tradingcodex 0.1.0__py3-none-any.whl

tradingcodex_service/application/audit.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from tradingcodex_service.application.common import append_jsonl, now_iso, stable_hash
+from tradingcodex_service.application.runtime import ensure_runtime_database, workspace_context_payload
+
+def write_audit_event(workspace_root: Path | str, event: dict[str, Any], principal_id: str = "system", source: str = "service") -> dict[str, Any]:
+    root = Path(workspace_root)
+    record = {"ts": now_iso(), "event": event}
+    append_jsonl(root / "trading" / "audit" / "tradingcodex-mcp.jsonl", record)
+    write_audit_event_if_available(root, principal_id, source, event)
+    return {"written": True, "db_canonical": True, "export_path": "trading/audit/tradingcodex-mcp.jsonl", "workspace_context": workspace_context_payload(root)}
+
+def write_audit_event_if_available(
+    workspace_root_or_principal: Path | str | None,
+    principal_id_or_source: str,
+    source_or_event: str | dict[str, Any],
+    event: dict[str, Any] | None = None,
+) -> None:
+    if event is None:
+        workspace_root = None
+        principal_id = str(workspace_root_or_principal)
+        source = str(principal_id_or_source)
+        event = source_or_event if isinstance(source_or_event, dict) else {}
+    else:
+        workspace_root = workspace_root_or_principal
+        principal_id = str(principal_id_or_source)
+        source = str(source_or_event)
+    try:
+        if workspace_root is not None:
+            ensure_runtime_database(workspace_root)
+        from apps.audit.models import AuditEvent
+
+        AuditEvent.objects.create(
+            actor_principal=principal_id,
+            source=source,
+            action=str(event.get("type") or event.get("action") or "event"),
+            resource=str(event.get("resource") or event.get("payload", {}).get("order_intent_id") or ""),
+            decision=str(event.get("decision") or event.get("payload", {}).get("status") or "recorded"),
+            request_hash=stable_hash(event),
+            result_hash=stable_hash(event.get("payload", event)),
+            workspace_context=workspace_context_payload(workspace_root),
+            payload=event,
+        )
+    except Exception:
+        return
+
+
+def write_policy_decision_if_available(workspace_root_or_result: Path | str | dict[str, Any] | None, result: dict[str, Any] | None = None) -> None:
+    workspace_root = None
+    if result is None:
+        result = workspace_root_or_result if isinstance(workspace_root_or_result, dict) else {}
+    else:
+        workspace_root = workspace_root_or_result
+    try:
+        if workspace_root is not None:
+            ensure_runtime_database(workspace_root)
+        from apps.policy.models import PolicyDecision
+
+        PolicyDecision.objects.create(
+            principal_id=result["principal_id"],
+            action=result["action"],
+            resource=result.get("resource") or "",
+            decision=result["decision"],
+            reasons=result["reasons"],
+            workspace_context=workspace_context_payload(workspace_root),
+        )
+    except Exception:
+        return

tradingcodex_service/application/common.py

@@ -0,0 +1,88 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+def now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def stable_hash(value: Any) -> str:
+    return hashlib.sha256(json.dumps(value, sort_keys=True, default=str).encode("utf-8")).hexdigest()
+
+
+def sanitize_id(value: Any) -> str:
+    return re.sub(r"[^A-Za-z0-9._-]+", "-", str(value)).strip("-") or "unknown"
+
+
+def read_json(path: Path, default: Any = None) -> Any:
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return default
+
+
+def write_json(path: Path, value: Any) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(value, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+
+
+def append_jsonl(path: Path, value: Any) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8") as handle:
+        handle.write(json.dumps(value, ensure_ascii=False, default=str) + "\n")
+
+def _status_class(value: Any) -> str:
+    text = str(value).lower()
+    if text in {"ok", "allow", "accepted", "approved", "enabled", "filled", "valid", "read", "true", "open"}:
+        return "good"
+    if text in {"deny", "denied", "rejected", "error", "blocked", "disabled", "false", "execution"}:
+        return "bad"
+    if text in {"proposed", "pending", "recorded", "stubbed", "write", "approval", "research-only"}:
+        return "warn"
+    return "neutral"
+
+
+def _resolve_path(root: Path, raw: str) -> Path:
+    path = Path(raw)
+    return path if path.is_absolute() else root / path
+
+
+def _safe_read(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8")
+    except Exception:
+        return ""
+
+
+def _number(value: Any) -> float | None:
+    try:
+        return float(value)
+    except Exception:
+        return None
+
+
+def _validate_positive(value: Any, field: str, reasons: list[str]) -> None:
+    if value in (None, ""):
+        return
+    number = _number(value)
+    if number is None or number <= 0:
+        reasons.append(f"{field} must be a positive number")
+
+
+def _parse_datetime(value: Any) -> datetime | None:
+    if not value:
+        return None
+    try:
+        parsed = datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+    except Exception:
+        return None
+    return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
+
+
+def _unique(items: list[str]) -> list[str]:
+    return list(dict.fromkeys(items))

tradingcodex_service/application/components.py

@@ -0,0 +1,299 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass(frozen=True)
+class HarnessComponent:
+    id: str
+    label: str
+    summary: str
+    status: str
+    tags: tuple[str, ...]
