create-tradejs 3.1.21-beta.237 → 3.1.22-beta.238

package/README.md

@@ -18,6 +18,47 @@ npx create-tradejs my-trading-project
 
 Docker with the Compose plugin and Node.js 20.19 or newer are required.
 
+## Codex strategy skills
+
+Every generated project includes focused workflow skills in `.codex/skills`:
+
+- `$strategy-candidate-report` — show the latest selected candidate;
+- `$strategy-candidate-compare` — compare it with production;
+- `$strategy-improvement-plan` — produce a causal improvement plan;
+- `$strategy-improvement-research` — run a new bounded research lineage;
+- `$strategy-period-revalidate` — recheck frozen candidates on new data;
+- `$strategy-forward-start` — publish and start the latest eligible candidate
+  at `MAX_LOSS_VALUE=1`, or an explicitly named reproducible historical
+  candidate under a prospective-only operator authorization;
+- `$strategy-forward-status` — inspect prospective live evidence;
+- `$strategy-risk-scale` — change only `MAX_LOSS_VALUE` after an explicit
+  scaling request.
+
+Invoke one skill with one strategy name, for example:
+
+```text
+$strategy-forward-start MarketFlushReversal
+```
+
+Forward start is an explicit live rollout request. It still requires an exact
+deployment/account binding and a configured package publication and deployment
+workflow; the scaffolder does not invent production credentials or hosting.
+Operator-directed mode does not rewrite an old research verdict: it preserves
+the original selection and contrary evidence and requires positive full-period
+PnL, profit factor above 1, and checksum-verifiable configuration and charts.
+
+The generated files include `.codex/tradejs-skill-bundle.json`, which binds the
+installed skills to the canonical TradeJS bundle by SHA-256. To update only
+that managed bundle in an existing project, use an explicitly selected
+`create-tradejs` version:
+
+```bash
+npx create-tradejs@<approved-version> --update-skills .
+```
+
+The updater preserves unrelated custom skills and refuses to overwrite a
+managed file that no longer matches its installed checksum.
+
 ## License
 
