tradingcodex 1.1.0__tar.gz → 1.1.2__tar.gz

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/CHANGELOG.md

@@ -2,6 +2,96 @@
 
 ## Unreleased
 
+## 1.1.2 - 2026-07-17
+
+- Add a cross-platform fixed-role calculation surface with generated
+  `tcx-calc`/`tcx-calc.cmd` launchers and a content-addressed runtime v2 outside
+  Django, MCP, the service home, DB, workspace, and scratch. Its wheel-only
+  per-artifact hash resource pins the complete 12-package direct/transitive
+  set around NumPy, pandas, SciPy, statsmodels, numpy-financial, and PyArrow.
+  The exact basename-only contract replaces host-dependent system
+  Python and heredocs, sanitizes environment and temp state before exposing the
+  verified runtime, rejects links and compound forms, applies resource bounds,
+  blocks child-process and network escape paths in prepared mode, verifies the
+  generated launcher hashes in doctor, and remains inside the native Codex OS
+  sandbox. Windows scratch now uses `TradingCodexScratch` so it cannot overlap
+  the default service home. Native Windows release smoke invokes both generated
+  batch launchers through tokenized `cmd /c call` commands so workspace paths
+  containing spaces retain their argument boundaries. Pinned packages may load
+  native libraries only from absolute paths inside the verified runtime and
+  only from an imported runtime-package frame; their process-local ctypes
+  bootstrap remains available, including CPython's exact Windows `kernel32`
+  import bootstrap. Scratch calls and external, other bare-name, or raw-integer-
+  handle loading remain denied. The explicit manual
+  release workflow gates the exact wheel through an x86-64 Linux/macOS/Windows
+  and Python 3.11-3.14 runtime matrix.
+- Separate ordinary GitHub uploads from deployment work. Normal source CI keeps
+  source, framework, and deterministic frontend checks but does not build or
+  upload distributions, run release-upgrade or platform matrices, or publish.
+  Documentation-only pushes and pull requests skip source CI, GitHub Pages
+  becomes manual-only, and package build/publication remains confined to
+  explicit Manual Release dispatches.
+- Add immutable Dataset memory with Source Snapshot lineage, explicit typed
+  manifests, content-addressed canonical Parquet payloads, append-only license
+  withdrawals, bounded card/manifest/profile/slice retrieval, and a managed
+  Git ignore rule for payload objects. A rebuildable SQLite+FTS v3 catalog now
+  unifies existing research artifacts with Dataset and Calculation objects,
+  reprojects only changed files, rebuilds after corruption, and continues the
+  legacy JSON exports for one compatibility release. Lineage timestamps cannot
+  predate their Source Snapshot or parent Dataset, withdrawn shared payloads
+  cannot be profiled, malformed manifests fail closed per object, and L0 cards
+  are size-bounded. Internally generated `Path` objects are normalized to the
+  portable forward-slash workspace form on native Windows while caller-supplied
+  backslash paths remain rejected.
+- Add prepared CalculationSpec/Run memory around `tcx-calc`, including declared
+  scratch inputs/outputs, typed finite result envelopes, exact full-fingerprint
+  reuse with a current-workflow reuse Run, comparison by requested metric, and
+  private-ledger snapshot hash binding without durable input values. The new
+  shared `tcx-calculation` skill gives the six financial calculation roles the
+  bounded procedure; Head Manager receives card-only planning discovery and
+  the viewer remains read-only. Calculation cards also project bounded symbols
+  and immutable Dataset relations so instrument-scoped role searches do not
+  miss an existing exact calculation. Prepared recording independently
+  revalidates script/input/sidecar/runtime/output hashes and schemas; Dataset
+  materializations and private central-ledger snapshots are service-bound
+  rather than caller-asserted.
+- Route legacy Source Snapshot, ResearchSpec, ReplayManifest, and ExperimentRun
+  path construction, regular-file reads, hash verification, and immutable
+  writes through the shared Research Object primitives while preserving their
+  released v1 hash encoding and IDs without migration.
+- Enable Head Manager live web search for narrow workflow-planning
+  reconnaissance. Durable root instructions and `tcx-workflow` keep raw search
+  results untrusted and prohibit using them as accepted evidence or synthesis
+  support; material facts must be reacquired by producing roles. Portfolio,
+  risk, and judgment-review roles explicitly keep web search disabled, and the
+  existing Build hook continues to block native web and browser tools.
+- Fix BYOR Codex capability use after the 1.1.1 gate removal. Head Manager and
+  fixed roles now distinguish explicit external skill overlays from read-only
+  app, connector, MCP, and data tools; inspect the current task's callable
+  surface before falling back or declaring a provider unavailable; and treat
+  the sanitized inventory as configuration evidence rather than runtime
+  callability proof. Capability inventory now names plugin app/MCP/hook
+  components from secret-free top-level identifiers and includes compatible
+  user skills discovered below `CODEX_HOME/skills`. Generated workspaces no
+  longer disable Codex apps, leaving app exposure to user, organization, and
+  host policy.
+- Align observed E2E behavior with the workspace contract: fixed roles may edit
+  files in their dedicated private scratch root while arbitrary external paths
+  remain blocked; viewer write-shaped requests consistently return GET-only
+  `405` responses even with CSRF enforcement; managed Brain and Strategy proof
+  errors name their own entrypoints; and E2E hooks execute through the generated
+  launcher runtime.
+
+## 1.1.1 - 2026-07-16
+
+- Remove the legacy user-capability gate, its CLI and broker-import paths,
+  and its active database tables. User-installed MCP servers, skills, plugins,
+  apps, and hooks now remain BYOR native Codex capabilities for root and fixed
+  agents. Add a secret-free read-only capability inventory to MCP and System,
+  preserve non-reserved user Codex configuration across update, and keep all
+  TradingCodex principals, grants, protected proofs, and order effects behind
+  the existing service boundary.
+
 ## 1.1.0 - 2026-07-16
 
