tradingcodex 1.0.2__tar.gz → 1.1.1__tar.gz

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 ## Unreleased
 
+## 1.1.1 - 2026-07-16
+
+- Remove the legacy user-capability gate, its CLI and broker-import paths,
+  and its active database tables. User-installed MCP servers, skills, plugins,
+  apps, and hooks now remain BYOR native Codex capabilities for root and fixed
+  agents. Add a secret-free read-only capability inventory to MCP and System,
+  preserve non-reserved user Codex configuration across update, and keep all
+  TradingCodex principals, grants, protected proofs, and order effects behind
+  the existing service boundary.
+
+## 1.1.0 - 2026-07-16
+
+- Make managed skill invocation resilient without weakening authority: Build,
+  Brain, Strategy, and native order entrypoints now share one lexical parser
+  that accepts the first meaningful line, matching projected-skill Markdown
+  links, same-line requests, BOMs, and cross-platform newline forms. Prompt
+  proofs remain bound to the original bytes, and order flags, approvals,
+  confirmations, one-effect limits, and replay protection remain strict.
+- Give `trading-build` credential-free, limited public HTTP(S) and HTTPS Git
+  retrieval while keeping root native web search disabled. Public source files
+  are staged only below the workspace-specific cache-backed scratch provider
+  directory, remain inert, and may be hashed, diffed, inspected, or
+  syntax-checked but not installed or executed. The proxy uses full HTTP
+  transport only for Git Smart HTTP's read-only protocol POST; ordinary HTTP
+  remains GET/HEAD-only and general POST stays blocked. Authentication,
+  model-authored request bodies, private/local targets, shell pipelines,
+  dependency installation, direct `trading/` downloads, Git publication, and
+  broker effects remain blocked.
+- Make the active Build-turn shell a narrow, non-extensible review lane. Edits
+  use `apply_patch`; admitted commands are public GET/HEAD, enumerated read-only
+  HTTPS Git, limited workspace reads, inert provider hash/diff/Git inspection,
+  exact isolated `py_compile`, and allowlisted workspace-launcher operations.
+  General interpreters, helper scripts, test runners, build systems, shell
+  composition, model-authored POST, and native browser/web/network tools now
+  fail closed during Build while Research browser behavior remains unchanged.
+- Add provider source provenance, full bundle hashing, secret/VCS/symlink
+  rejection, immutable approval snapshots, and provider-first connector
+  onboarding. Build-side inspection can return an inert bundle-only hash and
+  `service_check_required` posture without reading the central ledger; only the
+  interactive operator path resolves canonical approval state. Missing-provider
+  connection requests no longer leave dead-end connector scaffolds; explicit
+  scaffold-only requests remain available.
+- Preserve the v1 update contract for existing workspaces. `tcx update`
+  refreshes the generated invocation, permission, hook, and skill surfaces
+  without a database migration, keeps workspace identity and user-owned
+  artifacts, and retains the existing explicit home, database, and service
+  address. Fully restart Codex and open a new task after updating so an older
+  task cannot retain its prior hook snapshot. Existing manual provider bundles
+  may omit provenance, while changed or newly unsafe bundles must be reviewed
+  and approved again.
+
 ## 1.0.2 - 2026-07-15
 
 - Preserve an attached release workspace's explicit `TRADINGCODEX_HOME`,
@@ -127,8 +178,8 @@
   user-terminal handoffs instead of attempting a blocked model shell.
 - Replace agent-side connector `connect`/write-style scaffold MCP operations
   with read-only, content-addressed scaffold rendering plus native patching.
-  External MCP lifecycle/consent and provider-source approval remain
-  interactive operator actions protected by one-use service capabilities.
+  Provider-source approval remains an interactive operator action protected by
+  a one-use service capability.
 - Add the explicit-only `tcx-order-allow` bundle and `OrderTurnGrant`: only a
   physical first line `$tcx-order-allow --mode paper|validation|live` can admit one
   later submit or cancel in that root turn. Grants bind workspace, session,

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 1.0.2
+Version: 1.1.1
 Summary: Local-first investment operating system for Codex-native research and service-gated execution.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0
@@ -132,15 +132,6 @@ needs revision, or is blocked.
 | **Django service** | Enforces artifact identity, policy, approval, broker, idempotency, execution, and audit rules through shared application services. | It does not replace Codex with a semantic router, preset team, or stored workflow DAG. |
 | **Read-only viewer** | Lets you browse Library artifacts, Skills, System posture, and registered workspaces. | It does not launch Codex, write workspace files, or mutate orders, brokers, skills, or policy. |
 