 The `create-tradejs` scaffolder remains MIT-licensed. Generated projects

package/dist/index.js

@@ -35,16 +35,208 @@ __export(index_exports, {
   findAvailablePort: () => findAvailablePort,
   main: () => main,
   parseArgs: () => parseArgs,
-  scaffoldProject: () => scaffoldProject
+  scaffoldProject: () => scaffoldProject,
+  stageCanonicalSkillBundle: () => stageCanonicalSkillBundle,
+  updateProjectSkills: () => updateProjectSkills
 });
 module.exports = __toCommonJS(index_exports);
 var import_node_child_process = require("child_process");
+var import_node_crypto2 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_net = __toESM(require("net"));
+var import_node_path2 = __toESM(require("path"));
+
+// src/skillBundle.ts
 var import_node_crypto = require("crypto");
 var import_node_fs = require("fs");
-var import_node_net = __toESM(require("net"));
 var import_node_path = __toESM(require("path"));
+var PROJECT_SKILL_BUNDLE_MANIFEST = ".codex/tradejs-skill-bundle.json";
+var PROJECT_SKILL_NAMES = [
+  "strategy-candidate-report",
+  "strategy-candidate-compare",
+  "strategy-improvement-plan",
+  "strategy-improvement-research",
+  "strategy-period-revalidate",
+  "strategy-forward-start",
+  "strategy-forward-status",
+  "strategy-risk-scale"
+];
+var sha256 = (contents) => (0, import_node_crypto.createHash)("sha256").update(contents).digest("hex");
+var toProjectPath = (...parts) => import_node_path.default.posix.join(...parts);
+var readDirectory = (directory, projectDirectory, files) => {
+  for (const entry of (0, import_node_fs.readdirSync)(directory, { withFileTypes: true }).sort(
+    (left, right) => left.name.localeCompare(right.name)
+  )) {
+    const absolutePath = import_node_path.default.join(directory, entry.name);
+    const projectPath = toProjectPath(projectDirectory, entry.name);
+    if (entry.isDirectory()) {
+      readDirectory(absolutePath, projectPath, files);
+      continue;
+    }
+    if (!entry.isFile()) {
+      throw new Error(
+        `Skill bundle source must contain regular files: ${absolutePath}`
+      );
+    }
+    files[projectPath] = (0, import_node_fs.readFileSync)(absolutePath, "utf8");
+  }
+};
+var calculateBundleSha256 = (fileHashes) => sha256(
+  Object.entries(fileHashes).sort(([left], [right]) => left.localeCompare(right)).map(([filePath, fileSha256]) => `${filePath}\0${fileSha256}`).join("\n")
+);
+var createProjectSkillBundle = (canonicalSkillsRoot) => {
+  const files = {};
+  for (const skillName of PROJECT_SKILL_NAMES) {
+    const skillRoot = import_node_path.default.join(canonicalSkillsRoot, skillName);
+    if (!(0, import_node_fs.existsSync)(import_node_path.default.join(skillRoot, "SKILL.md"))) {
+      throw new Error(`Missing canonical skill: ${skillName}`);
+    }
+    readDirectory(
+      skillRoot,
+      toProjectPath(".codex", "skills", skillName),
+      files
+    );
+  }
+  const fileHashes = Object.fromEntries(
+    Object.entries(files).map(([filePath, contents]) => [
+      filePath,
+      sha256(contents)
+    ])
+  );
+  const manifest = {
+    schema: "tradejs-skill-bundle/v1",
+    source: "TradeJS-Dev/TradeJS:.codex/skills",
+    bundleSha256: calculateBundleSha256(fileHashes),
+    skills: [...PROJECT_SKILL_NAMES],
+    files: Object.fromEntries(
+      Object.entries(fileHashes).sort(
+        ([left], [right]) => left.localeCompare(right)
+      )
+    )
+  };
+  return {
+    manifest,
+    files: {
+      ...files,
+      [PROJECT_SKILL_BUNDLE_MANIFEST]: `${JSON.stringify(manifest, null, 2)}
+`
+    }
+  };
+};
+var readPackagedSkillBundle = (bundleRoot) => {
+  const files = {};
+  readDirectory(bundleRoot, "", files);
+  const manifestContents = files[PROJECT_SKILL_BUNDLE_MANIFEST];
+  if (!manifestContents) {
+    throw new Error(`Missing packaged ${PROJECT_SKILL_BUNDLE_MANIFEST}`);
+  }
+  const manifest = JSON.parse(manifestContents);
+  if (manifest.schema !== "tradejs-skill-bundle/v1" || manifest.source !== "TradeJS-Dev/TradeJS:.codex/skills" || JSON.stringify(manifest.skills) !== JSON.stringify(PROJECT_SKILL_NAMES) || manifest.bundleSha256 !== calculateBundleSha256(manifest.files)) {
+    throw new Error("Invalid packaged TradeJS skill bundle manifest");
+  }
+  const packagedFilePaths = Object.keys(files).filter((filePath) => filePath !== PROJECT_SKILL_BUNDLE_MANIFEST).sort();
+  if (JSON.stringify(packagedFilePaths) !== JSON.stringify(Object.keys(manifest.files).sort())) {
+    throw new Error("Packaged TradeJS skill bundle contains unbound files");
+  }
+  for (const [filePath, expectedSha256] of Object.entries(manifest.files)) {
+    const contents = files[filePath];
+    if (contents === void 0 || sha256(contents) !== expectedSha256) {
+      throw new Error(`Packaged TradeJS skill bundle mismatch: ${filePath}`);
+    }
+  }
+  return { files, manifest };
+};
+var writeProjectSkillBundle = (canonicalSkillsRoot, outputRoot) => {
+  const { files, manifest } = createProjectSkillBundle(canonicalSkillsRoot);
+  (0, import_node_fs.rmSync)(outputRoot, { recursive: true, force: true });
+  for (const [relativePath, contents] of Object.entries(files)) {
+    const destination = import_node_path.default.join(outputRoot, relativePath);
+    (0, import_node_fs.mkdirSync)(import_node_path.default.dirname(destination), { recursive: true });
+    (0, import_node_fs.writeFileSync)(destination, contents, "utf8");
+  }
+  return manifest;
+};
+var isManagedSkillPath = (relativePath) => {
+  const normalized = relativePath.replaceAll("\\", "/");
+  return normalized === PROJECT_SKILL_BUNDLE_MANIFEST || normalized.startsWith(".codex/skills/") && !normalized.includes("../") && !import_node_path.default.posix.isAbsolute(normalized);
+};
+var readInstalledManifest = (projectRoot) => {
+  const manifestPath = import_node_path.default.join(projectRoot, PROJECT_SKILL_BUNDLE_MANIFEST);
+  if (!(0, import_node_fs.existsSync)(manifestPath)) return null;
+  const manifest = JSON.parse(
+    (0, import_node_fs.readFileSync)(manifestPath, "utf8")
+  );
+  if (manifest.schema !== "tradejs-skill-bundle/v1") {
+    throw new Error(`Unsupported installed skill bundle: ${manifestPath}`);
+  }
+  return manifest;
+};
+var syncProjectSkillBundle = (projectRoot, bundleFiles) => {
+  if (!(0, import_node_fs.existsSync)(projectRoot) || !(0, import_node_fs.statSync)(projectRoot).isDirectory()) {
+    throw new Error(`Project directory does not exist: ${projectRoot}`);
+  }
+  const newManifest = JSON.parse(
+    bundleFiles[PROJECT_SKILL_BUNDLE_MANIFEST]
+  );
+  const installedManifest = readInstalledManifest(projectRoot);
+  for (const [relativePath, contents] of Object.entries(bundleFiles)) {
+    if (!isManagedSkillPath(relativePath)) {
+      throw new Error(`Unsafe managed skill path: ${relativePath}`);
+    }
+    const destination = import_node_path.default.resolve(projectRoot, relativePath);
+    if (!destination.startsWith(`${import_node_path.default.resolve(projectRoot)}${import_node_path.default.sep}`)) {
+      throw new Error(
+        `Managed skill path escapes the project: ${relativePath}`
+      );
+    }
+    if ((0, import_node_fs.existsSync)(destination) && relativePath !== PROJECT_SKILL_BUNDLE_MANIFEST) {
+      const currentContents = (0, import_node_fs.readFileSync)(destination, "utf8");
+      const installedSha256 = installedManifest?.files[relativePath];
+      const isKnownInstalledFile = installedSha256 !== void 0 && sha256(currentContents) === installedSha256;
+      if (!isKnownInstalledFile && currentContents !== contents) {
+        throw new Error(
+          `Refusing to overwrite a modified skill: ${relativePath}`
+        );
+      }
+    }
+  }
+  for (const [relativePath, installedSha256] of Object.entries(
+    installedManifest?.files ?? {}
+  )) {
+    if (newManifest.files[relativePath] !== void 0) continue;
+    if (!isManagedSkillPath(relativePath)) {
+      throw new Error(`Unsafe installed skill path: ${relativePath}`);
+    }
+    const obsoletePath = import_node_path.default.resolve(projectRoot, relativePath);
+    if (!(0, import_node_fs.existsSync)(obsoletePath)) continue;
+    const contents = (0, import_node_fs.readFileSync)(obsoletePath);
+    if (sha256(contents) !== installedSha256) {
+      throw new Error(
+        `Refusing to remove a modified obsolete skill: ${relativePath}`
+      );
+    }
+    (0, import_node_fs.rmSync)(obsoletePath);
+  }
+  for (const [relativePath, contents] of Object.entries(bundleFiles)) {
+    const destination = import_node_path.default.join(projectRoot, relativePath);
+    (0, import_node_fs.mkdirSync)(import_node_path.default.dirname(destination), { recursive: true });
+    (0, import_node_fs.writeFileSync)(destination, contents, "utf8");
+  }
+  return newManifest;
+};
+
+// src/index.ts
 var DEFAULT_PROJECT_NAME = "tradejs-project";
 var DEFAULT_PORT = 3e3;
+var PACKAGED_SKILL_BUNDLE_ROOT = import_node_path2.default.resolve(__dirname, "skill-bundle");
+var CANONICAL_SKILLS_ROOT = import_node_path2.default.resolve(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  ".codex",
+  "skills"
+);
 var DEFAULT_INFRASTRUCTURE_PORTS = {
   postgres: 5432,
   redis: 6379,
@@ -62,6 +254,7 @@ Options:
   --no-infra       Skip Docker infrastructure and onboarding seed
   --no-start       Do not start the Web UI
   --no-open        Do not open a browser
+  --update-skills  Update only the managed TradeJS skill bundle in an existing project
   -h, --help       Show this help`);
 };
 var readOptionValue = (argv, index) => {
@@ -78,6 +271,7 @@ var parseArgs = (argv) => {
   let start = true;
   let open = true;
   let port = DEFAULT_PORT;
+  let updateSkills = false;
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (arg === "-h" || arg === "--help") {
@@ -101,6 +295,10 @@ var parseArgs = (argv) => {
       open = false;
       continue;
     }
+    if (arg === "--update-skills") {
+      updateSkills = true;
+      continue;
+    }
     if (arg === "--port") {
       port = Number(readOptionValue(argv, index));
       index += 1;
@@ -124,20 +322,35 @@ var parseArgs = (argv) => {
   if (!install && (infra || start)) {
     throw new Error("--no-install cannot start infrastructure or the Web UI");
   }
+  if (updateSkills) {
+    install = false;
+    infra = false;
+    start = false;
+    open = false;
+  }
   return {
-    targetDir: targetDir || DEFAULT_PROJECT_NAME,
+    targetDir: targetDir || (updateSkills ? "." : DEFAULT_PROJECT_NAME),
     install,
     infra,
     start,
     open,
-    port
+    port,
+    updateSkills
   };
 };
 var packageNameFromDir = (targetDir) => {
-  const normalized = import_node_path.default.basename(targetDir).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  const normalized = import_node_path2.default.basename(targetDir).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
   return normalized || DEFAULT_PROJECT_NAME;
 };
-var createAuthSecret = () => (0, import_node_crypto.randomBytes)(32).toString("hex");
+var createAuthSecret = () => (0, import_node_crypto2.randomBytes)(32).toString("hex");
+var readProjectSkillBundle = () => (0, import_node_fs2.existsSync)(
+  import_node_path2.default.join(
+    PACKAGED_SKILL_BUNDLE_ROOT,
+    ".codex",
+    "tradejs-skill-bundle.json"
+  )
+) ? readPackagedSkillBundle(PACKAGED_SKILL_BUNDLE_ROOT) : createProjectSkillBundle(CANONICAL_SKILLS_ROOT);
+var stageCanonicalSkillBundle = () => writeProjectSkillBundle(CANONICAL_SKILLS_ROOT, PACKAGED_SKILL_BUNDLE_ROOT);
 var buildProjectFiles = (targetDir, port, infrastructurePorts = DEFAULT_INFRASTRUCTURE_PORTS) => {
   const packageName = packageNameFromDir(targetDir);
   const authSecret = createAuthSecret();
@@ -207,21 +420,40 @@ npm run dev
 
