feat(bayn): make execution authority explicit - #13351
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 86c0b7bfbd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
86c0b7b to
db2e464
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db2e464187
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
68069e7 to
7d66ba2
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d66ba26b7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d2e3bdd7e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
0d2e3bd to
fbbd89d
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3724f0675b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fef62d7505
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
fef62d7 to
ccd3dce
Compare
|
@codex review |
ccd3dce to
32ca8da
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 32ca8daa56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
32ca8da to
c24c0dc
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c24c0dc25e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c24c0dc to
5f9c454
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5f9c454f2b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
dd0ea34 to
3a6555c
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3a6555c08b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3a6555c to
54166c1
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 54166c1fa1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
54166c1 to
91ab0d4
Compare
|
@codex review |
cc1d0ab to
9ec0549
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ec0549c35
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
9ec0549 to
6aed9b3
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6aed9b3039
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
6aed9b3 to
40d88f6
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 40d88f61c0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
40d88f6 to
f04bddb
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f04bddb36e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
f04bddb to
c189766
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c189766b7c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c189766 to
1e4c63e
Compare
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
replace Paper/live shorthand with orthogonal broker environment, broker access, and capital-authority contracts
bind durable broker identity to provider, environment, and account; persist append-only, time-bounded live-capital grants and revocations
compose one coordinator-backed execution program for sandbox and future live accounts from explicit immutable dependencies; read-only brokers cannot construct mutation capability
route quote, submit, and cancel traffic through the same explicit proxy-backed HTTP client; no ambient direct client remains at mutation construction
reread the immutable live-capital grant after all quote collection and immediately before pure final validation and submit
atomically recheck the started intent, approved risk decision expiry, and writer fence after broker preflight and immediately before the broker POST
atomically reread durable effective authority, kill state, active generation, and immutable IO-started intent bindings after broker preflight and immediately before POST
serialize live-grant revocation and final transmission on the same PostgreSQL grant-row lock while holding the writer-fenced transaction across the broker POST
repeat the durable IO-started intent and risk-expiry check after acquiring the potentially blocking live-grant lock and immediately before POST
guard the final broker mutation boundary by binding every intent to account, strategy, and authority generation, rereading the immutable grant immediately before submit, and serializing snapshot-to-submit validation
encode every domain market intent as a broker-side price-bounded limit order: buy quantity receives a maximum execution price, sell quantity receives a minimum proceeds price, with Alpaca tick-safe conservative rounding
use side-appropriate fresh SIP quotes, price otherwise-unpriced queued quantity market orders, and count only each partially filled order's unfilled remainder
reject queued stop and trailing-stop orders whose triggered market execution has no enforceable price or fixed-notional bound
evaluate every possible pending-order fill subset through worst-case per-symbol exposure bounds before applying projected position and gross limits
reject sell quantities that would create a short position while allowing exposure-reducing exits even when the account is already above a position or gross ceiling
retain the configured authority-generation binding for live grants and reject mismatches before mutation authority is constructed
allow only the exact Alpaca sandbox, live, and market-data hosts through the deployed Bayn TLS CONNECT proxy, with a semantic fail-closed validator
preserve immutable historical authority rows without backfill and expose explicit authority facts in status and metrics
derive broker-order and capital-promotion Prometheus capability gauges from the explicit execution policy
report durable legacy authority as
observe/paperindependently from configured sandbox or live capital authoritydeterministic PostgreSQL race: preflight sees an active grant, revocation wins the row lock, final authorization blocks until commit, observes revocation, and records zero broker POSTs
persist deterministic zero-POST guard failures as terminal
SUBMIT_DENIED, never as ambiguousSUBMIT_UNKNOWNtreat terminal broker rejection and local pre-transmit denial as settled mutation-cycle outcomes so the bound cycle completes once and later cycles proceed
preserve post-transmit transaction or fence failures as ambiguous
SUBMIT_UNKNOWNso broker lookup recovery remains mandatoryexplicitly narrow discovery qualification/broker bindings and persisted grant rows/revocation fields without production non-null assertions
retain monotone worst-case pending position exposure during sell-first multi-intent preparation; only confirmed reconciliation may release exposure
price every unfilled quantity market-order remainder from a fresh side-appropriate quote, never from historical fill averages
bind OBSERVE-generation replay to exact persisted v2 broker identity, with one source-controlled sandbox-only compatibility rule for the deployed pre-v2 root
close the asynchronous fill gap with a positions-before / open-orders / positions-after protocol and fail closed on exposure-book drift
reconcile durable MARKET intent expectations against the deterministic bounded LIMIT representation submitted to Alpaca
classify historical MARKET versus bounded LIMIT broker expectations from the immutable submit request hash rather than deployment time or intent type alone
reconcile bounded LIMIT orders against the exact deterministic price boundary encoded in the authorized request
revalidate account, positions-before/open-orders/positions-after, fresh quotes, and all live capital limits after the live-grant row lock, then recheck risk expiry before POST
bind live-capital grants to a referenced maximum=PAPER authority generation with exact strategy name, behavior hash, parameter hash, and parameter schema version on insert and readback
separate sell order-cap valuation from exposure valuation: fresh bid enforces the order ceiling while the broker limit floor remains the conservative exposure value
require every pending sell across the full broker portfolio to be covered by current inventory before any candidate intent is considered
prepare and execute only one deterministic mutation intent per fresh reconciliation pass instead of committing and submitting an entire target-plan batch
project every prior accepted nonterminal intent as one conservative unresolved order when broker history has not surfaced it yet, while reserving its buying power, notional, and worst-case position
honor each accepted/recovered submit event's durable consistency delay before starting the next exact reconciliation pass
reject every unfilled quantity-based MARKET order remainder as price-unbounded instead of estimating pending exposure from a transient quote
Current exact-head evidence
Head:
1e4c63e04c30ffd49c982fb59693a2d611856ca1, rebased onto708b1d7b56d8ea337247d00e6a8eb31b0d13cfe1.git diff --check: cleanSafety
BAYN_MAXIMUM_AUTHORITY=OBSERVE; explicit defaults resolve tobrokerAccess=read-onlyandcapitalAuthority=none, and the legacy token can only validate that exact safer policyBAYN_BROKER_ACCESS=mutation,BAYN_CAPITAL_AUTHORITY=live-capital-grant, orBAYN_LIVE_CAPITAL_GRANT_HASHBreaking changes
Runtime configuration resolves explicit
BAYN_BROKER_ACCESS,BAYN_CAPITAL_AUTHORITY, and optionalBAYN_LIVE_CAPITAL_GRANT_HASH. ExistingBAYN_MAXIMUM_AUTHORITY=OBSERVE|PAPERandPAPER_CANDIDATE_DISCOVERYvalues are accepted only through compatibility validation. Migration0019_explicit_execution_authorityadds versioned broker-identity columns and append-only live-capital grant tables without rewriting historical evidence.