Skip to content

test(bayn): add real Alpaca sandbox contract proof - #13325

Open
gregkonush wants to merge 15 commits into
mainfrom
codex/bayn-alpaca-sandbox-contract-proof
Open

test(bayn): add real Alpaca sandbox contract proof#13325
gregkonush wants to merge 15 commits into
mainfrom
codex/bayn-alpaca-sandbox-contract-proof

Conversation

@gregkonush

@gregkonush gregkonush commented Jul 28, 2026

Copy link
Copy Markdown
Member

Summary

  • add an opt-in real Alpaca paper contract proof through the production connection, verified session, read, submit, lookup, cancel, and cleanup interpreters
  • fail closed on the exact paper endpoint, protected credential binding, verified sandbox account identity, closed regular session, safe fractional asset, exact source SHA, and an exact multi-architecture release artifact
  • establish one absolute protected-job deadline and refuse submission unless the complete two-minute mutation phase plus three-minute cleanup phase remains
  • keep the three-minute cleanup deadline interruptible even inside the acquireUseRelease finalizer, with regression coverage against a never-ending cleanup
  • expose the Alpaca account ID, key ID, and secret key only to the credential guard and the real broker proof step
  • exercise the production alpacaHttpLayer through a restricted loopback CONNECT proxy that permits only paper-api.alpaca.markets:443
  • continue unknown-submit recovery through the cleanup window by polling the exact client ID and scanning bounded open orders until the exact broker order becomes visible
  • discard an unbound broker order ID returned by an accepted-contract mismatch; all cancellation requires both the proof client-order ID and exact recovered broker order ID
  • submit one unique 0.01 AAPL DAY paper order only when every guard passes, cancel only that exact order, and require Canceled, zero fill, and no residual open order
  • upload a sanitized canonical receipt; receipt schema v3 explicitly distinguishes the verified release artifact from the checked-out-source proof runtime

Exact-head evidence

Source head: 50b422208aafbebe5216a198f9641c9b5e2ada76
Rebased base: 344ca27ec30efb472f45b8124acfa32260eaae43

Changed files are limited to:

  • .github/workflows/bayn-ci.yml
  • services/bayn/src/broker/alpaca-sandbox-contract.test.ts

Ordinary CI and release gate

Main Bayn PR run: https://github.com/proompteng/lab/actions/runs/30393604803

Green on the exact head:

  • focused broker sandbox contract
  • Effect runtime compatibility
  • dependency-input invariant
  • PostgreSQL integration
  • complete PR checks
  • amd64 image
  • arm64 image
  • Bayn release gate

Repository workflow lint, commit lint, title validation, changed-area validation, and ci-pr are also green.

Exact multi-architecture release artifact

Run: https://github.com/proompteng/lab/actions/runs/30393632161

  • conclusion: SUCCESS
  • amd64: SUCCESS
  • arm64: SUCCESS
  • multi-architecture index and release contract: SUCCESS
  • image: registry.ide-newton.ts.net/lab/bayn@sha256:a7bd8b525eea1dcdadcd5dc6665bade35bbe88d2be32a737de0c82ecdd47ae18
  • amd64 digest: sha256:60c77be6ffd75f7ce00695c3a38e483da062973d8001405433e93d89e00e4ad5
  • arm64 digest: sha256:ae790c25f1b6791bee20f0e108baf4423250e31cd917ffb84a63fdc6b22365c0

The downloaded bayn-release-contract was independently checked for the exact source SHA, tag, image, digest, package attribute, and both platforms. Receipt schema v3 records this only as releaseGate.claim=EXACT_IMAGE_ARTIFACT_VERIFIED_NOT_PROOF_RUNTIME; the host proof runtime is explicitly CHECKED_OUT_SOURCE at the same exact SHA.

Protected paper proof

Run: https://github.com/proompteng/lab/actions/runs/30393835769
Protected job: https://github.com/proompteng/lab/actions/runs/30393835769/job/90391811608

  • the protected job ran and failed; it was not skipped
  • overall deadline establishment, dispatch validation, exact checkout, and exact-head verification passed
  • the credential-binding guard failed because the protected environment supplies none of the three required secrets
  • release-artifact verification, dependency setup, restricted proxy startup, and the real broker proof were skipped after the guard failure
  • no Alpaca request was made, no paper order was submitted, and no residual order was created
  • the same manual workflow completed its ordinary broker, Effect, dependency, PostgreSQL, full PR, and release-gate jobs successfully
  • sanitized artifact: alpaca-sandbox-contract-50b422208aafbebe5216a198f9641c9b5e2ada76
  • receipt schema/status: bayn.alpaca-sandbox-contract-receipt.v3 / GUARD_PENDING
  • receipt binds source 50b422208aafbebe5216a198f9641c9b5e2ada76, release run 30393632161, checked-out-source proof runtime, timestamp, and ALPACA_PAPER
  • the downloaded guard receipt contains no account, credential, secret, token, authorization, or key-ID material

