tradingcodex 0.3.1__tar.gz → 0.3.3__tar.gz

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 0.3.1
+Version: 0.3.3
 Summary: Agentic investment workflow harness for Codex-native research and service-gated execution checks.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0
@@ -229,7 +229,7 @@ provide investment recommendations or guarantee returns.
 | Status | Milestone |
 | --- | --- |
 | Shipped | Generated Codex workspace, fixed role roster, project MCP config, Django service plane, local web dashboard, Admin, Ninja API, file-native research memory, component registry, policy/audit primitives. |
-| Current `0.3.1` | Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
+| Current `0.3.3` | Flexible package/workspace update status, skipped-version Django migration smoke coverage, brief research chat replies with saved head-manager synthesis reports, Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
 | Next | Deeper validation scenarios, richer provider capability profiles, stronger generated-workspace smoke coverage, and improved artifact quality tooling. |
 | Future | Separately governed verified adapters, hosted/managed services, enterprise policy/compliance packs, and broker-specific live providers only after explicit product, policy, adapter, and validation work. |
 

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/README.md

@@ -198,7 +198,7 @@ provide investment recommendations or guarantee returns.
 | Status | Milestone |
 | --- | --- |
 | Shipped | Generated Codex workspace, fixed role roster, project MCP config, Django service plane, local web dashboard, Admin, Ninja API, file-native research memory, component registry, policy/audit primitives. |
-| Current `0.3.1` | Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
+| Current `0.3.3` | Flexible package/workspace update status, skipped-version Django migration smoke coverage, brief research chat replies with saved head-manager synthesis reports, Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
 | Next | Deeper validation scenarios, richer provider capability profiles, stronger generated-workspace smoke coverage, and improved artifact quality tooling. |
 | Future | Separately governed verified adapters, hosted/managed services, enterprise policy/compliance packs, and broker-specific live providers only after explicit product, policy, adapter, and validation work. |
 

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/docs/README.md

@@ -64,7 +64,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | [interfaces-and-surfaces.md](./interfaces-and-surfaces.md) | Product web, Django Admin, Django Ninja API, MCP boundary, CLI, generated wrapper behavior, and external MCP surface. |
 | [generated-workspaces.md](./generated-workspaces.md) | `tcx attach`, `tcx init`, `tcx update`, generated files, project-scoped MCP config, hooks, workspace provenance, profile scope, and template rules. |
 | [validation-and-test-plan.md](./validation-and-test-plan.md) | Required validation commands, unit/API/generator/smoke coverage, MCP smokes, broker provider smokes, routing scenarios, and release-sensitive checks. |
-| [deployment.md](./deployment.md) | PyPI/TestPyPI release process, CI/CD, Trusted Publishing, installer/update policy, versioning, and what is not deployed. |
+| [deployment.md](./deployment.md) | PyPI release process, CI/CD, Trusted Publishing, installer/update policy, versioning, and what is not deployed. |
 | [licensing-and-commercialization.md](./licensing-and-commercialization.md) | Apache-2.0 open-core boundary, generated workspace ownership, contributions, trademark posture, and legal review needs. |
 
 ## Change-To-Docs Map

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/docs/core-concepts-and-rules.md

@@ -96,6 +96,9 @@ subagents. Detailed responsibilities live in
 Handoff states are `accepted`, `revise`, `blocked`, or `waiting`. Only accepted
 artifacts move downstream. `head-manager` may synthesize accepted outputs and
 conflicts, but must not repair missing specialist work with direct analysis.
+When synthesis is allowed, the full user-facing synthesis should be saved as a
+workspace Markdown report; the chat reply should stay brief and point to that
+report.
 
 ## Execution Lifecycle Snapshot
 

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/docs/deployment.md

@@ -34,9 +34,6 @@ Use Python 3.11 for release build verification and keep CI green across the
 supported range. The package metadata requires `>=3.11,<3.15`, and CI runs on
 Python 3.11, 3.12, 3.13, and 3.14.
 
-Create separate PyPI and TestPyPI accounts. TestPyPI is a separate service and
-does not share login state with PyPI.
-
 Configure Trusted Publishing before the first upload. Do not store long-lived
 PyPI API tokens in GitHub repository secrets unless Trusted Publishing is not
 available.
@@ -46,12 +43,9 @@ Trusted Publisher settings:
 | Index | Project | Owner | Repository | Workflow | Environment |
 | --- | --- | --- | --- | --- | --- |
 | PyPI | `tradingcodex` | repository owner/org | repository name | `release.yml` | `pypi` |
-| TestPyPI | `tradingcodex` | repository owner/org | repository name | `release.yml` | `testpypi` |
-
-On GitHub, create both environments:
 
-- `testpypi`: no manual approval required by default
-- `pypi`: require manual approval before deployment
+On GitHub, create the `pypi` environment and require manual approval before
+deployment.
 
