tradingcodex 1.1.1__tar.gz → 1.1.2__tar.gz

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/CHANGELOG.md

@@ -2,6 +2,86 @@
 
 ## Unreleased
 
+## 1.1.2 - 2026-07-17
+
+- Add a cross-platform fixed-role calculation surface with generated
+  `tcx-calc`/`tcx-calc.cmd` launchers and a content-addressed runtime v2 outside
+  Django, MCP, the service home, DB, workspace, and scratch. Its wheel-only
+  per-artifact hash resource pins the complete 12-package direct/transitive
+  set around NumPy, pandas, SciPy, statsmodels, numpy-financial, and PyArrow.
+  The exact basename-only contract replaces host-dependent system
+  Python and heredocs, sanitizes environment and temp state before exposing the
+  verified runtime, rejects links and compound forms, applies resource bounds,
+  blocks child-process and network escape paths in prepared mode, verifies the
+  generated launcher hashes in doctor, and remains inside the native Codex OS
+  sandbox. Windows scratch now uses `TradingCodexScratch` so it cannot overlap
+  the default service home. Native Windows release smoke invokes both generated
+  batch launchers through tokenized `cmd /c call` commands so workspace paths
+  containing spaces retain their argument boundaries. Pinned packages may load
+  native libraries only from absolute paths inside the verified runtime and
+  only from an imported runtime-package frame; their process-local ctypes
+  bootstrap remains available, including CPython's exact Windows `kernel32`
+  import bootstrap. Scratch calls and external, other bare-name, or raw-integer-
+  handle loading remain denied. The explicit manual
+  release workflow gates the exact wheel through an x86-64 Linux/macOS/Windows
+  and Python 3.11-3.14 runtime matrix.
+- Separate ordinary GitHub uploads from deployment work. Normal source CI keeps
+  source, framework, and deterministic frontend checks but does not build or
+  upload distributions, run release-upgrade or platform matrices, or publish.
+  Documentation-only pushes and pull requests skip source CI, GitHub Pages
+  becomes manual-only, and package build/publication remains confined to
+  explicit Manual Release dispatches.
+- Add immutable Dataset memory with Source Snapshot lineage, explicit typed
+  manifests, content-addressed canonical Parquet payloads, append-only license
+  withdrawals, bounded card/manifest/profile/slice retrieval, and a managed
+  Git ignore rule for payload objects. A rebuildable SQLite+FTS v3 catalog now
+  unifies existing research artifacts with Dataset and Calculation objects,
+  reprojects only changed files, rebuilds after corruption, and continues the
+  legacy JSON exports for one compatibility release. Lineage timestamps cannot
+  predate their Source Snapshot or parent Dataset, withdrawn shared payloads
+  cannot be profiled, malformed manifests fail closed per object, and L0 cards
+  are size-bounded. Internally generated `Path` objects are normalized to the
+  portable forward-slash workspace form on native Windows while caller-supplied
+  backslash paths remain rejected.
+- Add prepared CalculationSpec/Run memory around `tcx-calc`, including declared
+  scratch inputs/outputs, typed finite result envelopes, exact full-fingerprint
+  reuse with a current-workflow reuse Run, comparison by requested metric, and
+  private-ledger snapshot hash binding without durable input values. The new
+  shared `tcx-calculation` skill gives the six financial calculation roles the
+  bounded procedure; Head Manager receives card-only planning discovery and
+  the viewer remains read-only. Calculation cards also project bounded symbols
+  and immutable Dataset relations so instrument-scoped role searches do not
+  miss an existing exact calculation. Prepared recording independently
+  revalidates script/input/sidecar/runtime/output hashes and schemas; Dataset
+  materializations and private central-ledger snapshots are service-bound
+  rather than caller-asserted.
+- Route legacy Source Snapshot, ResearchSpec, ReplayManifest, and ExperimentRun
+  path construction, regular-file reads, hash verification, and immutable
+  writes through the shared Research Object primitives while preserving their
+  released v1 hash encoding and IDs without migration.
+- Enable Head Manager live web search for narrow workflow-planning
+  reconnaissance. Durable root instructions and `tcx-workflow` keep raw search
+  results untrusted and prohibit using them as accepted evidence or synthesis
+  support; material facts must be reacquired by producing roles. Portfolio,
+  risk, and judgment-review roles explicitly keep web search disabled, and the
+  existing Build hook continues to block native web and browser tools.
+- Fix BYOR Codex capability use after the 1.1.1 gate removal. Head Manager and
+  fixed roles now distinguish explicit external skill overlays from read-only
+  app, connector, MCP, and data tools; inspect the current task's callable
+  surface before falling back or declaring a provider unavailable; and treat
+  the sanitized inventory as configuration evidence rather than runtime
+  callability proof. Capability inventory now names plugin app/MCP/hook
+  components from secret-free top-level identifiers and includes compatible
+  user skills discovered below `CODEX_HOME/skills`. Generated workspaces no
+  longer disable Codex apps, leaving app exposure to user, organization, and
+  host policy.
+- Align observed E2E behavior with the workspace contract: fixed roles may edit
+  files in their dedicated private scratch root while arbitrary external paths
+  remain blocked; viewer write-shaped requests consistently return GET-only
+  `405` responses even with CSRF enforcement; managed Brain and Strategy proof
+  errors name their own entrypoints; and E2E hooks execute through the generated
+  launcher runtime.
+
 ## 1.1.1 - 2026-07-16
 
