tradingcodex 1.0.2__tar.gz → 1.1.0__tar.gz

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 ## Unreleased
 
+## 1.1.0 - 2026-07-16
+
+- Make managed skill invocation resilient without weakening authority: Build,
+  Brain, Strategy, and native order entrypoints now share one lexical parser
+  that accepts the first meaningful line, matching projected-skill Markdown
+  links, same-line requests, BOMs, and cross-platform newline forms. Prompt
+  proofs remain bound to the original bytes, and order flags, approvals,
+  confirmations, one-effect limits, and replay protection remain strict.
+- Give `trading-build` credential-free, limited public HTTP(S) and HTTPS Git
+  retrieval while keeping root native web search disabled. Public source files
+  are staged only below the workspace-specific cache-backed scratch provider
+  directory, remain inert, and may be hashed, diffed, inspected, or
+  syntax-checked but not installed or executed. The proxy uses full HTTP
+  transport only for Git Smart HTTP's read-only protocol POST; ordinary HTTP
+  remains GET/HEAD-only and general POST stays blocked. Authentication,
+  model-authored request bodies, private/local targets, shell pipelines,
+  dependency installation, direct `trading/` downloads, Git publication, and
+  broker effects remain blocked.
+- Make the active Build-turn shell a narrow, non-extensible review lane. Edits
+  use `apply_patch`; admitted commands are public GET/HEAD, enumerated read-only
+  HTTPS Git, limited workspace reads, inert provider hash/diff/Git inspection,
+  exact isolated `py_compile`, and allowlisted workspace-launcher operations.
+  General interpreters, helper scripts, test runners, build systems, shell
+  composition, model-authored POST, and native browser/web/network tools now
+  fail closed during Build while Research browser behavior remains unchanged.
+- Add provider source provenance, full bundle hashing, secret/VCS/symlink
+  rejection, immutable approval snapshots, and provider-first connector
+  onboarding. Build-side inspection can return an inert bundle-only hash and
+  `service_check_required` posture without reading the central ledger; only the
+  interactive operator path resolves canonical approval state. Missing-provider
+  connection requests no longer leave dead-end connector scaffolds; explicit
+  scaffold-only requests remain available.
+- Preserve the v1 update contract for existing workspaces. `tcx update`
+  refreshes the generated invocation, permission, hook, and skill surfaces
+  without a database migration, keeps workspace identity and user-owned
+  artifacts, and retains the existing explicit home, database, and service
+  address. Fully restart Codex and open a new task after updating so an older
+  task cannot retain its prior hook snapshot. Existing manual provider bundles
+  may omit provenance, while changed or newly unsafe bundles must be reviewed
+  and approved again.
+
 ## 1.0.2 - 2026-07-15
 
 - Preserve an attached release workspace's explicit `TRADINGCODEX_HOME`,

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 1.0.2
+Version: 1.1.0
 Summary: Local-first investment operating system for Codex-native research and service-gated execution.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/docs/README.md

@@ -47,7 +47,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 
 | Document | Purpose |
 | --- | --- |
-| [release-readiness.md](./release-readiness.md) | v1.0.1 source readiness, final-commit and exact-artifact validation, and pending tag, publication, and post-publish gates. |
+| [release-readiness.md](./release-readiness.md) | Current v1 release readiness, prior-version update compatibility, exact-artifact validation, and tag, publication, and post-publish gates. |
 
 ## Workflow And Agent Documents
 

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/docs/core-concepts-and-rules.md

@@ -122,7 +122,7 @@ exact root native action -> deterministic hook parse -> native-user permission
   -> policy -> payload validation -> approval/duplicate-request check
   -> mandatory intent audit -> connection -> finalized/uncertain audit
 