+    surfaces: dict[str, tuple[str, ...]]
+    depends_on: tuple[str, ...]
+    owned_capabilities: tuple[str, ...]
+    validation: tuple[str, ...]
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "id": self.id,
+            "label": self.label,
+            "summary": self.summary,
+            "status": self.status,
+            "tags": list(self.tags),
+            "surfaces": {key: list(values) for key, values in self.surfaces.items()},
+            "depends_on": list(self.depends_on),
+            "owned_capabilities": list(self.owned_capabilities),
+            "validation": list(self.validation),
+        }
+
+
+HARNESS_COMPONENTS: tuple[HarnessComponent, ...] = (
+    HarnessComponent(
+        id="fixed-role-dispatch",
+        label="Fixed Role Dispatch",
+        summary="Maintains the head-manager, fixed subagent routing, and no-overlap handoff contract.",
+        status="core",
+        tags=("guardrail.guidance", "guardrail.information_barrier", "improvement.workflow_quality"),
+        surfaces={
+            "instructions": ("head-manager", "AGENTS"),
+            "skills": ("manage-subagents",),
+            "services": ("harness",),
+            "templates": ("codex-base", "fixed-subagents", "repo-skills"),
+            "tests": ("generated-workspace", "subagent-roster"),
+        },
+        depends_on=(),
+        owned_capabilities=("workflow.dispatch_fixed_roles",),
+        validation=("pytest", "generated workspace contract"),
+    ),
+    HarnessComponent(
+        id="investment-request-routing",
+        label="Investment Request Routing",
+        summary="Classifies user intent and activates the fixed-role workflow.",
+        status="core",
+        tags=("guardrail.guidance", "improvement.workflow_quality"),
+        surfaces={
+            "instructions": ("head-manager", "AGENTS"),
+            "skills": ("orchestrate-workflow", "investment-workflow-map", "scenario-quality-gates"),
+            "hooks": ("UserPromptSubmit",),
+            "services": ("harness",),
+            "templates": ("codex-base", "repo-skills"),
+            "tests": ("routing", "generated-workspace"),
+        },
+        depends_on=("fixed-role-dispatch",),
+        owned_capabilities=("workflow.route_investment_request",),
+        validation=("pytest", "generated workspace contract"),
+    ),
+    HarnessComponent(
+        id="workflow-quality-gates",
+        label="Workflow Quality Gates",
+        summary="Defines lane selection, handoff acceptance, artifact readiness, claim discipline, and synthesis gates.",
+        status="core",
+        tags=("guardrail.guidance", "improvement.workflow_quality"),
+        surfaces={
+            "skills": ("investment-workflow-map", "scenario-quality-gates", "synthesize-decision"),
+            "services": ("harness",),
+            "templates": ("repo-skills",),
+            "tests": ("quality-scenarios", "routing"),
+        },
+        depends_on=("investment-request-routing", "fixed-role-dispatch"),
+        owned_capabilities=("workflow.quality_gate",),
+        validation=("pytest", "routing scenario tests"),
+    ),
+    HarnessComponent(
+        id="research-memory",
+        label="Research Memory",
+        summary="Indexes source-aware workspace markdown artifacts and file-native source snapshots.",
+        status="core",
+        tags=("improvement.research_memory",),
+        surfaces={
+            "services": ("research",),
+            "mcp_tools": ("create_research_artifact", "search_research_artifacts", "export_research_artifact_md"),
+            "files": ("trading/research/*.md", "trading/reports/**/*.md", "trading/research/source-snapshots/*.json"),
+            "templates": ("tradingcodex-mcp",),
+            "tests": ("research-memory",),
+        },
+        depends_on=("audit-ledger",),
+        owned_capabilities=("research.memory",),
+        validation=("pytest", "research-memory smoke checks"),
+    ),
+    HarnessComponent(
+        id="external-data-source-gate",
+        label="External Data Source Gate",
+        summary="Keeps external MCP, router, plugin, web, and data evidence read-only and source-aware.",
+        status="core",
+        tags=("guardrail.guidance", "improvement.workflow_quality"),
+        surfaces={
