my-NexusTradingForexBot/agents/change_control.md

CHANGE CONTROL REGISTRY — Nexus Scalp Engine (NSE)

Maintained per the MASTER MULTI-AGENT CONTRACT §4 (see agents/multi-agent-git-contract.md). Register a change entry BEFORE a meaningful architectural or shared-code change. Status lifecycle: PROPOSED → IMPLEMENTING → VERIFIED → READY_FOR_REVIEW → MERGED | REJECTED.

Open / recent changes

CHANGE-ID: CHG-0018
Agent: Hermes-ShadowLive70D
Role: 70D Shadow Deployment & Candidate Validation Engineer
Task: TASK-70D-SHADOW-LIVE-VALIDATION
Scope: Current-state verification (HEAD 3f3f3d9), 70D candidate discovery
       (wf_candidate DISCOVERED; NOT VALIDATED — unregistered, scalp_v4 vs
       canonical scalp_v3, missing provenance/validation), gated attach
       rejection proof (by design), Champion-unchanged + broker=0 proof,
       governance verify matrix via verify_candidate (read-only), evidence
       JSON + final docs + TEST-SHADOW-LIVE-01..20
Affected files: tests/unit/test_shadow70_live_valid.py (new),
       scratch/shadow70_live_evidence.py (new), docs/70D_SHADOW_LIVE_
       VALIDATION_FINAL.md (new), docs/agent_handoffs/TASK-70D-SHADOW-LIVE-
       VALIDATION.md (new), artifacts/validation/70d_shadow_live_evidence.json
       (new), agents/* registries
Affected functions/classes: none in src/ (read-only evidence task; reuse of
       Shadow70Runtime.attach + governance.verify.verify_candidate)
Contracts touched: SHADOW_70D v1 (reused), MODEL_GOVERNANCE v2 (reused),
       INV-018 (honored)
Runtime paths touched: NONE (no production mutation; shadow attach is
       exercised only against the runtime object in-process with a
       deliberately non-attached candidate)
Owners affected: Hermes-GovAgent8 (TASK-08 governance), TASK-04 validation
Risk: NONE (read-only; no promotion, no broker, no Champion touch)
Dependencies: TASK-05 shadow70 runtime, TASK-08 governance verify,
       TASK-04 wf_candidate artifact
Required tests: TEST-SHADOW-LIVE-01..20
Status: IMPLEMENTING

CHANGE-ID: CHG-0017
Agent: Hermes-Forensic-12
Role: Incident Correlation / Root-Cause / Recovery Diagnostics Engineer
Task: TASK-12-FORENSIC-INCIDENT-RESPONSE
Scope: Incident response layer above TASK-11 monitoring: canonical incident
       model (INC-YYYY-hex8, 8 statuses, 5 severities), correlation engine
       (fingerprint + correlation_id + ticket grouping, causal chain from
       actual timestamps), value lineage (source-of-truth traces), WHY
       workflows (blocked/closed/no-learning/no-strategy/UI-empty),
       MT5/ledger divergence + clock-skew + split-fill + outcome forensics,
       impact analysis (observed-only), non-destructive quarantine,
       recovery-plan generation (RECOMMENDED, approval-gated, no
       destructive options), incident reports (JSON+MD, secret-masked),
       AuditRepository-queued persistence via governed AUDIT-0006 migration,
       CLI `nexus incidents *`, read-only /api/diagnostics/*, Forensic
       Incident Center web tab, Telegram CRITICAL/HIGH alerts with
       throttling/dedup, worker (background, bounded, off tick path)
Affected files: src/nexus_scalp/incidents/{models,store,correlator,lineage,
       trace,impact,reports,worker,telegram,__init__}.py (new),
       src/nexus_scalp/database/registry.py (AUDIT-0006), cli/main.py +
       cli/incident_commands.py (new), web/server.py (diagnostics routes),
       Web/index.html + Web/app.js (Incident Center), tests/unit/
       test_incident_response_task12.py (62 tests), tests/integration/
       test_diagnostics_api.py, docs/70D_INCIDENT_RESPONSE_MODEL.md,
       docs/70D_INITIAL_INCIDENT_FORENSIC_REPORT.md,
       docs/70D_INCIDENT_RESPONSE_FINAL_REPORT.md, agents/* registries
Affected functions/classes: Incident, IncidentStore, IncidentCorrelator,
       LineageEngine, ImpactAnalyzer, QuarantineManager, RecoveryPlanner,
       IncidentWorker, IncidentTelegramNotifier, news_incidents,
       version_consistency, broker_ledger_divergence, clock_skew,
       split_fill_groups, outcome_forensics, learning_pipeline_rates,
       why_blocked/why_closed/why_no_learning/why_no_strategy/why_ui_empty
Contracts touched: INCIDENT_RESPONSE v1 (new), INCIDENT_CORRELATION v1
       (new), VALUE_LINEAGE v1 (new), RECOVERY_GOVERNANCE v1 (new);
       consumed: AUDIT-0006 migration (new), DB_MIGRATION v1
Runtime paths touched: web server (5 new GET routes), CLI (nexus incidents),
       live_engine NOT touched (worker available for TASK-13 wiring),
       audit.db (additive tables only)
Owners affected: TASK-11 monitoring (forensics/), TASK-13 handoff
       (worker wiring + incident console), governance (no change)
Risk: LOW — diagnostic-only; no execution/risk/policy imports; additive
       migration; all routes GET; recovery never auto-executed
Dependencies: TASK-11 forensics/ (models), AuditRepository queued writer,
       TASK-10 migration engine
Required tests: TEST-INCIDENT-01..35 + integration diagnostics API tests
Status: VERIFIED (absorbed into commit 066a7ba; quality gates clean)

CHANGE-ID: CHG-0015 Agent: Hermes-Parity Role: 70D Dataset/Replay/Inference/Runtime Contract Engineer Task: TASK-03-70D-PARITY Scope: canonical 70D feature contract (scalp_v3 = Base 0..49 + News 10D 50..59 + Liquidity 10D 60..69); deterministic feature_schema_hash; immutable 70D snapshot with provenance; dataset builder (compute_70d_frame) + quality gates + reproducibility; replay parity + anti-leakage; inference validator with explicit rejection codes; model manifest extension (feature_schema_hash, training_dataset_id) + scaler compatibility (no pad/truncate); legacy 60D protection (mismatch blocked); four News/Liquidity toggle combinations; golden corpus; real-data parity; no fake fallback values; no DB on tick hot path (INV-001). Trading behavior untouched; no Champion change; no auto-promotion. Affected files: features/schema_contract.py (new), features/schema.py, model_generation/schema_v2.py, model_generation/models.py, model_generation/news_bridge.py, model_generation/replay.py, inference validator (new module), application/live_engine.py (guarded additive hook), tests/unit/test_70d_contract_parity_task3.py, docs/70D_DATA_CONTRACT.md, docs/agent_handoffs/TASK-03-70D-PARITY.md, agents/{taskboard,change_control,contracts,runtime_invariants,repository_state,bugs}.md (additive rows) Contracts: FEATURE_SCHEMA_70D v1 (scalp_v3 70D canonical), FEATURE_SCHEMA_HASH v1 (new), INFERENCE_CONTRACT v1 (new) Risk: LOW-MEDIUM (feature-contract hardening only; live 50D hot path untouched; guarded 70D hook behind config flag) Status: IN_PROGRESS

CHANGE-ID: CHG-0014
Agent: Hermes-ModelValidation-04
Role: 70D Model Generation / Fair Benchmark / Challenger Validation
Task: TASK-04-70D-MODEL-VALIDATION
Scope: Fair scientific A/B/C benchmark protocol (50D Base / 60D Base+News /
       70D Base+News+Liquidity) with identical datasets-labels-splits-purge-
       embargo-budgets-seeds; dataset fairness + liquidity feature audit +
       walk-forward/OOS/robustness/calibration gates; BUG-101 reproducibility
       fix in CandidateTrainer (seed BEFORE model construction); TEST-70D-
       MODEL-01..25 contract suite. Benchmark EXECUTION remains BLOCKED until
       TASK-03-70D-PARITY lands (feature contract not trustworthy). No model
       was trained, no threshold changed, no auto-promotion, Champion untouched.
Affected files: src/nexus_scalp/model_generation/training.py (minimal seed-order
       fix), tests/unit/test_70d_model_validation_task4.py (new), docs/
       MODEL_BENCHMARK_70D_LIQUIDITY.md (new), docs/agent_handoffs/TASK-04-70D-
       MODEL-VALIDATION.md (new), agents/* registries
Affected functions/classes: CandidateTrainer.train_candidate (seed order only)
Contracts touched: MODEL_MANIFEST v1 (unchanged), FEATURE_SCHEMA v1
       (scalp_v4 70D registered by TASK-02 — consumed, not created)
Runtime paths touched: none (model-generation only; invariant INV-001..015 intact)
Owners affected: Hermes-70D series agents 1..3 (protocol consumer),
       Hermes-ModelGovernance (validation gates)
Risk: LOW (isolated to candidate training reproducibility; no live path)
Dependencies: TASK-03-70D-PARITY (blocking), TASK-01/02 (liquidity engine WIP)
Required tests: TEST-70D-MODEL-01..25 (18 passed / 8 skip-till-task3)
Status: VERIFIED (deliverables) — benchmark execution BLOCKED by TASK-03

```text
CHANGE-ID: CHG-0014
Agent: Hermes-GitSurveillance
Role: Multi-Agent Change Surveillance / Commit / Push / Handoff Engineer
Task: TASK-13-GIT-SURVEILLANCE
Scope: Continuous multi-agent change surveillance + commit/push governance: full
       forensic snapshot of the 70D swarm working tree (55 changed files across
       TASK-01/02/04/05/08/11/12), ownership/classification of every path,
       secret scan (PASS), shared-API alerts (schema registry, load_gate, live_engine
       hooks, AUDIT-0005), duplicate-source-of-truth scan (none), pre-existing
       failure classification (5 liquidity test failures, owner TASK-01), registry
       state synchronization, surveillance FINAL report + handoff.
Affected files: agents/bugs.md, agents/change_control.md, agents/contracts.md,
       agents/runtime_invariants.md, agents/taskboard.md, agents/repository_state.md,
       docs/TASK_13_GIT_SURVEILLANCE_FINAL.md (new),
       docs/agent_handoffs/TASK-13-git-surveillance.md (new)
Affected functions/classes: none (no production code in this change)
Contracts touched: none (registry rows only; contract state surveyed and reported)
Runtime paths touched: none
Owners affected: all 70D swarm owners (TASK-01..12) — notified via handoff
Risk: LOW (additive registry rows + docs; no code/DB/migration)
Dependencies: none (surveillance is read-only over the swarm WIP)
Required tests: TEST-GIT-01..25 (verification matrix in the FINAL report)
Status: VERIFIED (committed + pushed)

CHANGE-ID: CHG-0013 Agent: Hermes-Shadow70D Role: 70D Shadow Runtime / Drift / Champion-Safe Deployment Engineer Task: TASK-05-70D-SHADOW Scope: 70D Liquidity Shadow runtime (TASK-5/10 brief): validated-candidate gate (registry: NO_VALIDATED_CANDIDATE — 70D lineage mid-flight in parallel TASK-01..04, so Shadow infra is implemented + verified against a deterministic VALIDATED-status fixture, production runtime untouched), shadow model contract + load validation (manifest/artifact-hash/schema/ dimension/scaler), strict isolation boundary (no policy/risk/order dependency), 70D live feature build (50D canonical + 10 news + 10 liquidity when producer present; schema-controlled), feature validation (finite/range/schema/freshness/provenance), deterministic idempotent observations, disagreement taxonomy (8 classes), feature health + drift (NORMAL/WATCH/WARNING/CRITICAL), bounded queue + backpressure + async persistence (no sync DB on tick path), Claude-style structured [SHADOW70] events, web API (summary/recent/health/drift/disagreements), replay parity + live read-only smoke + Champion/broker zero-impact proof Affected files: src/nexus_scalp/shadow/shadow70/{models,runtime,health,drift, store,worker}.py (new), web/server.py, application/live_engine.py (observability hook guarded by shadow_enabled flag), Web/ panel optional, tests/unit/test_shadow70_runtime.py, tests/unit/test_shadow70_safety.py, tests/unit/test_shadow70_health_drift.py, docs/70D_SHADOW_RUNTIME.md, docs/agent_handoffs/TASK-05-70D-SHADOW.md, agents/* registries Affected functions/classes: Shadow70Runtime, Shadow70LoadValidator, Shadow70Observation, Shadow70Classification, Shadow70FeatureHealth, Shadow70DriftMonitor, Shadow70Store, Shadow70Worker (new) Contracts touched: SHADOW_70D v1 (new), SHADOW_LOAD_GATE v1 (new), SHADOW_FEATURE_HEALTH v1 (new), SHADOW_DRIFT v1 (new) Runtime paths touched: live_engine tick path — observability ONLY, wrapped in shadow70_enabled flag (default false), bounded, failure-isolated (INV-001/002/003/004/009 intact) Owners affected: Hermes-ModelGovernance (TASK-6 shadow reuse), Hermes-LiquidityFoundation (70D series), Hermes-UI (shadow panel) Risk: LOW (observability only; no execution/risk/policy path) Dependencies: TASK-6 governance (3cca598), model_lifecycle integrity, AuditRepository queued writer; 70D producer series (parallel WIP) Required tests: TEST-SHADOW-01..35 Status: IMPLEMENTING

```text
CHANGE-ID: CHG-0012
Agent: Hermes-Research
Role: Forensic Verification of Duplicate Outcome + Excursion Anomalies
Task: ANOMALY-VERIFY-01
Scope: MFE tracker seeding fix, economic-duplicate outcome guard, deterministic
       anomaly ids, incident-grouped anomaly listing (DB/API/UI)
Affected files: src/nexus_scalp/execution/order_manager.py, experience/ledger.py,
       experience/intelligence.py, intelligence/behavior.py, intelligence/store.py,
       Web/app.js, tests/unit/test_anomaly_verify01_{duplicates,mfe}.py
Affected functions/classes: _ensure_ticket_bootstrap, _update_mfe_mae,
       ExperienceLedger.owner_of_execution, record_trade_outcome,
       _trade_data_anomalies, list_anomaly_events (grouped)
Contracts touched: ANOMALY v1 (deterministic incident identity + grouping),
       TRADE_OUTCOME v3 (one economic trade == one outcome)
Runtime paths touched: order_manager MFE/MAE trackers (in-memory only, no I/O,
       no broker interaction, not on the async hot path I/O)
Owners affected: Hermes-Accounting (excursion metrics), Hermes-Learning (outcomes),
       Hermes-UI (anomaly panel)
Risk: MEDIUM
Dependencies: BUG-081/095 (split-fill context), BUG-096/097/098 (this task)
Required tests: TEST-ANOM-01..28
Status: MERGED

CHANGE-ID: CHG-0013
Agent: Hermes-ProdRel
Role: Production Deployment / Migration / Runtime Reliability Engineer
Task: TASK-09-70D-PRODUCTION-RELEASE
Scope: 70D production release layer — model artifact release packaging +
       70D/60D compatibility classification (ACTIVE/LEGACY/RETAINED/
       ARCHIVABLE) + liquidity-producer dependency check
       (MODEL_NOT_RUNTIME_COMPATIBLE, no silent fallback);
       runtime version-consistency block (app/commit/web_bundle_hash/
       feature_schema/db_schema; VERSION_INCONSISTENCY on drift);
       release manifest schema coverage (registry-derived feature_schema,
       supported_model_schemas, web_bundle_version, db_schema_version,
       required_migrations); AUDIT-0007 release_metadata migration;
       TEST-REL-01..30 acceptance suite; 3 install/deploy/update docs
Affected files: release/model_artifacts.py (new), release/versioning.py
       (new), release/packaging.py, database/registry.py,
       database/manifest.py, web/server.py, cli/main.py,
       tests/unit/test_release_{model_artifacts,versioning,manifest,
       migration_0007,acceptance}_phase19.py, docs/70D_{PRODUCTION_RELEASE_
       FORENSICS,INSTALLATION_COMPATIBILITY,PRODUCTION_DEPLOYMENT,UPDATE_AND_
       MIGRATION}.md, docs/agent_handoffs/TASK-09-70D-PRODUCTION-RELEASE.md
Affected functions/classes: generate_manifest (+_manifest_* helpers),
       RuntimeVersionBlock, compute_artifact_identity/classify_artifact/
       check_runtime_compatibility/summarize_artifacts,
       _audit_0007_release_metadata, _runtime_version_block, version_cmd,
       model_artifacts_cmd
Contracts touched: MODEL_RELEASE v1 (new), VERSION_CONSISTENCY v1 (new),
       UPDATE_SYSTEM v1 (manifest schema coverage), DB_MIGRATION v1
       (AUDIT-0007 additive release_metadata)
Runtime paths touched: /api/status versioning block (read-only addition);
       nexus version --json (additive); startup migration chain includes
       AUDIT-0007 (v6->v7); CLI model-artifacts (read-only)
Owners affected: all release consumers, web UI, DB owners (audit domain)
Risk: MEDIUM
Dependencies: TASK-9 update engine, TASK-10 migration engine, TASK-6 load
       gate, canonical schema registry (scalp_v1/v2/v4/liquidity)
Required tests: TEST-REL-01..30 (phase19 suites), TEST-UP-01..35, TEST-DBM
Status: MERGED

CHANGE-ID: CHG-0011
Agent: Hermes-Research
Role: Strategy Research / Discovery / Validation Forensic Engineer
Task: TASK-4
Scope: Research data-integrity repair: explicit eligibility audit + rejection taxonomy,
       zero-substitution rejection (UNKNOWN != 0), family-select validation, tiered
       discovery (SMALL_SAMPLE), hard evidence-floor scoring, registry immutability,
       dataset rebuild guard, /api/research/health diagnostics
Affected files: src/nexus_scalp/research/{dataset,discovery,pipeline,scoring,worker,
       registry,store}.py, src/nexus_scalp/web/server.py, tests/unit/test_research_task4_*.py,
       tests/unit/task4_research_helpers.py, tests/integration/test_research_api.py
Affected functions/classes: ResearchDatasetBuilder.evaluate_sample/audit,
       discover_candidates (tiered), ResearchPipeline._select_family, compute_strategy_score
       (evidence floor), StrategyRegistry.upsert (immutability), ResearchWorker._refresh_dataset
       (rebuild guard), research_health_summary
Contracts touched: RESEARCH_RESULT v1 (family-select evidence), TRADE_OUTCOME v3 (consumed),
       FEATURE_VECTOR_50D (schema provenance preserved)
Runtime paths touched: research worker background cycle only (off tick hot path; INV-001 intact)
Owners affected: Hermes-Research, Hermes-Accounting (research_runs consumers)
Risk: MEDIUM
Dependencies: TASK-1/2/3 outcome repair (BUG-045/073/081) — 32 zero-R outcomes remain upstream
Required tests: TEST-RS-01..26 (test_research_task4_dataset.py, test_research_task4_validation.py)
Status: MERGED

Open / recent changes (table)

