v9.0.15

What's new in v9.0.15

• b3ac69c fix(release): anchor the go-api ship dir at the workspace root (#657)
• ee4d607 fix: prevent concurrent financial overflow drain race (#656)
• 3371ca7 fix(release): provision the Go toolchain before building the API plane (#655)
• 6427efc fix(release): build the Go API plane in the release workflow (GO-API-SHIP) (#654)
• b841947 fix(release): absolute icon/version-file paths for PyInstaller + deflake telegram dormant test (#653)
• 75f0c0a fix(release): declare pillow as a build-time dependency (icon generation) (#652)
• 7fa489d chore(release): bump version to 9.0.15 (#651)
• c4d2cc0 chore(deps-py)(deps): bump the python-dev-tools group with 3 updates (#650)
• 9ff90e6 ci(actions)(deps): bump the github-actions group with 6 updates (#649)
• 5d380fa chore(deps-fe)(deps-dev): bump the frontend-build-tools group in /frontend (#648)
• a01ca84 chore(deps-fe)(deps): bump @tanstack/react-query from 5.104.0 to 5.104.1 in /frontend (#647)
• 1223b49 chore(deps-fe)(deps): bump source-map-js from 1.2.1 to 1.2.2 in /frontend (#645)
• 74c7140 feat(installer): one-command packaged-release installer with integrity proof (#646)
• 8fcd19d chore(deps): regenerate lockfiles + sync training-env contract, bump polars/fastapi (#644)
• 7765ca4 chore(deps-fe)(deps-dev): bump vite from 8.3.0 to 8.3.1 in /frontend in the frontend-build-tools group (#636)
• f4cc70b ci(actions)(deps): bump aquasecurity/trivy-action from d2a0b60797ff03db6132bd4e2b293f9b37081297 to c03d123cb480c08c69b054af418ea5e69fe6e57e in the github-actions group (#637)
• 19d1c12 chore(deps-fe)(deps): bump @tanstack/react-query from 5.103.2 to 5.104.0 in /frontend in the frontend-framework group (#635)
• 6b54bf6 chore(deps-py)(deps): bump ruff from 0.16.8 to 0.16.9 in the python-dev-tools group (#634)
• 87d6ef9 chore(deps-py)(deps): bump fastapi from 0.142.0 to 0.142.2 in the python-production group (#633)
• a38c153 fix(deps): regenerate drifted lockfiles + add lock self-heal workflow (#638)
• 5e6c142 fix(pos-adviser): roll back the experimental 324D diagnostic pipeline, keep 12D model-driven control (324D-ROLLBACK) (#632)
• 3b71156 fix(ci): create chaos results dir before pytest redirection on Windows (#631)
• 346e879 feat(ui): PostgreSQL health state for ai-providers and provisioning (#630)
• e9b3eaf fix(ci): make the final-gate report 7-bit clean end to end (#629)
• e3b6bd0 fix(web): structured DB error boundary for legacy API routes (incident remediation) (#628)
• 0329547 fix(ci): keep the final-gate rich report alive on a non-UTF-8 stdout (#627)
• 634db54 fix(server): handle expected windows proactor client disconnects (#626)
• 206e858 fix(engine): AI-reversal close-before-risk-gate + news 304/misconfig handling (LIVE-LOG-REMEDIATION) (#624)
• fb61b27 test(ai-providers): register the upsert-arity regression in the critical suite and PG arm gate (#625)
• 34d64f4 fix(live): stop MT5 replay amplification at the source (TASK-DEDUP-REPLAY-001) (#621)
• 6069542 fix(db): index experience-outcome execution_id probe behind the P0 pg-read slow query (#622)
• 33a199a fix(ai-providers): generate upsert SQL in the driver so placeholders cannot mismatch parameters (#620)
• 861b00c fix(pos-adviser): render clean empty state copy instead of ApiError prefix when waiting for sample (#619)
• 5661edb feat(ml): canonical model factory, certification gates & model studio integration (#618)
• c09cde7 fix(pos-adviser): rehydrate selection on restart + wire tensor diagnostics into Go route table (#617)
• 614f4ef ci(actions)(deps): bump github-actions group with 6 updates (#615)
• 8dbd98b feat(ci): add MetaTrader 5 demo account connection to 120s soak test and enrich evidence report (#616)
• a540803 ci: certify DB query parity and SQLite↔PostgreSQL runtime transitions (#612)
• 23ee715 perf(wave7): SSE streaming through Go proxy + 15MiB payload parity + verbatim v1 envelopes (#614)
• 42bab54 fix(accounting): route AccountingCore reads through audit read plane (PG-ACCT-READ-001) (#613)
• 80f0ab3 fix(ui): hoist AnalysisSection useMemos above early returns (React #310 crash) (#611)
• 005f270 fix(db): env overlay no longer erases persisted PG config; doctor names credential mismatches (#608)
• d47bdeb perf(wave-6): defer heavy imports out of CLI startup + fix Go version route + proxy keep-alive (#606)
• 34849e8 ci: add parallel SQLite/PostgreSQL runtime soak + MT5 Wine (#597)
• 55a2d94 chore(ci): remove noisy AI final summary workflow (#604)
• 944d25d fix(research): kill the WORKER_KICK timeout spam (N+1 dataset build + 45s budget) (#605)
• 54c85e7 fix(log-sink): migrate legacy db_operation_logs schema in place (BUG-LOGSCHEMA) (#603)
• 7b775c2 fix(test): un-stale agent13 OOS test + wire into critical suite (R-BT-4) (#602)