 Open [http://localhost:${port}/routes/dashboard](http://localhost:${port}/routes/dashboard).
 On the first launch, TradeJS asks you to create the local root password.
-`
+
+## Codex strategy workflow
+
+The project includes focused TradeJS skills under \`.codex/skills\`. Invoke a
+skill with a strategy name, for example:
+
+\`$strategy-candidate-report MarketFlushReversal\`
+
+Use \`$strategy-forward-start <Strategy>\` only when you want Codex to publish
+and launch the selected candidate as a bounded forward test. It installs the
+exact candidate configuration with \`MAX_LOSS_VALUE=1\` and requires an exact
+deployment/account binding.
+`,
+    ...readProjectSkillBundle().files
   };
 };
 var scaffoldProject = (targetDir, port, infrastructurePorts = DEFAULT_INFRASTRUCTURE_PORTS) => {
-  const absoluteTarget = import_node_path.default.resolve(targetDir);
-  if ((0, import_node_fs.existsSync)(absoluteTarget) && (0, import_node_fs.readdirSync)(absoluteTarget).length > 0) {
+  const absoluteTarget = import_node_path2.default.resolve(targetDir);
+  if ((0, import_node_fs2.existsSync)(absoluteTarget) && (0, import_node_fs2.readdirSync)(absoluteTarget).length > 0) {
     throw new Error(`Target directory is not empty: ${absoluteTarget}`);
   }
-  (0, import_node_fs.mkdirSync)(absoluteTarget, { recursive: true });
+  (0, import_node_fs2.mkdirSync)(absoluteTarget, { recursive: true });
   const files = buildProjectFiles(absoluteTarget, port, infrastructurePorts);
   for (const [relativePath, contents] of Object.entries(files)) {
-    (0, import_node_fs.writeFileSync)(import_node_path.default.join(absoluteTarget, relativePath), contents, "utf8");
+    const destination = import_node_path2.default.join(absoluteTarget, relativePath);
+    (0, import_node_fs2.mkdirSync)(import_node_path2.default.dirname(destination), { recursive: true });
+    (0, import_node_fs2.writeFileSync)(destination, contents, "utf8");
   }
   return absoluteTarget;
 };
+var updateProjectSkills = (targetDir) => {
+  const absoluteTarget = import_node_path2.default.resolve(targetDir);
+  return syncProjectSkillBundle(absoluteTarget, readProjectSkillBundle().files);
+};
 var run = (command, args, cwd) => {
   const result = (0, import_node_child_process.spawnSync)(command, args, {
     cwd,
@@ -237,7 +469,7 @@ var run = (command, args, cwd) => {
     );
   }
 };
-var localBin = (projectDir, name) => import_node_path.default.join(
+var localBin = (projectDir, name) => import_node_path2.default.join(
   projectDir,
   "node_modules",
   ".bin",
@@ -345,6 +577,13 @@ var main = async () => {
     printUsage();
     return;
   }
+  if (options.updateSkills) {
+    const manifest = updateProjectSkills(options.targetDir);
+    console.log(
+      `Updated TradeJS skill bundle ${manifest.bundleSha256} in ${import_node_path2.default.resolve(options.targetDir)}`
+    );
+    return;
+  }
   const infrastructurePorts = options.infra ? {
     postgres: await findAvailablePort(5432),
     redis: await findAvailablePort(6379),
@@ -396,5 +635,7 @@ create-tradejs failed: ${error.message}`);
   findAvailablePort,
   main,
   parseArgs,
-  scaffoldProject
+  scaffoldProject,
+  stageCanonicalSkillBundle,
+  updateProjectSkills
 });