CHANGE-ID	Agent	Task	Scope	Contracts	Owners	Risk	Status
CHG-0002	Hermes-TradeLifecycle	TASK-3	Canonical trade lifecycle/exit-intelligence repair: reason-code classifier fix (BUG-088), broker-outcome dedup, lifecycle finalize wiring + reversal capture (BUG-089), exit R fix	EXIT_CLASSIFICATION v3, TRADE_EXECUTION_CONTEXT v2 (unchanged), TRADE_OUTCOME v3 (extended)	Hermes-Accounting, Hermes-Behavior	MEDIUM	VERIFIED
CHG-0003	Hermes-ModelGovernance	TASK-6	New src/nexus_scalp/governance/ (load gate, truthful registry, event ledger, outcome linkage, drift/calibration, rollback, health); shadow runtime 60D-aware input alignment + news-context parity + latency telemetry; API /api/models/governance/*, /api/models/registry/reconcile, /api/models/shadow/outcomes, /api/models/promotion/approve; Telegram canonical governance report; Model Governance dashboard panel; golden fixtures; live-champion registry truthfulness fix. Does NOT touch OrderManager/RiskEngine/execution paths.	MODEL_GOVERNANCE v1, MODEL_LOAD_GATE v1, SHADOW_PARITY v1, PROMOTION_STATE_MACHINE v1 (new); MODEL_MANIFEST v1, FEATURE_SCHEMA v1 (consumed)	LiveEngine, shadow/, model_lifecycle/, web/, reporting/	MEDIUM	PROPOSED
CHG-0004	Hermes-ModelIntelligence	TASK-5	Additive 60D (scalp_v2) schema path: schema_augment.py + schema_v2.py; training/validation gate hardening; fair 8-cell benchmark matrix; truthful worker status	features/schema.py, features/schema_augment.py, model_generation/schema_v2.py, model_generation/training.py, model_generation/validation.py, model_generation/benchmark.py, model_generation/__init__.py, model_lifecycle/worker.py	FEATURE_SCHEMA v1 (scalp_v2 60D, candidate-only), MODEL_MANIFEST v1	50D hot-path untouched (INV-009); Champion path untouched	LOW
CHG-0002	Hermes-DBMigrate	TASK-10	Automatic DB migration engine: versioned per-domain migrations, baseline detection, idempotent additive migration, index management, WAL-safe backup, startup/CLI/update integration	DB_MIGRATION v1 (new), SCHEMA_MANIFEST v1 (new)	all agents (DB consumers)	HIGH	VERIFIED
CHG-0001	Hermes-Behavior	TASK-2	Behavioral/anomaly intelligence: wire BehaviorDetectionEngine into IntelligenceWorker; add evidence-based detectors; versioned idempotent persistence; report truth-states (NO_DATA/CLEAR/FLAGS_FOUND/ANOMALIES_FOUND) + coverage	BEHAVIOR_ANALYSIS v1 (new), ANOMALY v1 (new)	Hermes-Accounting (reporting), Hermes-TradeLifecycle (TASK-3)	MEDIUM	VERIFIED
CHG-0006	Hermes-DBHygiene	TASK-11	Database hygiene worker: inventory/classification matrix, deterministic duplicate+orphan detection, retention engine, archive-before-delete with hashes, bounded executor, journal, verification, CLI nexus db hygiene *, worker state	DATABASE_HYGIENE v1 (new), RETENTION_POLICY v1 (new)	all DB consumers	MEDIUM	VERIFIED
CHG-0015	Hermes-70D-Integration (TASK-2)	TASK-02-70D-INTEGRATION	70D Liquidity integration + UI/runtime control plane: scalp_v4=70D schema, features/liquidity_runtime.py governor, /api/liquidity/* endpoints, canonical liquidity section in /api/status + live/state + SSE, Liquidity Intelligence UI panel + toggle, chart overlays from real pools, TEST-70D-01..28 + API suite	LIQUIDITY_RUNTIME v1 (new), LIQUIDITY_API v1 (new), FEATURE_SCHEMA_70D v1 (scalp_v4)	live_engine (info-only hook), web/server.py, Web/	LOW	VERIFIED
CHG-0005	Hermes-TASK1 (Performance Intelligence Data-Truth Auditor)	TASK-1	Metric-truth repair (Performance Intelligence): MAE/MFE sign-convention normalization, MFE-capture portfolio-ratio semantics, fill-rate real denominator, funnel rejection re-tabulation (NO_TRADE+blocked_by), timestamp-cutoff normalization (ISO 'T' vs space), drawdown window labels (period vs 90D), model funnel new prediction_to_trade_rate	ACCOUNTING_SNAPSHOT v1 (extended: period_drawdown_pct, drawdown_window), TRADE_OUTCOME v3 (read), EXIT_CLASSIFICATION v2 (read)	Hermes-Accounting, Hermes-Behavior (reporting), Hermes-TradeLifecycle (TASK-3)	MEDIUM	VERIFIED

CHANGE-ID: CHG-0001
Agent: Hermes-Behavior
Role: Behavioral Intelligence / Anomaly Detection Forensic Engineer
Task: TASK-2
Scope: Behavioral + anomaly intelligence pipeline (detector invocation, evidence-based
       detectors, versioned idempotent persistence, truthful report states)
Affected files: src/nexus_scalp/intelligence/behavior.py, worker.py, store.py,
       adapters/database/audit_repository.py (schema add), reporting/engine.py,
       reporting/models.py, reporting/insights.py, reporting/telegram_format.py,
       reporting/__init__.py, application/live_engine.py (worker tick only),
       web/server.py (API contract), tests/unit/test_behavior_anomaly_intelligence_phase16.py
Affected functions/classes: BehaviorDetectionEngine.analyze, IntelligenceWorker._refresh_once,
       PerformanceReportEngine._stage_behavioral, compute_anomalies, formatters
Contracts touched: BEHAVIOR_ANALYSIS v1 (new), ANOMALY v1 (new)
Runtime paths touched: IntelligenceWorker background tick (30s cadence, off hot path)
Owners affected: Hermes-Accounting (reporting contract), Hermes-TradeLifecycle (TASK-3)
Risk: MEDIUM
Dependencies: BUG-081/082 ledger/exit normalization; TASK-1; TASK-3 (sequential consumer)
Required tests: TEST-BHV-01..20 (tests/unit/test_behavior_anomaly_intelligence_phase16.py)
Status: MERGED

Template

CHANGE-ID: CHG-XXXX
Agent: <name>
Role: <role>
Task: <task>
Scope: <scope>
Affected files: <files>
Affected functions/classes: <fns>
Contracts touched: <contracts>
Runtime paths touched: <paths>
Owners affected: <owners>
Risk: LOW | MEDIUM | HIGH | CRITICAL
Dependencies: <deps>
Required tests: <tests>
Status: PROPOSED | IMPLEMENTING | VERIFIED | READY_FOR_REVIEW | MERGED | REJECTED
CHANGE-ID: CHG-0016
Agent: Hermes-LiqOptAgent6
Role: Liquidity Optimization Engineer
Task: TASK-06-70D-LIQUIDITY-OPTIMIZATION
Scope: Liquidity Intelligence 10D (indices 60..69 scalp_v4 / 50..59 scalp_liquidity_v1) forensic optimization: baseline measurement (real M5),
       redundancy analysis vs Base 50D + News, bounded parameter search (EQH/EQL tolerance, confluence cutoff, sweep detection thresholds,
       HTF weights, displacement window) with temporal train/validation/OOS discipline, golden dataset A/B comparison, TEST-LIQ-OPT-01..28,
       algorithm versioning (liquidity-v1 -> liquidity-v1.x). NO production activation: candidate-only.
Affected files: src/nexus_scalp/features/liquidity_engine.py (parameterization, ONLY when evidence-justified), docs/LIQUIDITY_70D_OPTIMIZATION_REPORT.md,
       docs/LIQUIDITY_70D_IMPLEMENTATION_MAP.md, tests/unit/test_liquidity_optimization_phase19.py (new), agents/* registries
Contracts touched: none (50D Base + News unchanged; liquidity family contract preserved; version bump only)
Owners affected: Hermes-Parity (TASK-3), Hermes-ModelValidation-04, Hermes-Shadow70D, Hermes-LiquidityResearch (TASK-7)
Risk: LOW (candidate-only; no live switch; no execution path)
Dependencies: TASK-01..05 70D series landed; TASK-03 parity in flight
Status: IN_PROGRESS

Notes

• Substantial tasks also get a TASK-ID in agents/taskboard.md and a handoff in docs/agent_handoffs/.
• Reference CHANGE-ID in PRs/issues alongside BUG-NNN / TASK-ID (contract §42). CHANGE-ID: CHG-0019 Agent: Hermes-Forensic-70D-UI Role: Debug UI / Runtime Observability Engineer Task: TASK-70D-DEBUG-CONSOLE Scope: Debug tab upgraded into full 70D runtime intelligence console. One canonical /api/debug/state snapshot (18 sections) rendered by the UI — the frontend never computes trading intelligence. Registry-driven 70D feature matrix (schema_contract scalp_v3), contract validation (70D CONTRACT BROKEN / MODEL CONTRACT INVALID incl. actual_classes=128 regression), confidence pipeline, policy gate trace, risk/exposure/execution/positions/exit forensics, liquidity context, news, workers, database, caches, chart, SSE diagnostics, snapshot capture/compare/diff. TEST-DEBUG-01..32. Affected files: src/nexus_scalp/web/debug_snapshot.py (new), src/nexus_scalp/web/server.py (/api/debug/state + snapshots + compare + SSE diagnostics), src/nexus_scalp/application/ live_engine.py (_last_model_input_tensor stash), Web/index.html, Web/app.js (Debug tab rebuild), tests/unit/ test_debug_snapshot_phase20.py (new, 36 tests), docs/DEBUG_70D_FORENSIC_UPGRADE_FINAL.md (new), docs/agent_handoffs/2026-08-19_Hermes-Forensic-70D-UI_debug-console.md Contracts: DEBUG_SNAPSHOT v1 (canonical /api/debug/state payload), FEATURE_SCHEMA_70D v1 (scalp_v3 registry-driven rendering) Status: MERGED

CHANGE-ID: CHG-0020
Agent: Hermes-SecurityHardening
Role: CodeQL Security Alert Remediation
Task: BUG-113 (16 GitHub code-scanning alerts: 12 py/exception-information-exposure, insecure temp file, clear-text storage, URL sanitization)
Scope: All exception handlers in web/server.py diagnostics/debug/db-status/deploy-gate/SSE paths now return sanitized _err() envelopes and generic codes; full detail only in server logs. Incident report writes wrapped in restrictive umask (0o077; no-op on Windows). Worker-stall probe test uses TemporaryDirectory. Git-remote URL test uses host-boundary urlsplit check. incidents/__init__ __all__ completed (4 constants).
Affected files: src/nexus_scalp/web/server.py, src/nexus_scalp/incidents/reports.py,
       src/nexus_scalp/incidents/__init__.py, tests/unit/test_incident_response_task12.py,
       tests/unit/test_git_surveillance_task13.py, agents/bugs.md (BUG-113)
Affected functions/classes: get_db_hygiene, get_diagnostics_incidents,
       get_diagnostics_incident, get_diagnostics_health, get_diagnostics_lineage,
       get_diagnostics_forensics, get_diagnostics_incident_report,
       get_diagnostics_incident_zip, get_diagnostics_search, get_debug_state,
       get_db_migration_status, get_forensic_health, sse_telemetry_stream,
       write_incident_reports (+_restrictive_umask), incident package __all__
Contracts touched: NONE (response shapes unchanged for success paths; error envelopes
       already standardized via safe_error_payload; DB_MIGRATION_FAILED /
       FORENSIC_ENGINE_UNAVAILABLE error codes keep their previous string values)
Runtime paths touched: /api/diagnostics/*, /api/db/hygiene, /api/db/status,
       /api/debug/state, /api/forensics/health, /api/ticks/stream error frame
Owners affected: TASK-12 incidents (Hermes-IncidentResponse) — error envelope now
       sanitized; TASK-70D-DEBUG-CONSOLE (Hermes-Forensic-70D-UI) — debug snapshot
       reason is generic code; BUG-110 SSE diagnostic — field names preserved
Risk: LOW — error responses change from raw-exception text to generic codes;
       success-path payloads unchanged; detail remains in existing structured logs
Dependencies: BUG-110 SSE canonical_json, TASK-12 incidents store/reports
Required tests: tests/unit/test_incident_response_task12.py,
       tests/unit/test_git_surveillance_task13.py (87 passed)
Status: MERGED

CHANGE-ID: CHG-0021
Agent: AGENT-12
Role: Continuous Forensic Monitoring & Production Safety Engineer
Task: TASK-12-POST-70D-MONITORING
Scope: Canonical deploy gate (deploy_gate.py, DEPLOY_POLICY, fail-safe
       FORENSIC_ENGINE_UNAVAILABLE, evidence JSON), beforePush.sh/ps1 step
       5/5, experience-gap forensics (first-divergence, s18 taxonomy,
       defect-rate semantics - corrects CHECK-ACC-04 misattribution), news
       source classification (s14 taxonomy, 200-but-wrong proven), liquidity
       golden-reference freeze (LIQUIDITY_70D_GOLDEN_BASELINE.json@4455874),
       dual-registry governance + fingerprint cross-verify (CHECK-GOV-01/02),
       bounded Telegram periodic report (config-driven, dedup), trend
       analysis, CLI forensic --deploy-gate/--trend/--gap/--report,
       TEST-POST70D-01..28
Affected files: forensics/{deploy_gate,experience_gap,news_sources,
       telegram_report,trend}.py (new), forensics/{checks,engine,
       references,__init__}.py (extended), cli/main.py, beforePush.sh/ps1,
       configs/base.yaml (forensic_report), docs/POST_70D_DEPLOY_GATE.md +
       TASK-12 final + anomaly audit + performance, tests/
Contracts touched: DEPLOY_GATE v1 (new), EXPERIENCE_GAP v1 (new),
       NEWS_SOURCE_CLASSIFICATION v1 (new)
Runtime paths touched: none (read-only monitoring; CLI/API/worker only)
Owners affected: TASK-8 governance (stale champion rows), Hermes-News (200-but-wrong)
Risk: LOW
Dependencies: TASK-11 monitoring engine, 70D golden baseline
Required tests: TEST-POST70D-01..28, TEST-MONITOR-01..36
Status: READY_FOR_REVIEW

CHANGE-ID: CHG-0019
Agent: Hermes-CI-Isolation
Role: CI / GitHub Actions Pipeline Engineer
Task: TASK-CI-ISOLATION
Scope: GitHub Actions CI isolation & test branch. Audited all 4 workflows
       (ci/release/docker/security). ci.yml split: 'quality' (ruff/mypy/
       unit+coverage) runs on every push+PR to main|develop; new 'heavy-ci'
       matrix (integration / e2e-playwright / research-backtest / model-
       validation) runs ONLY on the ci-tests branch or manual dispatch
       (inputs.full=true). security.yml: push trigger replaced by ci-tests
       branch + PR + weekly schedule + dispatch. docker.yml + release.yml:
       triggers preserved (comment-only). concurrency groups added to
       ci.yml (already present) + security.yml. ci-tests branch created
       from origin/main. Actionlint-validated (all files pass; release.yml
       pre-existing ::set-output deprecation warning at line 247 NOT
       modified — out of scope).
Affected files: .github/workflows/ci.yml (rewritten), .github/workflows/
       security.yml (rewritten), .github/workflows/docker.yml (comment
       only), agents/change_control.md, agents/taskboard.md,
       agents/repository_state.md (append-only rows)
Affected functions/classes: NONE in src/ (workflow YAML only)
Contracts touched: CI_TRIGGER_POLICY v1 (heavy CI only on ci-tests /
       dispatch; security weekly+PR; docker/release unchanged)
Runtime paths touched: NONE (no application code, no DB, no hot path)
Owners affected: Hermes-Release (release.yml untouched), Hermes-DevOps
       (workflow owners)
Risk: LOW. Heavy CI no longer runs on every push — intentional (objective).
       PR validation + security PR scans + release triggers preserved.
Dependencies: none
Required tests: actionlint .github/workflows/*.yml (0 errors on changed
       files), YAML parse, branch filter cross-check
Status: MERGED

CHANGE-ID: CHG-0022
Agent: Hermes-CI-Reporting
Role: CI / GitHub Actions Pipeline Engineer
Task: TASK-CI-REPORTING
Scope: Unified CI results system (ci-results/) for the quality job incl.
       ruff JSON + lint.txt, format.txt, mypy text + junit, pytest
       junit.xml + log + cobertura coverage.xml + htmlcov, run-info/
       (metadata.json, summary.md, manifest.json, SHA256SUMS.txt,
       per-check status json, secrets-present.json), $GITHUB_STEP_SUMMARY,
       one canonical artifact per run (30-day retention), final gate
       preserving real failure exits. Heavy-ci matrix arms (integration /
       e2e / research-backtest / model-validation) each produce their own
       artifact; aggregate job merges into ONE canonical ci-results
       artifact. docs/ci-secrets.md added. release.yml ::set-output
       deprecation fixed via $GITHUB_STEP_SUMMARY (arm64-report job).
       Scripts: scripts/ci/make_ci_results.py (authoritative result
       pipeline, validated end-to-end locally).
Affected files: .github/workflows/ci.yml (extended: heavy-ci + aggregate +
       unified reporting), .github/workflows/release.yml (::set-output ->
       GITHUB_STEP_SUMMARY), scripts/ci/make_ci_results.py (new, from
       parallel agent — adopted + verified), docs/ci-secrets.md (new),
       agents/change_control.md, agents/taskboard.md, agents/repository_state.md
Affected functions/classes: NONE in src/ — workflow YAML + CI scripts only
Contracts touched: CI_RESULTS v1 (canonical reporting layout), CI_TRIGGER_POLICY
       v1 (unchanged: heavy CI only on ci-tests/dispatch)
Runtime paths touched: NONE (no application code)
Owners affected: none (release workflow triggers unchanged)
Risk: LOW. Reporting-only additions; failure semantics preserved (final
       gate fails on any check failure; artifacts still uploaded on failure).
Dependencies: none
Required tests: actionlint all workflows (0 errors); make_ci_results.py
       exercised end-to-end locally (init/check/summary/manifest/checksums);
       release.yml diff review; live GitHub run verification pending
Status: VERIFIED

CHANGE-ID: CHG-0023
Agent: Hermes-CI-Lint
Role: CI / lint gate engineer
Task: TASK-CI-LINT-FIX
Scope: Fix GitHub Actions quality gate (ruff check/format) broken by
       unpinned ruff (>=0.2.0 -> latest 0.16.3 flagging 141 lint errors
       across scratch/ probes). Pin ruff==0.16.3 in pyproject dev extras
       (reproducible CI), fix all lint errors in tracked files (import
       sorting/placement, unused imports, semicolon statements, percent
       format -> f-strings, B023 lambda loop-var binding, RUF034
       redundant hasattr, PLR0124 psi!=psi -> math.isnan, PLW2901 loop
       var, B007 unused loop vars, PLW1510 subprocess check=False,
       zip strict=, UP017 datetime.UTC), ruff-format all tracked files.
       Parallel-agent WIP files (Web/, src/ live_engine etc.) NOT
       touched; scripts/ci/*, tests/conftest.py, 3 test files formatted
       to keep `ruff format --check .` green repo-wide.
Affected files: pyproject.toml (ruff pin), scratch/*.py (~40 probes),
       scripts/ci/{make_ci_results,collect_results}.py,
       tests/conftest.py, tests/unit/test_70d_parity_task3.py,
       tests/unit/test_debug_snapshot_phase20.py,
       tests/unit/test_incident_response_task12.py,
       tests/unit/test_release_*_phase19.py (+7 format-only test files),
       agents/{change_control,taskboard}.md
Affected functions/classes: NONE in src/ (scratch/scripts/tests/lint only)
Contracts touched: none (no src/ behavior change)
Runtime paths touched: NONE
Owners affected: all scratch/ owners (format/lint normalization only)
Risk: LOW. Lint/format-only; no runtime behavior change. ruff pinned to
       the CI-verified version so local == CI.
Dependencies: none
Required tests: ruff check . (clean), ruff format --check . (clean),
       mypy src (clean), pytest tests/unit
Status: VERIFIED

CHANGE-ID: CHG-0024
Agent: Hermes-SecurityAudit
Role: GitHub Security & Quality audit engineer
Task: TASK-SEC-AUDIT
Scope: Residual GitHub code-scanning batch (BUG-121): webfonts route
       rewritten to listing-match (no user input in path expressions),
       debug_snapshot section handlers + research health return stable
       error markers (exception detail server-side via logger), incident
       reports gain value-level secret-shape redaction. All 4 workflow
       files' third-party actions pinned to immutable commit SHAs
       (trivy-action was on @master). Dependabot vulnerability alerts +
       automated security updates enabled at repo level (were disabled).
       ruff exclude added for scratch/ + _cleanup_hold_20260819 so
       parallel-agent probe WIP cannot break CI. pip-audit on the venv:
       no known vulnerabilities. No trading/risk/model code touched.
Affected files: src/nexus_scalp/web/server.py, web/debug_snapshot.py,
       incidents/reports.py, research/store.py, tests/unit/
       test_frontend_assets_phase14.py (absorbed in 4f45a26),
       test_debug_snapshot_phase20.py, test_incident_response_task12.py,
       tests/integration/test_research_api.py, pyproject.toml,
       .github/workflows/{security,ci,docker,release}.yml,
       agents/{bugs,change_control}.md
Affected functions/classes: serve_fa_webfont (server.py); 9 snapshot
       section handlers + _safe (debug_snapshot.py); mask_secrets +
       _SECRET_VALUE_RE (reports.py); research_health_summary
       (research/store.py)
Contracts touched: WEB_FONT_SERVING v2 (listing-match, 404 semantics
       preserved), DEBUG_SNAPSHOT error contract (stable reason codes,
       exception text removed from wire), INCIDENT_REPORT_MASKING v2
       (value-level redaction), CI action pinning policy (SHA-only)
Runtime paths touched: web webfont serving, /api/debug/state,
       /api/research/health, incident report writes (all error paths
       only - happy paths byte-identical)
Owners affected: none (error-path contract changes only; UI reads
       available/reason fields which remain)
Risk: LOW. Error paths never change trading behavior; webfonts serves
       the same 8 real files; masking only redacts secret shapes.
Dependencies: none
Required tests: ruff check . (clean), ruff format --check (clean on
       src+tests+scripts), mypy src (clean), pytest unit + research API
       (targeted suites), 153 tests in the 4 touched suites pass
Status: VERIFIED