• f99281d fix(sec): ML control-plane routes no longer expose exception text (CWE-209 #1178/#1179) (#600)
• d23c8cd fix(ci-summary): restore AI environment and final delivery (#598)
• f83816a feat(pr-evidence): surface the real cause of agent-check failures from Actions job logs (#599)
• 63d9bfe fix(wave-gate): in-flight CI reads PENDING, not RED (#596)
• 3e4a7a8 feat(wave): multi-PR wave gate for the push/merge loop (#595)
• 6cbcc63 feat(observability): app-wide PostgreSQL error/warning log sink with full traces and de-duplication (PG-LOG-SINK) (#594)
• 1b48fb0 fix(go-api): end-user UI through the Go origin — React console parity, launcher boot, banner, auth (#593)
• a016c80 fix(db): kill the live-cluster error/warning log spam (6 defect classes) (#592)
• 0191757 feat(pr-evidence): deep-diagnostics — extract file/line/rule/traceback from CI results artifacts (#591)
• 40281fb feat(go-api): Wave 4 direct Go serving with automatic Python fallback (#590)
• b1c9476 feat(ci): surface failure locations, lines, and tracebacks in gate and evidence (#589)
• 284114a feat(db): evidence-reader indexes (R-7 + R-6) and duplicate index drop (R-8) (#588)
• 34fb9ff feat(position-ml): exclusive ML position control plane + shared indicator features (#587)
• 01b8948 fix(hygiene): extend backup retention to orphaned snapshots and pre-cleanup sets (#586)
• 292abb5 perf(news): reclaim the legacy body duplicate — 48.5 MB (DEEP-OPT L3) (#573)
• 94cdaef feat(hygiene): reversible R-11 news retirement from the SQLite surface + L7 surface audit (#585)
• 2d5b4ea fix(web): bind the NO_TRADE tail read — move the majority predicate outside the slice (R-3) (#584)
• 9030032 test(research): DEEP-OPT L4 PostgreSQL arm — derived evidence read on real PG (#579) (#581)
• ee7e40d docs(db): post-remediation global rescan — the new baseline and why no further payload reclamation is available (#583)
• 690ae6e perf(db): reclaim the SQLite shadow mirror — 108 MB, audit.db 416→224 MB (#582)
• 9e1a09c perf(db): drop idx_factory_cand_hash — 552 kB index whose key is never a lookup key (#580)
• 4712a8e perf(research): stop the evidence vault mirroring the gate outcome — 17.2 MB of a 17.2 MB column (DEEP-OPT L4) (#579)
• aabeae8 perf(db): memoize the 5Hz health probe (R-1) + prune the backup directory (R-9) (#576)
• 9c8fd8d perf(db): drop idx_gov_events_model — 5.5 MB index with 0 scans on a hot write table (#578)
• 2cf34bc docs(db): post-merge verification — shadow payload reclaim (#575) (#577)
• 64b2b60 docs(deep-opt): correct the L2 echo evidence from a 5-row sample to the full corpus (#574)
• 3c1760e fix(db): provider-portable mirror reclaim for shadow_decisions (108 MB) (#575)
• 47d95e3 perf(news): value gate the AI summary echo — 45 MB of a 45 MB column (DEEP-OPT L2) (#571)
• 44c2e6d perf(shadow): retire the whole-record JSON mirror — 108 MB of a 227 MB table (DEEP-OPT L1) (#568)
• f8042ce docs(db): post-merge verification of the data-lifecycle remediation on live PostgreSQL (#566) (#570)
• 652b41e docs(taskboard): record TASK-DB-LIFECYCLE-REMEDATION-001 (#566 merged) (#569)
• 7c93017 Database & Data-Lifecycle Remediation: value gate, archival lifecycle, provider-split read plane (#566)
• 9d035f3 chore(deps): regenerate requirements.lock (librt 0.16.0) to re-green main (#567)
• adbf05a test(secrets): pin the synthetic bot-token fixture matches TOKEN_RE (#565)
• da68d95 fix(security): sanitize exception data flow in 6 web routes + retire leaked test token (#564)
• bb593bc test-arch: kill connection-level retry waste (~108s gate time); make CI failures legible in the job log (#563)
• 0db0c23 docs(repo): retire capital-A Agent/ shim and sort repository root (#562)
• 8d85cb2 P1: eliminate audit_signals scan amplification (bounded tails + high-water-mark memo) (#561)
• b9248e9 fix(benchmark+test): normalize sized-path linearity ratio; isolate bug542 cwd (#559)
• ca91ec6 docs: remove root duplicates of contracts archived under docs/historical/root-contracts (#560)
• a377c86 docs: canonical documentation architecture + governance contract (#555)
• ea17273 fix(audit): keep shared PG write backend alive, finish registry schema, repair the live.yaml atomic write (#552)
• c23a06c fix(web): unwrap the tensor diagnostic envelope so the Position Adviser page renders (BUG-544) (#557)
• a7f6a83 fix(health): surface the real DB connection failure reason + stamp the news cycle clock (#556)
• 74a14bb fix(benchmark): size the sized-path linearity legs above the process-time tick (#554)
• af6f0f6 fix(test): worker-identity negative control must not assume os.getppid() is the test pid (#553)
• 1987138 fix(database): adapt analytics view DDL to the driver dialect (BUG-544) (#551)
• 3495cfe fix(runtime): enforce complete click dependency closure (#510)
• 997f074 fix(test): tensor inspect assertions match the actual route contract (#550)
