Repository navigation
Complete Live 0.1.3 provider qualification and release #92
Description
Completed: Live 0.1.3 published and production docs deployed
Published ml4t-live 0.1.3 on PyPI and GitHub v0.1.3. The production documentation serves the matching release. Source and tag both identify 7ef33b7b0adbb0120a7f71367d8e205ddadd45cd.
Final release run 40027042865 completed SUCCESS: 31 successful jobs and one expected exception-validation skip. Source/platform qualification, exact artifact qualification, security/provenance/recovery, provider binding, public documentation deployment and verification, PyPI publication, GitHub release creation and postpublication verification all pass. Both configured protected reviews used the maintainer's explicit publication/deployment approval; protections and credentials were unchanged.
All normal final-main workflows also pass on attempt one: CI, ecosystem, and docs, with 26 successful checks and one expected skip. All supported Python/platform cells and all three Python 3.15 canaries pass.
Actual published identity verified
Fresh independent downloads from PyPI and GitHub match the retained qualified wheel/source bytes and the immutable release manifest:
- Wheel SHA256:
868c09beae590c74e83a867cbbdac59b01e9ca70a6d1c332152783dddc90bbcf - Source distribution SHA256:
57a5b871f8e0faf8d6c868c0581f5d983e44f176ce81adc288aca2fefcee4b3b - Release manifest SHA256:
457520c7168ef7ea186d50c728520cee41ab5489ae75269545d4f66442e67858
The postpublication job installed the actual package from PyPI into a clean environment and exercised its installed workflow in Python isolated mode. Independent public checks also validate the root, quickstart and API HTML identities, plus the actual deployed release.json. All identify Live 0.1.3 and exact final source 7ef33b7. All 17 rendered pages and release.json pass artifact identity validation.
Provider, parity and migration acceptance
Successful original provider run 39815911531 retains its actual qualified source d6897be7c0f25c667498e9b9ea5ab2ef2f0c066b and original artifact/report hashes. Actual six-hour results pass:
| Provider | Actual seconds | Errors/gaps | Controlled reconnects | Maximum shutdown seconds |
|---|---|---|---|---|
| IB | 21600.103308 | 0/0 | 1 | 0.106636 |
| Alpaca | 21603.253140 | 0/0 | 1 | 3.050315 |
| OKX | 21600.002 | 0/0 | 1 | 0.003 |
Lifecycle/replacement/cancellation/cleanup, fresh-process broker restarts and OKX short reports independently validate. Final reconciliation passes; broker state is unchanged with zero unexpected disconnects and bounded RSS growth. OKX records 360 complete bars, 361 funding events and zero rejected/overflowed events.
All 32 installed member contents match the accepted runtime. Its actual installed parity/migration tests (14), all three full task examples and the 60-second public OKX console workflow pass with same-process Python/Live/Backtest/Specs provenance retained. Six fresh installed artifact profiles pass for the final source. The actual native final-artifact binding job accepts every original provider report for the final wheel/source hashes above. No failed-parent evidence, altered counters, relabeled source identity or gate waiver is used.
Repairs and closure
All maintenance source PRs are merged after substantive current-head review and applicable checks. The final release-verifier repair #141 reproduces real Cloudflare1010/default Python-urllib rejection on the base and passes with truthful verifier identification, while continuing to reject stale pages. Local validation passes 1,078 tests with 29 classified skips, plus lint/format/type checks, strict docs and normal hooks. The final normal main and release checks qualify the exact merged revision.
Complete owned branch histories were privately backed up before retirement. Source is clean with only main; qualification/API watchers and verification tasks are finished. This issue closes on actual publication and verified acceptance, not a reduced queue count.
GitHub still displays seven stale development-virtualenv alerts for 21.7.13, while current source/lock contains patched 21.14.9 and current dependency/installed-upgrade audits pass with zero advisories. The historical managed graph job cannot be rerun; no alternate route, manual snapshot, alert dismissal or permission change was attempted. That disclosed external metadata state does not represent an unpatched source dependency or failed release gate.
Procedure: Qualify A Stable Candidate.