 ## Local Build Verification
 
@@ -101,27 +95,25 @@ It runs on pull requests and pushes to `main` or `develop`:
 - builds the package for validation only
 - validates distribution metadata with `twine check`
 
-The CI workflow never uploads to TestPyPI or PyPI. Pushes to `main` or
-`develop` run tests and packaging checks only.
+The CI workflow never uploads to PyPI. Pushes to `main` or `develop` run tests
+and packaging checks only.
 
 Release automation is defined in `.github/workflows/release.yml` and appears as
 `Manual Release` in GitHub Actions.
 
 The release workflow is manual-only. Branch pushes and tag pushes must not
-publish package artifacts to TestPyPI or PyPI.
+publish package artifacts to PyPI.
 
 The release workflow has additional guardrails:
 
 - publication requires `workflow_dispatch`
 - PyPI publication is allowed only from the `main` branch
-- TestPyPI and PyPI publication must be run as separate manual workflow runs
 - concurrent release runs on the same ref are serialized instead of cancelled
 
-Manual `workflow_dispatch` can publish to TestPyPI when
-`publish_testpypi=true`, and to PyPI when `publish_pypi=true`.
+Manual `workflow_dispatch` can publish to PyPI when `publish_pypi=true`.
 
-Keep both publish inputs set to `false` when the run should only build and
-verify distributions.
+Keep `publish_pypi=false` when the run should only build and verify
+distributions.
 
 The workflow uses PyPI Trusted Publishing. The publish jobs request only an
 OIDC token through `id-token: write`; they do not require API-token secrets.
@@ -134,32 +126,6 @@ and download do not depend on the deprecated Node.js 20 action runtime.
 `tcx update` applies central DB migrations before the updated workspace is used.
 Product flows create, check, approve, and submit `OrderTicket` records directly.
 
-## TestPyPI Release
-
-Use TestPyPI before the first public PyPI release and after packaging changes.
-
-1. Confirm the local build verification steps pass.
-2. Run the `Manual Release` workflow manually with `publish_testpypi=true`.
-3. Install from TestPyPI in a clean environment.
-
-Example:
-
-```bash
-python3.11 -m venv /tmp/tcx-testpypi
-/tmp/tcx-testpypi/bin/pip install \
-  --index-url https://test.pypi.org/simple/ \
-  --extra-index-url https://pypi.org/simple/ \
-  tradingcodex==0.3.1
-rm -rf /tmp/tcx-testpypi-smoke
-mkdir -p /tmp/tcx-testpypi-smoke
-cd /tmp/tcx-testpypi-smoke
-/tmp/tcx-testpypi/bin/tcx attach .
-./tcx doctor
-```
-
-`--extra-index-url` is used because dependencies such as Django may not be
-available on TestPyPI.
-
 ## PyPI Release
 
 Before pushing the release tag:
@@ -168,7 +134,6 @@ Before pushing the release tag:
 - verify `README.md` describes execution as service-gated
 - verify docs mention that live broker execution requires installed providers and explicit gates
 - run local build verification
-- run a TestPyPI release when packaging changed
 