• c8ee135 fix(benchmark): warm up sized-path revaluation and median 5 samples for linearity ratio (#549)
• 2c67b6a fix(ci): refresh shadow70 frozen instant per-test; relax CPU-budget >0 assert on quantized clocks (#548)
• c57f858 fix(web): live.yaml projections must filter through AppConfig schema (BUG-543) (#547)
• 62734e3 docs(ledger): record BUG-542 — Max Drawdown header read the bootstrap, not the runtime snapshot (#546)
• bf89090 fix(web): Max Drawdown header must read the effective runtime snapshot (#545)
• aed8a8e docs(db): correct phase4 report commit lineage after rebase (#544)
• 80029c8 perf(db): PostgreSQL Phase 4 workload observability (#543)
• 26f70f4 Neural Studio: 50D/70D contract gate, runtime state machine, OOS trainer, model builder (#535)
• 341adeb fix(registry): remove duplicate read path that doubled every registry row (CC-READ-PLANE-002) (#540)
• bec4667 chore(deps): refresh requirements.lock (filelock 4.0.4 -> 4.0.5) (#542)
• 0f86a45 fix(test): make the failure-isolation probe architecture-independent (#541)
• 06742bc feat(liquidity ui): depth, section anchors, bounded table striping, heat-bar glow (#538)
• 8548a14 chore(deps): refresh requirements.lock to clear the dependency-drift gate (#539)
• bcf4808 fix(ml): /ml runtime truth — poisoned global app slot + drift run-state (#522)
• 247fa8e fix(db-console/research-obs): bytes-safe validation errors + provider-aware reads (#533)
• e5bc08c fix(research): make research persistence provider-neutral (real PostgreSQL) (#536)
• 4961121 fix(health): make /api/status subsystem health report runtime truth (#529)
• a7e4092 Position Adviser: runtime, load contract, tensor inspector, SQLite settings, PG operational store (#526)
• d936c1f fix(database): register trading_rules_config(rule_name) so the BUG-276 unique-target heal covers it (#537)
• 3f15764 fix(research): provider-portable worker checkpoint, real census timestamps, persisted PG transition config (#534)
• df8afb1 test(health): register the health-governance suite in the critical manifest (#531)
• 92eb594 fix(runtime-integrity): research reads off the provider URI; authoritative mode source (#523)
• fb74e2c chore(db): PostgreSQL + SQLite hygiene cleanup; fix BREAKEVEN_FAILED audit spam at source (#530)
• f574aa0 fix(debug): report operational truth instead of fabricated gate verdicts (#528)
• 636350b PHASE 2 — Database / Contract Integrity (Agent 2) (#527)
• 62a35bb fix(health): runtime-truthful safety/governance health system (#514)
• 2268642 fix(risk): /risk gauges report live measured state on a halted engine (#519)
• 46de3ed fix(ai-providers): canonical switch-response keys + structured refusal reasons (#525)
• 0e336dc fix(model): make trust anchor + lifecycle schema provider-portable (#524)
• 8fdac1b Model provisioning control plane: run truth, cancel ack, model inventory (#517)
• 3bcfbd7 fix(config): validate a partial /config edit against the merged document (#521)
• 09d965f fix(audit): read the live provider instead of a dead audit_events table (PG-AUDIT-READ-001) (#516)
• c3d19b2 feat(ai-providers): operational provider control plane — add / test / test-model / activate / deactivate / rollback (#518)
• 8828b18 fix(research): provider-gated reads silenced Command Center data (CC-READ-PLANE-001) (#515)
• 7178250 fix(control-center): repair the operator console truth chain (React #310 crash + stale latest_decision_at) (#513)
• 77eb21b docs(db): record real PostgreSQL phase3 benchmark evidence (#512)
• 1daea6b perf(marketplace): batch installation existence checks (#511)
• b08acc4 fix(database): enforce fail-closed provider switching and migration safety
• 033c6dc feat(database): close dual-provider lifecycle, observability, and UI gaps (#507)
• 2a7234c fix(qa): ML-QA-019 legs are host-portable (Windows CI red + flaky CPU budget) (#496)
• 0d28c16 chore(deps-fe)(deps): bump @tanstack/react-query from 5.103.1 to 5.103.2 in /frontend in the frontend-framework group (#502)
• 842cb34 feat(database): complete dual database architecture lifecycle, purge, and observability (#506)
• cef1197 fix(pr-evidence): resolve unknown file paths instead of printing them (#504)
• e86c0ee fix(database): route audit operations through active provider (#505)
• d4bd0f3 PostgreSQL migration wave: 11 lanes, empty-tables root causes fixed (#492)
• 21f566b feat(pr-evidence): final merge verdict + explain every failure with where/why/fix (#501)
• dca9746 fix(pr-evidence): land a settled verdict, not a mid-flight snapshot (#500)
• 4e736d1 fix(ci): publish the evidence report from main, after CI settles (#499)
• 6ca1f81 fix(pr-evidence): resolve workflow names, honour --refresh, auto-refresh after CI (#498)
• 2ff19c1 feat(cli): generic NSE PR evidence reporter (nexus pr report) (#497)
