Reuse signed Paper/Shadow intake for the four-stage bundle and keep LiveSmall disabled

[proerror77]

Parent

#580

What to build

Make the promoted four-stage strategy bundle compatible with the existing signed deployment-envelope boundary for Paper and Shadow.

Preserve exact bundle, promotion, account, venue, instrument, risk/configuration, approval, signature, validity, and nonce verification. Add no automatic activation and leave LiveSmall disabled.

Verified signed Paper/Shadow feedback may be admitted into a later typed Mission through the existing memory contract.

Acceptance criteria

• The promoted four-stage bundle is versioned and validates through the existing StrategyBundle and PromotionRecord lineage.
• Existing signed Paper and Shadow handoff accepts the bundle only when every promotion, bundle, stage, configuration, scope, approval, signature, validity, and nonce identity matches.
• Tampering with a factor, weight, stage, hash, policy, approval, signature, account, venue, or instrument fails closed.
• Paper and Shadow remain distinct attribution modes and cannot be confused with research replay.
• LiveSmall activation remains rejected even when research, holdout, Paper, or Shadow evidence passes.
• The Agent, GP, MCTS, evaluator, and result bundle cannot create deployment authority or submit orders.
• Signed Paper/Shadow attribution can be verified and referenced by a later Mission.
• Raw, unsigned, untrusted-key, hash-mismatched, or cross-scope runtime feedback is rejected before memory admission.
• Feedback never resumes or changes the completed Mission that produced the strategy.
• Prediction Market bundles and approvals cannot be substituted for the CEX strategy.
• Focused integration tests cover Paper acceptance, Shadow acceptance, tampering, invalid feedback, and LiveSmall rejection.
• No external Paper or Shadow activation is performed by this code issue.

Blocked by

#604

[proerror77]

Exact-main downstream release — 2026-08-17T08:50Z

The signed Paper/Shadow implementation now has an exact-current-main release candidate:

• Source: 369fcffde72324fffd236c56eea457de8f5a3088
• Publish run: https://github.com/proerror77/monday/actions/runs/32011712211 — completed success
• Immutable image: crpi-ygobwehhof7qs9m3.ap-northeast-1.personal.cr.aliyuncs.com/wildcard0923/hft-trading@sha256:18fffffc9d40d935a409dc07791caa05bc7842800c75962ce32a7148659d305d
• Bare-ECS artifact: hft-trading-ecs-linux-amd64-369fcffde72324fffd236c56eea457de8f5a3088, GitHub artifact digest sha256:00e6982e6114d1bf5c296d13a17c871b960a51d258e82fa7a2704c58f4443bd2
• Release manifest SHA-256: 4c816a3443f74439b5de15f7481cb0dcd52e38d3b66d8ffc89be86e2fa7fddd8
• Control archive SHA-256: bdf76602a1138defffe30ad16456bc43989ff20edb060a93c93988b87310b74c

The release manifest binds the source, image digest, Tokyo/amd64/Ubuntu-26.04/bare-ECS target, and all four extracted control assets verified against their manifest.

This advances Release only. Tokyo currently has no dedicated trading ECS, and MondayTradingEcsRole does not exist. No stage, host, role, secret, Paper, Shadow, LiveSmall, order, or trading mutation was performed.