[Pigbibi]

AI assistance

Authored with OpenAI Codex. The host does not expose an independently verifiable
model revision. Author self-review and local validation are recorded below;
independent review belongs to the established code-review-and-merge bot and is
not claimed here. Keep this PR in draft.

What changed

Supersedes #956 without closing it. That PR is a source-repair branch rather than
a pin-only branch, so this fresh branch carries its RC-01C admission boundary on
current main, including already merged settlement protection #957.

Pin QuantPlatformKit to merged #768 commit
cee53965b3d6b368445193b580aa94f2bbb9537c in pyproject.toml, its uv override,
qsl.toml, uv.lock and the CI expected-pin value. Preserve isolated research pins
and all other dependency versions and check policies.

Resolve the breaker/settlement reservation overlap: finish blocking preparation
and resize the exact cash-buy intent before reserving it as new_risk=True, so
QPK rechecks persistent OPEN at final dispatch. Add three synthetic regressions
covering a separate process opening the breaker during qualification or after
reservation, and the resized intent's new-risk marker. Preserve every original
assertion; forward reserve keywords in an existing test spy. Update four golden
notification messages for the requested QPK's masked account display and explicit
unknown run fields; keep dedupe keys and every other fixture field unchanged.

How verified

• Full frozen-dependency IBKR suite: 5,957 ordinary tests and 348 subtests passed,
  6 skipped, zero failures (exit 0).
• Focused boundary/heartbeat/notification/settlement suite and original switch-OFF
  assertions: 401 passed (exit 0).
• Ruff, documentation style (zero blocking findings; one existing advisory),
  protected workflow contract, QPK pin consistency, uv lock check, offline WSGI
  startup (10 routes) and diff checks passed.

Tests use synthetic state, an allowlisted environment, an empty HOME and inherited
Linux seccomp denial of network operations. Installed QPK direct_url metadata
confirms both requested and resolved revision equal the exact pinned merge commit.
An AST comparison preserves all 321 assertions in modified existing Python tests.
The original two switch-OFF assertions are rerun unchanged. The full suite retains
its existing skips; isolated historical TQQQ overlay and hosted CI are separate
from the installed-production-pin local suite.

Current-head hosted readback: test, isolated tqqq-offline-risk, documentation,
commit-message convention, offline governance contracts, both Gitleaks scans,
GitGuardian and PR template checks succeeded. CodeRabbit was skipped. Evaluate
PR governance and risk-gate failed; the current-head status explicitly reports:
"High-risk paths: needs-owner-approval; owner must add owner-approved".
No labels were added. These approval conditions belong to the established
review process; passing tests do not establish runtime acceptance.

Adversarial evidence: the old pin produced 11 failures in the 21-case inherited
breaker module. All three new handoff tests failed unchanged on current main with
the requested QPK before integration. Initial local failures exposed an old spy,
new-fixture environment leakage and outdated notification expectations; the
signature forwarding, explicit environment restoration and four message fixture
updates address those causes without weakening any assertion.

Why

#956 depends on durable breaker and new-risk dispatch APIs absent from its old
QPK pin. Adopting the merged dependency makes that boundary usable while retaining
the settlement protections now present on main. A current healthy snapshot must
not authorize a buy after another process persists OPEN during blocking preparation.

Risk

High: the complete PR includes inherited admission code in application/, the
reservation handoff in main.py and a dependency upgrade. Unknown storage/ownership
or persistent OPEN blocks new risk. With the portfolio stop-loss switch OFF, the
inherited boundary preserves holding targets and creates no drawdown sell plans.

Runtime/full RC-01 and RC-03 remain NOT_PROVEN. Authentic initial state, stable
storage ownership, old-writer quiescence, deployed consumer identities, real broker
receipts and shared cash/commission conservation are missing. No live/Kelly/
stop-loss switch, risk parameter, Gateway session, production configuration,
label, merge or deployment is changed. #956 remains open and untouched. Review
and approval gates remain the responsibility of the established review process.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6a318e2e-7291-4347-839e-6da800ef5210

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Pigbibi]

Post-merge re-review: InteractiveBrokersPlatform #958 (R2) — FINDINGS (P1 x1)

• Reviewed head SHA: d39d1997531ce674ddb1286c1344ca99bd937018
• Squash commit SHA: 70311069d37c3815514954c6f3b6eb5bbdfde19e
• Marker state on that head: none on this head
• Method: read-only, full squash diff (<merge>^1..<merge>) read in full; PR head tree == squash tree (empty git diff <head> <merge>). Offline/in-memory only; no hosted CI, deploy, Secret or IAM inspection.

Findings

• P1 application/account_new_risk_gate_support.py:195 (variant at :206): after cached equity is replaced with current account NAV, a stale cached explicit drawdown_from_peak (e.g. 0) survives the native snapshot path, so a real drawdown breach is not detected (admission returns ALLOW_NEW_RISK; journal stays CLOSED). Reproduced only on a fake broker (one new-risk buy). Consumers: application/rebalance_service.py:1039, application/execution_service.py:1589, :1458.
• Not an actual trade or loss; a defect in the merged stale-fact repair. Needs regressions for both variants.
• P0: none. P2/P3: none recorded.

Scope / limits

Touches execution, risk and workflow paths (R2). 21 files, +1029/-90. A fix PR is being prepared separately; no code is changed by this comment.

Post-merge re-review. Not an approval; no review marker is issued retroactively.