package/dist/skill-bundle/.codex/skills/strategy-candidate-compare/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: strategy-candidate-compare
+description: Compare one TradeJS strategy’s latest selected best candidate with the exact composition currently deployed or configured for production on a common evidence scope. Use for candidate-vs-production questions; do not tune, publish, deploy, or change risk.
+---
+
+# Strategy Candidate Compare
+
+Require one exact strategy name.
+
+## Boundary
+
+This is a read-only comparison. Do not edit source/config, select new
+parameters, publish, deploy, or alter orders. A single cache-only bridge run is
+allowed only when the two frozen compositions lack a valid common-scope result;
+it must not change either composition.
+
+## Resolve both identities
+
+1. Resolve the latest explicitly selected, reproducible candidate using the
+   same rules as `$strategy-candidate-report`.
+2. Resolve production from the deployed package manifest and Git-owned
+   `tradejs.config.ts`, including effective defaults, package lock, deterministic
+   gate, runtime context, `strategyRevision`, and `deploymentCompositionId`.
+   Redis backtest configs and legacy strategy keys are not production truth.
+3. If live evidence is unavailable, use the newest immutable deployment
+   manifest and label production identity as unconfirmed rather than guessing.
+
+## Make the comparison fair
+
+Use the maximum common timestamp range, point-in-time universe, symbols,
+interval, fees, slippage, entry delay, risk unit, and execution assumptions.
+Normalize PnL and drawdown per unit of `MAX_LOSS_VALUE` when production and the
+candidate use different risk. Never compare raw money at different sizing as
+strategy quality.
+
+If a bridge is necessary, freeze the comparison before running it, use cached
+history, run both exact compositions, and record the new run as evaluation—not
+optimization. Do not inspect one result and alter the other.
+
+## Output
+
+Show side-by-side absolute values and candidate-minus-production deltas for
+ALL/LONG/SHORT across full/max coverage and continuous 365d/180d/90d/30d/7d
+windows, plus 3y/4y/5y-or-max when covered. Include `N`, net PnL, expectancy,
+PF, win rate, Sharpe/PSR/DSR, MaxDD, worst trade, loss streak, losing-month
+streak, recovery, cadence, stability, concentration, and cost stress.
+
+Conclude with:
+
+- identity/parity confidence;
+- what improved, regressed, or remains underpowered;
+- whether the candidate remains the selected best candidate under the frozen
+  objective;
+- one exact next action. Do not launch it from this skill.

