tradingcodex 0.1.0__py3-none-any.whl

tradingcodex_cli/commands/doctor.py

@@ -0,0 +1,230 @@
+from __future__ import annotations
+
+import os
+import sys
+import tomllib
+from pathlib import Path
+from typing import Any
+
+from tradingcodex_service.application.agents import (
+    EXPECTED_SKILLS,
+    EXPECTED_SUBAGENTS,
+    ROLE_PERMISSION_PROFILES,
+    SKILL_SPECS,
+    inspect_agent_configuration,
+)
+from tradingcodex_service.application.runtime import (
+    read_workspace_manifest,
+    ensure_runtime_database,
+    tradingcodex_db_path,
+)
+from tradingcodex_cli.commands.utils import (
+    _safe_read,
+    list_subagents,
+    path_check,
+    read_thread_policy,
+    text_check,
+)
+
+def doctor(root: Path, layer: str) -> None:
+    allowed = {"all", "codex-native", "guidance", "enforcement", "information-barrier", "improvement", "mcp", "service"}
+    if layer not in allowed:
+        raise ValueError(f'unknown layer "{layer}"')
+    checks = []
+    checks.extend(_central_service_checks(root))
+    checks.extend(_guidance_checks(root))
+    checks.extend(_enforcement_checks(root))
+    checks.extend(_information_barrier_checks(root))
+    checks.extend(_improvement_checks(root))
+    checks.extend(_mcp_checks(root))
+    checks = [check for check in checks if layer == "all" or check["layer"] == layer or (layer == "codex-native" and check.get("codexNative"))]
+    failed = 0
+    print("TradingCodex Harness\n")
+    for check in checks:
+        status = "WARN" if check.get("warn") else "PASS" if check["ok"] else "FAIL"
+        if not check["ok"] and not check.get("warn"):
+            failed += 1
+        print(f"{status.ljust(4)} {check['layer'].ljust(20)} {check['name']} - {check['detail']}")
+    if failed:
+        print(f"TradingCodex doctor failed: {failed} check(s) failed", file=sys.stderr)
+        sys.exit(1)
+    print("\nTradingCodex doctor passed")
+
+def _guidance_checks(root: Path) -> list[dict[str, Any]]:
+    return [
+        path_check(root, "guidance", "AGENTS.md installed", "AGENTS.md", True),
+        text_check(root, "guidance", "head-manager model instructions file configured", ".codex/config.toml", 'model_instructions_file = "prompts/base_instructions/head-manager.md"', True),
+        text_check(root, "guidance", "head-manager instructions installed", ".codex/prompts/base_instructions/head-manager.md", "You are the `head-manager` agent", True),
+        path_check(root, "guidance", "local CLI wrapper installed", "tcx", False),
+        text_check(root, "guidance", "hooks configured", ".codex/hooks.json", "\"PreToolUse\"", True),
+        text_check(root, "guidance", "scenario quality gates configured", ".codex/prompts/base_instructions/head-manager.md", "scenario-quality-gates", True),
+        text_check(root, "guidance", "investment workflow map configured", ".codex/prompts/base_instructions/head-manager.md", "investment-workflow-map", True),
+        text_check(root, "guidance", "handoff quality gate configured", ".codex/prompts/base_instructions/head-manager.md", "## Handoff quality", True),
+        {"layer": "guidance", "name": "subagent max_threads matches roster", "ok": read_thread_policy(root)["max_threads"] == len(list_subagents(root)), "codexNative": True, "detail": f"max_threads={read_thread_policy(root)['max_threads']}, subagents={len(list_subagents(root))}"},
+    ]
+
+
+def _central_service_checks(root: Path) -> list[dict[str, Any]]:
+    checks: list[dict[str, Any]] = []
+    try:
+        ensure_runtime_database(root)
+        db_path = tradingcodex_db_path()
+        checks.append({"layer": "service", "name": "central DB reachable", "ok": db_path.exists(), "codexNative": False, "detail": str(db_path)})
+        checks.append({
+            "layer": "service",
+            "name": "workspace root is provenance only",
+            "ok": db_path != (root / ".tradingcodex" / "state" / "tradingcodex.sqlite3").resolve(),
+            "codexNative": False,