 Then create or update the GitHub release/tag as needed, and run the
 `Manual Release` workflow manually with `publish_pypi=true`. Do not rely on tag push for
@@ -178,7 +143,7 @@ After the PyPI workflow completes:
 
 ```bash
 python3.11 -m venv /tmp/tcx-pypi
-/tmp/tcx-pypi/bin/pip install tradingcodex==0.3.1
+/tmp/tcx-pypi/bin/pip install tradingcodex==0.3.3
 rm -rf /tmp/tcx-pypi-smoke
 mkdir -p /tmp/tcx-pypi-smoke
 cd /tmp/tcx-pypi-smoke
@@ -277,7 +242,12 @@ Use PEP 440 versions:
   updates after `0.2.10`
 - `0.3.1` for compatible evidence-card validation and persisted loop closure
   state fixes after `0.3.0`
-- later patch releases for compatible fixes after `0.3.1`
+- `0.3.2` for brief research chat replies with saved head-manager synthesis
+  reports after `0.3.1`
+- `0.3.3` for flexible update status across package/workspace drift,
+  skipped-version Django migration smoke coverage, and PyPI-only release flow
+  after `0.3.2`
+- later patch releases for compatible fixes after `0.3.3`
 - pre-releases such as `0.4.0a1`, `0.4.0b1`, or `0.4.0rc1` when preparing
   the next minor contract
 

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/docs/generated-workspaces.md

@@ -101,7 +101,7 @@ Generated workspaces contain:
 - an immutable workspace manifest at `.tradingcodex/workspace.json`
 - root `head-manager` identity loaded from `.codex/prompts/base_instructions/head-manager.md` through `.codex/config.toml` `model_instructions_file`
 - sectioned Markdown base-instruction format for `head-manager`, including `# How you work`, TradingCodex guardrails, and tool guidelines
-- Codex-style operating style in the root `head-manager` prompt: scoped `AGENTS.md` handling, concise preambles, selective planning, `rg`-first search, `apply_patch` edits, focused validation, dirty-worktree respect, and concise final handoffs
+- Codex-style operating style in the root `head-manager` prompt: scoped `AGENTS.md` handling, concise preambles, selective planning, `rg`-first search, `apply_patch` edits, focused validation, dirty-worktree respect, concise maintenance handoffs, and brief chat replies that point to saved head-manager synthesis reports once accepted artifacts exist
 - instruction/skill separation: root `head-manager` instructions own identity, durable safety boundaries, fail-closed dispatch, role boundaries, skill routing, optional-skill management, and approved action boundaries; fixed subagent TOML files own standing role identity, MCP/tool config, artifact walls, and always-on prohibitions; repo skills are dependency-light capability procedures for workflow maps, compact assignment-envelope templates, optional skill file management, quality gates, synthesis, and postmortems, without declaring role ownership or direct inter-skill call chains
 - no-overlap handoff contract: each role owns its specialist question, downstream roles consume accepted artifacts, and missing/stale/weak upstream work returns `revise`, `blocked`, or `waiting` instead of being silently redone by another role
 - validated staged workflow plan: hook intake hints are not binding; `$tcx-workflow`
@@ -250,8 +250,9 @@ user-terminal workspace-only path:
 step. If startup health reports `update_status.workspace_update_allowed=true`,
 `head-manager` should tell the user to run
 `update_status.workspace_update_command` from their terminal. If startup health
-reports `update_status.package_update_required_first=true`, package refresh is
-also a user-terminal action, normally:
+reports `update_status.package_update_required_first=true`, including when the
+generated workspace and installed wrapper both match an older release, package
+refresh is also a user-terminal action, normally:
 
 ```bash
 uvx --refresh --from tradingcodex tcx update .
@@ -366,7 +367,10 @@ must explain the two supported paths: switch Codex to full access and enable
 TradingCodex build mode, or run the recommended `update_status.command` from a
 terminal. Self-update is allowed only when Codex full access and explicit
 workspace build mode are both active and the user asks for the update. After
-self-update, `head-manager` stops and tells the user to restart Codex.
+self-update, `head-manager` stops and tells the user to restart Codex. If a
+same-DB service is already running with a newer TradingCodex version than the
+current wrapper, startup health treats that service version as an update hint
+and should recommend package/workspace refresh before service stop.
 
 Build mode is per workspace and explicit:
 

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/docs/research-memory-and-artifacts.md

@@ -266,5 +266,7 @@ Research file writes should be deterministic enough for review:
 - include content hash
 - avoid raw secrets
 - use stable paths for role-owned reports
+- save head-manager final synthesis reports as
+  `trading/reports/head-manager/synthesis-<workflow_run_id>.md`
 - make stale/missing source warnings visible
 - keep file content readable by Codex without a DB lookup

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/docs/roles-skills-and-workflows.md

@@ -156,7 +156,11 @@ For repository, CLI, Django, MCP, template, docs, test, and harness maintenance
 work, `head-manager` follows the default Codex coding-agent style: concise
 preambles before grouped tool work, plans only for meaningful multi-step tasks,
 `rg`-first search, `apply_patch` for manual edits, focused validation before
-broader checks, respect for dirty worktrees, and concise final handoffs.
+broader checks, respect for dirty worktrees, and concise maintenance handoffs.
+Investment synthesis stores depth in a workspace Markdown report: after
+accepted artifacts exist, `head-manager` should save the full synthesis under
+`trading/reports/head-manager/` and keep the chat reply brief with the report
+path, 1-3 key takeaways, and next allowed action.
 