 - Make managed skill invocation resilient without weakening authority: Build,
@@ -168,8 +258,8 @@
   user-terminal handoffs instead of attempting a blocked model shell.
 - Replace agent-side connector `connect`/write-style scaffold MCP operations
   with read-only, content-addressed scaffold rendering plus native patching.
-  External MCP lifecycle/consent and provider-source approval remain
-  interactive operator actions protected by one-use service capabilities.
+  Provider-source approval remains an interactive operator action protected by
+  a one-use service capability.
 - Add the explicit-only `tcx-order-allow` bundle and `OrderTurnGrant`: only a
   physical first line `$tcx-order-allow --mode paper|validation|live` can admit one
   later submit or cancel in that root turn. Grants bind workspace, session,

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/MANIFEST.in

@@ -11,5 +11,7 @@ recursive-include frontend *.css *.html *.json *.js *.ts *.tsx
 recursive-include workspace_templates *
 recursive-include workspace_templates .*
 recursive-include tradingcodex_service/static *
+include tradingcodex_cli/calculation-runtime-lock.json
+include tradingcodex_cli/calculation-runtime-requirements.txt
 recursive-exclude frontend/node_modules *
 global-exclude *.py[cod]

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 1.1.0
+Version: 1.1.2
 Summary: Local-first investment operating system for Codex-native research and service-gated execution.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0
@@ -29,13 +29,18 @@ Requires-Dist: markdown-it-py<5,>=3
 Requires-Dist: nh3<0.4,>=0.3
 Requires-Dist: packaging>=24
 Requires-Dist: pydantic>=2
+Requires-Dist: pyarrow==25.0.0
 Requires-Dist: PyYAML>=6
 Requires-Dist: whitenoise<7,>=6.12
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Dynamic: license-file
 
-# TradingCodex
+<h1 align="center">TradingCodex</h1>
+
+<p align="center">
+  <img src="assets/tradingcodex-banner-v3.png" alt="TradingCodex transforms fragmented investment tools into a native Codex research workflow" width="100%">
+</p>
 
 <div align="center">
   <a href="https://pypi.org/project/tradingcodex/"><img alt="PyPI" src="https://img.shields.io/pypi/v/tradingcodex?label=PyPI"></a>
@@ -132,15 +137,6 @@ needs revision, or is blocked.
 | **Django service** | Enforces artifact identity, policy, approval, broker, idempotency, execution, and audit rules through shared application services. | It does not replace Codex with a semantic router, preset team, or stored workflow DAG. |
 | **Read-only viewer** | Lets you browse Library artifacts, Skills, System posture, and registered workspaces. | It does not launch Codex, write workspace files, or mutate orders, brokers, skills, or policy. |
 
