# AlphaBot V2 rc1 omission review and rc2 correction

Review date: October 28, 2026. Baseline: the established AlphaBot V2 execution,
authentication and instrumentation contract plus the native release request in
this conversation. Scope: delivered source and synthetic local protocol behavior.
No real gateway/account was accessed and no real-money session was started.

| Established requirement | rc1 finding | rc2 disposition and evidence |
| --- | --- | --- |
| Hidden administrator password on interactive macOS main thread | Missing | Restored in auth_gate.py; OS/TTY/main-thread/core-dump policy tested |
| Exact SHA-256 challenge POST and AUTHENTICATED / 3600 response | Missing | Restored; real localhost HTTPS tests check exact payload, wrong status, integer TTL and one-attempt failure |
| Secure, HttpOnly, exact-host session binding; HTTPS/redirect restrictions | Missing | Restored; cookie, origin and redirect-negative cases tested |
| Separate authenticated broker/account bootstrap | Missing | Restored at /v1/broker-session; account-binding rejection tested; production service still unverified |
| 60-minute monotonic expiry, background revocation and fresh prompt | Missing | Restored; expiry/renewal/failure tests and strategy-routing regression tests |
| Environment-only broker credentials and no secret logging | Present, but original bootstrap/environment disposal omitted | Bootstrap and environment cleanup restored; native signing retains necessary in-memory credentials; no secure-wipe claim |
| Correct-database connected read-only dashboard | Missing | Restored native HTTP/WebSocket observer, separate query-only readers, Host/Origin/CSP, bounded clients/requests/writes and replay cursors |
| Overview / transactions / lesson matrix / positions and context | Missing | Implemented in web/; HTTP/assets/data paths tested; actual browser rendering remains unverified because no browser binary is installed |
| Historical date/slider and first milestone crossing | Missing | Restored and tested; historical halt state is selected as of that snapshot |
| Independent verifier and pre-entry diagnostic HTML | Missing | Restored; verification and exclusive report creation precede strategy/entry; disconnected observer blocks entry while independent risk monitoring continues |
| Persistent double-entry Decimal accounting | rc1 had hash-chained observations, not double-entry postings | Restored for newly instrumented observations, terminal receipts and control frames; trial balances, realized/unrealized postings, physical-row integrity and read-only verification tested |
| Unclassified movement → suspense + LESSON + durable halt | rc1 had bounded reconciliation but no suspense postings | Restored; unexplained changes post to Equity:UnclassifiedSuspense and block rearm |
| Append-only audit-table triggers | Missing | Restored for events, receipts, lessons and journal lines; mutation and tamper tests |
| Independent LESSON ancestry and explicit arithmetic reasons | Incomplete | Restored parent LESSON hashes, independently verified physical rows and explicit buy-budget mathematics |
| Native Alpaca / Kraken connections and independent one-second target risk loop | Present | Retained; protocol tests cover both venues, active-order cancellation, partial fills, shutdown and floor breaches |
| Permanent stepped floors and acquisition-cost protection | Present | Retained unchanged; peak/ratchet state is now checked against hashed observations |
| Cumulative threshold/penalty and one entry per INDPRO month | Present | Retained: deviation >= 0.0001%; 0.95**N default decay; monthly marker preserved |
| Pending-intent recovery and no blind resubmission | Present | Retained; ambiguous sell protection, recovered client IDs and durable halt tested |
| Macro/geopolitical reload, publication alignment, tone override | Present | Retained; source refresh and historical alignment remain explicit |
| Previous backtest runner and Bitstamp gateway mapping | Omitted from native package by requested scope | Not reintroduced into the native Alpaca/Kraken release. The installed 0.3.1 plugin and its backtests remain unchanged; no backtest regression certification is claimed for this separate build |

## Remaining gaps — production release is not cleared

1. **Live gateway / Cloudflare / Mac acceptance is unverified.** The exact gate
   client and broker bootstrap are implemented and tested against a synthetic
   HTTPS gateway. The actual owned gateway must implement cookie identity/account
   binding, renewal, server-side expiry and Cloudflare origin checks. This
   package does not deploy that external service. The restored gate intentionally
   refuses to authorize a native session when that service is missing or wrong.
2. **Actual Alpaca fees are not completed by this adapter.** Terminal order
   responses currently produce `fee:null`; accounting uses an explicitly labeled
   conservative reserve. That is a management estimate, not an authoritative fee
   receipt. Kraken terminal aggregates contain the reported quote-currency fee.
   The earlier requirement for complete authoritative individual venue fill/fee
   receipts is not fully satisfied by terminal aggregates alone. Additional
   venue-activity/fill reconciliation is required before claiming that contract.
3. **Hard market-order debit caps / atomic server enforcement are not provided.**
   Native preflight budgets and liquidation values remain estimates. The original
   proposed gateway-side atomic floor/budget enforcement was not implemented in
   the native dispatcher; market gaps and fees can exceed modeled reserves.
   Independent risk checks do not establish a guaranteed fill price, debit cap
   or liquidation floor. Venue/gateway acceptance and enforceable order controls
   remain required for that stronger contract.
4. **Independent broker/gateway-side protection is external.** Process death,
   expiry, blocked interactive input, rate limits, closed markets, unavailable
   sockets and unsellable dust can prevent liquidation. Invalid authorization
   cannot be bypassed for an emergency. Unconfirmed outcomes remain visible and
   durable; no hard-real-time or always-on protection guarantee is made.
5. **Browser and real host rendering are unverified.** Required UI controls and
   data/security paths are implemented and protocol-tested. Playwright is present
   but its browser executable is absent; responsive widths, keyboard navigation,
   zoom, font layout and actual browser WebSocket rendering were not certified.
6. **rc1 historical accounting cannot be retroactively restored.** The upgrade
   preserves existing rows and starts double-entry instrumentation at the first
   newly recorded snapshot. It does not invent the missing historical postings.

## Upgrade and preservation

Keep every Python module and web/ together. Copy the rc2 source over the rc1
runtime, without replacing or deleting the project directory. Authentication
settings use security.json so the rc1 trading-configuration fingerprint does
not need to be changed. Keep the same broker key and trading configuration.
The database upgrade is additive and preserves old events, lessons, pending
orders, peak/floor ratchets, receipts, monthly markers and durable halt state.
New immutable triggers intentionally reject in-place changes to audit rows.

No blanket "all requirements restored" or production-ready certification is
issued. The complete candidate, executed test log and evidence gate make the
remaining checks visible for review.