 - Remove the legacy user-capability gate, its CLI and broker-import paths,

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/MANIFEST.in

@@ -11,5 +11,7 @@ recursive-include frontend *.css *.html *.json *.js *.ts *.tsx
 recursive-include workspace_templates *
 recursive-include workspace_templates .*
 recursive-include tradingcodex_service/static *
+include tradingcodex_cli/calculation-runtime-lock.json
+include tradingcodex_cli/calculation-runtime-requirements.txt
 recursive-exclude frontend/node_modules *
 global-exclude *.py[cod]

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tradingcodex
-Version: 1.1.1
+Version: 1.1.2
 Summary: Local-first investment operating system for Codex-native research and service-gated execution.
 Author: TradingCodex Authors
 License-Expression: Apache-2.0
@@ -29,13 +29,18 @@ Requires-Dist: markdown-it-py<5,>=3
 Requires-Dist: nh3<0.4,>=0.3
 Requires-Dist: packaging>=24
 Requires-Dist: pydantic>=2
+Requires-Dist: pyarrow==25.0.0
 Requires-Dist: PyYAML>=6
 Requires-Dist: whitenoise<7,>=6.12
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Dynamic: license-file
 
-# TradingCodex
+<h1 align="center">TradingCodex</h1>
+
+<p align="center">
+  <img src="assets/tradingcodex-banner-v3.png" alt="TradingCodex transforms fragmented investment tools into a native Codex research workflow" width="100%">
+</p>
 
 <div align="center">
   <a href="https://pypi.org/project/tradingcodex/"><img alt="PyPI" src="https://img.shields.io/pypi/v/tradingcodex?label=PyPI"></a>

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/README.md

@@ -1,4 +1,8 @@
-# TradingCodex
+<h1 align="center">TradingCodex</h1>
+
+<p align="center">
+  <img src="assets/tradingcodex-banner-v3.png" alt="TradingCodex transforms fragmented investment tools into a native Codex research workflow" width="100%">
+</p>
 
 <div align="center">
   <a href="https://pypi.org/project/tradingcodex/"><img alt="PyPI" src="https://img.shields.io/pypi/v/tradingcodex?label=PyPI"></a>

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/docs/components.md

@@ -61,6 +61,7 @@ clear.
 | `fixed-role-dispatch` | Maintains head-manager, fixed subagent routing, and no-overlap handoff boundaries in native Codex. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.workflow_quality` |
 | `versioned-workspace` | Keeps generated workspaces in user-owned Git worktrees with privacy-first ignores and no automatic stage, commit, remote, or publication. | `guardrail.guidance`, `guardrail.information_barrier`, `improvement.validation_feedback` |
 | `research-memory` | Stores source-aware research artifacts, versions, snapshots, Evidence Run Cards, Validation Cards, and rebuildable research/cross-artifact search projections. | `improvement.research_memory` |
+| `dataset-calculation-memory` | Stores immutable Dataset manifests/content-addressed Parquet payloads and conclusion-relevant CalculationSpec/Run records, projects them into the rebuildable SQLite+FTS v3 catalog, and reuses only exact successful fingerprints through the wheel-locked finance runtime v2. | `guardrail.information_barrier`, `improvement.research_memory`, `improvement.context_efficiency`, `improvement.validation_feedback` |
 | `workflow-quality-gates` | Defines artifact quality, Decision Quality Spine, agent judgment review, claim discipline, and synthesis lineage without a Django workflow loop. | `guardrail.guidance`, `improvement.workflow_quality` |
 | `decision-package` | Freezes run provenance, artifact paths, forecasts, investor-context gaps, and outcomes in Codex-readable workspace records. | `guardrail.guidance`, `improvement.workflow_quality`, `improvement.research_memory` |
 | `artifact-quality-contract` | Evaluates workspace artifacts, Evidence Run Cards, Validation Cards, source snapshots, and forecast ledgers for source/as-of posture, source trust, data-boundary warnings, claim tags, handoff state, confidence, missing evidence, judgment-review fields, and next-recipient routing metadata. | `guardrail.guidance`, `improvement.workflow_quality`, `improvement.research_memory` |

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/docs/deployment.md

@@ -108,13 +108,20 @@ files are never replaced.
 
