tradingcodex 0.3.2__tar.gz → 0.3.4__tar.gz

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 0.3.2
+Version: 0.3.4
 Summary: Agentic investment workflow harness for Codex-native research and service-gated execution checks.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0
@@ -229,7 +229,7 @@ provide investment recommendations or guarantee returns.
 | Status | Milestone |
 | --- | --- |
 | Shipped | Generated Codex workspace, fixed role roster, project MCP config, Django service plane, local web dashboard, Admin, Ninja API, file-native research memory, component registry, policy/audit primitives. |
-| Current `0.3.2` | Brief research chat replies with saved head-manager synthesis reports, Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
+| Current `0.3.4` | Build Center customization, Codex MCP discovery/import, external MCP permission approval UX, head-manager research synthesis depth, flexible package/workspace update status, skipped-version Django migration smoke coverage, Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
 | Next | Deeper validation scenarios, richer provider capability profiles, stronger generated-workspace smoke coverage, and improved artifact quality tooling. |
 | Future | Separately governed verified adapters, hosted/managed services, enterprise policy/compliance packs, and broker-specific live providers only after explicit product, policy, adapter, and validation work. |
 

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/README.md

@@ -198,7 +198,7 @@ provide investment recommendations or guarantee returns.
 | Status | Milestone |
 | --- | --- |
 | Shipped | Generated Codex workspace, fixed role roster, project MCP config, Django service plane, local web dashboard, Admin, Ninja API, file-native research memory, component registry, policy/audit primitives. |
-| Current `0.3.2` | Brief research chat replies with saved head-manager synthesis reports, Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
+| Current `0.3.4` | Build Center customization, Codex MCP discovery/import, external MCP permission approval UX, head-manager research synthesis depth, flexible package/workspace update status, skipped-version Django migration smoke coverage, Codex-native Decision Packages, independent judgment-review gate, staged workflow planning, artifact-supervisor loop closure state, Evidence Run/Validation Cards, provider capability profiles, and Python `>=3.11,<3.15` support. |
 | Next | Deeper validation scenarios, richer provider capability profiles, stronger generated-workspace smoke coverage, and improved artifact quality tooling. |
 | Future | Separately governed verified adapters, hosted/managed services, enterprise policy/compliance packs, and broker-specific live providers only after explicit product, policy, adapter, and validation work. |
 

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/apps/mcp/admin.py

@@ -1,6 +1,7 @@
 from django.contrib import admin
 
 from apps.mcp.models import (
+    McpExternalPermissionRequest,
     McpExternalTool,
     McpExternalToolCall,
     McpExternalToolPermission,
@@ -16,5 +17,6 @@ admin.site.register([
     McpRouter,
     McpExternalTool,
     McpExternalToolPermission,
+    McpExternalPermissionRequest,
     McpExternalToolCall,
 ])

tradingcodex-0.3.4/apps/mcp/migrations/0002_mcpexternalpermissionrequest.py

@@ -0,0 +1,51 @@
+# Generated by TradingCodex on 2026-07-06
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("mcp", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="McpExternalPermissionRequest",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("router_name", models.CharField(max_length=160)),
+                ("external_name", models.CharField(max_length=200)),
+                ("principal_id", models.CharField(default="unknown", max_length=128)),
+                ("role", models.CharField(blank=True, max_length=128)),
+                ("workflow_run_id", models.CharField(blank=True, max_length=160)),
+                ("request_hash", models.CharField(max_length=64)),
+                ("arguments_summary", models.JSONField(blank=True, default=dict)),
+                ("approval_scope", models.CharField(default="single_call", max_length=32)),
+                ("status", models.CharField(default="pending", max_length=32)),
+                ("reasons", models.JSONField(blank=True, default=list)),
+                ("expires_at", models.DateTimeField(blank=True, null=True)),
+                ("decided_by", models.CharField(blank=True, max_length=128)),
+                ("decided_at", models.DateTimeField(blank=True, null=True)),
+                ("decision_reason", models.TextField(blank=True)),
+                (
+                    "external_tool",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="permission_requests",
+                        to="mcp.mcpexternaltool",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "external MCP permission request",
+                "verbose_name_plural": "external MCP permission requests",
+                "ordering": ["-created_at", "-id"],
+            },
+        ),
+    ]