-```mermaid
-flowchart LR
-  question[Your mandate] --> codex[Native Codex task]
-  codex --> team[Head Manager and fixed-role evidence]
-  team --> artifacts[Authenticated research artifacts]
-  artifacts --> viewer[Read-only Library and System viewer]
-  artifacts --> service[Policy, approval, broker, and audit gates]
-```
-
 ## What You Keep
 
 TradingCodex keeps the work inspectable after the chat ends:
@@ -165,6 +161,11 @@ that state in prompts or workspace files.
 - Fixed roles have bounded tools and handoff responsibilities. A final order
   path is available only from an exact root-native protocol, never from the
   viewer, a subagent, public REST, generic CLI, or direct MCP call.
+- User-installed MCP servers, skills, and plugins are BYOR native Codex
+  capabilities. TradingCodex neither recommends nor verifies them; their
+  licenses, data terms, costs, and side effects remain the user/provider's
+  responsibility, and TradingCodex guarantees cover only its own capabilities,
+  state, and actions.
 - Raw credentials do not belong in prompts, workspace files, reports, API/MCP
   output, or audit data.
 

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/README.md

@@ -1,4 +1,8 @@
-# TradingCodex
+<h1 align="center">TradingCodex</h1>
+
+<p align="center">
+  <img src="assets/tradingcodex-banner-v3.png" alt="TradingCodex transforms fragmented investment tools into a native Codex research workflow" width="100%">
+</p>
 
 <div align="center">
   <a href="https://pypi.org/project/tradingcodex/"><img alt="PyPI" src="https://img.shields.io/pypi/v/tradingcodex?label=PyPI"></a>
@@ -95,15 +99,6 @@ needs revision, or is blocked.
 | **Django service** | Enforces artifact identity, policy, approval, broker, idempotency, execution, and audit rules through shared application services. | It does not replace Codex with a semantic router, preset team, or stored workflow DAG. |
 | **Read-only viewer** | Lets you browse Library artifacts, Skills, System posture, and registered workspaces. | It does not launch Codex, write workspace files, or mutate orders, brokers, skills, or policy. |
 
-```mermaid
-flowchart LR
-  question[Your mandate] --> codex[Native Codex task]
-  codex --> team[Head Manager and fixed-role evidence]
-  team --> artifacts[Authenticated research artifacts]
-  artifacts --> viewer[Read-only Library and System viewer]
-  artifacts --> service[Policy, approval, broker, and audit gates]
-```
-
 ## What You Keep
 
 TradingCodex keeps the work inspectable after the chat ends:
@@ -128,6 +123,11 @@ that state in prompts or workspace files.
 - Fixed roles have bounded tools and handoff responsibilities. A final order
   path is available only from an exact root-native protocol, never from the
   viewer, a subagent, public REST, generic CLI, or direct MCP call.
+- User-installed MCP servers, skills, and plugins are BYOR native Codex
+  capabilities. TradingCodex neither recommends nor verifies them; their
+  licenses, data terms, costs, and side effects remain the user/provider's
+  responsibility, and TradingCodex guarantees cover only its own capabilities,
+  state, and actions.
 - Raw credentials do not belong in prompts, workspace files, reports, API/MCP
   output, or audit data.
 

tradingcodex-1.1.2/apps/mcp/admin.py

@@ -0,0 +1,20 @@
+from django.contrib import admin
+
+from apps.mcp.models import McpToolCall, McpToolDefinition
+
+
+class ReadOnlyAdmin(admin.ModelAdmin):
+    def get_readonly_fields(self, request, obj=None):
+        return tuple(field.name for field in self.model._meta.fields)
+
+    def has_add_permission(self, request) -> bool:
+        return False
+
+    def has_change_permission(self, request, obj=None) -> bool:
+        return False
+
+    def has_delete_permission(self, request, obj=None) -> bool:
+        return False
+
+
+admin.site.register([McpToolDefinition, McpToolCall], ReadOnlyAdmin)

tradingcodex-1.1.2/apps/mcp/migrations/0002_remove_external_mcp_gate.py

@@ -0,0 +1,22 @@
+from django.db import migrations
+
+
+def remove_gate_broker_connections(apps, schema_editor):
+    BrokerConnection = apps.get_model("integrations", "BrokerConnection")
+    BrokerConnection.objects.filter(provider_id="external-mcp", transport="mcp").delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("integrations", "0001_v1_initial"),
+        ("mcp", "0001_v1_initial"),
+    ]
+
+    operations = [
+        migrations.RunPython(remove_gate_broker_connections, migrations.RunPython.noop),
+        migrations.DeleteModel(name="McpExternalPermissionRequest"),
+        migrations.DeleteModel(name="McpExternalToolCall"),
+        migrations.DeleteModel(name="McpExternalToolPermission"),
+        migrations.DeleteModel(name="McpExternalTool"),
+        migrations.DeleteModel(name="McpRouter"),
+    ]