+            "detail": f"workspace={root}",
+        })
+        manifest = read_workspace_manifest(root)
+        has_workspace_id = bool(str(manifest.get("workspace_id", "")).startswith("tcxw_"))
+        checks.append({
+            "layer": "service",
+            "name": "workspace identity manifest installed",
+            "ok": has_workspace_id,
+            "warn": not has_workspace_id,
+            "codexNative": False,
+            "detail": str(manifest.get("workspace_id") or "missing .tradingcodex/workspace.json"),
+        })
+        has_profile = bool((manifest.get("active_profile") or {}).get("portfolio_id"))
+        checks.append({
+            "layer": "service",
+            "name": "active profile configured",
+            "ok": has_profile,
+            "warn": not has_profile,
+            "codexNative": False,
+            "detail": (manifest.get("active_profile") or {}).get("label", "missing active profile"),
+        })
+        from apps.mcp.models import McpToolCall
+
+        McpToolCall.objects.count()
+        checks.append({"layer": "service", "name": "central MCP ledger reachable", "ok": True, "codexNative": False, "detail": "McpToolCall table available"})
+    except Exception as exc:
+        checks.append({"layer": "service", "name": "central DB reachable", "ok": False, "codexNative": False, "detail": str(exc)})
+    export_dirs = ["trading/research", "trading/reports", "trading/audit", "trading/orders", "trading/approvals"]
+    for rel in export_dirs:
+        path = root / rel
+        checks.append({"layer": "service", "name": f"workspace export/cache writable: {rel}", "ok": path.exists() and os.access(path, os.W_OK), "codexNative": False, "detail": "writable" if path.exists() and os.access(path, os.W_OK) else "missing or not writable"})
+    return checks
+
+
+def _enforcement_checks(root: Path) -> list[dict[str, Any]]:
+    schemas = ["evidence_pack.schema.json", "fundamental_report.schema.json", "technical_report.schema.json", "news_report.schema.json", "thesis.schema.json", "valuation.schema.json", "portfolio_review.schema.json", "risk_report.schema.json", "order_intent.schema.json", "approval_receipt.schema.json", "execution_result.schema.json", "postmortem_report.schema.json", "audit_event.schema.json"]
+    return [
+        text_check(root, "enforcement", "command rules configured", ".codex/rules/tradingcodex.rules", "prefix_rule(", True),
+        *_codex_mcp_config_checks(root),
+        path_check(root, "enforcement", "TradingCodex MCP installed", ".tradingcodex/mcp/server.py", False),
+        {"layer": "enforcement", "name": "live broker disabled by default", "ok": not (root / ".tradingcodex" / "mcp" / "adapters" / "live.py").exists(), "detail": "live.py adapter absent"},
+        *[path_check(root, "enforcement", f"schema installed: {schema}", f".tradingcodex/schemas/{schema}", False) for schema in schemas],
+    ]
+
+
+def _codex_mcp_config_checks(root: Path) -> list[dict[str, Any]]:
+    root_mcp = _read_codex_mcp_config(root / ".codex" / "config.toml")
+    execution_mcp = _read_codex_mcp_config(root / ".codex" / "agents" / "execution-operator.toml")
+    risk_mcp = _read_codex_mcp_config(root / ".codex" / "agents" / "risk-manager.toml")
+    root_tools = set(root_mcp.get("enabled_tools") or [])
+    execution_tools = set(execution_mcp.get("enabled_tools") or [])
+    risk_tools = set(risk_mcp.get("enabled_tools") or [])
+    return [
+        {
+            "layer": "enforcement",
+            "name": "TradingCodex MCP root server configured",
+            "ok": bool(root_mcp.get("enabled") is True and root_mcp.get("command") and root_mcp.get("args")),
+            "codexNative": True,
+            "detail": "enabled with command/args" if root_mcp else "missing mcp_servers.tradingcodex",
+        },
+        {
+            "layer": "enforcement",
+            "name": "TradingCodex MCP autostarts local service",
+            "ok": root_mcp.get("env", {}).get("TRADINGCODEX_MCP_AUTOSTART_SERVICE") == "1",