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/apps/mcp/models.py

@@ -130,6 +130,34 @@ class McpExternalToolPermission(models.Model):
         return f"{self.external_tool.external_name} {self.principal_or_role} {self.decision}"
 
 
+class McpExternalPermissionRequest(models.Model):
+    external_tool = models.ForeignKey(McpExternalTool, on_delete=models.SET_NULL, null=True, blank=True, related_name="permission_requests")
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+    router_name = models.CharField(max_length=160)
+    external_name = models.CharField(max_length=200)
+    principal_id = models.CharField(max_length=128, default="unknown")
+    role = models.CharField(max_length=128, blank=True)
+    workflow_run_id = models.CharField(max_length=160, blank=True)
+    request_hash = models.CharField(max_length=64)
+    arguments_summary = models.JSONField(default=dict, blank=True)
+    approval_scope = models.CharField(max_length=32, default="single_call")
+    status = models.CharField(max_length=32, default="pending")
+    reasons = models.JSONField(default=list, blank=True)
+    expires_at = models.DateTimeField(null=True, blank=True)
+    decided_by = models.CharField(max_length=128, blank=True)
+    decided_at = models.DateTimeField(null=True, blank=True)
+    decision_reason = models.TextField(blank=True)
+
+    class Meta:
+        ordering = ["-created_at", "-id"]
+        verbose_name = "external MCP permission request"
+        verbose_name_plural = "external MCP permission requests"
+
+    def __str__(self) -> str:
+        return f"{self.router_name}:{self.external_name} {self.status}"
+
+
 class McpExternalToolCall(models.Model):
     created_at = models.DateTimeField(auto_now_add=True)
     external_tool = models.ForeignKey(McpExternalTool, on_delete=models.SET_NULL, null=True, blank=True, related_name="calls")

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/apps/mcp/services.py

@@ -8,12 +8,14 @@ import shlex
 import subprocess
 import time
 import urllib.request
+from datetime import timedelta
 from typing import Any
 
 from django.utils import timezone
 from django.db.models import QuerySet
 
 from apps.mcp.models import (
+    McpExternalPermissionRequest,
     McpExternalTool,
     McpExternalToolCall,
     McpExternalToolPermission,
@@ -53,6 +55,8 @@ RESEARCH_ROLES = {
 }
 ACCOUNT_READ_ROLES = {"head-manager", "portfolio-manager", "risk-manager", "execution-operator"}
 PORTFOLIO_STATE_ROLES = {"portfolio-manager", "risk-manager"}
+USER_APPROVAL_CATEGORIES = {"account_read", "portfolio_state", "research_write", "workflow_prompt", "execution"}
+SENSITIVE_ARGUMENT_RE = re.compile(r"secret|credential|password|api[_-]?key|token", flags=re.I)
 
 
 def set_mcp_tools_enabled(queryset: QuerySet[McpToolDefinition], enabled: bool, actor: str = "admin") -> int:
@@ -355,8 +359,25 @@ def evaluate_external_mcp_proxy_call(
     arguments: dict[str, Any] | None = None,
     actor: str = "mcp-proxy",
 ) -> dict[str, Any]:
+    arguments = arguments or {}
     reasons = external_tool_denial_reasons(tool, principal_id)
-    decision = "allow" if not reasons else "deny"
+    request_hash = stable_hash(arguments)
+    permission_request = None
+    if not reasons and _external_tool_requires_user_approval(tool) and not _approved_external_permission(tool, principal_id, request_hash):
+        role = role_for_principal_id(principal_id)
+        permission_request = _create_or_reuse_permission_request(
+            tool,
+            principal_id=principal_id,
+            role=role,
+            request_hash=request_hash,
+            arguments=arguments,
+            workflow_run_id=str(arguments.get("workflow_run_id") or ""),
+            reasons=["user permission required for external MCP call"],
+        )
+        reasons = ["user permission required for external MCP call"]
+        decision = "approval_required"
+    else:
+        decision = "allow" if not reasons else "deny"
     result = {
         "decision": decision,
         "reasons": reasons,
@@ -368,6 +389,7 @@ def evaluate_external_mcp_proxy_call(
         "canonical_capability": tool.canonical_capability,
         "adapter_call_allowed": decision == "allow" and tool.proxy_mode in SERVICE_PROXY_MODES,
         "direct_proxy_allowed": decision == "allow" and tool.proxy_mode in READ_ONLY_PROXY_MODES,
+        "permission_request": serialize_permission_request(permission_request) if permission_request else None,
         "db_canonical": True,
         "workspace_context": workspace_context_payload(workspace_root),
     }
@@ -379,16 +401,104 @@ def evaluate_external_mcp_proxy_call(
         proxy_mode=tool.proxy_mode,
         decision=decision,
         reasons=reasons,
-        request=arguments or {},
+        request=arguments,
         response=result,
-        request_hash=stable_hash(arguments or {}),
+        request_hash=request_hash,
         result_hash=stable_hash(result),
         workspace_context=result["workspace_context"],
     )
-    _audit("external_mcp.proxy_allowed" if decision == "allow" else "external_mcp.proxy_denied", {"tool": str(tool), "reasons": reasons}, actor)
+    audit_action = "external_mcp.proxy_allowed" if decision == "allow" else "external_mcp.proxy_permission_required" if decision == "approval_required" else "external_mcp.proxy_denied"
+    _audit(audit_action, {"tool": str(tool), "reasons": reasons}, actor)
     return result
 