-```mermaid
-flowchart LR
-  question[Your mandate] --> codex[Native Codex task]
-  codex --> team[Head Manager and fixed-role evidence]
-  team --> artifacts[Authenticated research artifacts]
-  artifacts --> viewer[Read-only Library and System viewer]
-  artifacts --> service[Policy, approval, broker, and audit gates]
-```
-
 ## What You Keep
 
 TradingCodex keeps the work inspectable after the chat ends:
@@ -165,6 +156,11 @@ that state in prompts or workspace files.
 - Fixed roles have bounded tools and handoff responsibilities. A final order
   path is available only from an exact root-native protocol, never from the
   viewer, a subagent, public REST, generic CLI, or direct MCP call.
+- User-installed MCP servers, skills, and plugins are BYOR native Codex
+  capabilities. TradingCodex neither recommends nor verifies them; their
+  licenses, data terms, costs, and side effects remain the user/provider's
+  responsibility, and TradingCodex guarantees cover only its own capabilities,
+  state, and actions.
 - Raw credentials do not belong in prompts, workspace files, reports, API/MCP
   output, or audit data.
 

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/README.md

@@ -95,15 +95,6 @@ needs revision, or is blocked.
 | **Django service** | Enforces artifact identity, policy, approval, broker, idempotency, execution, and audit rules through shared application services. | It does not replace Codex with a semantic router, preset team, or stored workflow DAG. |
 | **Read-only viewer** | Lets you browse Library artifacts, Skills, System posture, and registered workspaces. | It does not launch Codex, write workspace files, or mutate orders, brokers, skills, or policy. |
 
-```mermaid
-flowchart LR
-  question[Your mandate] --> codex[Native Codex task]
-  codex --> team[Head Manager and fixed-role evidence]
-  team --> artifacts[Authenticated research artifacts]
-  artifacts --> viewer[Read-only Library and System viewer]
-  artifacts --> service[Policy, approval, broker, and audit gates]
-```
-
 ## What You Keep
 
 TradingCodex keeps the work inspectable after the chat ends:
@@ -128,6 +119,11 @@ that state in prompts or workspace files.
 - Fixed roles have bounded tools and handoff responsibilities. A final order
   path is available only from an exact root-native protocol, never from the
   viewer, a subagent, public REST, generic CLI, or direct MCP call.
+- User-installed MCP servers, skills, and plugins are BYOR native Codex
+  capabilities. TradingCodex neither recommends nor verifies them; their
+  licenses, data terms, costs, and side effects remain the user/provider's
+  responsibility, and TradingCodex guarantees cover only its own capabilities,
+  state, and actions.
 - Raw credentials do not belong in prompts, workspace files, reports, API/MCP
   output, or audit data.
 

tradingcodex-1.1.1/apps/mcp/admin.py

@@ -0,0 +1,20 @@
+from django.contrib import admin
+
+from apps.mcp.models import McpToolCall, McpToolDefinition
+
+
+class ReadOnlyAdmin(admin.ModelAdmin):
+    def get_readonly_fields(self, request, obj=None):
+        return tuple(field.name for field in self.model._meta.fields)
+
+    def has_add_permission(self, request) -> bool:
+        return False
+
+    def has_change_permission(self, request, obj=None) -> bool:
+        return False
+
+    def has_delete_permission(self, request, obj=None) -> bool:
+        return False
+
+
+admin.site.register([McpToolDefinition, McpToolCall], ReadOnlyAdmin)

tradingcodex-1.1.1/apps/mcp/migrations/0002_remove_external_mcp_gate.py

@@ -0,0 +1,22 @@
+from django.db import migrations
+
+
+def remove_gate_broker_connections(apps, schema_editor):
+    BrokerConnection = apps.get_model("integrations", "BrokerConnection")
+    BrokerConnection.objects.filter(provider_id="external-mcp", transport="mcp").delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("integrations", "0001_v1_initial"),
+        ("mcp", "0001_v1_initial"),
+    ]
+
+    operations = [
+        migrations.RunPython(remove_gate_broker_connections, migrations.RunPython.noop),
+        migrations.DeleteModel(name="McpExternalPermissionRequest"),
+        migrations.DeleteModel(name="McpExternalToolCall"),
+        migrations.DeleteModel(name="McpExternalToolPermission"),
+        migrations.DeleteModel(name="McpExternalTool"),
+        migrations.DeleteModel(name="McpRouter"),
+    ]

