tradingcodex 1.0.0__tar.gz → 1.0.1__tar.gz

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 1.0.1 - 2026-07-15
+
+- Add the shared `tcx-artifact` skill to all nine producing fixed roles so
+  deferred MCP calls receive the exact research-artifact, thesis-lifecycle,
+  retry, and forecast persistence procedure.
+- Expand `create_research_artifact` and `issue_forecast` MCP schemas to expose
+  state-specific lifecycle fields, one-range probability rules, RFC 3339
+  timestamps, and the complete base-rate contract before a call is attempted.
+  Artifact validation errors now name the supported alternative fields, and
+  MCP resource-template discovery returns an empty supported list. Omitted
+  forecast `issued_at` and revision `revised_at` values now reuse the same
+  service receipt timestamp as `recorded_at`, eliminating a microsecond race
+  that rejected otherwise valid agent calls.
+- Require Codex CLI 0.144.4, the validated reference for generated permission
+  profiles, V2 fixed-role dispatch, hooks, and deferred TradingCodex MCP calls.
+  Older clients now fail the runtime doctor check with upgrade guidance.
+
 ## 1.0.0 - 2026-07-15
 
 - Raise the validated Codex CLI reference to 0.144.4 while retaining the

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 1.0.0
+Version: 1.0.1
 Summary: Local-first investment operating system for Codex-native research and service-gated execution.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/README.md

@@ -47,7 +47,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 
 | Document | Purpose |
 | --- | --- |
-| [release-readiness.md](./release-readiness.md) | v1.0.0 source readiness, final-commit and exact-artifact validation, and pending tag, publication, and post-publish gates. |
+| [release-readiness.md](./release-readiness.md) | v1.0.1 source readiness, final-commit and exact-artifact validation, and pending tag, publication, and post-publish gates. |
 
 ## Workflow And Agent Documents
 

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/deployment.md

@@ -252,7 +252,7 @@ sh "$SOURCE_ROOT/install.sh" \
 On native Windows PowerShell:
 
 ```powershell
-$ReleaseVersion = "1.0.0"
+$ReleaseVersion = "1.0.1"
 $Workspace = Join-Path $env:TEMP "tcx-pypi-$ReleaseVersion"
 New-Item -ItemType Directory -Force $Workspace | Out-Null
 Set-Location $Workspace

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/execution-without-subagent-plan.md

@@ -60,7 +60,7 @@ design, migration, and validation evidence.
 - Provider canary regressions prove that submit/cancel results, health details,
   account-sync exceptions, and successful account display metadata do not
   reappear in DB rows, API/MCP projections, execution results, or audit events.
-- A disposable generated workspace reports nine fixed roles and 31 skills,
+- A disposable generated workspace reports nine fixed roles and 32 skills,
   contains no retired execution role, and exposes no ungated submit, cancel, or
   broker status-refresh mutation. Its one execution-risk MCP tool is
   `use_order_turn_grant`, which has no authority without hook-injected proof.

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/generated-workspaces.md

@@ -737,11 +737,11 @@ uvx --refresh --from tradingcodex tcx update . --from tradingcodex
 Generated root config sets `default_permissions = "trading-research"` and
 defines two custom profiles. It deliberately omits legacy `sandbox_mode` from
 the root and every fixed-role TOML because any loaded `sandbox_mode` overrides
-custom permission profiles in Codex. This contract supports Codex CLI 0.144.1
+custom permission profiles in Codex. This contract requires Codex CLI 0.144.4
 or later on a locally supported platform. Version 0.144.4 is the current
-release-validation reference for permission profiles, hooks, required MCP
-startup, and the explicit V2 feature table. Older compatible patch versions
-warn but do not fail ordinary doctor checks. These remain version-sensitive
+release-validation reference for permission profiles, hooks, required MCP,
+deferred MCP calls, and the explicit V2 feature table. Older versions fail the
+Codex runtime doctor check. These remain version-sensitive
 surfaces, so release validation includes strict config/feature inspection and
 a real native smoke.