tradingcodex-1.1.2/apps/mcp/models.py

@@ -0,0 +1,45 @@
+from django.db import models
+
+
+class McpToolDefinition(models.Model):
+    name = models.CharField(max_length=160, unique=True)
+    description = models.TextField(blank=True)
+    category = models.CharField(max_length=64, default="general")
+    capability_required = models.CharField(max_length=160, blank=True)
+    input_schema = models.JSONField(default=dict, blank=True)
+    risk_level = models.CharField(max_length=32, default="read")
+    allowed_roles = models.JSONField(default=list, blank=True)
+    requires_approval = models.BooleanField(default=False)
+    audit_required = models.BooleanField(default=True)
+    experimental = models.BooleanField(default=False)
+    enabled = models.BooleanField(default=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name = "MCP tool definition"
+        verbose_name_plural = "MCP tool definitions"
+
+    def __str__(self) -> str:
+        return self.name
+
+
+class McpToolCall(models.Model):
+    created_at = models.DateTimeField(auto_now_add=True)
+    tool_name = models.CharField(max_length=160)
+    principal_id = models.CharField(max_length=128, default="unknown")
+    status = models.CharField(max_length=32, default="recorded")
+    request = models.JSONField(default=dict, blank=True)
+    response = models.JSONField(default=dict, blank=True)
+    workspace_context = models.JSONField(default=dict, blank=True)
+    request_hash = models.CharField(max_length=64, blank=True)
+    result_hash = models.CharField(max_length=64, blank=True)
+    error = models.TextField(blank=True)
+    duration_ms = models.PositiveIntegerField(default=0)
+
+    class Meta:
+        ordering = ["-created_at", "-id"]
+        verbose_name = "MCP tool call"
+        verbose_name_plural = "MCP tool calls"
+
+    def __str__(self) -> str:
+        return f"{self.tool_name} {self.status}"

tradingcodex-1.1.2/apps/mcp/services.py

@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from tradingcodex_service.log_safety import redact_log_text
+
+
+REDACTED = "<redacted>"
+SAFE_REFERENCE_RE = re.compile(r"^env:[A-Za-z_][A-Za-z0-9_]*$")
+
+
+def redact_sensitive_data(value: Any, *, secret_values: tuple[str, ...] = ()) -> Any:
+    """Redact credentials from MCP requests, responses, audit data, and errors."""
+
+    secrets = tuple(secret for secret in secret_values if secret)
+    if isinstance(value, dict):
+        redacted: dict[str, Any] = {}
+        for raw_key, item in value.items():
+            key = str(raw_key)
+            if key.lower() == "env":
+                redacted[key] = _redact_environment(item)
+            elif key.lower() == "credential_ref" and _is_safe_reference(item):
+                redacted[key] = str(item)
+            elif _is_sensitive_field(key):
+                redacted[key] = REDACTED
+            else:
+                redacted[key] = redact_sensitive_data(item, secret_values=secrets)
+        return redacted
+    if isinstance(value, list):
+        redacted_items: list[Any] = []
+        redact_next = False
+        for item in value:
+            if redact_next:
+                redacted_items.append(REDACTED)
+                redact_next = False
+                continue
+            redacted_items.append(redact_sensitive_data(item, secret_values=secrets))
+            redact_next = isinstance(item, str) and bool(
+                re.fullmatch(
+                    r"--?(?:api[_-]?key|token|secret|password|credential|authorization)",
+                    item,
+                    flags=re.I,
+                )
+            )
+        return redacted_items
+    if isinstance(value, tuple):
+        return [redact_sensitive_data(item, secret_values=secrets) for item in value]
+    if isinstance(value, str):
+        return _redact_sensitive_text(value, secrets)
+    return value
+
+
+def _redact_environment(value: Any) -> dict[str, str] | str:
+    if not isinstance(value, dict):
+        return REDACTED
+    result: dict[str, str] = {}
+    for key, item in value.items():
+        text = str(item or "")
+        result[str(key)] = text if SAFE_REFERENCE_RE.fullmatch(text) else REDACTED
+    return result
+
+
+def _is_safe_reference(value: Any) -> bool:
+    text = str(value or "")
+    return bool(
+        SAFE_REFERENCE_RE.fullmatch(text)
+        or re.fullmatch(r"(?:os-keychain|keyring|secret)://[A-Za-z0-9._~:/@+-]+", text)
+    )
+
+
+def _is_sensitive_field(key: str) -> bool:
+    normalized = re.sub(r"[^a-z0-9]", "", str(key).lower())
+    return normalized.endswith(
+        (
+            "secret",
+            "secrets",
+            "password",
+            "passphrase",
+            "credential",
+            "credentials",
+            "apikey",
+            "accesstoken",
+            "refreshtoken",
+            "token",
+            "authorization",
+            "cookie",
+        )
+    )
+
+
+def _redact_sensitive_text(value: str, secret_values: tuple[str, ...] = ()) -> str:
+    text = str(value or "")
+    for secret in sorted((item for item in secret_values if item), key=len, reverse=True):
+        text = text.replace(secret, REDACTED)
+    text = re.sub(r"(?i)(bearer\s+)[^\s,;]+", rf"\1{REDACTED}", text)
+    text = re.sub(
+        r"(?i)((?:api[_-]?key|token|secret|password|credential|authorization)\s*[:=]\s*)([^\s,;&]+)",
+        rf"\1{REDACTED}",
+        text,
+    )
+    text = re.sub(r"(?i)([a-z][a-z0-9+.-]*://)[^/@\s]+@", rf"\1{REDACTED}@", text)
+    return redact_log_text(text)

