toki/alt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(live-trading): 실거래 risk guard를 추가한다

Browse source 
실거래 주문이 브로커에 도달하기 전에 kill switch와 계정별 주문 한도를 검증해야 한다. API, CLI, client parser surface와 완료된 review archive를 함께 정리한다.
This commit is contained in:
toki 2026-06-08 05:36:59 +09:00
parent adc0b12d82
commit c23fea2342
40 changed files with 5276 additions and 297 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

239
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/code_review_cloud_G06_0.log Normal file
View file

@ -0,0 +1,239 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=0 tag=LIVE_RISK -->
# Code Review Reference - LIVE_RISK
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `구현 체크리스트`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked by a user-only decision, user-owned external environment prerequisite, or scope conflict, fill `사용자 리뷰 요청` with evidence and stop with active files in place; code-review decides whether to write `USER_REVIEW.md`. Evidence gaps that a follow-up agent can close by rerunning commands or collecting artifacts are normal follow-up issues, not user-review blockers by themselves.
> Do not ask the user directly, present choices in chat, or call `request_user_input` during implementation; record the needed decision in `사용자 리뷰 요청` and stop for code-review.
> Finalization (`코드리뷰 결과`, log rename, `complete.log`, archive moves, `코드리뷰 전용 체크리스트`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.
## 개요
date=2026-06-07
task=m-live-trading-boundary/03+01,02_risk_kill_switch, plan=0, tag=LIVE_RISK
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 이 파일을 읽는 리뷰 에이전트에게
> **[REVIEW AGENT ONLY]** 아래 종결 절차는 코드리뷰 에이전트 전용이다. 구현 에이전트는 이 섹션을 실행하지 않는다.
각 항목의 구현을 실제 소스 파일과 대조하고, `검증 결과` 섹션의 출력이 코드와 일치하는지 확인하세요.
리뷰 완료는 아래 순서까지 끝난 상태를 의미합니다.
1. 판정을 append한다.
2. `CODE_REVIEW-cloud-G06.md` -> `code_review_cloud_G06_N.log`, `PLAN-cloud-G06.md` -> `plan_cloud_G06_M.log`로 아카이브한다.
3. PASS이면 `complete.log` 작성 후 active task 디렉터리를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동한다. WARN/FAIL이면 user-review gate를 확인한 뒤 다음 active plan/review 파일 또는 `USER_REVIEW.md`를 작성한다. `USER_REVIEW.md`가 사용자 결정으로 완료/PASS 해소되면 code-review가 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log` 작성 후 archive 이동한다.
4. PASS이고 task group이 `m-<milestone-slug>`이면 완료 이벤트 메타데이터를 보고한다. roadmap 상태 체크와 `update-roadmap` 호출은 런타임 책임이다.
5. 적용 가능한 `코드리뷰 전용 체크리스트` 항목을 최종 `.log` 위치에서 체크한 뒤 보고한다.
---
## 구현 항목별 완료 여부
| 항목 | 완료 여부 |
|------|---------|
| [LIVE_RISK-1] live risk policy domain/config defaults를 추가한다. | [x] |
| [LIVE_RISK-2] worker submit path에 risk guard와 kill switch를 적용한다. | [x] |
| [LIVE_RISK-3] risk/kill switch contract, API forwarder, CLI actions/output을 추가한다. | [x] |
| [LIVE_RISK-4] focused verification과 affected module tests를 실행한다. | [x] |
## 구현 체크리스트
- [x] [LIVE_RISK-1] live risk policy domain/config defaults를 추가한다.
- [x] [LIVE_RISK-2] worker submit path에 risk guard와 kill switch를 적용한다.
- [x] [LIVE_RISK-3] risk/kill switch contract, API forwarder, CLI actions/output을 추가한다.
- [x] [LIVE_RISK-4] focused verification과 affected module tests를 실행한다.
- [x] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
## 코드리뷰 전용 체크리스트
> **[REVIEW AGENT ONLY]** 이 체크리스트는 코드리뷰 에이전트만 사용한다.
> 구현 에이전트는 이 섹션을 수정하거나 체크하지 않는다.
- [x] `코드리뷰 결과`에 `PASS`, `WARN`, `FAIL` 중 하나의 판정을 append한다.
- [x] 판정과 `차원별 평가`, Required/Suggested/Nit 분류가 서로 일치한다.
- [x] active `CODE_REVIEW-*-G??.md`를 `code_review_cloud_G06_N.log`로 아카이브한다.
- [x] active `PLAN-*-G??.md`를 `plan_cloud_G06_M.log`로 아카이브한다.
- [x] `.gitignore`의 Agent-Ops 관리 block이 `agent-task/**/*.md`와 `agent-task/**/*.log`를 unignore하고 `agent-roadmap/current.md`를 ignore하는지 확인한다.
- [ ] PASS이면 `agent-ops/skills/common/code-review/templates/complete-log-template.md` 기준으로 `complete.log`를 작성하고 active `.md` 파일을 남기지 않는다.
- [ ] PASS이면 active task 디렉터리 `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/`를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동하고 최종 archive 경로에서 이 체크리스트를 갱신한다.
- [ ] PASS이고 task group이 `m-<milestone-slug>`이면 런타임이 읽을 완료 이벤트 메타데이터를 보고하고, roadmap 수정이나 `update-roadmap` 직접 호출을 하지 않는다.
- [ ] PASS split 작업이면 이동 후 빈 active parent `agent-task/m-live-trading-boundary/`를 제거하거나, 남은 sibling/file이 있어 유지했다고 확인한다.
- [x] WARN/FAIL이고 user-review gate가 트리거되지 않았으면 다음 active `PLAN-{build_lane}-GNN.md`와 `CODE_REVIEW-{review_lane}-GNN.md`를 작성하고 `complete.log`를 작성하지 않는다.
- [ ] USER_REVIEW이면 `agent-ops/skills/common/code-review/templates/user-review-template.md` 기준으로 `USER_REVIEW.md`를 작성하고 active `PLAN-*.md`, `CODE_REVIEW-*.md`, `complete.log`를 남기지 않는다.
- [ ] USER_REVIEW가 사용자 결정으로 완료/PASS 해소되면 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log`를 작성한 뒤 task directory를 archive로 이동한다.
## 계획 대비 변경 사항
- `services/worker/internal/socket/live_mapping.go`를 신규 파일로 분리해 `riskPolicyToProto`와 `killSwitchToProto` 함수를 추가했다. 계획에 명시된 `live.go`에 직접 추가하는 대신, 기존 패턴(paper_mapping.go)과 일관성을 유지했다.
- `services/api/internal/socket/live.go`에 forwarder handler 함수를 `apiLiveHandlers()` 아래가 아니라 위에서 아래 순서로 배치했다. handler wiring 함수가 먼저 나오고 구현이 뒤따르는 기존 패턴을 따랐다.
- `livetrading.Service`의 기존 테스트(`TestSubmitLiveOrderPreservesCustomOrderType` 등)에 `svc.SetKillSwitch(trading.KillSwitchState{Halted: false})` 호출을 추가했다. Kill switch default가 `halted=true`로 바뀌면서 기존 성공 경로 테스트가 차단되었기 때문이다. 계획의 의도와 일치하는 safe default 변경이다.
## 주요 설계 결정
1. **Kill switch safe default `halted=true`**: 새로운 live service 인스턴스는 kill switch가 기본적으로 halted 상태다. Operator가 명시적으로 해제해야만 주문이 통과한다. 이는 broker 연결 직후 의도치 않은 주문 제출을 막는 안전 장치다.
2. **`ErrRiskBlocked`를 `invalid_request` error code로 매핑**: Risk guard 거부는 broker unavailability가 아닌 의미상 잘못된 요청이므로 API/CLI 수신 측이 typed error로 구분할 수 있다. `liveOrderErrorCode()`에서 명시적으로 처리한다.
3. **Risk policy를 `Service` 내부에 mutex로 보호**: `policyMu sync.RWMutex`로 동시 read와 write를 분리했다. `GetRiskPolicy()`는 RLock, `SetKillSwitch()`는 Lock을 사용해 goroutine-safe하게 만들었다.
4. **`EvaluateRisk`에서 kill switch → short selling → notional limit 순서 평가**: Kill switch가 가장 먼저 평가되어 halted 시 다른 정책을 평가하지 않는다. Short selling은 side가 sell인 경우에만, notional limit은 limit order에만 적용된다. Market order는 price가 없으므로 notional check를 건너뛴다.