CHANGE-ID: CHG-0025
Agent: Hermes-CI-Ready
Role: CI / GitHub Actions Pipeline Engineer
Task: TASK-CI-READY
Scope: Enterprise GitHub Actions modernization — workflows only, NO
       application code. Records pre-existing CI reliability findings
       (order-dependent flakiness, parallel-WIP interactions,
       environment-dependent failures) as SEPARATE findings with CI-side
       remedies (sharding, isolation, retries, timeouts) — never by
       weakening tests. Deliverables: timeouts/retries/concurrency
       hardening, artifact orchestration + verification (checksums/SBOM),
       test result aggregation, GitHub API-safe behavior, summaries,
       Telegram HTML observability.
Affected files: .github/workflows/*.yml, scripts/ci/*, docs/CI_RELIABILITY_FINDINGS_2026-08-19.md, agents/registries
Contracts touched: CI_RESULTS v1 (extended), CI_TRIGGER_POLICY v1 (extended)
Risk: LOW (workflows/scripts only; no src/ runtime paths)
Dependencies: TASK-CI-ISOLATION, TASK-CI-REPORTING
Required tests: actionlint on all workflows, YAML parse, dry-run artifact flow
Status: IN_PROGRESS

CHANGE-ID: CHG-0026
Agent: Hermes-CI-Telegram
Role: CI/CD Observability & Notification Engineer
Task: TASK-CI-TELEGRAM
Scope: Enterprise Telegram CI/CD observability layer (spec: HTML-format,
       split/HTML-safe, secret-redacted, file-uploading, isolated).
       New src/ modules: observability/telegram_html.py (central HTML
       renderer + esc() + split_html_message with tag-safe splitting,
       Unicode/Persian-safe), observability/telegram_transport.py
       (sendDocument upload + captions + redact_secrets for text/files),
       observability/ci_telegram_reporter.py (orchestrator reading
       ci-results/run-info, junit wrapper, coverage; chat-id resolution
       TELEGRAM_CHAT_ID > NEXUS_TELEGRAM_ADMIN_ID). CLI
       scripts/ci/telegram_notify.py (run-started/run-finished/
       test-summary/artifacts/release-*/push/pr; ALWAYS exit 0 so CI
       never fails on Telegram). ci.yml wired: Telegram - CI started/finished
       steps (advisory, continue-on-error). docs/ci-telegram-operations.md
       (config, chat-id how-to, retry/timeout/redaction policy),
       docs/ci-secrets.md (+TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID rows).
       Tests: tests/unit/test_telegram_html.py (36) +
       test_ci_telegram_reporter.py (20) — HTML escaping, malformed
       values, long-message splitting, Persian/Unicode, redaction,
       file uploads, missing/oversized files, chat-id resolution
       (incl. USER_ID), failure isolation.
       Enterprise wiring: USER_ID accepted as Telegram destination
       (fallback < TELEGRAM_CHAT_ID); release.yml concurrency guard
       (per-tag, no cancel), Telegram release started/gates/finished
       steps + POST-RELEASE VERIFICATION (API re-fetch: tag match +
       assets present); docker.yml concurrency + 40m timeout;
       security.yml Telegram security result step; CLI gains
       'security' subcommand.
Affected files: src/nexus_scalp/observability/{telegram_html,telegram_transport,
       ci_telegram_reporter}.py (new), scripts/ci/telegram_notify.py (new),
       .github/workflows/ci.yml (telegram env + 2 notify steps),
       docs/{ci-telegram-operations,ci-secrets}.md,
       tests/unit/{test_telegram_html,test_ci_telegram_reporter}.py,
       agents/{change_control,taskboard}.md
Contracts touched: TELEGRAM_OBSERVABILITY v1 (new; canonical HTML message
       vocabulary + correlation id NEXUS-CI-<run>-<sha4>); CI_RESULTS v1
       (consumed: run-info/*.json, junit.xml, coverage.xml)
Runtime paths touched: NONE (src/ additions only; no trading/execution/ML
       code modified; existing TelegramNotifier untouched)
Owners affected: TASK-CI-READY (CHG-0025) — complementary: this is the
       library+CLI+tests; CHG-0025 keeps workflow hardening
Risk: LOW. All new modules; CI fails never on Telegram errors; messages
       redacted before send; no secrets referenced in logs/artifacts
Dependencies: TASK-CI-REPORTING (ci-results), CHG-0024 (secrets doc)
Required tests: pytest tests/unit/test_telegram_html.py
       tests/unit/test_ci_telegram_reporter.py (55 passed); ruff check +
       format on all new files; actionlint on ci.yml
Status: READY_FOR_REVIEW

CHANGE-ID: CHG-0023
Agent: Hermes-CI-Reporting
Role: CI / GitHub Actions Pipeline Engineer
Task: TASK-CI-REPORTING (follow-up)
Scope: Live-verification fixes on the unified CI results system:
       1. heavy-ci + aggregate jobs now use if: always() && (ci-tests ||
          dispatch full=true) so a failing quality job no longer silently
          skips the entire heavy matrix (verified live on run 32283621817:
          all 4 heavy arms executed despite quality failure).
       2. Aggregate job merge fixed: download-artifact extracts artifact
          CONTENTS at artifacts/<name>/ (no ci-results/ wrapper); the loop
          now copies each arm's contents into ci-results/heavy/<suite>/ and
          quality(-CI) into the top level, then make_ci_results.py summary +
          manifest regenerate over the merged tree (verified live on
          run 32290418115: aggregate upload succeeds).
       3. Artifact naming made collision-free: quality uploads as
          ci-results-quality-..., arms as ci-results-<suite>-..., aggregate
          as ci-results-<workflow>-...-aggregate (parallel agent's naming
          adopted where present).
Affected files: .github/workflows/ci.yml (job ifs + aggregate merge loop +
       artifact names)
Affected functions/classes: NONE in src/ — workflow YAML only
Contracts touched: CI_RESULTS v1 (aggregate layout: quality top-level +
       heavy/<suite>/), CI_TRIGGER_POLICY v1 (unchanged)
Runtime paths touched: NONE
Owners affected: none (actions SHA-pinning landed separately via
       Hermes-SecurityAudit 4b01a3e/9fc0972)
Risk: LOW (workflow-only; failure semantics preserved)
Dependencies: CHG-0022 (unified results)
Required tests: actionlint clean; merge layout simulated locally; live
       GitHub runs verified (quality artifact + per-arm artifacts + aggregate)
Status: VERIFIED

CHG-0027 — Client CLI Update Engine v2: exact-release identity, checksum-asset digests, stage-differentiated commands (TASK-UPDATER-02, 2026-08-20)

Status: VERIFIED Agent: Hermes-UpdateCLI Scope: src/nexus_scalp/release/updater.py, src/nexus_scalp/cli/main.py, docs/RELEASE.md, tests/unit/test_release_update_phase17.py Change:

• Release selection now locks an exact identity (release_id, tag, commit_sha, published_at) before download; draft releases and REVOKED markers are never eligible.
• SHA-256 digests resolved from the release's own checksum assets (GitHub gh-md5-style algorithm=gzip uploads) with per-asset manifest/checksum-file cross-verification; a release without a resolvable digest is SECURITY_BLOCKED.
• --include-prerelease / --allow-downgrade explicit opt-ins; --force remains LIVE-quiesce authorization.
• Retry/backoff (429 Retry-After honored), resumable-download hash now computed over full bytes, ETag/If-None-Match metadata cache + --force refresh, offline -> NETWORK_UNAVAILABLE.
• Installed-release local state written post-install; nexus update check|latest|download|install|verify, nexus release info, unified exit-code table. Invariants touched: UPDATE PROTOCOL v2 (additive; all prior UPDATE PROTOCOL v1 semantics retained). Tests: TEST-UP-36..60 in tests/unit/test_release_update_phase17.py. Risk: additive; no change to LIVE-safety, backup, migration or rollback contracts.

CHANGE-ID: CHG-0028
Agent: Hermes-LogArchitect
Role: Observability / Structured Logging Architecture Engineer
Task: Master Structured Logging & Organized Log Storage brief
Scope: Centralized severity-split date-organized logging engine
       (src/nexus_scalp/observability/logging.py): logs/<severity>/YYYY/MM/
       YYYY-MM-DD.log tree, ISO-8601+03:30 timestamps, stable event names +
       category + NEXUS-* error codes, correlation/run/generation/strategy
       context fields, daily + size rotation (part-NNN, zero-loss), per-severity
       retention + hourly prune (archive never auto-deleted), key-based +
       high-entropy redaction (BUG-121), ANSI-free plain-text error files with
       full stack traces, process-wide write lock. Call sites: launcher,
       LiveEngine.start(), train_model. Tests: tests/unit/test_logging.py
       (14 tests: routing/stack/redaction/correlation/rotation/retention).
Affected files: src/nexus_scalp/observability/logging.py (rewrite),
       NexusTradingForexBot.py, src/nexus_scalp/application/live_engine.py,
       src/cli/train_model.py, tests/unit/test_logging.py (rewrite),
       docs/agent_handoffs/Hermes-LogArchitect-structured-logging.md
Affected functions/classes: configure_logging (log_file_path now base dir +
       retention_days), get_logger (unchanged), log_event (new),
       bind_correlation_id (new), DatedRotatingFileHandler (new),
       _LevelMatchFilter (new), _prune_old_logs (new)
Contracts touched: OBSERVABILITY v2 (severity-split layout), INV-001 honored
       (no sync I/O added to tick path beyond the existing throttled sink)
Runtime paths touched: boot path (launcher/live_engine.start/train_model)
Commits: 7c19a34, 208eebe, df5c1e2, efa2afa, 96d7c82 (local)
Status: VERIFIED (14 tests PASS; acceptance run produced info/warning/error/
       critical files with stacks, redaction, correlation; rotation zero-loss;
       retention verified) -> READY_FOR_REVIEW

CHANGE-ID: CHG-0019 Agent: Hermes-LiquidityCompat Role: Liquidity-Model Compatibility Engineer Task: BUG-123 — contract-based model compatibility for Liquidity Intelligence Scope: liquidity_runtime.py (resolve_model_compatibility engine, governor model contract + compatibility_contract + report contract sections), Web UI (Model Contract/Reason cells, State Revision row), tests (test_liq_bug123_01..16), proof artifact (liq70_proof scalp_v3 70D) Affected files: src/nexus_scalp/features/liquidity_runtime.py, Web/index.html, Web/app.js (absorbed via parallel commit), tests/unit/test_liquidity_runtime_integration_phase18.py, tests/integration/test_liquidity_api.py, scratch/fix_70d_proof_artifact.py (new artifact builder) Affected functions/classes: resolve_model_compatibility (contract engine), model_schema_family, build_model_compatibility_contract, LiquidityGovernor.model_contract/compatibility_contract/model_compatibility, report() (liquidity_contract + snapshot_coherence_revision), snapshot_payload (per-value normalization/validity) Contracts touched: LIQUIDITY_70D v1 (reason vocabulary + contract descriptor), INV-022 (new), schema_contract reused Runtime paths touched: /api/liquidity/state, /api/liquidity/features, /api/status liquidity section, Debug console liquidity section (all derive from governor.report()); NO model inference path changed Owners affected: our liveness of the 70D candidate (TASK-04/05/09), UI consumers of the reason string (docs/LIQUIDITY_UI_FORENSIC*) Risk: LOW. The compatibility verdict for the CURRENT production champion (50D) remains BLOCK (truthful); only the reason + contract detail changed. No padding/truncation anywhere. Dependencies: schema_contract (canonical 70D), ChampionManager (BUG-118) Required tests: test_liq_bug123_01..16 (all pass; suites 73 passed) Status: VERIFIED

CHANGE-ID: CHG-0029
Agent: Hermes-DBHygiene
Role: Database Hygiene / Runtime Data Integrity Engineer
Task: TASK-22-DB-HYGIENE-RUNTIME
Scope: Continuous runtime database hygiene engine on top of the TASK-11
       worker. New hygiene/ modules: quarantine.py (DataQuarantine store,
       MOVE->MARK->REPORT, restore/resolve, provenance), consistency.py
       (read-only rule engine: trade/ledger/dataset/news validation),
       index_health.py (missing/duplicate/unused index advisory +
       QUERY_HEALTH_REPORT), report.py (DATABASE_HYGIENE_INITIAL_REPORT +
       cycle telemetry + Telegram report text), hygiene_runtime.py
       (RuntimeCleanupScheduler conductor: config cadence, first-run audit,
       deep maintenance, telegram cooldown). Config: database_hygiene
       section in configs/base.yaml + DatabaseHygieneConfig/RetentionsConfig.
       Wiring: live_engine tick loop (scheduler replaces bare worker),
       /api/db/hygiene (runtime + quarantine), CLI nexus db hygiene
       health|cleanup --dry-run|--deep|quarantine, Web Database Health Panel
       (fixes previously-dead loadHealthPanel button, BUG-119 pattern).
Affected files: hygiene/{quarantine,consistency,index_health,report,
       hygiene_runtime}.py, configuration/config.py, configs/base.yaml,
       application/live_engine.py, cli/db_commands.py, web/server.py,
       Web/{index.html,app.js}, tests/unit/test_database_hygiene_task11.py,
       docs/agent_handoffs/Hermes-Hygiene-Runtime-TASK22.md
Contracts touched: DATABASE_HYGIENE v2 (runtime scheduler + quarantine +
       consistency + index health), RETENTION_POLICY v1 (unchanged)
Risk: LOW (runtime cycles default dry_run=True; deletes require
       apply_deletes + non-LIVE execution; schema changes still go through
       TASK-10 migrations; index findings are advisory only)
Dependencies: TASK-11 hygiene worker, TASK-10 migrations, TASK-12 telegram
Required tests: TEST-HYG-37..48 (scheduler, first-run audit, quarantine,
       consistency, index health, dry-run, protected data, telemetry, budget)
Status: VERIFIED (49 tests in file PASS; ruff+format+mypy clean)

## CHG-0028 — EXEC trace-id observability: single execution_id across signal→dispatch→broker (BUG-124, 2026-08-20 Hermes-Forensic-ExecAudit)

Change: Add `TradeProposal.execution_id` (EXEC-YYYYMMDD-HHMMSS-xxxxxx) stamped once per evaluation in SignalPolicy.evaluate_probabilities and carried into every proposal; `[EXEC_TRACE]` structlog line per finalized decision; dispatch_order embeds `| exec=<id>` in audit_orders.reason; new read-only endpoint GET /api/debug/trace/{execution_id}.
Scope: src/nexus_scalp/domain/models.py, src/nexus_scalp/signals/policy.py, src/nexus_scalp/execution/order_manager.py, src/nexus_scalp/web/server.py, tests/unit/test_policy.py, tests/unit/test_domain_models.py
Why: Forensic audit found NO positions opened (stacked filter deadlock). The trace id is the observability prerequisite to attribute every future rejection to its exact gate — without weakening any safety gate.
Migration: none (additive optional field; DB schema unchanged; reason-string embeds the id).
Verification: VERIFIED — 12 policy/domain tests + 38 debug-snapshot tests PASS; live probe `[EXEC_TRACE] execution_id=EXEC-20260820-002033-d783c9 action=NO_TRADE blocked_by=ASYMMETRIC_RR_LIMIT stage=STANDARD_EVAL`.
Risk: minimal — observability only; no decision/behavior change.

## CHG-0029 — Stash reconciliation: DB-portability settings canonicalization + logging-test fix + DDL literal porting (2026-08-20 Hermes-StashMerge)

Change: (1) settings/service.py set_postgres_config/set_database_provider canonicalized to PG_CONFIG_SETTING_KEY json row + PG_PASSWORD_SECRET_KEY secret-store + provider/domain fields, aligned with database/config.py readers (verified end-to-end load_database_config -> resolve_password); (2) database/config.py load_database_config accepts dict OR string for the persisted json row; (3) ddl_port.py normalizes SQLite double-quoted string literals to single-quoted for PG (identifiers preserved); (4) test_logging.py event-name parser fixed (was asserting wrong token from the severity-split renderer).
Scope: src/nexus_scalp/settings/service.py, src/nexus_scalp/database/config.py, src/nexus_scalp/database/ddl_port.py, tests/unit/test_logging.py, tests/unit/test_settings_subsystem_bug072.py, tests/unit/test_database_portability.py
Why: HEAD persisted PG config per-key (database.postgres.*) while config.py/health.py read the canonical key — `nexus db postgres set` data was never consumed (host fell back to localhost). test_logging had 4 failing routing tests from an outdated token split. Ported DDL could break under PG for double-quoted literals.
Migration: none — old per-key rows are ignored (fresh write required), matching prior behavior; no DB schema change.
Verification: VERIFIED — end-to-end probe (set -> load -> resolve password == S3cret!), test_settings_subsystem_bug072 22 passed, test_database_portability TestDdlPorting 7 passed, test_logging 13 passed; ruff + mypy clean.
Risk: low — additive alignment; heuristic literal classifier documented; settings writes are CLI/API only (not hot path).

## CHG-0030 — Isolated strategy research store (SQLite+PostgreSQL) (2026-08-20 Hermes-StrategyIsolation)

Change: generated-strategy research memory moved OUT of the audit DB into a dedicated portable store.
(1) NEW src/nexus_scalp/strategies/research_store.py — StrategyResearchStore over the DatabaseDriver
abstraction (SQLite artifacts/strategies.db default, PostgreSQL via NSE_PG_TEST_URL / config): 8 tables
(7 factory tables + strategy_research_meta), provider-portable DDL via ddl_port.port_create_table,
idempotent ensure_schema, explicit-commit writes (driver auto-commit gap: SQLite execute/upsert without
an explicit connection rolls back silently — verified). (2) factory/store.py dual-backend dispatch: every
function accepts either AuditRepository (legacy audit queue) or StrategyResearchStore (isolated);
_resolve_backend duck-types on 'driver'. (3) factory/orchestrator.py StrategyFactory gains store= param +
_research_backend property; 27 store-function call sites route through it; strategy_registry reads stay on
the audit repo (shared validation truth). (4) live_engine.py opens the isolated store at startup
(fallback to audit queue on failure); factory wired with store=_strategy_store. (5) factory_routes.py UI
reads through factory._research_backend. (6) provider.py 'strategies' domain registered.
Scope: new src/nexus_scalp/strategies/research_store.py, new tests/unit/test_strategy_research_store.py,
src/nexus_scalp/strategies/factory/store.py, orchestrator.py, src/nexus_scalp/application/live_engine.py,
src/nexus_scalp/web/factory_routes.py, src/nexus_scalp/database/provider.py
Why: generated strategies are research memory, not trade truth — they must not grow inside the live audit
path. Audit DB stays small/fast for order/signal/ledger truth. Same store code runs on SQLite and PG.
Migration: none for existing DBs — audit_orders execution_id column already migrated by 474f7f2
(verified in error-log forensics: errors stopped at 09:50, engine restarted 09:59/10:04 on fixed code).
Verification: VERIFIED — 74 passed / 13 skipped (PG arm) across test_strategy_research_store (21),
test_database_portability (26), test_strategy_factory_phase22 (19), test_audit_db_growth_bug054 (12);
ruff check+format clean; mypy clean on all 7 files. Commit 318964e.
Risk: LOW — additive; audit-queue fallback preserved; strategy_registry unchanged.