tradingcodex-1.1.1/apps/mcp/models.py

@@ -0,0 +1,45 @@
+from django.db import models
+
+
+class McpToolDefinition(models.Model):
+    name = models.CharField(max_length=160, unique=True)
+    description = models.TextField(blank=True)
+    category = models.CharField(max_length=64, default="general")
+    capability_required = models.CharField(max_length=160, blank=True)
+    input_schema = models.JSONField(default=dict, blank=True)
+    risk_level = models.CharField(max_length=32, default="read")
+    allowed_roles = models.JSONField(default=list, blank=True)
+    requires_approval = models.BooleanField(default=False)
+    audit_required = models.BooleanField(default=True)
+    experimental = models.BooleanField(default=False)
+    enabled = models.BooleanField(default=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name = "MCP tool definition"
+        verbose_name_plural = "MCP tool definitions"
+
+    def __str__(self) -> str:
+        return self.name
+
+
+class McpToolCall(models.Model):
+    created_at = models.DateTimeField(auto_now_add=True)
+    tool_name = models.CharField(max_length=160)
+    principal_id = models.CharField(max_length=128, default="unknown")
+    status = models.CharField(max_length=32, default="recorded")
+    request = models.JSONField(default=dict, blank=True)
+    response = models.JSONField(default=dict, blank=True)
+    workspace_context = models.JSONField(default=dict, blank=True)
+    request_hash = models.CharField(max_length=64, blank=True)
+    result_hash = models.CharField(max_length=64, blank=True)
+    error = models.TextField(blank=True)
+    duration_ms = models.PositiveIntegerField(default=0)
+
+    class Meta:
+        ordering = ["-created_at", "-id"]
+        verbose_name = "MCP tool call"
+        verbose_name_plural = "MCP tool calls"
+
+    def __str__(self) -> str:
+        return f"{self.tool_name} {self.status}"

tradingcodex-1.1.1/apps/mcp/services.py

@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from tradingcodex_service.log_safety import redact_log_text
+
+
+REDACTED = "<redacted>"
+SAFE_REFERENCE_RE = re.compile(r"^env:[A-Za-z_][A-Za-z0-9_]*$")
+
+
+def redact_sensitive_data(value: Any, *, secret_values: tuple[str, ...] = ()) -> Any:
+    """Redact credentials from MCP requests, responses, audit data, and errors."""
+
+    secrets = tuple(secret for secret in secret_values if secret)
+    if isinstance(value, dict):
+        redacted: dict[str, Any] = {}
+        for raw_key, item in value.items():
+            key = str(raw_key)
+            if key.lower() == "env":
+                redacted[key] = _redact_environment(item)
+            elif key.lower() == "credential_ref" and _is_safe_reference(item):
+                redacted[key] = str(item)
+            elif _is_sensitive_field(key):
+                redacted[key] = REDACTED
+            else:
+                redacted[key] = redact_sensitive_data(item, secret_values=secrets)
+        return redacted
+    if isinstance(value, list):
+        redacted_items: list[Any] = []
+        redact_next = False
+        for item in value:
+            if redact_next:
+                redacted_items.append(REDACTED)
+                redact_next = False
+                continue
+            redacted_items.append(redact_sensitive_data(item, secret_values=secrets))
+            redact_next = isinstance(item, str) and bool(
+                re.fullmatch(
+                    r"--?(?:api[_-]?key|token|secret|password|credential|authorization)",
+                    item,
+                    flags=re.I,
+                )
+            )
+        return redacted_items
+    if isinstance(value, tuple):
+        return [redact_sensitive_data(item, secret_values=secrets) for item in value]
+    if isinstance(value, str):
+        return _redact_sensitive_text(value, secrets)
+    return value
+
+
+def _redact_environment(value: Any) -> dict[str, str] | str:
+    if not isinstance(value, dict):
+        return REDACTED
+    result: dict[str, str] = {}
+    for key, item in value.items():
+        text = str(item or "")
+        result[str(key)] = text if SAFE_REFERENCE_RE.fullmatch(text) else REDACTED
+    return result
+
+
+def _is_safe_reference(value: Any) -> bool:
+    text = str(value or "")
+    return bool(
+        SAFE_REFERENCE_RE.fullmatch(text)
+        or re.fullmatch(r"(?:os-keychain|keyring|secret)://[A-Za-z0-9._~:/@+-]+", text)
+    )
+
+
+def _is_sensitive_field(key: str) -> bool:
+    normalized = re.sub(r"[^a-z0-9]", "", str(key).lower())
+    return normalized.endswith(
+        (
+            "secret",
+            "secrets",
+            "password",
+            "passphrase",
+            "credential",
+            "credentials",
+            "apikey",
+            "accesstoken",
+            "refreshtoken",
+            "token",
+            "authorization",
+            "cookie",
+        )
+    )
+
+
+def _redact_sensitive_text(value: str, secret_values: tuple[str, ...] = ()) -> str:
+    text = str(value or "")
+    for secret in sorted((item for item in secret_values if item), key=len, reverse=True):
+        text = text.replace(secret, REDACTED)
+    text = re.sub(r"(?i)(bearer\s+)[^\s,;]+", rf"\1{REDACTED}", text)
+    text = re.sub(
+        r"(?i)((?:api[_-]?key|token|secret|password|credential|authorization)\s*[:=]\s*)([^\s,;&]+)",
+        rf"\1{REDACTED}",
+        text,
+    )
+    text = re.sub(r"(?i)([a-z][a-z0-9+.-]*://)[^/@\s]+@", rf"\1{REDACTED}@", text)
+    return redact_log_text(text)