-exact first-line $tcx-order-allow -> workspace/session/turn/prompt/mode grant
+exact first-meaningful-line $tcx-order-allow -> workspace/session/turn/prompt/mode grant
   -> protected use_order_turn_grant + PreToolUse proof -> consume once
   -> the same canonical policy/approval/idempotency/live/audit gates
 ```
@@ -131,8 +131,10 @@ The root `tcx-order-submit` and `tcx-order-cancel` skill bundles
 carry no tools. Their complete exact prompt grammar is intercepted by
 `UserPromptSubmit` and dispatched in-process to the service gateway before any
 model runs. The separate `tcx-order-allow` bundle documents current-turn admission:
-an exact physical first line issues one `OrderTurnGrant`, and only root Head
+an exact first meaningful line issues one `OrderTurnGrant`, and only root Head
 Manager can select one later submit or cancel through `use_order_turn_grant`.
+The leading skill may be a plain token or its matching projected Markdown link;
+the order mode and immediate action grammars remain literal.
 `PreToolUse` injects proof that model input and direct MCP callers cannot supply.
 The browser viewer has no mutation route. Fixed roles, public REST, generic
 CLI, and unproven direct MCP calls cannot invoke the final mutation.

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/docs/decision-memory.md

@@ -355,8 +355,8 @@ Memory remains independent of the Brain that produced a decision:
   provenance.
 
 Learning from memory into a Brain is a separate user-controlled curation path.
-Writing requires a root native Codex prompt whose exact physical first line is
-`$tcx-brain`, an explicit source-authoring request below it, an
+Writing requires a root native Codex prompt whose first meaningful invocation
+is `$tcx-brain`, an explicit source-authoring request on that line or below it, an
 actual Codex sandbox that permits the required workspace-local writes, exact
 user-selected source episodes, and counterexamples. The Brain-scoped grant is
 bound to that turn, cannot authorize Build or Strategy work, and does not carry

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/docs/deployment.md

@@ -150,12 +150,20 @@ find . -maxdepth 1 -name '*.egg-info' -type d -exec rm -rf {} +
 python3.11 -m build
 python3.11 -m twine check dist/*
 python3.11 tests/platform_wheel_smoke.py --wheel-dir dist
+python3.11 tests/release_upgrade_smoke.py --wheel-dir dist --from-version 1.0.2
 ```
 
 The wheel smoke installs only the built wheel into a clean virtual environment,
 checks distribution metadata against the runtime version, attaches a workspace,
 validates native launchers and generated configuration, runs hooks and MCP
 stdio, exercises the local service, and loads the packaged SPA and assets.
+The release-upgrade smoke starts from the published `1.0.2` package, updates
+that attached workspace with the built candidate wheel, and verifies preserved
+workspace and runtime identity, user-owned state, and explicit home, DB, and
+service-address settings alongside the refreshed generated contract. It also
+preserves the exact provider approval identity and timestamp, compares every
+byte in the immutable provider snapshot, and proves that the candidate runtime
+loads that approved snapshot after the update.
 
 Harness, role, prompt, skill, hook, policy, MCP, or generated-template changes
 also require the disposable-workspace and Codex-native checks documented in
@@ -165,7 +173,8 @@ also require the disposable-workspace and Codex-native checks documented in
 
 `.github/workflows/ci.yml` is test-only. One Ubuntu/Python 3.11 job runs the
 frontend build, complete Python suite and framework gates, clean package
-construction, and the wheel smoke. Guide-only pushes skip this workflow because
+construction, the wheel smoke, and the prior-release update smoke. Guide-only
+pushes skip this workflow because
 the Pages workflow validates and deploys only static guide files. CI never
 publishes.
 
@@ -179,7 +188,8 @@ publishes.
 - the workflow ref is exactly `refs/tags/v<release_version>`
 - the tagged commit is on `origin/main`
 - the wheel and source-distribution filenames carry the same version
-- the built wheel passes the Ubuntu smoke
+- `dist/` contains exactly that one wheel and one source distribution
+- the built wheel passes the Ubuntu wheel and prior-release update smokes
 - the protected `pypi` environment approves Trusted Publishing
 