+            "codexNative": True,
+            "detail": "MCP env enables dashboard/service autostart" if root_mcp.get("env", {}).get("TRADINGCODEX_MCP_AUTOSTART_SERVICE") == "1" else "missing TRADINGCODEX_MCP_AUTOSTART_SERVICE=1",
+        },
+        {
+            "layer": "enforcement",
+            "name": "head-manager MCP execution submit excluded",
+            "ok": "submit_approved_order" not in root_tools,
+            "codexNative": True,
+            "detail": "root allowlist excludes submit_approved_order" if "submit_approved_order" not in root_tools else "root allowlist includes submit_approved_order",
+        },
+        {
+            "layer": "enforcement",
+            "name": "execution-operator MCP execution allowlist configured",
+            "ok": "submit_approved_order" in execution_tools,
+            "codexNative": True,
+            "detail": "execution-operator allowlist includes submit_approved_order" if "submit_approved_order" in execution_tools else "missing submit_approved_order",
+        },
+        {
+            "layer": "enforcement",
+            "name": "risk-manager MCP approval allowlist configured",
+            "ok": "create_approval_receipt" in risk_tools and "submit_approved_order" not in risk_tools,
+            "codexNative": True,
+            "detail": "risk-manager can approve but not submit" if "create_approval_receipt" in risk_tools and "submit_approved_order" not in risk_tools else "risk-manager approval/submit allowlist mismatch",
+        },
+    ]
+
+
+def _read_codex_mcp_config(path: Path) -> dict[str, Any]:
+    try:
+        parsed = tomllib.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return {}
+    return parsed.get("mcp_servers", {}).get("tradingcodex", {})
+
+
+def _information_barrier_checks(root: Path) -> list[dict[str, Any]]:
+    return [
+        path_check(root, "information-barrier", "capabilities installed", ".tradingcodex/capabilities.yaml", False),
+        path_check(root, "information-barrier", "information barriers installed", ".tradingcodex/policies/information-barriers.yaml", False),
+        path_check(root, "information-barrier", "restricted list installed", ".tradingcodex/policies/restricted-list.yaml", False),
+        path_check(root, "information-barrier", "approvals directory installed", "trading/approvals", False),
+    ]
+
+
+def _improvement_checks(root: Path) -> list[dict[str, Any]]:
+    checks = []
+    for subagent in EXPECTED_SUBAGENTS:
+        checks.append(path_check(root, "improvement", f"subagent installed: {subagent}", f".codex/agents/{subagent}.toml", True))
+        checks.append(text_check(root, "improvement", f"subagent permissions profile: {subagent}", f".codex/agents/{subagent}.toml", f'default_permissions = "{ROLE_PERMISSION_PROFILES[subagent]}"', True))
+        try:
+            projected = set(inspect_agent_configuration(root, subagent)["projected_skills"])
+            effective = set(inspect_agent_configuration(root, subagent)["effective_skills"])
+            checks.append({
+                "layer": "improvement",
+                "name": f"subagent projected skills current: {subagent}",
+                "ok": effective.issubset(projected),
+                "codexNative": True,
+                "detail": "projected TOML matches effective skills" if effective.issubset(projected) else f"missing {sorted(effective - projected)}",
+            })
+        except Exception as exc:
+            checks.append({"layer": "improvement", "name": f"subagent projected skills current: {subagent}", "ok": False, "codexNative": True, "detail": str(exc)})
+    for skill in EXPECTED_SKILLS:
+        checks.append(path_check(root, "improvement", f"skill installed: {skill}", _skill_check_path(skill), False))
+    checks.append(path_check(root, "improvement", "agent index projected", ".tradingcodex/generated/agent-index.json", False))
+    checks.append(path_check(root, "improvement", "skill index projected", ".tradingcodex/generated/skill-index.json", False))