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/docs/README.md

@@ -47,7 +47,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 
 | Document | Purpose |
 | --- | --- |
-| [release-readiness.md](./release-readiness.md) | v1.0.1 source readiness, final-commit and exact-artifact validation, and pending tag, publication, and post-publish gates. |
+| [release-readiness.md](./release-readiness.md) | Current v1 release readiness, prior-version update compatibility, exact-artifact validation, and tag, publication, and post-publish gates. |
 
 ## Workflow And Agent Documents
 
@@ -65,7 +65,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | Document | Owns |
 | --- | --- |
 | [guardrails.md](./guardrails.md) | Guardrail taxonomy: guidance, enforcement, and information barriers. |
-| [safety-policy-and-execution.md](./safety-policy-and-execution.md) | Permission checks, approval rules, execution lifecycle, adapter boundary, external MCP gate, blocked actions, and secret handling. |
+| [safety-policy-and-execution.md](./safety-policy-and-execution.md) | Permission checks, approval rules, execution lifecycle, adapter boundary, BYOR Codex capability boundary, blocked actions, and secret handling. |
 | [improvement-loop.md](./improvement-loop.md) | Workflow quality, research memory, improve records, skill evolution, postmortem review, validation feedback, and quality-learning loops. |
 
 ## Implementation And Operations Documents
@@ -73,7 +73,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | Document | Owns |
 | --- | --- |
 | [system-architecture.md](./system-architecture.md) | Django modular monolith, central DB ownership, app boundaries, runtime planes, service-layer use cases, and core models. |
-| [interfaces-and-surfaces.md](./interfaces-and-surfaces.md) | Product web, Django Admin, Django Ninja API, MCP boundary, CLI, generated wrapper behavior, and external MCP surface. |
+| [interfaces-and-surfaces.md](./interfaces-and-surfaces.md) | Product web, Django Admin, Django Ninja API, MCP boundary, CLI, generated wrapper behavior, and read-only Codex capability inventory. |
 | [generated-workspaces.md](./generated-workspaces.md) | `tcx attach`, `tcx update`, generated files, project-scoped MCP config, hooks, workspace provenance, profile scope, and template rules. |
 | [investment-brain-plugins.md](./investment-brain-plugins.md) | Product plan for high-freedom community TradingCodex Investment Brain plugins, Codex-skill projection, layer/override semantics, Decision Memory boundaries, and Git-managed user workspaces. |
 | [validation-and-test-plan.md](./validation-and-test-plan.md) | Required validation commands, unit/API/generator/smoke coverage, MCP smokes, broker provider smokes, routing scenarios, and release-sensitive checks. |
@@ -89,7 +89,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | User-facing request scoping, investor-context suitability, plain-English output, or professional finance framing | `financial-workflow-references.md`, `interfaces-and-surfaces.md`, `roles-skills-and-workflows.md` |
 | Role roster, model policy, head-manager dispatch, skills, Investment Brain plugins, strategy behavior, routing, information barriers, or handoff quality | `release-readiness.md`, `investment-brain-plugins.md`, `codex-native-orchestration.md`, `roles-skills-and-workflows.md`, `harness.md`, `generated-workspaces.md`, `core-concepts-and-rules.md` |
 | Research or decision memory, source snapshots, ResearchSpec/replay/ExperimentRun, forecast/calibration ledgers, postmortem lessons, search indexes, readiness labels, artifact paths, report quality, or markdown preview | `decision-memory.md`, `research-memory-and-artifacts.md`, `improvement-loop.md`, `codex-native-orchestration.md` |
-| Policy, permissions, approvals, idempotency, execution, adapters, broker safety, external MCP gate, or secret handling | `safety-policy-and-execution.md`, `guardrails.md`, `core-concepts-and-rules.md` |
+| Policy, permissions, approvals, idempotency, execution, adapters, broker safety, BYOR capabilities, or secret handling | `safety-policy-and-execution.md`, `guardrails.md`, `core-concepts-and-rules.md` |
 | Django apps, models, service-layer contracts, central DB ownership, or runtime topology | `system-architecture.md` |
 | Product web, Admin, REST, MCP, CLI, or generated wrapper behavior | `interfaces-and-surfaces.md` |
 | Workspace templates, bootstrap, hooks, project MCP config, generated files, or update behavior | `generated-workspaces.md` |

