VENUE_DEFAULT_SYMBOL[venue];
     if (!gatewayToken) {
         logger.warn(TAG, 'Gateway token not found in CLI args, env vars, or OpenClaw config');
     }
     // --- Intelligence URL ---
-    // CLI > env > default
+    // CLI > env > plugin-config.json > default. A default is mandatory: this URL
+    // gates the ONLY writer of intel's trade_results (see the constant).
     const intelligenceUrl = args.intelligenceUrl
         || process.env.REEFCLAW_INTELLIGENCE_URL
-        || null;
-    if (intelligenceUrl) {
-        logger.info(TAG, `Intelligence service: ${intelligenceUrl}`);
-    }
+        || pluginConfig?.intelligenceUrl
+        || DEFAULT_INTELLIGENCE_URL;
+    logger.info(TAG, `Intelligence service: ${intelligenceUrl} (venue=${venue})`);
     logger.debug(TAG, `Resolved: url=${gatewayUrl}, token=${gatewayToken ? '***' : '(none)'}, symbol=${symbol}`);
-    return { gatewayUrl, gatewayToken, symbol, intelligenceUrl };
+    return { gatewayUrl, gatewayToken, symbol, intelligenceUrl, venue };
 }
 /**
  * Validate that the resolved config has all required fields.

package/bridge/gateway/gateway-ws-client.d.ts

@@ -71,7 +71,10 @@ export declare class GatewayWsClient {
     private listeners;
     private readonly gatewayUrl;
     private readonly gatewayToken;
-    constructor(config: Pick<GatewayConfig, 'gatewayUrl' | 'gatewayToken'>, reconnect?: Partial<ReconnectConfig>);
+    private readonly requestAdminScope;
+    constructor(config: Pick<GatewayConfig, 'gatewayUrl' | 'gatewayToken'> & {
+        requestAdminScope?: boolean;
+    }, reconnect?: Partial<ReconnectConfig>);
     /** Start the WebSocket connection and handshake */
     connect(): void;
     /** Disconnect and clean up. Cannot reconnect after this. */