 See the [Codex permissions reference](https://learn.chatgpt.com/docs/permissions).

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/release-readiness.md

@@ -1,15 +1,15 @@
-# TradingCodex 1.0.0 Release Status
+# TradingCodex 1.0.1 Release Status
 
-Status: release-branch implementation, broad suite, native workflow, browser,
-and exact Ubuntu/macOS/Windows distribution acceptance validated; merge CI,
-tag-bound rehearsal, tag, and publication remain pending
+Status: local source, frontend, disposable native workflow, and exact
+distribution gates complete; candidate CI, tag-bound rehearsal, tag, and
+publication remain pending
 Updated: 2026-07-15
 
-This page records the current `1.0.0` release state. It is not an implementation
+This page records the current `1.0.1` release state. It is not an implementation
 roadmap and does not treat source changes as proof that an exact distribution
 artifact or public release has passed its gates.
 
-## v1.0.0 Contract
+## v1.0.1 Contract
 
 - `tradingcodex_service/version.py` is the single version source for package
   metadata, `tcx --version`, generated workspaces, release input, and tags.
@@ -33,22 +33,49 @@ artifact or public release has passed its gates.
 
 | Area | Current state | Evidence or remaining gate |
 | --- | --- | --- |
-| Version identity | Verified in the working tree | `TRADINGCODEX_VERSION` is `1.0.0`; `pyproject.toml` reads it dynamically; `tcx --version` uses the same source. |
+| Version identity | Verified in the working tree | `TRADINGCODEX_VERSION` is `1.0.1`; `pyproject.toml` reads it dynamically; `tcx --version` uses the same source. |
 | Schema baseline | Verified in the working tree | Project apps contain only `0001_v1_initial`; migration-graph and model-state checks live in `tests/test_v1_migrations.py`. |
-| Workspace baseline | Current-reference preflight, release-branch native acceptance, and exact-wheel CI verified | A disposable development workspace passed strict pinned-reference config, explicit V2, persisted trust for all eight project hooks, the final artifact-to-synthesis workflow, and the disabled-dispatch fail-closed check after the prepublication quality-gate fix. GitHub CI then passed the exact release-branch wheel on macOS and Windows. |
-| Interfaces and safety | Verified on the release branch | GitHub CI passed 614 tests on each of Python 3.11, 3.12, 3.13, and 3.14, plus Django checks, migration checks, compile passes, focused safety invariants, frontend verification, clean-wheel construction, and native acceptance. |
+| Workspace baseline | Exact candidate native acceptance passes locally | The v1.0.1 candidate projects the shared artifact skill to all producing roles, requires the current reference Codex client, and exposes the nested MCP contracts. A disposable generated workspace passed strict config/hook preflight plus artifact, forecast, and proof-protected Brain MCP smokes. |
+| Interfaces and safety | Full local candidate suite passes | MCP schema, lifecycle-error, skill-projection, resource-template discovery, Codex-version, forecast receipt-time, Django, migration, compile, and full test gates pass. |
 | Frontend | Viewer source, build, and browser acceptance pass | Ten focused tests, typecheck/build, deterministic committed assets, three-section routing, read-only source checks, 1440px/900px/600px layouts, keyboard focus, workspace switching, long-label containment, and invalid-selection failure rendering pass. |
 | Release automation | Structurally verified | The release contract suite verifies tag and artifact gating; a manual `publish_pypi=false` rehearsal remains required. |
-| Distribution artifacts | Exact release-branch artifacts verified on Ubuntu, macOS, and Windows | Fresh `1.0.0` sdist/wheel build, `twine check`, and packaged-wheel smoke passed locally; GitHub CI built one clean wheel, passed its Ubuntu smoke, and reused the uploaded artifact for native macOS and Windows smokes. |
-| Git tag and PyPI | Not performed by this status | Merge/CI, annotated `v1.0.0` tag, protected-environment approval, and manual publication remain release-operator actions. |
+| Distribution artifacts | Exact local candidate passes | Fresh `1.0.1` sdist/wheel build, `twine check`, and the isolated macOS packaged-wheel smoke pass. Native CI reuse on Ubuntu, macOS, and Windows remains required. |
+| Git tag and PyPI | Not performed by this status | Merge/CI, annotated `v1.0.1` tag, protected-environment approval, and manual publication remain release-operator actions. |
 | Post-publish verification | Blocked on publication | Exact-version POSIX and native Windows attach/doctor smokes run only after PyPI contains the immutable artifacts. |
 
 Release-branch status describes candidate source shape, not release sign-off.