 This operating style is a working discipline, not an investment permission.
 It does not weaken the dispatch gate, role-owned skill boundary, approved action
@@ -166,8 +170,8 @@ boundary, approval requirements, or information barriers.
 
 | Situation | Allowed response | Forbidden response |
 | --- | --- | --- |
-| Broad analysis such as "Analyze Apple stock" | auto-dispatch or reuse selected subagents, then wait for outputs before synthesis | Direct business/price/news/recommendation analysis |
-| Explicit workflow request such as "$tcx-workflow analyze Apple" | Spawn selected team or reuse active/completed roles, wait for outputs, then synthesize | Analyze without dispatch |
+| Broad analysis such as "Analyze Apple stock" | auto-dispatch or reuse selected subagents, then wait for outputs before saving a head-manager synthesis report and returning a brief chat summary | Direct business/price/news/recommendation analysis |
+| Explicit workflow request such as "$tcx-workflow analyze Apple" | Spawn selected team or reuse active/completed roles, wait for outputs, then save a synthesis report and return its path with a brief summary | Analyze without dispatch |
 | Broker/provider build request | Check full-access plus TCX build mode, connect/scaffold/register/validate provider metadata through `$tcx-build`, and keep live submission inside service gates | Dispatch investment subagents, ask for raw secrets, or expose raw broker SDK tools |
 | Decision support such as "Should I buy?" | Dispatch analyst/valuation/portfolio/risk team and explain required artifacts/gates | Offer buy/sell opinion without subagent output |
 | Dispatch unavailable, role routing unverified, or dispatch failed | Provide `waiting_for_subagent_dispatch` state and task briefs only | Switch to "I will analyze it myself" |
@@ -388,6 +392,10 @@ posture, or core skill behavior.
 - Downstream roles start from artifact path plus `context_summary`; they open
   full markdown only for disputed, stale, missing, or load-bearing evidence.
 - The head-manager should tell subagents to write reader-facing research artifacts in the user's language from the original request unless the user explicitly requests another artifact language. File paths, frontmatter keys, symbols, tickers, source names, and quoted source text stay in their natural/original form.
+- Once accepted artifacts exist, head-manager final synthesis should be saved
+  as `trading/reports/head-manager/synthesis-<workflow_run_id>.md` through the
+  research artifact path. The chat reply should stay brief and point to that
+  report instead of pasting the full synthesis.
 - `plan-workflow` mandates and `automate-workflow` automation summaries follow the same user-language rule.
 - When selecting an exact fixed role with Codex `spawn_agent`, do not combine `agent_type` with full-history forking. Use a compact assignment envelope on the first attempt and no model/reasoning overrides.
 - Workflow consent stays separate from explicit user constraints. Consent to orchestrate or use subagents allows dispatch, but it is not itself an analytical constraint.

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/docs/validation-and-test-plan.md

@@ -251,6 +251,9 @@ Scenarios should include:
 - starter prompts and generated guidance expose the no-overlap handoff contract
 - starter prompts and generated guidance tell subagents to write reader-facing
   research artifacts in the user's language unless explicitly overridden
+- starter prompts and generated guidance tell `head-manager` to keep final chat
+  brief while saving full accepted-artifact synthesis as a Markdown report under
+  `trading/reports/head-manager/`
 - `tcx quality-check <artifact> --strict` fails research markdown that lacks
   source/as-of posture, `context_summary`, material claim tags, handoff state,
   confidence, missing-evidence fields, next-recipient routing, blocked actions,

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tradingcodex"
-version = "0.3.1"
+version = "0.3.3"
 description = "Agentic investment workflow harness for Codex-native research and service-gated execution checks."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/tests/test_python_migration.py

@@ -150,7 +150,7 @@ def test_service_autostart_rejects_version_and_db_mismatch(monkeypatch) -> None:
     )
     with pytest.raises(RuntimeError, match="version mismatch") as version_mismatch:
         service_autostart._assert_compatible_service("127.0.0.1", 48267)
-    assert "tcx service stop 127.0.0.1:48267" in str(version_mismatch.value)
+    assert "uvx --refresh --from tradingcodex tcx update ." in str(version_mismatch.value)
 
     monkeypatch.setattr(service_autostart, "tradingcodex_db_path", lambda: Path("/tmp/current.sqlite3"))
     monkeypatch.setattr(
@@ -195,6 +195,24 @@ def test_service_autostart_replaces_stale_same_db_service(monkeypatch, tmp_path:
     assert state["started"] is True
 