AI assistance: Codex implemented and reviewed the maintenance repairs, reproduced failures, executed qualification, validated original provider reports and exact artifact binding, completed the explicitly approved publication/deployment and independently verified public artifacts. Provider identifiers, balances and credentials remain private.
Activity
stefan-jansen commentedon Sep 19, 2026
Current sequencing on 2026-09-19:
b43e5ede8161e478871ec9dd012adace13d0b348passed the complete stable CI qualification.origin/maincontinues to match the already qualified 0.1.3 candidate.After an authenticated IB Gateway or TWS paper session is running with API access, rerun paper qualification for the same candidate and qualification run 35444949287. If that passes, publish 0.1.3, then merge PR #94.
stefan-jansen commentedon Sep 19, 2026
Sequencing update: PR #94 is now merged as
dbbdc2da053b4001a7724fb835b083f9fc996febso the eventual 0.1.3 source distribution includes the corrected contributor README. This intentionally supersedes the earlierb43e5ede...candidate.The new main commit must complete stable CI qualification, then paper qualification must be rerun against that exact commit after IB Gateway or TWS is authenticated. Alpaca and OKX evidence from the prior run remains useful diagnostic evidence but is not release evidence for the new commit. The release gate and provider requirements were not weakened.
stefan-jansen commentedon Sep 19, 2026
The exact current release candidate
dbbdc2da053b4001a7724fb835b083f9fc996febhas now passed the full stable CI workflow: https://github.com/ml4t/live/actions/runs/35450330011. The remaining gate is a fresh paper-trading workflow on this exact commit. Alpaca and OKX were previously green, while IB remains blocked until an authenticated IB Gateway or TWS paper session with API access is available. No release will be dispatched before all three paper connectors pass on the exact candidate.stefan-jansen commentedon Sep 19, 2026
PR #99 replaces the every-candidate provider session requirement with automatic provider-contract classification. The branch compares reusable IB evidence against the full current IB contract and reports
reusable=Truewith no changed inputs relative to v0.1.2.All PR checks are green, including exact installed-artifact qualification, stress and performance, and the ecosystem matrix on Python 3.12 through 3.15 prerelease across Linux, macOS, and Windows. The earlier candidate and
extended-provider=noneinstructions are superseded. After PR #99 merges, the 0.1.3 release must use the new main commit and exact artifacts; it will reuse matching IB evidence without waiting for an IB session.stefan-jansen commentedon Sep 19, 2026
Release candidate 0.1.3 at
04ef4e519e65601c61b83d4e29053968fb4e3e7epassed preflight, ecosystem qualification, and complete stable qualification. Release run 35472488615 stopped at the fail-closed provider-evidence gate as designed.Authoritative artifact run 35472797538 succeeded. Provider-specific refreshes are now in progress: Alpaca run 35473026566 passed its lifecycle checks and entered the six-hour soak; OKX run 35473028351 is approved and queued behind it. Neither run invokes IB. IB remains the final provider refresh after scheduled maintenance.
stefan-jansen commentedon Sep 21, 2026
The exact-commit 0.1.3 release is now running from merged
maincommit43da4caf90a12240c34143b3ea336b4d96013772: https://github.com/ml4t/live/actions/runs/35553318363\n\nThe workflow will bind the candidate artifacts to the retained successful Alpaca and OKX provider evidence, then verify PyPI, the GitHub release, and the deployed documentation before this issue closes.stefan-jansen commentedon Sep 21, 2026
Release run 35553318363 stopped at the provider-evidence gate. The retained Alpaca and OKX six-hour reports are reusable, but no retained IB report satisfies both current requirements: the September IB runs predate the six-hour soak artifact, while the older full bundle predates changes to the IB adapter, paper qualification, persistence, safety, and supported-runtime contract.\n\nThis corrects my previous comment: the provider contract is unchanged relative to v0.1.2, but v0.1.2 has no successful retained IB soak bundle at that contract revision. Publication therefore requires one successful current IB exercise, restart, and six-hour soak. The gate remains fail closed; it has not been weakened.
4 remaining items
fix: wait for IB Gateway acknowledgement before paper reconnect (#135)
fix: qualify complete upgrade closure and replace old aiohttp
fix: replace compromised certifi roots during package upgrades (#139)
fix: identify the public documentation release verifier (#141)