package/dist/skill-bundle/.codex/skills/strategy-candidate-report/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: strategy-candidate-report
+description: Show the latest selected best candidate for one TradeJS strategy, including exact lineage, configuration, gate, freshness, chart, and professional risk-adjusted metrics. Use for “show the best candidate” or “latest candidate metrics”; do not run new research or change runtime state.
+---
+
+# Strategy Candidate Report
+
+Require one exact strategy name. Work from the TradeJS project that owns
+`tradejs.config.ts`, `data/`, and research evidence.
+
+## Boundary
+
+This is a reporting skill. Do not edit strategy source or configuration, start
+backtests, publish packages, change `tradejs.config.ts`, or mutate a runtime.
+Creating a report or chart under `output/` is allowed.
+
+## Select the candidate
+
+1. Find the newest completed research lineage that explicitly selected a best
+   candidate and has checksum-verifiable evidence. Do not equate newest file,
+   largest PnL, an incomplete run, or an old production config with “best.”
+2. Prefer a verified strategy-release/candidate manifest. If evidence exists
+   only in notes, require the exact source SHA, resolved config, gate identity,
+   data bounds, costs, and artifact hashes before calling it reproducible.
+3. If there is no selected reproducible candidate, say so. Show the strongest
+   known evidence separately, but do not silently promote it.
+
+## Report
+
+Show:
+
+- candidate ID, selection time, research ID, source/package revision, dirty
+  state, core config, deterministic gate and direction policy;
+- data start/end, universe provenance, fees/slippage, train/discovery/test
+  exposure, and the newest evaluated candle;
+- ALL, LONG, and SHORT rows for full/max coverage plus available continuous
+  3y, 4y, 5y-or-max, 365d, 180d, 90d, 30d, and 7d windows;
+- `N`, net PnL, PnL/trade, PF, win rate, Sharpe, probabilistic/deflated Sharpe
+  when available, realized MaxDD, worst trade, maximum loss streak, maximum
+  losing-month streak, recovery duration, and cadence;
+- walk-forward/fold and regime stability, concentration, cost stress, and all
+  recorded limitations or failed checks;
+- a stored equity/drawdown chart, or rebuild the chart only from the frozen
+  candidate trades and label it as report rendering rather than new evidence.
+
+Classify every window by independent support: fewer than 20 events is
+underpowered, 20–49 is diagnostic, and 50+ is selection-grade. A zero-trade or
+sparse 7d/30d row must remain visible, but it is not a standalone veto and does
+not imply that anyone must wait for a calendar deadline.
+
+Finish with one exact next skill: compare, plan, revalidate, or forward-start.

package/dist/skill-bundle/.codex/skills/strategy-forward-start/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: strategy-forward-start
+description: Publish and start one exact TradeJS strategy candidate as a bounded production forward test with MAX_LOSS_VALUE=1. Supports either the latest eligible best candidate or a checksum-reproducible historically promising candidate that the user explicitly names for prospective-only learning. Use only when the user explicitly asks to launch the forward test.
+---
+
+# Strategy Forward Start
+
+Require one exact strategy name. Invocation of this skill is authorization to
+roll out only that strategy at `MAX_LOSS_VALUE=1`. By default, use its latest
+checksum-verified, forward-eligible best candidate. If the user explicitly
+names a different historically promising candidate and requests a production
+forward test, use the operator-directed prospective mode below. Neither mode is
+authorization to retune the candidate, increase risk, or touch unrelated
+strategies.
+
+## Operator-directed prospective mode
+
+An explicitly named candidate may proceed even when an immutable research
+artifact selected another candidate, marked runtime mutation as disallowed, or
+reported a sparse, flat, or negative recent diagnostic cohort. These facts
+remain visible diagnostics; they are not by themselves blockers for collecting
+new prospective evidence at risk 1.
+
+Use this mode only when all of the following are true:
+
+- the user names the exact strategy and candidate and explicitly authorizes its
+  production forward test with `MAX_LOSS_VALUE=1`;
+- the exact expression, direction policy, effective core configuration, source
+  and data lineage, and evidence hashes are reproducible without new tuning;
+- the maximum-covered historical window has positive net PnL and profit factor
+  above 1, and its full-period metrics and chart remain available;
+- a new immutable operator-authorization artifact references the original
+  selection/freeze and the contrary or underpowered evidence; and
+- the artifact states that the rollout is prospective-only and does not rewrite
+  the old verdict or upgrade the candidate to historically validated.
+
+Do not edit an old freeze, selection, progress, decision, or research verdict
+to manufacture eligibility. Implement a research-only expression in the owned
+strategy package before release, with focused tests that lock the exact
+behavior.
+
+## Preconditions
+
+Resolve the exact runtime user, deployment, account, connector, symbols, and
+release mechanism from Git-owned project/deployment configuration. Resolve the
+candidate’s source SHA, package version, lockfile boundary, full effective core
+config, deterministic gate/context, direction policy, evidence hashes, and
+either standard forward eligibility or the immutable operator authorization.
+Do not infer production from Redis.
+
+Stop before mutation if the target binding is ambiguous, credentials/registry
+authorization is missing, the candidate is not reproducible or implementable,
+the maximum-covered historical edge is non-positive, required evidence/chart
+hashes are missing, required checks fail, another rollout is active, or safe
+atomic deployment is unavailable. These are operational or falsifiability
+boundaries and operator-directed mode does not waive them. Give the exact
+command or UI boundary the user must complete; never start an interactive
+authentication flow.
+
+## Release and configure
+
+1. Re-run source package checks at the selected commit. If the candidate uses
+   unpublished source, commit and push the complete accumulated release range,
+   publish one immutable stable package through the repository’s existing
+   release workflow, and verify the registry artifact. Do not cherry-pick only
+   one fix out of an accumulated unshipped range.
+2. Install the exact package version in the Project and commit the lockfile.
+3. Write the candidate’s complete reviewed configuration to the selected
+   deployment in the Git-owned Project runtime configuration and force
+   `MAX_LOSS_VALUE=1`:
+   - if the strategy is absent, add and enable it;
+   - if it runs a different composition, replace that strategy declaration in
+     one guarded cutover while preserving unrelated strategies;
+   - if the exact composition already runs at risk 1, make no config change and
+     continue with idempotent verification.
+4. Run strict Project checks and runtime-control verification. Commit and push
+   the complete Project release range, publish/deploy its exact immutable tip
+   through the configured production workflow, and wait for the deployment
+   handoff to finish.
+
+## Verify the forward test
+
+Confirm the deployed package/config manifest, `strategyRevision`,
+`deploymentCompositionId`, account binding, enabled strategy, risk value,
+heartbeat, and that exactly one managed runtime process owns the deployment.
+Verify that the configured runtime actually permits bounded order placement;
+signal-only evaluation is not a started forward test.
+
+Never place, cancel, or close an order manually and never launch an unmanaged
+background daemon. Do not wait for profitable 7d/30d/180d tails: forward
+learning starts immediately at risk 1. Return the authorization mode and
+artifact, preserved contrary evidence, commits, package version, deployment
+identity, exact config diff, verification evidence, monitoring command, and
+rollback/stop procedure.