+            "skills": ("external-data-source-gate",),
+            "instructions": ("AGENTS",),
+            "templates": ("repo-skills",),
+            "tests": ("external-data",),
+        },
+        depends_on=("workflow-quality-gates",),
+        owned_capabilities=("evidence.external_source_gate",),
+        validation=("pytest", "routing scenario tests"),
+    ),
+    HarnessComponent(
+        id="external-mcp-proxy-gate",
+        label="External MCP Proxy Gate",
+        summary="Imports external MCP tool metadata, classifies risk, manages role scopes, and blocks unsafe direct proxy paths.",
+        status="core",
+        tags=("guardrail.enforcement", "guardrail.information_barrier"),
+        surfaces={
+            "services": ("mcp.services",),
+            "models": ("McpRouter", "McpExternalTool", "McpExternalToolPermission", "McpExternalToolCall"),
+            "templates": ("web/mcp_router.html",),
+            "tests": ("external-mcp", "product-web"),
+        },
+        depends_on=("policy-and-restricted-list", "audit-ledger", "secret-wall"),
+        owned_capabilities=("mcp.external.classify", "mcp.external.proxy_gate"),
+        validation=("pytest", "python manage.py check"),
+    ),
+    HarnessComponent(
+        id="secret-wall",
+        label="Secret Wall",
+        summary="Blocks raw broker secrets from workspace files, prompts, shell paths, and role context.",
+        status="core",
+        tags=("guardrail.enforcement", "guardrail.information_barrier"),
+        surfaces={
+            "hooks": ("UserPromptSubmit", "PreToolUse", "PermissionRequest"),
+            "instructions": ("AGENTS",),
+            "templates": ("information-barriers", "codex-base"),
+            "tests": ("secret-warning", "generated-workspace"),
+        },
+        depends_on=("audit-ledger",),
+        owned_capabilities=("secret.block_workspace_storage",),
+        validation=("pytest", "generated workspace contract"),
+    ),
+    HarnessComponent(
+        id="policy-and-restricted-list",
+        label="Policy And Restricted List",
+        summary="Evaluates principals, capabilities, explicit deny rules, restricted symbols, and limits.",
+        status="core",
+        tags=("guardrail.enforcement",),
+        surfaces={
+            "services": ("policy",),
+            "models": ("Principal", "Capability", "PolicyDecision", "RestrictedSymbol"),
+            "mcp_tools": ("simulate_policy",),
+            "templates": ("enforcement-guardrails",),
+            "tests": ("policy",),
+        },
+        depends_on=("audit-ledger",),
+        owned_capabilities=("policy.evaluate", "policy.restricted_list"),
+        validation=("pytest", "python manage.py check"),
+    ),
+    HarnessComponent(
+        id="approval-gate",
+        label="Approval Gate",
+        summary="Validates order intents and approval receipts before any execution-sensitive action.",
+        status="core",
+        tags=("guardrail.enforcement",),
+        surfaces={
+            "services": ("orders", "policy"),
+            "skills": ("create-order-intent", "approve-order", "review-risk"),
+            "mcp_tools": ("validate_order_intent", "validate_approval_receipt", "create_approval_receipt"),
+            "templates": ("enforcement-guardrails", "tradingcodex-mcp"),
+            "tests": ("orders", "approval"),
+        },
+        depends_on=("policy-and-restricted-list", "audit-ledger"),
+        owned_capabilities=("orders.approval_gate",),
+        validation=("pytest", "python manage.py check"),
+    ),
+    HarnessComponent(
+        id="execution-boundary",
+        label="Execution Boundary",
+        summary="Keeps execution behind MCP role allowlists, approval, idempotency, adapter, and audit checks.",
+        status="core",
+        tags=("guardrail.enforcement", "guardrail.information_barrier"),
+        surfaces={
+            "services": ("orders", "mcp_runtime", "integrations"),
+            "skills": ("execute-paper-order",),
+            "mcp_tools": ("submit_approved_order", "cancel_approved_order", "get_order_status"),
+            "templates": ("tradingcodex-mcp", "stub-execution", "paper-trading"),
+            "tests": ("mcp", "execution"),
+        },
+        depends_on=("approval-gate", "policy-and-restricted-list", "audit-ledger"),