package/bridge/gateway/gateway-ws-client.js

@@ -5,6 +5,21 @@ import WebSocket from 'ws';
 import { logger } from '../logger.js';
 import { computeDelay } from '../utils/reconnect.js';
 const TAG = 'gateway-ws';
+/** True when a `host[:port][/path]` string points at this machine. Used to
+ *  decide the default scheme for bare gateway hosts (loopback → ws://, remote
+ *  → wss://) and to warn on plaintext-to-remote. */
+function isLoopbackHost(hostAndRest) {
+    const authority = hostAndRest.split('/')[0].toLowerCase();
+    if (authority.startsWith('[')) {
+        // Bracketed IPv6, e.g. [::1]:18789
+        const end = authority.indexOf(']');
+        return (end > 0 ? authority.slice(1, end) : authority.slice(1)) === '::1';
+    }
+    if (authority === '::1')
+        return true; // bare IPv6 loopback (no port possible)
+    const host = authority.split(':')[0];
+    return host === 'localhost' || host.startsWith('127.');
+}
 // ---- Protocol constants ----
 // Protocol range we can speak. The gateway picks its own version if it falls
 // inside [min, max]. v3 = OpenClaw ≤2026.4.x (prod); v4 = OpenClaw 2026.6+
@@ -45,8 +60,14 @@ export class GatewayWsClient {
     listeners = new Map();
     gatewayUrl;
     gatewayToken;
+    requestAdminScope;
     constructor(config, reconnect) {
-        // Convert to WebSocket URL: http→ws, https→wss, bare host:port→ws://
+        this.requestAdminScope = config.requestAdminScope === true;
+        // Convert to WebSocket URL: http→ws, https→wss. A bare host:port defaults
+        // by destination: loopback → ws:// (the normal localhost gateway), anything
+        // else → wss:// — a remote default must never silently downgrade to
+        // plaintext, because the hello frame carries the gateway token. An explicit
+        // ws:// to a remote host is honored but warned about below.
         let url = config.gatewayUrl.replace(/\/$/, '');
         if (/^https:\/\//.test(url)) {
             url = url.replace(/^https:\/\//, 'wss://');
@@ -55,7 +76,12 @@ export class GatewayWsClient {
             url = url.replace(/^http:\/\//, 'ws://');
         }
         else if (!/^wss?:\/\//.test(url)) {
-            url = `ws://${url}`;
+            url = `${isLoopbackHost(url) ? 'ws' : 'wss'}://${url}`;
+        }
+        if (/^ws:\/\//.test(url) && !isLoopbackHost(url.slice('ws://'.length))) {
+            logger.warn(TAG, `Gateway URL ${url} is PLAINTEXT ws:// to a non-loopback host — the ` +
+                `gateway token will transit unencrypted. Use wss:// (or an SSH tunnel ` +
+                `to localhost) unless this network is fully trusted.`);
         }
         this.gatewayUrl = url;
         this.gatewayToken = config.gatewayToken;
@@ -280,15 +306,19 @@ export class GatewayWsClient {
                     mode: 'backend',
                 },
                 role: 'operator',
-                // operator.admin: cron management (the boot-time heartbeat-cron ensure
-                // calls cron.list/cron.add) moved behind the admin scope on OpenClaw
-                // 2026.7.x — observed live on the first real npx onboarding
-                // ("Heartbeat cron: skipped (missing scope: operator.admin)",
-                // 2026-07-22, openclaw 2026.7.1-2). The gateway is localhost-bound and