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/docs/components.md

@@ -60,14 +60,14 @@ clear.
 | `investment-brain-plugins` | Supports privacy-reviewed user-owned local Brain authoring, strict community bundle validation, explicit Head Manager-only projection, immutable versions, and receipt-authenticated run/artifact/Decision Memory provenance. | `guardrail.guidance`, `improvement.skill_evolution`, `improvement.research_memory` |
 | `fixed-role-dispatch` | Maintains head-manager, fixed subagent routing, and no-overlap handoff boundaries in native Codex. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.workflow_quality` |
 | `versioned-workspace` | Keeps generated workspaces in user-owned Git worktrees with privacy-first ignores and no automatic stage, commit, remote, or publication. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.validation_feedback` |
-| `research-memory` | Stores source-aware research artifacts, versions, snapshots, Evidence Run Cards, Validation Cards, and exports. | `improvement.research_memory` |
+| `research-memory` | Stores source-aware research artifacts, versions, snapshots, Evidence Run Cards, Validation Cards, and rebuildable research/cross-artifact search projections. | `improvement.research_memory` |
 | `workflow-quality-gates` | Defines artifact quality, Decision Quality Spine, agent judgment review, claim discipline, and synthesis lineage without a Django workflow loop. | `guardrail.guidance`, `improvement.workflow_quality` |
 | `decision-package` | Freezes run provenance, artifact paths, forecasts, investor-context gaps, and outcomes in Codex-readable workspace records. | `guardrail.guidance`, `improvement.workflow_quality`, `improvement.research_memory` |
 | `artifact-quality-contract` | Evaluates workspace artifacts, Evidence Run Cards, Validation Cards, source snapshots, and forecast ledgers for source/as-of posture, source trust, data-boundary warnings, claim tags, handoff state, confidence, missing evidence, judgment-review fields, and next-recipient routing metadata. | `guardrail.guidance`, `improvement.workflow_quality`, `improvement.research_memory` |
 | `context-efficiency-contract` | Keeps workflows bounded through compact briefs, artifact references, context summaries, source snapshot IDs, targeted full-artifact reads, and `subagents context-audit` validation. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.workflow_quality`, `improvement.context_efficiency` |
 | `responsibility-boundary-contract` | Separates durable role identity, tool permissions, skill procedures, artifact contracts, and projection ownership so changes stay local. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.workflow_quality`, `improvement.skill_evolution` |
 | `tcx-source-gate` | Keeps external evidence read-only and source-aware. | `guardrail.guidance`, `improvement.workflow_quality` |
-| `external-mcp-proxy-gate` | Registers external MCP connections, imports metadata, classifies risk, manages lifecycle/review state, and blocks unsafe direct connection paths. | `guardrail.enforcement`, `guardrail.information_barrier` |
+| `codex-capability-inventory` | Lists sanitized native Codex MCP, skill, plugin, app, and hook metadata without managing or endorsing user-installed capabilities. | `guardrail.guidance`, `guardrail.information_barrier` |
 | `broker-center` | Acts as the local broker control plane for connector state, capability profiles, source drift, read-only account discovery, sync runs, mapping review, reconciliation, and service-gated execution. | `guardrail.enforcement`, `improvement.workflow_quality` |
 | `secret-wall` | Blocks raw broker secrets from workspace files, prompts, shell paths, and role context. | `guardrail.enforcement`, `guardrail.information_barrier` |
 | `policy-and-restricted-list` | Evaluates principals, capabilities, explicit deny rules, restricted symbols, and limits. | `guardrail.enforcement` |

