@reefclaw/openclaw-plugin 0.1.14 → 0.1.16

package/bridge/bridge.d.ts

@@ -66,11 +66,26 @@ export declare class Bridge {
     private stopThrottleTimer;
     private handleRequest;
     private handleStateChange;
-    /** Today every authenticated session carries operator.write via the
-     *  relay-level Clerk token. This method exists as the enforcement seam —
-     *  a future PR can drop per-session roles in here without restructuring
-     *  the dispatcher. Returning true keeps current behavior identical. */
-    private hasOperatorWriteScope;
+    /** Whether operator-write methods are allowed for the current session mix.
+     *
+     *  This is NOT a per-frame credential check, and does not claim to be. The
+     *  real authorization boundary for operator-write methods is layered
+     *  OUTSIDE this method:
+     *    1. Transport: every frame reaching handleRequest arrives over the relay
+     *       connection, which authenticated the per-user rc_ token against the
+     *       user-bound relay room before any frame flows (relay/src/auth.ts).
+     *       There is no other ingress to this dispatcher.
+     *    2. State-mutating tools: the plugin independently refuses
+     *       set_trading_mode / set_exchange_credentials /
+     *       clear_exchange_credentials / set_bracket_requirement /
+     *       test_exchange_credentials without the `operator_token` provenance
+     *       proof (audit F12) — a compromised bridge still cannot flip trading
+     *       state.
+     *  While every relay session is an operator session by construction, this
+     *  returns true; it is the seam where per-session roles attach if a
+     *  non-operator ingress is ever added, without restructuring the
+     *  dispatcher. */
+    private operatorWriteAllowed;
     /** Handle a set_trading_mode request. Returns 'responded' if the handler
      *  already wrote the response frame (e.g. on validation failure), otherwise
      *  returns the structured outcome for the caller to wrap in a success

package/bridge/bridge.js

@@ -326,15 +326,15 @@ export class Bridge {
     async handleRequest(frame) {
         const { id, method, params } = frame;
         try {
-            // ---- Operator-write scope gate ----
-            // Methods in OPERATOR_WRITE_METHODS require an elevated scope. Today,
-            // all connected sessions inherit operator.write from the relay-level
-            // authentication (Clerk-issued token), so this check is effectively a
-            // whitelist — it exists so a future PR can attach per-session roles
-            // without restructuring the dispatcher. Emergency methods are on the
-            // list for the same reason (they are already covered today, but the
-            // list is the forward-compatible gate).
-            if (OPERATOR_WRITE_METHODS.has(method) && !this.hasOperatorWriteScope()) {
+            // ---- Operator-write gate ----
+            // Methods in OPERATOR_WRITE_METHODS are dashboard-operator actions. The
+            // enforcement is layered and documented on operatorWriteAllowed():
+            // transport auth at the relay (token↔room binding — the only ingress to
+            // this dispatcher) + plugin-side operator_token provenance on every
+            // state-mutating tool. This branch is the forward-compatible seam for
+            // per-session roles; it does not itself verify credentials. Emergency
+            // methods are on the list for the same forward-compatibility reason.
+            if (OPERATOR_WRITE_METHODS.has(method) && !this.operatorWriteAllowed()) {
                 audit('operator_write.denied', { method, id });
                 this.connector.sendResponse(id, false, undefined, {
                     code: 403,
@@ -578,11 +578,26 @@ export class Bridge {
         logger.info(TAG, `Connector state: ${state}`);
     }
     // ---- Operator onboarding (PR2) ----
-    /** Today every authenticated session carries operator.write via the
-     *  relay-level Clerk token. This method exists as the enforcement seam —
-     *  a future PR can drop per-session roles in here without restructuring
-     *  the dispatcher. Returning true keeps current behavior identical. */
-    hasOperatorWriteScope() {
+    /** Whether operator-write methods are allowed for the current session mix.
+     *
+     *  This is NOT a per-frame credential check, and does not claim to be. The
+     *  real authorization boundary for operator-write methods is layered
+     *  OUTSIDE this method:
+     *    1. Transport: every frame reaching handleRequest arrives over the relay
+     *       connection, which authenticated the per-user rc_ token against the
+     *       user-bound relay room before any frame flows (relay/src/auth.ts).
+     *       There is no other ingress to this dispatcher.
+     *    2. State-mutating tools: the plugin independently refuses
+     *       set_trading_mode / set_exchange_credentials /
+     *       clear_exchange_credentials / set_bracket_requirement /
+     *       test_exchange_credentials without the `operator_token` provenance
+     *       proof (audit F12) — a compromised bridge still cannot flip trading
+     *       state.
+     *  While every relay session is an operator session by construction, this
+     *  returns true; it is the seam where per-session roles attach if a
+     *  non-operator ingress is ever added, without restructuring the
+     *  dispatcher. */
+    operatorWriteAllowed() {
         return true;
     }
     /** Handle a set_trading_mode request. Returns 'responded' if the handler