## CHG-0030 — Market Structure & Liquidity Intelligence Engine (MSLIE): perception layer for AI models (2026-08-20 Hermes-MSLIE)

Change: New `src/nexus_scalp/mslie/` package — a Market Perception Engine converting raw OHLC/volume/spread into structured intelligence: MarketIntelligenceFeatureVectorV1 (versioned contract), adaptive swing detection (ATR thresholds, volatility-adjusted window, volume confirmation, reaction strength, timeframe weight), BSL/SSL liquidity map ranked LOW/MEDIUM/HIGH/EXTREME, stop-hunt detector (pool + violation + rejection/acceptance + displacement + follow-through; REVERSAL/CONTINUATION/UNCERTAIN), breakout quality (real vs fake), smart-money features (OB/FVG/displacement/inducement/premium-discount), bounded multi-month MarketMemory. Wired: LiveEngine bar-close hook (pure numpy, no I/O, INV-001/INV-002), GET /api/mslie/status + /api/mslie/features, mslie section in /api/debug/state, Debug tab 'Market Intelligence Engine' panel.
Scope: src/nexus_scalp/mslie/ (new), src/nexus_scalp/application/live_engine.py, src/nexus_scalp/web/server.py, src/nexus_scalp/web/debug_snapshot.py, Web/index.html, Web/app.js, tests/unit/test_mslie_phase22.py, tests/integration/test_mslie_api.py, scratch/mslie_validate.py
Why: The platform lacked a market perception layer — AI models had no structured knowledge of where important highs/lows exist, where liquidity sits, whether stops were hunted, whether structure changed, or the market regime. The engine is advisory/observability-first; the decision stays with strategy models / ScalpNet / execution / risk.
Migration: none — no DB changes, no feature-schema changes (INV-009 untouched: the 50D/70D contract is never altered).
Verification: VERIFIED — 28 unit tests + 4 API integration tests + 38 debug-snapshot tests PASS; ruff/format/mypy clean; historical validation probe (3 regimes) PASS; node --check Web/app.js OK.
Risk: LOW — pure perception, zero order authority, failure-isolated hooks; latency 10-20ms on 300 bars.

## CHG-0031 — DATABASE MANAGEMENT console: SSMS-style explorer, SQL console, API keys (2026-08-20 Hermes-DBConsole)

Change: new provider-abstracted web console under /api/db/console/* — databases (all DB files incl. settings, provider/size/status), refresh (auto-sync new DBs), tables+row counts, columns, paginated rows (500-row cap), read-only SQL query (SELECT/EXPLAIN/WITH/PRAGMA/VALUES only, placeholder translation for psycopg, single-statement, bounded timeout), ready-made quick SQL, and named API keys backed by the OS SecureSecretStore (masked only, never plaintext; reserved names rejected). UI: Database Explorer tree + table chips + row grid + SQL console + API Keys panel under the existing DATABASE MANAGEMENT tab. Same driver contract serves SQLite now and PostgreSQL after the active provider switch.
Scope: new src/nexus_scalp/web/db_console.py, src/nexus_scalp/web/server.py, Web/index.html, Web/app.js, Web/api_client.js (NX.api.del), tests/unit/test_database_portability.py (TestDbConsole*, 13 tests)
Why: user brief — SSMS-like Database Management UI (tables + ready buttons below Migration Workflow, open/see databases and rows, execute DB commands, API KEYS), future-proof for PostgreSQL, auto-sync when new DBs are added.
Migration: none — read-only surface; no schema change.
Verification: VERIFIED — 42 passed/10 skipped in test_database_portability.py (1.34s), ruff+mypy clean, live TestClient probes on real artifacts DBs, node --check on both JS files.
Risk: low — read-only; no hot-path changes.

## CHG-0032 - Large-file decomposition & debug-friendly architecture refactor (2026-08-31 Nexus-Main)

Change: structural decomposition of oversized source modules into responsibility-based domain packages with thin
compatibility facades. NO runtime behavior change (CLI/API/DB/config/model/logging/exit codes all preserved).
Phases: 1 forensic inventory (Researcher) -> 2 target-tree design (Main) -> 3 staged per-domain implementation (Coder,
one coherent commit per domain) -> 4 adversarial review (Reviewer) -> 5 QA regression gate (QA). Candidates ranked by
evidence, not LOC alone; order_manager.py and live_engine.py DEFERRED (convention-locked hot path, INV-001/INV-004).
Scope: TBD per Phase-1 inventory - expected src/nexus_scalp/cli/main.py, forensics/checks.py, release/updater.py,
adapters/database/audit_repository.py, web/server.py (P0 caution: REST/SSE/WS surface); docs/architecture/debug-map.md (new);
tests reorganized with source ownership. Parallel WIP in .github/workflows/release.yml + src/nexus_scalp/release/metadata.py
(BUG-166/174, release-identity owner) is EXCLUDED from this change.
Why: user-directed decomposition mission - lower cognitive load, clear ownership, debug-first navigation. Recent user-side
hunts (BUG-160/162/166/170-173) all landed in cli/release code where giant files hid failure modes.
Migration: none - no DB/schema/contract/feature changes permitted; public APIs preserved via facades; import graph checked
after each split (no cycles).
Verification: ruff check + ruff format --check + mypy src per step; targeted per-domain pytest; full critical suite via
beforePush before push; CLI --help/status real-execution smoke; behavior-preservation audit (before/after outputs).
Risk: MEDIUM - structure-only but touches CLI/release/forensics paths with fresh bug history (BUG-160/162/166/170-173);
mitigated by staged commits, facades, and regression gates per domain.
Status: PROPOSED -> IMPLEMENTING (Phase 1 dispatched)

## CHG-0032-A1 — SCOPE LOCK ruling (2026-08-31, user directive via Nexus-Main)

RULING: APPROVED WITH BINDING SCOPE NOTES for TASK-ARCH-DECOMP.

CURRENT PASS (approved order, Coder authorized):
1. src/nexus_scalp/cli/main.py — package split + facade (app_factory.py, update_cli.py, engine_boot.py, doctor.py,
   wizard.py, styling.py per Phase-1 contract); main.py re-exports app + console; module-level import-time app
   construction MUST remain (release/packaged_main.py + cli_shim.py import `app` at import; 12 importers).
2. src/nexus_scalp/forensics/checks.py — domain split; ALL check_* public names preserved via compatibility
   aliases (engine.py + tests alias the module as `C`); no check-semantics redesign (BUG-166 class rule: probe
   fallback semantics stay byte-identical while moving).
3. src/nexus_scalp/web/server.py — LAST, highest risk. EXISTING flat route convention: web/<domain>_routes.py
   (pattern already proven by factory_routes.py / news_intelligence_routes.py). NO web/routes/ nested package.
   Facade MUST re-export the verified surface: create_app, WEB_DIR, canonical_json, serialize_enums,
   safe_error_payload, log_web_error, new_request_id, _find_non_json_fields. The 28 API test files must NOT be
   modified to compensate for an incomplete facade.

DEFERRED — DO NOT TOUCH (no split/refactor/rename/formatting-only mutation/threshold change):
- signals/policy.py — foreign uncommitted WIP (BUG-054); separate controlled change later.
- execution/order_manager.py — hot-path convention lock (INV-004 OrderManager authority), BUG-105 init-order
  sensitivity, parallel-agent churn.
- application/live_engine.py — hot-path convention lock (INV-001), DI composition root, parallel-agent churn;
  BUG-105 engine-launch gate: tests/integration/test_engine_runtime_launch.py MANDATORY after every
  live_engine step in ANY future authorized task.

OUT OF SCOPE this pass (not authorized): adapters/database/audit_repository.py, release/updater.py,
web/debug_snapshot.py, and all other Phase-1 candidates (P2/P3 leave-alone set included).

Per-step gates (binding): py_compile; module-specific tests; ruff check; ruff format --check; mypy src.
Web step additionally: ALL 28 API test files + integration API suites run STANDALONE/SEQUENTIAL
(artifacts/audit.db collision — a combined run is NOT validation evidence). Critical-suite-only evidence is
NOT sufficient for the web step.

Baseline protection: before/after every step record git status / git diff --stat / git diff -- <targets> /
git diff --check; never absorb or revert parallel-owner changes; commit per responsibility with <AGENT>: title;
re-add own files immediately before commit (parallel restore --staged hazard).

Precedence note: user ruling supersedes researcher P0 ranking where they differ (checks.py P2 -> approved Step 2;
audit_repository.py P0 / updater.py P1 -> OUT OF SCOPE this pass).
Status: IMPLEMENTING (Step 1 dispatch)
## CHG-0033 - Observability & Forensic Trace Audit (audit-only, no code) (2026-08-31 Hermes-ObsForensic)

Change: AUDIT-ONLY deliverable - docs/architecture/observability-map.md + artifacts/forensics/observability-audit.json (OBS-001..016 gap ledger, reconstruction scorecard, 10-scenario black-box reconstruction results). NO runtime code, trading, model, release, or config changes; zero-behavior-impact by construction (two additive docs + registry rows).
Scope: docs/architecture/observability-map.md (new), artifacts/forensics/observability-audit.json (new), agents/taskboard.md (TASK-OBS-AUDIT row), agents/change_control.md (this entry).
Why: user-mandated forensic observability audit - determine whether a developer can reconstruct incidents from runtime evidence alone; evidence-based gap ledger for future fixes (P0: redaction eats EXEC- ids, correlation ids never bound; P1: dead /api/debug/trace audit_db import, silent DB batch drops, EXPERIENCE execution_id 0%%, update chain json-only).
Migration: none - no schema/contract/feature change; OBSERVABILITY_AUDIT v1 is a documentation artifact.
Verification: black-box reconstruction of 10 scenarios from runtime evidence (logs 190MB severity-split, 9 DBs, incidents, update-state.json, live API :8081 probes incl. X-Request-ID echo + dead debug/trace endpoint, real CLI execution); 6 parallel read-only code sweeps for every claim; no runtime claims made.
Risk: LOW - additive docs only. Recommended fixes are listed for future authorized tasks, NOT implemented (audit-only mandate).
Status: VERIFIED (audit artifacts complete; no runtime verification applicable)
## CHG-0034 - Provider rate-limit hardening: global provider gate, auto-disable, Strategy Factory toggle (2026-09-01 Nexus-Main)

Change: HARDENING of the optional external-provider subsystem (Strategy Factory LLM + News AI) after repeated HTTP 429 from the configured provider. New module src/nexus_scalp/strategies/factory/provider_gate.py = ONE global provider gate (config validation, bounded concurrency, token-bucket rate limit, bounded retries with Retry-After + exponential backoff + jitter, circuit breaker AVAILABLE/RATE_LIMITED/CIRCUIT_OPEN/COOLDOWN/HALF_OPEN/RECOVERED, single-flight dedup, bounded-queue staleness, secret-free health snapshot). LLMGenerationProvider routes ALL requests through the gate; httpx transport retries=0 (one retry owner). Settings DB keys factory.enabled / factory.auto_disabled / factory.auto_disabled_reason = user intent vs runtime health (effective_enabled). New web endpoints GET /api/factory/provider-health, POST /api/factory/provider-toggle, POST /api/factory/provider-test (one controlled probe). Web UI: Strategy Factory ENABLED/DISABLED toggle + auto-disable reason panel. Auto-disable ONLY the provider feature - trading engine untouched.
Scope: src/nexus_scalp/strategies/factory/provider_gate.py (new), provider.py, settings/service.py, web/factory_routes.py, news/ai_service.py, application/live_engine.py (additive guard in _build_factory_llm_provider ONLY - deferred-file disclosure per CHG-0032-A1; not decomposition), Web/index.html, Web/app.js, tests/unit/test_provider_gate_hardening.py (new), agents/* registries.
Why: user MASTER STEER 2026-09-01 (provider rate-limit hardening + API/host health gate + Strategy Factory toggle). Evidence: provider.py had NO 429/backoff/circuit handling; pro_auto.py soft-retry + news worker requeue x3 = retry amplification; no user toggle existed. BUG-186 (429 storm/retry amplification), BUG-187 (no toggle/auto-disable).
Contracts touched: PROVIDER_HEALTH_GATE v1 (new), PROVIDER_USAGE v1 (extended fields), SETTINGS_DB factory.* keys v2. NOT touched: 70D/scalp_v3/model artifacts, feature schema, execution, risk, research paths, thresholds (explicit no-change per steer sections 53-57).
Owners affected: Hermes-News (pro_auto fallback unchanged in behavior), Hermes-UI (factory tab additive), Hermes-Runtime (live_engine additive guard only).
Risk: MEDIUM (provider subsystem only; isolation tests mandatory - provider failure must never block the trading loop; INV-024 registered).
Required tests: config validation matrix, 429 Retry-After/bounded retry, 401/403 auth-fail, circuit open/half-open/recover, rate-limit bound, concurrency cap, single-flight, queue staleness, user toggle, secret-redaction, trading isolation.
Status: IMPLEMENTING
## CHG-0035 - Research execution stack closure: TRUE FORWARD TEST + TICK REPLAY + provenance hardening (2026-09-01, Hermes-Main)

Change: closes Agent-3's remaining research-path gaps WITHOUT touching any passing path (backtest/walk-forward/replay-70D/MT5 probes). (1) research/forward_test.py = dedicated ForwardTestExperiment experiment_type=FORWARD_TEST: freeze capture at cutoff (model fingerprint = sha256 of live artifact bytes, scaler fingerprint = sha256 of model.scaler.npz, strategy fingerprint = sha256 of frozen SignalPolicy constructor params, schema hash = features.schema_contract.feature_schema_hash, execution config, git commit via release.metadata), hard causal cutoff boundary; frozen artifacts are snapshotted to artifacts/forward_test/<run_id>/ (bytes, not symlinks) so later champion changes cannot mutate the experiment; runner streams ONLY ticks/bars with timestamp > cutoff through the SHARED streaming replay engine; freeze invariants re-verified after the run. (2) research/event_source.py = HistoricalEventSource abstraction: BarEventSource (rates frame), TickEventSource (raw tick frame: time_msc/bid/ask/last/flags/volume_real preserved), ChunkedEventSource (bounded tick chunks; boundaries must not change semantics - enforced by test), validate_event_source (ordering/duplicates/bid-ask sanity/finiteness/gap detection); DATA_ERROR records are returned for malformed ticks (never fabricated). (3) research/streaming_replay.py = ONE StreamingReplayEngine shared by bar + tick + forward-test modes: logical clock (event timestamps only, zero wall-clock sleeps), incremental BarAggregator from ticks, causal feature snapshot (ScalpFeatureEngine 50D window + news_context_at + liquidity engine at decision T), local ScalpNet 70D bundle inference (torch.inference_mode, loaded ONCE per session), FROZEN SignalPolicy.evaluate_probabilities, RiskEngine.evaluate_proposal, direction-aware simulated execution (BUY entry ASK / SELL entry BID / BUY exit BID / SELL exit ASK; historical bid/ask only), tick-chronological SL/TP first-touch resolution, logical latency fields (signal/decision/order/fill timestamps), TradeLedger summary (MFE/MAE from replayed path). NO adapter import, NO mt5.order_send anywhere in the replay path (INV; test-enforced), NO retraining, NO parameter mutation. (4) research/mt5_tick_dataset.py = tick dataset acquisition+cache using the ALREADY-PROBED adapter surface (DirectMT5Adapter.get_tick_history -> copy_ticks_range COPY_TICKS_ALL, fields verified by Agent-3's probe suite test_mt5_api_probes.py); chunked bounded RAM; local parquet/npz cache keyed by (symbol, range, fingerprint); after acquisition the engine runs 100% offline (MT5 closed) - test-enforced. (5) PROVENANCE: audit_repository research_run_snapshots gains feature_schema_id/feature_dimension/model_id/git_commit columns (ADD COLUMN guarded, idempotent); ResearchRunSnapshot model + build_run_snapshot capture them from the LIVE schema contract + artifact bytes + git commit (empty string = NOT RECORDED, never invented); pipeline.py validate_candidate passes the resolved identity through configuration; backfill NOT performed for existing rows (no authoritative evidence at this time) - recorded honestly as NOT_RECORDED.
Scope: src/nexus_scalp/research/{forward_test.py,event_source.py,streaming_replay.py,mt5_tick_dataset.py} (new), src/nexus_scalp/research/evidence.py (snapshot fields), src/nexus_scalp/research/observability.py (snapshot SQL columns), src/nexus_scalp/adapters/database/audit_repository.py (additive DDL columns), src/nexus_scalp/research/pipeline.py (identity capture at snapshot build), tests/integration/test_research_execution_stack.py (new), tests/unit/test_forward_test_freeze.py (new), tests/unit/test_research_provenance_immutable.py (new), agents/* registries.
Why: Agent-3 final verdict - FORWARD TEST = NO DEDICATED MODE (shadow70 is a runtime disagreement observer, NOT a frozen-experiment runner: no cutoff boundary, no future-data isolation, no experiment result identity), TICK REPLAY = architectural gap (REPLAY-70D recomputes vectors on bar frames; no tick event stream through strategy+risk+execution), research_run_snapshots model_version/feature_schema_version recorded empty (P2 gap). User research-completion brief 2026-09-01 sections 4-11, 12-23, 33-39.
Contracts touched: FORWARD_TEST_EXPERIMENT v1 (new), HISTORICAL_EVENT_SOURCE v1 (new), STREAMING_REPLAY v1 (new), MT5_TICK_DATASET v1 (new), RESEARCH_RUN_SNAPSHOT v2 (4 new columns). NOT touched: LiveEngine hot path, order_manager, execution adapters, policy.py (CHG-0032-A1 deferred files untouched), 70D schema/scaler/model artifacts, walk-forward implementation, MT5 probe suite.
Owners affected: Nexus-QA (new test surface), Agent-3 (research validation re-run), devops (no runtime/CI change beyond test files).
Risk: MEDIUM (research-only subsystem; zero live-trading surface; replay never sends orders - invariant test-enforced).
Required tests: freeze identity captured+re-verified post-run, future-data poison (pre-cutoff state unchanged), replay determinism (two runs byte-identical ledger), chunk determinism (1 chunk == N chunks), resume determinism, no order_send in replay, direction-aware pricing, tick SL/TP first-touch, bar/tick difference classification, offline-after-acquisition, model-offline inference, provenance immutability across champion change, empty/future-range honest outcomes.
Status: IMPLEMENTING

## CHG-0036 - LIVE MT5 tick acquisition certification + BUG-188 boundary fix (2026-09-01, Hermes-Main)

Change: closes the CHG-0035 explicitly-unverified residual (acquire_ticks
against a REAL terminal) via a bounded read-only live probe, then the
smallest safe boundary fix for the discovered BUG-188 double-conversion
(input window +180min in get_tick_history, symmetric with broker_epoch_to_utc
output conversion), plus targeted offline regression tests
(tests/unit/test_mt5_tick_boundary_bug188.py) and a sanitized certification
evidence artifact (artifacts/forensics/mt5_tick_certification.json - no
market-data dumps, no credentials).
Scope: src/nexus_scalp/adapters/mt5/mt5_adapter.py (get_tick_history input
boundary ONLY), tests/unit/test_mt5_tick_boundary_bug188.py (new),
artifacts/forensics/mt5_tick_certification.json (new, sanitized), agents/*
registries. NOT touched: research engine semantics (event_source/
streaming_replay/forward_test), provenance schema, walk-forward, backtest,
strategy core, risk engine, provider gate, installer, UI.
Why: user certification brief 2026-09-01 (live probe A-F checks; live/stub
parity; smallest boundary fix; no scope creep).
Contracts touched: MT5_TICK_HISTORY_INPUT_TIMEBASE v2 (input boundary now
broker-timebase-shifted, symmetric with output conversion). NOT touched:
MT5_TICK_DATASET v1 cache identity/fingerprint semantics, HistoricalEventSource.
Risk: LOW (single function input-boundary normalization; offline-tested;
parity with the already-proven history-deal window convention).
Status: COMPLETE

## CHG-0039 - Provider gate lifecycle hardening: state ownership, credential rotation recovery, restart semantics (2026-09-01 Nexus-Main)

Change: POST-CERTIFICATION lifecycle layer on top of live-certified CHG-0034 (rate-limit/circuit implementation NOT reopened). Forensic pass found and fixed: DEFECT-1 (live-confirmed): settings-layer auto_disabled had NO production writer, so the health payload/UI showed ENABLED while the gate was AUTO_DISABLED. Fix: the gate is the RUNTIME authority; factory_health_snapshot(runtime_override=...) merges gate truth into the authoritative top-level fields (provider-health endpoint). DEFECT-2: transient auto-disable must never be persisted (sticky across key rotation forbidden) - settings DB keeps USER INTENT only; record_/clear_ methods remain for API compatibility. DEFECT-3: llm-config save in web-only mode (no in-process factory) never reconfigured the gate - now the process singleton is reconfigured on every save. DEFECT-4: provider-test while AUTO_DISABLED could not verify a rotated key - the probe path now reconfigures the singleton first (still EXACTLY ONE network request).
Scope: settings/service.py (snapshot runtime_override), web/factory_routes.py (health merge + web-only reconfigure + probe reconfigure), tests/unit/test_provider_lifecycle_hardening.py (new, 18 tests), agents/*.
Why: user steer 2026-09-01 (post-certification): deterministic recovery lifecycle, state consistency, restart semantics, operator UX truthfulness.
Contracts: PROVIDER_HEALTH_GATE v1 extended (runtime authority semantics); SETTINGS_DB factory.* v2 semantics clarified (intent persisted, runtime transient). BUG-189 (UI/backend state contradiction) filed.
Risk: LOW-MEDIUM (state reporting + recovery paths; no trading, no 70D, no rate-limit/circuit behavior changes).
Status: IMPLEMENTING
## CHG-0038 - Data-to-decision fidelity audit: tick->bar->70D->inference->policy->ledger (2026-09-01, Hermes-Main)