• dcf1db6 AGENT-QA: ML-QA-019 handoff report (closes determinism recount table) (#495)
• d87cd9d ui: full UI/UX modernization wave (10 lanes, presentation-only) (#494)
• 448c5ff feat(qa): restore BUG-106 parity coverage + CPU-time speedup budget (ML-QA-019) (#493)
• 1f6727b fix(review): allow all CREATE ... IF NOT EXISTS forms (unique indexes) (#487)
• c80ad0c fix(go-api): Wave 3 profiler blind spots — 130 → 105 Go candidates (#491)
• 43d6fa8 AGENT-QA: benchmark wall-clock to CPU-time determinism for the final two roster rows (ML-QA-018) (#490)
• 696fb9f feat(go-api): Wave 3 dependency-aware routing — needs-DB/needs-Python classification (#489)
• 1f7f344 AGENT-QA: process-identity determinism for training-env worker suite (ML-QA-017) (#488)
• 10aaac0 fix(review): allow idempotent seed writes so the console boots (#485 follow-up) (#486)
• 66d636c fix(db): secret-store coercion + fail-loud missing PG password + 3 silent write-drop P0s (#481)
• 58dfec0 fix(review): allow the idempotent schema bootstrap so the console can boot (#485)
• 357425a feat(review): widen the read-only guard to the whole process (REVIEW-LOCK L3 v2) (#484)
• 8a5db64 AGENT-QA: process-identity determinism for hot-reload suite (ML-QA-016) (#483)
• 7a690e2 feat(review): lock the review console read-only (REVIEW-LOCK, L1-L4) (#482)
• 90b7cf6 fix(incidents+research): PG write-path upsert parity, archive bootstrap, Lane D test repair (#480)
• 0316ca6 AGENT-QA: wall-clock determinism for BUG-275 hygiene-cadence suite (ML-QA-015) (#479)
• 379a1c1 AGENT-QA: CPU-time determinism for causal-TCN latency suite (ML-QA-014) (#478)
• 6db6570 fix(db): PG parity for 9 audit-derived stores + fast-fail migration + DSN parsing (#470)
• 2410819 AGENT-QA: monotonic-clock determinism for BUG-285 overflow-drain cadence suite (ML-QA-013) (#477)
• ade49f1 feat(ui): trading console wave-9 UX upgrade (D1–D5) (#465)
• 7e27109 docs(skill): document CONTRACT #7 dotless static-shell rule as a binding Go-plane rule (#474)
• e71739f docs(taskboard): record TASK-PG-DBPATH-BOOT-001 (PR #471 merged, all required gates green) (#475)
• 533ec42 fix(model_lifecycle): PG DSN never reaches sqlite3.connect at boot (BUG-RT008) (#473)
• 7a78696 fix(live): MT5 watchdog reconnect storm + boot safety fail-closed (RT-007/008/009) (#476)
• 0db3864 fix(go-api): port CONTRACT #7 dotless static-shell rule to the auth allowlist (#472)
• f6e56a5 fix(db): provider URI in _db_path is fatal at boot + incident store (PG-DBPATH-BOOT-001) (#471)
• 8239152 chore(docker): pin docker/*.sh to LF so the container ENTRYPOINT is executable (#469)
• b07e9e6 fix(docker): readiness/healthcheck probes corrupted curl status codes (#468)
• 03df494 Go API plane: auto-build, installer, CI, SPA, docs — one origin for API + UI (#464)
• 616a5b8 fix(db): provider-config registry follows the ACTIVE provider + close a silent SQLite write-loss seam (CHG-0067) (#467)
• 2b70763 AGENT-QA: push-gate wall-clock determinism for BUG-140 outcome-flush race suite (ML-QA-012) (#466)
• e04123d DATA-RAW: parquet producer/consumer split, data-restore cmd, self-healing health gate (#463)
• 384006f fix(db): AI-provider decision ledger follows the active provider (P0 PG-migration violation) (#462)
• 930e691 Go API server: full FastAPI surface parity (466 routes) (#461)
• 0428afc Fix PostgreSQL DB problems: read-plane registration, schema replay, store paths, config clobber (PG-READ-PLANE-001) (#460)
• 2454c0d fix(model_lifecycle): LearningCycleStore no longer silently loses every cycle (RT-007) (#458)
• 33205de AGENT-QA: push-gate wall-clock determinism for shadow70 safety suite (ML-QA-011) (#457)
• d82837c docs(taskboard): TASK-I18N-COMPLETE -> MERGED (PR #448, 7d49973) (#456)
• 35542cc Persist AI-provider position decisions to SQLite/PostgreSQL (#454)
• 7d49973 MASTER WAVE: full-product internationalization (fa/de/es/ar + en fallback, RTL, error-code map, i18n CI gate) (#448)
• 7705d1b fix(health): first-run config resolution + honest model contract + repair migrations (#451)
• c19dfcf fix(web): operator .env token is authoritative for WEB-AUTH-P0 (RT-006) (#453)
• 8351348 fix(boot): persist bootstrapped default config on first run (EUR follow-up) (#452)
• b19fbd3 fix(data): ingest signature, watermark, timeframe canonicalization (MT5-PARITY-FORENSICS) (#437)
• 29bab21 docs(taskboard): close out TASK-ML-POSITION-FORENSICS (PRs #429 + #443 merged) (#450)
• 8a8e5da Database Fabric master wave: read-plane registration + multi-domain PG provisioning (Wave 3) (#449)
• d5ff641 ML-POSITION-FORENSICS UI: real model identity + decision evidence in the Position Adviser page (#443)
• 10b8ce7 fix(mt5): transport-bridge parity fixes T1-T6 (MT5-PARITY-FORENSICS) (#436)
• 6a7e2e7 feat(qa): push-gate wall-clock determinism for BUG-262 close-time evidence + contract battery (ML-QA-010) (#432)