 The merged commit and exact uploaded artifacts remain authoritative.
 
-Current release-branch evidence recorded on 2026-07-15 is listed below. It
-authorizes merge of the candidate but does not substitute for CI on the merged
-commit or the tag-bound rehearsal of the immutable release artifacts:
+The local v1.0.1 candidate evidence recorded on 2026-07-15 is:
+
+- `python3.11 -m pytest`: **617 passed** with three dependency-level Pydantic
+  deprecation warnings and no failures.
+- `python3.11 manage.py check`, migration dry-run, compile pass, skill
+  validation, JSON-schema validation, and diff checks: passed.
+- `npm ci --prefix frontend`, the ten-test frontend suite, typecheck/build, and
+  deterministic committed-asset comparison: passed.
+- A fresh `tradingcodex-1.0.1` sdist and wheel built in isolation; both passed
+  `twine check`, and the wheel passed the macOS isolated-install platform smoke
+  with runtime version `1.0.1`.
+- A fresh generated development workspace passed `tcx doctor` and the strict
+  current-reference Codex CLI contract, including all eight trusted hooks.
+- Native artifact persistence completed with one exact
+  `fundamental-analyst` child after it loaded `tcx-artifact`; the accepted
+  artifact id was
+  `research_report-ACME-synthetic-fixture-fundamental-artifact-persistence-smoke-76d0866c5fa1`.
+- Native forecast persistence completed in one exact child without an MCP
+  retry: artifact
+  `fundamental_report-receipt-race-fixed-synthetic-recurring-revenue-smoke-e3e03d1566da`
+  produced forecast `forecast-261e59a11d6d4bb39fe0e8c80c95042d`.
+  The omitted caller timestamp resolved to one service receipt time, so
+  `issued_at` equaled `recorded_at`.
+- A fresh exact `$tcx-brain` management turn received the hook-owned build-turn
+  proof and completed the protected list call, confirming the current-reference
+  deferred MCP proof path.
+
+The v1.0.0 baseline evidence recorded on 2026-07-15 is listed below. It does
+not substitute for v1.0.1 validation, CI on the candidate commit, or the
+tag-bound rehearsal of the immutable patch artifacts:
 
 - GitHub Actions [CI run 29403737708](https://github.com/monarchjuno/tradingcodex/actions/runs/29403737708)
   passed on release-branch commit `12649b0`: the safety and financial invariant
@@ -223,13 +250,13 @@ Trusted Publisher configuration must be reviewed before publication.
 ## Tag And Publication State
 
 This document does not assert that the final commit is on `main`, CI is green,
-the tag exists, or PyPI contains `1.0.0`. After every final-commit and artifact
+the tag exists, or PyPI contains `1.0.1`. After every final-commit and artifact
 gate passes:
 
 1. Merge the release commit to `main` and wait for CI.
-2. Create and push the annotated tag `v1.0.0` at that commit.
+2. Create and push the annotated tag `v1.0.1` at that commit.
 3. Rehearse the manual workflow with `publish_pypi=false` and
-   `release_version=1.0.0`.
+   `release_version=1.0.1`.
 4. With protected-environment approval, run the same tag with
    `publish_pypi=true`.
 5. Verify the immutable PyPI files, release notes, and exact-version POSIX and

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/research-memory-and-artifacts.md

@@ -243,6 +243,12 @@ Codex and subagents should use service-layer tools when available:
   `create_blind_review_assignment`, `get_blind_review_packet`,
   `record_blind_human_review`, and `compare_evaluation_runs`
 
+For forecast issue and revision, agents normally omit `issued_at` and
+`revised_at`. The service assigns the event time and `recorded_at` from one
+receipt timestamp, avoiding client-clock drift and preserving the invariant
+that an event cannot occur after its system record. Explicit caller timestamps
+remain timezone-aware and fail closed when they are in the future.
