INFINBOT — CME DATAMINE AND PRIVATE SIGNING TOKEN ACCEPTANCE
2026-10-13 | Offline schema/recorded-data verification; no live-capital clearance

Your provider is CME DataMine. This package preserves existing host configuration,
credentials and ledger. It does not create a new provider, contract or order route.

AUTHORITATIVE ROUTES VERIFIED ON 2026-10-13
https://www.cmegroup.com/datamine/datamine-api.html
https://www.cmegroup.com/datamine/datamine-list-api.html
https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457223239/Time+and+Sales

DataMine lists entitled historical files and downloads purchased files. A recent
catalog update or saved file is not evidence of a continuous live futures stream.
Supported canonical GET endpoints:
  https://datamine.new.cmegroup.com/api/list_entitlements_files
  https://datamine.new.cmegroup.com/cme/api/v2/download?fid=YOUR_ACTUAL_FILE_ID
Existing entitled Basic Auth or existing OAuth bearer tokens are supported.
This adapter does not generate a bearer token or purchase any data.
Credential headers are restricted to the canonical HTTPS host; redirects fail
closed. Download limit: 32 MiB; expanded gzip limit: 128 MiB. Larger files remain
unavailable rather than partially accepted. A file outside the inspected first
catalog page remains unavailable; select its actual saved List API page instead.

SUPPORTED FLAT-FILE PROFILE
CME_TIMESALES_V2_19_FIELDS: published CME Time & Sales v2 CSV, 19 fields, raw CSV
or gzip; explicit header/no-header selection. Requires exact Globex product code,
XCME, FUT and explicit outright/calendar contract/delivery-month agreement. Preserves
UTC nanosecond timestamp text and validates present sequence ordering per Security_ID;
timestamps are not silently sorted and no global product sequence is asserted.
TRD and VOL are distinct: volume records cannot become invented executed trades.
Spread rows, empty-quantity price records and null-sequence volume records are
explicitly classified. The actual sample header uses Transaction_Date; the guide's
Transaction__Date spelling is accepted as a separate exact header variant. No
continuous-contract rollover, symbol-punctuation attribution, price fallback,
paper funding, broker execution inference or trading-ledger writes.
Unknown layouts (including v1, EOD settlement, PCAP, FIX, MBO) remain blocked.
DataMine has different dataset layouts. The provider name alone does not identify
your purchased dataset. If yours differs, provide its dataset name/schema version
and non-secret column header or layout reference for an exact parser extension.
Saved matching metadata/file size/name do not independently prove origin or current
entitlement offline. Neither file timestamps nor historical trades are bot outcomes.

EXISTING DATA MAPPING
Create a NEW owner-private mapping, for example private/datamine-input.json.
Use actual existing paths and the actual fid, dataset page and product code.
This is a mapping template, not observations; do not substitute test files:

{
  "provider": "CME DataMine",
  "schema": "CME_TIMESALES_V2_19_FIELDS",
  "product": "MES",
  "file_id": "REPLACE_WITH_ACTUAL_DATAMINE_FID",
  "list_file": "/absolute/private/path/actual-list-api-page.json",
  "data_file": "/absolute/private/path/actual-provider-filename.csv.gz",
  "header": false
}

Use product="MES" only for actual Micro E-mini files; ES is not relabeled as MES.
The mapping and any credential file must be mode 600/400, owned by you, not symlinks.
Do not overwrite your existing host JSON, environment file or signing configuration.

OPTIONAL PROVIDER DOWNLOAD (NETWORK, EXPLICIT OWNER INVOCATION ONLY)
datamine_adapter.py --download requires a separate existing private JSON containing
only CME_DATAMINE_API_ID and CME_DATAMINE_API_PASSWORD, or only
CME_DATAMINE_ACCESS_TOKEN. No actual values are included in this package.
No broker credential alias, environment mutation or raw response body is logged.
Outputs are new files; existing downloads are preserved.

.venv-infinbot/bin/python datamine_adapter.py --download --credentials-file /absolute/private/datamine-credentials.json --file-id ACTUAL_FID --output-dir /absolute/private/new-download-directory

The download produces explicit paths for a later saved-file schema inspection.
It does not itself establish data-schema validity or a live subscription.

DISCLOSED SIGNING TOKEN
The audit compares all values in its inherited process environment against the
disclosed placeholder, without printing values or masking fragments. It rejects
the placeholder, short/invalid tokens and public credential files.
An external private token can be loaded through:
  --hmac-keychain-service YOUR_EXISTING_KEYCHAIN_SERVICE_NAME
or:
  --hmac-token-file /absolute/private/existing-signing-token
Choose one. Keychain mode invokes /usr/bin/security on your Mac; only the service
name is an argument. Token stdout stays inside the process and is never logged.
The package does not create or write a new Keychain token. Keep the owner-managed
replacement in your existing approved vault. Gateway authentication tokens and
broker API credentials are separate secrets and are not signing-token substitutes.

PASS means placeholder absent from THIS process and an external token loaded with
a local HMAC roundtrip. It does not prove cryptographic entropy, system-wide purge,
revocation at an external service, or use by the actual production signing worker.
Other workers and launch services need separate scoped checks/restarts. Remove the
old value at its actual configuration source; changing only a child process is not
permanent rotation. No removal or rotation on your Mac has occurred from this chat.

CONSOLIDATED OFFLINE ACCEPTANCE (AFTER INSTALLATION, VENV AND HOST SETUP)
cd "$HOME/ForesixaQuant"
.venv-infinbot/bin/python infinbot_acceptance.py --config private/infinbot-host.json --offline --datamine-config private/datamine-input.json --hmac-keychain-service YOUR_EXISTING_KEYCHAIN_SERVICE_NAME

Replace the service-name argument with your real existing entry, or use the private
token-file alternative. The program reads current selected ledger/export, observes
zero-entry worker behavior, rehearses local gateway authentication, checks saved
DataMine schema, audits the local signing-token source and verifies encrypted backup
recovery. Writes are separate operational receipts/risk policy/backup only.
The host JSON is read and hashed again; changes during the run are flagged. No
existing Python configuration, broker credential or trading ledger is modified.
No --demo. Missing files, unsupported datasets or missing evidence remain blocked.
Offline skips current broker/feed connectivity. Report status may remain blocked
even when every available offline component passes; inspect individual checks.
The single private receipt remains subject to review. Do not upload secrets,
private data or the full ledger. Share only a redacted result/blocker summary.

Test evidence: isolated synthetic protocol/secret cases only, not CME authentication
or current user-host observations. No LGC contract edits, production clearance,
deposit advice, IRS filing approval, live trial or broker orders.