• 0255a7b AGENT-QA: audit-flush bounded-wait assert on CPU time + 8-test contract battery (ML-QA-009) (#422)
• 70f2415 fix(web): debug_snapshot audit probe on PostgreSQL (RT-005) (#447)
• df78ab2 fix(incidents): IncidentStore constructible on PostgreSQL (RT-004) (#446)
• a9d37f4 docs(dispatch): correct stale volume-ceiling comments to match min() semantics (#445)
• 214f02d fix(db): portable guard-telemetry counter upsert (RT-003) (#444)
• 0de154a docs(taskboard): register TASK-ENDUSER-OPERABILITY-HARDENING DONE (PR #439) (#442)
• 1b56bc5 fix(broker): identity is config, ticket ownership gated, close confirmation enforced (#434)
• 528f5b1 feat(operability): end-user product hardening — payload hygiene, uninstall data preservation, dashboard discovery, state contract (#439)
• 8fff4ae fix(db): provider-agnostic additive schema heal + lazy dead-letter sink (#435)
• e4b6c0f docs(taskboard): record LIVE-CAUSAL-TOPOLOGY wave (PR #438 merged) (#441)
• 58c0819 docs(taskboard): ECOSYSTEM-001 row for the AI provider ecosystem (PR #430) (#440)
• bc42c66 feat(trace): live causal execution topology + request-journey forensics (#438)
• b231930 END-USER-RUNTIME-UI-INTEGRATION: one-click packaged product (TASK-EUR-001) (#428)
• 17b2edd AI provider ecosystem: System One + OpenRouter + internal ML behind one canonical decision contract (#430)
• d8429bd fix(security): round-2 remediation of 7 post-merge code-scanning alerts (#433)
• 4f2d24b Database Fabric wave 2: full logical schema parity for PG + observable read degradation (CHG-0067) (#431)
• 03d2fed fix(position-adviser): forensic lifecycle hardening + production gates (BUG-314) (#429)
• 68b22e6 docs(broker-forensics): post-merge verification results — canonical law vs live MT5 order_check (#427)
• edd8439 feat(broker): canonical MT5 valuation law + honest paper money semantics (#426)
• ff4f7cf docs(taskboard): close TASK-RESIDUE-POSIX-001 + release locks (PR #423 merged) (#425)
• 24dbe98 Database Fabric master wave: complete SQLite<->PostgreSQL migration (Wave 1) (#424)
• 5ad2d2f fix(ci): canonicalize merge-marker-residue diagnostic paths to POSIX (#423)
• 7242109 feat(qa): push-gate latency determinism for MT5 parity suite (ML-QA-007) (#411)
• cbabada feat(db): first-run provider choice prompt on both entry paths (#421)
• 5d028bc fix(security): resolve 14 CodeQL alerts (deserialization, path injection, SQL injection, exception leaks) (#412)
• 874af06 docs(taskboard): close TASK-EUP-RELEASE-001 — merged (PR #417, squash c9851b5) (#420)
• c9851b5 fix(release): CLI help-surface canonical prog_name + test-harness isolation (EUP-RELEASE-001) (#417)
• 0787268 docs(taskboard): close TASK-DECISION-TRACE-001 — merged (PR #416, squash a758fe4) (#419)
• bbbec18 feat(qa): push-gate latency determinism for experiment-registry benchmark (ML-QA-008) (#418)
• a758fe4 feat(observability): Trading Decision Trace + Runtime Topology Observability (#416)
• 366cbe5 fix(windows): expose NexusTraderBot application identity in taskbar (#415)
• 8b4d9e5 feat(db): PostgreSQL persistence fabric — provider-agnostic write plane, migration engine, fail-loud config validation (DB-FABRIC-001) (#408)
• c9e186c docs(taskboard): mark TASK-NEWS-ADMISSION merged (PR #410) (#414)
• fc640fa fix(log): 4-lane remediation of live log defects (LOG-DEFECTS-WAVE) (#413)
• 5c38c3e feat(news): pre-DB admission gateway + re-poll duplicate guard (#410)
• c69a971 docs(qa): restore ML-QA-003 taskboard row dropped by #402 (supersession of #392) (#406)
• 0f7305c AGENT-QA: duplicate canonical task-row detector for SSOT tables (ML-QA-006) (#409)
• 52aaa8b feat(i18n): full internationalization (fa/de/es/ar + en fallback) of React frontend + handbook overlay + RTL/overflow fixes (#407)
• a1a798f AGENT-QA: merge-marker residue guard + diff3 arm leak removal (ML-QA-005) (#405)
• 4386a7e feat(governance): GATE11 artifact-integrity shape contract + orchestrator fail-closed (BUG-308C) (#381)
• a111f92 AGENT-ML-ARCH: causal attention module + positional-encoding ablation (ML-ARCH-003) (#354)
• adfc0a6 feat(qa): ML-QA-003 + ML-QA-004 canonical delivery — determinism census + push-gate timing remediation (#402)
• 6a8aa2c chart wave-3: performance + deeper UI/UX (4-lane contract build) (#403)
• 9161d96 feat(db-tab): connection-string entry, readiness-gated provider switch, options & API hardening (#400)
• 14dd12b perf(ui): wave 7 — render-load sweep (6 lanes, contract-verified, output-identical) (#399)
• 44cc542 docs(taskboard): close TASK-UI-TRADING-001 — merged PR #396 (#398)
• 5ffb293 feat(ui): wave 6 — account studio, marketplace storefront, incidents command skin (4 lanes, contract) (#397)
• 85d0f17 feat(ui): trading page pro UI/UX — hero, command deck, market readout (presentation-only) (#396)