+
 `source_snapshot_ids` are service-issued references, not agent-authored labels.
 When reproducibility requires a snapshot, the producing role calls
 `record_source_snapshot` first and copies only the exact returned `snapshot_id`

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/roles-skills-and-workflows.md

@@ -118,6 +118,14 @@ Required quality includes source/as-of posture, non-empty readiness label,
 context and reader summaries, confidence, missing evidence, next action,
 blocked actions, and explicit handoff state.
 
+Every producing fixed role receives the shared `tcx-artifact` skill. It maps
+the service's state-specific thesis lifecycle, single-range probability,
+follow-up request, RFC 3339, and complete forecast base-rate requirements into
+a compact persistence procedure. MCP schemas expose the same nested fields so
+deferred tool discovery supplies the contract before the call. A role applies
+all returned corrections in one targeted retry and stops in `waiting` if the
+same contract error repeats.
+
 For run-bound artifacts, provide `workflow_run_id` and exact consumed
 `input_artifact_ids`. The service derives producer identity, schema version,
 content hash, and input hashes. `plan_hash`, `stage_id`, and `task_id` are not v1
@@ -328,7 +336,7 @@ judgment, or mutate state. Operational diagnosis and recovery remain
 
 ## Validation
 
-Validate the nine-role fixed roster and projections, 31 skill bundles, absence
+Validate the nine-role fixed roster and projections, 32 skill bundles, absence
 of raw public execution-mutation tools, protected grant-tool proof behavior,
 deterministic native-action and `$tcx-order-allow` hook behavior,
 exact V2 dispatch, multilingual analysis requests,

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/docs/user-facing-skills.md

@@ -6,7 +6,7 @@ shape, automate, or review workflows without granting extra authority.
 
 ## Naming Contract
 
-All 31 bundled TradingCodex skills use the `tcx-` namespace. Prefer one word
+All 32 bundled TradingCodex skills use the `tcx-` namespace. Prefer one word
 after the prefix and use at most two words when clarity or safety requires it,
 as in `tcx-order-submit` or `tcx-investor-context`. Folder names, frontmatter
 names, registry ids, projected paths, UI metadata, and explicit `$` invocations
@@ -16,6 +16,10 @@ The namespace is reserved for bundled product skills. User-owned
 `strategy-*`, `investment-brain-*`, and optional role skills remain separate;
 an optional skill cannot claim a `tcx-*` id.
 
+The shared internal `tcx-artifact` skill is projected to every producing fixed
+role. It teaches the exact research-artifact, thesis-lifecycle, and forecast
+ledger contracts; users do not invoke it as a Head Manager entrypoint.
+
 ## Primary Entrypoints
 
 | Skill | Primary use | Main output |

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/installation.md

@@ -48,7 +48,7 @@ The target workspace should be empty. A directory with only `.git` already
 initialized is fine, as is an empty directory inside an existing parent
 worktree.