5. **API forwarder에서 account_id 필수 검증**: Worker에도 동일 검증이 있지만, API layer에서 먼저 막아 불필요한 network round-trip을 줄인다. 기존 live order lifecycle forwarder와 동일한 패턴이다.
6. **CLI `KillSwitchReason`을 별도 YAML field로 추가**: `ConfirmationReason`은 operator confirmation에 의미가 결합되어 있어 kill switch 상태 변경 이유로 재사용하면 혼동을 유발한다. `kill_switch_reason`이라는 독립적인 field를 추가했다.
## 사용자 리뷰 요청
_기본값은 `없음`이다. 구현 중 사용자 결정, 사용자 소유 외부 환경/secret/서비스 준비, 또는 계획 범위 변경 없이는 안전하게 진행할 수 없으면 아래 항목을 실제 내용으로 교체하고, 구현을 중단한 뒤 active 파일을 그대로 둔 채 리뷰를 요청한다. 구현 에이전트는 사용자에게 직접 질문하거나 선택지를 제시하거나 `request_user_input`을 호출하지 않는다. 후속 에이전트가 명령 재실행이나 산출물 수집으로 해소할 수 있는 검증 증거 공백만으로는 사용자 리뷰 요청을 작성하지 않는다._
- 상태: 없음
- 사유 유형: 없음
- 결정 필요: 없음
- 차단 근거: 없음
- 실행한 검증/명령: 없음
- 자동 후속 불가 이유: 없음
- 재개 조건: 없음
## 리뷰어를 위한 체크포인트
- `01_broker_port`와 `02+01_order_lifecycle` completion이 prerequisite로 충족됐는지 확인한다.
- Kill switch default가 safe default이며 config/test fixture로 조정 가능한지 확인한다.
- Risk denial이 broker call 이전에 발생하고 fake broker call count test가 있는지 확인한다.
- Risk policy가 주문 type capability를 닫지 않는지 확인한다.
- CLI/API가 secret/account number를 tracked fixture에 기록하지 않는지 확인한다.
## 검증 결과
_구현 에이전트가 각 중간 검증 및 최종 검증 명령 실행 후 출력을 여기에 붙여 넣는다._
필수 규칙:
- 검증 명령은 고정된 계약이다. 임의로 대체하지 않는다.
- 대체가 필요하면 `계획 대비 변경 사항`에 이유와 대체 명령을 기록한다.
- `검증 결과`에는 실제 stdout/stderr를 붙여 넣는다.
- 사용자 리뷰 요청으로 명령을 끝까지 실행하지 못했다면 `사용자 리뷰 요청`에 실행한 명령, 실제 출력, 미실행 명령의 사유를 기록한다.
- mobile/UI hang, timeout, 또는 2분 무진행은 blind retry를 중단하고 focused rerun 명령과 screenshot/window/UI-tree evidence path를 남기며, 불가능하면 정확한 사유를 남긴다.
### LIVE_RISK-1 중간 검증
```text
$ go test ./packages/domain/...
ok git.toki-labs.com/toki/alt/packages/domain/backtest (cached)
ok git.toki-labs.com/toki/alt/packages/domain/market (cached)
ok git.toki-labs.com/toki/alt/packages/domain/trading 0.002s
```
### LIVE_RISK-2 중간 검증
```text
$ go test ./services/worker/internal/livetrading/... ./services/worker/internal/socket/...
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.003s
ok git.toki-labs.com/toki/alt/services/worker/internal/socket 0.067s
```
### LIVE_RISK-3 중간 검증
```text
$ bin/contracts-gen
(no output — codegen succeeded)
$ bin/contracts-check
(no output — generated files are up to date)
$ go test ./services/api/internal/socket/... ./apps/cli/internal/operator/...
ok git.toki-labs.com/toki/alt/services/api/internal/socket 0.010s
ok git.toki-labs.com/toki/alt/apps/cli/internal/operator 0.184s
```
### 최종 검증
```text
$ bin/contracts-check
(no output — exit code 0)
$ go test ./packages/domain/...
ok git.toki-labs.com/toki/alt/packages/domain/backtest (cached)
ok git.toki-labs.com/toki/alt/packages/domain/market (cached)
ok git.toki-labs.com/toki/alt/packages/domain/trading (cached)
$ go test ./packages/contracts/gen/go/...
? git.toki-labs.com/toki/alt/packages/contracts/gen/go/alt/v1 [no test files]
$ go test ./services/worker/...
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker (cached)
? git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-data-check [no test files]
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-migrate (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/backtest (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/config (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/contracts (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/jobs (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/datacheck (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/importer (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/papertrading (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/providers/kis (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/rediskeys (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/socket (cached)
? git.toki-labs.com/toki/alt/services/worker/internal/storage [no test files]
ok git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres (cached)
? git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres/sqlc [no test files]
$ go test ./services/api/...
? git.toki-labs.com/toki/alt/services/api/cmd/alt-api [no test files]
ok git.toki-labs.com/toki/alt/services/api/internal/config (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/contracts (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/socket (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/workerclient (cached)
$ go test ./apps/cli/...
? git.toki-labs.com/toki/alt/apps/cli/cmd/alt [no test files]
ok git.toki-labs.com/toki/alt/apps/cli/internal/cli (cached)
ok git.toki-labs.com/toki/alt/apps/cli/internal/operator (cached)
$ bin/lint
Analyzing client...
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:27:7 • avoid_print
(... 12 more pre-existing avoid_print warnings in mattermost_auth_service.dart ...)
13 issues found. (ran in 4.2s)
```
lint 13개 모두 `mattermost_auth_service.dart`의 기존 `avoid_print` info 경고이며 이번 구현과 무관하다. 새로 추가한 Go/Dart 파일에서 lint 위반 없음.
---
> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section: completion table, implementation checklist, changes from plan, design decisions, and verification output?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.
## 코드리뷰 결과
### 종합 판정
FAIL
### 차원별 평가
| 차원 | 평가 | 근거 |
|------|------|------|
| correctness | Fail | live risk policy의 주문 수 제한이 실제 제출 경로에서 평가되지 않는다. |
| completeness | Fail | 계획의 `LiveRiskDecision`/blocked order record 및 client parser rollout이 빠졌다. |
| test coverage | Fail | daily/open order limit, client parser map 신메시지 등록 테스트가 없다. |
| API contract | Fail | 새 Dart generated message가 client parser map에 등록되지 않고, risk denial decision surface가 없다. |
| code quality | Pass | 리뷰 중 `gofmt` drift는 비동작성 수정으로 정리했다. |
| plan deviation | Fail | 계획의 max daily/open live order guard, rejected/blocked order 저장, `LiveRiskDecision`이 구현되지 않았다. |
| verification trust | Warn | Go/contract/client focused rerun은 통과했지만 기존 Flutter contract test가 새 live risk/kill switch 메시지를 검증하지 못한다. |
### 발견된 문제
- Required: `services/worker/internal/livetrading/service.go:194`에서 현재 `policy`와 `killSwitch`만 복사한 뒤 `trading.EvaluateRisk`를 호출하지만, `packages/domain/trading/risk.go:61`의 평가 함수는 kill switch, short selling, notional만 확인한다. `services/worker/internal/livetrading/config.go:17`의 `MaxDailyOrders=5`와 `MaxOpenOrders=3` 기본값은 contract/CLI에 노출되지만 broker call 전 guard로 전혀 적용되지 않아 계획의 최소 risk limit을 충족하지 못한다. Fix: `SubmitLiveOrder`가 account별 당일 주문 수와 non-terminal open order 수를 계산해 한도 초과 시 `ErrRiskBlocked`로 broker 호출 전에 차단하고, `TestSubmitLiveOrderMaxDailyOrdersBlocks`와 `TestSubmitLiveOrderMaxOpenOrdersBlocks`를 추가한다.