Change: full fidelity audit from certified live ticks to simulated outcome, with a
machine-readable tensor audit, deterministic causality probes, inference-parity
measurement, policy parity, NO_TRADE first-gate attribution, DB reconciliation and a
bounded counterfactual; one genuine defect found (BUG-190 live news-block key mismatch)
with a minimal boundary fix + RED->GREEN regression test
(tests/unit/test_fidelity_data_to_decision.py, 13 tests).
Scope: src/nexus_scalp/application/live_engine.py (news projection call sites ONLY:
_build_live_feature_vector + _build_retrain_record), tests/unit/test_fidelity_data_to_decision.py,
artifacts/forensics/fidelity_audit_20260901.json, agents/* registries.
NOT touched: policy.py, risk engine, regime classifier, event_source/streaming_replay/
forward_test (CHG-0035 certified paths), provenance schema, walk-forward, backtest,
provider gate, installer, observability (Agent-2), CLI/docs owners.
Why: user fidelity-audit brief 2026-09-01 (find the FIRST divergence between real ticks
and the engine's interpretation; fix only evidence-backed defects).
Contracts touched: LIVE_NEWS_10D_PROJECTION v2 (engine now uses the canonical named
projection). Risk: LOW (mapping parity fix; bit-identical outputs on the current
smoke-grade artifact verified pre/post).
Status: COMPLETE

## CHG-0041 - Research tick store + NO_TRADE counterfactual engine (2026-09-01, Hermes-Main)

Change: closes the CHG-0038 counterfactual small-N gap. (1) mt5_tick_dataset.py
extended: TICK_DATASET_META v2 provenance (source, acquisition_time, adapter
surface, git_commit, requested window, fingerprint), overlap dedup (only
missing sub-windows fetched, merged chronologically), immutable fingerprinted
parquet. (2) research/counterfactual.py = TICK_COUNTERFACTUAL v1: joins
audit_signals NO_TRADE rows (decision id, timestamp, action=NO_TRADE,
confidence, entry/SL/TP geometry, regime, gate, model probs) with the tick
store; hypothetical entry at T via the CERTIFIED direction-aware semantics
(BUY@ASK/SELL@BID); tick-walk to SL/TP/horizon: MFE/MAE (favorable/adverse
price excursion), future return, cost = entry spread, time-to-target,
time-to-stop, RR_NOT_RECORDED when geometry absent; classification
FALSE_REJECTION / CORRECT_REJECTION / MISSED_LOSER / INCONCLUSIVE with
evidence-based rules (R>=+0.5R = rejected winner, R<=-0.5R = would-be loser,
insufficient coverage = INCONCLUSIVE); stratification by gate/regime/
confidence band/session/direction; fingerprinted deterministic outputs.
(3) tests/unit/test_counterfactual_engine.py (offline, synthetic deterministic
ticks + decision fixtures). (4) evidence artifact
artifacts/forensics/no_trade_counterfactual_20260901.json.
Scope: src/nexus_scalp/research/{counterfactual.py,mt5_tick_dataset.py},
tests/unit/test_counterfactual_engine.py, artifacts/forensics/*, agents/*.
NOT touched: policy, risk, regime engine, execution adapters, certified
replay/forward-test paths, observability, installer, CLI owners' WIP.
Why: user counterfactual-engine brief 2026-09-01; prior sample N=17 INCONCLUSIVE.
Contracts touched: TICK_DATASET_META v2, TICK_COUNTERFACTUAL v1. Risk: LOW
(research-only, no live path).
Status: COMPLETE


## CHG-0042 - Confidence-semantics repair: policy gate measures trained-class directional share (2026-09-02, Hermes-Main)

Change: SignalPolicy now normalizes the candidate's OWN-side directional
probability over the TRAINED classes (BUY+SELL+NO_TRADE) before comparing it
with the existing thresholds (0.40 base / 0.50 range - UNCHANGED). The
4-logit head's WAIT slice (never a training label: TripleBarrierLabeler
3-class + LABEL_SCHEMA_3CLASS_V1; online fine-tune class_counts [.., 0]) no
longer dilutes directional confidence. Degenerate vectors (zero/non-finite
mass, malformed width) fall back to the pre-fix raw semantics instead of
manufacturing confidence; prob_no_trade is sanitized like its siblings
(NaN-slice poisoning found by the new regression net). confidence_source
(DIRECTIONAL_NORMALIZED | RAW_FALLBACK) is stamped into every proposal's
risk_checks for explainability.
Evidence: NO_TRADE forensic e1f95e5 (0/464 candidates pass; all-time max raw
probability 0.357 < 0.40); counterfactual artifacts/forensics/
confidence_repair_counterfactual_20260902.json (BEFORE 0 passers, AFTER 13
on the same recorded set, 0 in RANGING - consistent with the ~32 all-data
projection; no threshold tuning).
Scope: src/nexus_scalp/signals/policy.py,
tests/unit/test_confidence_semantics_repair.py (13),
tests/unit/test_policy.py (telemetry assertions to the repaired measure).
NOT touched: regime_classifier, order_manager, live_engine, risk engine,
70D contract/artifacts, provider gate, installer, observability contract.
Why: user confidence-pipeline-repair brief 2026-09-02. Contracts touched:
CONFIDENCE_SEMANTICS v2 (risk_checks +confidence_source). Risk: MEDIUM
(hot-path decision semantics; mitigated by fallback + full gate battery).
Status: COMPLETE

## CHG-0043 - Replay-on-Chart: historical session controller + no-future-data certification (2026-09-02, Hermes-Main)

Change: user replay-on-chart brief. (1) SURGICAL behavior-preserving refactor of
research/streaming_replay.py: extract per-event processing + run-finalization so
ONE decision path serves both run() and a new stepwise controller (no second
engine, no second execution model). (2) research/replay_session.py =
REPLAY_SESSION v1: ReplayContract (replay_id/dataset_id/window/model identity/
schema/policy/risk identity/git_commit/replay_mode=BAR_REPLAY), authoritative
ReplayClock (event time only), step/play/pause/reset/seek/checkpoint with
equivalence tests, bounded decision-trace ring (per-decision: timestamp, price,
probs, confidence, action, regime, gates, first blocking gate, candidate
geometry), causal regime wiring (MarketRegimeClassifier on replay ticks,
guarded by regime_enabled flag, default preserves current behavior),
checkpoints every N bars (full state: bars window, policy state, regime rings,
equity, position, counters). (3) web/replay_routes.py: POST /api/replay/session,
POST /api/replay/control, GET /api/replay/state, GET /api/replay/report —
serves persisted truth (research_run_snapshots v2 + evidence JSON). (4) Web/
replay panel: KNOWN-vs-UNKNOWN chart semantics, decision drill-down, NO_TRADE
reasons. (5) Tests: future-mutation invariance A-F (price/news/liquidity/
volume/regime-labels/db-rows), seek==sequential, checkpoint equivalence, 70D
mapping, model fingerprint, E2E DB reconciliation, clock-contract (no
datetime.now in decision path), END_OF_DATA, step determinism.
Scope: src/nexus_scalp/research/{streaming_replay.py,replay_session.py(new)},
web/replay_routes.py(new), Web/{index.html,app.js}, tests/unit/test_replay_session_*.py,
tests/integration/test_replay_e2e_reconciliation.py, artifacts/forensics/*,
agents/*. NOT touched: signals/policy.py, features/regime_classifier.py,
execution/order_manager.py (foreign Agent-5 WIP), application/live_engine.py,
adapters/mt5, provider_gate, installer WIP, settings.
Why: brief 2026-09-02 — chart must be the operator surface of the REAL
historical decision pipeline with ZERO future-data leakage.
Contracts touched: STREAMING_REPLAY v1 (refactor, hash-equivalence proven),
REPLAY_SESSION v1 (new), REPLAY_API v1 (new), RESEARCH_RUN_SNAPSHOT v2 (reused).
Risk: MEDIUM (touches certified engine file; mitigated by pre/post hash
equivalence on real data + full research-family suite green).
Status: IMPLEMENTING

## CHG-0043 — Runtime Truth / Release Awareness / Feature-Model-DB Consistency Hardening
Agent: Nexus-Main (orchestrator; implementation via nexus-coder)
Role: Runtime identity / health truthfulness / release visibility
Task: TASK-RUNTIME-TRUTH (user brief 2026-09-02)
Scope: release/ state taxonomy + canonical runtime snapshot; metadata commit_source + dev stale build-info precedence; health.py truthful states (NOT_CONFIGURED/NOT_INITIALIZED/DISABLED/INFO vocabulary, MODEL_CONTRACT wired into run_all, FEATURE_SCHEMA resolved from configured artifact, NEWS table names fixed to real schema, update-state check offline-safe); cli/doctor.py render semantics (NOT_RECORDED, INFO); web live/state features block uses effective contract; NEW /api/release/status (no network); Web UI identity strip (surgical); tests.
Affected files: src/nexus_scalp/release/{state_taxonomy.py(new),runtime_snapshot.py(new),metadata.py,health.py,versioning.py,updater.py(additive fields)}, src/nexus_scalp/cli/doctor.py, src/nexus_scalp/web/{diagnostics_state_routes.py,release_routes.py(new)}, Web/{index.html,app.js}(minimal), tests/unit/*, agents/*
Contracts touched: RUNTIME_IDENTITY v2 (commit_source/commit_status), HEALTH_ENTRY v2 (INFO verdict + canonical states), RELEASE_STATUS_API v1 (new), LIVE_UI_STATE v2 additive (features.schema_id truthfulness + feature_activation additive); 70D contract UNCHANGED (features/schema_contract.py read-only); features/schema.py ACTIVE_SCHEMA_ID constant left as legacy residue per nse-50d ruling (runtime truth reads the artifact, not the constant).
Owners affected: Hermes-Release (release/), Hermes-UI (Web/) — CROSS-OWNER CHANGE declared; disclosed UI collision surface with TASK-REPLAY-ON-CHART (edits confined to identity/health render sites, replay files untouched).
Runtime paths touched: CLI doctor/version, /api/status|/health|/api/live/state (additive), NEW /api/release/status. NO hot-path change (snapshot cached 60s where wired; no new DB writes; no network in health).
Forbidden: installer/*, provider_gate, order_manager, live_engine edits, regime engine, observability SSOT, research/*, training pipeline, model training.
Risk: MEDIUM (health semantics change: optional-subsystem WARNs become INFO with canonical state; READY aggregate can only get MORE truthful — MODEL_CONTRACT FAIL on genuine width mismatch now blocks, which is the intended truth).
Required tests: new unit suites (taxonomy, snapshot identity, doctor semantics, release status endpoint) + affected existing suites + beforePush CRITICAL gate.
Status: IMPLEMENTING


## CHG-0047 - System-integration & production-readiness evidence pass (2026-09-02, Nexus-Main)

- Objective: cross-layer integration proof (install -> start -> data -> model
  -> decision -> persistence -> API/UI -> restart -> recovery) without
  redesigning any subsystem. Scope: tests/, artifacts/forensics/, agents/
  registries ONLY.
- Delivered: tests/integration/test_system_integration_boundaries.py (3
  boundary contracts), BUG-193 (deploy-gate false CRITICAL, split
  reference-registry singletons), evidence package
  docs/architecture/system-integration-evidence.json.
- Boundary findings routed to owners (NOT fixed here): BUG-193 (forensics
  domain), stale build-info.json CWD precedence (TASK-RUNTIME-TRUTH, pinned
  by test), model registry dual rows CHAMPION scalp_v1_50d + CANDIDATE
  scalp_v3_70d pointing at the same 70D artifact (governance domain,
  BUG-125/BUG-140 labeling artifact class - documented, not corruption).
- Verification: critical-suite replica RC=0 (1358 tests), engine runtime
  launch gate PASS (0 errors), CLI subprocess harness PASS, installer
  protocol suite 42 pass/1 skip, HEAD-tree isolated import probe 0 fails.

## CHG-0044 - OSS-grade adversarial QA / deep-assurance layer (2026-09-02, Hermes-Main)

Change: independent QA-adversarial brief. (1) tests/unit/test_qa_deep_*.py families:
tensor-contract adversarial + property (swapped/NaN/inf/extreme/dtype/bool/str/None, 
metamorphic news/liquidity neutrality, replay determinism), state-machine walkers with
seeded bounded generators (ProviderGate, PositionStateMachine, RecoveryBudgetLedger) +
single-flight concurrency race with barriers, DB migration adversarial (idempotency,
partial failure rollback, lock contention, tamper, downgrade, baseline, orphan rows on
disposable DBs), API contract adversarial via TestClient (schema/error envelope/JSON
purity/idempotency/malformed/oversized/auth boundary), security surface (redaction
metamorphics, secret leakage, path traversal, oversized inputs, deserialization probe),
observability chaos (EventBatchAggregator invariants, storm bounds, deterministic fault
injection harness with failure classification), execution safety (order_send-never-called
hard assertion on research/replay paths, duplicate-order idempotency, side/volume/SL/TP
preservation via fake port). (2) scripts/qa/deep_assurance.py orchestrator: --fast,
default, --json (valid JSON only, suite_version/git_commit/seed/durations/defects[]),
--mutation (runtime-behavioral mutations at contract seams; source files NEVER rewritten),
--offline default. (3) docs/architecture/QA_BLIND_SPOT_MATRIX.md + qa-assurance-contract.md.
(4) pyproject markers additive: qa_deep, adversarial, property, security.
(5) BUG-192: validate_70d_vector bool-accepted / str-None TypeError-crash; same class in
InferenceValidator.validate. Minimal type-guard fix + regression net; existing 70D parity
battery re-run to prove zero behavior change on valid vectors.
Scope: tests/unit/test_qa_deep_*.py, scripts/qa/deep_assurance.py, docs/architecture/*,
agents/*, pyproject.toml (markers), .github/workflows/qa-deep-assurance.yml (NEW file),
features/schema_contract.py + features/inference_validator.py (BUG-192 minimal type
guards ONLY - CROSS-OWNER CHANGE to 70D contract SSOT, disclosed to contract owner).
NOT touched: live_engine, order_manager, policy, risk, provider gate logic, installer,
migrations content, observability implementations, ci.yml, release workflows.
Why: user OSS-Grade adversarial QA brief 2026-09-02. Contracts touched: none new
(guards FEATURE_SCHEMA_70D, INFERENCE_CONTRACT, PROVIDER_HEALTH_GATE v1, DB_MIGRATION v1,
OBSERVABILITY_LOG_CONTRACT). Risk: LOW (test-only surface + two-line type guards on
malformed-input paths; valid-input behavior byte-identical).
Status: IMPLEMENTING

CHANGE-ID: CHG-0043-P2 (addendum, part 2 scope detail)
Agent: Hermes-Main
Task: TASK-REPLAY-ON-CHART
Scope additions (2026-09-02):
  - research/replay_session.py: ReplaySession controller (REPLAY_SESSION v1):
    ReplayContract identity (fingerprinted, deterministic replay_id),
    authoritative event-clock, play/pause/step_tick/step_bar/reset/seek,
    checkpoints every N bars (full state snapshot), bounded decision-trace
    ring with per-decision evidence (probs, confidence, action, regime,
    gates, candidate geometry), regime_enabled flag (default False preserves
    legacy byte-parity; True wires the PRODUCTION MarketRegimeClassifier fed
    ONLY by replay events - regime state then flows to FrozenPolicyRunner
    (guardian gate live) and RiskEngine (replay regime state)).
  - web/replay_routes.py: REPLAY_API v1 (session/control/state/report).
  - Web/: replay panel (KNOWN/UNKNOWN chart semantics, decision drill-down).
  - tests: mutation-invariance A-F, seek/checkpoint equivalence, clock
    contract, E2E reconciliation.
NOT touched: policy/regime/execution/live_engine internals (identity and
  semantics consumed as-is per brief section 10: replay reveals truth, does
  not modify it).
Status: IMPLEMENTING


## CHG-0043 - Versioned read-only API platform /api/v1 (TASK-API-PLATFORM) (2026-09-02, Hermes-Main)

Change: NEW subsystem src/nexus_scalp/api/v1/* exposing ~40 real, read-only API
capabilities over EXISTING backends (audit repository, incident store, research
store/registry, shadow stores, feature schema contract, release metadata, config
pydantic models, live engine observability attributes) mounted at /api/v1 via a
single include_router in web/server.py create_app. Standardized error envelope
(reuses web/errors.py safe_error_payload contract + X-Request-ID), one pagination
model (page/page_size, bounded), UTC ISO-8601 timestamps, capabilities discovery,
request-id continuation. Mutation surface deliberately ZERO (no trading actions).
Developer tooling: nexus api CLI group (consumes the same HTTP contracts via
TestClient-embedded mode), scripts/dev/api_smoke.py, api_contract_check.py,
api_snapshot.py, api_diff.py. Tests: contract suite (happy/validation/empty/
not-found/dependency-unavailable/pagination/filters), bounded property-style
pagination tests, security checks (no secret keys, no stack traces), OpenAPI
quality gate. docs/API_PLATFORM.md developer reference.
Why: user API-platform brief 2026-09-02 (40+ real capabilities; no duplicates of
existing 257 routes; truthful data only - NO fake fallbacks).
Scope: NEW files only + 1-line include_router in web/server.py + pyproject/CI
additive rows. NOT touched: strategy, risk policy, execution internals, order
manager, live_engine hot path, model artifacts, 70D contract, installer, settings.
Contracts touched: API_PLATFORM v1 (new). Risk: LOW (read-only, additive, new
prefix; existing 257 routes and UI untouched).
Status: IN_PROGRESS

## CHG-0044 - JSON developer-contract layer over /api/v1 (TASK-API-CONTRACTS) (2026-09-02, Nexus-Contracts)

Change: machine-readable contract system for the developer-facing /api/v1
platform (extends CHG-0043 TASK-API-PLATFORM; the route surface, envelope,
pagination and error contracts it defines are consumed as-is, never
duplicated):
  - src/nexus_scalp/api/v1/contracts.py: CONTRACT REGISTRY - one decorator-
    registered source of truth (contract_id, version, status, owner, schema
    ref, endpoint binding, evidence backend, introduced, replacement);
    duplicate-ID and duplicate-endpoint detection at registration time.
  - src/nexus_scalp/api/v1/schemas.py: PYDANTIC-DRIVEN JSON SCHEMA for every
    registered contract (generated from typed models, draft 2020-12); schema
    artifacts exposed via /api/v1/contracts/{id}/schema.
  - src/nexus_scalp/api/v1/examples.py + tests/fixtures/api/: at least one
    valid, secret-free example + deterministic fixtures per contract
    (clearly synthetic test data only - NEVER production values).
  - scripts/dev/validate_json_contracts.py: discovers registry, loads
    schemas, validates examples + fixtures, detects duplicate contract IDs,
    exit-code contract for CI (0=pass).
  - scripts/dev/json_contract_diff.py: schema-vs-schema breaking-change
    classifier (removed required field, type change, enum narrowing,
    nullable->non-nullable, property removal) with PATCH/MINOR/MAJOR verdict.
  - scripts/dev/api_snapshot.py: endpoint inventory + contract map + schema
    hashes (reproducible API surface snapshot).
  - src/nexus_scalp/api/v1/redaction.py: reusable secret redaction for
    examples/fixtures/diagnostics exports + secret scan over the whole
    contract corpus.
  - tests/unit/test_api_v1_contract_*.py: schema validity, example validity,
    fixture validity, API->contract integration (TestClient over real
    endpoints), NOT_RECORDED semantics, pagination/units/timestamps, secret
    scan, registry integrity.
  - docs/API_PLATFORM.md: contract reference (WHAT/WHO/WHEN/consume/versions).
NOT touched: strategy, risk, execution, order manager, live engine hot path,
model artifacts, 70D contract, installer, settings, Web/, existing routes.
Truthfulness rule: contracts document REAL fields from REAL backends; missing
evidence stays NOT_RECORDED/null with explicit semantics - never fabricated.
Status: IN_PROGRESS