 ## Maintainer Prerequisites
 
-Release verification uses Python 3.11 and Node 22. The hosted CI budget runs
-the complete source, frontend, and package gates once on Python 3.11 instead
-of multiplying every push across the supported Python range and native
-platforms. Maintainers run additional supported-version or native-platform
-checks locally or through an explicit temporary/manual workflow when a change
-touches compatibility-sensitive code. Node is a maintainer-only build
-dependency.
+Release verification uses Python 3.11 and Node 22 for the complete source and
+frontend gates. After that single quality job builds the candidate
+distribution, the calculation-runtime matrix reuses the exact wheel on x86-64
+Linux, Intel macOS, and native Windows under Python 3.11, 3.12, 3.13, and 3.14.
+Each matrix job provisions the hash-locked runtime and exercises attach,
+doctor, direct package imports, exploratory compatibility, prepared recording,
+and exact reuse. Node remains a maintainer-only build dependency and is not
+installed by matrix workspaces.
+
+Calculation runtime changes are compatibility-sensitive even when the main
+source suite is unchanged. Before release, resolve and verify every hash-locked
+wheel for the complete 12-package `finance-*` runtime on supported Python
+3.11–3.14 macOS, Linux, and native Windows x86-64 targets. Missing wheels fail
+the target; release validation never permits a source build as fallback.
 
 Configure PyPI Trusted Publishing for:
 
@@ -156,6 +163,9 @@ The wheel smoke installs only the built wheel into a clean virtual environment,
 checks distribution metadata against the runtime version, attaches a workspace,
 validates native launchers and generated configuration, runs hooks and MCP
 stdio, exercises the local service, and loads the packaged SPA and assets.
+It also provisions the content-addressed calculation runtime, verifies its
+manifest/lock/launcher hashes and exact imports, and exercises prepared and
+exploratory `tcx-calc` modes without importing Django from the runner.
 The release-upgrade smoke starts from the published `1.0.2` package, updates
 that attached workspace with the built candidate wheel, and verifies preserved
 workspace and runtime identity, user-owned state, and explicit home, DB, and
@@ -171,11 +181,11 @@ also require the disposable-workspace and Codex-native checks documented in
 ## CI And Release Automation
 
 `.github/workflows/ci.yml` is test-only. One Ubuntu/Python 3.11 job runs the
-frontend build, complete Python suite and framework gates, clean package
-construction, the wheel smoke, and the prior-release update smoke. Guide-only
-pushes skip this workflow because
-the Pages workflow validates and deploys only static guide files. CI never
-publishes.
+frontend determinism check, complete Python suite, and framework gates. It does
+not construct or upload a wheel or source distribution, run release-upgrade or
+native-runtime matrices, or publish anything. Documentation-, guide-, OpenWiki-,
+and asset-only pushes or pull requests skip this workflow. Source-bearing pull
+requests and pushes still receive the normal source-quality checks.
 
 `.github/workflows/release.yml` is manual-only. Every run requires an explicit
 `release_version`. A dry run may build from any selected ref with
@@ -191,11 +201,13 @@ publishes.
 - the built wheel passes the Ubuntu wheel and prior-release update smokes
 - the protected `pypi` environment approves Trusted Publishing
 
-The release workflow has one build/verification job. When publication is
-requested, one protected PyPI job downloads that exact artifact and uploads it;
-no job rebuilds the distribution after verification. Native macOS and Windows
-release smokes are local or explicitly scheduled maintainer gates rather than
-automatic jobs on every release.
+The release workflow has one build/verification job followed by the required
+Python 3.11-3.14 Linux, Intel-macOS, and native-Windows calculation-runtime
+matrix. When publication is requested, one protected PyPI job downloads that
+exact artifact and uploads it; no job rebuilds the distribution after
+verification. These distribution and platform jobs run only after an explicit
+`Manual Release` dispatch, never because a branch, tag, development commit, or
+documentation change was pushed.
 