 
+def list_external_mcp_permission_requests(workspace_root: Any = None, args: dict[str, Any] | None = None) -> dict[str, Any]:
+    ensure_runtime_database(workspace_root)
+    _expire_external_mcp_permission_requests()
+    args = args or {}
+    queryset = McpExternalPermissionRequest.objects.select_related("external_tool").all()
+    status = str(args.get("status") or "pending")
+    if status and status != "all":
+        queryset = queryset.filter(status=status)
+    if args.get("principal_id"):
+        queryset = queryset.filter(principal_id=str(args["principal_id"]))
+    if args.get("router_name") or args.get("name"):
+        queryset = queryset.filter(router_name=str(args.get("router_name") or args.get("name")))
+    limit = max(1, min(int(args.get("limit") or 50), 200))
+    return {
+        "status": "ok",
+        "requests": [serialize_permission_request(item) for item in queryset[:limit]],
+        "count": queryset.count(),
+        "workspace_context": workspace_context_payload(workspace_root),
+    }
+
+
+def approve_external_mcp_permission_request(workspace_root: Any, args: dict[str, Any] | None = None) -> dict[str, Any]:
+    ensure_runtime_database(workspace_root)
+    _expire_external_mcp_permission_requests()
+    args = args or {}
+    request = resolve_external_mcp_permission_request(args)
+    if request.status != "pending":
+        raise ValueError(f"external MCP permission request is not pending: {request.status}")
+    request.status = "approved"
+    request.decided_by = str(args.get("principal_id") or args.get("decided_by") or "user")
+    request.decided_at = timezone.now()
+    request.decision_reason = str(args.get("reason") or "")
+    request.save(update_fields=["status", "decided_by", "decided_at", "decision_reason", "updated_at"])
+    _audit("external_mcp.permission_approved", {"request_id": request.id, "tool": f"{request.router_name}:{request.external_name}"}, request.decided_by)
+    return {"status": "approved", "request": serialize_permission_request(request), "workspace_context": workspace_context_payload(workspace_root)}
+
+
+def deny_external_mcp_permission_request(workspace_root: Any, args: dict[str, Any] | None = None) -> dict[str, Any]:
+    ensure_runtime_database(workspace_root)
+    _expire_external_mcp_permission_requests()
+    args = args or {}
+    request = resolve_external_mcp_permission_request(args)
+    if request.status != "pending":
+        raise ValueError(f"external MCP permission request is not pending: {request.status}")
+    request.status = "denied"
+    request.decided_by = str(args.get("principal_id") or args.get("decided_by") or "user")
+    request.decided_at = timezone.now()
+    request.decision_reason = str(args.get("reason") or "")
+    request.save(update_fields=["status", "decided_by", "decided_at", "decision_reason", "updated_at"])
+    _audit("external_mcp.permission_denied", {"request_id": request.id, "tool": f"{request.router_name}:{request.external_name}"}, request.decided_by)
+    return {"status": "denied", "request": serialize_permission_request(request), "workspace_context": workspace_context_payload(workspace_root)}
+
+
+def resolve_external_mcp_permission_request(args: dict[str, Any]) -> McpExternalPermissionRequest:
+    request_id = args.get("request_id") or args.get("id")
+    if request_id in (None, ""):
+        raise ValueError("external MCP permission request requires request_id")
+    request = McpExternalPermissionRequest.objects.select_related("external_tool").filter(pk=int(request_id)).first()
+    if request is None:
+        raise ValueError(f"external MCP permission request not found: {request_id}")
+    return request
+
+
+def serialize_permission_request(request: McpExternalPermissionRequest | None) -> dict[str, Any] | None:
+    if request is None:
+        return None
+    return {
+        "id": request.id,
+        "created_at": request.created_at.isoformat() if request.created_at else "",
+        "updated_at": request.updated_at.isoformat() if request.updated_at else "",
+        "router_name": request.router_name,
+        "external_name": request.external_name,
+        "principal_id": request.principal_id,
+        "role": request.role,
+        "workflow_run_id": request.workflow_run_id,
+        "request_hash": request.request_hash,
+        "arguments_summary": request.arguments_summary,
+        "approval_scope": request.approval_scope,
+        "status": request.status,
+        "reasons": list(request.reasons or []),
+        "expires_at": request.expires_at.isoformat() if request.expires_at else "",
+        "decided_by": request.decided_by,
+        "decided_at": request.decided_at.isoformat() if request.decided_at else "",
+        "decision_reason": request.decision_reason,
+    }
+
+
 def external_tool_denial_reasons(tool: McpExternalTool, principal_id: str) -> list[str]:
     reasons: list[str] = []
     role = role_for_principal_id(principal_id)
@@ -412,6 +522,79 @@ def external_tool_denial_reasons(tool: McpExternalTool, principal_id: str) -> li
     return list(dict.fromkeys(reasons))
 