## CHG-0045 - QA deep-assurance layer: adversarial/property/state-machine tests + mutation proof + deep_assurance.py (2026-09-02, Nexus-Main QA)

Change: OSS-grade adversarial QA layer (user brief 2026-09-02). (1) NEW tests/adversarial/: seeded
property-style tensor/70D contract attacks (BUG-184/BUG-192 classes), PositionStateMachine +
RecoveryBudgetLedger state-machine invariants over random valid event sequences, ProviderGate
state-machine + single-flight failure semantics, EventBatchAggregator storm-bound/evidence-loss
adversarial, migration crash-restart recovery, /api/v1 platform contract + malformed-input
adversarial, secret-redaction attack matrix, deterministic fault-injection (tests/helpers/
fault_injection.py), replay temporal adversarial (duplicates/out-of-order/timezone/malformed),
hard order_send-never-called execution-safety net, CLI/config bounded fuzz. (2) NEW
tests/contracts/: producer==consumer boundary contracts (schema hash, family indices,
observability summary-line freeze, GateResult wire shape). (3) scripts/qa/deep_assurance.py:
one-command orchestrator (--fast/--json/--seed, offline default) + scripts/qa/run_mutations.py
controlled mutation proof on critical contracts (expect-test-kill; foreign-WIP guard).
(4) .github/workflows/qa-deep-assurance.yml: fast lane (PR/push) + deep lane (main/weekly).
(5) docs/architecture/QA_BLIND_SPOT_MATRIX.md (required first milestone: defect-history ->
detection-gap map, test-quality verdicts KEEP/IMPROVE/MERGE/DELETE/MISSING) +
docs/architecture/qa-assurance-contract.md (lane/marker/budget/JSON contract).
Scope: tests/adversarial/ (new), tests/contracts/ (new), tests/helpers/fault_injection.py (new),
scripts/qa/ (new), .github/workflows/qa-deep-assurance.yml (new), docs/architecture/{2 files} (new),
agents/ registries. ZERO production-code edits; tests may convert proven testability defects
into separate controlled changes later.
NOT touched: order_manager.py, live_engine, policy, risk, schema/features modules (BUG-184/192
edits in tree belong to their in-flight owners), provider gate impl, migrations impl,
observability impl, installer, CI ci.yml (TASK-CI-ISOLATION owner), release.
Why: brief mandates defect-detection power over test count; regression classes (BUG-141/150/
162/170/175/184/186/188/190/192) need multi-angle permanent guards + machine-readable results.
Contracts touched: none changed; contracts VERIFIED (SCHEMA, OBSERVABILITY_LOG freeze,
PROVIDER_HEALTH_GATE v1, DB_MIGRATION v1, API platform v1). Risk: LOW (tests-only + CI lane).
Status: IMPLEMENTING


## CHG-0043 - API Platform v1 (/api/v1) — additive typed platform layer (2026-09-02, Hermes-Main)

Change: New versioned API platform `/api/v1` (65 read-dominant capabilities, 16 domain
routers under src/nexus_scalp/web/api_v1/) with standardized envelope
({data, meta:{request_id, generated_at}}), single pagination model (page/page_size/has_more),
unified error model (code/message/details/request_id/retryable; VALIDATION_ERROR→422,
RESOURCE_NOT_FOUND→404, unavailable family→503), UTC ISO-8601 timestamps, secret
sanitization, idempotency-key echo on POSTs. Developer surface: Python client
(api_client.py), CLI `nexus api`, scripts/dev tools (smoke/contract-check/openapi
snapshot+diff/benchmark), docs/api/API_REFERENCE.md. Spec of record:
docs/api/API_PLATFORM_V1.md.
Scope: src/nexus_scalp/web/api_v1/ (new), server.py (ONE include_router wiring block
ONLY), api_client.py, cli/api_commands.py + app_factory registration, scripts/dev/api_*,
tests/unit/test_api_v1_contracts.py, tests/integration/test_api_v1_platform.py, docs/api/.
NOT touched: legacy routes (zero behavior change), trading/execution/risk internals,
feature/model contracts, installer, CI workflows (except additive api-platform job last).
Contracts: API_V1_ENVELOPE v1 (new), API_V1_PAGINATION v1 (new), API_V1_ERRORS v1 (new).
Risk: MEDIUM (new public surface; mitigated: read-dominant, no trading mutations,
sanitization layer, additive-only wiring, contract gates). Status: COMPLETE (2026-09-02 closure)

Closure evidence (executed):
- Canonical tree consolidated to src/nexus_scalp/web/api_v1 (commit e51a910);
  superseded src/nexus_scalp/api removed; 67->68 operations live (no-trade/reasons added).
- Contract+integration tests: 35 PASS (e1d7724) — envelope, pagination
  no-dup/no-skip/window-slice invariants, filter composition, secret scan,
  method-abuse, bounded query/path fuzz, additive legacy wiring proof.
- DX layer landed (absorbed into 7b8618a during parallel BUG-211 push prep;
  files verified in HEAD): nexus api CLI (12 commands), NexusApiClient,
  scripts/dev api_smoke/api_contract_check/api_openapi_snapshot/api_openapi_diff/api_benchmark.
- Gates at closure: API CONTRACT CHECK = PASS (68 operations/68 paths);
  API_SMOKE = PASS (embedded); API_BENCHMARK = PASS (0 routes over p95 250ms
  after health TTL-cache+prewarm / O(1) database-status / version memo repairs);
  ruff + mypy clean on api_v1 + wiring + CLI + client; ruff --fix applied to tools.
- docs/api/API_REFERENCE.md (part 4) examples executed against a live uvicorn
  instance of the v1 app: DOC_EXAMPLES_VERIFIED = PASS.
Known limitations (documented, not defects): no WebSocket/SSE duplication
(legacy SSE retained); /market/bars bounded to engine-local aggregator bars;
shadow/research reads require the shared audit DB to exist (truthful 503
otherwise); mutation surface = 5 safe POSTs only.


### CHG-0043 addendum — Canonical API agent skill (2026-09-02, Nexus-Main)

Change: agents/APISkill.md — machine-oriented operational contract for the whole
API surface (CURRENT /api/v1 68 ops + LEGACY 280 dashboard routes + REMOVED
src/nexus_scalp/api/v1 tree + DEPRECATED mappings). 28 sections: four status
classes, verified legacy family table (10 modules + static), per-domain
operational entries (purpose/returns/dependencies/errors/agent-use/CLI/tests/
smoke), envelope+error+pagination+filter+time+idempotency contracts (all bounds
verified from source: page_size 1..200, hours_back<=720, bars<=500), engine-
dependency matrix (E/E-soft/DB/STATIC with engineless behavior), read/write
classification (63 GET / 3 SAFE_VALIDATION / 1 REFRESH / 1 DIAGNOSTIC / 0
EXECUTION_CAPABLE — NO REAL TRADING FROM AGENT API TESTS), CLI->API map (12
commands), NexusApiClient contract, tooling reference (5 scripts + drift
validator), test map (real files incl. tests/e2e_client/), security rules,
performance contract, domain guidance, one-question-one-API routing, discovery
workflow, extension/removal workflows, drift detection, historical
reconciliation, skill self-audit (10/10).
Tooling: scripts/dev/api_skill_drift_check.py — APISkill <-> live OpenAPI sync
gate (parses machine-registry rows + domain headers; missing/extra ops or count
mismatch -> exit 1). Battery at closure: DRIFT PASS 68/68, CONTRACT CHECK PASS,
SMOKE PASS, snapshot/diff COMPATIBLE, unit+integration+state-truth suites green,
ruff+mypy clean, all file refs resolve.
Scope: agents/APISkill.md + scripts/dev/api_skill_drift_check.py ONLY. Zero API
implementation changes (VERIFIED: no web/api_v1 commits since 03d0848 closure).
Status: COMPLETE

## CHG-0046 — Shadow System Forensic, Hardening & Intelligence Upgrade (2026-09-02, Hermes-Main)

Change: Shadow-owner forensic map (agents/forensic_reports/2026-09-02_shadow_forensic_map.md)
+ P0/P1 hardening per master brief. Proven verdict: Shadow = E (combination) of
three parallel layers — PHASE-11 model comparison (dormant), TASK-6 governance
shadow (dormant), TASK-05 70D observer (live hook, runtime IDLE). No outcome
layer existed anywhere (hypothetical_r hardcoded 0.0; outcome "PENDING").
Scope: src/nexus_scalp/shadow/** + governance/shadow_runtime.py (identity fields
only) + live_engine.py shadow hooks (D1 identity, D5 fingerprint, D2
normalization, D4 preloaded shadow70 inference) + web/model_governance_routes.py
(attach fix D7) + hygiene/retention.py (shadow70 rules D10) + Web panel truth
rendering. NOT touched: order_manager, policy, provider_gate, installer,
regime engine, observability SSOT, training pipeline, RiskEngine, execution.
P0 fixes: D1 champion identity (effective_*, bundle-authoritative), D2 action
vocabulary normalization, D3 outcome layer (geometry at record time + offline
certified-tick outcome resolver + paired Delta_R + champion-R direction rule),
D4 preloaded 70D inference fn, D5 sha1 full-vector fingerprint, D6 scaler
parity. P1: D7 attach meta-fallback, D8 liquidity provenance stamping +
INPUT_MISMATCH, D9 valid-only counts, D10 retention, D11 run freeze (git
revision + hash reverify at finalize). P2: D12 model-argmax confidence,
D13 canonical status vocabulary, D14 run clock. Contracts: SHADOW_EVIDENCE v2
(additive DB cols via lazy ALTER; historical rows preserved, missing
provenance = NOT_RECORDED), SHADOW70_ATTACH v2 (meta fallback), no production
policy/threshold changes, no auto-promotion. Risk: MEDIUM (observability-only
surface; all shadow paths failure-isolated; zero order authority preserved).
Required tests: identity parity, action normalization, outcome resolver
determinism, scaler parity, attach gate, retention bounds, isolation reproofs.
Status: COMPLETE (SHADOW_HARDENED) — 18 commits 6427596..8422ac9 (parts 1-16 +
BUG-203/BUG-204/BUG-210 ledgers + registry closure). Delivered: forensic map,
D1-D12+D14 fixed, 22 regression tests + critical-suite wiring, SHADOW_EVIDENCE
v2 additive migration, SHADOW70_ATTACH v2. Deferred P2: D13 canonical status
vocabulary unification, D15 per-feature drill-down. Evidence: 176 shadow-family
tests PASS locally; CI ruff/mypy PASS; sole CI pytest failure = foreign
observability flake (BUG-213, owner-ledgered, 5/5 green locally).

## CHG-0043 - OSS-grade adversarial QA / deep-assurance layer (2026-09-02, Nexus-Main)

Change: builds the user-briefed adversarial QA layer WITHOUT changing production
behavior: (1) test-architecture forensics inventory (families table, duplication
risk, runtime budgets measured); (2) docs/architecture/QA_BLIND_SPOT_MATRIX.md
mapping BUG/CHG history -> current regression -> re-entry gap -> proposed
detection with priority; (3) tests/adversarial/ targeted suites: property-style
tensor/vector contracts, position state-machine + recovery-budget invariants
over arbitrary event sequences, provider-gate chaos (single-flight follower
timeout, bounded retry storm with FakeClock, circuit flapping), DB migration
adversarial (idempotence migrate(migrate(x))==migrate(x), partial failure,
tamper, downgrade block), API contract adversarial against create_app() TestClient
(malformed JSON, oversized inputs, unknown fields, method abuse, JSON purity),
secret-redaction/URL-hygiene security tests, replay determinism (repeat equality),
timestamp/UTC boundary property tests, execution-safety order_send-never-called
guard, EventBatchAggregator evidence-preservation property (drop_events==0,
count/first_seen/last_seen/sample_ids bounds); (4) scripts/qa/deep_assurance.py
orchestrator: --fast/--json/--seed/--offline, suite_version, git_commit,
duration_ms, defects[]/flaky[]/mutation[]/recommendations[], deterministic seed
default 20260902, Windows PS 5.1/7-safe (pure Python, no bash); (5) mutation
proof runner (temp-tree copy, bounded textual mutations >/>=, threshold shift,
index swap, timestamp comparison flip, state-transition drop; SURVIVOR = test
blind spot reported, working tree NEVER mutated); (6) CI lane
qa-deep-assurance.yml (scheduled + dispatch; NOT added to the pre-push critical
gate); (7) BUG-184 fix (checks_features.py CHECK-FCS-04 duck-typing hole:
bool/str vector elements now CRITICAL) — routed to Nexus-Main by the BUG-184
ledger row, regression test included.
Scope: docs/architecture/{QA_BLIND_SPOT_MATRIX.md,qa-assurance-contract.md},
tests/adversarial/ (new), scripts/qa/ (new), pyproject.toml (pytest markers
adversarial/deep under strict-markers), .github/workflows/qa-deep-assurance.yml,
src/nexus_scalp/forensics/checks_features.py (BUG-184 ONLY), agents/* registries.
NOT touched: live_engine, order_manager, policy, risk, regime, shadow, replay
producers, provider gate, installer, migrations, observability SSOT.
Why: user OSS-grade adversarial QA brief 2026-09-02. Contracts touched: none
changed (verification-only layer); CONFIDENCE/PROVIDER/DB contracts consumed
read-only. Risk: LOW (tests+docs; one ledger-routed P2 forensics-check repair).
Status: IMPLEMENTING
## CHG-0043 - Decision evidence completeness: NO_TRADE counterfactuals fully reconstructable (2026-09-02, Hermes-Main)

Change: closes the CHG-0041 coverage gap (1619 rows without a recorded
direction). (1) audit_signals gains 7 ADD COLUMN-guarded research fields:
preferred_direction, raw_prob_buy/sell/no_trade/wait, confidence_source,
spread_usd; the recorder populates them at decision time; genuine NO_TRADE
abstention stays NOT_RECORDED (''), never derived from market outcomes;
historical rows immutable (new columns NULL = NOT_RECORDED). (2) policy.py:
spread_usd stamped into risk_checks at both proposal builders (INV-018
observability only); guardian pre-model block records the observed quoting
state + geometry_unavailable_before_gate=True + PRE_MODEL_GUARDIAN semantics
so sentinel SL/TP are unambiguous non-geometry. (3) counterfactual engine
consumes preferred_direction (legacy model_action parse as pre-column
fallback), the raw probability block, and refuses sentinel geometry
(RR_NOT_RECORDED + excursion proxy). (4) tests/unit/test_decision_evidence
_completeness.py (10 evidence-invariant tests incl. schema-safe migration +
historical immutability). (5) evidence artifact decision_evidence_
completeness_20260902.json (2162 decisions, 476 covered, per-stratum
evidence grades).
Scope: src/nexus_scalp/{adapters/database/audit_repository.py,signals/policy.py,
research/counterfactual.py}, tests/unit/test_decision_evidence_completeness.py,
artifacts/forensics/*, agents/*.
NOT touched: thresholds, regime engine, model architecture, execution
behavior; guardian stays BEFORE inference (moving it = semantics change).
Why: user decision-evidence brief 2026-09-02.
Contracts touched: AUDIT_SIGNALS_EVIDENCE v2 (7 columns), TICK_COUNTERFACTUAL
v1.1 (evidence join + geometry refusal). Risk: LOW (recording + research
only; zero decision-path change).
Status: COMPLETE

## CHG-0048 - Client experience & usability pass: safety, clarity, connectivity, i18n (2026-09-02, Nexus-Main UX)

- Objective (user brief "NEXUS CLIENT EXPERIENCE & USABILITY AGENT"): make the
  actual client easy/fast/clear for a user who knows nothing about internals.
  NO trading-logic, model, risk, execution, or signal-semantics changes.
- Scope (presentation layer only): Web/index.html, Web/app.js (additive),
  Web/ux.js (NEW), Web/ux_i18n.js (NEW), Web/ux_palette.js (NEW),
  Web/styles.css (append), src/nexus_scalp/web/server.py (ADDITIVE serve
  routes for the 3 new static assets, verbatim FileResponse pattern),
  tests/unit/test_web_ux_safety.py (NEW).
- Delivered: (1) NX.confirm modal + type-to-confirm on PAPER/SHADOW->LIVE
  (BUG-194); (2) connection-lost banner + stale-data marking + retry-now;
  (3) i18n core EN/FA/DE/ES/AR + dir=rtl + language switcher for shared UI
  chrome; (4) Ctrl+K command palette + keyboard shortcuts + last-tab restore;
  (5) NO_TRADE humanization (confidence semantics, plain-language reasons,
  freshness); (6) attention strip + grouped sidebar sections; (7)
  visibility-aware polling (hidden tabs stop 30s account polling).
- Owners affected: Web/Dashboard (this agent); web/server.py touched ADDITIVELY
  (CROSS-OWNER declared: serve-route block only, no handler semantics).
- Contracts: UI_STATE (presentation-only consumers, no producer changes),
  PROVIDER_HEALTH_GATE UI panel untouched, INV-010 untouched (no Telegram
  paths), no API request/response shapes changed.
- Risk: LOW (client-only presentation; worst case = cosmetic regression,
  covered by new UI-safety tests + existing Playwright e2e + deploy-drift tests).
- Status: IMPLEMENTING


CHANGE-ID: CHG-0050
Agent: Nexus-Main (Database Platform owner)
Task: TASK-DB-PLATFORM — Database Platform Overhaul (schema/migration/init/reconciliation + DB→API→client truth)

Scope (2026-09-02):
  Forensic inventory (no edits first): all CREATE TABLE/ALTER/migration/
  repository/bootstrap paths mapped; operator-evidence root causes proven by
  direct execution probes:
  - BUG-197 CRITICAL: migration-gate baseline skeletons (gate runs BEFORE
    AuditRepository in engine_boot) crashed fresh-install bootstrap with
    "no column named rule_name"; reproduced, then healed additively in
    database/engine._create_baseline_tables (rule_name/is_enabled/category/
    parameters + ledger base columns + ticket TEXT→INTEGER PK retype ONLY on
    the empty skeleton shape — legacy rows never rebuilt).
  - BUG-199: manifest.py NEWS/CANDLE schema_version 1 → 2 (SSOT agreement
    with registry-expected; pinned by regression test).
  - BUG-200: /api/debug/state database section now probes the canonical
    migration engine for schema_version + migration_state (was hard-coded
    None → UI could never see schema truth; API was the first broken layer).
  - BUG-201: release/versioning db_versions_provider reads the real
    `migration_state` key (nonexistent `state` key yielded empty strings in
    the operator snapshot); empty → UNKNOWN normalization.
  - BUG-198: stale TestDbConsoleUiSurface now asserts the post-CHG-0032-A1
    registration location (debug_research_routes), not server.py.
  - test_health_never_raises_on_missing_database aligned to the CHG-0043
    part-A NOT_INITIALIZED contract (absent DB = WARNING, not FAIL).
  - docs/DATABASE_CATALOG.md: canonical per-table catalog with
    REQUIRED_FOR_BOOT / REQUIRED_FOR_FEATURE / LAZY_INITIALIZED /
    SHADOW_ONLY / OPTIONAL / FOREIGN_SCHEMA classification + DB→repo→API→UI
    map + retention/perf/PG-portability status.
  - tests/unit/test_database_platform_task_db.py: 12-test regression net
    (manifest agreement, gate-first fresh install, legacy data preservation,
    idempotency, API truth).

NOT touched: installer/*, order_manager, provider_gate, regime, policy,
shadow implementation, replay, observability SSOT, model training.
Status: COMMITTED (19bf95b carried the tree; content verified at HEAD)

## CHG-0043 - STATUS: HARDENED (2026-09-02, Hermes-Main)

Result: REPLAY_ON_CHART_HARDENED. Parts landed: behavior-preserving stepwise
refactor of streaming_replay (hash-equivalence probe-verified on synthetic +
real M1), ReplaySession controller (step/play/pause/reset/seek/checkpoint;
state-correctness fix: fresh engine per prefix run), contract-window causal
projection, REPLAY_API v1 routes wired into create_app (local dataset loader,
offline), engine-backed chart panel with KNOWN/UNKNOWN cursor overlay +
decision drill-down, adversarial future-mutation invariance A-F all PASS,
real-M1 E2E certification through wired create_app PASS. Certification
artifact: artifacts/forensics/replay_on_chart_certification_20260902.json
(dataset fp, model fp 8a5fc653858abf17b92e290920400f8f, replay_id scheme,
leakage matrix, defects fixed). Remaining (documented): news-frame loader for
sessions, checkpoint-resume streaming for very long windows. NOT touched:
policy/regime/execution owners' WIP.
Status: VERIFIED (research-only surface; zero live/broker impact)

## CHG-0051 - Canonical Runtime Certification Gate (TASK-RUNTIME-GATE) (2026-09-02, Nexus-Main)

CHANGE-ID: CHG-0051
Agent: Nexus-Main (runtime verification / certification owner)
Task: P0 runtime forensics + ONE canonical runtime gate.

