v3.28.0

Canary — portfolio, risk and order tools for Interactive Brokers

Canary runs locally with TWS or IB Gateway, providing portfolio monitoring, market analysis, risk checks, performance review and order management. Order submission requires the trading build and its approval checks. Standard downloads and MCP remain read-only.

New in v3.28.0

Compare historical option-exit rules against statement trades, inspect option
results beyond the first page, and read the current and previous session's
account-value history. Missing history and reconciliation limits remain visible;
a replay is a historical simulation, not a forecast or an order instruction.

Holding locks now cover a whole name across its contracts. Proposal reviews
show an index-fall comparison when the required evidence is available.

This release includes the owner's previously approved risk-policy changes
below. Installing it does not arm automatic trading. Standard binaries and
every MCP tool remain read-only; broker writes retain their separate gates.

Install

For the standard read-only CLI and local MCP server:

curl -fsSL https://raw.githubusercontent.com/osauer/canary/main/install.sh | sh

For Claude Desktop, download canary.mcpb from the assets below. For order submission, choose a canary-trading-v3.28.0-* archive and follow the trading guide and security guidance.

Requires a local TWS or IB Gateway session on macOS, Linux or Windows through WSL. See the installation guide for setup, signature verification and other MCP clients.

• Go module and source-built CLI: product v3 and later ship through the signed installer and release assets above. The public Go module remains on its maintained v2 line; go install github.com/osauer/canary/v2/cmd/canary@latest installs the newest v2 release, not this product release.

Detailed changes

Added

• Historical option-exit replay through canary edge replay, with dated market evidence, retained inputs and explicit missing-history and reconciliation results. Live option rolling and cooling-off remain design work, not execution features in this release.
• Option-list pagination in CLI and MCP. canary edge --all-options --json retrieves all rows while counts and known totals cover the entire result.
• Intraday account-value history for the current and previous US equity sessions. It is display evidence, not an input to trading decisions.
• Proposal index-loss estimates and canary proposals reduce --portfolio --plan --proposal KEY to price a selected group. Stops and trails remain unknown because their execution depends on a trigger; plans cannot be submitted.
• Mandate exposure by underlying and in total, including delta, beta-adjusted delta, gamma, theta, vega and premium at risk. Unavailable figures retain their reasons.

Changed

• Holding locks apply to every held contract of a name, including a later rolled contract (owner decision 2026-10-28 06:41 CET). A lock on a name no longer held remains recorded and is labeled accordingly; direct single-holding reductions retain their existing behavior.
• The mandate headline now compares option premium at risk plus losses to working stock stops against remaining maximum-loss room (owner decision 2026-10-27 19:50–19:52 CET). Unstopped shares are named rather than assigned an invented stop loss; volatility remains visible for sizing.
• Forced loss-budget reductions target the largest premium at risk per name until the book fits 95% of loss room, superseding the former allocation order under that same owner decision. Gap, expiry, sleeve-stop, veto and device-confirmation gates remain binding.
• Risk-adding option purchases use the premium limits; a loss-room or volatility judgment remains a warning when those limits permit the buy (owner decision 2026-10-23 18:22 CEST). The migration writes the new per-name option_name_act_pct policy key at 15. Held protection premium counts in the name and portfolio measurements (owner decision 2026-10-27 19:52 CET); the existing protective-put entry exemption remains.
• An owner override of mandate.vol_target_pct can lift the additions gate until expiry. Other applicable loss, premium and order limits, sleeve stops and device confirmation still bind, with existing hedge and reduction exceptions retained; installation creates no override.

Fixed

• Mandate evaluations are bound to the broker account, session and position evidence that produced them. Reconnects and book changes invalidate old readings before admission or reduction uses them.
• Risk-adding option purchases count pending buy commitments against the existing premium caps, including uncertain sends. Unresolved fills and unpriceable pending combo exposure hold further additions until the evidence is sufficient.
• Held, deactivated or not-yet-activated stop children no longer count as effective stock protection.
• Proposal index-loss comparisons become unavailable when their retained mandate evaluation exceeds the existing freshness limit, including previously cached figures.
• CLI reduction reviews show the projected after-delta and untouched holdings, with explicit unlocked-book scope for net reductions.
• Partially stop-covered shares now contribute the covered loss to the mandate while the uncovered portion remains identified.
• Reductions capped by working orders report relief for the quantity actually reviewed rather than the original larger allocation.
• Option-exit replay refuses an explicit date window when its required baseline is missing. A reopened position no longer inherits a previous closed cycle's profit-trail high; historical adds reset that high when the position changes.
• Reconciliation uses the single-day statement's closing basis and tolerates sub-cent closing dust without requiring an unrelated live currency reading.
• Edge retains statement evidence through nightly reports, includes the final statement day's executions, and counts option closures by expiry, exercise or assignment without moving the same quantity twice. Option-leg results do not include the resulting stock position.
• Cash-sweep selection compares earnings after fees with leaving the money in cash, and remembers fee evidence across daemon restarts.
• Broker transport sends waiting behind a pause end with their session; the next account-summary read retries a failed cancellation. Closed-session US cash-index quotes preserve the regular close and its predecessor.
• MCP order-status sanitization now covers attached protective stops while preserving typed state and error codes.

Security

• Updated golang.org/x/net to v0.62.0 for GO-2026-6860.