 
+def test_service_autostart_does_not_replace_newer_same_db_service(monkeypatch, tmp_path: Path) -> None:
+    from tradingcodex_cli import service_autostart
+
+    current_db = tmp_path / "current.sqlite3"
+    monkeypatch.setattr(service_autostart, "tradingcodex_db_path", lambda: current_db)
+    monkeypatch.setattr(service_autostart, "_tcp_open", lambda host, port: True)
+    monkeypatch.setattr(
+        service_autostart,
+        "_service_health",
+        lambda host, port: {"service": "tradingcodex", "version": "999.0.0", "db_path": str(current_db)},
+    )
+    monkeypatch.setattr(service_autostart, "stop_service", lambda *args, **kwargs: (_ for _ in ()).throw(AssertionError("stopped newer service")))
+    monkeypatch.setattr(service_autostart, "_start_service", lambda *args: (_ for _ in ()).throw(AssertionError("started over newer service")))
+
+    with pytest.raises(RuntimeError, match="uvx --refresh --from tradingcodex tcx update"):
+        service_autostart.ensure_service_up(tmp_path, timeout=0.01)
+
+
 def test_service_status_reports_actionable_state(monkeypatch) -> None:
     from tradingcodex_cli import service_autostart
 
@@ -218,6 +236,15 @@ def test_service_status_reports_actionable_state(monkeypatch) -> None:
     assert mismatch["package_version"] == TRADINGCODEX_VERSION
     assert "tcx service stop 127.0.0.1:48267" in mismatch["next_action"]
 
+    monkeypatch.setattr(
+        service_autostart,
+        "_service_health",
+        lambda host, port: {"service": "tradingcodex", "version": "999.0.0", "db_path": str(Path("/tmp/current.sqlite3"))},
+    )
+    newer_service = service_autostart.service_status("127.0.0.1:48267")
+    assert newer_service["issue"] == "version_mismatch"
+    assert "uvx --refresh --from tradingcodex tcx update ." in newer_service["next_action"]
+
     monkeypatch.setattr(service_autostart, "tradingcodex_db_path", lambda: Path("/tmp/current.sqlite3"))
     monkeypatch.setattr(
         service_autostart,
@@ -230,6 +257,67 @@ def test_service_status_reports_actionable_state(monkeypatch) -> None:
     assert compatible["next_action"] == "No action needed."
 
 
+def test_db_migrate_applies_skipped_django_migrations_and_legacy_order_data(tmp_path: Path) -> None:
+    workspace = tmp_path / "skip-migration-workspace"
+    workspace.mkdir()
+    home = tmp_path / "tc-home-skip-migration"
+    env_extra = {"TRADINGCODEX_HOME": str(home), "TRADINGCODEX_DB_NAME": None}
+
+    run([sys.executable, "manage.py", "migrate", "orders", "0001", "--noinput"], ROOT, env_extra=env_extra)
+    db_path = home / "state" / "tradingcodex.sqlite3"
+    with sqlite3.connect(db_path) as connection:
+        connection.execute(
+            """
+            INSERT INTO orders_orderintent (
+              intent_id, symbol, side, quantity, limit_price, currency, broker,
+              estimated_notional_krw, created_by, created_at, portfolio_id,
+              account_id, strategy_id, workspace_context, payload
+            )
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            """,
+            (
+                "legacy-intent-1",
+                "NVDA",
+                "buy",
+                "1",
+                "100",
+                "USD",
+                "paper",
+                "100",
+                "portfolio-manager",
+                "2026-01-01 00:00:00",
+                "default-paper",
+                "local-paper",
+                "default-strategy",
+                "{}",
+                json.dumps({"order_intent": {"order_ticket_id": "legacy-ticket-1", "symbol": "NVDA", "side": "buy", "quantity": "1"}}),
+            ),
+        )
+
+    migrated = json.loads(run([sys.executable, "-m", "tradingcodex_cli", "db", "migrate"], workspace, env_extra=env_extra).stdout)
+    assert migrated["status"] == "migrated"
+    with sqlite3.connect(db_path) as connection:
+        applied = {
+            (row[0], row[1])
+            for row in connection.execute("SELECT app, name FROM django_migrations")
+        }
+        tables = {
+            row[0]
+            for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")
+        }
+        ticket = connection.execute(
+            "SELECT ticket_id, symbol, side, payload_hash FROM orders_orderticket WHERE ticket_id = ?",
+            ("legacy-ticket-1",),
+        ).fetchone()
+
+    assert ("orders", "0004_remove_order_intent_compat_fields") in applied
+    assert ("integrations", "0002_brokerconnection_brokeraccount_instrumentmap") in applied
+    assert "orders_orderintent" not in tables
+    assert ticket is not None
+    assert ticket[:3] == ("legacy-ticket-1", "NVDA", "buy")
+    assert ticket[3]
+
+
 def test_service_runserver_uses_fixed_port_and_skips_duplicate(monkeypatch, tmp_path: Path, capsys) -> None:
     from django.core import management
     from tradingcodex_cli import __main__ as cli_main
@@ -351,6 +439,49 @@ def test_startup_status_preserves_service_mismatch_details(monkeypatch, tmp_path
     assert status["allowed_next_actions"][0] == service_detail["next_action"]
 
