PACKAGE_STATUS.md

# Current Working Build Status

- Project: HermesFace / Hermes Futures Desk V5
- Version: `5.0.0-web-impl-2026-07-23`
- Package profile: `processed-ui-merged`
- Processed UTC: `20260723T172253Z`
- Safety mode: Paper-only defaults; `HERMES_EXECUTION_ENABLED=false`; `HERMES_NONPAPER_EXECUTION_ENABLED=false`
- Merge base: user-attached `processed(1)` package, preserving Phase 4 execution/audit implementation
- UI overlay: mobile/tablet navigation and toolbar fixes from `ui-finalized`
- New route: `POST /api/futures/positions/close` for safe server-side position close
- CSRF protection: double-submit token enforced on all mutations (`/api/futures/csrf-token`)
- Cross-tab sync: BroadcastChannel-based state refresh propagation
- UI polish: Paper-only banner, kill-switch/close-only/reconciliation/stale-data warnings, responsive mobile position cards
- Backend contract: `/api/futures/status` now returns `killSwitchActive`, `paperModeConfirmed`, `reconciliationStatus`, `dataStale`, enhanced `warnings`
- Full test suite: `411 passed, 3 warnings`
- UI/frontend contract tests: `30 passed`
- Phase 4 focused suite: `75 passed`
- Execution client-path audit: `0 findings`
- Phase 4 adjacent-path audit: `0 findings`
- Repository metadata verifier: `PASS`
- Secret scan: `0 findings`
- Migration checks: `PASS` for SQLite and PostgreSQL migration inventories
- Runbook validator: `CONSISTENT`
- Runbook state retained from processed base: `32/104 tasks verified; 72 tasks open`
- Active task retained from processed base: `P5-T01` — constrain the initial exchange/account/position/contract support scope

This archive is the merged source package requested by the operator: it keeps the more complete Phase 4 backend/audit implementation from the attached processed package and adds the responsive UI/accessibility fix from the UI-finalized package, plus safe close-position and CSRF hardening. It is not a completed production release. Testnet, Live, and autonomous execution are not approved and remain disabled.

The specifically named `HERMES_V5_pROMPT.md` was not present in the supplied archives. Work was performed against the repository's canonical `HERMES_V5_CLOUD_DESKTOP_MASTER_RUNBOOK.md`.

Excluded from the archive: interpreter/test caches, coverage artifacts, local databases and runtime state, populated environment files, credentials/keys, temporary backups, and older archives.