+    checks.append(path_check(root, "improvement", "projection manifest projected", ".tradingcodex/generated/projection-manifest.json", False))
+    checks.append(text_check(root, "improvement", "no-overlap handoff contract installed", ".agents/skills/manage-subagents/SKILL.md", "Downstream roles consume accepted upstream artifacts", False))
+    checks.append(text_check(root, "improvement", "strategy root skill config installed", ".codex/config.toml", "# BEGIN TradingCodex strategy skills", True))
+    checks.append(path_check(root, "improvement", "postmortem workflow installed", ".tradingcodex/workflows/postmortem.yaml", False))
+    return checks
+
+
+def _skill_check_path(skill: str) -> str:
+    spec = SKILL_SPECS[skill]
+    if spec.scope == "subagent_shared":
+        return f".tradingcodex/subagents/skills/shared/{skill}/SKILL.md"
+    if spec.scope == "subagent_role":
+        role = spec.owner_roles[0]
+        return f".tradingcodex/subagents/skills/{role}/{skill}/SKILL.md"
+    return f".agents/skills/{skill}/SKILL.md"
+
+
+def _mcp_checks(root: Path) -> list[dict[str, Any]]:
+    return [
+        path_check(root, "mcp", "stub execution adapter installed", ".tradingcodex/mcp/adapters/stub-execution.py", False),
+        path_check(root, "mcp", "paper trading adapter installed", ".tradingcodex/mcp/adapters/paper-trading.py", False),
+        path_check(root, "mcp", "live adapter contract installed", ".tradingcodex/mcp/adapters/live-adapter.contract.md", False),
+        text_check(root, "mcp", "MCP server instructions installed", ".tradingcodex/mcp/server.py", "approved action gateway", False),
+    ]

tradingcodex_cli/commands/mcp.py

@@ -0,0 +1,186 @@
+from __future__ import annotations
+
+import os
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+from tradingcodex_service.application.runtime import ensure_runtime_database, tradingcodex_db_path
+from tradingcodex_service.mcp_runtime import call_mcp_tool
+from tradingcodex_service.mcp_runtime import SAFE_HOME_TOOL_NAMES
+from tradingcodex_cli.commands.utils import _option_value, print_json
+
+def mcp(root: Path, argv: list[str]) -> None:
+    if not argv or argv[0] in {"--help", "-h", "help"}:
+        print_mcp_help()
+        return
+    if argv and argv[0] == "stdio":
+        from tradingcodex_cli.mcp_stdio import run_stdio
+        from tradingcodex_cli.service_autostart import maybe_autostart_service
+
+        maybe_autostart_service(root)
+        run_stdio(root)
+        return
+    if argv and argv[0] in {"ledger", "calls"}:
+        mcp_ledger(root, argv[1:])
+        return
+    if argv and argv[0] == "install-global":
+        install_global_mcp(argv[1:])
+        return
+    if not argv or argv[0] != "call":
+        raise ValueError("Usage: tcx mcp call <tool> [--order-intent file] [--approval-receipt file] [--order-id id] | tcx mcp ledger [--tool name] | tcx mcp stdio")
+    tool = argv[1] if len(argv) > 1 else ""
+    args = argv[2:]
+    order_path = _option_value(args, "--order-intent")
+    receipt_path = _option_value(args, "--approval-receipt")
+    principal_id = _option_value(args, "--principal")
+    payload: dict[str, Any] = {}
+    if principal_id:
+        payload["principal_id"] = principal_id
+    payload.update({
+        "order_intent_id": _option_value(args, "--order-intent-id"),
+        "order_id": _option_value(args, "--order-id"),
+        "artifact_id": _option_value(args, "--artifact-id") or _option_value(args, "--id"),
+        "artifact_type": _option_value(args, "--artifact-type") or _option_value(args, "--type"),
+        "universe": _option_value(args, "--universe"),
+        "workflow_type": _option_value(args, "--workflow-type"),
+        "symbol": _option_value(args, "--symbol"),
+        "title": _option_value(args, "--title"),
+        "markdown": _option_value(args, "--markdown"),
+        "markdown_path": _option_value(args, "--markdown-file") or _option_value(args, "--file"),
