Deadlatch v0.1.2

Deadlatch 0.1.2

Deadlatch is a local-first, advisory-only pre-trade risk check and audit component.
It never places orders; the caller is responsible for invoking it and stopping on
BLOCK or errors. Publication does not demonstrate live-account effectiveness,
external adoption, paid adoption, or real would-block observations.

Install and MCP

pip install deadlatch==0.1.2
uvx --from deadlatch==0.1.2 deadlatch-mcp --policy policy.yaml --portfolio portfolio.json

• PyPI 0.1.2 is published and clean-install verified.
• MCP Registry: io.github.Diabloluo/deadlatch@0.1.2, verified active/latest on 2026-09-22.
• Use fictional or your own simulated inputs; do not submit credentials or account data in public issues.

What changed since 0.1.1

• UTC daily audit shards with bounded-tail append, AuditRecord v2 prev_hash / record_hash, and legacy v1 read compatibility.
• Collection verify/repair/prune, explicit audit initialization, persistent write-date watermark, and cross-midnight/date-regression protection.
• Trusted reads validate chain integrity; damaged or downgraded chains are not silently repaired into valid-looking history.
• Platform contracts and failure-path regressions, including maximum-size tail records and cross-collection temporary-file isolation.

Durable audit writes are supported on Linux and macOS only. Windows supports
core computation and narrower offline read/verify behavior, not equivalent trusted
audit writes. New collections require explicit audit initialization before append.
The local hash chain is not a digital signature: without an external anchor, tail
deletion or a fully rewritten chain cannot be reliably detected. Cross-file writes
are not an atomic transaction.

Release identity and verification

• Tag target: b072e8a4d4b053e1d5a428dbb9c47e06652fbf4c.
• Public CI: 11/11 jobs passed, including Linux root, macOS/Linux matrices, Windows contracts, and fresh-venv wheel verification. Root: 715 passed, 4 skipped.
• PyPI publish run built the immutable PyPI artifacts from beebeff019137cfe780bc93a5c93dc514b25a332; the tag includes the subsequent six-file publication-fact update. Attached wheel/sdist are the original PyPI files, not rebuilt artifacts.

Asset	Bytes	SHA-256
deadlatch-0.1.2-py3-none-any.whl	106966	166135857b442d0be9d89fc530cfdcf4773e203b5d6d6ad5bb74516cf113b2e6
deadlatch-0.1.2.tar.gz	186990	13dd0f4263440e9497ea99709df1a3acdf165cbdf22383b019438792ebdd16aa

The tagged README/CHANGELOG retain checkpoint wording that Registry/GitHub Release
were pending; the package README also reflects its earlier build checkpoint.
These release notes record the completed distribution steps. This is a staged
publication, not a same-version PyPI rebuild. Source archives generated by GitHub
are separate from the attached PyPI distribution files.

Deadlatch v0.1.1

Deadlatch 0.1.1 is the G3A audit-maintenance release.

Highlights:

• Adds deadlatch audit verify and deadlatch audit repair --quarantine with fail-closed path handling, byte-preserving quarantine, atomic publication, schema-valid JSON errors, and shared locking with append.
• Publishes the public 12-rule contract at docs/rules-spec.md.
• Adds Linux root CI coverage and explicit non-root / lsof capability guards.

Install:

pip install deadlatch==0.1.1

MCP-first start:

uvx --from deadlatch==0.1.1 deadlatch-mcp --policy policy.yaml --portfolio portfolio.json

Published artifact identity:

• deadlatch-0.1.1-py3-none-any.whl — 92,050 bytes — SHA-256 8970420501c411b2334c07ee7e002b1273939f7f8f2ac35ada878295b42b0750
• deadlatch-0.1.1.tar.gz — 165,495 bytes — SHA-256 9fb7d456faef07201edb22e7888e77b7eb625b2e2688c8095c37d8d814f777ae

Deadlatch remains advisory-only: it never places orders and cannot force an agent to call it or honor a BLOCK. This is not complete G3; daily rotation, O(1) append, and hash chains remain planned for G3B. Publication is not evidence of users, paid adoption, live-account use, or a real would-block observation.