package/bridge/config.js

@@ -11,6 +11,12 @@ const OPENCLAW_DIR = join(homedir(), '.openclaw');
 const CONFIG_PATH = join(OPENCLAW_DIR, 'openclaw.json');
 const DEFAULT_RELAY_URL = 'wss://reefclaw.radunlupsa.partykit.dev';
 // ---- Read/write OpenClaw config ----
+//
+// Scope contract: these helpers touch ONLY the ReefClaw skill entry
+// (skills.entries.reefclaw.config — the token/userId/relayUrl the USER pasted
+// during onboarding) and preserve every other key verbatim. They exist so the
+// connector can pick up a connection the user saved via chat and persist it
+// across restarts — not to manage OpenClaw's own configuration.
 /** Read the OpenClaw config file and extract ReefClaw skill settings.
  *  Prefers the schema-valid nested shape (entry.config.*), falls back to the
  *  legacy flat shape per-field. */

package/bridge/gateway/gateway-ws-client.d.ts

@@ -71,7 +71,10 @@ export declare class GatewayWsClient {
     private listeners;
     private readonly gatewayUrl;
     private readonly gatewayToken;
-    constructor(config: Pick<GatewayConfig, 'gatewayUrl' | 'gatewayToken'>, reconnect?: Partial<ReconnectConfig>);
+    private readonly requestAdminScope;
+    constructor(config: Pick<GatewayConfig, 'gatewayUrl' | 'gatewayToken'> & {
+        requestAdminScope?: boolean;
+    }, reconnect?: Partial<ReconnectConfig>);
     /** Start the WebSocket connection and handshake */
     connect(): void;
     /** Disconnect and clean up. Cannot reconnect after this. */