-                // this connection already holds operator.write (orders, chat), so the
-                // marginal grant is small; without it fresh 2026.7.x installs never
-                // get a heartbeat cron.
-                scopes: ['operator.read', 'operator.write', 'operator.admin'],
+                // Least privilege: operator.admin is requested ONLY while the
+                // once-per-install heartbeat-cron ensure is still owed (cron.list/
+                // cron.add moved behind the admin scope on OpenClaw 2026.7.x —
+                // "Heartbeat cron: skipped (missing scope: operator.admin)", observed
+                // 2026-07-22 on openclaw 2026.7.1-2; without it fresh installs never
+                // get a heartbeat cron). Once the ensure marker exists, the caller
+                // constructs this client with requestAdminScope=false and every later
+                // session runs on read/write only.
+                scopes: [
+                    'operator.read',
+                    'operator.write',
+                    ...(this.requestAdminScope ? ['operator.admin'] : []),
+                ],
                 auth: {
                     token: this.gatewayToken,
                     ...(this.deviceToken && { deviceToken: this.deviceToken }),

package/bridge/gateway/poller.js

@@ -356,8 +356,14 @@ export class Poller {
         const tool = this.toolMap.fetch_positions;
         // Fetch ALL positions (no symbol filter) so multi-symbol trades are visible
         const result = await this.http.invoke(tool, {});
-        const positions = Array.isArray(result.data) ? result.data : [];
-        this.callbacks.onPositions(positions);
+        if (!Array.isArray(result.data)) {
+            // null ≠ empty: this cache is the emergency-Flatten fallback. Collapsing
+            // a garbage response to [] would let a later failed fresh read report
+            // "No positions to close" off poisoned data (audit 2026-07-26 F6).
+            logger.warn(TAG, `fetch_positions returned non-array (${typeof result.data}) — keeping last known positions`);
+            return;
+        }
+        this.callbacks.onPositions(result.data);
     }
     async pollBalance() {
         const tool = this.toolMap.fetch_balance;
@@ -370,13 +376,17 @@ export class Poller {
         // Fetch ALL open orders (no symbol filter) — this cache is the fallback
         // for the portfolio-wide Kill + reconcile snapshot (see interval comment).
         const result = await this.http.invoke(tool, {});
+        if (!Array.isArray(result.data)) {
+            // null ≠ empty: same reasoning as pollPositions — a garbage response
+            // must not overwrite the Kill fallback cache with a confirmed-empty [].
+            logger.warn(TAG, `fetch_open_orders returned non-array (${typeof result.data}) — keeping last known orders`);
+            return;
+        }
         const orders = [];
-        if (Array.isArray(result.data)) {
-            for (const ccxt of result.data) {
-                const mapped = mapCcxtOrder(ccxt);
-                if (mapped)
-                    orders.push(mapped);
-            }
+        for (const ccxt of result.data) {
+            const mapped = mapCcxtOrder(ccxt);
+            if (mapped)
+                orders.push(mapped);
         }
         this.callbacks.onOpenOrders(orders);
     }