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/docs/core-concepts-and-rules.md

@@ -122,7 +122,7 @@ exact root native action -> deterministic hook parse -> native-user permission
   -> policy -> payload validation -> approval/duplicate-request check
   -> mandatory intent audit -> connection -> finalized/uncertain audit
 
-exact first-line $tcx-order-allow -> workspace/session/turn/prompt/mode grant
+exact first-meaningful-line $tcx-order-allow -> workspace/session/turn/prompt/mode grant
   -> protected use_order_turn_grant + PreToolUse proof -> consume once
   -> the same canonical policy/approval/idempotency/live/audit gates
 ```
@@ -131,8 +131,10 @@ The root `tcx-order-submit` and `tcx-order-cancel` skill bundles
 carry no tools. Their complete exact prompt grammar is intercepted by
 `UserPromptSubmit` and dispatched in-process to the service gateway before any
 model runs. The separate `tcx-order-allow` bundle documents current-turn admission:
-an exact physical first line issues one `OrderTurnGrant`, and only root Head
+an exact first meaningful line issues one `OrderTurnGrant`, and only root Head
 Manager can select one later submit or cancel through `use_order_turn_grant`.
+The leading skill may be a plain token or its matching projected Markdown link;
+the order mode and immediate action grammars remain literal.
 `PreToolUse` injects proof that model input and direct MCP callers cannot supply.
 The browser viewer has no mutation route. Fixed roles, public REST, generic
 CLI, and unproven direct MCP calls cannot invoke the final mutation.

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/docs/decision-memory.md

@@ -71,6 +71,16 @@ The source of truth is the existing file-native record:
 Existing events are not edited to make history look cleaner. Corrections,
 revisions, supersession, disputes, and retirement are new records.
 
+The rebuildable v2 artifact catalog provides a discovery projection across
+these file-native records without becoming Decision Memory itself. New
+type-specific service output projects with full canonical identity metadata;
+older files remain unchanged and may project as `legacy_partial`. Malformed
+records are quarantined as `invalid`. A point-in-time catalog query uses each
+type's explicit `knowledge_cutoff` or `known_at` field and excludes missing,
+malformed, or later values, so legacy discovery does not silently become
+historical provenance. The catalog can be discarded and recreated from source
+artifacts and verified forecast-ledger state.
+
 ### Time contract
 
 Decision Memory needs more than a document `updated_at`. Records should
@@ -355,8 +365,8 @@ Memory remains independent of the Brain that produced a decision:
   provenance.
 
 Learning from memory into a Brain is a separate user-controlled curation path.
-Writing requires a root native Codex prompt whose exact physical first line is
-`$tcx-brain`, an explicit source-authoring request below it, an
+Writing requires a root native Codex prompt whose first meaningful invocation
+is `$tcx-brain`, an explicit source-authoring request on that line or below it, an
 actual Codex sandbox that permits the required workspace-local writes, exact
 user-selected source episodes, and counterexamples. The Brain-scoped grant is
 bound to that turn, cannot authorize Build or Strategy work, and does not carry

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/docs/deployment.md

@@ -79,7 +79,6 @@ the backend listener private. Invalid remote settings fail before binding.
 - service autostart, `tcx service status`, compatibility checks, and `doctor`
   consume readiness rather than treating a reachable process as ready.
 - service logs rotate at 5 MiB with three backups by default.
-- external MCP stderr rotates separately at 1 MiB with two backups.
 - persisted logs redact known secrets, authorization values,
   credential-shaped fields, and URL user-info.
 
@@ -150,12 +149,20 @@ find . -maxdepth 1 -name '*.egg-info' -type d -exec rm -rf {} +
 python3.11 -m build
 python3.11 -m twine check dist/*
 python3.11 tests/platform_wheel_smoke.py --wheel-dir dist
+python3.11 tests/release_upgrade_smoke.py --wheel-dir dist --from-version 1.0.2
 ```
 
 The wheel smoke installs only the built wheel into a clean virtual environment,
 checks distribution metadata against the runtime version, attaches a workspace,
 validates native launchers and generated configuration, runs hooks and MCP
 stdio, exercises the local service, and loads the packaged SPA and assets.
+The release-upgrade smoke starts from the published `1.0.2` package, updates
+that attached workspace with the built candidate wheel, and verifies preserved
+workspace and runtime identity, user-owned state, and explicit home, DB, and
+service-address settings alongside the refreshed generated contract. It also
+preserves the exact provider approval identity and timestamp, compares every
+byte in the immutable provider snapshot, and proves that the candidate runtime
+loads that approved snapshot after the update.
 