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/docs/README.md

@@ -65,7 +65,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | Document | Owns |
 | --- | --- |
 | [guardrails.md](./guardrails.md) | Guardrail taxonomy: guidance, enforcement, and information barriers. |
-| [safety-policy-and-execution.md](./safety-policy-and-execution.md) | Permission checks, approval rules, execution lifecycle, adapter boundary, external MCP gate, blocked actions, and secret handling. |
+| [safety-policy-and-execution.md](./safety-policy-and-execution.md) | Permission checks, approval rules, execution lifecycle, adapter boundary, BYOR Codex capability boundary, blocked actions, and secret handling. |
 | [improvement-loop.md](./improvement-loop.md) | Workflow quality, research memory, improve records, skill evolution, postmortem review, validation feedback, and quality-learning loops. |
 
 ## Implementation And Operations Documents
@@ -73,7 +73,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | Document | Owns |
 | --- | --- |
 | [system-architecture.md](./system-architecture.md) | Django modular monolith, central DB ownership, app boundaries, runtime planes, service-layer use cases, and core models. |
-| [interfaces-and-surfaces.md](./interfaces-and-surfaces.md) | Product web, Django Admin, Django Ninja API, MCP boundary, CLI, generated wrapper behavior, and external MCP surface. |
+| [interfaces-and-surfaces.md](./interfaces-and-surfaces.md) | Product web, Django Admin, Django Ninja API, MCP boundary, CLI, generated wrapper behavior, and read-only Codex capability inventory. |
 | [generated-workspaces.md](./generated-workspaces.md) | `tcx attach`, `tcx update`, generated files, project-scoped MCP config, hooks, workspace provenance, profile scope, and template rules. |
 | [investment-brain-plugins.md](./investment-brain-plugins.md) | Product plan for high-freedom community TradingCodex Investment Brain plugins, Codex-skill projection, layer/override semantics, Decision Memory boundaries, and Git-managed user workspaces. |
 | [validation-and-test-plan.md](./validation-and-test-plan.md) | Required validation commands, unit/API/generator/smoke coverage, MCP smokes, broker provider smokes, routing scenarios, and release-sensitive checks. |
@@ -89,7 +89,7 @@ If these layers disagree, treat `docs/` as the durable product intent and fix th
 | User-facing request scoping, investor-context suitability, plain-English output, or professional finance framing | `financial-workflow-references.md`, `interfaces-and-surfaces.md`, `roles-skills-and-workflows.md` |
 | Role roster, model policy, head-manager dispatch, skills, Investment Brain plugins, strategy behavior, routing, information barriers, or handoff quality | `release-readiness.md`, `investment-brain-plugins.md`, `codex-native-orchestration.md`, `roles-skills-and-workflows.md`, `harness.md`, `generated-workspaces.md`, `core-concepts-and-rules.md` |
 | Research or decision memory, source snapshots, ResearchSpec/replay/ExperimentRun, forecast/calibration ledgers, postmortem lessons, search indexes, readiness labels, artifact paths, report quality, or markdown preview | `decision-memory.md`, `research-memory-and-artifacts.md`, `improvement-loop.md`, `codex-native-orchestration.md` |
-| Policy, permissions, approvals, idempotency, execution, adapters, broker safety, external MCP gate, or secret handling | `safety-policy-and-execution.md`, `guardrails.md`, `core-concepts-and-rules.md` |
+| Policy, permissions, approvals, idempotency, execution, adapters, broker safety, BYOR capabilities, or secret handling | `safety-policy-and-execution.md`, `guardrails.md`, `core-concepts-and-rules.md` |
 | Django apps, models, service-layer contracts, central DB ownership, or runtime topology | `system-architecture.md` |
 | Product web, Admin, REST, MCP, CLI, or generated wrapper behavior | `interfaces-and-surfaces.md` |
 | Workspace templates, bootstrap, hooks, project MCP config, generated files, or update behavior | `generated-workspaces.md` |