Scope (2026-09-02):
  Forensic audit (no edits first): traced the REAL operator boot path
  (NexusTradingForexBot.py -> AppConfig.load_from_yaml(configs/live.yaml) ->
  adapter binding (Direct/Remote/Paper) -> LiveEngine.__init__ service graph
  order -> _preflight_or_raise -> run_loop (connect, warmup, workers) ->
  _process_tick_pipeline (features->70D->scaler->inference->regime->policy->
  experience/intelligence/news/freshness gates->risk->dispatch) ->
  _shutdown_async). Verified CLI start path (engine_boot.start_cmd) and its
  PAPER=PaperMT5Adapter boundary (BUG-148), settings DB isolation seam
  (NEXUS_SETTINGS_DB), AuditRepository injection seam (audit_repo kwarg),
  exit-code SSOT (release/exit_codes.py), forensic deploy gate
  (forensics/deploy_gate.py + ForensicHealthEngine) and HealthEngine
  (release/health.py).

  Delivered: scripts/ci/runtime_gate.py - the single canonical
  pre-push runtime certification command. Layers L0..L9 with explicit
  PASS/FAIL/SKIP per stage, deterministic exit codes (0 certified,
  1 runtime failure, 2 configuration error, 3 environment blocked,
  4 contract violation, 5 internal gate error), --json machine output,
  --fast tier, --no-network is the DEFAULT (the gate never calls
  providers/MT5/downloads; only loopback for the in-process API probe).
  LIVE-TRADING SAFETY: paper adapter only, injected disposable
  AuditRepository (artifacts/audit.db NEVER touched), NEXUS_SETTINGS_DB
  isolated to a temp dir, order_send absence asserted (source + runtime).
  The gate CALLS existing certified surfaces (schema_contract, features70,
  liquidity_runtime, inference_validator, HealthEngine, deploy gate
  engine) and does not reimplement them.

  Determinism: seeded synthetic bar series (no random), fixed neutral
  news block, monotonic-timestamp-free assertions.

  CI: same command wired as an explicit ci.yml quality-job step (CI
  remains final authority; no command logic duplicated in YAML beyond
  invocation).
Status: IN_PROGRESS -> verification

## CHG-0048 ADDENDUM - Post-churn re-certification (TASK-UX-01 followup, 2026-09-02, Nexus-Main UX)

Scope: additive status update ONLY (original CHG-0048 scope unchanged, zero new
runtime changes).

Re-certified all 8 delivered parts at post-churn HEAD 5b9c726 (after the Control
Center cc_* modules + /api/operator/*, BUG-205/206/209 fixes, docs Pages v2,
runtime gate work landed on top):

1. SERVED BUNDLE: all six ux_*.js assets resolve over their explicit
   FileResponse routes via repo-venv TestClient create_app(engine_ref=None)
   with HTTP 200 and BYTE-IDENTICAL content to disk (route identity proof).
   /app.js (X-UI-Bundle-Source=REPO), /, /cc_state.js, /cc_components.js,
   /control_center.js, /replay_panel.js also 200. Broken-local-refs gate
   (test_frontend_assets_phase14) green.
2. SUITES RE-RUN: tests/unit/test_web_ux_safety.py 28 passed (plus
   test_frontend_assets_phase14.py: 69 passed combined); node --check 6/6 OK;
   node --test tests/js 66 passed.
3. INTERACTION MATRIX vs NEW cc_* LAYER (27 checks, scratch/ux_cert_matrix.js,
   ALL_PASS, committed 43763f7):
   - typed-LIVE guard (ux.js) vs CC Stop-Bot/Start confirmDialog
     (cc_components.js): separate DOM roots (data-ux-* dialog vs
     ccb-confirm-overlay), separate Esc/Enter handling, my global keydown
     early-returns while the dialog is hidden, CC removes its keydown listener
     on close -> the two-layer confirmation design coexists by construction.
   - NXConn banner vs cc_state STALE semantics: disjoint scopes - NXConn is
     global transport truth (SSE/fetch health), cc_state STALE is per-resource
     data freshness (2.5x interval). cc_state never calls NXConn.*; the banner
     is fed exclusively by app.js live-event call sites (>=10). No duplicate
     event listeners (max one document-level keydown per my module), no id
     collisions (a naive probe flagged 'tab' from both files; proven to be
     VARIABLE names, not id literals - false positive corrected).
   - Palette shortcut keys vs CC views: all 14 palette tabs exist in
     index.html; palette contains no mode/stop commands (dangerous actions
     remain behind the CC confirmDialog / typed-LIVE gates); Ctrl+K, Alt+1..4,
     R do not collide with CC handlers (CC has no global keydown of its own).
   - No broken-local-refs: every index.html local src/href resolves to a
     served route (incl. vendor/fontawesome/all.min.css).
4. DEFECTS IN MY FILES: NONE found at HEAD -> zero repairs required. The two
   post-churn UX defects (BUG-205 replay_panel.js 404, BUG-206 CC blank panel)
   were foreign-file defects and were fixed by their owners (580626f, 7c9401d).
5. Registries updated additively: taskboard row
   "TASK-UX-01 (post-churn certification)" + this addendum. Server restart to
   serve the new bundle to a live browser remains a runtime-owner step (was
   already pending at CHG-0048 closure; file-level serving routes verified
   green at HEAD).
## CHG-0052 - 70D news family bound repair: state-encoding overflow (latent BUG-217) (2026-09-02, Nexus-Main)

- Objective: repair the latent 70D contract violation in the news state
  encoding WITHOUT weakening the contract, touching the validator,
  or altering 50D live semantics.
- Root cause: _STATE_ENCODING (bridge) and its alignment.py mirror map
  BREAKING=4.0 / STALE=5.0 - beyond the [-3,+3] family bound - while the
  dataset path clamps the family to the training distribution
  (clamp_neutral_family, neutral 0.0) before the contract boundary.
- Scope: src/nexus_scalp/governance/alignment.py (state_enc bounded to
  the training-distribution maximum 3.0 - the SAME transform the dataset
  builder already applies; comment documents why), tests/unit/test_bug217_news_state_bounds.py (NEW).
- NOT touched: schema_contract.py validator (unchanged, still fail-closed),
  features/features70.py, shadow70/news_provider.py, live_engine 70D branch,
  UX files, dataset builders, model artifacts, 50D path (base50 validation
  independent), Champion identity, promotion state.
- Risk: LOW-MEDIUM (changes one live encoding value for BREAKING/STALE
  states from out-of-contract 4.0/5.0 to in-distribution 3.0; a
  news-aware 70D model trained on clamped rows sees the value it was
  trained with - the current 70d_liquidity artifact is unaffected as its
  news block is smoke-grade zeros).
- Status: IMPLEMENTING

## CHG-0053 - BUG-212 hard simulation boundary: PAPER boots bind PaperMT5Adapter + SHADOW observation-only execution (2026-09-02, Hermes-EngineGuard)

- MOTIVATION: `NexusTradingForexBot.py --mode paper` bound DirectMT5Adapter on win32
  regardless of mode (BUG-212 black-box evidence: MT5 CONNECTED + real demo position managed
  while configured_mode=PAPER); PAPER was not the documented hard simulation boundary and
  SHADOW still ran position-mutation lifecycles.
- CHANGE (minimal surface, no LIVE behavior change, no order_manager/execution/* edits):
  (1) launcher mode-first adapter bind (PAPER -> PaperMT5Adapter before any real branch);
  (2) LiveEngine.align_adapter_to_boot_mode() called at __init__ (PAPER replaces a real
  adapter BEFORE OrderLifecycleManager wiring; SHADOW keeps live-data adapter by contract);
  (3) _process_tick_pipeline SHADOW boundary downgrades every non-NO_TRADE decision to a
  logged NO_TRADE observation (SHADOW_OBSERVATION_ONLY) before dispatch;
  (4) _evaluate_hedging_policy suppresses hedge dispatch in SHADOW.
- BEHAVIOR: PAPER boot can never touch the real terminal (no account/position RPC); SHADOW
  observes live data and records full counterfactual evidence but never mutates broker
  state; LIVE/gateway/REPLAY/BACKTEST semantics untouched; set_execution_mode hot-switch
  contract (BUG-148) unchanged.
- TESTS: tests/unit/test_launcher_paper_boundary_bug212.py (10 green; fails-before evidence
  on pristine HEAD worktree).
- RISK: LOW-MEDIUM (execution-adjacent but engine-level only; order_manager untouched;
  no dispatch-path change in LIVE). Owner sign-off: runtime-truth owner notified via
  taskboard row TASK-NX-BUG212-PAPERA.
## CHG-0055 - BUG-228 zero-improvement fine-tune skip + structured gate-rejection logging (2026-09-03, Nexus-Main)
- AGENT: Nexus-Main | ROLE: Orchestrator / Training-Loop Reliability | TASK: fix quality-gate misfire on unchanged-baseline candidates
- SCOPE: src/nexus_scalp/training/walk_forward_trainer.py::fine_tune_online tail only (+ new static helper _state_dicts_equal); tests/unit/test_walk_forward_trainer.py (+1 regression test); agents/bugs.md (+BUG-228); docs/agent_handoffs/ (+handoff)
- MOTIVATION: every early-stop-without-improvement window emitted a red [QUALITY GATE REJECTION] + "Atomically reverting to baseline!" for a model whose weights never moved (live evidence 2026-09-03T13:04, accuracy_delta=0.0). Misleading incident signal + raw ANSI print() bypassing the structured logger.
- BEHAVIOR CHANGE: (a) zero-improvement runs (early_stopping_triggered AND best_state==baseline_state) now skip the gate, log INFO 'no improvement over baseline; keeping baseline weights', return baseline, write no checkpoint; (b) genuine gate rejections route the banner through logger.error instead of raw ANSI print. Gate thresholds, gate semantics, and rollback for real candidates unchanged. No shared function signature changed (SHARED API UNCHANGED); no runtime hot path affected (trainer runs off-loop via asyncio.to_thread).
- INVARIANTS: INV-002 (learning places no orders) untouched; baseline-preserving contract kept - the skip path preserves baseline weights exactly like the previous rollback did, minus the false failure report.
- TESTS: test_wf_zero_improvement_early_stop_skips_quality_gate_rejection (new, red-on-prefx scenario: epochs=3, lr=1.0 divergence -> early stop without improvement); full test_walk_forward_trainer.py 6/6 green; ruff+format+mypy+CRITICAL suite via beforePush before commit.
- RISK: LOW (isolated trainer tail; failure mode is a calmer honest log instead of a false red alarm; genuine rejections still reject and roll back).


CHANGE-ID: CHG-0055
Agent: Nexus-Recovery (orchestrated by Nexus-Main)
Role: Execution / Cause-Aware Pending Order Recovery
Task: BUG-231 - pending-order dispatch is not cause-aware (wrong 10016 retcode labels + blind 3x resend of a structurally-invalid SELL_LIMIT; stale PAPER signal geometry survived PAPER->LIVE hot-swap)
Scope:
- src/nexus_scalp/adapters/mt5/mt5_adapter.py (place_pending_order retry loop rewrite; new PENDING_RETCODE_MAP, _classify_pending_retcode, _validate_pending_request, _repair_pending_request, _log_recovery; _translate_retcode relabel)
- src/nexus_scalp/adapters/mt5/diagnostics.py (RETCODE_LABELS corrected to official MQL5 mapping)
- tests/unit/test_pending_recovery_cause_aware.py (NEW, 35 offline regression tests)
- agents/bugs.md (BUG-231), agents/change_control.md (this row), agents/taskboard.md (TASK-BUG231 row)
Affected functions/classes:
- DirectMT5Adapter.place_pending_order (behavior change: cause-aware bounded retry; signature unchanged)
- DirectMT5Adapter._translate_retcode (SEMANTIC CHANGE: label VALUES corrected; signature unchanged)
- NEW: DirectMT5Adapter._classify_pending_retcode/_validate_pending_request/_repair_pending_request/_log_recovery
- diagnostics.RETCODE_LABELS (values corrected; dict name kept)
Contracts touched: MT5 adapter port behavior (IMT5Port implementation internals; no port signature change); observability logging adds recovery_state fields. No DB schema change. No feature/model contract. No strategy logic change.
Runtime paths touched: order dispatch path (pending orders only; market orders untouched); hot path impact positive (structurally-invalid requests now abort in O(1) without 3x broker round-trips).
Owners affected: Hermes-MT5 (adapter owner), Hermes-Execution (order_manager untouched but consumes adapter), Hermes-Runtime (live_engine hot-swap revalidation HANDOFF - open item, NOT in this change).
Risk: MEDIUM-HIGH (execution-adjacent; mitigated by 35 offline regression tests incl. exact production scenario + idempotency guard preserved + valid-request path regression-tested)
Dependencies: BUG-231; independent of CHG-0053
Required tests: tests/unit/test_pending_recovery_cause_aware.py (all green); focused -k "pending or mt5 or recovery" suite = 130 passed / 1 skipped / 0 failed; ruff check+format, mypy, py_compile clean
Status: IMPLEMENTED->VERIFIED (offline); live MT5 smoke NOT executed (safety contract: no live order placement during verification)

CHANGE-ID: CHG-0056
Agent: Nexus-Main
Role: Orchestrator / Test-Suite Reduction & Critical-Gate Optimization (user mission 2026-09-03)
Task: PASS-1 - evidence-driven test-suite reduction: kill the critical gate's measured wall-time hotspots without losing protected coverage
Scope: tests/unit/test_release_system.py (test_cli_exit_codes_contract verify-release root '.' -> tmp_path; same non-release-dir->EXIT_RELEASE contract, empty-dir case already pinned by test_cli_end_to_end.py::test_e2e_14 + e2e_66); tests/unit/test_web_ux_safety.py (pytest-9 sanctioned @classmethod class-scoped fixture; PytestRemovedIn10Warning removed); src/nexus_scalp/observability/logging.py (structlog 26.1 pad_event -> pad_event_to; identical rendered output, DeprecationWarning removed); src/nexus_scalp/release/verify.py (BUG-233 OSError guards in _secrets_scan, fail-safe verdict instead of crash); src/nexus_scalp/dependency_intelligence/{engine,models}.py (fingerprint-keyed result cache for the full AST scan + DependencyGraph.from_dict; 7 repeated 10-14s scans per critical-suite run collapse to 1 build + 0.3s cache hits; non-trading tooling module, output equivalence verified node/edge-identical)
Affected files: the five above + agents/bugs.md (BUG-233) + agents/taskboard.md (TASK-NX-TESTRED-P1) + tests/unit/test_dependency_cache.py (new regression)
Affected functions/classes: DependencyIntelligenceEngine.analyze/_fingerprint/_load_cache/_store_cache; DependencyGraph.from_dict (new classmethod); ReleaseVerifier._secrets_scan; configure_logging (kwarg rename only); test_cli_exit_codes_contract (fixture arg only)
Contracts touched: NONE (no trading, risk, execution, model, persistence, or API contract touched). Dependency-intelligence CLI JSON outputs byte-equivalent on unchanged trees (cached result == fresh result; verified probe: 1403 nodes / 4531 edges both paths)
Runtime paths touched: NONE (dependency scanner is a dev/CI tool, never on the tick path; verify.py runs only in release verification)
Owners affected: dependency_intelligence (previously unowned tooling), observability/logging (renderer kwarg only), release/verify (robustness fix, BUG-233 filed)
Risk: LOW (test-layer + non-trading tooling; production equivalence probes recorded; mypy/ruff/format clean)
Dependencies: user test-reduction mission (continuous loop); complements TASKBOARD-CI-TIME-ATTACK-20260903
Required tests: test_dependency_cache.py (new), test_release_system.py, test_web_ux_safety.py, test_dependency_intelligence.py, test_cli_end_to_end.py, observability guardrails suite
Status: IMPLEMENTED (local gates green; critical-suite re-run pending in this pass)

CHANGE-ID: CHG-0057
Agent: Nexus-Main (orchestrator, repairer-of-record for UI) + Nexus-Coder (A2 backend subagent, 5cc34926+ebf0fd57)
Role: Strategy Marketplace Epic Orchestration (Phase 1-8 backend + UI + BUG-233 short-circuit)
Task: Strategy Marketplace, Isolated Research DB & Adaptive Live Strategy Runtime (NX-MKT EPIC)
Scope: src/nexus_scalp/marketplace/** (13 packs, scoring/measurement/repair/snapshot/service/store), src/nexus_scalp/research/pipeline.py (BUG-233), src/nexus_scalp/web/api_v1/** (12-route marketplace router + wiring mount), Web/marketplace.js + Web/index.html sidebar+section + Web/app.js switchTab hook, tests/unit/test_research_gate_shortcircuit_bug233.py / test_marketplace_backend.py / test_web_marketplace_contract.py
Risk: LOW-MEDIUM (additive, isolated DB, no direct MT5/risk/execution mutation; hot-reload contract is an additive snapshot store, live_engine wiring expressly deferred until the tree is quiet).
Verification: 24 unit tests in 3 files (2+12+8+8 ca) passing RC=0; ruff check+format pass on all touched files; py_compile pass; API wiring verified via FastAPI app.openapi() (12 /api/v1/marketplace paths, 80 total routes); forensics matched: next free IDs verified at commit (BUG-236/CHG-0057), heavy parallel tree churn respected (owned-files-only staging, no git add -A).