 The release workflow has one build/verification job. When publication is
@@ -261,7 +271,7 @@ sh "$SOURCE_ROOT/install.sh" \
 On native Windows PowerShell:
 
 ```powershell
-$ReleaseVersion = "1.0.2"
+$ReleaseVersion = "1.1.0"
 $Workspace = Join-Path $env:TEMP "tcx-pypi-$ReleaseVersion"
 New-Item -ItemType Directory -Force $Workspace | Out-Null
 Set-Location $Workspace

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/docs/execution-without-subagent-plan.md

@@ -26,7 +26,7 @@ design, migration, and validation evidence.
   author every class of Codex app Scheduled Task, from simple research and
   monitoring through optional turn-authorized execution.
 - [x] Issue a workspace-, session-, turn-, prompt-, and mode-bound single-use
-  grant only for an exact physical first line `$tcx-order-allow --mode
+  grant only for an exact first meaningful line `$tcx-order-allow --mode
   paper|validation|live`; revoke it after one submit or cancel, after one hour,
   on `Stop`, or when the next user turn starts.
 - [x] Protect `use_order_turn_grant` so only root Head Manager can select the
@@ -82,9 +82,9 @@ Remove `execution-operator` from the fixed-role roster. Native Codex keeps the
 exact immediate submit/cancel path for already-known canonical identifiers and
 adds a separate single-turn path for workflows that create the ticket or
 approval during the turn. The immediate path executes in `UserPromptSubmit`
-before Head Manager runs. The turn path begins only when the physical first
-line is exact `$tcx-order-allow --mode paper|validation|live`, then continues the
-normal workflow with a single-use service grant.
+before Head Manager runs. The turn path begins only when the first meaningful
+line is exactly `$tcx-order-allow --mode paper|validation|live`, then continues
+the normal workflow with a single-use service grant.
 
 `tcx-automate` authors Codex app Scheduled Tasks; it is not a scheduler or
 the skill invoked recursively by each run. Research, monitoring, recurring
@@ -109,7 +109,7 @@ UserPromptSubmit  -> deterministic parse and native-user mandate
 Django service    -> authorize, reserve, audit, invoke adapter, finalize
 Head Manager      -> summarize the already-recorded result; no action authority
 
-native/scheduled user -> exact physical first-line $tcx-order-allow mode
+native/scheduled user -> exact first-meaningful-line $tcx-order-allow mode
 UserPromptSubmit      -> bind one grant to workspace + session + turn + prompt + mode
 roles/services        -> create and approve canonical ticket state
 Head Manager          -> call protected use_order_turn_grant once
@@ -152,7 +152,8 @@ Each bundle follows the normal TradingCodex skill shape, including `SKILL.md`
 and `agents/openai.yaml`, but contains no tool authority. The skill documents an
 action syntax intercepted by the hook before the model runs.
 
-The complete trimmed user prompt must have one of these forms:
+The complete meaningful user prompt must have one of these canonical plain
+forms:
 
 ```text
 $tcx-order-submit --ticket-id <ticket-id> --approval-receipt-id <receipt-id>
@@ -162,10 +163,13 @@ $tcx-order-cancel --ticket-id <ticket-id> --broker-order-id <broker-order-id> --
 $tcx-order-cancel --ticket-id <ticket-id> --broker-order-id <broker-order-id> --approval-receipt-id <receipt-id> --live-confirmation <token>
 ```
 
-Parsing rules are intentionally strict:
+Parsing rules are intentionally strict. One UTF-8 BOM, normalized CRLF/CR/NEL/
+Unicode line separators, leading/trailing blank lines, and a Markdown link whose
+label and target match the projected workspace action skill are presentation
+variants only:
 
 - Parse with `shlex.split`; never use a shell or evaluate prompt content.
-- Require the skill token to be the first token and the entire prompt to be the
+- Require the skill invocation to be first and the entire meaningful prompt to be the
   action. Free-form prefixes, suffixes, comments, quotations, or a second skill
   invocation are invalid.
 - Accept only the documented `--name value` form. Reject `--name=value`, unknown
@@ -191,8 +195,8 @@ must not fall through to Head Manager as ordinary analysis.
 
 ## Turn-Scoped Order Allow Contract
 
-For a workflow that may create its final identifiers during the turn, the
-physical first line must be exactly one of:
+For a workflow that may create its final identifiers during the turn, the first
+meaningful line must be exactly one of:
 