- Required: `services/worker/internal/livetrading/service.go:199`은 risk denial을 `LiveOrder{}` + error로 즉시 반환해 차단 주문을 in-memory registry에 `rejected`/`blocked` 상태로 저장하지 않는다. 또한 `packages/contracts/proto/alt/v1/live_trading.proto:137`의 `SubmitLiveOrderResponse`에는 `order`/`error`만 있고, 계획이 요구한 `LiveRiskDecision` surface가 없어 CLI도 `apps/cli/internal/operator/output.go:202`의 live order fields나 별도 risk decision fields로 차단 사유를 안정적으로 표시할 수 없다. Fix: risk denial 시 broker 호출 없이 rejected/blocked live order record와 reason을 보존하고, 필요한 `LiveRiskDecision` contract/API/CLI output을 추가한 뒤 worker/API/CLI tests를 보강한다.
- Required: `apps/client/lib/src/generated/alt/v1/live_trading.pb.dart:1618`에 `LiveRiskPolicy`, `LiveKillSwitchState`, `GetLiveRiskPolicy*`, `GetLiveKillSwitch*`, `SetLiveKillSwitch*` generated classes가 추가됐지만 `apps/client/lib/src/contracts/alt_contracts.dart:59`의 `altParserMap`은 기존 live order lifecycle 메시지까지만 등록한다. `apps/client/test/contracts/alt_contracts_test.dart:16`의 expected list와 `parsers.length == 33`도 같은 old set만 검증해서 Flutter client가 새 API response를 파싱하지 못하는 contract drift를 잡지 못한다. Fix: 새 live risk/kill switch request/response/state/policy 메시지를 Dart parser map과 contract test에 모두 추가하고 `cd apps/client && flutter test test/contracts/alt_contracts_test.dart`를 최종 검증에 포함한다.
### 다음 단계
FAIL follow-up: `PLAN-cloud-G07.md`와 `CODE_REVIEW-cloud-G07.md`를 작성해 위 Required 이슈만 좁게 보완한다.

246
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/code_review_cloud_G07_1.log Normal file
View file

@ -0,0 +1,246 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=1 tag=REVIEW_LIVE_RISK -->
# Code Review Reference - REVIEW_LIVE_RISK
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `구현 체크리스트`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked by a user-only decision, user-owned external environment prerequisite, or scope conflict, fill `사용자 리뷰 요청` with evidence and stop with active files in place; code-review decides whether to write `USER_REVIEW.md`. Evidence gaps that a follow-up agent can close by rerunning commands or collecting artifacts are normal follow-up issues, not user-review blockers by themselves.
> Do not ask the user directly, present choices in chat, or call `request_user_input` during implementation; record the needed decision in `사용자 리뷰 요청` and stop for code-review.
> Finalization (`코드리뷰 결과`, log rename, `complete.log`, archive moves, `코드리뷰 전용 체크리스트`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.
## 개요
date=2026-06-07
task=m-live-trading-boundary/03+01,02_risk_kill_switch, plan=1, tag=REVIEW_LIVE_RISK
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 이 파일을 읽는 리뷰 에이전트에게
> **[REVIEW AGENT ONLY]** 아래 종결 절차는 코드리뷰 에이전트 전용이다. 구현 에이전트는 이 섹션을 실행하지 않는다.
각 항목의 구현을 실제 소스 파일과 대조하고, `검증 결과` 섹션의 출력이 코드와 일치하는지 확인하세요.
리뷰 완료는 아래 순서까지 끝난 상태를 의미합니다.
1. 판정을 append한다.
2. `CODE_REVIEW-cloud-G07.md` -> `code_review_cloud_G07_N.log`, `PLAN-cloud-G07.md` -> `plan_cloud_G07_M.log`로 아카이브한다.
3. PASS이면 `complete.log` 작성 후 active task 디렉터리를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동한다. WARN/FAIL이면 user-review gate를 확인한 뒤 다음 active plan/review 파일 또는 `USER_REVIEW.md`를 작성한다.
4. PASS이고 task group이 `m-<milestone-slug>`이면 완료 이벤트 메타데이터를 보고한다. roadmap 상태 체크와 `update-roadmap` 호출은 런타임 책임이다.
5. 적용 가능한 `코드리뷰 전용 체크리스트` 항목을 최종 `.log` 위치에서 체크한 뒤 보고한다.
---
## 구현 항목별 완료 여부
| 항목 | 완료 여부 |
|------|---------|
| [REVIEW_LIVE_RISK-1] max daily/open live order limits를 submit guard에 적용한다. | [x] |
| [REVIEW_LIVE_RISK-2] risk denial을 rejected/blocked order record와 `LiveRiskDecision` contract/CLI evidence로 남긴다. | [x] |
| [REVIEW_LIVE_RISK-3] Flutter contract parser map과 contract test에 live risk/kill switch messages를 등록한다. | [x] |
| [REVIEW_LIVE_RISK-4] focused verification과 affected module tests를 실행한다. | [x] |
## 구현 체크리스트
- [x] [REVIEW_LIVE_RISK-1] max daily/open live order limits를 submit guard에 적용한다.
- [x] [REVIEW_LIVE_RISK-2] risk denial을 rejected/blocked order record와 `LiveRiskDecision` contract/CLI evidence로 남긴다.
- [x] [REVIEW_LIVE_RISK-3] Flutter contract parser map과 contract test에 live risk/kill switch messages를 등록한다.
- [x] [REVIEW_LIVE_RISK-4] focused verification과 affected module tests를 실행한다.
- [x] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
## 코드리뷰 전용 체크리스트
> **[REVIEW AGENT ONLY]** 이 체크리스트는 코드리뷰 에이전트만 사용한다.
> 구현 에이전트는 이 섹션을 수정하거나 체크하지 않는다.
- [x] `코드리뷰 결과`에 `PASS`, `WARN`, `FAIL` 중 하나의 판정을 append한다.
- [x] 판정과 `차원별 평가`, Required/Suggested/Nit 분류가 서로 일치한다.
- [x] active `CODE_REVIEW-*-G??.md`를 `code_review_cloud_G07_N.log`로 아카이브한다.
- [x] active `PLAN-*-G??.md`를 `plan_cloud_G07_M.log`로 아카이브한다.
- [x] `.gitignore`의 Agent-Ops 관리 block이 `agent-task/**/*.md`와 `agent-task/**/*.log`를 unignore하고 `agent-roadmap/current.md`를 ignore하는지 확인한다.
- [ ] PASS이면 `agent-ops/skills/common/code-review/templates/complete-log-template.md` 기준으로 `complete.log`를 작성하고 active `.md` 파일을 남기지 않는다.
- [ ] PASS이면 active task 디렉터리 `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/`를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동하고 최종 archive 경로에서 이 체크리스트를 갱신한다.
- [ ] PASS이고 task group이 `m-<milestone-slug>`이면 런타임이 읽을 완료 이벤트 메타데이터를 보고하고, roadmap 수정이나 `update-roadmap` 직접 호출을 하지 않는다.
- [ ] PASS split 작업이면 이동 후 빈 active parent `agent-task/m-live-trading-boundary/`를 제거하거나, 남은 sibling/file이 있어 유지했다고 확인한다.
- [x] WARN/FAIL이고 user-review gate가 트리거되지 않았으면 다음 active `PLAN-{build_lane}-GNN.md`와 `CODE_REVIEW-{review_lane}-GNN.md`를 작성하고 `complete.log`를 작성하지 않는다.
- [ ] USER_REVIEW이면 `agent-ops/skills/common/code-review/templates/user-review-template.md` 기준으로 `USER_REVIEW.md`를 작성하고 active `PLAN-*.md`, `CODE_REVIEW-*.md`, `complete.log`를 남기지 않는다.
- [ ] USER_REVIEW가 사용자 결정으로 완료/PASS 해소되면 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log`를 작성한 뒤 task directory를 archive로 이동한다.
## 계획 대비 변경 사항
- `bin/contracts-gen` 출력: proto 재생성은 G06 루프에서 이미 수행되어 generated 파일이 수정 상태로 있었으므로 재실행 없이 `bin/contracts-check`로만 일관성을 확인했다. contracts-check가 비출력(성공)이었으므로 proto ↔ gen 파일이 일치한다.
- 그 외 계획과의 차이 없음. 모든 항목은 PLAN-cloud-G07.md의 명세를 그대로 따랐다.
## 주요 설계 결정
1. **`SubmitLiveOrder`의 반환 타입을 유지**: risk denial 시에도 `(LiveOrder, error)`를 반환한다. `recordRiskRejectedOrder`가 `rejected` 상태의 `LiveOrder`를 in-memory에 기록하고 반환하므로, socket handler는 `order.ID != ""`로 rejected order 유무를 판별해 `SubmitLiveOrderResponse`에 포함할 수 있다. 서비스 인터페이스 변경 없이 정보를 전달하는 가장 좁은 변경이다.