 
+def _external_tool_requires_user_approval(tool: McpExternalTool) -> bool:
+    if tool.category in USER_APPROVAL_CATEGORIES:
+        return True
+    return tool.sensitivity not in {"public", ""} or tool.risk_level in {"write", "approval", "execution"}
+
+
+def _approved_external_permission(tool: McpExternalTool, principal_id: str, request_hash: str) -> bool:
+    now = timezone.now()
+    return McpExternalPermissionRequest.objects.filter(
+        external_tool=tool,
+        principal_id=principal_id,
+        request_hash=request_hash,
+        status="approved",
+    ).filter(expires_at__gt=now).exists()
+
+
+def _create_or_reuse_permission_request(
+    tool: McpExternalTool,
+    *,
+    principal_id: str,
+    role: str,
+    request_hash: str,
+    arguments: dict[str, Any],
+    workflow_run_id: str = "",
+    reasons: list[str] | None = None,
+) -> McpExternalPermissionRequest:
+    now = timezone.now()
+    _expire_external_mcp_permission_requests(now)
+    request = McpExternalPermissionRequest.objects.filter(
+        external_tool=tool,
+        principal_id=principal_id,
+        request_hash=request_hash,
+        status="pending",
+        expires_at__gt=now,
+    ).first()
+    if request is not None:
+        return request
+    return McpExternalPermissionRequest.objects.create(
+        external_tool=tool,
+        router_name=tool.router.name,
+        external_name=tool.external_name,
+        principal_id=principal_id,
+        role=role,
+        workflow_run_id=workflow_run_id,
+        request_hash=request_hash,
+        arguments_summary=_summarize_arguments(arguments),
+        reasons=reasons or [],
+        expires_at=now + timedelta(hours=24),
+    )
+
+
+def _expire_external_mcp_permission_requests(now: Any = None) -> None:
+    now = now or timezone.now()
+    McpExternalPermissionRequest.objects.filter(status="pending", expires_at__lte=now).update(status="expired", updated_at=now)
+
+
+def _summarize_arguments(arguments: dict[str, Any]) -> dict[str, Any]:
+    summary: dict[str, Any] = {}
+    for key, value in sorted((arguments or {}).items()):
+        if SENSITIVE_ARGUMENT_RE.search(str(key)):
+            summary[str(key)] = "<redacted>"
+        elif isinstance(value, str | int | float | bool) or value is None:
+            text = str(value)
+            summary[str(key)] = text if len(text) <= 120 else text[:117] + "..."
+        elif isinstance(value, list):
+            summary[str(key)] = f"list[{len(value)}]"
+        elif isinstance(value, dict):
+            summary[str(key)] = f"object[{len(value)}]"
+        else:
+            summary[str(key)] = type(value).__name__
+    return summary
+
+
 def resolve_external_mcp_router(args: dict[str, Any]) -> McpRouter:
     router_id = args.get("router_id") or args.get("connection_id")
     name = args.get("name") or args.get("router_name")