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/docs/components.md

@@ -60,14 +60,15 @@ clear.
 | `investment-brain-plugins` | Supports privacy-reviewed user-owned local Brain authoring, strict community bundle validation, explicit Head Manager-only projection, immutable versions, and receipt-authenticated run/artifact/Decision Memory provenance. | `guardrail.guidance`, `improvement.skill_evolution`, `improvement.research_memory` |
 | `fixed-role-dispatch` | Maintains head-manager, fixed subagent routing, and no-overlap handoff boundaries in native Codex. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.workflow_quality` |
 | `versioned-workspace` | Keeps generated workspaces in user-owned Git worktrees with privacy-first ignores and no automatic stage, commit, remote, or publication. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.validation_feedback` |
-| `research-memory` | Stores source-aware research artifacts, versions, snapshots, Evidence Run Cards, Validation Cards, and exports. | `improvement.research_memory` |
+| `research-memory` | Stores source-aware research artifacts, versions, snapshots, Evidence Run Cards, Validation Cards, and rebuildable research/cross-artifact search projections. | `improvement.research_memory` |
+| `dataset-calculation-memory` | Stores immutable Dataset manifests/content-addressed Parquet payloads and conclusion-relevant CalculationSpec/Run records, projects them into the rebuildable SQLite+FTS v3 catalog, and reuses only exact successful fingerprints through the wheel-locked finance runtime v2. | `guardrail.information_barrier`, `improvement.research_memory`, `improvement.context_efficiency`, `improvement.validation_feedback` |
 | `workflow-quality-gates` | Defines artifact quality, Decision Quality Spine, agent judgment review, claim discipline, and synthesis lineage without a Django workflow loop. | `guardrail.guidance`, `improvement.workflow_quality` |
 | `decision-package` | Freezes run provenance, artifact paths, forecasts, investor-context gaps, and outcomes in Codex-readable workspace records. | `guardrail.guidance`, `improvement.workflow_quality`, `improvement.research_memory` |
 | `artifact-quality-contract` | Evaluates workspace artifacts, Evidence Run Cards, Validation Cards, source snapshots, and forecast ledgers for source/as-of posture, source trust, data-boundary warnings, claim tags, handoff state, confidence, missing evidence, judgment-review fields, and next-recipient routing metadata. | `guardrail.guidance`, `improvement.workflow_quality`, `improvement.research_memory` |
 | `context-efficiency-contract` | Keeps workflows bounded through compact briefs, artifact references, context summaries, source snapshot IDs, targeted full-artifact reads, and `subagents context-audit` validation. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.workflow_quality`, `improvement.context_efficiency` |
 | `responsibility-boundary-contract` | Separates durable role identity, tool permissions, skill procedures, artifact contracts, and projection ownership so changes stay local. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.workflow_quality`, `improvement.skill_evolution` |
 | `tcx-source-gate` | Keeps external evidence read-only and source-aware. | `guardrail.guidance`, `improvement.workflow_quality` |
-| `external-mcp-proxy-gate` | Registers external MCP connections, imports metadata, classifies risk, manages lifecycle/review state, and blocks unsafe direct connection paths. | `guardrail.enforcement`, `guardrail.information_barrier` |
+| `codex-capability-inventory` | Lists sanitized native Codex MCP, skill, plugin, app, and hook metadata without managing or endorsing user-installed capabilities. | `guardrail.guidance`, `guardrail.information_barrier` |
 | `broker-center` | Acts as the local broker control plane for connector state, capability profiles, source drift, read-only account discovery, sync runs, mapping review, reconciliation, and service-gated execution. | `guardrail.enforcement`, `improvement.workflow_quality` |
 | `secret-wall` | Blocks raw broker secrets from workspace files, prompts, shell paths, and role context. | `guardrail.enforcement`, `guardrail.information_barrier` |
 | `policy-and-restricted-list` | Evaluates principals, capabilities, explicit deny rules, restricted symbols, and limits. | `guardrail.enforcement` |