2. **`riskDecisionToProto`는 `order.RejectionReason`에서 reason을 취득**: socket handler가 `RiskDecision` 값을 직접 갖지 않으므로, rejected order record의 `RejectionReason` 필드를 재활용한다. `recordRiskRejectedOrder`가 `decision.Reason`을 order에 기록하므로 정보 손실 없이 역방향 변환이 가능하다.
3. **`riskUsageForAccount`는 s.mu RLock 하에서 호출**: caller인 `SubmitLiveOrder`가 이미 RLock을 보유한 상태로 호출한다. 함수 내부에서 Lock/Unlock하지 않아 double-lock 없이 in-memory orders를 안전하게 순회한다.
4. **`isTerminalStatus`를 별도 helper로 분리**: `filled/canceled/rejected` 세 가지 terminal 상태 판별 로직이 open order count 계산과 향후 order lifecycle 관리에서 재사용될 수 있어 helper로 분리했다.
5. **Flutter altParserMap: 9개 신규 + 기존 33 = 42**: `GetLiveRiskPolicy{Request,Response}`, `LiveRiskPolicy`, `GetLiveKillSwitch{Request,Response}`, `SetLiveKillSwitch{Request,Response}`, `LiveKillSwitchState`, `LiveRiskDecision` 9개를 추가했다. `live_trading.pb.dart`에 이미 존재하는 클래스들이며, 이전 G06 루프에서 parser map에 누락된 항목들이다.
## 사용자 리뷰 요청
- 상태: 없음
- 사유 유형: 없음
- 결정 필요: 없음
- 차단 근거: 없음
- 실행한 검증/명령: 없음
- 자동 후속 불가 이유: 없음
- 재개 조건: 없음
## 리뷰어를 위한 체크포인트
- `MaxDailyOrders`와 `MaxOpenOrders`가 broker call 전에 account별로 적용되는지 확인한다.
- Risk denial이 broker를 호출하지 않으면서 rejected/blocked live order record와 reason/decision을 남기는지 확인한다.
- `LiveRiskDecision`이 Go/Dart generated output, worker/API/CLI parser maps, CLI output/tests까지 일관되게 연결됐는지 확인한다.
- Flutter `altParserMap`과 `alt_contracts_test.dart`가 새 live risk/kill switch messages를 포함하는지 확인한다.
- Verification output이 실제 stdout/stderr이고 `bin/lint`의 기존 Mattermost info와 새 위반을 구분했는지 확인한다.
## 검증 결과
### REVIEW_LIVE_RISK-1 중간 검증
```text
$ go test ./packages/domain/... ./services/worker/internal/livetrading
ok git.toki-labs.com/toki/alt/packages/domain/backtest (cached)
ok git.toki-labs.com/toki/alt/packages/domain/market (cached)
ok git.toki-labs.com/toki/alt/packages/domain/trading (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading (cached)
```
### REVIEW_LIVE_RISK-2 중간 검증
```text
$ bin/contracts-gen
(no output — 성공)
$ bin/contracts-check
(no output — 성공)
$ go test ./packages/contracts/gen/go/... ./services/worker/internal/livetrading ./services/worker/internal/socket ./services/api/internal/socket ./apps/cli/internal/operator
? git.toki-labs.com/toki/alt/packages/contracts/gen/go/alt/v1 [no test files]
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/socket (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/socket (cached)
ok git.toki-labs.com/toki/alt/apps/cli/internal/operator (cached)
```
### REVIEW_LIVE_RISK-3 중간 검증
```text
$ cd apps/client && flutter test test/contracts/alt_contracts_test.dart
00:00 +0: loading /config/workspace/alt/apps/client/test/contracts/alt_contracts_test.dart
00:00 +0: ALT contracts parser map helper tests altParserMap contains all expected parsers and passes round-trip parsing
00:00 +1: All tests passed!
```
### 최종 검증
```text
$ bin/contracts-check
(no output — 성공)
$ go test ./packages/domain/...
ok git.toki-labs.com/toki/alt/packages/domain/backtest (cached)
ok git.toki-labs.com/toki/alt/packages/domain/market (cached)
ok git.toki-labs.com/toki/alt/packages/domain/trading 0.002s
$ go test ./packages/contracts/gen/go/...
? git.toki-labs.com/toki/alt/packages/contracts/gen/go/alt/v1 [no test files]
$ go test ./services/worker/...
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker 0.005s
? git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-data-check [no test files]
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-migrate (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/backtest (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/config (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/contracts 0.004s
ok git.toki-labs.com/toki/alt/services/worker/internal/jobs (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.002s
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/datacheck (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/importer (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/papertrading (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/providers/kis (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/rediskeys (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/socket 0.062s
? git.toki-labs.com/toki/alt/services/worker/internal/storage [no test files]
ok git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres (cached)
? git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres/sqlc [no test files]
$ go test ./services/api/...
? git.toki-labs.com/toki/alt/services/api/cmd/alt-api [no test files]
ok git.toki-labs.com/toki/alt/services/api/internal/config (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/contracts 0.005s
ok git.toki-labs.com/toki/alt/services/api/internal/socket 0.010s
ok git.toki-labs.com/toki/alt/services/api/internal/workerclient 0.429s
$ go test ./apps/cli/...
? git.toki-labs.com/toki/alt/apps/cli/cmd/alt [no test files]
ok git.toki-labs.com/toki/alt/apps/cli/internal/cli 0.006s
ok git.toki-labs.com/toki/alt/apps/cli/internal/operator 0.178s
$ cd apps/client && flutter test test/contracts/alt_contracts_test.dart
00:00 +0: loading /config/workspace/alt/apps/client/test/contracts/alt_contracts_test.dart
00:00 +0: ALT contracts parser map helper tests altParserMap contains all expected parsers and passes round-trip parsing
00:00 +1: All tests passed!
$ bin/lint
Analyzing client...
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:27:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:35:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:41:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:44:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:51:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:55:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:101:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:123:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:132:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:134:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:137:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:154:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:156:7 • avoid_print
13 issues found. (ran in 4.2s)
[모두 mattermost_auth_service.dart의 기존 avoid_print warning. 이번 변경으로 인한 신규 위반 없음.]
```
---
> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section: completion table, implementation checklist, changes from plan, design decisions, and verification output?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.
## 코드리뷰 결과
### 종합 판정
FAIL
### 차원별 평가
| 차원 | 평가 | 근거 |
|------|------|------|
| correctness | Fail | max daily/open live order guard가 순차 호출에서는 동작하지만 concurrent submit에서는 broker 호출 전 한도 보장을 하지 못한다. |
| completeness | Fail | G06 Required 보완의 핵심인 count-limit guard가 동시 제출 경계까지 완료되지 않았다. |
| test coverage | Fail | max daily/open limit tests가 모두 순차 호출만 검증하고, broker call이 막힌 상태에서 동시 제출을 검증하지 않는다. |
| API contract | Pass | `LiveRiskDecision`과 risk/kill switch request/response contract, Go/Dart generated output, parser maps는 추가됐다. |
| code quality | Pass | 리뷰 중 `gofmt` drift는 비동작성 수정으로 정리했다. |
| plan deviation | Fail | 계획의 "broker call 전 account별 MaxDailyOrders/MaxOpenOrders 적용"이 concurrent request path에서 성립하지 않는다. |
| verification trust | Pass | reviewer rerun 기준 contracts, affected Go tests, Flutter parser test, lint, diff check가 통과했다. |
### 발견된 문제
- Required: `services/worker/internal/livetrading/service.go:199`에서 account usage를 `RLock`으로 읽고 바로 해제한 뒤, `services/worker/internal/livetrading/service.go:212`에서 broker를 호출하고 `services/worker/internal/livetrading/service.go:217` 이후에야 새 order를 저장한다. 그래서 같은 account에 대해 두 submit이 동시에 들어오면 둘 다 동일한 pre-submit count를 보고 `MaxOpenOrders`/`MaxDailyOrders`를 통과한 뒤 broker까지 도달할 수 있다. 이 경로는 money-moving risk limit의 핵심 보장인 "broker call 전 차단"을 깨며, 현재 `services/worker/internal/livetrading/service_test.go:437`와 `services/worker/internal/livetrading/service_test.go:469`의 테스트도 순차 호출만 검증한다. Fix: account별 risk reservation을 broker 호출 전에 원자적으로 만들고, broker 호출이 느리거나 동시에 시작되는 상황에서도 한도 초과 요청이 broker에 도달하지 않도록 한다. 예를 들어 account별 submit/risk mutex 또는 provisional in-memory order reservation으로 usage 계산과 reservation을 같은 critical section에서 처리한 뒤 broker 결과로 record를 갱신한다. `MaxOpenOrders=1`과 `MaxDailyOrders=1`에서 blocking fake broker로 동시 submit을 실행해 broker call count가 1이고 나머지는 rejected order + `ErrRiskBlocked`가 되는 테스트를 추가한다.