package/bridge/gateway/gateway-ws-client.js

@@ -5,6 +5,21 @@ import WebSocket from 'ws';
 import { logger } from '../logger.js';
 import { computeDelay } from '../utils/reconnect.js';
 const TAG = 'gateway-ws';
+/** True when a `host[:port][/path]` string points at this machine. Used to
+ *  decide the default scheme for bare gateway hosts (loopback → ws://, remote
+ *  → wss://) and to warn on plaintext-to-remote. */
+function isLoopbackHost(hostAndRest) {
+    const authority = hostAndRest.split('/')[0].toLowerCase();
+    if (authority.startsWith('[')) {
+        // Bracketed IPv6, e.g. [::1]:18789
+        const end = authority.indexOf(']');
+        return (end > 0 ? authority.slice(1, end) : authority.slice(1)) === '::1';
+    }
+    if (authority === '::1')
+        return true; // bare IPv6 loopback (no port possible)
+    const host = authority.split(':')[0];
+    return host === 'localhost' || host.startsWith('127.');
+}
 // ---- Protocol constants ----
 // Protocol range we can speak. The gateway picks its own version if it falls
 // inside [min, max]. v3 = OpenClaw ≤2026.4.x (prod); v4 = OpenClaw 2026.6+
@@ -45,8 +60,14 @@ export class GatewayWsClient {
     listeners = new Map();
     gatewayUrl;
     gatewayToken;
+    requestAdminScope;
     constructor(config, reconnect) {
-        // Convert to WebSocket URL: http→ws, https→wss, bare host:port→ws://
+        this.requestAdminScope = config.requestAdminScope === true;
+        // Convert to WebSocket URL: http→ws, https→wss. A bare host:port defaults
+        // by destination: loopback → ws:// (the normal localhost gateway), anything
+        // else → wss:// — a remote default must never silently downgrade to
+        // plaintext, because the hello frame carries the gateway token. An explicit
+        // ws:// to a remote host is honored but warned about below.
         let url = config.gatewayUrl.replace(/\/$/, '');
         if (/^https:\/\//.test(url)) {
             url = url.replace(/^https:\/\//, 'wss://');
@@ -55,7 +76,12 @@ export class GatewayWsClient {
             url = url.replace(/^http:\/\//, 'ws://');
         }
         else if (!/^wss?:\/\//.test(url)) {
-            url = `ws://${url}`;
+            url = `${isLoopbackHost(url) ? 'ws' : 'wss'}://${url}`;
+        }
+        if (/^ws:\/\//.test(url) && !isLoopbackHost(url.slice('ws://'.length))) {
+            logger.warn(TAG, `Gateway URL ${url} is PLAINTEXT ws:// to a non-loopback host — the ` +
+                `gateway token will transit unencrypted. Use wss:// (or an SSH tunnel ` +
+                `to localhost) unless this network is fully trusted.`);
         }
         this.gatewayUrl = url;
         this.gatewayToken = config.gatewayToken;
@@ -280,15 +306,19 @@ export class GatewayWsClient {
                     mode: 'backend',
                 },
                 role: 'operator',
-                // operator.admin: cron management (the boot-time heartbeat-cron ensure
-                // calls cron.list/cron.add) moved behind the admin scope on OpenClaw
-                // 2026.7.x — observed live on the first real npx onboarding
-                // ("Heartbeat cron: skipped (missing scope: operator.admin)",
-                // 2026-07-22, openclaw 2026.7.1-2). The gateway is localhost-bound and
-                // this connection already holds operator.write (orders, chat), so the
-                // marginal grant is small; without it fresh 2026.7.x installs never
-                // get a heartbeat cron.
-                scopes: ['operator.read', 'operator.write', 'operator.admin'],
+                // Least privilege: operator.admin is requested ONLY while the
+                // once-per-install heartbeat-cron ensure is still owed (cron.list/
+                // cron.add moved behind the admin scope on OpenClaw 2026.7.x —
+                // "Heartbeat cron: skipped (missing scope: operator.admin)", observed
+                // 2026-07-22 on openclaw 2026.7.1-2; without it fresh installs never
+                // get a heartbeat cron). Once the ensure marker exists, the caller
+                // constructs this client with requestAdminScope=false and every later
+                // session runs on read/write only.
+                scopes: [
+                    'operator.read',
+                    'operator.write',
+                    ...(this.requestAdminScope ? ['operator.admin'] : []),
+                ],
                 auth: {
                     token: this.gatewayToken,
                     ...(this.deviceToken && { deviceToken: this.deviceToken }),

