v1.0.0-rc.1: All 10 hardening layers + production safety - #1
Merged
Conversation
WP-001: Makefile & Developer Tooling Setup WP-003: Linting & Code Quality Enforcement (39 ruff errors fixed) WP-004: Pyright Type Checking (47 strict-mode errors fixed) WP-005: Docker Containerization (Dockerfile, compose, .dockerignore) WP-006: GitHub Actions CI Pipeline (lint/typecheck/test/docker) WP-007: Database Migration Framework + ADR-005 Full CI pipeline passes: ruff, black, isort, pyright (0 errors), pytest (7/7)
New src/traderos/ layered architecture: domain/ — analysis, liquidity, risk, strategies, backtesting, research infrastructure/ — config, database, data application/ — orchestrator interfaces/ — cli, visualization Dual directory strategy: old flat modules become re-export shims. All configs updated: Makefile (PYTHONPATH), pyproject.toml (pyright, coverage), Dockerfile, CI workflow. Full CI pipeline passes: ruff, black, isort, pyright (0), pytest (7/7).
…y stubs, config v2, error handling, logging, event bus, architecture tests, MarketDataRepository - WP-009: 17 domain entity dataclasses (Market, Candle, OHLCV, Signal, Strategy, etc.) - WP-010: Repository[T] ABC + 16 domain repository interfaces - WP-011: InMemory implementations for all 16 repositories - WP-013: Config v2 — frozen dataclass with YAML/env loader, backward-compatible .get() - WP-014: Exception hierarchy (TraderOSError → Domain/Infra/Application/InterfaceError) - WP-015: StructuredLogger producing JSON logs - WP-016: EventBus + InMemoryEventBus with frozen Event dataclass - WP-017: 9 architecture enforcement tests (layer separation, import validation) - WP-018: MarketDataRepository combining Market + Candle repos - 163 tests passing, 0 lint errors, 0 typecheck errors, 82% coverage
…a services) - WP-012: SQLiteRepository base + 16 SQLite repo implementations - WP-019: DataCollector ABC + CollectorRegistry in domain layer - WP-020: BinanceCollector (reads from Binance REST API) - WP-021: YFinanceCollector (stub for later yfinance wrapper) - WP-022: MockDataCollector (deterministic synthetic OHLCV) - WP-023: DataNormalizer + DataValidator services - 280 tests passing, 0 lint, 0 typecheck, 83% coverage
…tation (Sharpe/Sortino/Calmar), BacktestStep tracking, 5 tests
…rAdapter, DeviationAnalysisService, 26 tests
…itService, Unified CLI, 26 tests
…stService, VisualizationService, 24 tests
…- 8 tests, 497 total
…ill_price fix Gap 1: Wire market data feed into orchestrator - DataIngestionService.get_latest_close() resolves close price by market_id - Factory builds CollectorRegistry + parses settings.yaml symbols - run_forever() reads prices via data_ingestion instead of hardcoded 100.0 Gap 2: Wire Alpaca broker for LIVE mode - Factory branches broker selection on TradingMode.LIVE - Uses AlpacaBrokerAdapter when alpaca_api_key/secret are configured - Falls back gracefully to PaperBrokerAdapter if alpaca-py absent - Config gains typed alpaca fields + env var mappings Gap 3: Fix fill_price multiplier bug - BrokerAdapter.place_market_order accepts close_price for absolute pricing - PaperBrokerAdapter returns ref_price * slippage (not just slippage) - process_candle double-multiply workaround removed - All call sites updated (orchestrator, tests, Alpaca adapter) Hardening: Config typed fields, daemon panic recovery in run_forever
- 33 ruff errors fixed: DTZ001/DTZ005 tzinfo=UTC, FURB157 Decimal, E741 rename l, E501 line length, B011 raise AssertionError, RUF059 prefix unused var, F401 unused import, RUF100 unused noqa - 42 pyright errors fixed: FastAPI optional deps TYPE_CHECKING guard, public ensure_fastapi, running @Property, BaseModel type:ignore, TradeSide enum, total_equity, StrategyBase instantiation, isinstance removal - 514 tests pass, lint clean, typecheck clean
…dules, close_price, cmd_signal
Batch 1 (Config alignment): - GAP-14: Config.load() maps settings.yaml nested keys - GAP-15: Docker MODE=paper env var removed - GAP-25: PaperBrokerAdapter reads DEFAULT_CASH env var Batch 2 (API hardening): - GAP-11: /papertrade/session accepts market_ids body - GAP-17: CORSMiddleware added - GAP-27: /metrics returns warning when orchestrator not running Batch 3 (Stub replacements): - GAP-7: strategy_lab.py stripped to list-only - GAP-9: notifications: file persistence + webhook POST - GAP-21: Alpaca limit order implemented - GAP-22: EventBus exception isolation Batch 4 (Infrastructure hardening): - GAP-16: HEALTHCHECK in Dockerfile - GAP-20: backtest timeout after max_duration_seconds - GAP-23: shutdown timeout daemon force-exit Batch 5 (Remaining): - GAP-12: all cash reads DEFAULT_CASH env var (verified) - GAP-19: CLI --json flag for key subcommands 509 tests pass, 78% coverage, 0 lint/typecheck errors
…h, Audit, Metrics, Manifest
- Add KillSwitch dataclass with circuit breaker (max consecutive failures), daily loss limit, and trade-blocking can_trade() method - Add can_trade() to RiskService that checks kill switch + max position count - Wire kill switch into orchestrator: check can_trade() before placing orders, record_success() on filled trades, record_failure() on unfilled - Add EventBus backward-compat alias in events.py (isort-safe) - 509 tests pass, 0 lint/typecheck errors
- Add X-API-Key authentication via FastAPI middleware - API key read from TRADEROS_API_KEY env var (optional) - When key is set, all endpoints require X-API-Key header - When not set, all endpoints remain open (dev mode) - Middleware applies globally to all routes - 509 tests pass, 0 lint/typecheck errors
…ersistence, config validation - retry_with_backoff() with exponential backoff, jitter, max 3 attempts - purge_old_entries() with 90-day retention on 5 SQLite tables - v003_strategies migration: strategy_registry table + 3 seed strategies - Config validation: db_path dir check, MAX_DRAWDOWN 0-100 range, forex_symbols type check - Factory calls purge_old_entries() on startup after migrations - Retry wrapped around Alpaca broker submit() and notification webhook - 585 tests pass, 85.04% coverage, lint/typecheck clean
…CENSE, .env.example - Replace 4 production asserts with proper RuntimeError checks - Unify version to 0.8.0 across pyproject.toml, VERSION, CHANGELOG - Add MIT LICENSE file - Update .env.example with all documented env vars
- Rewrite README to reflect current architecture, CLI/API usage, config ref - Add CONTRIBUTING.md with setup, standards, commit convention, architecture rules
- Delete unused CLI modules: dashboard.py, research.py, strategy_lab.py - Delete unused visualization modules: charts.py, liquidity_charts.py - Delete empty interfaces/visualization/ package - Add smoke test for api/main build_app() - 587 tests pass, 87.83% coverage
- Add security job: pip-audit (dependency vulns) + bandit (SAST) - Replace raw docker build with build-push-action pushing to ghcr.io - Tag with commit SHA, branch name, and 'latest' on main branch - Docker job now depends on security job
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merges sprint-2-paper-trading (35 commits ahead) into main for v1.0.0-rc.1 release.
Layers 1-6: Architecture Hardening
Layers 7-9: Trading + Testing
Layer 10: Production Hardening
Phases 0-3: Release Polish
Verification