 
+def test_startup_status_uses_same_db_newer_service_as_update_hint(monkeypatch, tmp_path: Path) -> None:
+    from tradingcodex_cli import startup_status
+
+    workspace = make_workspace(tmp_path)
+    module_lock_path = workspace / ".tradingcodex" / "generated" / "module-lock.json"
+    module_lock = json.loads(module_lock_path.read_text(encoding="utf-8"))
+    module_lock["tradingcodex_version"] = "0.3.1"
+    module_lock_path.write_text(json.dumps(module_lock, indent=2) + "\n", encoding="utf-8")
+    db_path = "/tmp/current.sqlite3"
+    monkeypatch.setattr(startup_status, "TRADINGCODEX_VERSION", "0.3.1")
+    monkeypatch.setattr(
+        startup_status,
+        "latest_release_info",
+        lambda: (_ for _ in ()).throw(AssertionError("latest release check should use service hint")),
+    )
+    monkeypatch.setattr(
+        startup_status,
+        "inspect_service_status",
+        lambda addr: {
+            "addr": addr,
+            "url": f"http://{addr}/",
+            "reachable": True,
+            "compatible": False,
+            "service": "tradingcodex",
+            "version": "0.3.2",
+            "package_version": "0.3.1",
+            "db_path": db_path,
+            "expected_db_path": db_path,
+            "issue": "version_mismatch",
+            "next_action": "Run package refresh.",
+        },
+    )
+    monkeypatch.setattr(startup_status, "_read_health", lambda url: {"service": "tradingcodex", "version": "0.3.2", "db_path": db_path})
+
+    status = startup_status.build_server_status(workspace)
+
+    update_status = status["update_status"]
+    assert update_status["versions_match"] is True
+    assert update_status["latest_release_source"] == "service_status"
+    assert update_status["package_update_required"] is True
+    assert update_status["command"] == "uvx --refresh --from tradingcodex tcx update ."
+
+
 def test_manage_runserver_uses_fixed_port_and_skips_duplicate(monkeypatch, capsys) -> None:
     from tradingcodex_cli import service_autostart
 
@@ -898,6 +1029,55 @@ def test_session_start_update_recommendation_respects_home_preference(tmp_path:
     assert run_user_prompt_hook(workspace, "Create a quality income strategy for dividend stocks") is None
 