package/bridge/providers/gateway.d.ts

@@ -100,6 +100,7 @@ export declare class GatewayProvider implements OpenClawProvider {
     private agentStateInterval;
     private toolRetryInterval;
     private regimeInterval;
+    private tradingParamsInterval;
     private signalInterval;
     private missionInterval;
     private analyticsInterval;
@@ -114,6 +115,17 @@ export declare class GatewayProvider implements OpenClawProvider {
     private atrData;
     private atrSampleCount;
     private currentRegime;
+    /** ★ The tenant's ENFORCED risk limits, mirrored from intel
+     *  `/api/trading-params` — the same row the plugin's `preTradeRiskCheck`
+     *  rejects orders against. Null until the first fetch lands (then
+     *  DEFAULT_RISK_LIMITS applies). Before this existed the dashboard's risk
+     *  banner ran on a hardcoded ladder that no enforcer used, so it could show
+     *  a red "Gate fail" for a limit nothing blocked on — and, in the other
+     *  direction, stay green while the plugin rejected every entry. */
+    private riskLimits;
+    /** Tenant drawdown-zone boundaries. Drives the RED-zone auto-flatten, so a
+     *  stale/stricter local ladder here can flatten a live book early. */
+    private drawdownThresholds;
     /** Timestamp of the most recent trade (fill event) — used in buildAgentState */
     private lastTradeTs;
     /** Epoch ms of the most recent LIVE fill observed this process (issue #248).
@@ -416,6 +428,22 @@ export declare class GatewayProvider implements OpenClawProvider {
     /** Log first error per poller, suppress subsequent repeats. */
     private trackIntelError;
     private startRegimePoller;
+    /**
+     * Mirror the tenant's trading params into the risk limits the dashboard
+     * banner and the RED-zone auto-flatten run on.
+     *
+     * Deliberately NOT routed through `startIntelligencePoller`: that helper
+     * appends `/${symbol}` and is gated by `RC_SKILL_INTEL_POLL=off`. These
+     * limits are a safety input, not a dashboard read — shedding intel display
+     * load must not silently revert the operator's configured limits to the
+     * fallback ladder.
+     *
+     * Fail-open by design: a failed fetch keeps the last good values (or the
+     * fallback constants on a cold start). We never tighten limits from a
+     * parse failure, and we never widen them past what the plugin enforces —
+     * the plugin re-reads the same row for the gate that actually blocks.
+     */
+    private startTradingParamsPoller;
     private startSignalPoller;
     private startMissionPoller;
     private startAnalyticsPoller;