+        "source_as_of": _option_value(args, "--source-as-of"),
+        "readiness_label": _option_value(args, "--readiness"),
+        "query": _option_value(args, "--query") or _option_value(args, "--q"),
+        "limit": _option_value(args, "--limit"),
+        "provider": _option_value(args, "--provider"),
+        "source_category": _option_value(args, "--source-category") or _option_value(args, "--category"),
+        "as_of": _option_value(args, "--as-of"),
+    })
+    payload_json = _option_value(args, "--payload")
+    if payload_json:
+        parsed_payload = json.loads(payload_json)
+        if not isinstance(parsed_payload, dict):
+            raise ValueError("--payload must be a JSON object")
+        payload["payload"] = parsed_payload
+    warnings_json = _option_value(args, "--warnings")
+    if warnings_json:
+        parsed_warnings = json.loads(warnings_json)
+        if not isinstance(parsed_warnings, list):
+            raise ValueError("--warnings must be a JSON array")
+        payload["warnings"] = parsed_warnings
+    payload = {key: value for key, value in payload.items() if value not in (None, "")}
+    for raw in args:
+        if raw.startswith("{"):
+            parsed = json.loads(raw)
+            if not isinstance(parsed, dict):
+                raise ValueError("positional JSON MCP payload must be an object")
+            payload.update(parsed)
+    if order_path:
+        payload["order_intent"] = json.loads((root / order_path).read_text(encoding="utf-8"))
+    if receipt_path:
+        payload["approval_receipt"] = json.loads((root / receipt_path).read_text(encoding="utf-8"))
+    result = call_mcp_tool(root, tool, payload)
+    print_json(result)
+    if result.get("status") in {"rejected", "not_supported"} or result.get("decision") == "deny" or result.get("valid") is False:
+        sys.exit(1)
+
+
+def mcp_ledger(root: Path, args: list[str]) -> None:
+    ensure_runtime_database(root)
+    from apps.mcp.models import McpToolCall
+
+    queryset = McpToolCall.objects.all()
+    tool = _option_value(args, "--tool")
+    principal = _option_value(args, "--principal")
+    status = _option_value(args, "--status")
+    if tool:
+        queryset = queryset.filter(tool_name=tool)
+    if principal:
+        queryset = queryset.filter(principal_id=principal)
+    if status:
+        queryset = queryset.filter(status=status)
+    limit = max(1, min(int(_option_value(args, "--limit") or 20), 200))
+    print_json({
+        "count": queryset.count(),
+        "db_path": str(tradingcodex_db_path()),
+        "central_ledger": True,
+        "calls": [
+            {
+                "created_at": call.created_at.isoformat(),
+                "tool_name": call.tool_name,
+                "principal_id": call.principal_id,
+                "status": call.status,
+                "workspace_context": call.workspace_context,
+                "request_hash": call.request_hash,
+                "result_hash": call.result_hash,
+                "error": call.error,
+                "duration_ms": call.duration_ms,
+            }
+            for call in queryset[:limit]
+        ],
+    })
+
+
+def install_global_mcp(args: list[str]) -> None:
+    if "--safe" not in args:
+        raise ValueError("Usage: tcx mcp install-global --safe [--config <path>] [--print]")
+    config_path = Path(_option_value(args, "--config") or Path.home() / ".codex" / "config.toml").expanduser().resolve()
+    block = global_home_mcp_config_block()
+    if "--print" in args:
+        print(block)
+        return
+    config_path.parent.mkdir(parents=True, exist_ok=True)
+    existing = config_path.read_text(encoding="utf-8") if config_path.exists() else ""
+    updated = replace_managed_block(existing, block)
+    config_path.write_text(updated, encoding="utf-8")
+    print_json({
+        "status": "installed",
+        "server_name": "tradingcodex-home",
+        "config_path": str(config_path),