 ```text
 $tcx-order-allow --mode paper
@@ -200,9 +204,10 @@ $tcx-order-allow --mode validation
 $tcx-order-allow --mode live
 ```
 
-The rest of the prompt is the ordinary interactive or Codex app Scheduled Task
-request. The line accepts no aliases, comments, quotes, extra flags, embedded
-prose, or `--mode=value` form. A free-form mention or later-line occurrence
+The skill token may be its matching projected Markdown link. The rest of the
+prompt is a non-empty ordinary interactive or Codex app Scheduled Task request.
+The line accepts no aliases, comments, quotes, extra flags, embedded prose, or
+`--mode=value` form. A free-form mention or later-meaningful-line occurrence
 does not grant authority. Scheduled and interactive turns use the same parser;
 there is no Automation-origin branch.
 
@@ -264,7 +269,7 @@ normal analysis context:
 The existing provider-call idempotency remains the replay defense if the hook
 event is delivered more than once.
 
-For `$tcx-order-allow`, `UserPromptSubmit` instead validates the exact first line,
+For `$tcx-order-allow`, `UserPromptSubmit` instead validates the exact first meaningful line,
 requires root native `session_id` and `turn_id`, revokes the session's older
 grant, issues the new bounded grant, and continues normal analysis allocation.
 The additional context contains only mode, expiry, single-use posture, and the
@@ -400,8 +405,9 @@ map, or safety routing would otherwise become misleading.
 - Prove that unavailable hook audit blocks before reservation/provider use.
 - Prove that hook result projection contains no raw prompt, reasoning, secrets,
   credentials, raw provider payload, or unallowlisted error text.
-- Accept only the three exact physical-first-line `$tcx-order-allow` modes; reject
-  later-line, malformed, subagent, Workbench, missing-session, and missing-turn
+- Accept only the three exact first-meaningful-line `$tcx-order-allow` modes;
+  reject later-meaningful-line, malformed, subagent, Workbench,
+  missing-session, and missing-turn
   forms without issuing a grant.
 - Prove grant binding to workspace, session, turn, prompt hash, mode, and
   tool-use id; prove one-hour, `Stop`, next-turn, and consumption revocation.
@@ -465,7 +471,7 @@ The change is complete only when all of the following are true:
 8. Generated workspace update safely retires unmodified agent files and
    preserves modified-file conflict protection.
 9. A saved Scheduled Task prompt is processed as an ordinary root turn on each
-   run; only an exact `$tcx-order-allow` physical first line can create one bounded
+   run; only an exact `$tcx-order-allow` first meaningful line can create one bounded
    effect grant, and no Automation-origin detector is involved.
 
 ## Explicit Non-Goals

{tradingcodex-1.0.2 → tradingcodex-1.1.0}/docs/generated-workspaces.md

@@ -13,6 +13,12 @@ apply the current central runtime schema, and record workspace provenance in
 the central local Django DB. Pre-v1 workspace and database state is rejected
 before mutation rather than converted.
 
+Generated invocation, permission, hook, and skill changes are not retroactive
+inside an already attached workspace. Apply them with `tcx update`, then fully
+restart Codex so the refreshed project config, prompts, skills, hooks, and MCP
+binding load together. Start a new task after restart rather than resuming an
+already-open task, which can retain the prior generated hook snapshot.
+
 The template source tree may be refactored for maintainability, but generated
 output paths are the v1 release contract. Module ids, module dependency
 resolution, and rendered paths such as `.codex/config.toml`, `.agents/skills/*`,
@@ -276,21 +282,23 @@ Generated workspaces contain:
   `$tcx-order-cancel`, accepts only their complete exact `--name value`
   grammar from a root native user turn, creates a workspace-bound `native-user`
   mandate, and calls the canonical Django execution gateway in-process. It also
-  reserves a physical-first-line `$tcx-order-allow --mode
+  reserves a first-meaningful-line `$tcx-order-allow --mode
   paper|validation|live`, issues one workspace/session/turn/prompt/mode-bound
   `OrderTurnGrant`, and then continues the normal workflow. Malformed reserved
   actions, subagent actions, and retired
   `$execute-paper-order` actions fail closed
-- deterministic Build-turn admission: a root native prompt whose exact physical
-  first line is `$tcx-build` and whose remaining body is non-empty issues a
+- deterministic Build-turn admission: a root native prompt whose first
+  meaningful invocation is a plain or matching projected-link `$tcx-build` and
+  whose same-line or following body is non-empty issues a
   DB-canonical workspace/session/turn/cwd/prompt-bound `BuildTurnGrant` with