• e40aa83 feat(ai-analysis): wave 2b — router-backed tabs, idle chunk warming, honest loading states, SignalsTab extraction (#395)
• 3bb9871 fix(tests): conftest binds THIS tree's src for every suite, not just .worktrees/ — editable .pth pinned nexus_scalp to the main checkout's branch, so lane suites tested another session's WIP (BUG-231 condition generalized) (#394)
• 6e5fb0e docs(taskboard): record EU-RELEASE-001 end-user release lane (PR #388 merged) (#393)
• 5701eb1 fix(incidents): replace two raw hex colors with a theme token color-mix() (#391)
• c2a0af3 feat(ui): wave 7 — deeper UX depth + latent perf (4 lanes, contract-verified) (#390)
• 354c602 docs(taskboard): TASK-UI-W8-HERO-4 wave 8 operator heroes (PR #387 merged) (#389)
• 229dfea fix(cli,release): nexus --version exit 0 + branded application icon on every shipped EXE (#388)
• 96bb757 feat(ui): wave 8 operator heroes — health, incidents, liquidity, governance (#387)
• cba130e docs(taskboard): record TASK-UI-PERF-007 runtime perf wave (PR #383 merged) (#386)
• 89f1bc6 feat(provisioning): operator-grade /alt/provisioning UI/UX + dataset browser endpoint (#385)
• 2b7140f perf(ui): wave 7 — 13.6x format cache, tick coalescing, stable route elements (#383)
• b8e807e perf(ai-analysis): wave-2 — UI/UX performance, perceived latency, review pass (#382)
• b4d21b4 chore(deps): regen requirements.lock — clear required Dependency-drift gate (#384)
• b3038b9 docs(taskboard): TASK-UI-INTEL-002 -> MERGED (PR #378, squash 891d12a) (#380)
• d1fe2d3 feat(db-tab): Database tab deep overhaul — provider truth, UI/UX rebuild, poll-latency fixes (#374)
• 891d12a feat(ui): intelligence page wave-2 — pro/modern hero, KPI, structure viz, feed (3-lane contract build) (#378)
• 4958311 Pro UI/UX wave 6: performance — async, lower latency, 89% smaller entry chunk (#379)
• 887a039 chart-wave2: TradingView-parity chart panel (volume band, axis tags+legend, overlay toggles, chart types) via contract lanes (#377)
• e0833e1 docs(locks): release TASK-CFGUI-001 locks (PR #370 merged) (#376)
• 7bbc91b Command Center: BUG-312 spatial fix + analysis charts + retry-hardened delivery (#375)
• d72c147 docs(taskboard): record TASK-UI-ICONS-001 website identity set lane (#373)
• 7439ca6 feat(ui): website identity set — favicon, PWA manifest, OG card + rules hero mark (#372)
• fa96194 feat(ui): dependency console pro upgrade — real payload shapes, hero, hotspot bars, blast radius (#366)
• dac519f TASK-CFGUI-001: /alt/config tab — backend connection fixes + full UI/UX redesign (#370)
• 418e4ff feat(ui): UIUX parallel-lane wave — positions/risk/intelligence/control-center upgrades (#371)
• edc54a2 feat(research): strategy playbook + animation layer for /alt/research (#369)
• 03d524d AGENT-QA: real walk-forward nightly harness + ci-summary watch (ML-CI-001) (#363)
• a06225c feat(ui): AI Analysis console redesign — hero card, charts, intel wiring (#367)
• cf79700 Pro UI/UX wave 5: unified dialog keyboard contract, keyboard-reachable scroll regions, state semantics (#368)
• ec6ad15 docs(taskboard): record TASK-UI-INTEL-001 intelligence-page redesign lane (#365)
• 9b84d17 feat(ui): intelligence page pro UI/UX — hero, endpoint provenance, section grouping, tone badges (#364)
• 3cc9fa9 feat(ui): rules console redesign — hero stats, grouped matrix, modal param editor (#362)
• 2559237 feat(chart): TradingView-style zoom/pan/future scroll + timeframe switcher (1m-1W) (#360)
• f746f8f Pro UI/UX wave 4: table scoping, landmark names, legend styling law, stable keys (#361)
• 41f2d7b feat(ui): debug hub pro UI/UX — SOLID tab decomposition, trading-terminal skin, sortable tables, compare-contract fix (#359)
• c2fe11d Pro UI/UX wave 3: deep a11y semantics, dialog focus management, accessible names (#358)
• 9a6a0c2 GOV-OWNERSHIP-001: branch/worktree ownership hardening after the 2026-09-22 incident (#357)
• 8a9c529 feat(ui): wave-2 pro polish — truthful health badge, AA contrast, global table cap, a11y (#356)
• db78130 feat(ui): pro UI/UX upgrade across every dashboard screen (unstyled-page fixes, orphan wiring, design-system sweep) (#355)
• 2d3eb77 GOV-GIT-001 residual hardening: secret-scanner token prefixes + stale git instructions (#353)
• 6784dda AGENT-GOV: Git/GitHub governance overhaul — enforcement over prose (GOV-GIT-001) (#352)
• fcd43fb feat(arch): ML-ARCH-002 causal TCN dilation schedules + exact receptive-field proof (#351)
• 594855d AGENT-QA: BUG-307D fix Windows path-separator misclassification in legacy-4 audit probe (OS Matrix red since #347) (#350)
• cb51ed5 fix(ci): BUG-307C process-global logging.disable leak turned main red (db-portability --json) (#349)
• 73f5eaf docs(bugs): record BUG-307B — both CI pytest flakes root-caused and fixed (#348)
