INFINBOT — PROXY-ONLY BROKER ROUTING
2026-10-14 | Owner-selected https://sotality.com

The client sends GET requests only to https://sotality.com. It does not load
Alpaca key IDs/secrets from JSON, environment variables or host credential files.
Caller APCA headers are never forwarded. Legacy Alpaca REST URLs, if supplied to
the compatibility transport, are mapped to the pinned proxy host before sending.
Redirects, order routes, credential-bearing query fields and direct fallback fail.
The earlier config.json credential setup wrapper is retired and replaced by this
proxy-only checker. No key or secret should be placed in a client proxy config.

Actual observation at 2026-10-14T19:31:57.818559+00:00:
GET https://sotality.com/v2/account -> HTTP 403.
Credential headers sent: false. Broker credential files read: false.
Direct Alpaca calls: 0. Orders submitted: 0. Engine started: false.
Result: PROXY_ACCOUNT_ACCESS_UNVERIFIED, not successful broker authentication.

The response does not establish whether the denial originated at a network edge,
the proxy application, or an upstream service. Proxy-side access logs should confirm
whether the request reached the intended handler. The operator must authorize the
account route according to the existing access policy and verify the host-side
upstream binding. Do not expose an unauthenticated public account-data endpoint.
This package does not bypass a 403, alter the domain server, provide upstream keys,
prove host disk token storage, or infer paper/live mode from a proxy hostname.

Run the standalone checker from any supported Python runtime:
python3 infinbot_file_auth.py --base-url https://sotality.com
Or use the installed package module:
python3 infinbot_proxy.py --base-url https://sotality.com

Supported REST route contracts:
/v2/account; /v2/positions; /v2/stocks/bars; /v1beta1/options/bars;
/v1beta3/crypto/us/latest/quotes. These are client route profiles, not proof that
each route is implemented or entitled on the server. Expected replies retain
their documented JSON shapes. The checker never prints private account contents.

The proxy WebSocket handshake/path contract was not supplied. Real crypto stream
checks remain blocked without trying Alpaca directly or inventing proxy routing.
Old-key rejection/rotation cannot be demonstrated by a proxy that automatically
substitutes current upstream credentials; those checks belong to the host operator.
Default client rotation checks now stop before opening either old/new key file.

Existing code, data and broker configuration on the Mac are not changed by creating
this download. The source installer applies the supplied module changes locally
after the owner runs it. Actual TradingBotEngine source/integration remains absent
from this workspace. The LGC contract and CME DataMine connector remain unchanged.