Current external-authority blocker in GitHub environment bayn-alpaca-sandbox:

  • zero environment secrets
  • zero protection/reviewer rules
  • no deployment branch policy

Required environment secret names:

  • BAYN_ALPACA_SANDBOX_ACCOUNT_ID
  • BAYN_ALPACA_SANDBOX_KEY_ID
  • BAYN_ALPACA_SANDBOX_SECRET_KEY

The cluster-managed Kubernetes secret was not read, copied, or exposed.

Local validation

Exact rebased head:

  • actionlint -shellcheck '' -pyflakes '' .github/workflows/bayn-ci.yml
  • focused contract test: 14 passed, 1 credential-gated skip, 0 failed
  • TypeScript: passed
  • Oxfmt: passed
  • Oxlint standard: 0 warnings, 0 errors
  • Oxlint type-aware: 0 warnings, 0 errors
  • Effect diagnostics: 0 errors, 0 warnings, 0 messages
  • restricted proxy check: Alpaca paper reachable through the proxy; unrelated HTTPS target rejected with 403
  • full Bayn suite: 846 passed, 123 expected skips, 0 failed; 6,254 assertions across 969 tests and 74 files
  • build: passed
  • git diff --check: passed

Merge status

Do not merge until the protected environment has the intended reviewer policy and all three secrets, and an exact-head protected run succeeds with a sanitized receipt proving submit, lookup, exact cancellation, zero fill, and no residual order.

Breaking Changes

None.

@gregkonush
gregkonush force-pushed the codex/bayn-alpaca-sandbox-contract-proof branch from 5cbdc66 to f48074d Compare July 28, 2026 04:54
@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 04:54 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5cbdc666d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
Comment thread .github/workflows/bayn-ci.yml Outdated
@gregkonush
gregkonush force-pushed the codex/bayn-alpaca-sandbox-contract-proof branch from f48074d to 0ae1e48 Compare July 28, 2026 06:36

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ae1e48d4f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/bayn-ci.yml
Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts
@gregkonush
gregkonush force-pushed the codex/bayn-alpaca-sandbox-contract-proof branch from 0ae1e48 to d5829cb Compare July 28, 2026 06:43

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5829cb1e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 06:48 — with GitHub Actions Failure
@gregkonush
gregkonush force-pushed the codex/bayn-alpaca-sandbox-contract-proof branch from d5829cb to a88c149 Compare July 28, 2026 07:08
@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 07:11 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a88c14968e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/bayn-ci.yml Outdated
Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts
Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a88c14968e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts
Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
@gregkonush
gregkonush force-pushed the codex/bayn-alpaca-sandbox-contract-proof branch from a88c149 to c0ecbe7 Compare July 28, 2026 07:30

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c0ecbe7934

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49e99ac9ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/bayn-ci.yml Outdated
@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 07:49 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: faea86f993

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .github/workflows/bayn-ci.yml
Comment thread .github/workflows/bayn-ci.yml Outdated
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 18:54 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 19408a49a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 19:02 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f80766812

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts
Comment thread .github/workflows/bayn-ci.yml Outdated
@gregkonush
gregkonush force-pushed the codex/bayn-alpaca-sandbox-contract-proof branch from 9f80766 to 199baa9 Compare July 28, 2026 19:17
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 19:20 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 199baa9ac4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 19:32 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 293c79b2c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 19:41 — with GitHub Actions Failure

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 37370b51f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread services/bayn/src/broker/alpaca-sandbox-contract.test.ts Outdated
@gregkonush

Copy link
Copy Markdown
Member Author

@codex review

@gregkonush
gregkonush had a problem deploying to bayn-alpaca-sandbox July 28, 2026 19:52 — with GitHub Actions Failure
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 50b422208a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@gregkonush
gregkonush force-pushed the codex/bayn-alpaca-sandbox-contract-proof branch from 50b4222 to 85b77d7 Compare July 29, 2026 03:26
@gregkonush

Copy link
Copy Markdown
Member Author

:shipit:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant