Spaces:
Sleeping
Sleeping
| # Phase 3 Adjacent-Gap Audit | |
| ## Scope | |
| The audit covers immutable plan creation and hashing, approval creation and consumption, dashboard analysis/approval/execution routes, bounded dashboard state, the LLM-facing toolset, Telegram, safety-only revalidation, material-change invalidation, and concurrent analysis behavior. | |
| ## Closed gaps | |
| 1. **Persisted hash omitted server plan identity and creation time.** Hash schema 2 now binds `plan_id`, `created_at`, ownership/session/account/mode/environment, market/contract identity, geometry, quantities, leverage/margin, risk/slippage, provider provenance, and strategy/policy/software versions. Schema 1 remains readable only for legacy verification. | |
| 2. **Approval checks trusted the approval row without rechecking authoritative plan payload/state.** Creation, validation, and consumption now verify the stored payload hash and current plan ownership, scope, readiness, expiry, active approval, invalidation, and execution state. | |
| 3. **Concurrent dashboard analysis could silently supersede a newer result.** The browser sends `expectedPreviousVersion`; the repository enforces optimistic versioning; stale tabs receive HTTP 409. | |
| 4. **Material-change evidence was generic.** Supersession records normalized changed fields and invalidates the old approval transactionally. | |
| 5. **Bounded dashboard plan copies retained a hash without all hash material.** Dashboard state now retains the canonical subset and verifies both the source and bounded snapshot before display. | |
| ## Boundary review result | |
| - Dashboard approval and execution accept identifiers only. | |
| - LLM mutation handlers remain blocked and are absent from the runtime toolset. | |
| - **Re-verified (2026-07-27, plugin migration):** `set_leverage_and_margin`, `execute_futures_position`, and `close_futures_position` are still hard-reject stubs in `futures_trading_tool.py` and are **not** registered by `plugins/futures_trading/`. Only six read-only tools are exposed to the agent runtime. | |
| - Telegram remains analysis-only and does not reference approval or execution mutation boundaries. | |
| - Safety revalidation can only accept or reject the exact persisted hash; accepted and rejected contexts are durable and do not rewrite plan payloads. | |
| - Cross-user, cross-session, cross-account, cross-mode, expiry, reuse, payload-tamper, material-change, stale-tab, and version-conflict tests pass. | |
| ## Automated audit | |
| Run: | |
| ```bash | |
| python scripts/audit_plan_approval_boundaries.py | |
| ``` | |
| Expected result: `findings=0` and `RESULT: PASS`. | |
| ## Remaining limitations | |
| No file-based Phase 3 integrity bypass is known. Testnet and Live remain disabled and are governed by later release gates and operator approvals. | |