+        "safe_tools": sorted(SAFE_HOME_TOOL_NAMES),
+    })
+
+
+def global_home_mcp_config_block() -> str:
+    tools = ",\n  ".join(json.dumps(tool) for tool in sorted(SAFE_HOME_TOOL_NAMES))
+    return f"""# BEGIN TradingCodex home MCP
+[mcp_servers.tradingcodex-home]
+command = "uvx"
+args = ["--refresh", "--python", "3.14", "--from", "{os.environ.get("TRADINGCODEX_MCP_PACKAGE_SPEC", "tradingcodex")}", "python", "-m", "tradingcodex_cli", "mcp", "stdio"]
+enabled = true
+env = {{ TRADINGCODEX_MCP_SAFE_TOOLS = "1", TRADINGCODEX_MCP_SCOPE = "global-home" }}
+enabled_tools = [
+  {tools}
+]
+default_tools_approval_mode = "prompt"
+startup_timeout_sec = 20
+# END TradingCodex home MCP
+"""
+
+
+def replace_managed_block(existing: str, block: str) -> str:
+    start = "# BEGIN TradingCodex home MCP"
+    end = "# END TradingCodex home MCP"
+    if start in existing and end in existing:
+        before, rest = existing.split(start, 1)
+        _, after = rest.split(end, 1)
+        return before.rstrip() + "\n\n" + block.rstrip() + "\n" + after
+    prefix = existing.rstrip() + "\n\n" if existing.strip() else ""
+    return prefix + block
+
+
+def print_mcp_help() -> None:
+    print("""TradingCodex MCP
+
+Usage:
+  ./tcx mcp call <tool> [--principal <role>] [tool args]
+  ./tcx mcp ledger [--tool <name>] [--principal <role>] [--status ok]
+  ./tcx mcp install-global --safe
+  ./tcx mcp stdio
+
+Examples:
+  ./tcx mcp call create_research_artifact --principal fundamental-analyst --artifact-id note-1 --title "Note" --markdown "# Note" --symbol MSFT
+  ./tcx mcp call submit_approved_order --order-intent-id approved-order-id
+  ./tcx mcp ledger --tool create_research_artifact --status ok
+""")

tradingcodex_cli/commands/orders.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import json
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+from tradingcodex_service.application.audit import write_audit_event
+from tradingcodex_service.application.common import sanitize_id, write_json
+from tradingcodex_service.application.orders import create_approval_receipt, validate_order_intent
+from tradingcodex_cli.commands.utils import _option_value, classify_artifact_path, print_json
+
+def validate(root: Path, argv: list[str]) -> None:
+    if len(argv) < 2 or argv[0] != "order":
+        raise ValueError("Usage: tcx validate order <order-intent.json>")
+    order = json.loads((root / argv[1]).read_text(encoding="utf-8"))
+    result = validate_order_intent(root, {"principal_id": "portfolio-manager", "order_intent": order})
+    write_audit_event(root, {"type": "order_intent.validated" if result["valid"] else "order_intent.validation_failed", "payload": result}, "portfolio-manager", "cli")
+    print_json(result)
+    if not result["valid"]:
+        sys.exit(1)
+
+
+def risk_check(root: Path, argv: list[str]) -> None:
+    file_path = argv[0] if argv else _option_value(argv, "--order-intent")
+    if not file_path:
+        raise ValueError("Usage: tcx risk-check <order-intent.json>")
+    order = json.loads((root / file_path).read_text(encoding="utf-8"))
+    validation = validate_order_intent(root, {"principal_id": "risk-manager", "order_intent": order})
+    result = {"decision": "go" if validation["valid"] else "revise", "order_intent_id": order.get("id"), "reasons": validation["reasons"], "checks": {"schema": not any(reason.startswith("missing ") for reason in validation["reasons"]), "policy": validation["policy"]["decision"]}}
+    write_audit_event(root, {"type": "risk_check", "payload": result}, "risk-manager", "cli")
+    print_json(result)
+    if result["decision"] != "go":
+        sys.exit(1)
+
+
+def approve(root: Path, argv: list[str]) -> None:
+    file_path = argv[0] if argv else _option_value(argv, "--order-intent")
+    if not file_path:
+        raise ValueError("Usage: tcx approve <draft-order-intent.json> [--approved-by risk-manager]")
+    order = json.loads((root / file_path).read_text(encoding="utf-8"))