 ## User Guide Pages
 
@@ -206,10 +218,11 @@ prompts, workspace viewing, reusable skills, and everyday recovery. The detailed
 product rules remain canonical in `README.md`, `installation.md`, and `docs/`;
 the guide links back to those sources rather than replacing them.
 
-`.github/workflows/deploy-user-guide.yml` uses one job to configure, upload,
-and deploy only `guidebook/` to GitHub Pages after a push to `main` that changes
-the guide or its workflow. It can also be run manually. It does not build or
-deploy the Python package, the Django service, or a production Node runtime.
+`.github/workflows/deploy-user-guide.yml` is manual-only. An explicit workflow
+dispatch uses one job to configure, upload, and deploy only `guidebook/` to
+GitHub Pages. A normal branch push or documentation-only change neither deploys
+Pages nor builds or deploys the Python package, Django service, or a production
+Node runtime.
 
 GitHub Pages is configured to use **GitHub Actions** as its publishing source.
 The guide for this repository is published at
@@ -270,7 +283,7 @@ sh "$SOURCE_ROOT/install.sh" \
 On native Windows PowerShell:
 
 ```powershell
-$ReleaseVersion = "1.1.1"
+$ReleaseVersion = "1.1.2"
 $Workspace = Join-Path $env:TEMP "tcx-pypi-$ReleaseVersion"
 New-Item -ItemType Directory -Force $Workspace | Out-Null
 Set-Location $Workspace

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/docs/execution-without-subagent-plan.md

@@ -60,7 +60,7 @@ design, migration, and validation evidence.
 - Provider canary regressions prove that submit/cancel results, health details,
   account-sync exceptions, and successful account display metadata do not
   reappear in DB rows, API/MCP projections, execution results, or audit events.
-- A disposable generated workspace reports nine fixed roles and 32 skills,
+- A disposable generated workspace reports nine fixed roles and 33 skills,
   contains no retired execution role, and exposes no ungated submit, cancel, or
   broker status-refresh mutation. Its one execution-risk MCP tool is
   `use_order_turn_grant`, which has no authority without hook-injected proof.

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/docs/generated-workspaces.md

@@ -23,7 +23,9 @@ The template source tree may be refactored for maintainability, but generated
 output paths are the v1 release contract. Module ids, module dependency
 resolution, and rendered paths such as `.codex/config.toml`, `.agents/skills/*`,
 `.tradingcodex/*`, `trading/*`, and `./tcx` must remain stable unless docs and
-tests intentionally change the generated workspace contract.
+tests intentionally change the generated workspace contract. The generated
+`tcx-calc` and `tcx-calc.cmd` names are likewise stable; the cache key behind
+them is content-addressed and may change when the locked runtime changes.
 
 Template bodies should remain ordinary source files under
 `workspace_templates/modules/*/files` whenever the generated artifact is meant
@@ -43,6 +45,7 @@ The generated workspace is ready for:
 - `./tcx investor-context status`
 - MCP ledger inspection
 - research-memory commands
+- prepared and exploratory `tcx-calc` workflows
 - local React viewer/Admin service access
 - Codex-native role prompts and skills
 
@@ -159,8 +162,9 @@ The managed `.gitignore` block excludes local/private state by default:
 - process, session, and service-status state, including
   `.tradingcodex/mainagent/session-start.json`;
 - transient audit streams;
-- Python/tool caches, rebuildable research and artifact-catalog indexes, and
-  native lock files;
+- Python/tool caches, rebuildable research and artifact-catalog indexes,
+  content-addressed Dataset payloads under
+  `trading/research/datasets/objects/`, and native lock files;
 - raw secrets, credentials, local environment files, keys, and certificates;
   and
 - the private workspace Investor Context plus its per-run sealed snapshot.
@@ -256,21 +260,25 @@ Generated workspaces contain:
   `agents` tool namespace; every task uses a fresh custom role, a compact
   assignment envelope, and `fork_turns="none"`; `followup_task` and generic
   role emulation are forbidden
-- role-scoped web search: root `.codex/config.toml` sets
-  `web_search="disabled"`; only the fundamental, technical, news, macro,
-  instrument, and valuation custom-agent TOML files override it with
-  `web_search="live"`. Codex applies the spawned custom-agent config to that
-  child, so evidence collection stays in producing roles while Head Manager and
-  downstream portfolio/risk/judgment roles remain unable to
-  pre-research through live web search
+- role-scoped web search: root `.codex/config.toml` sets `web_search="live"`
+  so Head Manager can perform narrow planning reconnaissance before choosing or
+  revising the team. Those results are untrusted planning leads, never accepted