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/docs/decision-memory.md

@@ -71,6 +71,16 @@ The source of truth is the existing file-native record:
 Existing events are not edited to make history look cleaner. Corrections,
 revisions, supersession, disputes, and retirement are new records.
 
+The rebuildable v2 artifact catalog provides a discovery projection across
+these file-native records without becoming Decision Memory itself. New
+type-specific service output projects with full canonical identity metadata;
+older files remain unchanged and may project as `legacy_partial`. Malformed
+records are quarantined as `invalid`. A point-in-time catalog query uses each
+type's explicit `knowledge_cutoff` or `known_at` field and excludes missing,
+malformed, or later values, so legacy discovery does not silently become
+historical provenance. The catalog can be discarded and recreated from source
+artifacts and verified forecast-ledger state.
+
 ### Time contract
 
 Decision Memory needs more than a document `updated_at`. Records should

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/docs/deployment.md

@@ -79,7 +79,6 @@ the backend listener private. Invalid remote settings fail before binding.
 - service autostart, `tcx service status`, compatibility checks, and `doctor`
   consume readiness rather than treating a reachable process as ready.
 - service logs rotate at 5 MiB with three backups by default.
-- external MCP stderr rotates separately at 1 MiB with two backups.
 - persisted logs redact known secrets, authorization values,
   credential-shaped fields, and URL user-info.
 
@@ -109,13 +108,20 @@ files are never replaced.
 
 ## Maintainer Prerequisites
 
-Release verification uses Python 3.11 and Node 22. The hosted CI budget runs
-the complete source, frontend, and package gates once on Python 3.11 instead
-of multiplying every push across the supported Python range and native
-platforms. Maintainers run additional supported-version or native-platform
-checks locally or through an explicit temporary/manual workflow when a change
-touches compatibility-sensitive code. Node is a maintainer-only build
-dependency.
+Release verification uses Python 3.11 and Node 22 for the complete source and
+frontend gates. After that single quality job builds the candidate
+distribution, the calculation-runtime matrix reuses the exact wheel on x86-64
+Linux, Intel macOS, and native Windows under Python 3.11, 3.12, 3.13, and 3.14.
+Each matrix job provisions the hash-locked runtime and exercises attach,
+doctor, direct package imports, exploratory compatibility, prepared recording,
+and exact reuse. Node remains a maintainer-only build dependency and is not
+installed by matrix workspaces.
+
+Calculation runtime changes are compatibility-sensitive even when the main
+source suite is unchanged. Before release, resolve and verify every hash-locked
+wheel for the complete 12-package `finance-*` runtime on supported Python
+3.11–3.14 macOS, Linux, and native Windows x86-64 targets. Missing wheels fail
+the target; release validation never permits a source build as fallback.
 
 Configure PyPI Trusted Publishing for:
 
@@ -157,6 +163,9 @@ The wheel smoke installs only the built wheel into a clean virtual environment,
 checks distribution metadata against the runtime version, attaches a workspace,
 validates native launchers and generated configuration, runs hooks and MCP
 stdio, exercises the local service, and loads the packaged SPA and assets.
+It also provisions the content-addressed calculation runtime, verifies its
+manifest/lock/launcher hashes and exact imports, and exercises prepared and
+exploratory `tcx-calc` modes without importing Django from the runner.
 The release-upgrade smoke starts from the published `1.0.2` package, updates
 that attached workspace with the built candidate wheel, and verifies preserved
 workspace and runtime identity, user-owned state, and explicit home, DB, and
@@ -172,11 +181,11 @@ also require the disposable-workspace and Codex-native checks documented in
 ## CI And Release Automation
 