package/dist/skill-bundle/.codex/skills/strategy-forward-status/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: strategy-forward-status
+description: Inspect the live status and evidence of one TradeJS strategy’s forward test, including deployed identity, parity, orders, normalized performance, drawdown, execution quality, and whether the test is still informative. Read-only; does not scale, stop, or deploy.
+---
+
+# Strategy Forward Status
+
+Require one exact strategy name and resolve the exact runtime user/deployment.
+
+## Boundary
+
+This skill is read-only. Do not edit source/config, pause/resume, place/cancel
+orders, scale risk, publish, or deploy. Missing local Redis keys are not proof
+that production did not run; prefer immutable runtime evidence from the target
+deployment.
+
+## Inspect
+
+Verify the deployed manifest, package version, full effective config,
+`strategyRevision`, `deploymentCompositionId`, account/connector/symbol binding,
+`MAX_LOSS_VALUE`, heartbeat, and single-process ownership. Compare all of them
+with the selected candidate manifest and classify exact match, explainable
+drift, or invalid forward evidence.
+
+Collect runtime evidence and reconcile signal → gate decision → order → fill →
+exit. Report:
+
+- independent closed positions, open exposure, cadence, and elapsed market
+  coverage;
+- PnL and drawdown normalized by the candidate risk unit;
+- expectancy, PF, win rate, Sharpe when meaningful, worst loss, current and
+  maximum loss streak, losing-month streak, and recovery;
+- fees, slippage, rejects, latency, partial fills, missed/duplicate decisions,
+  parity mismatches, symbol/regime concentration, and historical-envelope
+  utilization;
+- prospective evidence only—never merge live observations back into the
+  historical selection sample.
+
+Classify the forward test as `RUNNING_INFORMATIVE`, `RUNNING_UNDERPOWERED`,
+`PAUSED_OR_STOPPED`, `COMPOSITION_DRIFT`, or `EXECUTION_INVALID`. Calendar age
+alone is not success or failure; weight the number and diversity of independent
+events. Finish with one exact recommendation: keep collecting, diagnose via a
+new research task, stop through the deployment runbook, or invoke
+`$strategy-risk-scale`.

package/dist/skill-bundle/.codex/skills/strategy-improvement-plan/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: strategy-improvement-plan
+description: Analyze how one TradeJS strategy could be improved from its source, latest candidate, production comparison, traces, and rejected hypotheses. Use for an opportunity map or research plan; do not run experiments, edit code, or change production.
+---
+
+# Strategy Improvement Plan
+
+Require one exact strategy name. Read the strategy repository rules, source,
+tests, latest selected candidate, production composition, prior candidate
+ledger, rejection reasons, and available signal-to-exit traces.
+
+## Boundary
+
+This skill produces a causal research plan only. Do not run backtests or gate
+searches, edit source, create a new candidate, publish, deploy, or change risk.
+
+## Analysis
+
+Reconstruct the market thesis and map evidence across:
+
+- setup formation and point-in-time data quality;
+- entry timing, direction policy, and regime dependence;
+- stop/target geometry, payoff asymmetry, and worst-loss mechanics;
+- position lifecycle, shared occupancy, cooldown, and exits;
+- deterministic gate precision, rejection coverage, and missing context;
+- symbol/time concentration, capacity, fees, slippage, and execution parity.
+
+Do not recommend generic threshold grids. For every proposed change state the
+mechanism, exact source/config seam, predicted trade-identity and metric effect,
+minimum falsifying observation, affected side/regime, and overfit risk.
+
+## Professional objective
+
+Rank hypotheses hierarchically:
+
+1. causal validity, trace reconciliation, and absence of leakage;
+2. positive out-of-sample expectancy per risk after costs with enough
+   independent support;
+3. Sharpe/PSR/DSR, drawdown/tail loss, recovery, loss streaks, and losing-month
+   streaks;
+4. walk-forward/regime stability, concentration, cost robustness, and
+   executable cadence;
+5. full-period PnL and win rate as economic diagnostics, never sole targets.
+
+Recent 7d/30d/180d rows describe the current regime with support-aware weight;
+they are not mandatory profit gates when sparse. Avoid objectives that improve
+Sharpe or win rate by suppressing almost all trades.
+
+Return an ordered plan with one exploit hypothesis, one repair hypothesis, one
+explore/falsify hypothesis, frozen evaluation criteria, expected cost, and the
+exact invocation of `$strategy-improvement-research`.