 Harness, role, prompt, skill, hook, policy, MCP, or generated-template changes
 also require the disposable-workspace and Codex-native checks documented in
@@ -165,7 +172,8 @@ also require the disposable-workspace and Codex-native checks documented in
 
 `.github/workflows/ci.yml` is test-only. One Ubuntu/Python 3.11 job runs the
 frontend build, complete Python suite and framework gates, clean package
-construction, and the wheel smoke. Guide-only pushes skip this workflow because
+construction, the wheel smoke, and the prior-release update smoke. Guide-only
+pushes skip this workflow because
 the Pages workflow validates and deploys only static guide files. CI never
 publishes.
 
@@ -179,7 +187,8 @@ publishes.
 - the workflow ref is exactly `refs/tags/v<release_version>`
 - the tagged commit is on `origin/main`
 - the wheel and source-distribution filenames carry the same version
-- the built wheel passes the Ubuntu smoke
+- `dist/` contains exactly that one wheel and one source distribution
+- the built wheel passes the Ubuntu wheel and prior-release update smokes
 - the protected `pypi` environment approves Trusted Publishing
 
 The release workflow has one build/verification job. When publication is
@@ -261,7 +270,7 @@ sh "$SOURCE_ROOT/install.sh" \
 On native Windows PowerShell:
 
 ```powershell
-$ReleaseVersion = "1.0.2"
+$ReleaseVersion = "1.1.1"
 $Workspace = Join-Path $env:TEMP "tcx-pypi-$ReleaseVersion"
 New-Item -ItemType Directory -Force $Workspace | Out-Null
 Set-Location $Workspace

{tradingcodex-1.0.2 → tradingcodex-1.1.1}/docs/execution-without-subagent-plan.md

@@ -26,7 +26,7 @@ design, migration, and validation evidence.
   author every class of Codex app Scheduled Task, from simple research and
   monitoring through optional turn-authorized execution.
 - [x] Issue a workspace-, session-, turn-, prompt-, and mode-bound single-use
-  grant only for an exact physical first line `$tcx-order-allow --mode
+  grant only for an exact first meaningful line `$tcx-order-allow --mode
   paper|validation|live`; revoke it after one submit or cancel, after one hour,
   on `Stop`, or when the next user turn starts.
 - [x] Protect `use_order_turn_grant` so only root Head Manager can select the
@@ -82,9 +82,9 @@ Remove `execution-operator` from the fixed-role roster. Native Codex keeps the
 exact immediate submit/cancel path for already-known canonical identifiers and
 adds a separate single-turn path for workflows that create the ticket or
 approval during the turn. The immediate path executes in `UserPromptSubmit`
-before Head Manager runs. The turn path begins only when the physical first
-line is exact `$tcx-order-allow --mode paper|validation|live`, then continues the
-normal workflow with a single-use service grant.
+before Head Manager runs. The turn path begins only when the first meaningful
+line is exactly `$tcx-order-allow --mode paper|validation|live`, then continues
+the normal workflow with a single-use service grant.
 
 `tcx-automate` authors Codex app Scheduled Tasks; it is not a scheduler or
 the skill invoked recursively by each run. Research, monitoring, recurring
@@ -109,7 +109,7 @@ UserPromptSubmit  -> deterministic parse and native-user mandate
 Django service    -> authorize, reserve, audit, invoke adapter, finalize
 Head Manager      -> summarize the already-recorded result; no action authority
 
-native/scheduled user -> exact physical first-line $tcx-order-allow mode
+native/scheduled user -> exact first-meaningful-line $tcx-order-allow mode
 UserPromptSubmit      -> bind one grant to workspace + session + turn + prompt + mode
 roles/services        -> create and approve canonical ticket state
 Head Manager          -> call protected use_order_turn_grant once
@@ -152,7 +152,8 @@ Each bundle follows the normal TradingCodex skill shape, including `SKILL.md`
 and `agents/openai.yaml`, but contains no tool authority. The skill documents an
 action syntax intercepted by the hook before the model runs.
 
-The complete trimmed user prompt must have one of these forms:
+The complete meaningful user prompt must have one of these canonical plain
+forms:
 