### 다음 단계
FAIL follow-up: `PLAN-cloud-G07.md`와 `CODE_REVIEW-cloud-G07.md`를 다시 작성해 concurrent submit에서도 live risk count guard가 broker 전 원자적으로 적용되도록 보완한다.

239
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/code_review_cloud_G07_2.log Normal file
View file

@ -0,0 +1,239 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=2 tag=REVIEW_REVIEW_LIVE_RISK -->
# Code Review Reference - REVIEW_REVIEW_LIVE_RISK
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `구현 체크리스트`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked by a user-only decision, user-owned external environment prerequisite, or scope conflict, fill `사용자 리뷰 요청` with evidence and stop with active files in place; code-review decides whether to write `USER_REVIEW.md`. Evidence gaps that a follow-up agent can close by rerunning commands or collecting artifacts are normal follow-up issues, not user-review blockers by themselves.
> Do not ask the user directly, present choices in chat, or call `request_user_input` during implementation; record the needed decision in `사용자 리뷰 요청` and stop for code-review.
> Finalization (`코드리뷰 결과`, log rename, `complete.log`, archive moves, `코드리뷰 전용 체크리스트`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.
## 개요
date=2026-06-07
task=m-live-trading-boundary/03+01,02_risk_kill_switch, plan=2, tag=REVIEW_REVIEW_LIVE_RISK
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 이 파일을 읽는 리뷰 에이전트에게
> **[REVIEW AGENT ONLY]** 아래 종결 절차는 코드리뷰 에이전트 전용이다. 구현 에이전트는 이 섹션을 실행하지 않는다.
각 항목의 구현을 실제 소스 파일과 대조하고, `검증 결과` 섹션의 출력이 코드와 일치하는지 확인하세요.
리뷰 완료는 아래 순서까지 끝난 상태를 의미합니다.
1. 판정을 append한다.
2. `CODE_REVIEW-cloud-G07.md` -> `code_review_cloud_G07_N.log`, `PLAN-cloud-G07.md` -> `plan_cloud_G07_M.log`로 아카이브한다.
3. PASS이면 `complete.log` 작성 후 active task 디렉터리를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동한다. WARN/FAIL이면 user-review gate를 확인한 뒤 다음 active plan/review 파일 또는 `USER_REVIEW.md`를 작성한다.
4. PASS이고 task group이 `m-<milestone-slug>`이면 완료 이벤트 메타데이터를 보고한다. roadmap 상태 체크와 `update-roadmap` 호출은 런타임 책임이다.
5. 적용 가능한 `코드리뷰 전용 체크리스트` 항목을 최종 `.log` 위치에서 체크한 뒤 보고한다.
---
## 구현 항목별 완료 여부
| 항목 | 완료 여부 |
|------|---------|
| [REVIEW_REVIEW_LIVE_RISK-1] same-account concurrent submit에서도 max daily/open live order guard가 broker 호출 전 원자적으로 적용되게 한다. | [x] |
| [REVIEW_REVIEW_LIVE_RISK-2] focused verification과 affected module checks를 실행한다. | [x] |
## 구현 체크리스트
- [x] [REVIEW_REVIEW_LIVE_RISK-1] same-account concurrent submit에서도 max daily/open live order guard가 broker 호출 전 원자적으로 적용되게 한다.
- [x] [REVIEW_REVIEW_LIVE_RISK-2] focused verification과 affected module checks를 실행한다.
- [x] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
## 코드리뷰 전용 체크리스트
> **[REVIEW AGENT ONLY]** 이 체크리스트는 코드리뷰 에이전트만 사용한다.
> 구현 에이전트는 이 섹션을 수정하거나 체크하지 않는다.
- [x] `코드리뷰 결과`에 `PASS`, `WARN`, `FAIL` 중 하나의 판정을 append한다.
- [x] 판정과 `차원별 평가`, Required/Suggested/Nit 분류가 서로 일치한다.
- [x] active `CODE_REVIEW-*-G??.md`를 `code_review_cloud_G07_N.log`로 아카이브한다.
- [x] active `PLAN-*-G??.md`를 `plan_cloud_G07_M.log`로 아카이브한다.
- [x] `.gitignore`의 Agent-Ops 관리 block이 `agent-task/**/*.md`와 `agent-task/**/*.log`를 unignore하고 `agent-roadmap/current.md`를 ignore하는지 확인한다.
- [ ] PASS이면 `agent-ops/skills/common/code-review/templates/complete-log-template.md` 기준으로 `complete.log`를 작성하고 active `.md` 파일을 남기지 않는다.
- [ ] PASS이면 active task 디렉터리 `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/`를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동하고 최종 archive 경로에서 이 체크리스트를 갱신한다.
- [ ] PASS이고 task group이 `m-<milestone-slug>`이면 런타임이 읽을 완료 이벤트 메타데이터를 보고하고, roadmap 수정이나 `update-roadmap` 직접 호출을 하지 않는다.
- [ ] PASS split 작업이면 이동 후 빈 active parent `agent-task/m-live-trading-boundary/`를 제거하거나, 남은 sibling/file이 있어 유지했다고 확인한다.
- [x] WARN/FAIL이고 user-review gate가 트리거되지 않았으면 다음 active `PLAN-{build_lane}-GNN.md`와 `CODE_REVIEW-{review_lane}-GNN.md`를 작성하고 `complete.log`를 작성하지 않는다.
- [ ] USER_REVIEW이면 `agent-ops/skills/common/code-review/templates/user-review-template.md` 기준으로 `USER_REVIEW.md`를 작성하고 active `PLAN-*.md`, `CODE_REVIEW-*.md`, `complete.log`를 남기지 않는다.
- [ ] USER_REVIEW가 사용자 결정으로 완료/PASS 해소되면 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log`를 작성한 뒤 task directory를 archive로 이동한다.
## 계획 대비 변경 사항
없음. 계획에서 선호안으로 제시한 account별 submit mutex를 그대로 선택했다.
## 주요 설계 결정
**account별 submit mutex 선택 (plan 선호안)**
`Service` 구조체에 `acctMuMu sync.Mutex`(map 보호용)와 `acctMus map[string]*sync.Mutex`(account별 submit 직렬화)를 추가했다. `submitLockForAccount(accountID)` 헬퍼가 map에서 mutex를 get-or-create한다.
`SubmitLiveOrder`에서 policy/ks 조회(policyMu 아래) 직후, `riskUsageForAccount` 호출 전에 account mutex를 획득(`acctMu.Lock()` + `defer acctMu.Unlock()`)한다. account mutex는 risk usage 읽기 → EvaluateRisk → broker.SubmitOrder → 주문 저장까지 보유하며, broker 호출 동안 다른 account submit이나 cancel/get은 블로킹하지 않는다.
`recordRiskRejectedOrder`는 account mutex 보유 상태에서 호출되므로 이중 잠금 위험이 없다(s.mu만 내부에서 새로 잡음).
**테스트 보조 타입: `blockingFakeBroker`**
`brokerEntered` 채널(sync.Once로 최초 SubmitOrder 진입 시 close)과 `releaseCh` 채널(테스트 main이 close해 broker를 해제)으로 타이밍을 제어한다. 두 concurrent 테스트 모두 `<-blocking.brokerEntered`로 첫 submit이 account mutex를 잡고 broker 안에 있음을 확인한 뒤 두 번째 goroutine을 시작한다.
