v0.1.1 — vendor fact corrections

Correction release. No new prompts — v0.1.0 shipped facts that were wrong, and this release fixes them.

If you cloned or built an adapter from v0.1.0, check it against vendor
documentation before trusting it.

What was wrong

prompts/broker-integration.md carried a per-broker adapter table asserting
endpoints, auth schemes, and capabilities as fact, with no provenance note.
Four were wrong:

	v0.1.0 said	Corrected to
Longbridge endpoint	openapi.longbridgeapp.com (404)	openapi.longbridge.com, with separate WebSocket hosts for quote and trade
Longbridge auth	HMAC-SHA256, X-Broker-Id headers	OAuth 2.0 by default; API-key signature is a legacy fallback
Tiger endpoint	openapi.tigerbroker.com (does not resolve)	openapi.tigerfintech.com
Tiger auth	Tiger-Open-API-Key + X-Signature	private-key signature, not header-based HMAC
Webull endpoint	openapi.webull.com (does not resolve)	api.webull.com, plus separate gRPC and streaming hosts
Webull auth	OAuth2-like token flow	HMAC-SHA1 with x-app-key / x-signature, plus a reusable token

Also retracted: "Webull does NOT support order cancellation via API." The
current API exposes order place, replace, and cancel together.

Two corrections were independently confirmed against working Go clients in
this workspace, which is stronger evidence than any documentation page:
webullapi4go uses api.webull.com, data-api.webull.com,
events-api.webull.com, x-app-key, x-signature; longbridge-go-demo
uses openapi.longbridge.com and the two WebSocket hosts. Every one of those
contradicted the published prompt.

What else changed

• trading-risk.md had the same class of error, carrying actual money. It
  asserted > 90% utilized = margin call imminent, max drawdown > 10%, and
  a 25% position cap as constants. Maintenance margin varies by broker, by
  account type, by instrument, and by market. The const block is now
  explicitly per-broker configuration; the risk limits are framed as mandates
  rather than rules.
• broker-webull.md carried the same SHA256 error and was framed as a
  Hong Kong API when the published OpenAPI is US-market.
• broker-vbroker.md now says plainly that no public developer portal
  could be located and that its specifics are unverified.
• sdk-docs.md told the agent to document "all supported auth schemes" as
  a flat checklist, inventing auth documentation for an SDK that may use none
  of them.

Enforcement

scripts/check_vendor_claims.py now runs in CI and fails a prompt that:

• asserts vendor auth internals without an instruction to verify them, or
  cites a doc URL that belongs to a different vendor than the file names
• states a risk threshold as a rule without nearby framing that it is
  configurable, and will not let one config entry's framing discharge a
  neighbour's

Every rule is verified by injection, not just by passing. Six negative tests
cover stripped verification wording, hard-coded auth claims, cross-vendor
citation mismatches, and unframed threshold blocks.

Audit scope

Covered the 12 prompts that hard-code broker or exchange specifics: the nine
broker-* prompts, the two sdk-* prompts, and the risk-management prompt.
The other 26 were reviewed and carry no vendor claims — they are
principle-based rather than tied to a particular API, so this audit says
nothing about the correctness of their technical judgement.

License

MIT.