Deadlatch v0.1.0

Deadlatch v0.1.0

First stable release of Deadlatch, a local, advisory-only pre-trade risk gate for AI trading agents.

Install

pip install deadlatch==0.1.0

MCP Registry name: io.github.Diabloluo/deadlatch

uvx --from deadlatch==0.1.0 deadlatch-mcp --policy policy.yaml --portfolio portfolio.json

Verified release identity

• deadlatch-0.1.0-py3-none-any.whl — 86,870 bytes — SHA-256 54dc7cb50e7e53d04bcdb97b730eeac4ba752a5c1a8700e7c2709eeb28e0776b
• deadlatch-0.1.0.tar.gz — 147,514 bytes — SHA-256 322f7441caed88248adb3817510482312a0cd0b264e51789773c60b08260cc0d

These are the same files independently read back from PyPI. The public CI for this release target passed the macOS/Linux matrix, Windows core matrix, and build/inspect/fresh-venv verification.

Honest boundary

Deadlatch never places orders and cannot force an agent to call it or honor a BLOCK. This release does not claim live-account validation, real-order would-block evidence, external users, paid adoption, or avoided losses.

See CHANGELOG.md for details.

v0.1.0.dev1

Security-focused pre-release

v0.1.0.dev1 supersedes v0.1.0.dev0. Do not continue installing the older
artifact: it predates the option-direction and live-policy fixes below.

Fixed

• Option *_to_close text is no longer trusted as proof of a closing order.
  A close requires a fresh snapshot with the same full option contract, the
  opposite position direction, and sufficient quantity; otherwise the order is
  evaluated as opening risk.
• The stdio MCP server validates and reloads changed policy content before the
  next tool call. Invalid or unstable policy fails closed with exit code 4.
• Added an optional startup-only --kill-switch-path. Its content is read on
  every tool call and can only tighten the policy's own switch.
• Removed obsolete internal project identifiers from the public tree.

Integration requirement

For options, symbol must be the broker's unique full contract code. Do not
reuse an underlying ticker across expiry, strike, or right.

Verification

• Public GitHub Actions: macOS and Linux full suites on Python 3.10-3.12,
  Windows core suites on Python 3.10-3.12, plus build/inspect/fresh-venv wheel
  verification.
• Sanitized public candidate: 488 tests.
• This remains advisory-only pre-1.0 software. It never submits orders and
  cannot force an execution system to call the guard or honor BLOCK.

Deadlatch v0.1.0.dev0

Deadlatch is a local, fail-closed pre-trade policy guard for agent-driven workflows.

This is a public development preview, not a stable release.

Highlights:

• Advisory-only Python library, CLI, and MCP stdio server
• PASS/BLOCK decisions with structured audit records
• Local core path with no broker connection and no order submission
• USD-only, single-leg order scope for v0.1
• 472 tests in the sanitized public candidate
• GitHub Actions passed on macOS and Linux with Python 3.10-3.12, Windows core tests with Python 3.10-3.12, and the independent build job

Important limitations:

• A system can bypass Deadlatch by not calling it; this is not an execution gateway.
• This software is not investment advice and does not guarantee loss prevention.
• Experimental read-only mapping examples are not included in this repository, wheel, or source distribution and have no public live-account verification.
• There is no five-day live shadow observation, no real order shadow/block evidence, and no external or paid-user evidence yet.
• No SLA is provided.

SHA-256:

611199799f79cbab504f1cc68e0bddc4480ad135d989715fe0806737756e7daf  deadlatch-0.1.0.dev0-py3-none-any.whl
0cea4bcd1c5be74dddb1aa3fe4b2c497c32d71bfa0ee48c50ae1e16b77c38982  deadlatch-0.1.0.dev0.tar.gz

CI evidence: https://github.com/Diabloluo/deadlatch/actions/runs/34738219972