   `authority_scope=build`;
   `PreToolUse` requires it for direct writes and injects one-time proof into
   protected build MCP calls, while later turns and subagents cannot
   inherit it; Codex Plan mode cannot issue or use it, and the grant is bound to
   its issue-time permission mode
-- deterministic managed-skill admission: an exact first-line `$tcx-brain` or
-  `$tcx-strategy` root prompt issues the same DB-canonical grant shape with a
+- deterministic managed-skill admission: a plain or matching projected-link
+  `$tcx-brain` or `$tcx-strategy` on the first meaningful line of a root prompt
+  issues the same DB-canonical grant shape with a
   distinct `brain` or `strategy` scope. The normal Research profile remains
   active, source/launcher use is allowlisted to that capability, cross-scope
   calls fail, and Build or order markers cannot be combined
@@ -409,11 +417,11 @@ Generated workspaces contain:
 - decision-quality skill bundles for forecasting discipline, thesis scenario
   trees, numeric data QC, and anti-overfit validation, plus role-owned
   `tcx-judgment` for the independent `judgment-reviewer` gate
-- standalone `strategy-*` skills under `.agents/skills/strategy-*` for user-approved agent-readable investment strategies, created from native Codex only in an exact first-line `$tcx-strategy` root `trading-research` turn through the managed lifecycle service, or through an explicitly authenticated user/operator API surface, then exposed to the root `head-manager` through the strategy marker block in `.codex/config.toml`
+- standalone `strategy-*` skills under `.agents/skills/strategy-*` for user-approved agent-readable investment strategies, created from native Codex only in a matching first-meaningful-line `$tcx-strategy` root `trading-research` turn through the managed lifecycle service, or through an explicitly authenticated user/operator API surface, then exposed to the root `head-manager` through the strategy marker block in `.codex/config.toml`
 - built-in `tcx-brain` projected only to Head Manager as the single source and
   managed-plugin entrypoint; source create/inspect/revise/validate/delete and
   managed list/inspect/install/update/activate/deactivate/rollback/remove stay
-  distinct, tool-using management needs an exact first-line `$tcx-brain` root
+  distinct, tool-using management needs a matching first-meaningful-line `$tcx-brain` root
   `trading-research` turn, source
   authoring stops before lifecycle work, installation begins inactive, and no
   path implies Git/publication actions
@@ -704,7 +712,8 @@ intermediates belong under `$TRADINGCODEX_SCRATCH`. They cannot modify
 runtime, protected artifact paths, credential files, local/private
 destinations, or Unix sockets. Authenticated service/MCP tools own durable
 TradingCodex writes. Harness update is either an explicit user-terminal
-operation or a root native Codex turn whose exact first line is `$tcx-build`,
+operation or a root native Codex turn whose first meaningful invocation is
+`$tcx-build`,
 because it rewrites the generated `.codex` prompt/config/hook surfaces that
 define the current agent. The marker records current-turn intent but cannot
 widen the active native profile. For already-installed packages, the wrapper
@@ -750,9 +759,13 @@ See the [Codex permissions reference](https://learn.chatgpt.com/docs/permissions
 overrides `trading/`, generated
 control files, Git metadata, launchers, and sensitive paths with more-specific
 read or deny rules. User-owned paths outside `trading/` can therefore be used
-as inputs or outputs without a Build turn. One generated, workspace-id-scoped
-temp path is writable as `$TRADINGCODEX_SCRATCH` and is projected as
-`TMPDIR`/`TEMP`/`TMP`; the broader temp roots are denied.
+as inputs or outputs without a Build turn. One generated, workspace-id-scoped,
+cache-backed path is writable as `$TRADINGCODEX_SCRATCH` and is projected as
+`TMPDIR`/`TEMP`/`TMP`; the broader temp roots are denied. The scratch root lives
+under the platform cache tree (`~/Library/Caches/TradingCodex` on macOS,
+`$XDG_CACHE_HOME/tradingcodex` or `~/.cache/tradingcodex` on Linux, and
+`%LOCALAPPDATA%\TradingCodex` on Windows), not inside the workspace and not in
+the broad OS temporary tree.
 Credential-bearing home paths such as Codex auth state, SSH/cloud/CLI config,
 keyrings, credential files, and shell histories are explicitly denied. The
 narrow read-only `~/.codex/packages/standalone` exception permits the installed
@@ -764,7 +777,8 @@ More-specific rules deny the rest of `.codex`, canonical
 TradingCodex home/DB/runtime paths, `.env` patterns, protected TradingCodex
 workspace state, and durable research/report/forecast/decision paths. Research