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/docs/README.md

@@ -64,7 +64,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | [interfaces-and-surfaces.md](./interfaces-and-surfaces.md) | Product web, Django Admin, Django Ninja API, MCP boundary, CLI, generated wrapper behavior, and external MCP surface. |
 | [generated-workspaces.md](./generated-workspaces.md) | `tcx attach`, `tcx init`, `tcx update`, generated files, project-scoped MCP config, hooks, workspace provenance, profile scope, and template rules. |
 | [validation-and-test-plan.md](./validation-and-test-plan.md) | Required validation commands, unit/API/generator/smoke coverage, MCP smokes, broker provider smokes, routing scenarios, and release-sensitive checks. |
-| [deployment.md](./deployment.md) | PyPI/TestPyPI release process, CI/CD, Trusted Publishing, installer/update policy, versioning, and what is not deployed. |
+| [deployment.md](./deployment.md) | PyPI release process, CI/CD, Trusted Publishing, installer/update policy, versioning, and what is not deployed. |
 | [licensing-and-commercialization.md](./licensing-and-commercialization.md) | Apache-2.0 open-core boundary, generated workspace ownership, contributions, trademark posture, and legal review needs. |
 
 ## Change-To-Docs Map

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/docs/deployment.md

@@ -34,9 +34,6 @@ Use Python 3.11 for release build verification and keep CI green across the
 supported range. The package metadata requires `>=3.11,<3.15`, and CI runs on
 Python 3.11, 3.12, 3.13, and 3.14.
 
-Create separate PyPI and TestPyPI accounts. TestPyPI is a separate service and
-does not share login state with PyPI.
-
 Configure Trusted Publishing before the first upload. Do not store long-lived
 PyPI API tokens in GitHub repository secrets unless Trusted Publishing is not
 available.
@@ -46,12 +43,9 @@ Trusted Publisher settings:
 | Index | Project | Owner | Repository | Workflow | Environment |
 | --- | --- | --- | --- | --- | --- |
 | PyPI | `tradingcodex` | repository owner/org | repository name | `release.yml` | `pypi` |
-| TestPyPI | `tradingcodex` | repository owner/org | repository name | `release.yml` | `testpypi` |
-
-On GitHub, create both environments:
 
-- `testpypi`: no manual approval required by default
-- `pypi`: require manual approval before deployment
+On GitHub, create the `pypi` environment and require manual approval before
+deployment.
 
 ## Local Build Verification
 
@@ -101,27 +95,25 @@ It runs on pull requests and pushes to `main` or `develop`:
 - builds the package for validation only
 - validates distribution metadata with `twine check`
 
-The CI workflow never uploads to TestPyPI or PyPI. Pushes to `main` or
-`develop` run tests and packaging checks only.
+The CI workflow never uploads to PyPI. Pushes to `main` or `develop` run tests
+and packaging checks only.
 
 Release automation is defined in `.github/workflows/release.yml` and appears as
 `Manual Release` in GitHub Actions.
 
 The release workflow is manual-only. Branch pushes and tag pushes must not
-publish package artifacts to TestPyPI or PyPI.
+publish package artifacts to PyPI.
 
 The release workflow has additional guardrails:
 
 - publication requires `workflow_dispatch`
 - PyPI publication is allowed only from the `main` branch
-- TestPyPI and PyPI publication must be run as separate manual workflow runs
 - concurrent release runs on the same ref are serialized instead of cancelled
 
-Manual `workflow_dispatch` can publish to TestPyPI when
-`publish_testpypi=true`, and to PyPI when `publish_pypi=true`.
+Manual `workflow_dispatch` can publish to PyPI when `publish_pypi=true`.
 