 
+def test_update_status_detects_stale_package_when_workspace_matches_installed(monkeypatch, tmp_path: Path) -> None:
+    from tradingcodex_cli import startup_status
+
+    workspace = make_workspace(tmp_path)
+    module_lock_path = workspace / ".tradingcodex" / "generated" / "module-lock.json"
+    module_lock = json.loads(module_lock_path.read_text(encoding="utf-8"))
+    module_lock["tradingcodex_version"] = "0.3.1"
+    module_lock_path.write_text(json.dumps(module_lock, indent=2) + "\n", encoding="utf-8")
+    monkeypatch.setattr(startup_status, "TRADINGCODEX_VERSION", "0.3.1")
+    monkeypatch.setattr(
+        startup_status,
+        "latest_release_info",
+        lambda: {"latest_release_version": "0.3.2", "latest_release_status": "ok", "latest_release_source": "test"},
+    )
+
+    update_status = startup_status.build_update_status(workspace, check_latest_release=True)
+
+    assert update_status["versions_match"] is True
+    assert update_status["workspace_update_available"] is False
+    assert update_status["package_update_required"] is True
+    assert update_status["package_update_required_first"] is True
+    assert update_status["update_available"] is True
+    assert update_status["command"] == "uvx --refresh --from tradingcodex tcx update ."
+
+
+def test_update_status_uses_service_hint_when_latest_check_unavailable(monkeypatch, tmp_path: Path) -> None:
+    from tradingcodex_cli import startup_status
+
+    workspace = make_workspace(tmp_path)
+    module_lock_path = workspace / ".tradingcodex" / "generated" / "module-lock.json"
+    module_lock = json.loads(module_lock_path.read_text(encoding="utf-8"))
+    module_lock["tradingcodex_version"] = "0.3.0"
+    module_lock_path.write_text(json.dumps(module_lock, indent=2) + "\n", encoding="utf-8")
+    monkeypatch.setattr(startup_status, "TRADINGCODEX_VERSION", "0.3.1")
+    monkeypatch.setattr(
+        startup_status,
+        "latest_release_info",
+        lambda: {"latest_release_version": "unknown", "latest_release_status": "unavailable", "latest_release_source": "test"},
+    )
+
+    update_status = startup_status.build_update_status(workspace, latest_version_hint="0.3.2")
+
+    assert update_status["workspace_update_available"] is True
+    assert update_status["latest_release_source"] == "service_status"
+    assert update_status["package_update_required"] is True
+    assert update_status["workspace_update_allowed"] is False
+    assert update_status["command"] == "uvx --refresh --from tradingcodex tcx update ."
+
+
 def test_repo_skill_templates_keep_instruction_boundary() -> None:
     skill_root = ROOT / "workspace_templates" / "modules" / "repo-skills" / "files" / ".agents" / "skills"
     subagent_skill_root = ROOT / "workspace_templates" / "modules" / "repo-skills" / "files" / ".tradingcodex" / "subagents" / "skills"
@@ -1393,7 +1573,7 @@ def test_runtime_mode_update_and_connector_build_cli(tmp_path: Path) -> None:
     module_lock_path.write_text(json.dumps(module_lock, indent=2) + "\n", encoding="utf-8")
     update_status = json.loads(
         run(
-            ["./tcx", "update", "status", "--json"],
+            ["./tcx", "update", "status", "--json", "--skip-refresh"],
             workspace,
             env_extra={"TRADINGCODEX_CODEX_PERMISSION": "danger-full-access", "TRADINGCODEX_LATEST_RELEASE_VERSION": TRADINGCODEX_VERSION},
         ).stdout
@@ -1693,6 +1873,7 @@ def test_update_refreshes_workspace_contract_and_preserves_identity(tmp_path: Pa
     assert module_lock["tradingcodex_version"] == TRADINGCODEX_VERSION
     assert module_lock["tradingcodex_package_spec"] == "tradingcodex"
     assert 'TRADINGCODEX_UPDATE_SKIP_REFRESH="${TRADINGCODEX_UPDATE_SKIP_REFRESH:-0}"' in wrapper
+    assert 'if [ "${1:-}" = "update" ] && [ "${2:-}" = "status" ]; then' not in wrapper
     assert 'if [ "${1:-}" = "update" ] && [ "$TRADINGCODEX_UPDATE_SKIP_REFRESH" != "1" ] && command -v uvx >/dev/null 2>&1; then' in wrapper
     assert '"--skip-refresh"' in wrapper
     assert "  ./tcx doctor" in updated.stdout
@@ -1749,7 +1930,9 @@ def test_starter_prompt_keeps_negated_actions_out_of_execution() -> None:
     assert "Context budget:" in macro
     assert "context_summary" in macro
     assert "reader_summary, next_action" in macro
-    assert "Reader mode: open with a plain-English answer" in macro
+    assert "Reader mode: keep final chat brief" in macro
+    assert "create_research_artifact at `trading/reports/head-manager/synthesis-<workflow_run_id>.md`" in macro
+    assert "final user-facing synthesis should be deep enough" not in macro
     assert "Artifact memory:" in macro
     assert "improvements for future judgment" in macro
     assert "Do not let downstream roles redo missing upstream work" in macro
@@ -2381,7 +2564,8 @@ def test_subagents_prompt_cli_and_api_expose_intake_summary(tmp_path: Path, monk
         for agent in cli_json["intake_summary"]["subagents"]
         if agent["role"] == "valuation-analyst"
     )
-    assert "Reader mode: open with a plain-English answer" in cli_json["starter_prompt"]
+    assert "Reader mode: keep final chat brief" in cli_json["starter_prompt"]
+    assert "synthesis-<workflow_run_id>" in cli_json["starter_prompt"]
     assert "Investor profile questions to ask if unanswered" in cli_json["starter_prompt"]
     assert "Method lenses for this lane" in cli_json["starter_prompt"]
 