 `.github/workflows/ci.yml` is test-only. One Ubuntu/Python 3.11 job runs the
-frontend build, complete Python suite and framework gates, clean package
-construction, the wheel smoke, and the prior-release update smoke. Guide-only
-pushes skip this workflow because
-the Pages workflow validates and deploys only static guide files. CI never
-publishes.
+frontend determinism check, complete Python suite, and framework gates. It does
+not construct or upload a wheel or source distribution, run release-upgrade or
+native-runtime matrices, or publish anything. Documentation-, guide-, OpenWiki-,
+and asset-only pushes or pull requests skip this workflow. Source-bearing pull
+requests and pushes still receive the normal source-quality checks.
 
 `.github/workflows/release.yml` is manual-only. Every run requires an explicit
 `release_version`. A dry run may build from any selected ref with
@@ -192,11 +201,13 @@ publishes.
 - the built wheel passes the Ubuntu wheel and prior-release update smokes
 - the protected `pypi` environment approves Trusted Publishing
 
-The release workflow has one build/verification job. When publication is
-requested, one protected PyPI job downloads that exact artifact and uploads it;
-no job rebuilds the distribution after verification. Native macOS and Windows
-release smokes are local or explicitly scheduled maintainer gates rather than
-automatic jobs on every release.
+The release workflow has one build/verification job followed by the required
+Python 3.11-3.14 Linux, Intel-macOS, and native-Windows calculation-runtime
+matrix. When publication is requested, one protected PyPI job downloads that
+exact artifact and uploads it; no job rebuilds the distribution after
+verification. These distribution and platform jobs run only after an explicit
+`Manual Release` dispatch, never because a branch, tag, development commit, or
+documentation change was pushed.
 
 ## User Guide Pages
 
@@ -207,10 +218,11 @@ prompts, workspace viewing, reusable skills, and everyday recovery. The detailed
 product rules remain canonical in `README.md`, `installation.md`, and `docs/`;
 the guide links back to those sources rather than replacing them.
 
-`.github/workflows/deploy-user-guide.yml` uses one job to configure, upload,
-and deploy only `guidebook/` to GitHub Pages after a push to `main` that changes
-the guide or its workflow. It can also be run manually. It does not build or
-deploy the Python package, the Django service, or a production Node runtime.
+`.github/workflows/deploy-user-guide.yml` is manual-only. An explicit workflow
+dispatch uses one job to configure, upload, and deploy only `guidebook/` to
+GitHub Pages. A normal branch push or documentation-only change neither deploys
+Pages nor builds or deploys the Python package, Django service, or a production
+Node runtime.
 
 GitHub Pages is configured to use **GitHub Actions** as its publishing source.
 The guide for this repository is published at
@@ -271,7 +283,7 @@ sh "$SOURCE_ROOT/install.sh" \
 On native Windows PowerShell:
 
 ```powershell
-$ReleaseVersion = "1.1.0"
+$ReleaseVersion = "1.1.2"
 $Workspace = Join-Path $env:TEMP "tcx-pypi-$ReleaseVersion"
 New-Item -ItemType Directory -Force $Workspace | Out-Null
 Set-Location $Workspace

{tradingcodex-1.1.0 → tradingcodex-1.1.2}/docs/execution-without-subagent-plan.md

@@ -60,7 +60,7 @@ design, migration, and validation evidence.
 - Provider canary regressions prove that submit/cancel results, health details,
   account-sync exceptions, and successful account display metadata do not
   reappear in DB rows, API/MCP projections, execution results, or audit events.
-- A disposable generated workspace reports nine fixed roles and 32 skills,
+- A disposable generated workspace reports nine fixed roles and 33 skills,
   contains no retired execution role, and exposes no ungated submit, cancel, or
   broker status-refresh mutation. Its one execution-risk MCP tool is
   `use_order_turn_grant`, which has no authority without hook-injected proof.
@@ -257,7 +257,7 @@ normal analysis context:
    canonical ids. If this audit is unavailable, fail closed before service
    invocation.
 4. Call the execution gateway synchronously and in-process. Do not launch a
-   shell, subprocess, external MCP proxy, or Head Manager tool call.
+   shell, subprocess, user-installed capability, or Head Manager tool call.
 5. Emit only an allowlisted result projection as `UserPromptSubmit` additional
    context with marker `tradingcodex-native-execution-result`.
 6. Instruct Head Manager to report the recorded result without spawning roles,