feat(finance): build simulated approval requests

[huangruiteng]

Motivation / 动机

The merged Goal Channel operation-card lifecycle and simulation executor own generic confirmation, callback, claim, recovery, and result readback. Finance still lacked a domain-owned producer that turns one already-bounded candidate action into the canonical loopx_operation_request_v0. Without this seam, a research caller must hand-assemble order, evidence, economics, expiry, no-trade conditions, executor binding, and approval projection.

已合并的 Goal Channel 操作卡与模拟 executor 已负责通用确认、callback、claim、恢复和结果读回；Finance 仍缺少领域 producer，把一个已经收敛的候选动作转换成 canonical loopx_operation_request_v0。没有该边界，研究调用方仍需手拼订单、证据、经济性、过期时间、禁交易条件、executor binding 和审批投影。

Scope decision / 范围决策

This PR was rebuilt on current main. The obsolete #4275 stack was removed: the diff is now seven Finance package/test files rather than 57 duplicated Core, Dashboard, Lark, and generated-asset files. Core card authority is reused, not copied.

本 PR 已基于当前 main 重建并删除过期的 #4275 叠加历史：差异从 57 个重复的 Core、Dashboard、Lark 与生成资源文件，收敛为 7 个 Finance package/test 文件；不复制 Core 卡片权威。

Changes / 改动

• Adds deterministic finance_transaction_approval_input_v0 → finance_transaction_approval_packet_v0 reduction.
• Emits the exact canonical request consumed by goal-channel prepare-operation.
• Hard-pins account:simulation, finance.order.simulate, finance.operation.simulate, limit orders, positive bounded economics, expiry, and explicit provider-qualified principals.
• Freezes evidence observation time in the approval projection; future observations fail closed.
• Reuses Finance public-boundary validation and rejects local/private hosts and credential-like URL query material.
• Preserves source-period/spot-evidence behavior from Finance 0.6.0 and releases the additive producer as 0.7.0.
• Provides both managed-extension stdin dispatch and direct build-operation-request CLI output.

中文：新增确定性的 Finance 审批 packet reducer，输出 Core 已支持的 operation request；固定为仅模拟账户、operation 与权限，要求显式审批主体、正向净经济性、过期时间和禁交易条件；在卡片中冻结证据观察时间，拒绝未来证据、私有地址和疑似凭证查询参数；保留 0.6.0 的 source-period/spot evidence，并以 0.7.0 发布新增 producer。

RFC and product entry points / RFC 与产品入口

• Authority: Finance owns financial semantics only. Core remains the sole proposal/confirmation/claim/outcome owner; Lark remains authenticated transport. The builder neither discovers nor broadens approvers or executor authority.
• CLI / managed Turn: both routes produce the same canonical request and deterministic idempotency key.
• Dashboard: no companion change is required. The existing schema-driven operation_review_frame_v0 consumes this canonical projection; the integration test reaches that TypeScript frame through the real Lark card builder.
• Goal Channel Lark: no second renderer or callback path is added. The existing operation card renders the same fields and owns confirm/reject and result readback.
• Boundary: confirmation can execute only the bundled non-effectful simulator. It cannot place an order, sign, transfer, move funds, or grant standing trading authority.

中文：Finance 只拥有金融语义；Core 继续独占 proposal/确认/claim/outcome，Lark 只负责认证 transport。CLI 与 managed Turn 同源输出；Dashboard 复用既有 TypeScript review frame；Lark 复用既有卡片和 callback；确认只可运行无外部效果的模拟 executor，不授权真实下单、签名、转账或持续交易权限。

Validation / 验证

• 231 passed: all test_finance_*.py, test_chat_operation_actions.py, and test_lark_goal_channel_operation.py.
• Focused package/license run: 7 passed.
• Ruff and git diff --check: passed.
• LoopX premerge canary: 17 checks executed, 0 failures/warnings; public-boundary scan passed.
• Wheel build: loopx_finance_value_discovery-0.7.0-py3-none-any.whl built successfully.
• No live Lark message, venue call, real order, signature, transfer, or other external financial effect was performed.