+  investment evidence, and every material fact must be reacquired by a producing
+  role through an authenticated run-local artifact. The six evidence-producing
+  custom agents also use live search; portfolio, risk, and judgment-review TOML
+  files explicitly set `web_search="disabled"`
 - fail-closed spawn hook: `PreToolUse` permits `spawn_agent` only for an exact
   registered `agent_type`, `fork_turns="none"`, an underscore-only task name,
   and a valid lightweight analysis run id in the compact message; no semantic
   plan or server task is consulted
 - native Research permission runtime: `head-manager` and every fixed role
-  inherit `trading-research`; ordinary shell/Python and credential-free public
-  HTTP are available, user-owned paths outside `trading/` are readable and
-  writable, and disposable intermediates stay under `$TRADINGCODEX_SCRATCH`.
+  inherit `trading-research`; ordinary shell and credential-free public HTTP
+  are available, user-owned paths outside `trading/` are readable and writable,
+  and disposable intermediates stay under `$TRADINGCODEX_SCRATCH`. Fixed roles
+  stage one direct scratch-local `.py` file with native `apply_patch` and run it
+  only through `./tcx-calc <filename.py>` or native Windows
+  `.\tcx-calc.cmd <filename.py>`; system Python, heredocs, `-c`, `-m`, paths,
+  and extra arguments are outside that contract.
   The `trading/` tree, control files, TradingCodex runtime/DB, protected
   artifacts, credentials, local/private destinations, and Unix sockets remain
   protected. Durable workflow, role-report, and synthesis writes go through
@@ -385,12 +393,13 @@ Generated workspaces contain:
 - project-local additional agent instructions under `.tradingcodex/agent-instructions/<role>.md`; projection appends them after generated default instructions for `head-manager` and fixed subagents as a managed overlay, without permitting them to replace core role, quality, policy, approval, or execution boundaries
 - an immutable core/extension footer projected after project-local additional
   instructions for both `head-manager` and fixed roles
-- disabled root web search in `.codex/config.toml` plus live web search only in
-  the six evidence-producing custom-agent TOML files; this preserves a pristine
-  public-source baseline without letting Head Manager research around the
-  dispatch gate, and source/as-of and evidence rules still apply
+- planning-only root live web search in `.codex/config.toml`, with durable Head
+  Manager and `tcx-workflow` instructions that prohibit using reconnaissance to
+  answer the mandate or support synthesis claims. Live evidence search remains
+  enabled for the six producing roles, while portfolio, risk, and judgment
+  review explicitly disable it
 - workspace customization preferences under `.tradingcodex/user/customization.json`, merged over `preferences/customization.json` in the canonical platform home; these files store UX/config metadata and never raw credentials
-- thirty-one bundled repo skills across project-scope mainagent skills and
+- thirty-three bundled repo skills across project-scope mainagent skills and
   subagent skill directories, each with `SKILL.md` frontmatter for document
   metadata and UI metadata when projected
 - one compact bundled namespace: every core skill id is `tcx-` plus one suffix
@@ -474,9 +483,10 @@ Generated workspaces contain:
   copies are not generated
 - append-only forecast ledger directory at `trading/forecasts/`
 - immutable point-in-time research directories for specs, replay manifests,
-  experiments, causal analyses, blind judgment priors/reviews, and a
-  rebuildable research and cross-artifact catalog indexes under
-  `trading/research/`
+  experiments, causal analyses, blind judgment priors/reviews, Dataset
+  manifests/payloads/withdrawals, Calculation specs/runs, and the rebuildable
+  SQLite+FTS v3 research-object catalog plus temporary legacy JSON exports
+  under `trading/research/`
 - research-only model-evaluation directories under `trading/evaluations/` for
   frozen corpora, control/candidate runs, blind reviews, and comparisons
 
@@ -490,6 +500,19 @@ baseline and must enter a workflow only through explicit user opt-in for that
 current workflow or a managed activation path that preserves role, quality,
 policy, approval, and execution boundaries.
 
+That explicit overlay rule applies to external skill procedures, not to
+read-only app, connector, MCP, or data tools used as evidence. A role whose
+assignment needs external data or preserves a user-named provider first checks
+the current task's callable tool surface and uses the runtime's available
+deferred-tool discovery surface when needed. It attempts the narrowest
+relevant read-only call before a public web fallback. Sanitized capability
+inventory is configuration evidence only:
+installed/enabled state neither proves nor disproves that a tool was loaded
+into the current task. A capability added or changed after task start may
+require a new task or full Codex restart. Generated workspace configuration
+does not override Codex's `features.apps` setting; user, organization, and
+host policy continue to decide whether installed apps are exposed.
+
 Workspace projection and role-local skill lists reduce accidental mixing, but
 they are not by themselves proof of hard runtime isolation from every
 host-discoverable skill. Documentation and release claims must not promise hard
@@ -550,6 +573,10 @@ configuration. TradingCodex preserves their non-reserved project entries and
 directories during update, and Codex exposes them to root and fixed-role agents
 through normal configuration inheritance. TradingCodex owns only its reserved
 entries and does not install, review, classify, or recommend user capabilities.
+The read-only inventory covers canonical repository and user `.agents/skills`
+locations plus compatible direct skills below `CODEX_HOME/skills`; plugin
+component records use only top-level app, MCP-server, and hook identifiers and
+never return component bodies or launch settings.
 
 ## Attach-First UX
 
@@ -635,6 +662,45 @@ through the native Windows batch shim. On update it prefers
 run `.\tcx.cmd` in PowerShell; native Windows validation never treats the Bash
 shim as executable evidence.
 
+Calculation does not reuse that launcher or its package-bearing interpreter.
+Attach/update provisions one `finance-*` calculation runtime v2 in a separate,
+content-addressed platform cache and renders `tcx-calc` plus `tcx-calc.cmd`.
+The wheel-only, per-artifact hash resource pins the complete 12-package direct
+and transitive runtime around
+`numpy==2.3.5`, `pandas==2.3.3`, `scipy==1.16.3`,
+`statsmodels==0.14.6`, `numpy-financial==1.0.0`, and
+`pyarrow==25.0.0`; source builds and agent-initiated `pip`/`uv` installation
+are forbidden. A platform without a locked Python 3.11–3.14 wheel fails attach
+clearly instead of compiling a dependency.
+
+The launcher accepts one basename-only script already staged in the exact
+workspace scratch, sanitizes environment first, starts Python with `-I -B -S`,
+and then adds only the verified runtime site-packages path. It clears
+service/DB/credential environment variables, maps home and temp to scratch,
+bounds CPU, wall time, file count, file size, and normal text output, and
+rejects links and oversized source. It never imports or starts Django, MCP, the
+service, or the ledger. The runner also denies process creation and replacement,
+shell/system execution, sockets and network access, package bootstrap, and
+dangerous dynamic-library loading. A pinned package may bootstrap a native
+library only when the initiating imported package frame is inside the verified
+content-addressed runtime; a named target must also be an absolute file inside
+that runtime. The same trusted bootstrap may initialize its process-local
+ctypes handle. On Windows, importing ctypes itself requires CPython's exact
+`kernel32` bootstrap name, which is the only trusted bare system-library
+exception. Scratch code, other bare or system-library names, raw integer handles,
+and paths outside that runtime remain denied. This is a constrained calculation
+surface inside the existing Codex OS sandbox, not a new Python security sandbox
+or a Django-owned Python environment.
+
+Without a service-authored sidecar, `tcx-calc` is exploratory compatibility
+mode and cannot support an accepted research conclusion. Prepared mode binds
+the script, declared input/output basenames, runtime lock, typed result schema,
+cutoff, and CalculationSpec fingerprint. The runner permits only declared
+scratch input/output plus runtime, stdlib, and required system-library reads,
+and writes a bounded success or failure envelope for
+`record_calculation_run`. `tcx doctor` verifies the launcher hash, runtime
+manifest and lock hashes, exact package versions, and imports.
+
 The POSIX shim resolves its canonical workspace root but does not `cd` back to
 the same absolute path when it is already running there. This keeps the normal
 workspace-root contract while avoiding a redundant path re-entry that native
@@ -705,9 +771,11 @@ discovered locator into provenance. Ordinary PyPI
 
 Inside a generated workspace, normal `head-manager` and fixed-role analysis
 threads inherit the `trading-research` permission profile. They can use normal
-shell, Python, data tools, and credential-free public HTTP, read ordinary
+shell, data tools, and credential-free public HTTP, read ordinary
 workspace inputs, and write user-owned files outside `trading/`; disposable
-intermediates belong under `$TRADINGCODEX_SCRATCH`. They cannot modify
+intermediates belong under `$TRADINGCODEX_SCRATCH`. Fixed-role Python
+calculations use only the generated scratch-local `tcx-calc` contract. They