package/dist/skill-bundle/.codex/skills/strategy-improvement-research/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: strategy-improvement-research
+description: Conduct a new bounded professional research lineage to improve one TradeJS strategy’s core and deterministic gate, revalidating prior candidates first and continuing beyond audits or failed first rounds until a reproducible best candidate is frozen. Does not publish or change production.
+---
+
+# Strategy Improvement Research
+
+Require one exact strategy name. Run operational commands from the TradeJS
+project. Before applying candidate source edits, create one dedicated strategy
+worktree per immutable research lineage from the exact frozen production or
+control SHA. Keep the canonical strategy checkout clean, run source edits and
+checks in the worktree, and set `PROJECT_CWD` to the canonical Project and
+`TRADEJS_SOURCE_REPOSITORY_ROOT` to the exact worktree. If the task is already
+scoped to a dedicated worktree, validate and reuse it instead of nesting
+another one. A lineage that only re-scores existing artifacts and makes no
+source edits does not need a worktree.
+
+## Source isolation
+
+- Inspect the owning repository's worktree list and verify the frozen baseline
+  SHA before creating or reusing the lineage worktree. Do not use an unrelated
+  old worktree, scratch directory, generated artifact, or clone as the source
+  root.
+- Evaluate candidates sequentially in the same lineage worktree. Before
+  replacing a rejected candidate, freeze its exact source diff, build hash,
+  resolved config, run lineage, and outcome in Project-owned immutable
+  evidence, then restore only that disposable worktree to the frozen baseline.
+- Keep any temporary Project package overlay explicit and restore it to the
+  verified stable package after each candidate or before handoff. A source
+  worktree does not isolate `TradeJS-Project/node_modules`.
+- If no new candidate is selected, verify the canonical checkout was never
+  changed and remove the disposable worktree only after all evidence is
+  frozen. If a candidate is selected, commit only that candidate and its tests
+  on the worktree branch and hand off the exact commit SHA; do not retain
+  rejected behavior as source commits.
+
+## Authority boundary
+
+You may refresh research artifacts, run cache-backed research, edit strategy
+core/gate/tests, and commit the selected source candidate locally. Do not push,
+publish packages, edit the Project’s production composition, deploy, start a
+forward test, or change live risk. Those belong to `$strategy-forward-start`.
+
+## Required contour
+
+1. Start a new immutable research lineage. Freeze data bounds, point-in-time
+   universe, symbols, interval, fees/slippage, execution assumptions, risk
+   normalization, objective, holdout exposure, and trial ledger.
+2. Inventory and deduplicate prior production and research candidates. Re-score
+   compatible candidates and exact-bridge any plausibly competitive
+   incompatible candidate on the new common period before inventing changes.
+   Old winners are competitors, not automatic controls and not erased.
+3. Reconstruct the market thesis and opportunity map. Select at least three
+   distinct causal families: exploit, repair, and explore/falsify.
+4. Evaluate one preregistered candidate per family. Continue viable families
+   with evidence-driven children and use remaining slots for direction-policy
+   or Pareto rescue. The default cap is 12 genuinely new behaviors. An audit,
+   parser fix, no-op, or rescoring of an old behavior does not consume a slot.
+5. Do not stop at the audit, baseline, first failed round, or a sparse recent
+   tail. Stop only when a reproducible best candidate is frozen, the fresh
+   budget is exhausted, or every remaining family has a recorded hard causal
+   blocker.
+6. Keep one chronological tail sealed during discovery when coverage permits.
+   Open it once for the final selected behavior. Track all exposed tests for
+   multiple-testing/deflated-Sharpe interpretation.
+7. Run package formatting, typecheck, tests, and build in the lineage worktree.
+   Commit only the selected candidate and its tests on that worktree branch;
+   preserve rejected experiments as immutable evidence, not source clutter.
+
+## Selection objective
+
+First require causal/reconciliation validity and positive aggregate
+out-of-sample expectancy per risk after costs. Then rank by probabilistic or
+deflated Sharpe, realized MaxDD/tail/recovery, worst loss and loss streaks,
+losing-month streak, fold/regime stability, concentration, cost robustness,
+and cadence. Full-period PnL, win rate, and 7d/30d/180d profitability are
+diagnostics, not standalone optimization targets. Classify window support as
+underpowered below 20 events, diagnostic at 20–49, and selection-grade at 50+.
+
+## Handoff
+
+Create or update the existing checksum-verified strategy-release/candidate
+manifest rather than inventing a second pointer format. Freeze candidate ID,
+source/package SHA, full resolved core config, deterministic gate/context,
+direction policy, evidence hashes, trial count, metric matrix, chart, freshness,
+limitations, and forward-test eligibility. End with the selected candidate,
+why it beat production and prior candidates, and exactly one next skill.

package/dist/skill-bundle/.codex/skills/strategy-period-revalidate/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: strategy-period-revalidate
+description: Re-evaluate one TradeJS strategy’s production composition and strongest prior candidates on a newly extended common period without retuning them. Use when new market data is available or old candidates must be revalidated under the current metric objective.
+---
+
+# Strategy Period Revalidate
+
+Require one exact strategy name and use the TradeJS project as the evidence
+root.
+
+## Boundary
+
+This is frozen-behavior evaluation. Do not alter strategy logic, gate rules,
+parameters, direction policy, or runtime state after seeing the new period. Do
+not publish or deploy. A configuration change belongs to a new
+`$strategy-improvement-research` lineage.
+
+## Cohort
+
+Include the exact current production composition, latest selected best
+candidate, strongest prior aggregate candidate, strongest side-specific
+candidate when distinct, and any currently running forward candidate. Deduplicate
+identical core/gate/context behavior. Record why any plausible prior candidate
+cannot be reproduced.
+
+## Run
+
+1. Freeze the new common end time, maximum common start, point-in-time universe,
+   costs, execution assumptions, and candidate identities before evaluation.
+2. Use existing cached history first. If the requested new tail is absent,
+   fetch only that missing tail through the supported TradeJS data path, then
+   fingerprint the resulting coverage; never silently rewrite old history.
+3. Evaluate all frozen candidates on identical scopes. Do not eliminate a
+   candidate after one window and do not tune against the new observations.
+4. Recompute ALL/LONG/SHORT full/max, 3y/4y/5y-or-max, 365d, 180d, 90d, 30d,
+   and 7d rows where covered, including zero-activity rows. Report PnL/risk,
+   PF, expectancy, win rate, Sharpe/PSR/DSR, MaxDD, worst loss, loss streak,
+   losing-month streak, recovery, cadence, stability, concentration, and cost
+   stress.
+5. Weight recent windows by independent support: below 20 underpowered, 20–49
+   diagnostic, 50+ selection-grade. Never require waiting 7, 30, or 180
+   calendar days merely to obtain a verdict.
+
+Update the immutable comparison evidence and candidate freshness without
+rewriting the original selection record. State whether the incumbent remains
+best under the frozen objective and choose exactly one next skill: report,
+research, forward-start, forward-status, or risk-scale.