 
-Use Codex CLI 0.144.1 or later on macOS, Linux, WSL, or native Windows. Version
+Use Codex CLI 0.144.4 or later on macOS, Linux, WSL, or native Windows. Version
 0.144.4 is the current TradingCodex reference for custom permission profiles,
 hooks, required MCP startup, and explicit MultiAgent V2 configuration. Verify
 with `codex --version`; `./tcx doctor --layer guidance` fails below the

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_codex_cli_compat.py

@@ -12,8 +12,8 @@ from tradingcodex_cli.commands import doctor
     ("installed", "ok", "warn"),
     [
         ("0.144.0", False, False),
-        ("0.144.1", True, True),
-        ("0.144.2", True, True),
+        ("0.144.1", False, False),
+        ("0.144.2", False, False),
         ("0.144.4", True, False),
         ("0.145.0", True, True),
     ],
@@ -41,10 +41,10 @@ def test_codex_cli_reference_version_check(
     assert result["ok"] is ok
     assert bool(result.get("warn")) is warn
     assert f"installed={installed}" in result["detail"]
-    assert "required>=0.144.1" in result["detail"]
+    assert "required>=0.144.4" in result["detail"]
     assert "reference=0.144.4" in result["detail"]
     if installed in {"0.144.1", "0.144.2"}:
-        assert "compatible but older than reference" in result["detail"]
+        assert "older than required" in result["detail"]
     if installed == "0.145.0":
         assert "newer client requires harness revalidation" in result["detail"]
 

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_codex_native_orchestration.py

@@ -72,6 +72,25 @@ def test_mcp_surface_has_one_lightweight_run_tool_and_no_server_orchestrator() -
     improvement_item = artifact_properties["improvements"]["items"]
     assert improvement_item["type"] == "object"
     assert improvement_item["additionalProperties"] is False
+    lifecycle = artifact_properties["thesis_lifecycle"]
+    assert lifecycle["required"] == ["state"]
+    assert lifecycle["properties"]["state"]["enum"] == [
+        "exploring",
+        "testing",
+        "validated",
+        "rejected",
+        "monitoring",
+    ]
+    assert {"monitoring_artifact", "review_cadence"} <= set(lifecycle["properties"])
+    forecast_properties = TOOL_REGISTRY["issue_forecast"].input_schema["properties"]
+    assert forecast_properties["horizon"]["format"] == "date-time"
+    assert forecast_properties["issued_at"]["description"].startswith("Optional")
+    assert forecast_properties["base_rate"]["required"] == [
+        "cohort",
+        "source_snapshot_id",
+        "sample_size",
+        "selection_rule",
+    ]
 
 
 def test_authenticated_artifacts_bind_run_local_lineage(tmp_path: Path) -> None:
@@ -256,7 +275,7 @@ def test_generated_contract_projects_sol_head_and_terra_roles(workspace: Path) -
     assert 'enabled = true' in config
     assert 'max_concurrent_threads_per_session = 7' in config
     assert 'max_threads = 6' not in config
-    assert model_policy["roles"]["head-manager"]["minimum_codex_version"] == "0.144.1"
+    assert model_policy["roles"]["head-manager"]["minimum_codex_version"] == "0.144.4"
     assert model_policy["roles"]["head-manager"]["reference_codex_version"] == "0.144.4"
     assert "required = true" in config
     assert '"begin_analysis_run"' in config

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_dynamic_artifact_quality.py

@@ -81,6 +81,27 @@ def test_explicit_quality_requirements_still_fail_closed(tmp_path: Path) -> None
     assert "decision_quality.contrary_evidence" in result["required_fields_missing"]
 
 
+def test_monitoring_lifecycle_error_names_the_two_supported_fields(tmp_path: Path) -> None:
+    artifact_path = _write_artifact(
+        tmp_path,
+        "decision_quality_required: true\n"
+        "contrary_evidence: []\n"
+        "update_triggers: []\n"
+        "invalidation_conditions: []\n"
+        "source_trust_notes: []\n"
+        "thesis_lifecycle:\n"
+        "  state: monitoring\n",
+    )
+
+    result = evaluate_decision_quality(tmp_path, artifact_path, strict=True)
+