 does not reopen `.tradingcodex/cli.py` or the attached runtime for managed
-lifecycle work. Exact `$tcx-brain` and `$tcx-strategy` first lines create
+lifecycle work. Matching `$tcx-brain` and `$tcx-strategy` invocations on the
+first meaningful line create
 separate current-turn scopes; the hook injects proof only into
 `manage_investment_brain` or `manage_strategy`, and neither scope requires or
 accepts `$tcx-build`.
@@ -776,9 +790,32 @@ local/private destinations blocked, upstream proxying disabled, and no Unix
 sockets. Public reachability does not grant credentials or broker authority.
 
 `trading-build` uses the same credential and protected-state denials, writes the ordinary
-workspace and the dedicated scratch path, but keeps `.git`,
+workspace through admitted edit/service surfaces and the dedicated scratch path, but keeps `.git`,
 `.agents`, and `AGENTS.md` read-only, denies `.codex`, TradingCodex home/DB/
-runtime, `.env` files, and audit/approval/order state, and disables network.
+runtime state, `.env` files, and audit/approval/order state. The exact managed
+launcher runtime is reopened read-only so hook-admitted `./tcx` validation and
+inspection commands can run. Across every active Build turn/profile, the hook
+admits only a narrow shell review lane: limited workspace `pwd`/`cat`/`ls`,
+inert provider-source reads/hash/diff/Git inspection, exact isolated
+`python -I -S -m py_compile`, allowlisted workspace-launcher commands, and the
+public retrieval forms below. General interpreters, helper scripts, test
+runners, build systems, shell composition, and direct runtime commands remain
+blocked. Its limited-public
+network permits credential-free HTTP(S) GET/HEAD and public HTTPS Git retrieval
+while blocking authenticated requests, bodies/uploads, local/private targets,
+non-HTTP(S) transports, package installation, fetch-to-execute pipelines,
+remote mutation, and broker access. Native `web_search` remains disabled.
+The generated `PreToolUse` matcher covers every tool name, then policy remains
+a no-op for ordinary Research tools while an active Build grant rejects native
+browser, web, HTTP, fetch, and navigation tools,
+so retrieval cannot reuse authenticated browser state; Research browser
+behavior is unchanged.
+The Build profile uses the proxy's full HTTP transport mode because Git Smart
+HTTP needs a small POST exchange even for read-only clone/fetch/ls-remote.
+That does not open general POST access: the Build hook admits only public
+GET/HEAD curl or wget commands and the enumerated read-only HTTPS Git commands,
+while rejecting general interpreters, shell composition, and other network
+clients.
 Durable research, report, forecast, and decision paths are denied in Build as
 well because those writes remain authenticated service operations.
 The root `$tcx-build` marker and hook remain required for controlled
@@ -950,6 +987,13 @@ or performs package refresh on its own. The emitted context uses marker
 `build_authorization`, `permission_status`, `update_status`, `server_status`,
 `allowed_next_actions`, and `routing_status`.
 
+Build authorization retains `exact_first_line` and managed-skill authorization
+retains `exact_first_lines` as canonical plain-token examples for copy/paste
+compatibility. Both also report `invocation_position=first_meaningful_line`,
+`accepted_forms`, and `same_line_request_allowed`.
+These fields describe lexical admission only; the grant remains bound to the
+original unnormalized prompt hash and current workspace/session/turn/profile.
+
 `head-manager` uses `$tcx-dashboard` to open the read-only workspace viewer and
 provide a compact orientation, and `$tcx-server` for diagnostics and recovery.
 Dashboard uses hook startup context plus the smallest relevant read-only
@@ -977,7 +1021,7 @@ Startup health may compare the generated workspace version in
 `.tradingcodex/generated/module-lock.json` with the installed/running `tcx`
 package version and the latest known TradingCodex release. For a workspace-only
 refresh, `head-manager` explains two paths: start a new `trading-build` root
-native turn whose exact physical first line is `$tcx-build` and run the non-empty
+native turn whose first meaningful invocation is `$tcx-build` and run the non-empty
 `update_status.command`, or run that workspace command from a terminal.
 Self-update is allowed only in that explicit current turn and only when the user
 asks for it. When `package_refresh_user_terminal_required=true`,
@@ -992,15 +1036,19 @@ and should recommend package/workspace refresh before service stop.
 ## Build Turn Authorization
 
 Mutating Codex build work uses an exact prompt contract, not a persistent
-workspace mode. The physical first line must be exactly:
+workspace mode. The first meaningful line must invoke:
 