+    result = create_approval_receipt(root, order, _option_value(argv, "--approved-by") or "risk-manager", int(_option_value(argv, "--expires-hours") or 24))
+    print_json(result)
+    if result.get("status") == "rejected":
+        sys.exit(1)
+
+
+def quality_check(root: Path, argv: list[str]) -> None:
+    if not argv or argv[0] in {"--help", "-h", "help"}:
+        print("Canonical research paths: trading/research/*.evidence.md; trading/reports/<role>/*")
+        return
+    path = root / argv[0]
+    text = path.read_text(encoding="utf-8")
+    rel = path.relative_to(root).as_posix()
+    result = {"path": rel, "exists": True, "bytes": len(text.encode()), "non_empty": bool(text), "artifact_type": classify_artifact_path(rel), "json_valid": None, "required_fields_missing": [], "warnings": []}
+    if rel.endswith(".json"):
+        try:
+            data = json.loads(text)
+            result["json_valid"] = True
+            if "order_intent" in rel:
+                result["required_fields_missing"] = [field for field in ["id", "symbol", "side", "quantity", "broker", "created_by"] if data.get(field) in (None, "")]
+        except Exception:
+            result["json_valid"] = False
+    result["status"] = "fail" if not result["non_empty"] or result["json_valid"] is False or result["required_fields_missing"] else "pass"
+    print_json(result)
+    if result["status"] != "pass":
+        sys.exit(1)
+
+
+def audit(root: Path, argv: list[str]) -> None:
+    tail = int(_option_value(argv, "--tail") or 20)
+    entries = []
+    for path in sorted((root / "trading" / "audit").glob("*.jsonl")):
+        for line in path.read_text(encoding="utf-8").splitlines():
+            if line.strip():
+                entries.append((path.name, line))
+    for file, line in entries[-tail:]:
+        print(f"{file}\t{line}")
+
+
+def postmortem(root: Path, argv: list[str]) -> None:
+    if not argv or argv[0] != "create":
+        raise ValueError("Usage: tcx postmortem create --trigger <trigger> [--tail n]")
+    trigger = _option_value(argv, "--trigger") or "manual"
+    report = {"id": f"postmortem-{datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%S%fZ')}", "created_by": _option_value(argv, "--created-by") or "head-manager", "created_at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"), "trigger": trigger, "findings": [{"category": "audit-summary", "summary": "Reviewed recent audit events.", "evidence_count": 0}], "next_actions": ["Review rejected or adapter_error events before the next execution-sensitive workflow."]}
+    path = root / "trading" / "reports" / "postmortem" / f"{sanitize_id(report['id'])}.postmortem_report.json"
+    write_json(path, report)
+    write_audit_event(root, {"type": "postmortem.created", "payload": {"id": report["id"], "path": path.relative_to(root).as_posix()}}, "head-manager", "cli")
+    print_json({"status": "created", "id": report["id"], "path": path.relative_to(root).as_posix()})

tradingcodex_cli/commands/policy.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+from tradingcodex_service.mcp_runtime import call_mcp_tool
+from tradingcodex_cli.commands.utils import _option_value, print_json
+
+def policy(root: Path, argv: list[str]) -> None:
+    if not argv or argv[0] != "simulate":
+        raise ValueError("Usage: tcx policy simulate --principal <id> --action <action> --resource <resource>")
+    args = argv[1:]
+    result = call_mcp_tool(root, "simulate_policy", {
+        "principal_id": _option_value(args, "--principal") or "unknown",
+        "action": _option_value(args, "--action") or "unknown",
+        "resource": _option_value(args, "--resource") or "*",
+        "require_approval_check": (_option_value(args, "--action") == "mcp.tradingcodex.submit_approved_order"),
+    })
+    print_json(result)
+    if result.get("decision") != "allow":
+        sys.exit(1)

tradingcodex_cli/commands/profile.py