-Keep both publish inputs set to `false` when the run should only build and
-verify distributions.
+Keep `publish_pypi=false` when the run should only build and verify
+distributions.
 
 The workflow uses PyPI Trusted Publishing. The publish jobs request only an
 OIDC token through `id-token: write`; they do not require API-token secrets.
@@ -134,32 +126,6 @@ and download do not depend on the deprecated Node.js 20 action runtime.
 `tcx update` applies central DB migrations before the updated workspace is used.
 Product flows create, check, approve, and submit `OrderTicket` records directly.
 
-## TestPyPI Release
-
-Use TestPyPI before the first public PyPI release and after packaging changes.
-
-1. Confirm the local build verification steps pass.
-2. Run the `Manual Release` workflow manually with `publish_testpypi=true`.
-3. Install from TestPyPI in a clean environment.
-
-Example:
-
-```bash
-python3.11 -m venv /tmp/tcx-testpypi
-/tmp/tcx-testpypi/bin/pip install \
-  --index-url https://test.pypi.org/simple/ \
-  --extra-index-url https://pypi.org/simple/ \
-  tradingcodex==0.3.2
-rm -rf /tmp/tcx-testpypi-smoke
-mkdir -p /tmp/tcx-testpypi-smoke
-cd /tmp/tcx-testpypi-smoke
-/tmp/tcx-testpypi/bin/tcx attach .
-./tcx doctor
-```
-
-`--extra-index-url` is used because dependencies such as Django may not be
-available on TestPyPI.
-
 ## PyPI Release
 
 Before pushing the release tag:
@@ -168,7 +134,6 @@ Before pushing the release tag:
 - verify `README.md` describes execution as service-gated
 - verify docs mention that live broker execution requires installed providers and explicit gates
 - run local build verification
-- run a TestPyPI release when packaging changed
 