+cannot modify
 `trading/`, generated control files, or the TradingCodex home, DB, attached
 runtime, protected artifact paths, credential files, local/private
 destinations, or Unix sockets. Authenticated service/MCP tools own durable
@@ -764,8 +832,12 @@ cache-backed path is writable as `$TRADINGCODEX_SCRATCH` and is projected as
 `TMPDIR`/`TEMP`/`TMP`; the broader temp roots are denied. The scratch root lives
 under the platform cache tree (`~/Library/Caches/TradingCodex` on macOS,
 `$XDG_CACHE_HOME/tradingcodex` or `~/.cache/tradingcodex` on Linux, and
-`%LOCALAPPDATA%\TradingCodex` on Windows), not inside the workspace and not in
+`%LOCALAPPDATA%\TradingCodexScratch` on Windows), not inside the workspace and not in
 the broad OS temporary tree.
+The calculation runtime uses a separate sibling cache
+(`TradingCodexCalculation`/`tradingcodex-calculation`) and is explicitly
+read-only in Research and denied in Build. Neither cache overlaps the service
+home, DB, workspace, Codex home, or the other cache.
 Credential-bearing home paths such as Codex auth state, SSH/cloud/CLI config,
 keyrings, credential files, and shell histories are explicitly denied. The
 narrow read-only `~/.codex/packages/standalone` exception permits the installed
@@ -804,12 +876,12 @@ blocked. Its limited-public
 network permits credential-free HTTP(S) GET/HEAD and public HTTPS Git retrieval
 while blocking authenticated requests, bodies/uploads, local/private targets,
 non-HTTP(S) transports, package installation, fetch-to-execute pipelines,
-remote mutation, and broker access. Native `web_search` remains disabled.
-The generated `PreToolUse` matcher covers every tool name, then policy remains
-a no-op for ordinary Research tools while an active Build grant rejects native
-browser, web, HTTP, fetch, and navigation tools,
-so retrieval cannot reuse authenticated browser state; Research browser
-behavior is unchanged.
+remote mutation, and broker access. Root `web_search="live"` supports only
+Research workflow planning; the generated `PreToolUse` matcher covers every
+tool name, and an active Build grant rejects native web search, browser, web,
+HTTP, fetch, and navigation tools, so retrieval cannot reuse authenticated
+browser state. Policy otherwise remains a no-op for ordinary Research tools;
+Research browser behavior is unchanged.
 The Build profile uses the proxy's full HTTP transport mode because Git Smart
 HTTP needs a small POST exchange even for read-only clone/fetch/ls-remote.
 That does not open general POST access: the Build hook admits only public
@@ -902,13 +974,20 @@ generated bindings are refreshed.
 
 TradingCodex owns only the `tradingcodex` MCP entry in project config. Other
 MCP, plugin, and skill entries are user-owned Codex configuration and survive
-update. Root web search stays disabled. The six evidence-producing custom agents may use
-their role-local live web override and available native Codex capabilities to gather public
-filings, disclosures, news, web sources, and market-data references while the
-filesystem remains read-only. TradingCodex does not classify or block those
-user-installed capabilities. Codex sandbox, approval, and organization
+update. Root live web search is limited by durable instructions to
+planning-only reconnaissance; raw results cannot support accepted evidence or
+synthesis claims. The six evidence-producing custom agents may use their
+role-local live web setting and available native Codex capabilities to gather
+public filings, disclosures, news, web sources, and market-data references
+while the filesystem remains read-only. TradingCodex does not classify or
+block those user-installed capabilities. Codex sandbox, approval, and organization
 requirements still apply, while TradingCodex service policy continues to protect
 its own principals, grants, order proofs, protected state, and execution path.
+Current-task callable tools, not the System inventory or the TradingCodex MCP
+allowlist alone, determine whether an external data call can be made. Agents
+must try the narrow read-only tool before reporting a capability or data field
+unavailable and must state separately whether configuration was discovered and
+whether the current task exposed or successfully called the tool.
 Broker APIs are attached through provider-driven TradingCodex connector profiles
 using canonical MCP tools such as `list_broker_adapter_providers`,
 `render_broker_connector_scaffold`, `register_broker_connector`,
@@ -1412,6 +1491,10 @@ or broker tools.
 Codex-native bootstrap verification:
 
 - `./tcx doctor` checks generated project MCP server shape and role allowlists.
+- `./tcx doctor` also checks the calculation launcher hash, `finance-*` runtime
+  v2 manifest and lock hashes, all 12 exact package versions/imports, and emits