package/bridge/providers/emergency-commands.d.ts

@@ -29,8 +29,16 @@ export interface EmergencyContext {
  *
  * Caller must set agentMode = 'STOPPED' after this returns, and should pass a
  * FRESH all-symbols order snapshot (see the gateway wrapper).
+ *
+ * ★ null ≠ empty (audit 2026-07-26 F6): `freshOrders === null` means the fresh
+ * fetch FAILED — order state is unknown. A stale (≤60s) cache that happens to
+ * be empty is NOT proof of zero working orders, and reporting executed:true
+ * from it is exactly the false-green the 2026-06-19 fix exists to prevent. On
+ * a failed fresh read Kill still halts the agent and best-effort cancels the
+ * cached-known working set, but ALWAYS reports executed:false with the
+ * unverified-coverage reason.
  */
-export declare function executeKill(ctx: EmergencyContext, openOrders: OrderData[]): Promise<EmergencyResult>;
+export declare function executeKill(ctx: EmergencyContext, freshOrders: OrderData[] | null, cachedOrders?: OrderData[]): Promise<EmergencyResult>;
 /**
  * Flatten: close all open positions at market.
  * Caller must set agentMode = 'STOPPED' after this returns.

package/bridge/providers/emergency-commands.js

@@ -30,11 +30,21 @@ function rejectionReasons(results, max = 3) {
  *
  * Caller must set agentMode = 'STOPPED' after this returns, and should pass a
  * FRESH all-symbols order snapshot (see the gateway wrapper).
+ *
+ * ★ null ≠ empty (audit 2026-07-26 F6): `freshOrders === null` means the fresh
+ * fetch FAILED — order state is unknown. A stale (≤60s) cache that happens to
+ * be empty is NOT proof of zero working orders, and reporting executed:true
+ * from it is exactly the false-green the 2026-06-19 fix exists to prevent. On
+ * a failed fresh read Kill still halts the agent and best-effort cancels the
+ * cached-known working set, but ALWAYS reports executed:false with the
+ * unverified-coverage reason.
  */
-export async function executeKill(ctx, openOrders) {
+export async function executeKill(ctx, freshOrders, cachedOrders = []) {
     if (!ctx.http) {
         return { action: 'kill', executed: false, timestamp: new Date().toISOString(), details: 'HTTP client not initialized' };
     }
+    const fresh = freshOrders !== null;
+    const openOrders = freshOrders ?? cachedOrders;
     // Protective = a stop/TP bracket (reduceOnly OR closePosition OR stop-type;
     // see mapCcxtOrder/isProtectiveOrder). Working = everything else (entries /
     // adds). Preserve protective so an open position is never left naked.
@@ -95,6 +105,15 @@ export async function executeKill(ctx, openOrders) {
             logger.warn(TAG, details);
         }
     }
+    if (!fresh) {
+        // Coverage is unverifiable: whatever the cached list said, orders placed
+        // in the last ≤60s are invisible to it. Never render a green "Killed".
+        executed = false;
+        details = working.length === 0
+            ? `Agent halted, but order state is UNVERIFIED — fresh order fetch failed and the cached snapshot shows no working orders; verify on the exchange${preservedNote}`
+            : `${details} — STALE snapshot (fresh order fetch failed); full coverage unverified`;
+        logger.error(TAG, details);
+    }
     return { action: 'kill', executed, timestamp: new Date().toISOString(), details };
 }
 /**
@@ -110,13 +129,19 @@ export async function executeFlatten(ctx, cachedPositions) {
     // ctx.symbol here narrowed the result to a single symbol, so positions on
     // every other symbol were silently skipped and never closed. The cached
     // fallback (this.positions) is already all-symbols.
+    // ★ null ≠ empty (audit 2026-07-26 F6): `fresh` records whether the list is
+    // exchange-confirmed. A stale cache that happens to be empty must NEVER
+    // produce a green "Flattened" — a position opened in the last ≤60s would be
+    // invisible to it and left running behind a STOPPED agent.
     let positions = cachedPositions;
+    let fresh = false;
     const fetchTool = ctx.toolMap.fetch_positions;
     if (fetchTool) {
         try {
             const result = await ctx.http.invokeEmergency(fetchTool, {});
             if (Array.isArray(result.data)) {
                 positions = result.data;
+                fresh = true;
             }
             else {
                 // Mirror gateway.ts fetchFreshPositions: a non-array response must
@@ -132,6 +157,11 @@ export async function executeFlatten(ctx, cachedPositions) {
     // Filter to non-zero positions
     const openPositions = positions.filter((p) => (p.contracts ?? 0) !== 0);
     if (openPositions.length === 0) {
+        if (!fresh) {
+            const details = 'Position state UNVERIFIED — fresh position fetch failed and the cached snapshot shows none; nothing was closed, verify on the exchange';
+            logger.error(TAG, details);
+            return { action: 'flatten', executed: false, timestamp: new Date().toISOString(), details };
+        }
         return { action: 'flatten', executed: true, timestamp: new Date().toISOString(), details: 'No positions to close' };
     }
     // Close each position
@@ -179,6 +209,13 @@ export async function executeFlatten(ctx, cachedPositions) {
         logger.error(TAG, details);
         return { action: 'flatten', executed: false, timestamp: new Date().toISOString(), details };
     }
+    if (!fresh) {
+        // Every cached-known position closed, but positions opened in the last
+        // ≤60s are invisible to a stale snapshot — coverage is unverifiable.
+        const details = `Closed ${succeeded}/${openPositions.length} positions from a STALE snapshot (fresh position fetch failed) — full coverage unverified, verify on the exchange`;
+        logger.error(TAG, details);
+        return { action: 'flatten', executed: false, timestamp: new Date().toISOString(), details };
+    }
     const details = `Closed ${succeeded}/${openPositions.length} positions`;
     return { action: 'flatten', executed: true, timestamp: new Date().toISOString(), details };
 }