## CHG-0058 - Execution pipeline deep forensic + single-authority/teardown/idempotency hardening (2026-09-05, Agent 12)

- AGENT: Agent 12 (Nexus-Main orchestrated) | ROLE: Execution / OrderManager / Protection / Recovery Forensics
- TASK: user brief 2026-09-05 — deep forensic + development + root-cause fix of the REAL execution pipeline
- SCOPE (expected): src/nexus_scalp/execution/*.py (order_manager.py, position_state_machine.py, protection_ledger.py, recovery_budget.py, tickets_cache.py, position_tracker.py), src/nexus_scalp/risk/risk_engine.py (read-only verify unless bypass found), adapters (semantic verification), tests/unit/test_agent12_* (new), agents registries, docs/agent_handoffs/
- OBJECTIVES: (1) prove ONE authoritative dispatch path (no second execution path anywhere); (2) 60-scenario router coverage map; (3) TradeProposal execution_id traceability end-to-end; (4) policy/confluence boundary respected before dispatch; (5) risk clamps authoritative (HARD_MAX_LOTS=10.0, MAX_TOTAL_EXPOSURE=1, free-margin 20%, 30s re-quote lock, 1.0 ATR drift, 3-rejection SAFE_MODE) with no bypass; (6) 11-state machine coherence; (7) protection ledger monotonic/NaN guards; (8) atomic per-ticket teardown (state+ledger+budget+tombstones); (9) recovery budget bounds (horizon clamp 30600s); (10) protective exit priority, no duplicate/contradictory exits; (11) INV-011 broker truth; (12) idempotency INV-005/006; (13) adapter semantic parity (Win32/ZMQ/paper); (14) partial-fill/rejection semantics; (15) EXIT_CLASSIFICATION v3 (UNKNOWN stays UNKNOWN); (16) [EXEC_TRACE] visibility; (17) accounting consistency; (18) paper/shadow/live boundaries (shadow zero order authority); (19) race analysis
- CONSTRAINTS: every confirmed defect FIXED + regression test; no safety weakening; commit-per-step; beforePush quality gate; evidence-based findings only (no invented bugs)
- STATUS: IMPLEMENTING

## CHG-0059 - Backtest/replay deep forensic + determinism/causality/friction hardening (2026-09-05, Agent 15)

- AGENT: Agent 15 (Nexus-Main orchestrated) | ROLE: Research / Backtesting / Replay / MT5-data Forensics
- TASK: user brief 2026-09-05 - analyze/trace/reproduce/fix/validate the complete backtest + historical-replay system; verify MT5 Python API semantics (copy_ticks_range, copy_rates_range, symbol_info, order_calc_profit/margin), UTC handling, boundary inclusivity, determinism, lookahead/causality, friction realism (spread/slippage/latency/fees), direction-aware bid/ask fills, tick SL/TP first-touch, order_send hard safety boundary, replay parity, funnel reconciliation, honest metrics, provenance.
- SCOPE (expected): src/nexus_scalp/research/{backtest,streaming_replay,forward_test,mt5_tick_dataset,event_source,metrics,replay_session}.py; tests/unit/* (new regression suites); agents registries; docs/agent_handoffs/
- CONSTRAINTS: no realism weakening; no order_send in any historical path; no future information; no fabricated fills/metrics; commit-per-step; beforePush quality gate; evidence-based findings only
- STATUS: IMPLEMENTING
## CHG-0061 - Dataset subsystem deep forensic + acquisition/immutability/provenance hardening (2026-09-05, Agent 14)

- AGENT: Agent 14 (Nexus-Main orchestrated) | ROLE: Dataset Engine / Tick Acquisition / Provenance / Immutability Forensics
- TASK: user brief 2026-09-05 - deep forensic + development + root-cause fix of the COMPLETE dataset chain: raw MT5 tick/bar data -> acquisition (copy_ticks_range COPY_TICKS_ALL probed surface) -> validation -> dedup -> normalization -> dataset creation -> fingerprint -> immutable storage -> dataset id -> manifest -> experiment/training. Prove the question 'what exact bytes of data produced this result' is answerable for every downstream research result.
- SCOPE (expected): src/nexus_scalp/research/mt5_tick_dataset.py (acquisition boundary), src/nexus_scalp/research/dataset.py (research dataset builder), src/nexus_scalp/model_generation/dataset_factory.py + artifact_store.py (manifest/persistence), src/nexus_scalp/adapters/mt5/mt5_adapter.py (get_tick_history/get_rate_history verification only), tests/unit/test_agent14_* (new regression suites), agents registries, docs/agent_handoffs/
- OBJECTIVES: (1) BUG-188 post-fix acquisition semantics proven with regression reproduction; (2) tick-level dedup semantics (exact dups, boundary timestamps, same-timestamp distinct identities never merged); (3) fingerprint = content-addressed deterministic (mutate-one-byte changes identity, restore restores identity); (4) fingerprinted-dataset immutability (overwrite/append/silently-repair/reorder paths all blocked); (5) manifest describes the actual stored artifact; (6) provenance honest (NOT_RECORDED, never invented) and immutable after fingerprinting; (7) cache-hit idempotence (repeat/overlap/subset/interrupted/corrupt-cache); (8) partial/failed acquisition never masquerades as complete (fault injection); (9) executable quality gates (malformed/missing-ts/invalid-OHLC/dups/out-of-order/impossible-values rejected loudly); (10) temporal boundaries exact; (11) offline-after-acquisition guarantee (poisoned MetaTrader5 module); (12) serialization determinism; (13) corruption detection (truncated/altered/missing/swapped -> DETECT/REJECT); (14) path safety; (15) concurrency; (16) real bounded historical execution + idempotent re-run.
- CONSTRAINTS: every confirmed defect FIXED + regression test (FAIL BEFORE / PASS AFTER); no gate weakened; no fingerprinted dataset mutated; no fabricated provenance; commit-per-step; beforePush quality gate; evidence-based findings only (no invented bugs); read-only MT5 (no order authority anywhere).
- BOUNDARIES: backtest/replay determinism owned by Agent 15 (CHG-0059); data-flow/hot-path owned by Agent 7 (CHG-0060); execution owned by Agent 12 (CHG-0058). Agent 14 owns the dataset identity/provenance/immutability/acquisition layer.
- STATUS: IMPLEMENTING
## CHG-0062 - Replay-engine deep forensic + order-safety certification (2026-09-05, Agent 18)

- AGENT: Agent 18 (Nexus-Main orchestrated) | ROLE: Replay Engine / Execution-Fidelity Forensics
- TASK: user brief 2026-09-05 (AGENT 18 REPLAY ENGINE) - analyze/trace/research/freeze/reproduce/fix/develop/test/run-real-replay/verify-parity/verify-no-order-authority/commit/handoff for the COMPLETE replay subsystem: (A) dataset replay replay_70d_vector bit-exactness, (B) streaming replay StreamingReplayEngine causal pipeline, order_send runtime-reachability certification (poisoned MetaTrader5 + exploding adapter + monkeypatch interception on REAL MT5-acquired ticks), lookahead attacks, feature/model/decision parity, determinism, state isolation, failure injection, SL/TP first-touch, bid/ask direction semantics, logical clock.
- SCOPE: src/nexus_scalp/research/{streaming_replay,event_source,mt5_tick_dataset}.py (read/fix), src/nexus_scalp/model_generation/replay.py (read/fix), tests/unit/test_agent18_*.py (new), scratch/ns_agent18_*.py (probes+evidence), agents registries, docs/agent_handoffs/
- CONSTRAINTS: INV-002/INV-008 preserved; no realism weakening; no fabricated results; commit-per-step; foreign WIP untouched (Agent-11 risk/order_manager/live_engine, Agent-14 mt5_tick_dataset WIP)
- STATUS: IMPLEMENTING


## CHG-0063 - OOS gate / temporal holdout / forward-test deep forensic + hard-gate hardening (2026-09-05, Agent 17)

- AGENT: Agent 17 (Nexus-Main orchestrated) | ROLE: Research Validation / OOS Gate / Temporal Holdout / Forward-Test Forensics
- TASK: user brief 2026-09-05 — prove OOS = genuinely unseen future data with NO override path; adversarial-audit the hard gate end-to-end (oos.py, splitting.py, pipeline.py, scoring.py, registry.py, lifecycle.py, model_generation/validation.py, model_lab/{evaluation,promotion}.py, forward_test.py); verify MT5 official UTC/range semantics (copy_rates_range/copy_ticks_range/history_orders_get/history_deals_get/order_calc_profit); verify cutoff/freeze immutability; preprocessing/feature/label isolation; sample sufficiency; metric/ECE integrity; real bounded OOS + forward run + repeatability; FIX every confirmed defect with regression tests.
- SCOPE (expected): src/nexus_scalp/research/{oos,splitting,forward_test,pipeline,scoring,registry,leakage,metrics}.py, src/nexus_scalp/model_generation/validation.py, src/nexus_scalp/model_lab/*, tests/unit/test_agent17_* (new), agents registries, docs/agent_handoffs/
- BOUNDARIES: dataset acquisition layer owned by Agent 14 (CHG-0061) — mt5_tick_dataset.py is foreign; replay/streaming engine owned by Agent 15 (CHG-0059) / Agent 18 (CHG-0062); execution owned by Agent 12 (CHG-0058). Defects outside this scope are routed via bugs.md/handoff, not edited.
- CONSTRAINTS: no threshold weakening; no OOS reuse for tuning; NaN never converts to PASS; every confirmed defect fixed + regression test; commit-per-step; beforePush quality gate; evidence-based findings only
- STATUS: IMPLEMENTING
## CHG-0062 — Replay-engine: LIMIT pending-queue fix (Agent 18 forensic lane)

- FIX: StreamingReplayEngine now honors LIMIT/STOP proposals as PENDING orders. A LIMIT
  resting at its level fills on the FIRST tick where ask <= level (BUY_LIMIT) or
  bid >= level (SELL_LIMIT) — live OrderManager parity — rather than being
  immediately consumed at the spawning tick's market price. Filled-pending entries
  enter the same _OpenPosition ledger path as market fills; remaining pendings are
  reported honestly in ReplayRunResult.pending_orders / pending_order_count.

## CHG-0058-FOLLOWUP - BUG-247 residual hedge/reversal gates (2026-09-05, Agent-12, CHG-0058 follow-up)

- SCOPE: `src/nexus_scalp/execution/order_manager.py` (execute_order + _run_protection_chain AI-flip leg) + `tests/unit/test_agent12_bug247_hardening.py` (3 regression tests) + `agents/bugs.md` (BUG-247 row)
- WHY: the CHG-0058 forensic census proved single-authority (no second execution path outside the manager) but flagged two remaining entry-path gates inside the manager: (P1) the AI-flip direct `place_pending_order` bypassed `SAFE_MODE`, (P2) `execute_order` (hedge) bypassed `HARD_MAX_LOTS`. Both fixed fail-closed; primary-path semantics unchanged. See `agents/bugs.md:BUG-247` + `docs/agent_handoffs/2026-09-05_agent12_execution_forensic.md` (Addendum).


CHANGE-ID: CHG-0060
Agent: Agent 6 / Nexus-Main (Architecture / Integration / Runtime Forensics)
Role: Architecture forensics + mandatory fix
Task: Hexagonal boundary audit + event-loop integrity + web control-surface correctness + import-cycle adjudication; BUG-239 (async toggle route) + BUG-240 (dead audit_db import + PRAGMA d[1] name bug) fixes
Scope:
- src/nexus_scalp/web/diagnostics_state_routes.py (toggle_engine: BUG-239 fix - async route; task lifecycle preserved)
- src/nexus_scalp/web/debug_research_routes.py (/api/debug/trace: BUG-240 fix - real audit db path resolution + PRAGMA d[1] name bug; closes OBS-001)
- tests/unit/test_web_engine_toggle_bug239.py (NEW 6-test regression net)
- agents/bugs.md (BUG-239, BUG-240), agents/taskboard.md, this registry
Affected functions/classes: toggle_engine; get_debug_trace
Contracts touched: NONE (no trading/risk/execution/model/DB schema contract). INV-001/002/004 preserved and re-proven.
Runtime paths touched: web control surface (engine START/STOP; debug trace read); tick path untouched.
Owners affected: Hermes-UI (web surface); Hermes-Runtime informed (run_loop scheduling semantics unchanged)
Risk: MEDIUM-LOW (START is an operator control; fix RESTORES designed behavior; regression-guarded)
Dependencies: independent; foreign WIP never staged
Required tests: test_web_engine_toggle_bug239.py + test_qa_deep_security_surfaces + test_web_ux_safety + ruff/format/mypy
ID COLLISION NOTE: an earlier Agent 6 registration used CHG-0058 while uncommitted; Agent 12 (commit 2d030668) later claimed CHG-0058 for the execution-pipeline mission; Agent-11's taskboard row claims CHG-0064 for BUG-239..242 (execution/risk). Agent 6's web-surface work re-registered under the next free declared id per the registry-id-race rule.
Status: IMPLEMENTING -> VERIFIED (offline TestClient + real create_app; 6/6 regression green)

## CHG-0064 - Execution/Risk/OrderManager deep forensic + confirmed-defect repair (2026-09-05, Agent 11)

- AGENT: Agent-11 (user brief 2026-09-05: EXECUTION / RISK / ORDERMANAGER DEEP FORENSIC + FIX)
- SCOPE: src/nexus_scalp/risk/risk_engine.py (evaluate_proposal sizing tail),
  src/nexus_scalp/execution/order_manager.py (_is_exposure_available, dispatch_order,
  new close_position_manual/modify_position_manual), src/nexus_scalp/web/server.py
  (/api/positions/close + /api/positions/modify reroute),
  tests/unit/test_agent11_execution_risk_forensic.py (new, 14 tests).
- DEFECTS FIXED (all FAIL-BEFORE proven): BUG-239 evaluate_proposal UnboundLocalError
  + micro-account margin resurrection hole (152e8ebe); BUG-240 engine-wide exposure
  gate counted only symbol-scoped tickets (ad06738f); BUG-241 SAFE_MODE dead on
  primary dispatch path (ad06738f); BUG-242 web operator close/modify bypassed
  OrderLifecycleManager / INV-004 (d0a9b6d4). Regression suite 14 tests.
- COORDINATION: alongside Agent-12 CHG-0058 (execution forensics); additive/fail-closed.
- INVARIANTS: INV-003/INV-004 strengthened; no clamp/breaker weakened.
- STATUS: VERIFIED (paper fixtures, no live trading)


## CHG-0059-W2 - Agent-15 wave-2 strong QA on backtest/replay (2026-09-05T05:30, Agent 15)
- AGENT: Agent 15 (Nexus-Main orchestrated) | ROLE: Research / Backtesting / Replay / MT5-data Forensics (QA composer)
- TASK: User follow-up brief (wave 2): strong adversarial QA on CURRENT main using GitHub Master/Commander discipline. Independent verification of wave-1 fixes (BUG-244 bar-mode replay, BUG-245/246/247/248 dataset/governance/execution) without assuming they work; composer verification of Agent-18 handoff (pending LIMIT queue + BUG-244 containment interplay); bounded 100k determinism where feasible; full research/replay family suite green; every confirmed defect fixed + regression tested.
- SCOPE: src/nexus_scalp/research/{streaming_replay,event_source,mt5_tick_dataset,backtest,forward_test}.py (verify/fix), tests/unit/* (new harness), agents registries, docs/agent_handoffs/ (composer handoff).
- BOUNDARIES: no realism weakening; no order_send in research; no fabricated metrics; INV-002/INV-008 preserved; parallel-agent WIP never staged.
- STATUS: IMPLEMENTING

## CHG-0058-W2 - Wave-2 forensic residual hardening (2026-09-05, Agent 12 W2)

- SCOPE: `src/nexus_scalp/experience/outcome_recovery.py:classify_exit_with_evidence` - the `reason==0` branch (MT5 DEAL_REASON_CLIENT ambiguous) + `tests/unit/test_agent12_bug250_exit_classification.py` (3, offline) + `agents/bugs.md:BUG-250`.
- WHY: the CHG-0058 / Wave-2 forensic sweep (router coverage map + exit classification v3 + accounting) found the `reason==0` promotion conflated PnL magnitude with broker evidence (any non-zero profit promoted to `MANUAL_CLOSE`; INV-012 violated). The predicate now requires comment or price-geometry corroboration (fail-closed; profit alone -> `UNKNOWN`). No live-broker-path, clamp, or gate semantics changed.
- VERIFICATION: situ probe before/after on `reason==0`; full exit/accounting suites `test_trade_lifecycle_task3` + `test_performance_metric_truth` + `test_agent11_scenario_coverage_contract` stay green (102 passed); ruff/mypy/py_compile clean.




## CHG-0065 (cont.) — registry + handoff rows landed (2026-09-05, Nexus-Main)
- Registry rows (CHG-0065 main entry + TASK-SMOKE-E2E taskboard row) plus the
  full agent handoff doc landed on a re-attached main working tree at HEAD
  75ce90e9..(registry commit); landing path may differ from the earlier
  branch-swap window — content byte-verified against this registry text.
- Handoff: docs/agent_handoffs/2026-09-05_nexus-main_smoke-e2e-chain.md

## CHG-0061-W2-GATE - dataset hardening suites gated in default CI (2026-09-05, Nexus-Main, Wave-2 close-out)

- AGENT: Nexus-Main (orchestrator) | ROLE: ecosystem QA closure
- TASK: close the QA-verdict P0 from docs/agent_handoffs/WAVE2_QA_VERDICT_ECOSYSTEM_SCALE.md —
  CHG-0061's landed hardening (test_agent14_dataset_integrity R1-R8, 19 tests) plus
  test_dataset_split_purge_bug244, test_70d_dataset_parity_task3 and the Wave-2 runtime
  bars hygiene suite (test_runtime_bars_normalize) were tracked on main but present in
  NO CI gate; a regression would ship green.
- CHANGE: tests/critical_suite.txt += the four suites (commit b7dd77af). beforePush and
  the CI quality job read the same manifest (gate_parity enforced), so the fetch->clean->train
  and dataset identity/immutability contracts now gate EVERY push to main.
- SCOPE: tests/critical_suite.txt only (manifest). No src semantics touched; no gate weakened;
  coverage ADDED only.
- STATUS: VERIFIED (offline) — four suites green locally (78-test combo 111s incl. a2 lineage
  + agent11 forensic suites). Remaining QA items 4-7 (bypass-cleaning property test,
  offline-enforcement contract, CSV-absent skip contract, 16-way cache isolation,
  suite-manifest completeness CI check) are registered on the taskboard row
  TASK-W2-ECO-GATING for the next wave.

## CHG-SMOKE-E2E-V2 - Production-Grade E2E Smoke Test (2026-09-05, Nexus-Main)

- AGENT: Nexus-Main (orchestrator) | TASK: User TRUTH-GATED mission - Production hardening of E2E Runtime verification - from basic health set to high-signal operational gate. Single prod-grade layered certification answering "Can repo be safely started, exercised, observed, stopped, preserving contracts?"
- SCOPE: src/nexus_scalp/smoke/ (new package: coverage_matrix 237 entries + 12 neg + result_contract redaction/budgets/human summary + runner 1180 lines, 13 layers) + src/nexus_scalp/cli/smoke_commands.py [Typer subapp: smoke --fast/--full/--runtime/--safety/--report --json --evidence] + src/nexus_scalp/cli/app_factory.py [addTyper smoke_app] + .github/workflows/ci.yml [fast tier lane in quality] + agents/E2E_SMOKE_TEST.md [canonical operator guide] + tests/unit/test_smoke_self.py [13 regressions]
- FEATURES: L0 static/L1 contracts/L2 integration (real Tick->50D->70D->ScalpNet->Policy->Risk->Accounting)/L3 runtime (REAL LiveEngine isolated, PAPER, disposable DBs)/L4 safety (12 neg injections)/lifecycle/dataflow/hotpath/authority/identity/determinism/budgets/taxonomy. No mocks, deterministic synthetics, no live trading, seam-tripwire, secret redaction.
- SAFETY: PAPER adapter only, disposable DBs, isolated settings, offline, no order_send (proved), secrets never emitted.
- MEASURED: fast ~2s, full ~17s, self-suite 13 tests. Layers: 40 fast, 42 full; 12 safety PASS.
- STATUS: IMPLEMENTING -> VERIFIED (offline) -> READY_FOR_REVIEW
Agent: Hermes-Main (Hermes-UI-01), Role: Dashboard / UX / Runtime UI
Task: TV-REDESIGN-1 — Technicals card professional redesign (UI layer only)
Registered: 2026-09-06. Plan: audit probes PASSED (scratch/tv_audit_1.py 15/15).
In scope: Web/tv_widget.html, Web/tv_widget.js, Web/tv_widget_styles.css (new, served additively), Web/index.html (embedded copy sync), tailwind.config.js (safelist additions), Web/tailwind.css (build script rebuild), tests/js/tv_widget_redesign.test.js (new).
Out of scope: src/** (zero backend changes), API contracts (API_V1_INDICATORS envelope untouched), trading logic, other cards/pages.
Design decisions (user-approved 2026-09-06): gauges -> distribution bars; last_close + meta.generated_at surfaced as real data.


CHANGE-ID: CHG-0066
Agent: Hermes (PERF-DEADLETTER wave)
Role: Performance & reliability audit + fix (user mission 2026-09-10: audit AND fix end-to-end)
Task: TASK-PERF-DEADLETTER — trace the ~553k audit_dead_letter producer to root cause; bounded dead-letter retention; /health integrity_check separation; EXEC_TRACE rate limit; regression protection; safety pins.
Scope: src/nexus_scalp/database/app_columns.py (NEW APP_REQUIRED_COLUMNS), src/nexus_scalp/database/engine.py (_create_baseline_tables skeleton heal), src/nexus_scalp/database/manifest.py (AUDIT 8→9 SSOT alignment), src/nexus_scalp/adapters/database/dead_letter_store.py (bounded retention), src/nexus_scalp/adapters/database/audit_repository.py (facade counter), src/nexus_scalp/signals/policy.py (EXEC_TRACE rate limit, trade-relevant always-emit), src/nexus_scalp/web/diagnostics_state_routes.py (/health TTL cache), src/nexus_scalp/web/debug_snapshot.py (pruned-rows counter), tests/unit/test_perf_*.py + test_dead_letter_retention_cap.py (NEW 35 tests), tests/critical_suite.txt (+5 entries), agents registries, docs/agent_handoffs/2026-09-10_perf_deadletter_health_exectrace_wave.md.
Contracts touched: DB_MIGRATION (baseline heal, additive), RETENTION_POLICY (dead-letter cap additive), HEALTH_ENTRY (unchanged semantics; TTL cache additive). BUG-254/BUG-255 filed.
Runtime paths touched: migration baseline (boot only), audit worker (retention on worker thread, off tick), /health route (cache), policy log site (rate limit). NO trading/risk/execution/model/halt changes. PERSISTED_HALTED fail-closed + LIVE/PAPER separation re-pinned.
Owners affected: DB platform (baseline heal owner), audit persistence owner, observability owner.
Risk: MEDIUM-LOW (persistence-path fixes, fail-loud, heavily regression-pinned; gates: ruff/format/mypy/migration-safety/smoke --fast green).
Dependencies: none conflicting; foreign WIP never staged.
Required tests: see critical_suite.txt PERF wave entries.
Status: VERIFIED (offline; full gate evidence in the handoff doc)