[stefan-jansen]

Position lookup, shadow order identity, Alpaca order/position handling and fixed-interval aggregation violate their public contracts. This bounded maintenance batch corrects those defects, updates the corresponding quickstart/migration guidance and contributor entry points, and makes provider qualification stop before publication by default.

Current qualification head: b9578bc. All applicable checks on this head must pass before ordinary merge.

Closes #111. Closes #114. Closes #116. Closes #117. Closes #118. Closes #119. Closes #120. Closes #126. Closes #128. Closes #132.

Changes:

• Normalize strategy position lookups consistently with accepted order symbols, including surrounding whitespace.
• Use unique shadow order identities across ticks and restarts for both fills and reductions.
• Preserve Alpaca short direction, reject fills without executed quantity atomically, and stop/await retained streams after provider faults.
• Align configured aggregation intervals to the UTC epoch across hour and date boundaries.
• Isolate the published-package quickstart and expose the existing runnable installed-wheel migration verifier with truthful version provenance.
• Adopt shared contribution guidance and the supplied maintainer-directed batching policy. External submission rules do not require separate owner PRs per defect or follow-up edit.
• Align CI, its identity validator and documentation with candidate version 0.1.3.
• Add a publish-evidence boolean input, defaulting to false, to paper qualification. Only durable prerelease publication is optional; protected credentials, artifact binding, provider lifecycle/restart/soaks, outcome checks, redaction and 90-day Actions retention remain required. The existing release verifier already consumes retained Actions evidence.

Regression provenance:

Behavior	Failing producer	Passing fix	Public workflow and retained evidence
Strategy lookup/close	2ad36a8; whitespace still fails at 94ff5c0	b1c5193	Real LiveEngine strategy submits, looks up and closes the same lowercase/padded symbol; both cases finish flat. The unchanged strategy regression covers both accepted input forms.
Shadow identities	2ad36a8; restart collision persists at d435e4d	679fe19	Six real strategy orders/reductions across two engine runs with fixed clock and retained state: base has two IDs, intermediate three, fix six. #122
Alpaca short close	2ad36a8	deee1f1	Validated SDK Position through public connect/lookup/close changes incorrect +50/sell into -50/buy-to-cover. #123
Missing executed quantity	2ad36a8	16ef90a	Validated SDK TradeUpdate reaches the registered stream handler after public submission; missing/zero fill cases fail atomicity on base, pass on fix, with a positive full-fill control. #124
Aggregation intervals	2ad36a8; midnight overlap at 1af9309	69f3fa8	Typed trade feed drives actual 90/100-minute aggregation with exact timestamps/OHLCV and no overlapping intervals. #125
Faulted stream shutdown	3ddba2d	078b776	Public connect/submit and registered SDK callback produce the fault. Disconnect must stop and await the actual adapter task; repeated disconnect is idempotent. #129

Producing-base reproductions used complete original source with the same final regression, replacing only external transports where needed. The final regressions exercise actual engines, SDK payloads and the public broker/feed workflows.

Verification:

• Combined behavior tree 78275f9: uv sync --locked --all-extras; all 1,068 tests passed, 29 skipped in 60.32s; all pre-commit hooks including Ruff/format/ty passed; strict MkDocs and 132 links passed. Runtime and regression files remain byte-identical on the current head.
• Public workflow validator: candidate-version mismatch reproduced through its real CLI and corrected; all 26 workflow-policy tests passed. The new publication policy rejects the original unconditional archive configuration and accepts the opt-in configuration. Strict docs,132 links and normal hooks passed for the publication correction.
• Historical provider-evidence-35473028351 demonstrates the original automatic prerelease publication. No unauthorized publication was rerun. The upcoming actual protected qualification run must finish with archive SKIPPED when publish-evidence=false; this result is still pending.
• Published quickstart: full 65-bar isolated Live 0.1.2 / Backtest 0.1.12 / Specs 0.1.5 run finished flat. Its original editable-environment failure and corrected invocation are retained in docs: isolate the published-package quickstart #127. The documentation change does not attribute these shadow versions to a separate historical parity log.
• Documented installed-wheel migration command: 103 contracts per minimum/locked/maximum profile at 0408aaf, with actual versions recorded in docs: make lifecycle migration verification runnable and versioned #133. Current-head dependency/artifact CI must requalify the combined implementation.
• Current-head dependency qualification passed at b9578bc: 92 packages audited with zero failures; 106 actual installed-wheel contracts in each minimum/locked/maximum profile; portable API identical; actual existing-environment upgrade passed. Candidate Live 0.1.3 uses Backtest 0.1.0 / Specs 0.1.1 for minimum/locked and Backtest 0.1.12 / Specs 0.1.5 for maximum. These are source candidate results, not a publication. Executed job.
• Current-head installed-artifact qualification passed all six wheel/sdist Python 3.12/3.13/3.14 profiles, reproducibility and exact manifests, with zero secret findings. Security qualification passed on the same artifact hashes. Its initial PyPI TLS metadata timeout was retained and only that failed leaf was retried; no source or artifact changed and no failure was waived. Successful security job.
• All supported Python, ecosystem, stress, performance, dependency, security/recovery, strict documentation and installed-artifact gates remain enabled and required on the exact current head. Prior-head successes are not reported as final-head qualification.

Contributor attribution and scope:
Original repairs were contributed in #112 by quantum-like/Cursor Agent. Their commits and evidence are retained in the combined branch and a verified recovery archive. Codex reviewed and extended the real regressions, completed the repairs, integrated the batch, corrected the maintainer policy distinction and ran verification. No agent coauthor footer is added.

The source-maintenance issues close only on merge. Provider/release #92 remains open for actual final-main artifact-bound IB/Alpaca/OKX qualification and a separate publication decision. Existing protected credentials and runner are configured; availability is not proof of a successful provider run. No release or deployment is authorized by this PR.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.