 Then create or update the GitHub release/tag as needed, and run the
 `Manual Release` workflow manually with `publish_pypi=true`. Do not rely on tag push for
@@ -178,7 +143,7 @@ After the PyPI workflow completes:
 
 ```bash
 python3.11 -m venv /tmp/tcx-pypi
-/tmp/tcx-pypi/bin/pip install tradingcodex==0.3.2
+/tmp/tcx-pypi/bin/pip install tradingcodex==0.3.4
 rm -rf /tmp/tcx-pypi-smoke
 mkdir -p /tmp/tcx-pypi-smoke
 cd /tmp/tcx-pypi-smoke
@@ -279,7 +244,13 @@ Use PEP 440 versions:
   state fixes after `0.3.0`
 - `0.3.2` for brief research chat replies with saved head-manager synthesis
   reports after `0.3.1`
-- later patch releases for compatible fixes after `0.3.2`
+- `0.3.3` for flexible update status across package/workspace drift,
+  skipped-version Django migration smoke coverage, and PyPI-only release flow
+  after `0.3.2`
+- `0.3.4` for Build Center customization, Codex MCP discovery/import, external
+  MCP permission approval UX, and head-manager research synthesis depth after
+  `0.3.3`
+- later patch releases for compatible fixes after `0.3.4`
 - pre-releases such as `0.4.0a1`, `0.4.0b1`, or `0.4.0rc1` when preparing
   the next minor contract
 

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/docs/generated-workspaces.md

@@ -101,7 +101,7 @@ Generated workspaces contain:
 - an immutable workspace manifest at `.tradingcodex/workspace.json`
 - root `head-manager` identity loaded from `.codex/prompts/base_instructions/head-manager.md` through `.codex/config.toml` `model_instructions_file`
 - sectioned Markdown base-instruction format for `head-manager`, including `# How you work`, TradingCodex guardrails, and tool guidelines
-- Codex-style operating style in the root `head-manager` prompt: scoped `AGENTS.md` handling, concise preambles, selective planning, `rg`-first search, `apply_patch` edits, focused validation, dirty-worktree respect, concise maintenance handoffs, and brief chat replies that point to saved head-manager synthesis reports once accepted artifacts exist
+- Codex-style operating style in the root `head-manager` prompt: scoped `AGENTS.md` handling, concise preambles, selective planning, `rg`-first search, `apply_patch` edits, focused validation, dirty-worktree respect, concise maintenance handoffs, and brief chat replies that point to saved head-manager synthesis reports once accepted artifacts exist without making the saved research report shallow
 - instruction/skill separation: root `head-manager` instructions own identity, durable safety boundaries, fail-closed dispatch, role boundaries, skill routing, optional-skill management, and approved action boundaries; fixed subagent TOML files own standing role identity, MCP/tool config, artifact walls, and always-on prohibitions; repo skills are dependency-light capability procedures for workflow maps, compact assignment-envelope templates, optional skill file management, quality gates, synthesis, and postmortems, without declaring role ownership or direct inter-skill call chains
 - no-overlap handoff contract: each role owns its specialist question, downstream roles consume accepted artifacts, and missing/stale/weak upstream work returns `revise`, `blocked`, or `waiting` instead of being silently redone by another role
 - validated staged workflow plan: hook intake hints are not binding; `$tcx-workflow`
@@ -158,6 +158,7 @@ Generated workspaces contain:
 - fixed subagent `nickname_candidates` set to a single item matching the exact role `name`
 - fixed subagent identities kept in `.codex/agents/*.toml` `developer_instructions`, as required by Codex custom agent files
 - project-local additional agent instructions under `.tradingcodex/agent-instructions/<role>.md`; projection appends them after generated default instructions for `head-manager` and fixed subagents
+- workspace customization preferences under `.tradingcodex/user/customization.json`, merged over global defaults in `~/.tradingcodex/preferences/customization.json`; these files store UX/config metadata and never raw credentials
 - twenty-six core repo skills across project-scope mainagent skills and subagent skill directories, each with `SKILL.md` frontmatter for document metadata and UI metadata when projected
 - decision-quality skill bundles for forecasting discipline, thesis scenario
   trees, numeric data QC, and anti-overfit validation, plus role-owned
@@ -186,6 +187,12 @@ ownership comes from the Python component registry and is exported into
 Agent and skill ownership comes from the Python agent registry and is projected
 into Codex-readable agent TOML plus generated agent/skill indexes.
 
+User-configured Codex MCP servers are discovered from project and root Codex
+config, then imported into TradingCodex External MCP Gate before use. Generated
+project config should not expose external broker/data MCP tools directly to
+subagents. TradingCodex writes Codex MCP config only inside explicit managed
+blocks and leaves user-owned config outside those blocks untouched.
+
 ## Attach-First UX
 
 TradingCodex is installed globally once, then attached to the workspace where
@@ -250,8 +257,9 @@ user-terminal workspace-only path:
 step. If startup health reports `update_status.workspace_update_allowed=true`,
 `head-manager` should tell the user to run
 `update_status.workspace_update_command` from their terminal. If startup health
-reports `update_status.package_update_required_first=true`, package refresh is
-also a user-terminal action, normally:
+reports `update_status.package_update_required_first=true`, including when the
+generated workspace and installed wrapper both match an older release, package
+refresh is also a user-terminal action, normally:
 
 ```bash
 uvx --refresh --from tradingcodex tcx update .
@@ -366,7 +374,10 @@ must explain the two supported paths: switch Codex to full access and enable
 TradingCodex build mode, or run the recommended `update_status.command` from a
 terminal. Self-update is allowed only when Codex full access and explicit
 workspace build mode are both active and the user asks for the update. After
-self-update, `head-manager` stops and tells the user to restart Codex.
+self-update, `head-manager` stops and tells the user to restart Codex. If a
+same-DB service is already running with a newer TradingCodex version than the
+current wrapper, startup health treats that service version as an update hint
+and should recommend package/workspace refresh before service stop.
 