package/bridge/providers/gateway.js

@@ -1,7 +1,7 @@
 // GatewayProvider — real OpenClaw gateway integration.
 // Connects to the OpenClaw gateway via HTTP and WebSocket,
 // streams live trading data, and emits ProviderEvents.
-import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { logger, formatError } from '../logger.js';
@@ -14,7 +14,7 @@ import { EventParser, mapCcxtBalance, mapCcxtOrder, extractLiquidationFields, ex
 import { Poller } from '../gateway/poller.js';
 import { ensureHeartbeatCron, isHeartbeatLikeName } from '../gateway/heartbeat-cron.js';
 import { parseIdentityName } from '../utils/identity-name.js';
-import { computeEquity as _computeEquity, computePositionNotional as _computePositionNotional, computeRiskMetrics as _computeRiskMetrics, DEFAULT_RISK_LIMITS, } from './risk-calculator.js';
+import { computeEquity as _computeEquity, computePositionNotional as _computePositionNotional, computeRiskMetrics as _computeRiskMetrics, DEFAULT_RISK_LIMITS, DRAWDOWN_ZONE_THRESHOLDS, TENANT_LIMIT_BOUNDS, boundedNum, validateDrawdownLadder, } from './risk-calculator.js';
 import { executeKill as _executeKill, executeFlatten as _executeFlatten, executePause as _executePause, executeResume as _executeResume, } from './emergency-commands.js';
 import { executeSetTradingMode, executeGetBracketConfig, executeSetBracketRequirement, executeSetExchangeCredentials, executeTestExchangeCredentials, executeClearExchangeCredentials, } from './onboarding-commands.js';
 const TAG = 'gateway';
@@ -220,6 +220,7 @@ export class GatewayProvider {
     agentStateInterval = null;
     toolRetryInterval = null;
     regimeInterval = null;
+    tradingParamsInterval = null;
     signalInterval = null;
     missionInterval = null;
     analyticsInterval = null;
@@ -240,6 +241,17 @@ export class GatewayProvider {
     atrSampleCount = 0;
     // ---- Current regime (Phase 9e: regime-conditional risk) ----
     currentRegime = 'UNKNOWN';
+    /** ★ The tenant's ENFORCED risk limits, mirrored from intel
+     *  `/api/trading-params` — the same row the plugin's `preTradeRiskCheck`
+     *  rejects orders against. Null until the first fetch lands (then
+     *  DEFAULT_RISK_LIMITS applies). Before this existed the dashboard's risk
+     *  banner ran on a hardcoded ladder that no enforcer used, so it could show
+     *  a red "Gate fail" for a limit nothing blocked on — and, in the other
+     *  direction, stay green while the plugin rejected every entry. */
+    riskLimits = null;
+    /** Tenant drawdown-zone boundaries. Drives the RED-zone auto-flatten, so a
+     *  stale/stricter local ladder here can flatten a live book early. */
+    drawdownThresholds = null;
     // ---- Trade tracking ----
     /** Timestamp of the most recent trade (fill event) — used in buildAgentState */
     lastTradeTs = null;
@@ -352,6 +364,10 @@ export class GatewayProvider {
             clearInterval(this.regimeInterval);
             this.regimeInterval = null;
         }
+        if (this.tradingParamsInterval) {
+            clearInterval(this.tradingParamsInterval);
+            this.tradingParamsInterval = null;
+        }
         if (this.signalInterval) {
             clearInterval(this.signalInterval);
             this.signalInterval = null;
@@ -671,7 +687,10 @@ export class GatewayProvider {
         return executeSetExchangeCredentials({ http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, apiKey, secret, testnet);
     }
     async testExchangeCredentials(apiKey, secret, testnet) {
-        return executeTestExchangeCredentials({ http: this.http, toolMap: this.toolMap }, apiKey, secret, testnet);
+        return executeTestExchangeCredentials(
+        // operatorToken required since the SkillSpector hardening: the plugin
+        // refuses the credential-validation call without dashboard provenance.
+        { http: this.http, toolMap: this.toolMap, operatorToken: this.config.connectionToken }, apiKey, secret, testnet);
     }
     async clearExchangeCredentials() {
         return executeClearExchangeCredentials({
@@ -860,7 +879,13 @@ export class GatewayProvider {
         // Step 3: Create WS client and connect FIRST to obtain device token.
         // OpenClaw's REST API requires a device token from the WS handshake,
         // not the raw gateway auth token. Tool discovery must wait for this.
-        this.wsClient = new GatewayWsClient(this.config);
+        // Least privilege: operator.admin (cron management) is requested only
+        // while the once-per-install heartbeat-cron ensure is still owed — after
+        // the marker exists, every session runs on operator.read/write alone.
+        this.wsClient = new GatewayWsClient({
+            ...this.config,
+            requestAdminScope: !existsSync(join(homedir(), '.openclaw', 'workspace', 'heartbeat-cron-ensured.json')),
+        });
         this.wireWsEvents();
         // Wait for WS handshake to complete (or fail)
         const deviceToken = await this.waitForDeviceToken();
@@ -925,6 +950,9 @@ export class GatewayProvider {
         }
         // Step 6: Start regime poller if intelligence service is configured
         this.startRegimePoller();
+        // Step 6b: Mirror the tenant's ENFORCED risk limits. A safety input, so it
+        // runs even when the intel display pollers are shed.
+        this.startTradingParamsPoller();
         // Step 7: Start signal poller if intelligence service is configured
         this.startSignalPoller();
         // Step 8: Start mission poller if intelligence service is configured
@@ -1641,7 +1669,9 @@ export class GatewayProvider {
     /** Simple heat score (0–100) matching webapp's HeatGauge logic */
     computeHeatScoreSimple(metrics) {
         const { grossExposure, dailyDrawdown, ordersPerMinute, cancelsPerMinute } = metrics.utilization;
-        const limits = DEFAULT_RISK_LIMITS;
+        // Same enforced limits the breach detector uses — otherwise the heat gauge
+        // and the gate disagree about what "hot" means.
+        const limits = this.riskLimits ?? DEFAULT_RISK_LIMITS;
         const scores = [