Risk / 风险

The remaining coupling is intentional: callers must supply the executor revision from enabled-extension readback and principals from current Goal Channel operator authority. Core revalidates both at preparation/callback/dispatch boundaries. The producer does not infer candidate truth or trading readiness; upstream research remains responsible for evidence quality and admission.

剩余耦合是有意保留的：调用方必须从已启用 extension 的读回取得 executor revision，并从当前 Goal Channel 操作权限取得审批主体；Core 在准备、callback 与 dispatch 边界重新校验。Producer 不推断候选真实性或交易准入，上游研究仍对证据质量和准入负责。

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head reviewed: f65f60020adc5cbc3100e890384e056016c239c8

动机

主干已经具备通用 operation card、Dashboard operation_review_frame_v0、Lark 回调/恢复以及本地模拟执行器，但 Finance 仍缺少一个受约束的生产者来把投研候选转换为规范 loopx_operation_request_v0。关闭本 PR 会迫使赚钱 Agent 手工拼装权限、经济性、证据、过期与 no-trade 字段；原 PR 直接堆叠旧卡片实现又会制造第二套真相源。本次因此保留 Finance producer，删除已被主干吸收的堆叠历史。

改动思路

Finance 扩展只负责金融语义验证与请求构建：要求模拟模式、受支持订单类型、正数价格/数量/费用、成本覆盖、可公开引用的证据、已观测时间、未来到期时间和 no-trade 条件；随后复用 Core 的 canonical operation envelope、权限与幂等契约。卡片展示、确认回调、恢复、Todo/receipt 与 executor effects 继续由现有 Core/Dashboard/Lark 链路拥有。

具体改动

• 将原 57 文件堆叠差异收敛为 7 个 Finance 包文件，不修改 Core、Dashboard 或 Lark 实现。
• 新增 finance.transaction_approval_input_v0 构建器及 managed source/direct CLI 两条等价入口。
• 将包版本提升为 0.7.0，补齐双语 README、入口点及 manifest。
• 加入 evidence_observed_at UTC 规范化与未来时间拒绝；拒绝私网/本机/带凭据查询参数的证据 URL。
• 固定集成测试时钟，避免原测试只在作者当天有效；验证 canonical request 可被现有真实 TypeScript review frame 和模拟执行器消费。

关键代码讲解

build_finance_transaction_approval_packet 是唯一领域 reducer：它不发送 Lark、不创建第二份状态，也不授予真实交易权限。它输出 finance.order.simulate、simulation=true 和 Core 所需 principals/executor revision；调用者只能传入来自当前 Goal Channel operator authority 的 provider-qualified principals，Core 在 preflight/callback 时继续复核。CLI 的 managed source path 与 direct command 共用同一函数，避免 Turn 与手工调用产生不同语义。

对主干的风险

风险可控且默认隔离：新增能力位于可选 Finance provider，主干通用 reducer 的基线夹具在 base/head 上字节一致；无网络写入、无券商调用、无真实下单能力。主要剩余风险是调用者错误提供 principal/executor revision provenance，README 已明确约束，Core 仍会二次校验。此次 exact head 未重新发送真实 Lark 卡片，因为传输与回调代码没有变化；同一 canonical frame 的集成测试已覆盖。

我的整体评价

本 PR 经重构后仍有明确且不可由主干现有卡片能力替代的价值：它补的是 Finance producer，而不是 UI 或消息队列。范围已经与管家 RFC、投研目标和三层 capability 分工对齐，验证充分，无阻断发现，建议合并。

English verdict: APPROVE. The rebased change keeps only the Finance-owned, simulation-only producer for canonical operation requests and reuses the existing Core/Dashboard/Lark approval lifecycle. The obsolete stacked card history is removed; authority remains with the Goal Channel/Core, and no live trading effect is introduced.