 Build mode is per workspace and explicit:
 

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/docs/interfaces-and-surfaces.md

@@ -50,6 +50,9 @@ Routes:
 - `/integrations/mcp/` Data Sources surface for External MCP Gate registry,
   source connection checks, manual discovery import, available action review,
   role scopes, and audited dry-run decisions
+- `/build/` Build Center for build-mode status, Codex config MCP discovery,
+  managed MCP config writes, agent customization summary, and pending external
+  MCP permission requests
 
 Direct diagnostic routes may remain for local operators, but they are not part
 of the primary product navigation:
@@ -147,6 +150,12 @@ primary web entrypoint. When present, it is server-rendered SVG/HTML and shows:
 - The product web app can register external MCP connections, import discovery
   metadata, review available actions/resources, set role scopes, and audit
   dry-run decisions. It must not expose raw external tools directly to Codex.
+- The product web app can discover project/root Codex MCP config and write
+  only TradingCodex managed MCP blocks when build mode and Codex full access
+  are active. It must not rewrite user-owned config outside managed blocks.
+- The product web app can approve or deny pending external MCP permission
+  requests; this is user consent for proxy evaluation, not order or execution
+  authorization.
 - Execution-sensitive actions remain behind TradingCodex MCP and service-layer
   policy, approval, duplicate-request, connection, and audit checks.
 
@@ -355,6 +364,7 @@ Top-level commands:
 - `tcx research create|append|get|list|search|export|run-card|validation-card`
 - `tcx policy simulate`
 - `tcx db status|path|migrate`
+- `tcx build status|codex-mcp|permission`
 - `tcx mcp call <tool> [tool args]`
 - `tcx mcp ledger [--tool <name>] [--principal <id>] [--status ok]`
 - `tcx mcp install-global --safe`
@@ -371,6 +381,7 @@ Generated workspace wrapper commands:
 - `./tcx update status [--json]`
 - `./tcx mode status`
 - `./tcx mode set build --reason "<reason>"`
+- `./tcx build status|codex-mcp|permission`
 - `./tcx mode set operate`
 - `./tcx connectors status`
 - `./tcx connectors providers`

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/docs/roles-skills-and-workflows.md

@@ -160,7 +160,9 @@ broader checks, respect for dirty worktrees, and concise maintenance handoffs.
 Investment synthesis stores depth in a workspace Markdown report: after
 accepted artifacts exist, `head-manager` should save the full synthesis under
 `trading/reports/head-manager/` and keep the chat reply brief with the report
-path, 1-3 key takeaways, and next allowed action.
+path, 1-3 key takeaways, and next allowed action. The brief chat handoff must
+not compress the saved research artifact; the Markdown report remains the
+detailed user-facing research output.
 
 This operating style is a working discipline, not an investment permission.
 It does not weaken the dispatch gate, role-owned skill boundary, approved action
@@ -395,7 +397,8 @@ posture, or core skill behavior.
 - Once accepted artifacts exist, head-manager final synthesis should be saved
   as `trading/reports/head-manager/synthesis-<workflow_run_id>.md` through the
   research artifact path. The chat reply should stay brief and point to that
-  report instead of pasting the full synthesis.
+  report instead of pasting the full synthesis, but the report itself should
+  remain detailed enough to stand alone.
 - `plan-workflow` mandates and `automate-workflow` automation summaries follow the same user-language rule.
 - When selecting an exact fixed role with Codex `spawn_agent`, do not combine `agent_type` with full-history forking. Use a compact assignment envelope on the first attempt and no model/reasoning overrides.
 - Workflow consent stays separate from explicit user constraints. Consent to orchestrate or use subagents allows dispatch, but it is not itself an analytical constraint.

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/docs/safety-policy-and-execution.md

@@ -137,6 +137,14 @@ External MCP permission is not execution authorization. Even if an external
 broker order tool is present and reviewed, order submission must still pass the
 TradingCodex order-ticket, approval, duplicate-request, connection, and audit lifecycle.
 
+Reviewed external MCP calls that expose private account state, write research
+state, use workflow prompts, or map to execution require an explicit user
+permission request before proxy evaluation returns `allow`. The request is
+stored as pending service-layer state and surfaced through Build Center,
+`tcx build permission list`, and the coordinator-visible MCP pending-request
+list. Subagents must stop at `waiting_for_user_permission` instead of burying a
+Codex permission prompt in their transcript.
+
 Codex network access may be enabled for public web, filing, disclosure, news,
 and market-data evidence gathering. That access is read-only research support:
 it does not authorize direct broker APIs, raw external broker MCP exposure,

{tradingcodex-0.3.2 → tradingcodex-0.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tradingcodex"
-version = "0.3.2"
+version = "0.3.4"
 description = "Agentic investment workflow harness for Codex-native research and service-gated execution checks."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"