             limits.position.maxGrossExposure > 0 ? (grossExposure / limits.position.maxGrossExposure) * 100 : 0,
             limits.loss.maxDailyDrawdown < 0 ? (dailyDrawdown / limits.loss.maxDailyDrawdown) * 100 : 0,
@@ -2302,6 +2332,8 @@ export class GatewayProvider {
             atrData: this.atrData ?? undefined,
             regime: this.currentRegime,
             realizedPnlToday: this.realizedPnlToday ?? undefined,
+            baseLimits: this.riskLimits ?? undefined,
+            drawdownThresholds: this.drawdownThresholds ?? undefined,
         });
         // Store pruned timestamps back (non-mutating function returns new arrays)
         this.orderTimestamps = result.prunedOrderTimestamps;
@@ -2536,6 +2568,99 @@ export class GatewayProvider {
             this.fire('regimeUpdate', { ...data, event: 'regime_update', symbol });
         }, 'regimeInterval');
     }
+    /**
+     * Mirror the tenant's trading params into the risk limits the dashboard
+     * banner and the RED-zone auto-flatten run on.
+     *
+     * Deliberately NOT routed through `startIntelligencePoller`: that helper
+     * appends `/${symbol}` and is gated by `RC_SKILL_INTEL_POLL=off`. These
+     * limits are a safety input, not a dashboard read — shedding intel display
+     * load must not silently revert the operator's configured limits to the
+     * fallback ladder.
+     *
+     * Fail-open by design: a failed fetch keeps the last good values (or the
+     * fallback constants on a cold start). We never tighten limits from a
+     * parse failure, and we never widen them past what the plugin enforces —
+     * the plugin re-reads the same row for the gate that actually blocks.
+     */
+    startTradingParamsPoller() {
+        const url = this.config.intelligenceUrl;
+        const token = this.config.connectionToken;
+        if (!url || !token)
+            return;
+        const fullUrl = `${url}/api/trading-params`;
+        logger.info(TAG, `Starting trading-params poller: ${fullUrl}`);
+        const poll = async () => {
+            if (!this.started)
+                return;
+            try {
+                const res = await fetch(fullUrl, {
+                    headers: { Authorization: `Bearer ${token}` },
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (!res.ok) {
+                    this.trackIntelError('tradingParams', `HTTP ${res.status}`);
+                    return;
+                }
+                const body = (await res.json());
+                const p = body?.params;
+                if (!p)
+                    return;
+                // Every field is bounds-checked against hardcoded bands
+                // (TENANT_LIMIT_BOUNDS / validateDrawdownLadder) — CLAUDE.md
+                // load-bearing rule: central config moves knobs only WITHIN hardcoded
+                // bounds; it must never be able to disable a safety mechanism.
+                // Out-of-band → field ignored, previous value kept.
+                const B = TENANT_LIMIT_BOUNDS;
+                const maxPositionSize = boundedNum(p.maxPositionSize, B.maxPositionSize.min, B.maxPositionSize.max);
+                const maxOpenPositions = boundedNum(p.maxOpenPositions, B.maxOpenPositions.min, B.maxOpenPositions.max);
+                const maxGrossExposure = boundedNum(p.maxGrossExposure, B.maxGrossExposure.min, B.maxGrossExposure.max);
+                const maxPerTradeLoss = boundedNum(p.maxPerTradeLoss, B.maxPerTradeLoss.min, B.maxPerTradeLoss.max);
+                // Validate the zone ladder FIRST — the loss limit below reads from the
+                // ACCEPTED ladder, so a rejected row can't leak its RED into
+                // maxDailyDrawdown (which drives the dailyDrawdown AUTO_PAUSE breach).
+                const base = this.drawdownThresholds ?? DRAWDOWN_ZONE_THRESHOLDS;
+                const next = {
+                    YELLOW: boundedNum(p.drawdownYellow, -1, 0) ?? base.YELLOW,
+                    ORANGE: boundedNum(p.drawdownOrange, -1, 0) ?? base.ORANGE,
+                    RED: boundedNum(p.drawdownRed, -1, 0) ?? base.RED,
+                };
+                const ladderError = validateDrawdownLadder(next);
+                if (ladderError === null) {
+                    this.drawdownThresholds = next;
+                }
+                else {
+                    logger.warn(TAG, `Ignoring drawdown zones from trading params: ${ladderError}`);
+                }
+                const prev = this.riskLimits ?? DEFAULT_RISK_LIMITS;
+                const acceptedRed = this.drawdownThresholds?.RED;
+                this.riskLimits = {
+                    position: {
+                        maxPositionSize: maxPositionSize ?? prev.position.maxPositionSize,
+                        maxOpenPositions: maxOpenPositions ?? prev.position.maxOpenPositions,
+                        maxGrossExposure: maxGrossExposure ?? prev.position.maxGrossExposure,
+                        // Intel has no separate net-tilt param; the gross cap bounds it
+                        // (|net| ≤ gross always, so this can never fire before gross).
+                        maxNetExposure: maxGrossExposure ?? prev.position.maxNetExposure,
+                    },
+                    loss: {
+                        // Drawdown limit tracks the operator's RED boundary rather than a
+                        // third independent number.
+                        maxDailyDrawdown: acceptedRed ?? prev.loss.maxDailyDrawdown,
+                        maxPerTradeLoss: maxPerTradeLoss != null ? -Math.abs(maxPerTradeLoss) : prev.loss.maxPerTradeLoss,
+                        maxDailyLoss: prev.loss.maxDailyLoss,
+                    },
+                    rate: prev.rate,
+                };
+                this.intelErrors.tradingParams = 0;
+            }
+            catch (err) {
+                this.trackIntelError('tradingParams', formatError(err));
+            }
+        };
+        void poll();
+        this.tradingParamsInterval = setInterval(() => { void poll(); }, 60_000);
+    }
     startSignalPoller() {
         this.startIntelligencePoller('signals', 'signals', 10_000, (raw) => {
             const data = raw;