+    assert "decision_quality.thesis_lifecycle.monitoring_artifact_or_cadence" in result["required_fields_missing"]
+    assert (
+        "thesis_lifecycle.state=monitoring requires either monitoring_artifact or review_cadence"
+        in result["warnings"]
+    )
+
+
 def test_explicit_context_gate_is_not_suppressed_by_producer_role(tmp_path: Path) -> None:
     artifact_path = _write_artifact(
         tmp_path,

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_e2e_user_scenarios.py

@@ -242,7 +242,7 @@ def test_generated_workspace_codex_cli_user_scenario_matrix(tmp_path: Path) -> N
     status = json.loads(tcx(workspace, env_extra, "subagents", "status").stdout)
     assert status["installed_count"] == 9
     assert status["fixed_roster_ok"] is True
-    assert status["skills_installed"] == 31
+    assert status["skills_installed"] == 32
     plan = json.loads(tcx(workspace, env_extra, "subagents", "plan", "--all").stdout)
     assert plan["requested_count"] == 9
     assert plan["parallel_spawn_ok"] is False
@@ -254,10 +254,11 @@ def test_generated_workspace_codex_cli_user_scenario_matrix(tmp_path: Path) -> N
         "tcx-data-qc",
         "tcx-scenarios",
         "tcx-forecast",
+        "tcx-artifact",
         "tcx-fundamental",
     ]
     judgment_inspect = json.loads(tcx(workspace, env_extra, "subagents", "inspect", "judgment-reviewer").stdout)
-    assert judgment_inspect["effective_skills"] == ["tcx-judgment"]
+    assert judgment_inspect["effective_skills"] == ["tcx-artifact", "tcx-judgment"]
 
     optional_body = workspace / "source-quality-body.md"
     optional_body.write_text("# Source Quality Check\n\nCheck source dates and cite stale evidence warnings.\n", encoding="utf-8")

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_platform_runtime.py

@@ -53,6 +53,7 @@ from tradingcodex_service.application.common import (
     workspace_launcher_command,
 )
 from tradingcodex_service.application.customization import write_codex_mcp_server_config
+from tradingcodex_service.version import TRADINGCODEX_VERSION
 
 
 ROOT = Path(__file__).resolve().parents[1]
@@ -785,7 +786,7 @@ def test_service_version_mismatch_never_exposes_explicit_local_source(
     monkeypatch.setenv("TRADINGCODEX_MCP_PACKAGE_SPEC", str(local_source))
     monkeypatch.setenv(PACKAGE_SOURCE_KIND_ENV, "local-explicit")
 
-    action = _version_mismatch_next_action("1.0.1", "127.0.0.1:48267")
+    action = _version_mismatch_next_action("1.0.2", "127.0.0.1:48267")
 
     assert str(local_source) not in action
     assert "<package-spec>" in action
@@ -858,7 +859,7 @@ def test_real_custom_source_attach_patch_update_and_same_version_refresh(
     assert first_python.is_file()
 
     version_path = source / "tradingcodex_service/version.py"
-    version_path.write_text('TRADINGCODEX_VERSION = "1.0.1"\n', encoding="utf-8")
+    version_path.write_text('TRADINGCODEX_VERSION = "1.0.2"\n', encoding="utf-8")
     before_explicit_override = {
         path: path.read_bytes()
         for path in (
@@ -913,7 +914,7 @@ def test_real_custom_source_attach_patch_update_and_same_version_refresh(
     lock = json.loads(
         (workspace / ".tradingcodex/generated/module-lock.json").read_text(encoding="utf-8")
     )
-    assert lock["tradingcodex_version"] == "1.0.1"
+    assert lock["tradingcodex_version"] == "1.0.2"
     assert lock["tradingcodex_package_spec"] == LOCAL_EXECUTABLE_SOURCE_PROVENANCE
 
     main_path = source / "tradingcodex_cli/__main__.py"
@@ -956,7 +957,7 @@ def test_real_custom_source_attach_patch_update_and_same_version_refresh(
         timeout=60,
         check=True,
     )
-    assert version.stdout.strip() == f"{marker}:1.0.1"
+    assert version.stdout.strip() == f"{marker}:1.0.2"
 
     request = '{"jsonrpc":"2.0","id":1,"method":"tools/list"}\n'
     config_paths = [
@@ -1029,7 +1030,7 @@ def test_uv_cache_removal_leaves_launchers_and_all_role_mcp_runnable(
         timeout=30,
         check=True,
     )
-    assert version.stdout.strip() == "1.0.0"
+    assert version.stdout.strip() == TRADINGCODEX_VERSION
 