+        owned_capabilities=("execution.boundary",),
+        validation=("pytest", "MCP smoke checks"),
+    ),
+    HarnessComponent(
+        id="audit-ledger",
+        label="Audit Ledger",
+        summary="Records policy, MCP, order, approval, execution, and hook events for review.",
+        status="core",
+        tags=("guardrail.enforcement", "improvement.validation_feedback"),
+        surfaces={
+            "services": ("audit",),
+            "models": ("AuditEvent", "McpToolCall"),
+            "mcp_tools": ("record_audit_event",),
+            "templates": ("audit", "tradingcodex-mcp"),
+            "tests": ("audit", "mcp-ledger"),
+        },
+        depends_on=(),
+        owned_capabilities=("audit.write", "audit.review"),
+        validation=("pytest", "MCP smoke checks"),
+    ),
+    HarnessComponent(
+        id="skill-improvement-loop",
+        label="Skill Improvement Loop",
+        summary="Keeps skill changes visible through workspace proposal files, validation, projection, and manifest state.",
+        status="core",
+        tags=("improvement.skill_evolution", "guardrail.guidance"),
+        surfaces={
+            "services": ("agents", "harness"),
+            "files": (
+                ".tradingcodex/mainagent/skill-change-proposals/*.yaml",
+                ".tradingcodex/subagents/skills/*/*/SKILL.md",
+                ".tradingcodex/subagents/skills/*/*/agents/tradingcodex.json",
+                ".tradingcodex/strategies/strategy-*/SKILL.md",
+                ".tradingcodex/generated/projection-manifest.json",
+                ".codex/agents/*.toml",
+                ".agents/skills/*",
+            ),
+            "skills": ("manage-optional-skills", "strategy-creator"),
+            "templates": ("repo-skills",),
+            "tests": ("skill-proposals", "projection"),
+        },
+        depends_on=("fixed-role-dispatch",),
+        owned_capabilities=("skill.proposal_loop",),
+        validation=("pytest", "generated workspace contract"),
+    ),
+    HarnessComponent(
+        id="postmortem-loop",
+        label="Postmortem Loop",
+        summary="Turns rejected orders, process failures, thesis changes, and executions into improvements.",
+        status="core",
+        tags=("improvement.postmortems", "improvement.validation_feedback"),
+        surfaces={
+            "skills": ("postmortem",),
+            "services": ("audit", "orders"),
+            "templates": ("postmortem", "repo-skills"),
+            "tests": ("postmortem",),
+        },
+        depends_on=("audit-ledger", "workflow-quality-gates"),
+        owned_capabilities=("workflow.postmortem",),
+        validation=("pytest", "postmortem smoke checks"),
+    ),
+    HarnessComponent(
+        id="paper-execution",
+        label="Paper Execution",
+        summary="Provides experimental local paper and stub execution adapters behind the execution boundary.",
+        status="experimental",
+        tags=("guardrail.enforcement",),
+        surfaces={
+            "services": ("orders", "portfolio", "integrations"),
+            "templates": ("paper-trading", "stub-execution"),
+            "mcp_tools": ("submit_approved_order", "get_portfolio_snapshot"),
+            "tests": ("paper-execution", "portfolio"),
+        },
+        depends_on=("execution-boundary", "approval-gate"),
+        owned_capabilities=("execution.paper", "execution.stub"),
+        validation=("pytest", "MCP smoke checks"),
+    ),
+)
+
+
+def list_harness_components() -> list[dict[str, Any]]:
+    return [component.as_dict() for component in HARNESS_COMPONENTS]
+
+
+def get_harness_component(component_id: str) -> dict[str, Any] | None:
+    for component in HARNESS_COMPONENTS:
+        if component.id == component_id:
+            return component.as_dict()
+    return None
+
+
+def list_components_by_tag(tag: str) -> list[dict[str, Any]]:
+    return [component.as_dict() for component in HARNESS_COMPONENTS if tag in component.tags]
+
+
+def count_harness_component_tags() -> dict[str, int]:
+    counts: dict[str, int] = {}
+    for component in HARNESS_COMPONENTS:
+        for tag in component.tags:
+            top_level = tag.split(".", 1)[0]
+            counts[top_level] = counts.get(top_level, 0) + 1
+    return dict(sorted(counts.items()))