@@ -0,0 +1,110 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from tradingcodex_cli.commands.utils import print_json
+from tradingcodex_service.application.runtime import (
+    active_profile_for_workspace,
+    default_active_profile,
+    ensure_workspace_manifest,
+    normalize_active_profile,
+    set_active_profile_for_workspace,
+)
+from tradingcodex_service.application.common import sanitize_id
+
+
+PROFILES_REL = ".tradingcodex/profiles.json"
+
+
+def profile(root: Path, argv: list[str]) -> None:
+    sub = argv[0] if argv else "status"
+    args = argv[1:]
+    if sub == "status":
+        manifest = ensure_workspace_manifest(root)
+        print_json({
+            "status": "ok",
+            "workspace_id": manifest["workspace_id"],
+            "active_profile": manifest["active_profile"],
+            "execution_mode": manifest["execution_mode"],
+        })
+        return
+    if sub == "list":
+        active = active_profile_for_workspace(root)
+        print_json({
+            "active_profile_id": active["profile_id"],
+            "profiles": [
+                {**item, "active": item["profile_id"] == active["profile_id"]}
+                for item in _list_profiles(root)
+            ],
+        })
+        return
+    if sub == "create":
+        profile_id = args[0] if args else ""
+        if not profile_id:
+            raise ValueError("Usage: tcx profile create <profile-id>")
+        created = _profile_from_id(profile_id)
+        registry = _read_profiles(root)
+        registry[created["profile_id"]] = created
+        _write_profiles(root, registry)
+        print_json({"status": "created", "profile": created})
+        return
+    if sub == "select":
+        profile_id = args[0] if args else ""
+        if not profile_id:
+            raise ValueError("Usage: tcx profile select <profile-id>")
+        registry = _read_profiles(root)
+        if profile_id in {"default", "default-paper", "shared"}:
+            selected = default_active_profile()
+        else:
+            selected = registry.get(sanitize_id(profile_id))
+            if selected is None:
+                raise ValueError(f"unknown profile: {profile_id}. Run `tcx profile create {profile_id}` first.")
+        manifest = set_active_profile_for_workspace(root, selected)
+        print_json({"status": "selected", "workspace_id": manifest["workspace_id"], "active_profile": manifest["active_profile"]})
+        return
+    raise ValueError("Usage: tcx profile status|list|create|select")
+
+
+def _profile_from_id(raw_id: str) -> dict[str, Any]:
+    profile_id = sanitize_id(raw_id)
+    return normalize_active_profile({
+        "profile_id": profile_id,
+        "portfolio_id": profile_id,
+        "account_id": "local-paper",
+        "strategy_id": "default-strategy",
+        "label": profile_id,
+        "shared": False,
+    })
+
+
+def _profiles_path(root: Path) -> Path:
+    return root / PROFILES_REL
+
+
+def _read_profiles(root: Path) -> dict[str, dict[str, Any]]:
+    try:
+        raw = json.loads(_profiles_path(root).read_text(encoding="utf-8"))
+    except Exception:
+        raw = {}
+    profiles = raw.get("profiles") if isinstance(raw, dict) else {}
+    result: dict[str, dict[str, Any]] = {}
+    if isinstance(profiles, dict):
+        for key, value in profiles.items():
+            if isinstance(value, dict):
+                normalized = normalize_active_profile(value)
+                result[normalized["profile_id"] or sanitize_id(key)] = normalized
+    return result
+
+
+def _write_profiles(root: Path, profiles: dict[str, dict[str, Any]]) -> None:
+    path = _profiles_path(root)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps({"profiles": profiles}, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+
+
+def _list_profiles(root: Path) -> list[dict[str, Any]]:
+    profiles = {default_active_profile()["profile_id"]: default_active_profile()}
+    profiles.update(_read_profiles(root))
+    return [profiles[key] for key in sorted(profiles)]