Validation: 231 focused extension/Core/Lark tests passed; package/license tests passed; Ruff and git diff --check passed; the standard premerge canary ran 17 checks with zero failures/warnings; wheel build succeeded; structured loopx pr-review --check-result returned APPROVE with no blockers.

[huangruiteng]

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

Exact head reviewed: 4e346e30c2ed49890d490b4511460befe1e3aa6b

动机

主干已经具备通用 operation card、Dashboard operation_review_frame_v0、Lark 回调/恢复以及本地模拟执行器，但 Finance 仍缺少一个受约束的生产者来把投研候选转换为规范 loopx_operation_request_v0。关闭本 PR 会迫使赚钱 Agent 手工拼装权限、经济性、证据、过期与 no-trade 字段；原 PR 直接堆叠旧卡片实现又会制造第二套真相源。本次因此保留 Finance producer，删除已被主干吸收的堆叠历史。

改动思路

Finance 扩展只负责金融语义验证与请求构建：要求模拟模式、受支持订单类型、正数价格/数量/费用、成本覆盖、可公开引用的证据、已观测时间、未来到期时间和 no-trade 条件；随后复用 Core 的 canonical operation envelope、权限与幂等契约。卡片展示、确认回调、恢复、Todo/receipt 与 executor effects 继续由现有 Core/Dashboard/Lark 链路拥有。

具体改动

• 将原 57 文件堆叠差异收敛为 7 个 Finance 包文件，不修改 Core、Dashboard 或 Lark 实现。
• 新增 finance.transaction_approval_input_v0 构建器及 managed source/direct CLI 两条等价入口。
• 将包版本提升为 0.7.0，补齐双语 README、入口点及 manifest。
• 加入 evidence_observed_at UTC 规范化与未来时间拒绝；拒绝私网/本机/带凭据查询参数的证据 URL。
• 固定集成测试时钟，避免原测试只在作者当天有效；验证 canonical request 可被现有真实 TypeScript review frame 和模拟执行器消费。

关键代码讲解

build_finance_transaction_approval_packet 是唯一领域 reducer：它不发送 Lark、不创建第二份状态，也不授予真实交易权限。它输出 finance.order.simulate、simulation=true 和 Core 所需 principals/executor revision；调用者只能传入来自当前 Goal Channel operator authority 的 provider-qualified principals，Core 在 preflight/callback 时继续复核。CLI 的 managed source path 与 direct command 共用同一函数，避免 Turn 与手工调用产生不同语义。

对主干的风险

风险可控且默认隔离：新增能力位于可选 Finance provider，主干通用 reducer 的基线夹具在 base/head 上字节一致；无网络写入、无券商调用、无真实下单能力。主要剩余风险是调用者错误提供 principal/executor revision provenance，README 已明确约束，Core 仍会二次校验。此次 exact head 未重新发送真实 Lark 卡片，因为传输与回调代码没有变化；同一 canonical frame 的集成测试已覆盖。

我的整体评价

本 PR 已重放到包含 #4404 门禁修复的最新主干；经重构后仍有明确且不可由主干现有卡片能力替代的价值：它补的是 Finance producer，而不是 UI 或消息队列。范围已经与管家 RFC、投研目标和三层 capability 分工对齐，验证充分，无阻断发现，建议合并。

English verdict: APPROVE. The rebased change keeps only the Finance-owned, simulation-only producer for canonical operation requests and reuses the existing Core/Dashboard/Lark approval lifecycle. The obsolete stacked card history is removed; authority remains with the Goal Channel/Core, and no live trading effect is introduced.

Validation: 231 focused extension/Core/Lark tests passed; package/license tests passed; Ruff and git diff --check passed; the standard premerge canary ran 13 checks with zero failures/warnings; wheel build succeeded; structured loopx pr-review --check-result returned APPROVE with no blockers.