feat(risk): gate Binance bStocks with runtime attestation

[proerror77]

Change contract

Add a runtime-owned attestation admission gate for Binance tokenized securities. It remains default-deny and creates no route to an exchange order.

Issue relationship

Refs #699

Out of scope

Testnet or live calls, credentials, deployment, ACK artifact or Job creation, quotes-only or allow-trading changes, and Bybit.

Dependencies and merge order

None.

Focused validation

• git diff --check
• tokenized_security_requires_runtime_owned_attestation exercises RiskManager::review_with_venue_specs and its lifecycle-envelope path: fresh coherent evidence is admitted; missing, stale, future, mismatched, unapproved, restricted, ineligible, capability-disabled, corporate-action, market-quality, limit, malformed-exposure, and batch cases reject; non-tokenized behavior remains unchanged.
• Normal PR CI validates the current source with its selected build, formatting, and Clippy checks.
• The exact offline test command is intentionally not run from this branch: after a final trusted-main merge, the existing digest-bound source-test profile must run cd rust_hft && cargo test --offline --locked -p hft-runtime --lib tokenized_security_requires_runtime_owned_attestation and produce its bounded ACK receipt. This PR neither requests nor creates that artifact or Job.
• Counterexample: optimistic intent compliance data cannot substitute for runtime-owned proof.

Rollout and rollback

None. There is no runtime or external-state change. Reverting this PR restores unconditional denial.

Scope exception

None.

[coderabbitai]

Warning

Review limit reached

@proerror77, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 28 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b0d4b4b-e6e7-4de1-ae0b-773e900b0998

📥 Commits

Reviewing files that changed from the base of the PR and between 18ad045 and 74b30b0.

📒 Files selected for processing (7)

• rust_hft/market-core/engine/src/execution_control.rs
• rust_hft/market-core/ports/src/traits.rs
• rust_hft/market-core/runtime/src/risk_manager_factory.rs
• rust_hft/market-core/runtime/src/system_builder/config_loader.rs
• rust_hft/market-core/runtime/src/system_builder/config_types.rs
• rust_hft/shared/config/src/lib.rs
• rust_hft/tests/critical_path_tests.rs

📝 Walkthrough

Walkthrough

AccountView now carries runtime account identity and tokenized-security attestations. TokenizedSecuritiesRiskManager validates these attestations before admitting tokenized orders and derives the compliance context from validated runtime evidence. Tests cover successful admission and fail-closed rejection cases.

Changes

Tokenized-security attestation gate

Layer / File(s)	Summary
Account attestation contract and state initialization rust_hft/market-core/ports/src/traits.rs, rust_hft/market-core/engine/src/execution_control.rs, rust_hft/tests/critical_path_tests.rs	AccountView adds runtime identity and attestation fields with defaults. Bootstrap and test account creation initialize unspecified fields safely.
Runtime attestation admission flow rust_hft/market-core/runtime/src/risk_manager_factory.rs	TokenizedSecuritiesRiskManager validates runtime-owned Binance attestations, applies cumulative limits, injects verified compliance data, and passes non-tokenized orders unchanged.
Attestation validation coverage rust_hft/market-core/runtime/src/risk_manager_factory.rs	Tests cover valid attestations and rejection for missing, stale, future-dated, mismatched, restricted, ineligible, illiquid, overexposed, and over-limit conditions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related issues

• Binance bStocks: add a fail-closed runtime-owned compliance-attestation gate #700 — The changes implement the runtime-owned Binance tokenized-security attestation gate described by the issue.
• PRD: Binance bStocks fail-closed eligibility and testnet readiness #699 — The changes implement runtime-owned, fail-closed Binance bStocks attestation and eligibility checks.

Possibly related PRs

• proerror77/monday#60 — Both changes update AccountView and runtime account-scoped reconciliation data.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: gating Binance tokenized securities with runtime attestation.
Description check	✅ Passed	The description follows the template and explains the contract, scope, validation, rollback, dependencies, and issue relationship.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/binance-bstocks-attestation-700

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

rust_hft/market-core/runtime/src/risk_manager_factory.rs (2)

906-1074: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add the remaining fail-closed branches, and consider splitting this test.