## 사용자 리뷰 요청
_기본값은 `없음`이다. 구현 중 사용자 결정, 사용자 소유 외부 환경/secret/서비스 준비, 또는 계획 범위 변경 없이는 안전하게 진행할 수 없으면 아래 항목을 실제 내용으로 교체하고, 구현을 중단한 뒤 active 파일을 그대로 둔 채 리뷰를 요청한다. 구현 에이전트는 사용자에게 직접 질문하거나 선택지를 제시하거나 `request_user_input`을 호출하지 않는다. 후속 에이전트가 명령 재실행이나 산출물 수집으로 해소할 수 있는 검증 증거 공백만으로는 사용자 리뷰 요청을 작성하지 않는다._
- 상태: 없음
- 사유 유형: 없음
- 결정 필요: 없음
- 차단 근거: 없음
- 실행한 검증/명령: 없음
- 자동 후속 불가 이유: 없음
- 재개 조건: 없음
## 리뷰어를 위한 체크포인트
- 같은 account의 concurrent `SubmitLiveOrder`에서 usage 계산과 risk slot 반영이 broker 호출 전 원자적으로 보장되는지 확인한다.
- `MaxOpenOrders=1`과 `MaxDailyOrders=1` concurrent tests가 broker call count 1, 나머지 rejected order + `ErrRiskBlocked`를 검증하는지 확인한다.
- account별 serialization을 선택했다면 다른 account submit까지 불필요하게 전역 직렬화하지 않는지 확인한다.
- 기존 `LiveRiskDecision`, worker/API/CLI parser map, Flutter parser map surface가 drift 나지 않았는지 확인한다.
- Verification output이 실제 stdout/stderr이고 `bin/lint`의 기존 Mattermost info와 새 위반을 구분했는지 확인한다.
## 검증 결과
_구현 에이전트가 각 중간 검증 및 최종 검증 명령 실행 후 출력을 여기에 붙여 넣는다._
필수 규칙:
- 검증 명령은 고정된 계약이다. 임의로 대체하지 않는다.
- 대체가 필요하면 `계획 대비 변경 사항`에 이유와 대체 명령을 기록한다.
- `검증 결과`에는 실제 stdout/stderr를 붙여 넣는다.
- 사용자 리뷰 요청으로 명령을 끝까지 실행하지 못했다면 `사용자 리뷰 요청`에 실행한 명령, 실제 출력, 미실행 명령의 사유를 기록한다.
- mobile/UI hang, timeout, 또는 2분 무진행은 blind retry를 중단하고 focused rerun 명령과 screenshot/window/UI-tree evidence path를 남기며, 불가능하면 정확한 사유를 남긴다.
### REVIEW_REVIEW_LIVE_RISK-1 중간 검증
```text
$ go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrderConcurrent(MaxOpenOrders|MaxDailyOrders)' -count=1 -v
=== RUN TestSubmitLiveOrderConcurrentMaxOpenOrdersBlocksBeforeBroker
--- PASS: TestSubmitLiveOrderConcurrentMaxOpenOrdersBlocksBeforeBroker (0.00s)
=== RUN TestSubmitLiveOrderConcurrentMaxDailyOrdersBlocksBeforeBroker
--- PASS: TestSubmitLiveOrderConcurrentMaxDailyOrdersBlocksBeforeBroker (0.00s)
PASS
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.002s
$ go test ./services/worker/internal/livetrading
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.002s
```
### 최종 검증
```text
$ gofmt -l packages/domain/trading/risk.go packages/domain/trading/risk_test.go services/worker/internal/livetrading/config.go services/worker/internal/livetrading/service.go services/worker/internal/livetrading/service_test.go services/worker/internal/socket/live.go services/worker/internal/socket/live_mapping.go services/worker/internal/socket/live_test.go services/worker/internal/contracts/parser_map.go services/api/internal/socket/live.go services/api/internal/socket/live_test.go services/api/internal/workerclient/client.go services/api/internal/contracts/parser_map.go services/api/internal/socket/backtest_test.go apps/cli/internal/operator/client.go apps/cli/internal/operator/client_test.go apps/cli/internal/operator/output.go apps/cli/internal/operator/parser_map.go apps/cli/internal/operator/runner.go apps/cli/internal/operator/runner_live_test.go apps/cli/internal/operator/scenario.go
(empty — all files are formatted)
$ bin/contracts-check
(exit 0, no output)
$ go test ./packages/domain/...
ok git.toki-labs.com/toki/alt/packages/domain/backtest (cached)
ok git.toki-labs.com/toki/alt/packages/domain/market (cached)
ok git.toki-labs.com/toki/alt/packages/domain/trading (cached)
$ go test ./packages/contracts/gen/go/...
? git.toki-labs.com/toki/alt/packages/contracts/gen/go/alt/v1 [no test files]
$ go test ./services/worker/...
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker (cached)
? git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-data-check [no test files]
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-migrate (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/backtest (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/config (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/contracts (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/jobs (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.003s
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/datacheck (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/importer (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/papertrading (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/providers/kis (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/rediskeys (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/socket (cached)
? git.toki-labs.com/toki/alt/services/worker/internal/storage [no test files]
ok git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres (cached)
? git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres/sqlc [no test files]
$ go test ./services/api/...
? git.toki-labs.com/toki/alt/services/api/cmd/alt-api [no test files]
ok git.toki-labs.com/toki/alt/services/api/internal/config (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/contracts (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/socket (cached)
ok git.toki-labs.com/toki/alt/services/api/internal/workerclient (cached)
$ go test ./apps/cli/...
? git.toki-labs.com/toki/alt/apps/cli/cmd/alt [no test files]
ok git.toki-labs.com/toki/alt/apps/cli/internal/cli (cached)
ok git.toki-labs.com/toki/alt/apps/cli/internal/operator (cached)
$ cd apps/client && flutter test test/contracts/alt_contracts_test.dart
00:00 +0: loading .../test/contracts/alt_contracts_test.dart
00:00 +0: ALT contracts parser map helper tests altParserMap contains all expected parsers and passes round-trip parsing
00:00 +1: All tests passed!
$ bin/lint
Analyzing client...
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:27:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:35:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:41:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:44:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:51:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:55:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:101:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:123:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:132:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:134:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:137:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:154:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:156:7 • avoid_print
13 issues found. (ran in 3.0s)
(exit 0 — 13개 모두 기존 Mattermost avoid_print info, 새 위반 없음)
```
---
> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section: completion table, implementation checklist, changes from plan, design decisions, and verification output?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.
## 코드리뷰 결과
### 종합 판정
FAIL
### 차원별 평가
| 차원 | 평가 | 근거 |
|------|------|------|
| correctness | Fail | account mutex는 추가됐지만 policy/kill switch snapshot이 mutex 대기 전에 만들어져 queued submit이 stale risk state로 broker에 도달할 수 있다. nil broker submit도 기본 halted kill switch 때문에 unavailable 대신 risk-blocked로 분류된다. |
| completeness | Fail | 같은 account submit 직렬화 자체는 구현됐지만 "broker 호출 전 현재 risk/kill switch guard"와 기존 unavailable contract 보장이 완료되지 않았다. |
| test coverage | Fail | concurrent max daily/open tests는 통과하지만, account mutex 대기 중 kill switch/policy 변경과 nil broker 기본 kill switch 상태를 검증하는 테스트가 없다. |
| API contract | Fail | `NewService(nil)`의 order operation은 unavailable이어야 한다는 service contract/comment와 기존 typed unavailable surface가 기본 상태에서 깨진다. |
| code quality | Pass | account별 mutex 구조와 기존 count-limit tests는 좁게 구현되어 있으며 불필요한 전역 lock은 없다. |
| plan deviation | Fail | 계획의 broker 전 risk guard 보장은 "현재" policy/kill switch 기준이어야 하지만 대기 중 변경된 guard를 반영하지 못한다. |
| verification trust | Pass | reviewer focused rerun은 기록된 concurrent tests를 재현해 통과했으며, 실패는 미검증 timing/contract 경로에서 소스 대조로 확인됐다. |
### 발견된 문제
- Required: `services/worker/internal/livetrading/service.go:211`에서 `policy`와 `ks`를 복사한 뒤 `services/worker/internal/livetrading/service.go:218`의 account mutex를 기다린다. 첫 submit이 broker 안에서 account mutex를 잡고 있는 동안 두 번째 submit이 stale `ks.Halted=false`를 복사하고 대기하면, 그 사이 운영자가 kill switch를 `halted=true`로 바꿔도 두 번째 submit은 lock 획득 후 `services/worker/internal/livetrading/service.go:227`에서 stale state로 risk를 통과해 broker까지 갈 수 있다. Fix: account mutex를 획득한 뒤, usage 계산과 `EvaluateRisk` 직전에 `policyMu`로 현재 policy/kill switch를 다시 읽는다. blocking fake broker test를 추가해 두 번째 submit이 account mutex에서 대기 중일 때 `SetKillSwitch(Halted: true)` 또는 더 엄격한 policy를 적용하고, broker call count가 1이며 두 번째 submit이 `ErrRiskBlocked` + rejected order가 되는지 검증한다.
- Required: `services/worker/internal/livetrading/service.go:227`의 risk evaluation이 `services/worker/internal/livetrading/service.go:231`의 nil broker check보다 먼저 실행된다. `NewService(nil)`은 기본 kill switch가 halted이므로 `SubmitLiveOrder`가 `ErrBrokerUnavailable` 대신 `ErrRiskBlocked`와 rejected order를 반환할 수 있어, `services/worker/internal/livetrading/service.go:81`의 nil broker/unavailable contract와 worker/API typed unavailable surface를 깨뜨린다. Fix: validation 직후 broker nil을 먼저 검사해 `ErrBrokerUnavailable`을 반환하고, `TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch`처럼 기본 kill switch 상태에서도 unavailable이 우선되는 테스트를 추가한다.
### 다음 단계
FAIL follow-up: 같은 `m-live-trading-boundary/03+01,02_risk_kill_switch` task에 `PLAN-cloud-G07.md`와 `CODE_REVIEW-cloud-G07.md`를 다시 작성해 queued submit의 current risk state 재평가와 nil broker unavailable precedence를 보완한다.

224
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/code_review_cloud_G07_3.log Normal file
View file

@ -0,0 +1,224 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=3 tag=REVIEW_REVIEW_REVIEW_LIVE_RISK -->
# Code Review Reference - REVIEW_REVIEW_REVIEW_LIVE_RISK
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `구현 체크리스트`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked by a user-only decision, user-owned external environment prerequisite, or scope conflict, fill `사용자 리뷰 요청` with evidence and stop with active files in place; code-review decides whether to write `USER_REVIEW.md`. Evidence gaps that a follow-up agent can close by rerunning commands or collecting artifacts are normal follow-up issues, not user-review blockers by themselves.
> Do not ask the user directly, present choices in chat, or call `request_user_input` during implementation; record the needed decision in `사용자 리뷰 요청` and stop for code-review.
> Finalization (`코드리뷰 결과`, log rename, `complete.log`, archive moves, `코드리뷰 전용 체크리스트`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.
## 개요
date=2026-06-07
task=m-live-trading-boundary/03+01,02_risk_kill_switch, plan=3, tag=REVIEW_REVIEW_REVIEW_LIVE_RISK
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 이 파일을 읽는 리뷰 에이전트에게
> **[REVIEW AGENT ONLY]** 아래 종결 절차는 코드리뷰 에이전트 전용이다. 구현 에이전트는 이 섹션을 실행하지 않는다.
각 항목의 구현을 실제 소스 파일과 대조하고, `검증 결과` 섹션의 출력이 코드와 일치하는지 확인하세요.
리뷰 완료는 아래 순서까지 끝난 상태를 의미합니다.
1. 판정을 append한다.
2. `CODE_REVIEW-cloud-G07.md` -> `code_review_cloud_G07_N.log`, `PLAN-cloud-G07.md` -> `plan_cloud_G07_M.log`로 아카이브한다.
3. PASS이면 `complete.log` 작성 후 active task 디렉터리를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동한다. WARN/FAIL이면 user-review gate를 확인한 뒤 다음 active plan/review 파일 또는 `USER_REVIEW.md`를 작성한다. `USER_REVIEW.md`가 사용자 결정으로 완료/PASS 해소되면 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log` 작성 후 archive 이동한다.
4. PASS이고 task group이 `m-<milestone-slug>`이면 완료 이벤트 메타데이터를 보고한다. roadmap 상태 체크와 `update-roadmap` 호출은 런타임 책임이다.
5. 적용 가능한 `코드리뷰 전용 체크리스트` 항목을 최종 `.log` 위치에서 체크한 뒤 보고한다.
---
## 구현 항목별 완료 여부
| 항목 | 완료 여부 |
|------|---------|
| [REVIEW_REVIEW_REVIEW_LIVE_RISK-1] account mutex 대기 후 현재 policy/kill switch로 risk를 평가하게 한다. | [x] |
| [REVIEW_REVIEW_REVIEW_LIVE_RISK-2] nil broker submit은 기본 kill switch 상태에서도 `ErrBrokerUnavailable`을 우선 반환하게 한다. | [x] |
## 구현 체크리스트
- [x] [REVIEW_REVIEW_REVIEW_LIVE_RISK-1] account mutex 대기 후 현재 policy/kill switch로 risk를 평가하게 한다.
- [x] [REVIEW_REVIEW_REVIEW_LIVE_RISK-2] nil broker submit은 기본 kill switch 상태에서도 `ErrBrokerUnavailable`을 우선 반환하게 한다.
- [x] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
## 코드리뷰 전용 체크리스트
> **[REVIEW AGENT ONLY]** 이 체크리스트는 코드리뷰 에이전트만 사용한다.
> 구현 에이전트는 이 섹션을 수정하거나 체크하지 않는다.
- [x] `코드리뷰 결과`에 `PASS`, `WARN`, `FAIL` 중 하나의 판정을 append한다.
- [x] 판정과 `차원별 평가`, Required/Suggested/Nit 분류가 서로 일치한다.
- [x] active `CODE_REVIEW-*-G??.md`를 `code_review_cloud_G07_N.log`로 아카이브한다.
- [x] active `PLAN-*-G??.md`를 `plan_cloud_G07_M.log`로 아카이브한다.
- [x] `.gitignore`의 Agent-Ops 관리 block이 `agent-task/**/*.md`와 `agent-task/**/*.log`를 unignore하고 `agent-roadmap/current.md`를 ignore하는지 확인한다.
- [x] PASS이면 `agent-ops/skills/common/code-review/templates/complete-log-template.md` 기준으로 `complete.log`를 작성하고 active `.md` 파일을 남기지 않는다.
- [x] PASS이면 active task 디렉터리 `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/`를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동하고 최종 archive 경로에서 이 체크리스트를 갱신한다.
- [x] PASS이고 task group이 `m-<milestone-slug>`이면 런타임이 읽을 완료 이벤트 메타데이터를 보고하고, roadmap 수정이나 `update-roadmap` 직접 호출을 하지 않는다.
- [x] PASS split 작업이면 이동 후 빈 active parent `agent-task/m-live-trading-boundary/`를 제거하거나, 남은 sibling/file이 있어 유지했다고 확인한다.
- [ ] WARN/FAIL이고 user-review gate가 트리거되지 않았으면 다음 active `PLAN-{build_lane}-GNN.md`와 `CODE_REVIEW-{review_lane}-GNN.md`를 작성하고 `complete.log`를 작성하지 않는다.
- [ ] USER_REVIEW이면 `agent-ops/skills/common/code-review/templates/user-review-template.md` 기준으로 `USER_REVIEW.md`를 작성하고 active `PLAN-*.md`, `CODE_REVIEW-*.md`, `complete.log`를 남기지 않는다.
- [ ] USER_REVIEW가 사용자 결정으로 완료/PASS 해소되면 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log`를 작성한 뒤 task directory를 archive로 이동한다.
## 계획 대비 변경 사항
없음. 플랜의 Before/After 코드 그대로 구현했다.
## 주요 설계 결정
**[1] policy/ks snapshot을 account mutex 획득 후로 이동**
`SubmitLiveOrder`에서 `policyMu.RLock()` 블록을 `acctMu.Lock()` 뒤로 이동했다. 이로써 같은 account의 두 번째 submit이 account mutex를 기다리는 동안 kill switch나 policy가 변경되면, 대기가 끝난 후 최신 상태로 risk를 평가한다. 기존 코드는 mutex 획득 전에 stale snapshot을 복사해 대기 중 상태 변경을 무시했다.
**[2] nil broker check를 validation 직후로 이동**
`s.broker == nil` 검사를 request validation(confirmation/accountID/intent) 직후, account mutex 획득과 risk evaluation 전으로 이동했다. `NewService(nil)`의 기본 kill switch(halted=true) 상태에서도 `ErrRiskBlocked` 대신 `ErrBrokerUnavailable`을 반환하고 rejected order record를 만들지 않는다. nil broker mode의 unavailable contract가 kill switch 상태에 무관하게 유지된다.