package/bridge/providers/onboarding-commands.d.ts

@@ -38,12 +38,15 @@ export interface ClearExchangeCredentialsOutcome {
 export interface OnboardingContext {
     http: GatewayHttpClient | null;
     toolMap: ToolMap;
-    /** rc_* connection token, injected as `operator_token` on the four
-     *  state-MUTATING operator tools (set_trading_mode /
+    /** rc_* connection token, injected as `operator_token` on the operator-only
+     *  tools: the four state-MUTATING ones (set_trading_mode /
      *  set_exchange_credentials / clear_exchange_credentials /
-     *  set_bracket_requirement). The plugin refuses those calls without it
-     *  (audit 2026-07-26 F12) — this is the operator-provenance proof that the
-     *  request came through the dashboard path, which the agent cannot forge
+     *  set_bracket_requirement, audit 2026-07-26 F12) plus
+     *  test_exchange_credentials (read-only, but a live authenticated exchange
+     *  call with caller-supplied keys — without the gate it would hand a
+     *  prompt-injected agent a credential-validation oracle). The plugin refuses
+     *  these calls without it — the operator-provenance proof that the request
+     *  came through the dashboard path, which the agent cannot forge
      *  conversationally (chat redaction strips rc_* tokens). */
     operatorToken?: string;
 }

package/bridge/providers/onboarding-commands.js

@@ -57,7 +57,7 @@ export async function executeTestExchangeCredentials(ctx, apiKey, secret, testne
         };
     }
     try {
-        const result = await ctx.http.invoke(tool, { apiKey, secret, testnet });
+        const result = await ctx.http.invoke(tool, { apiKey, secret, testnet, operator_token: ctx.operatorToken });
         return result.data;
     }
     catch (err) {