 ```text
 $tcx-build
 ```
 
-A non-empty, concrete build request follows on later lines. `UserPromptSubmit`
-parses the complete root native prompt deterministically and issues a
-DB-canonical grant bound to the workspace, session, turn, cwd, and prompt.
+A non-empty, concrete build request may share that line or follow it. The skill
+may be a plain token or a Markdown link whose label and target match the
+projected workspace `tcx-build/SKILL.md`. One UTF-8 BOM, normalized line
+endings, and leading/trailing blank lines do not change admission; mixed or
+duplicate managed markers still fail. `UserPromptSubmit` parses the complete
+root native prompt deterministically and issues a DB-canonical grant bound to
+the workspace, session, turn, cwd, and original prompt hash.
 `PreToolUse` enforces that grant for controlled `trading/` edits and injects a
 one-time internal proof into protected build MCP calls. Ordinary `apply_patch`
 edits outside `trading/` do not need the grant; generic Write/Edit tools remain
@@ -1012,8 +1060,10 @@ grant.
 The marker and hook never elevate Codex permissions. The active Codex profile
 remains the filesystem and network authority. Use `trading-build` for
 controlled `trading/` and managed lifecycle Build work; it opens connector and
-build paths but keeps
-TradingCodex runtime/DB, credentials, ledgers, and network access denied.
+build paths but keeps TradingCodex runtime/DB, credentials, and ledgers denied.
+Only credential-free limited-public retrieval is available; local/private or
+authenticated network access, uploads, package installs, fetch-to-execute
+pipelines, remote mutation, and broker calls remain denied.
 Codex Plan mode cannot issue or use a Build grant, and the grant is bound
 to its issue-time permission mode; changing modes requires a new root turn and
 fresh marker. Full access is not implied by the skill. Build work defaults to
@@ -1024,13 +1074,28 @@ credential files, policy or approval state, or order execution.
 External MCP mutation/consent and provider-source approval use separate,
 interactive user-terminal commands; they are not synthetic Build turns.
 
-Within `trading-build`, Codex may use general workspace-local shell, Python,
-scripts, and test runners for implementation and validation. Native
-`apply_patch` remains the reviewable edit tool. The hook routes every direct
-edit and trusted `./tcx`/`tcx.cmd` lifecycle command through the current-turn
-grant, and retains hard stops for protected paths, credentials, External MCP
-lifecycle or consent, global config, Git publication, and order effects. The
-native profile supplies the lower-level filesystem and network boundary.
+Within `trading-build`, native `apply_patch` is the reviewable edit tool. Shell
+access is intentionally non-general: Codex may use public HTTP(S) GET/HEAD,
+enumerated read-only HTTPS Git retrieval, limited workspace `pwd`/`cat`/`ls`,
+inert provider-source reads/hash/diff/Git inspection, exact isolated
+`python -I -S -m py_compile`, and allowlisted `./tcx`/`tcx.cmd` commands.
+Provider source retrieval is confined to
+`$TRADINGCODEX_SCRATCH/provider-sources/<provider-id>/` and remains inert there.
+The Build-turn context advertises an absolute command-proof form for native
+Codex transports that do not include their actual shell workdir in hook input:
+that form requires the recorded absolute executable, absolute staged operands,
+and an absolute Git `-C` staging/repository root, so authorization never relies
+on an opaque cwd, repository-local configuration, or cwd executable lookup.
+Relative workspace commands remain valid only with the exact generated
+workspace workdir; Git clone uses `--no-checkout`, and curl uses `--globoff`.
+General interpreters, helper scripts, test runners, build systems, shell
+composition, and model-authored POST are blocked throughout the active Build
+turn/profile. Broader unit, smoke, or build validation belongs to an explicit
+user-terminal or maintainer flow. The hook routes every direct edit and trusted
+workspace-launcher lifecycle command through the current-turn grant and retains
+hard stops for protected paths, credentials, External MCP lifecycle or consent,
+global config, Git publication, and order effects. The native profile supplies
+the lower-level filesystem and network boundary.
 
 Persistent `tcx mode` is retired. `./tcx mode status` remains only as an inert
 compatibility diagnostic, `tcx mode set ...` cannot enable Build, and any old
@@ -1060,34 +1125,71 @@ canonical DB services. Plan mode blocks every managed workspace grant.
 Prefer an isolated worktree or workspace and retain a reviewable diff for every
 recurring run. Never combine Build, Brain, Strategy, or order markers.
 
-In a Build turn, Head Manager first uses the read-only
+In a Build turn, Head Manager first inspects available providers. When the
+requested provider is missing, it develops that provider before rendering or
+registering a connector. A `provider_development_required` connector is created
+first only when the user explicitly requests scaffold-only output; an
+implementation or connection request does not leave behind a dead-end scaffold
+as apparent progress.
+
+Credential-free public HTTP(S) and HTTPS Git sources may be retrieved only into
+`$TRADINGCODEX_SCRATCH/provider-sources/<provider-id>/`. The staging tree is for
+read, hash, diff, and static validation only; fetched code is not executed or
+installed. For a new provider sourced by direct HTTP(S) rather than Git, the
+hook admits one canonical directory-creating fetch: one curl command with
+`--create-dirs`, one URL, and one explicit
+`--output <provider-id>/<file>` relative to the provider-sources staging root
+(or the equivalent absolute staged output when hook input omits workdir). It
+may create only that one fresh direct provider-id directory. It does not admit