• 159cd3b feat(arch): ML-ARCH-001 legacy-4 surface audit + DEC-0010 sunset decision (evidence-complete) (#347)
• 9279f1e ML-PHASE1-DATA-CONTRACT: 70D canonical data contract, labeling identity, fail-closed serving validator & Layer-2 position adviser (#338)
• 6bb1ffb AGENT-GIT: ML contract drift CI gate + local-gate parity wiring (ML-CI-002) (#346)
• eb73440 fix(model-lifecycle): champion registry truth-sync must compare the SERVING bundle contract (#343)
• 9fab7ff fix(alt-ui): publish status on every frame — CONNECTING chip stuck after connect (#344)
• 2d6950c feat(validation): probability calibration & ECE with temperature scaling (ML-VAL-002) (#339)
• 60a7047 fix(alt-ui): re-baseline state_version on stream open — engine restart starved the feed (#342)
• 73b86c0 fix(alt-ui): accept SSE tick frames by transport event, not a payload key (#341)
• 07d64e0 docs(site): regenerate static site output (#340)
• 8370549 feat(exp): bounded hyperparameter grid search runner (ML-EXP-003) (#337)
• 8566bd3 AGENT-ML-EXP: immutable experiment registry + artifact manifest schema (ML-EXP-001) (#335)
• e78891f AGENT-ML-TRAIN: loss function library + 5-fold benchmark (ML-TRAIN-002) (#334)
• 8dfd5d1 feat(training): optimizer & LR-scheduler factory + cadence-correct trainer wiring (ML-TRAIN-003) (#333)
• 579e16c feat(training): deterministic training engine, seed harness & AMP precision (ML-TRAIN-001) (#332)
• 344aa01 fix(docs-ui): mobile nav strip actually scrolls + rose negative-evidence callout (#331)
• f186647 fix(docs-ui): unreadable What's New changelog text on dark landing (#330)
• 84a1c0b chore(deps-py)(deps): bump ruff in the python-dev-tools group (#317)
• ed6f098 docs(ml-risk): close out ML-RISK-001 task header to DONE with re-verification evidence (#326)
• b41bc57 fix(docs-ui): mode-panel Docs chip + mobile landing polish (#328)
• aa2382f fix(ci): correct linear-scaling gate bound for shadow resolution benchmark (#329)
• 4b4f2f2 test: add unit tests for _eval_rule_flash_momentum_scrape (#270)
• e592d5b AGENT-PLATFORM: MT5 Linux parity suite for RemoteMT5GatewayAdapter + PaperMT5Adapter (ML-PLAT-001) (#322)
• e7cf38d test: add unit test for _eval_rule_contrarian_retail_trap in rule_matrix (#272)
• b7bf4cc fix(docs-ui): pin light-theme token leaks on dark landing page (#325)
• 8ce87fe feat(observability): live shadow outcome resolution at bar close (ML-OBS-001) (#321)
• 975d717 test(signals): add test for _eval_rule_tick_imbalance_reversal (#274)
• 043c245 AGENT-FEATURE: feature importance, collinearity clustering & redundancy pruning (ML-FEAT-002) (#323)
• fd5dc02 fix(docs-ui): dark-safe header chrome, capability-matrix table polish (#324)
• 002ed53 test(signals): add unit tests for _eval_rule_vwap_elastic_band (#276)
• 7af6edf AGENT-ML-VALIDATION: robustness stress battery + GATE8 ceiling analysis (ML-VAL-003) (#315)
• 213b77e test: add unit test for _eval_rule_wick_absorption_play in rule_matrix.py (#277)
• 71b07b0 AGENT-PLATFORM: signed official bundle tamper-proofing drill + 2 fail-open installer fixes (ML-PLAT-002) (#314)
• 51a3dc8 feat(backtest): trading quality metric suite - expectancy R, profit factor, slippage decay (ML-BT-001) (#316)
• ed1ac82 chore(deps-fe)(deps): bump the frontend-framework group (#318)
• b2d1526 chore(deps-fe)(deps-dev): bump vite (#319)
• 67e76d6 ci(actions)(deps): bump the github-actions group with 3 updates (#320)
• 463f5e1 🧪 Add unit test coverage for _get_active_tickets_info in policy.py (#288)
• e6a1b6b test(signals): add unit test for _eval_rule_end_of_hour_squeeze (#279)
• fa3369f test: add unit test for _eval_rule_news_spike_fade in rule_matrix (#282)
• a29e76c test: add unit test for _eval_rule_bollinger_burst_fade (#287)
• ebca0c0 🧪 Add comprehensive unit tests for _evaluate_tick_sweep in policy.py (#305)
• 8542b7d AGENT-ML-VALIDATION: purged walk-forward embargo leakage audit, zero leakage (ML-VAL-001) (#313)
• 345c92e perf: eliminate N+1 execution in itertools.groupby batch loop (#271)
• cf74821 refactor(paper): extract helper methods from get_last_tick in PaperMT5Adapter (#275)
• 3b52bc7 test(signals): add unit test for _eval_rule_fvg_sniper_fill (#278)
• 5510dea test: Add unit test for _eval_rule_gap_and_go_momentum in rule_matrix.py (#284)
• 46a9195 refactor: extract DEFAULT_TRADING_RULES constant in AuditRepository (#285)
• 6cc44b4 ⚡ [performance] Optimize min/max calculation over completed bars in policy.py (#291)
• 6362658 AGENT-INFERENCE: inference latency SLA benchmark + hot-path hardening (ML-INF-001) (#312)
• a7eac1b 🔒 Fix arbitrary SQL execution & injection vulnerability in DB console (#308)
• f79987e perf: optimize trading rules seed with executemany (#286)
• 6f2dd50 test: add unit test for _eval_rule_gap_and_go_momentum in rule_matrix.py (#289)
• dae0fef refactor(paper): extract helper methods from get_last_tick in PaperMT5Adapter (#290)