The rejection coverage is broad, but five fail-closed branches of runtime_attestation_context have no assertion:

• freeze_on_corporate_action: false (line 354).
• the unconfigured-limits branch, for example min_top_depth_usd: Decimal::ZERO (lines 357-363).
• a negative account_symbol_notional or account_asset_class_notional (lines 441-445).
• the cross-intent account_asset_class_notional coherence check (lines 446-450).
• a None price (lines 452-454).

A regression in any of these loosens the gate, and the current test still passes.

Separately, this single test asserts about 20 independent properties across 257 lines. The first failing assertion masks the rest. A table of (mutation, label) cases driving the review closure would report each failure independently and would make the new cases above one line each.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@rust_hft/market-core/runtime/src/risk_manager_factory.rs` around lines 906 -
1074, Extend the runtime attestation tests around the review closure to assert
rejection for freeze_on_corporate_action disabled, unconfigured limits, negative
symbol or asset-class notionals, incoherent cross-intent asset-class exposure,
and missing price. Refactor the independent mutation checks into a table-driven
set of cases with labels so each failure is reported separately, preserving the
existing valid and fail-closed expectations.

---

396-401: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use a dedicated attestation expiry for TokenizedSecuritiesRiskManager.

TokenizedSecuritiesRiskManager::new() receives system_risk_config.staleness_threshold_us, but that is the market-data stale-data threshold for RiskConfig, not TokenizedSecuritiesRiskConfig. Increasing staleness_threshold_us makes runtime tokenized attestation replay possible after observed_at, including u64::MAX, which disables the freshness check. Add a dedicated evidence_max_age_us field/limit on TokenizedSecuritiesRiskConfig and route it into the manager.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@rust_hft/market-core/runtime/src/risk_manager_factory.rs` around lines 396 -
401, Update TokenizedSecuritiesRiskConfig to define and validate a dedicated
evidence_max_age_us limit, then pass that value through
TokenizedSecuritiesRiskManager::new() into the manager’s freshness check. Remove
the use of system_risk_config.staleness_threshold_us for attestation expiry,
ensuring observed_at future dates and attestations older than the dedicated
limit remain rejected.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@rust_hft/market-core/runtime/src/risk_manager_factory.rs`:
- Around line 403-418: Normalize the jurisdiction once in the attestation
validation flow around the jurisdiction binding, preserving the existing
unknown-jurisdiction error for blank values. Use the trimmed value for
restricted-jurisdiction comparison, account-jurisdiction matching, and the
emitted ComplianceContext so padded inputs cannot bypass validation or appear
unnormalized.

---

Nitpick comments:
In `@rust_hft/market-core/runtime/src/risk_manager_factory.rs`:
- Around line 906-1074: Extend the runtime attestation tests around the review
closure to assert rejection for freeze_on_corporate_action disabled,
unconfigured limits, negative symbol or asset-class notionals, incoherent
cross-intent asset-class exposure, and missing price. Refactor the independent
mutation checks into a table-driven set of cases with labels so each failure is
reported separately, preserving the existing valid and fail-closed expectations.
- Around line 396-401: Update TokenizedSecuritiesRiskConfig to define and
validate a dedicated evidence_max_age_us limit, then pass that value through
TokenizedSecuritiesRiskManager::new() into the manager’s freshness check. Remove
the use of system_risk_config.staleness_threshold_us for attestation expiry,
ensuring observed_at future dates and attestations older than the dedicated
limit remain rejected.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a0af0f7f-9173-4622-8f8c-ecb76ed63e0f

📥 Commits

Reviewing files that changed from the base of the PR and between a765015 and 88f3961.

📒 Files selected for processing (4)

• rust_hft/market-core/engine/src/execution_control.rs
• rust_hft/market-core/ports/src/traits.rs
• rust_hft/market-core/runtime/src/risk_manager_factory.rs
• rust_hft/tests/critical_path_tests.rs

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88f39610df

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".