package/dist/skill-bundle/.codex/skills/strategy-risk-scale/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: strategy-risk-scale
+description: Increase MAX_LOSS_VALUE for a currently running TradeJS forward strategy while preserving the exact core, gate, context, direction policy, package, and deployment composition. Use only after explicit user instruction to increase risk; never switch candidates or wait for fixed calendar tails.
+---
+
+# Strategy Risk Scale
+
+Require one exact strategy name. Invocation authorizes one bounded risk step
+for the currently deployed composition only.
+
+## Invariants
+
+Freeze and verify source/package revision, full config, deterministic gate and
+context, direction policy, universe, connector/account, deployment, and current
+`strategyRevision`/`deploymentCompositionId`. Apart from `MAX_LOSS_VALUE`, all
+strategy behavior must remain identical. If anything else differs, stop and
+route to `$strategy-forward-start` or `$strategy-improvement-research`.
+
+Do not use “7 profitable days” or “wait 30 days” as a generic gate. Use the
+candidate’s preregistered event-driven scaling policy. If none exists, require
+enough independent closed positions to estimate expectancy and drawdown,
+positive after-cost normalized expectancy, execution/parity integrity,
+acceptable slippage and concentration, and normalized drawdown/tail losses
+inside the frozen historical stress envelope. Treat fewer than 20 independent
+events as underpowered and 20–49 as diagnostic unless unusually strong
+strategy-specific evidence justifies the recorded exception.
+
+## Scale
+
+1. Produce a read-only forward status and scaling decision first. Refuse the
+   step on composition drift, execution-invalid evidence, unresolved critical
+   parity errors, breached loss envelope, or missing deployment binding.
+2. Increase risk by only one preregistered step, never more than 2× the current
+   value and never above the candidate’s approved cap.
+3. Change only `MAX_LOSS_VALUE` in Git-owned `tradejs.config.ts`. Run strict
+   checks, commit and push the complete Project release range, publish/deploy
+   the exact immutable tip through the existing workflow, and verify the new
+   deployment atomically.
+4. Record a risk-scale marker linking old/new values and deployment identities;
+   keep historical and live performance normalized to a common risk unit.
+
+Never place, cancel, or close orders manually and never start an unmanaged
+daemon. Return the evidence decision, old/new risk, Project commit, deployment
+identity, verification, monitoring threshold, and rollback condition.

package/dist/skill-bundle/.codex/tradejs-skill-bundle.json

@@ -0,0 +1,25 @@
+{
+  "schema": "tradejs-skill-bundle/v1",
+  "source": "TradeJS-Dev/TradeJS:.codex/skills",
+  "bundleSha256": "61f0c85bbb29614ba43d447e808c9321fac85aad391f707ff18f0d51fcaace65",
+  "skills": [
+    "strategy-candidate-report",
+    "strategy-candidate-compare",
+    "strategy-improvement-plan",
+    "strategy-improvement-research",
+    "strategy-period-revalidate",
+    "strategy-forward-start",
+    "strategy-forward-status",
+    "strategy-risk-scale"
+  ],
+  "files": {
+    ".codex/skills/strategy-candidate-compare/SKILL.md": "34dbca2c77ce74836f5c264131cefb751313147128ab1c3f947002f975be051c",
+    ".codex/skills/strategy-candidate-report/SKILL.md": "3cad1241ce2107d7e30a5d78eafd6429514a10d1a8e9cf3d0e97ffef9d691ab6",
+    ".codex/skills/strategy-forward-start/SKILL.md": "1591bd1c64864283320793b3c0bb4e1677aab960951ef8b487a1101ca7b6f82c",
+    ".codex/skills/strategy-forward-status/SKILL.md": "b41f117680259fd7b4d5cbe3c0a1be75a42f08c8cf78f9ad7ccb0d90bfc66269",
+    ".codex/skills/strategy-improvement-plan/SKILL.md": "f5f0f390941dd3332890a2f0ffae1248abde4925db2cf49a41c0c0c1b47e7864",
+    ".codex/skills/strategy-improvement-research/SKILL.md": "38fe575954db303dc28763432b2bbc7bc07054adb56196810f15490755a75f76",
+    ".codex/skills/strategy-period-revalidate/SKILL.md": "f367ba1c632506a7d9bf92662a40b61df55f7a56ad04f3600a475b3c365bbbcb",
+    ".codex/skills/strategy-risk-scale/SKILL.md": "2c07846c9da2fd622ea6f5586c42863fc27b35a7d1d00614d5bbe0719da4d39f"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-tradejs",
-  "version": "3.1.21-beta.237",
+  "version": "3.1.22-beta.238",
   "description": "Create a ready-to-run TradeJS project with local infrastructure and the Web UI.",
   "keywords": [
     "tradejs",
@@ -33,7 +33,8 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node ./scripts/stage-skill-bundle.mjs",
+    "prepack": "yarn build",
     "typecheck": "tsc -p ./tsconfig.json --noEmit"
   },
   "devDependencies": {