• 876b92c test(policy): add unit tests for build_nt decision path (#294)
• fe9fecc test(signals): add unit test for _eval_rule_orderblock_tap_reserve (#296)
• bd90f26 test: add unit tests for SignalPolicy._evaluate_predictive_limit (#298)
• dbcbd18 refactor: extract helper functions in sync_broker_history (#306)
• bb316d3 fix(audit): anchor workspace DB path before DeadLetterStore construction (BUG-149) (#297)
• 569e9b4 Fix BUG-226: fallback account_source to current_account_source (#299)
• 7a6c48f fix(policy): wire max_spread_atr_ratio into AlgoConfig and RuntimeConfig (#303)
• cc3e37c test(policy): add unit tests for _expected_live_ticket_identity (#300)
• 3bec6cd fix(audit): encapsulate resolve_audit_db_url for BUG-223 isolation (#301)
• 5884da7 Fix candidate entry price for SELL candidates in SignalPolicy (#310)
• 88488e8 🧪 Add unit tests for _evaluate_exposure_limits in policy.py (#273)
• b5d61f6 test: add unit tests for _eval_rule_judas_swing_fade in rule matrix (#309)
• 5a9a5dd 🧪 test(policy): add unit tests for is_numeric input validation (#292)
• 8e508e6 ⚡ optimize loop slicing in extract_live_chart_overlays (#302)
• ee4fcba 🔒 Restrict overly permissive CORS origins in web server (#304)
• 105bc3d 🔒 Fix missing authentication on sensitive operator endpoints (#307)
• 117ce7f chore(deps): regenerate requirements.lock (drift: filelock 4.0.0 -> 4.0.1, fsspec 2026.7.0 -> 2026.9.0 upstream releases; regenerated with uv 0.12.10 --all-extras --universal --generate-hashes; requirements.txt unchanged - neither is a thin-artifact pin) (#311)
• 8287260 feat(labeling): sample uniqueness weighting & label overlap anti-leakage (ML-LABEL-002) (#269)
• 2c0b6a7 feat(ml-risk): Position replay & economic dataset generation engine (ML-RISK-001) (#268)
• e439f41 feat(ml-system): AI Hub SQLite model registry, hot-loader & runtime lifecycle (ML-UI-003) (#267)
• 3cc00a0 AGENT-LABEL: calibrate triple barrier parameters and add diagnostic metrics (ML-LABEL-001) (#266)
• 6df72c0 AGENT-DATA: dataset manifest schema, versioning & artifact hashing (ML-DATA-002) (#265)
• e46422d feat(ml-system): dataset ingestion, 50D/70D normalization & Layer-2 position dataset pipeline (ML-UI-002) (#264)
• 40e44ac docs(ml-system): ML-GOV-001 closeout — mark task DONE and record PR #262 merge evidence (#263)
• 266d3ae feat(governance): model promotion pipeline pre-flight and OOS economic floor gate (ML-GOV-001) (#262)
• ccfa140 NSE-Swarm role11(CI/GitOps): BUG-306 Windows CI critical suite breakages (sync_file EBADF and test_model_studio charmap decode) (#261)
• b361357 docs(ml-system): ML-DATA-001 closeout — mark task DONE and record PR #259 merge evidence (#260)
• d52bcde feat(data): historical M1 market data ingest and Parquet storage harness (ML-DATA-001) (#259)
• ca68a81 docs(ml-system): ML-UI-001 closeout — mark task DONE and record PR #257 merge evidence (#258)
• 947cd6a feat(ml): Deep Learning & Neural Model Studio — 50D/70D inspection, predict, and training (ML-UI-001) (#257)
• 0fe4f10 NSE-Swarm role10(Accounting/Forensics): BUG-305 broker-offset override consumer parity (#256)
• 184fc85 docs(ml-system): ML-FEAT-001 closeout — mark task DONE and record PR #254 merge evidence (#255)
• bd61deb AGENT-FEATURE: verify 50D normalization parity between trainer and inference (ML-FEAT-001) (#254)
• 0185af2 docs(ml-system): add ML-UI-001 for CLI and Web UI model validation (training, predict, trust)
• 2e07012 docs(ml-system): redesign ML backlog into 30-task swarm-safe quant DL system
• 6b46761 NSE-Swarm role9(Observability): BUG-303 CI notify env repair and observability reporting (#253)
• 7aff39d docs(ml-system): establish self-contained 15-task backlog and dependency ledger
• 5ebc1ad feat(provisioning): one-click first setup flow + local training pipeline + honest UI (#247)
• c6e7bff chore(deps): update idna in requirements.lock to prevent drift
• 0e80868 docs(ml-system): complete canonical ML documentation suite and task board
• f5ff457 OFFICIAL-MODEL-DISTRIBUTION-CONTRACT rev2: signed model channel, transactional install, publication pipeline (#250)
• bb9ce84 NSE-Swarm Security closeout: published-signing verification + stale blocker correction (#251)
• 2d67f4f NSE-Swarm QA: restore executable Bash pre-push wrapper (#249)
• 3b82a58 fix(deps): BUG-304 regen lock after upstream nvidia-nvjitlink 13.4.92 release (#248)
• 8416aa1 feat(research): truthful backtest report engine + full UI panel (MT5-inspired) (#246)
• 0eb3352 NSE-Swarm role6: PERF-WAVE R4 PARTIAL — offload remote tick polling from event loop (#245)

Architecture support

• Windows x64: SUPPORTED (PyTorch/Polars/MetaTrader5 wheels exist)
• Windows ARM64: UNSUPPORTED — no wheels for the dependency stack

Tests ran in this workflow (gates job). No claims beyond that.