{
  "revision": "1.0.0-rc3",
  "artifact_sha256": "786b220df3aee3cd1c1c7fac9206495ca21856954fecd3b0756a59c41fb19906",
  "source_hashes": {
    "AUDIT_FINDINGS.md": "a2cc5cf2c168b866c13828020bbccb17f9360aeb553a3723bf85a04a0875aebb",
    "README.md": "4928117f2286c13f53ba740eaa278045c1b8aabe8b9f4b5ea8a9e98afc7f6bcd",
    "STARTUP_CORRECTION.md": "6898c2ea381da2a560c8481347339f535f78d9692d94a239875f3fb2099651b1",
    "audit_dashboard.py": "41e4a53c6874641b5b246bdf92d3fccdd1d529b4e98e43a514d498e7dcf8528d",
    "audit_ledger.py": "72beebf9474968d8b7570986017f672fbec46daac810db6df8d1f7c4508098da",
    "audit_viewer.py": "70c2e07bc1a16058b279a0d457767f8c707cb615b924df1678114883113a6e5a",
    "auth_gate.py": "1063e50fe1f966d97b112109676287aa6d8e570cdbe231185ac2eb0f44aebb3a",
    "gauntlet_v2.py": "786b220df3aee3cd1c1c7fac9206495ca21856954fecd3b0756a59c41fb19906",
    "host_strategy.py": "d2bf77c06f2c98aa8005ff8a56b877b1d88211b4c7ad5f2a6b3e73f3d3558732",
    "requirements.txt": "441ae67aa7cf668f6e1045508f999cb29fcd46fd8d3a2b9714967987b40c3755",
    "tests/test_audit.py": "210b3972f357289a3ae3aa37bb78351dfc500db4f3ad4a7f9ebca5b5be1f6a94",
    "tests/test_auth.py": "66d9eac27c08df2c395b01c8ece628319c4060e3ca924f2405097bc26333382d",
    "tests/test_native.py": "c04d042801bd2a0dd7209f7e230f4c9765d2c1fd0bcbb343b533f401080cc2ec",
    "tests/test_startup.py": "d5b21f684ac741ff9475e8000fa61966b35697264d29b91f16d7d9e206fb9f9a",
    "web/app.js": "8931dbd4a847df471de321651aef69d51cdb7be11c9f4ea6f532717d01e3f2f2",
    "web/index.html": "a5d35b57803065b74f1147670ad132f0489eb21c3c50044dcbec5a2b5fb5fb76",
    "web/styles.css": "f102155d9717b7bd67042217d0d4b3bc98ca82cafd77f1e99d7e0b9951331830"
  },
  "executed_tests": 91,
  "passed_tests": 91,
  "elapsed_seconds": "40.698",
  "real_trades": 0,
  "critical_defects": 2,
  "critical_defect_scope": "Existing unresolved release requirements: authoritative fee/individual-fill completeness and hard/atomic debit enforcement. No executed local test failed.",
  "pass_1": [
    {
      "id": "syntax",
      "mandatory": true,
      "status": "pass",
      "evidence": "python3 -m compileall -q alphabot-v1; node --check alphabot-v1/web/app.js; exit 0"
    },
    {
      "id": "complete_local_suite",
      "mandatory": true,
      "status": "pass",
      "evidence": "python3 -m unittest discover -s tests -v; Ran 91 tests in 40.698s; OK; full output in TEST_RESULTS.txt"
    },
    {
      "id": "real_terminal_prompt_sequence",
      "mandatory": true,
      "status": "pass",
      "evidence": "pty.fork subprocess test observes exact app-password then MFA prompts, supplies both inputs without terminal echo and verifies prompt order before missing project/config failure."
    },
    {
      "id": "local_vault_totp_and_replay",
      "mandatory": true,
      "status": "pass",
      "evidence": "Encrypted envelope, correct password+token, RFC6238 SHA1 vectors, invalid input, tampering, private permissions, persisted and concurrent replay rejection, local-only auth-check tested."
    },
    {
      "id": "gateway_contract",
      "mandatory": true,
      "status": "pass",
      "evidence": "Local MFA failure sends no network request. Successful local MFA sends the exact existing SHA256-only gate payload; 3600-second cookie validation, expiry and renewal tested over localhost HTTPS."
    },
    {
      "id": "authoritative_fees_and_individual_fills",
      "mandatory": true,
      "status": "fail",
      "evidence": "Existing Alpaca fee=null/reserve and terminal aggregate limitation remains; AUDIT_FINDINGS.md gap 2."
    },
    {
      "id": "hard_debit_and_atomic_floor_contract",
      "mandatory": true,
      "status": "fail",
      "evidence": "Native market orders still have estimated debit/floor reserves rather than guaranteed market debit and gateway atomic enforcement; AUDIT_FINDINGS.md gap 3."
    }
  ],
  "pass_2": [
    {
      "id": "authenticated_mismatch_and_portal",
      "mandatory": true,
      "status": "pass",
      "evidence": "Full localhost TLS authentication with deliberately different stored key fingerprint reaches LOCAL_BINDING_REVIEW_REQUIRED, opens the read-only portal and does not enter broker trading or erase the original binding."
    },
    {
      "id": "rebind_preservation",
      "mandatory": true,
      "status": "pass",
      "evidence": "Explicit authenticated rebind test preserves halt, peak and ratchet, changes metadata without orders, and refuses pending intents."
    },
    {
      "id": "independent_serve_process",
      "mandatory": true,
      "status": "pass",
      "evidence": "Actual --serve subprocess with intentionally malformed trading config and no broker credentials serves committed balanced snapshots and exits without a login prompt."
    },
    {
      "id": "existing_native_engine_and_audit",
      "mandatory": true,
      "status": "pass",
      "evidence": "Both broker protocol flows, risk cancellation, partial fills, intent recovery, double-entry/trial balance, LESSON ancestry, immutable rows, pre-entry diagnostics, replay and historical observer cases retained in the full 91-test suite."
    },
    {
      "id": "browser_layout",
      "mandatory": true,
      "status": "unverified",
      "evidence": "No installed browser executable; unchanged dashboard rendering/breakpoint/keyboard acceptance remains unverified."
    },
    {
      "id": "production_gateway_and_live_host",
      "mandatory": true,
      "status": "unverified",
      "evidence": "No production gateway, real Mac/Authenticator phone, real broker account or real-money order was used. Remote hash-only wire protocol does not independently attest local MFA."
    }
  ],
  "release_decision": "RC3 implementation candidate; startup amendment implemented and locally tested. Production release remains blocked by disclosed standing requirements."
}