PRD: Binance bStocks fail-closed eligibility and testnet readiness

[proerror77]

Change contract

Define the independent contracts required before Monday may ever send a Binance bStocks order. This tracker does not authorize a configuration change, credential access, deployment, Paper/Shadow/Live action, or any exchange order.

Current boundary

main@5500f3e253f1d0d911396880de18f004294c9e48 deliberately rejects tokenized-security intents before the adapter, the checked-in bStocks configuration is quotes-only, and Binance account capability defaults to can_trade_tokenized_securities=false.

Required delivery slices

1. A code-only, fail-closed runtime-owned compliance-attestation and account-capability contract. It must never trust OrderIntent.compliance_context as its authority.
2. A separately controlled testnet/account rehearsal contract, blocked on the code slice and a named human runtime controller.

Acceptance evidence

• A direct unit/integration seam proves missing, stale, wrong-venue, restricted-jurisdiction, ineligible-account, or corporate-action evidence rejects the intent.
• A valid runtime-owned attestation can be represented without changing quotes_only, allow_trading, credentials, or an exchange endpoint.
• The capability supplied to the Binance adapter is derived from the same runtime-owned attestation contract, not YAML or an intent self-report.
• Before any future testnet rehearsal: immutable code/image/config identities, account and jurisdiction eligibility readback, source identity and timestamp, kill-switch and cancel/readback rehearsal, named controller, stop rules, and rollback identity are recorded.

Controller and authority

• Code controller: the single owner of the code child branch/worktree.
• Runtime controller: a named human operator; no runtime action is authorized until that person, the exact testnet account, and the separate runtime change are approved.

Stop rules

Stop and retain fail-closed behavior on absent/expired/ambiguous evidence, account-capability mismatch, unavailable source, unknown jurisdiction, active corporate action, missing immutable artifact/config identity, or any failed cancel/readback.

Rollback

The code slice must default-deny. Any later rehearsal rolls back by stopping the single testnet runtime, retaining its immutable evidence, and revoking only the exact testnet credential/configuration approved for it. No live credential or live order is in scope.

Out of scope

Opening quotes_only, setting allow_trading, placing/canceling any order, Binance Web3 reference-catalog promotion, production deployment, and all Bybit work.