package/bridge/providers/gateway.d.ts

@@ -100,6 +100,7 @@ export declare class GatewayProvider implements OpenClawProvider {
     private agentStateInterval;
     private toolRetryInterval;
     private regimeInterval;
+    private tradingParamsInterval;
     private signalInterval;
     private missionInterval;
     private analyticsInterval;
@@ -114,6 +115,17 @@ export declare class GatewayProvider implements OpenClawProvider {
     private atrData;
     private atrSampleCount;
     private currentRegime;
+    /** ★ The tenant's ENFORCED risk limits, mirrored from intel
+     *  `/api/trading-params` — the same row the plugin's `preTradeRiskCheck`
+     *  rejects orders against. Null until the first fetch lands (then
+     *  DEFAULT_RISK_LIMITS applies). Before this existed the dashboard's risk
+     *  banner ran on a hardcoded ladder that no enforcer used, so it could show
+     *  a red "Gate fail" for a limit nothing blocked on — and, in the other
+     *  direction, stay green while the plugin rejected every entry. */
+    private riskLimits;
+    /** Tenant drawdown-zone boundaries. Drives the RED-zone auto-flatten, so a
+     *  stale/stricter local ladder here can flatten a live book early. */
+    private drawdownThresholds;
     /** Timestamp of the most recent trade (fill event) — used in buildAgentState */
     private lastTradeTs;
     /** Epoch ms of the most recent LIVE fill observed this process (issue #248).
@@ -243,6 +255,20 @@ export declare class GatewayProvider implements OpenClawProvider {
      *  the WS store; under weight pressure isStoreTrusted() flickers between
      *  the two, so the raw symbol alternates poll-to-poll. */
     private canonicalSymbol;
+    /** Canonical symbol → the intel DB symbol for this box's venue.
+     *  binance: 'BTC/USDT' → 'BTCUSDT'; hyperliquid: 'BTC/USDC' → 'HL_BTC'.
+     *
+     *  ★ The old venue-blind `.replace('/','')` produced 'BTCUSDC' on a
+     *  hyperliquid box — a symbol no intel row has ever carried (intel
+     *  namespaces every HL row under the 'HL_' prefix). That silently broke the
+     *  regime/signal/mission/analytics pollers AND wrote every trade result to a
+     *  symbol Kelly sizing would never read back, so a hyperliquid box stayed at
+     *  `insufficient_history` even once the reporting path itself worked.
+     *
+     *  FAILS OPEN: an unmappable symbol falls back to the legacy concatenation
+     *  so intel answers "no data for <echo>" — honest and debuggable — rather
+     *  than the caller throwing and dropping the report entirely. */
+    private toIntelSymbol;
     private onPollerPositions;
     /**
      * Compare previous and current positions from polling.
@@ -279,6 +305,14 @@ export declare class GatewayProvider implements OpenClawProvider {
     private lastMarketStructure;
     private fetchFreshPositions;
     private fetchFreshBalance;
+    /** Strict fresh read — null on ANY failure (missing tool, thrown fetch,
+     *  non-array garbage). Callers whose verdict claims order-state coverage
+     *  (Kill) MUST distinguish "confirmed list" from "unknown"; collapsing a
+     *  failed read into the ≤60s cache here was how a stale-empty cache became
+     *  a green "No open orders to cancel" (audit 2026-07-26 F6). */
+    private fetchFreshOpenOrdersOrNull;
+    /** Cached-fallback wrapper for DISPLAY surfaces (the reconcile snapshot):
+     *  stale data beats a blank panel there. Never use for emergency verdicts. */
     private fetchFreshOpenOrders;
     private fetchAgentHealth;
     /**
@@ -387,13 +421,29 @@ export declare class GatewayProvider implements OpenClawProvider {
      * truthful-unknown beats confidently-wrong.
      */
     private seedLastTradeTs;
-    /** Symbol formatted for intelligence API (BTC/USDT → BTCUSDT). */
+    /** The configured symbol as the intel DB spells it. */
     private get intelligenceSymbol();
     /** Shared intelligence poller with circuit-breaker (exponential backoff on errors). */
     private startIntelligencePoller;
     /** Log first error per poller, suppress subsequent repeats. */
     private trackIntelError;
     private startRegimePoller;
+    /**
+     * Mirror the tenant's trading params into the risk limits the dashboard
+     * banner and the RED-zone auto-flatten run on.
+     *
+     * Deliberately NOT routed through `startIntelligencePoller`: that helper
+     * appends `/${symbol}` and is gated by `RC_SKILL_INTEL_POLL=off`. These
+     * limits are a safety input, not a dashboard read — shedding intel display
+     * load must not silently revert the operator's configured limits to the
+     * fallback ladder.
+     *
+     * Fail-open by design: a failed fetch keeps the last good values (or the
+     * fallback constants on a cold start). We never tighten limits from a
+     * parse failure, and we never widen them past what the plugin enforces —
+     * the plugin re-reads the same row for the gate that actually blocks.
+     */
+    private startTradingParamsPoller;
     private startSignalPoller;
     private startMissionPoller;
     private startAnalyticsPoller;