 ```text
 $tcx-order-submit --ticket-id <ticket-id> --approval-receipt-id <receipt-id>
@@ -162,10 +163,13 @@ $tcx-order-cancel --ticket-id <ticket-id> --broker-order-id <broker-order-id> --
 $tcx-order-cancel --ticket-id <ticket-id> --broker-order-id <broker-order-id> --approval-receipt-id <receipt-id> --live-confirmation <token>
 ```
 
-Parsing rules are intentionally strict:
+Parsing rules are intentionally strict. One UTF-8 BOM, normalized CRLF/CR/NEL/
+Unicode line separators, leading/trailing blank lines, and a Markdown link whose
+label and target match the projected workspace action skill are presentation
+variants only:
 
 - Parse with `shlex.split`; never use a shell or evaluate prompt content.
-- Require the skill token to be the first token and the entire prompt to be the
+- Require the skill invocation to be first and the entire meaningful prompt to be the
   action. Free-form prefixes, suffixes, comments, quotations, or a second skill
   invocation are invalid.
 - Accept only the documented `--name value` form. Reject `--name=value`, unknown
@@ -191,8 +195,8 @@ must not fall through to Head Manager as ordinary analysis.
 
 ## Turn-Scoped Order Allow Contract
 
-For a workflow that may create its final identifiers during the turn, the
-physical first line must be exactly one of:
+For a workflow that may create its final identifiers during the turn, the first
+meaningful line must be exactly one of:
 
 ```text
 $tcx-order-allow --mode paper
@@ -200,9 +204,10 @@ $tcx-order-allow --mode validation
 $tcx-order-allow --mode live
 ```
 
-The rest of the prompt is the ordinary interactive or Codex app Scheduled Task
-request. The line accepts no aliases, comments, quotes, extra flags, embedded
-prose, or `--mode=value` form. A free-form mention or later-line occurrence
+The skill token may be its matching projected Markdown link. The rest of the
+prompt is a non-empty ordinary interactive or Codex app Scheduled Task request.
+The line accepts no aliases, comments, quotes, extra flags, embedded prose, or
+`--mode=value` form. A free-form mention or later-meaningful-line occurrence
 does not grant authority. Scheduled and interactive turns use the same parser;
 there is no Automation-origin branch.
 
@@ -252,7 +257,7 @@ normal analysis context:
    canonical ids. If this audit is unavailable, fail closed before service
    invocation.
 4. Call the execution gateway synchronously and in-process. Do not launch a
-   shell, subprocess, external MCP proxy, or Head Manager tool call.
+   shell, subprocess, user-installed capability, or Head Manager tool call.
 5. Emit only an allowlisted result projection as `UserPromptSubmit` additional
    context with marker `tradingcodex-native-execution-result`.
 6. Instruct Head Manager to report the recorded result without spawning roles,
@@ -264,7 +269,7 @@ normal analysis context:
 The existing provider-call idempotency remains the replay defense if the hook
 event is delivered more than once.
 
-For `$tcx-order-allow`, `UserPromptSubmit` instead validates the exact first line,
+For `$tcx-order-allow`, `UserPromptSubmit` instead validates the exact first meaningful line,
 requires root native `session_id` and `turn_id`, revokes the session's older
 grant, issues the new bounded grant, and continues normal analysis allocation.
 The additional context contains only mode, expiry, single-use posture, and the
@@ -400,8 +405,9 @@ map, or safety routing would otherwise become misleading.
 - Prove that unavailable hook audit blocks before reservation/provider use.
 - Prove that hook result projection contains no raw prompt, reasoning, secrets,
   credentials, raw provider payload, or unallowlisted error text.
-- Accept only the three exact physical-first-line `$tcx-order-allow` modes; reject
-  later-line, malformed, subagent, Workbench, missing-session, and missing-turn
+- Accept only the three exact first-meaningful-line `$tcx-order-allow` modes;
+  reject later-meaningful-line, malformed, subagent, Workbench,
+  missing-session, and missing-turn
   forms without issuing a grant.
 - Prove grant binding to workspace, session, turn, prompt hash, mode, and
   tool-use id; prove one-hour, `Stop`, next-turn, and consumption revocation.
@@ -465,7 +471,7 @@ The change is complete only when all of the following are true:
 8. Generated workspace update safely retires unmodified agent files and
    preserves modified-file conflict protection.
 9. A saved Scheduled Task prompt is processed as an ordinary root turn on each
-   run; only an exact `$tcx-order-allow` physical first line can create one bounded
+   run; only an exact `$tcx-order-allow` first meaningful line can create one bounded
    effect grant, and no Automation-origin detector is involved.
 
 ## Explicit Non-Goals