+general directory creation, a nested output path,
+`--remote-name`/`--output-dir` forms, a repeated `--create-dirs`, or an
+already-existing destination directory. Later HTTP(S) files require an
+existing real direct provider parent and omit `--create-dirs`. Final provider
+files are authored with `apply_patch`, never by downloading, redirecting,
+copying, or moving content directly into `trading/`.
+Externally informed bundles include `source-provenance.json` with
+`schema_version: 1` and per-source `kind` (`https` or `git`), a public
+credential-free HTTPS `url` without userinfo/query/fragment, optional
+`requested_ref`, and exactly one resolved identifier: HTTPS uses
+`resolved_ref`, while Git uses `resolved_ref` or `resolved_commit`. Each entry
+also includes `fetched_content_sha256` and RFC 3339 `retrieved_at`. Existing manually
+authored providers remain compatible without that optional file. Provider
+bundles reject `.git`, `.hg`, `.svn`, credential/key/`.env` material, and
+symlinks. AST/syntax, `py_compile`, and static contract checks do not import the
+provider.
+
+After the provider is approved, the service is restarted, and a fresh Build
+turn begins, Head Manager uses the read-only
 `render_broker_connector_scaffold` MCP tool. Its content-addressed result
 contains each workspace target, rendered content/hash, and exact preimage
 existence/hash/size metadata but never existing file content. It performs no
-workspace write. Head Manager verifies the
-preimages and applies the files with `apply_patch`, so Codex's native workspace
-permission remains the filesystem authority. Only the DB-backed
-`register_broker_connector`, `validate_broker_connector_build`, and
-`record_broker_mapping_review` calls consume protected Build proof. Direct
-connector `connect` and write-style `scaffold` remain explicit user-terminal
-operator flows and are absent from the agent MCP surface. If the requested
-provider is not installed, the rendered profile records
-`provider_development_required` instead of pretending the broker is already
-supported.
+workspace write. Head Manager verifies the preimages and applies the files with
+`apply_patch`, so Codex's native workspace permission remains the filesystem
+authority. Only the DB-backed `register_broker_connector`,
+`validate_broker_connector_build`, and `record_broker_mapping_review` calls
+consume protected Build proof. Direct connector `connect` and write-style
+`scaffold` remain explicit user-terminal operator flows and are absent from the
+agent MCP surface.
 
 Broker provider build work is separate from the running operate server. A
 generated workspace may already have TradingCodex MCP autostarting the Django
 service; mutable workspace `provider.py` files are untrusted and are never
-loaded merely by listing providers. The user must inspect the bundle and approve
+loaded merely by listing providers. `inspect-provider` reports the secret-free
+source provenance summary and final bundle hash. When Build's central-ledger
+filesystem denial prevents an approval-state read, it falls back to an inert
+bundle-only result marked `service_check_required`; the later interactive
+operator inspection and approval still resolve canonical approval state from
+the service ledger. The user must inspect the bundle and approve
 its exact bundle hash from an interactive terminal with `./tcx connectors
 approve-provider <provider-id>`; piped stdin and agent, MCP, API, Admin,
 browser viewer, or Automation calls cannot approve or revoke source. Approval copies
-the reviewed `provider.py` plus its symlink-free supporting source bundle to an
+the reviewed `provider.py`, optional provenance, and its symlink-free supporting source bundle to an
 immutable managed snapshot but executes no code, and any bundle or workspace
-path change invalidates it. Runtime imports only the rehashed snapshot after a
+path, provenance, or helper change invalidates it. Runtime imports only the rehashed snapshot after a
 restart, never the mutable workspace copy. Connector profiles record provider
 hashes, status calls report `service_restart_required`, and live execution
-remains blocked until the service is restarted and the connector is revalidated.
+remains blocked until the service is restarted and connector render,
+registration, and validation complete in a fresh Build turn.
 
 ## Hooks
 
@@ -1108,16 +1210,16 @@ because hook policy is an agent-runtime boundary.
   tokens before analysis-run allocation; an exact full-prompt grammar
   dispatches the service-owned gateway as `native-user`, while malformed,
   subagent, and retired action forms fail closed
-- deterministic parsing of physical-first-line `$tcx-order-allow --mode
+- deterministic parsing of first-meaningful-line `$tcx-order-allow --mode
   paper|validation|live`; it requires current root `session_id` and `turn_id`,
   revokes an older session grant, issues a workspace/session/turn/full-prompt/
   mode-bound single-use `OrderTurnGrant`, and continues normal analysis
-- deterministic parsing of exact physical-first-line `$tcx-build` with a
+- deterministic parsing of matching first-meaningful-line `$tcx-build` with a
   non-empty body; it requires the current root session/turn/cwd, revokes an
   older session Build grant, and issues a DB-canonical current-turn grant that
   never elevates the Codex sandbox; Plan mode cannot issue the grant and tool
   use must match its bound permission mode
-- deterministic parsing of exact physical-first-line `$tcx-brain` and
+- deterministic parsing of matching first-meaningful-line `$tcx-brain` and
   `$tcx-strategy` prompts with non-empty bodies; each issues only its own
   managed capability scope in `trading-research`, rejects marker combinations,
   and bypasses investment-analysis run allocation