     request = '{"jsonrpc":"2.0","id":1,"method":"tools/list"}\n'
     for config in parsed:
@@ -1445,7 +1446,7 @@ def test_update_rejects_workspace_downgrade_before_writing(
     bootstrap_workspace(workspace)
     lock_path = workspace / ".tradingcodex/generated/module-lock.json"
     lock = json.loads(lock_path.read_text(encoding="utf-8"))
-    lock["tradingcodex_version"] = "1.0.1"
+    lock["tradingcodex_version"] = "1.0.2"
     lock_path.write_text(json.dumps(lock, indent=2) + "\n", encoding="utf-8")
     before = {path.relative_to(workspace).as_posix(): path.read_bytes() for path in workspace.rglob("*") if path.is_file()}
 

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_release_contract.py

@@ -80,7 +80,7 @@ def test_cli_hook_dispatch_preserves_standard_input_and_output(
 def test_v1_package_metadata_has_one_stable_version_source() -> None:
     project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))
 
-    assert TRADINGCODEX_VERSION == "1.0.0"
+    assert TRADINGCODEX_VERSION == "1.0.1"
     assert str(Version(TRADINGCODEX_VERSION)) == TRADINGCODEX_VERSION
     assert project["project"]["dynamic"] == ["version"]
     assert "version" not in project["project"]
@@ -145,7 +145,7 @@ def test_v1_release_checklist_does_not_preapprove_gates() -> None:
     assert re.search(r"(?<![\d.])v?0\.\d+\.\d+\b", deployment) is None
     assert re.search(r"(?<![\d.])v?0\.\d+\.\d+\b", checklist) is None
     assert "- [x]" not in checklist.lower()
-    assert "release_version=1.0.0" in checklist
+    assert "release_version=1.0.1" in checklist
 
 
 def test_attach_contract_has_no_overwrite_or_init_compatibility() -> None:
@@ -374,7 +374,7 @@ def test_update_status_requires_package_refresh_for_newer_workspace(monkeypatch,
             "schema_version": 1,
             "generated_at": "2026-07-11T00:00:00Z",
             "workspace_id": "tcxw_" + "a" * 32,
-            "tradingcodex_version": "1.0.1",
+            "tradingcodex_version": "1.0.2",
             "tradingcodex_package_spec": "tradingcodex",
             "tradingcodex_home": str((tmp_path / "home").resolve()),
             "home_source": "environment_override",
@@ -534,7 +534,7 @@ def test_update_status_never_treats_local_provenance_as_an_executable_spec(
                 "schema_version": 1,
                 "generated_at": "2026-07-11T00:00:00Z",
                 "workspace_id": "tcxw_" + "a" * 32,
-                "tradingcodex_version": "1.0.1",
+                "tradingcodex_version": "1.0.2",
                 "tradingcodex_package_spec": "local-explicit",
                 "tradingcodex_home": str((tmp_path / "home").resolve()),
                 "home_source": "environment_override",

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_research_forecast_surfaces.py

@@ -134,6 +134,51 @@ def test_research_and_forecast_lists_filter_run_before_limit(monkeypatch, tmp_pa
     assert [item["forecast_id"] for item in forecasts] == ["older-target"]
 
 
+def test_omitted_forecast_event_times_use_the_same_system_receipt_time(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    base_snapshot_id = _snapshot(tmp_path, "base-rate", 0.45)
+    forecast_id = f"receipt-time-{uuid.uuid4().hex[:10]}"
+    issue_times = iter(
+        [
+            "2026-01-02T00:00:00.000000Z",
+            "2026-01-02T00:00:00.000001Z",
+        ]
+    )
+    monkeypatch.setattr(forecasting_module, "now_iso", lambda: next(issue_times))
+    payload = _forecast_payload(base_snapshot_id, forecast_id)
+    payload.pop("issued_at")
+
+    issued = call_mcp_tool(
+        tmp_path,
+        "issue_forecast",
+        {"principal_id": "fundamental-analyst", **payload},
+    )["forecast"]
+
+    assert issued["issued_at"] == issued["recorded_at"]
+
+    revision_times = iter(
+        [
+            "2026-01-03T00:00:00.000000Z",
+            "2026-01-03T00:00:00.000001Z",
+        ]
+    )
+    monkeypatch.setattr(forecasting_module, "now_iso", lambda: next(revision_times))
+    revised = call_mcp_tool(
+        tmp_path,
+        "revise_forecast",
+        {