package/bridge/providers/risk-calculator.d.ts

@@ -10,11 +10,53 @@ export declare const REGIME_LIMIT_PROFILES: Record<string, Partial<{
 }>>;
 /** Apply regime-conditional adjustments to limits. */
 export declare function applyRegimeAdjustment(baseLimits: RiskLimits, regime: string): RiskLimits;
+/** Fallback zone boundaries, used only until the tenant's trading params load.
+ *  The AUTHORITATIVE values are the operator's `drawdownYellow/Orange/Red`
+ *  trading params — the same numbers the plugin's pre-trade gate rejects on.
+ *  Keeping a second hardcoded ladder here is how the skill ended up
+ *  auto-flattening at -2.5% on an account configured to -4%. */
 export declare const DRAWDOWN_ZONE_THRESHOLDS: {
     readonly YELLOW: -0.01;
     readonly ORANGE: -0.02;
     readonly RED: -0.025;
 };
+export interface DrawdownThresholds {
+    YELLOW: number;
+    ORANGE: number;
+    RED: number;
+}
+/** The auto-flatten trigger can never be configured looser than −10%. */
+export declare const AUTO_FLATTEN_RED_FLOOR = -0.1;
+/** Sanity bands for tenant limit fields. Values outside → field ignored,
+ *  previous value kept. Wide on purpose: these reject nonsense, not policy. */
+export declare const TENANT_LIMIT_BOUNDS: {
+    readonly maxPositionSize: {
+        readonly min: 1;
+        readonly max: 1000000000;
+    };
+    readonly maxOpenPositions: {
+        readonly min: 1;
+        readonly max: 100;
+    };
+    readonly maxGrossExposure: {
+        readonly min: 0.01;
+        readonly max: 20;
+    };
+    readonly maxPerTradeLoss: {
+        readonly min: 0.01;
+        readonly max: 10000000;
+    };
+};
+/** Finite number within [min, max], else null. */
+export declare function boundedNum(v: unknown, min: number, max: number): number | null;
+/**
+ * Validate a tenant drawdown-zone ladder. Returns null when acceptable, else
+ * a human-readable reason. Requirements: all finite; YELLOW ≤ 0 (zones are
+ * losses); strictly monotonic YELLOW > ORANGE > RED (a scrambled ladder would
+ * put the book straight into RED and auto-flatten it); RED no looser than
+ * AUTO_FLATTEN_RED_FLOOR.
+ */
+export declare function validateDrawdownLadder(t: DrawdownThresholds): string | null;
 export type DrawdownZone = 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
 /** State snapshot needed to compute equity. */
 export interface EquityState {
@@ -36,6 +78,12 @@ export interface RiskState {
     };
     regime?: string;
     realizedPnlToday?: number;
+    /** The tenant's configured limits (from intel `/api/trading-params`) — the
+     *  SAME numbers the plugin's pre-trade gate enforces. Omitted until the
+     *  first fetch lands, in which case DEFAULT_RISK_LIMITS applies. */
+    baseLimits?: RiskLimits;
+    /** The tenant's configured drawdown-zone boundaries. Omitted → fallback. */
+    drawdownThresholds?: DrawdownThresholds;
 }
 /** Result of computeRiskMetrics including pruned timestamp arrays. */
 export interface RiskMetricsResult {
@@ -51,7 +99,7 @@ export declare function computeVolFactor(state: {
 /** Apply volatility adjustment to base limits. Tightens position/exposure, leaves loss/rate unchanged. */
 export declare function applyVolatilityAdjustment(baseLimits: RiskLimits, volFactor: number): RiskLimits;
 /** Determine drawdown zone from drawdown ratio (e.g. -0.015 = -1.5%). */
-export declare function getDrawdownZone(drawdownRatio: number): DrawdownZone;
+export declare function getDrawdownZone(drawdownRatio: number, thresholds?: DrawdownThresholds): DrawdownZone;
 /** Human-readable message for a drawdown zone. */
 export declare function getDrawdownZoneMessage(zone: DrawdownZone, ratio: number): string;
 /**
@@ -80,6 +128,17 @@ export declare function countRecentEvents(timestamps: number[]): {
 };
 /**
  * Detect risk limit breaches from current metrics.
+ *
+ * ★ CRITICAL is reserved for the limits that are ACTUALLY ENFORCED — the
+ * tenant's trading params, which the plugin's `preTradeRiskCheck` rejects
+ * orders against (`plugin/src/risk/pre-trade-check.ts`). A red "Gate fail" on
+ * the dashboard must mean "the agent is being blocked right now".
+ *
+ * `advisoryLimits` carries the vol/regime-TIGHTENED view. Those multipliers
+ * live only in this file — no enforcer applies them — so they may raise a
+ * WARNING (amber, indication) but must never produce a CRITICAL. Conflating
+ * the two is what put a permanent red "Gate fail · Gross exposure 121%" on a
+ * live book whose 1.5x enforced limit was never even approached.
  */
 export declare function detectBreaches(metrics: {
     grossExposure: number;
@@ -88,7 +147,7 @@ export declare function detectBreaches(metrics: {
     dailyLoss?: number;
     ordersPerMinute: number;
     cancelsPerMinute: number;
-}, limits: RiskLimits): RiskBreach[];
+}, limits: RiskLimits, advisoryLimits?: RiskLimits): RiskBreach[];
 /**
  * Compute full risk metrics from a state snapshot.
  * Returns metrics + pruned timestamp arrays for the caller to store.