@@ -4598,7 +4782,7 @@ def test_product_web_does_not_create_approvals_or_executions(monkeypatch) -> Non
     assert "Idea translated" in decision_body
     assert "candidate thesis" in decision_body
     assert "Portfolio fit" in decision_body
-    assert "Reviews the business, financial drivers" in decision_body
+    assert "Reviews the business, financial drivers" not in decision_body
     assert "workflow reaches portfolio/order readiness" in decision_body
     assert "Next allowed actions" in decision_body
     assert "Answer missing profile questions" in decision_body
@@ -4705,6 +4889,83 @@ def test_file_native_research_artifacts_via_mcp_api_and_cli(tmp_path: Path) -> N
     assert strict_quality["frontmatter"]["reader_summary"].startswith("Plain-English first read")
     assert strict_quality["frontmatter"]["next_action"] == "Wait for valuation before any portfolio fit discussion."
     assert not any("non-expert first-read UX" in warning for warning in strict_quality["warnings"])
+    synthesis = call_mcp_tool(workspace, "create_research_artifact", {
+        "principal_id": "head-manager",
+        "artifact_id": "synthesis-workflow-unit",
+        "artifact_type": "synthesis_report",
+        "universe": "public_equity",
+        "workflow_type": "thesis_review",
+        "symbol": "NVDA",
+        "role": "head-manager",
+        "title": "NVDA Head-Manager Synthesis",
+        "markdown": """---
+workflow_lane: thesis_review
+forecast_allowed: false
+scenario_cases:
+  - base case remains unmodeled in this synthesis smoke
+contrary_evidence:
+  - accepted artifacts still have one unresolved source freshness gap
+source_trust_notes:
+  - source posture comes from accepted role artifacts
+update_triggers:
+  - new accepted role artifact changes the thesis
+invalidation_conditions:
+  - accepted role artifact contradicts the synthesis
+---
+
+# NVDA Head-Manager Synthesis
+
+## Direct Answer
+
+[inference] Accepted artifacts are sufficient for a research synthesis smoke, not for an order.
+
+## Accepted Artifact Inputs
+
+[factual] Input artifacts are referenced by path in frontmatter and body.
+
+## Synthesis
+
+[inference] The combined read remains research-only.
+
+## Disagreements/Conflicts
+
+[factual] One freshness gap remains visible.
+
+## Source/As-Of Posture
+
+[factual] Source posture is inherited from accepted role artifacts.
+
+## Missing Evidence
+
+[factual] Updated filing snapshot remains missing.
+
+## Caveats
+
+[assumption] No valuation, order, approval, or execution is implied.
+
+## Next Allowed Action
+
+[factual] User can inspect the saved synthesis report.
+""",
+        "source_as_of": "2026-06-01",
+        "readiness_label": "not-decision-ready",
+        "context_summary": "Head-manager synthesis report saved for user inspection.",
+        "reader_summary": "Brief chat should point to this saved synthesis report.",
+        "handoff_state": "accepted",
+        "confidence": "medium",
+        "missing_evidence": ["updated filing snapshot"],
+        "next_recipient": "user",
+        "next_action": "Inspect the saved synthesis report.",
+        "blocked_actions": ["order_drafting", "approval", "execution"],
+        "source_snapshot_ids": ["unit-test-filing"],
+        "created_by": "head-manager",
+        "export_path": "trading/reports/head-manager/synthesis-workflow-unit.md",
+    })
+    assert synthesis["export_path"] == "trading/reports/head-manager/synthesis-workflow-unit.md"
+    synthesis_quality = json.loads(run(["./tcx", "quality-check", synthesis["export_path"], "--strict"], workspace).stdout)
+    assert synthesis_quality["status"] == "pass"
+    assert synthesis_quality["frontmatter"]["artifact_type"] == "synthesis_report"
+    assert synthesis_quality["frontmatter"]["role"] == "head-manager"
     run_card = create_evidence_run_card(workspace, {
         "related_artifact_path": stored["export_path"],
         "config_hash": "unit-config-hash",

{tradingcodex-0.3.1 → tradingcodex-0.3.3}/tradingcodex.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 0.3.1
+Version: 0.3.3
 Summary: Agentic investment workflow harness for Codex-native research and service-gated execution checks.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0
@@ -229,7 +229,7 @@ provide investment recommendations or guarantee returns.
 | Status | Milestone |
 | --- | --- |
 | Shipped | Generated Codex workspace, fixed role roster, project MCP config, Django service plane, local web dashboard, Admin, Ninja API, file-native research memory, component registry, policy/audit primitives. |
-| Current `0.3.1` | Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
+| Current `0.3.3` | Flexible package/workspace update status, skipped-version Django migration smoke coverage, brief research chat replies with saved head-manager synthesis reports, Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
 | Next | Deeper validation scenarios, richer provider capability profiles, stronger generated-workspace smoke coverage, and improved artifact quality tooling. |
 | Future | Separately governed verified adapters, hosted/managed services, enterprise policy/compliance packs, and broker-specific live providers only after explicit product, policy, adapter, and validation work. |