+            "principal_id": "fundamental-analyst",
+            "forecast_id": forecast_id,
+            "revision_reason": "receipt-time regression check",
+            "probability": 0.61,
+        },
+    )["forecast"]
+
+    assert revised["revised_at"] == revised["recorded_at"]
+
+
 def test_mcp_research_and_forecast_lifecycle_enforces_role_separation(monkeypatch, tmp_path: Path) -> None:
     clock = ["2026-01-03T00:00:00Z"]
     monkeypatch.setattr(forecasting_module, "now_iso", lambda: clock[0])

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_security_invariants.py

@@ -128,6 +128,22 @@ def test_mcp_transport_principal_cannot_be_spoofed_or_omitted(monkeypatch, tmp_p
     assert spoofed and "does not match" in spoofed["error"]["message"]
 
 
+def test_mcp_resource_template_discovery_returns_an_empty_supported_list(tmp_path: Path) -> None:
+    workspace = tmp_path / "resource-template-workspace"
+    bootstrap_workspace(workspace)
+
+    response = handle_mcp_rpc(
+        workspace,
+        {"jsonrpc": "2.0", "id": 1, "method": "resources/templates/list"},
+    )
+
+    assert response == {
+        "jsonrpc": "2.0",
+        "id": 1,
+        "result": {"resourceTemplates": []},
+    }
+
+
 def test_mcp_registry_failure_exposes_only_static_safe_reads(monkeypatch, tmp_path: Path) -> None:
     import tradingcodex_service.mcp_runtime as runtime
 

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tests/test_skill_runtime_boundaries.py

@@ -48,7 +48,7 @@ def test_bundled_skills_use_the_compact_tcx_namespace(tmp_path: Path) -> None:
         if record["layer"] == "bundled_core"
     }
 
-    assert len(SKILL_SPECS) == 31
+    assert len(SKILL_SPECS) == 32
     assert set(bundled) == set(SKILL_SPECS)
     for skill_id, record in bundled.items():
         assert SKILL_SPECS[skill_id].id == skill_id
@@ -67,6 +67,9 @@ def test_bundled_skills_use_the_compact_tcx_namespace(tmp_path: Path) -> None:
         for agent in state["agents"].values()
         for skill_id in agent["builtin_skills"]
     )
+    for role, agent in state["agents"].items():
+        if role != "head-manager":
+            assert "tcx-artifact" in agent["builtin_skills"]
 
     legacy_ids = {
         "automate-workflow",

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tradingcodex.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 1.0.0
+Version: 1.0.1
 Summary: Local-first investment operating system for Codex-native research and service-gated execution.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tradingcodex.egg-info/SOURCES.txt

@@ -343,6 +343,8 @@ workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/ris
 workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/risk-manager/tcx-risk/agents/openai.yaml
 workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/shared/tcx-anti-overfit/SKILL.md
 workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/shared/tcx-anti-overfit/agents/openai.yaml
+workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/shared/tcx-artifact/SKILL.md
+workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/shared/tcx-artifact/agents/openai.yaml
 workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/shared/tcx-data-qc/SKILL.md
 workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/shared/tcx-data-qc/agents/openai.yaml
 workspace_templates/modules/repo-skills/files/.tradingcodex/subagents/skills/shared/tcx-evidence/SKILL.md

{tradingcodex-1.0.0 → tradingcodex-1.0.1}/tradingcodex_cli/commands/doctor.py

@@ -205,7 +205,9 @@ def _codex_cli_runtime_check() -> dict[str, Any]:
     compatible = parsed >= minimum
     differs_from_reference = parsed != reference
     reference_note = ""
-    if compatible and parsed < reference:
+    if not compatible:
+        reference_note = "; older than required; upgrade Codex before using the generated harness"
+    elif parsed < reference:
         reference_note = "; compatible but older than reference; upgrade before release validation"
     elif parsed > reference:
         reference_note = "; newer client requires harness revalidation"