+  a warning rather than disabling structured catalog search when SQLite lacks
+  FTS5.
 - `./tcx update --no-doctor` verifies the generated update path without running
   the full doctor twice in installer smoke tests.
 - `./tcx mcp stdio` `tools/list` verifies the TradingCodex MCP bridge and tool annotations.

{tradingcodex-1.1.1 → tradingcodex-1.1.2}/docs/harness.md

@@ -23,13 +23,25 @@ Head Manager uses `gpt-5.6-sol` with `xhigh` reasoning. Analytical fixed roles
 use `gpt-5.6-terra` with `high` reasoning. Final provider effects are not a role
 and run through the deterministic service gateway rather than an execution
 model. All analysis sessions inherit the project-wide `trading-research`
-permission profile: ordinary shell/Python and credential-free public HTTP are
+permission profile: ordinary shell and credential-free public HTTP are
 available, and user-owned files outside `trading/` are readable and writable.
-Disposable intermediates stay under `$TRADINGCODEX_SCRATCH`; `trading/`,
+For deterministic Python calculations, a fixed role stages one direct `.py`
+file under `$TRADINGCODEX_SCRATCH` with `apply_patch` and invokes only the
+platform-native `tcx-calc` launcher. Its content-addressed runtime v2 contains
+only the wheel-locked NumPy, pandas, SciPy, statsmodels, numpy-financial, and
+PyArrow stack and remains separate from Django, MCP, the service runtime, and
+the DB; the Codex OS sandbox remains the authority boundary. Conclusion-
+relevant work uses the prepared CalculationSpec/Run flow, while a direct run
+without its service-authored sidecar is exploratory only. Disposable
+intermediates stay under
+`$TRADINGCODEX_SCRATCH`; `trading/`,
 generated control files, TradingCodex runtime/DB, protected artifacts,
 credentials, local/private network targets, and Unix sockets remain protected.
-Evidence roles receive live web search through their role config; Head Manager
-does not.
+Head Manager receives live web search only for narrow workflow-planning
+reconnaissance. Its raw results are untrusted planning leads and cannot support
+synthesis claims; material facts must be reacquired through producing-role
+artifacts. The six evidence roles retain live search, while portfolio, risk,
+and judgment review explicitly disable it.
 
 MultiAgent V2 must expose exact `agent_type`. Every TradingCodex spawn uses a
 fresh child, compact underscore-only task name, compact assignment, and
@@ -38,6 +50,25 @@ role emulation, and model overrides are invalid. Generated config explicitly
 enables V2 and uses its session-wide concurrency setting; the incompatible V1
 `agents.max_threads` key is not projected.
 
+External skills and external data tools have different runtime semantics.
+Host-global or plugin skills remain explicit current-workflow overlays, while
+read-only app, connector, MCP, and data tools may supply evidence when the task
+requires them. Head Manager preserves a user-named provider in the role brief;
+root and evidence roles inspect the current task's callable surface, use the
+runtime's available deferred-tool discovery surface when needed, and attempt
+the smallest relevant read-only call before public-web fallback. The sanitized System inventory reports
+discovered configuration, not current-task callability.
+
+Reusable tabular evidence and calculations remain file-native research
+objects. A Source Snapshot can be promoted to an immutable Dataset manifest
+plus content-addressed Parquet payload when its rows will be reused. Agents
+search cards first, inspect manifest/profile metadata next, and materialize a
+typed scratch slice only when a role needs rows. Exact successful calculation
+fingerprints may be reused, but every reuse creates a current-run record and
+retains the original Run lineage. Head Manager receives discovery cards only;
+the six calculation roles receive the bounded write/execution groups, and the
+viewer remains read-only.
+
 ## Hooks
 
 Hooks own only:
@@ -214,8 +245,11 @@ After harness changes:
    modes, binding/revocation/proof injection, subagent/direct-MCP
    rejection, ordinary analysis transport behavior, and exact V2 dispatch;
 5. run a real Korean request and inspect parent/child JSONL, role model, sandbox, and artifacts;
-6. verify viewer workspace selection and sanitized artifact/skill detail;
-7. run focused pytest, Django check, compile, and the full suite.
+6. with a user-enabled read-only test plugin or MCP, verify current-task tool
+   discovery and one narrow successful call, then verify the same prompt reports
+   a distinct loading gap when the tool is intentionally absent;
+7. verify viewer workspace selection and sanitized artifact/skill detail;
+8. run focused pytest, Django check, compile, and the full suite.
 
 See [Codex-Native Orchestration](codex-native-orchestration.md),
 [Roles, Skills, And Workflows](roles-skills-and-workflows.md), and