**테스트 추가**
- `TestSubmitLiveOrderQueuedKillSwitchBlocksBeforeBroker`: 첫 submit이 blocking broker 안에 있을 때 kill switch를 halted로 변경 후 release. 두 번째 submit이 `ErrRiskBlocked` + `rejection_reason="operator halt"`인지 확인한다. `time.Sleep(time.Millisecond)`로 두 번째 goroutine이 account mutex에 도달할 시간을 확보한다.
- `TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch`: kill switch를 변경하지 않은 `NewService(nil)`에서 submit이 `ErrBrokerUnavailable`을 반환하고 `ErrRiskBlocked`가 아님을 확인한다.
## 사용자 리뷰 요청
_기본값은 `없음`이다. 구현 중 사용자 결정, 사용자 소유 외부 환경/secret/서비스 준비, 또는 계획 범위 변경 없이는 안전하게 진행할 수 없으면 아래 항목을 실제 내용으로 교체하고, 구현을 중단한 뒤 active 파일을 그대로 둔 채 리뷰를 요청한다. 구현 에이전트는 사용자에게 직접 질문하거나 선택지를 제시하거나 `request_user_input`을 호출하지 않는다. 후속 에이전트가 명령 재실행이나 산출물 수집으로 해소할 수 있는 검증 증거 공백만으로는 사용자 리뷰 요청을 작성하지 않는다._
- 상태: 없음
- 사유 유형: 없음
- 결정 필요: 없음
- 차단 근거: 없음
- 실행한 검증/명령: 없음
- 자동 후속 불가 이유: 없음
- 재개 조건: 없음
## 리뷰어를 위한 체크포인트
- `SubmitLiveOrder`가 account mutex를 획득한 뒤 현재 `policy`/`killSwitch`를 읽는지 확인한다.
- 첫 submit이 blocking broker 안에 있는 동안 queued submit이 stale unhalted state로 broker에 도달하지 못하는지 확인한다.
- `NewService(nil)`의 기본 halted kill switch 상태에서도 submit이 `ErrBrokerUnavailable`을 우선 반환하고 rejected order를 만들지 않는지 확인한다.
- 기존 concurrent max daily/open tests와 risk rejected order tests가 계속 통과하는지 확인한다.
- Verification output이 실제 stdout/stderr이고 `bin/lint`의 기존 Mattermost info와 새 위반을 구분했는지 확인한다.
## 검증 결과
_구현 에이전트가 각 중간 검증 및 최종 검증 명령 실행 후 출력을 여기에 붙여 넣는다._
필수 규칙:
- 검증 명령은 고정된 계약이다. 임의로 대체하지 않는다.
- 대체가 필요하면 `계획 대비 변경 사항`에 이유와 대체 명령을 기록한다.
- `검증 결과`에는 실제 stdout/stderr를 붙여 넣는다.
- 사용자 리뷰 요청으로 명령을 끝까지 실행하지 못했다면 `사용자 리뷰 요청`에 실행한 명령, 실제 출력, 미실행 명령의 사유를 기록한다.
- mobile/UI hang, timeout, 또는 2분 무진행은 blind retry를 중단하고 focused rerun 명령과 screenshot/window/UI-tree evidence path를 남기며, 불가능하면 정확한 사유를 남긴다.
### REVIEW_REVIEW_REVIEW_LIVE_RISK-1 중간 검증
```text
$ go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrder(QueuedKillSwitchBlocksBeforeBroker|Concurrent(MaxOpenOrders|MaxDailyOrders))' -count=1 -v
=== RUN TestSubmitLiveOrderConcurrentMaxOpenOrdersBlocksBeforeBroker
--- PASS: TestSubmitLiveOrderConcurrentMaxOpenOrdersBlocksBeforeBroker (0.00s)
=== RUN TestSubmitLiveOrderConcurrentMaxDailyOrdersBlocksBeforeBroker
--- PASS: TestSubmitLiveOrderConcurrentMaxDailyOrdersBlocksBeforeBroker (0.00s)
=== RUN TestSubmitLiveOrderQueuedKillSwitchBlocksBeforeBroker
--- PASS: TestSubmitLiveOrderQueuedKillSwitchBlocksBeforeBroker (0.00s)
PASS
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.004s
```
### REVIEW_REVIEW_REVIEW_LIVE_RISK-2 중간 검증
```text
$ go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch|TestSubmitLiveOrderBrokerUnavailable' -count=1 -v
=== RUN TestSubmitLiveOrderBrokerUnavailable
--- PASS: TestSubmitLiveOrderBrokerUnavailable (0.00s)
=== RUN TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch
--- PASS: TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch (0.00s)
PASS
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.002s
```
### 최종 검증
```text
$ gofmt -l services/worker/internal/livetrading/service.go services/worker/internal/livetrading/service_test.go
(empty — all files are formatted)
$ go test ./services/worker/internal/livetrading
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.004s
$ go test ./services/worker/...
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker (cached)
? git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-data-check [no test files]
ok git.toki-labs.com/toki/alt/services/worker/cmd/alt-worker-migrate (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/backtest (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/config (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/contracts (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/jobs (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/livetrading 0.004s
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/datacheck (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/marketdata/importer (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/papertrading (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/providers/kis (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/rediskeys (cached)
ok git.toki-labs.com/toki/alt/services/worker/internal/socket (cached)
? git.toki-labs.com/toki/alt/services/worker/internal/storage [no test files]
ok git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres (cached)
? git.toki-labs.com/toki/alt/services/worker/internal/storage/postgres/sqlc [no test files]
$ bin/lint
Analyzing client...
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:27:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:35:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:41:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:44:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:51:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:55:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:101:5 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:123:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:132:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:134:9 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:137:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:154:7 • avoid_print
info • Don't invoke 'print' in production code • lib/src/integrations/mattermost/mattermost_auth_service.dart:156:7 • avoid_print
13 issues found. (ran in 2.8s)
(exit 0 — 13개 모두 기존 Mattermost avoid_print info, 새 위반 없음)
```
---
> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section: completion table, implementation checklist, changes from plan, design decisions, and verification output?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.
## 코드리뷰 결과
### 종합 판정
PASS
### 차원별 평가
| 차원 | 평가 | 근거 |
|------|------|------|
| correctness | Pass | `SubmitLiveOrder`가 validation 직후 nil broker를 먼저 반환하고, account mutex 획득 후 최신 policy/kill switch snapshot으로 risk를 평가한다. queued submit stale state와 nil broker precedence Required가 모두 닫혔다. |
| completeness | Pass | 계획의 두 구현 항목과 구현 에이전트 소유 review stub 항목이 모두 완료됐고, source/test가 checklist와 일치한다. |
| test coverage | Pass | queued kill switch, concurrent max open/daily, nil broker default kill switch precedence 테스트가 추가됐으며 관련 기존 테스트도 유지된다. |
| API contract | Pass | nil broker는 `ErrBrokerUnavailable` 우선 contract를 유지하고, risk-blocked submit은 rejected order와 `LiveRiskDecision` surface를 보존한다. |
| code quality | Pass | account별 submit mutex는 같은 account submit만 직렬화하고, risk usage/order storage lock 경계가 기존 service 책임 안에 좁게 유지된다. debug print나 dead code는 확인되지 않았다. |
| plan deviation | Pass | active plan의 수정 범위인 worker live trading service와 tests에 맞게 구현됐고, 추가 변경 사유도 계획 범위와 충돌하지 않는다. |
| verification trust | Pass | reviewer가 고정 검증을 재실행했고 `gofmt -l`, focused tests, worker package tests, worker module tests, `bin/lint`, 추가 `-race` focused check가 모두 exit code 0이었다. |
### 발견된 문제
없음
### 다음 단계
PASS: `complete.log`를 작성하고 active task 디렉터리를 `agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동한다. `m-live-trading-boundary` 완료 이벤트 메타데이터를 보고하되 roadmap 수정은 런타임 책임으로 남긴다.

50
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/complete.log Normal file
View file

@ -0,0 +1,50 @@
# Complete - m-live-trading-boundary/03+01,02_risk_kill_switch
## 완료 일시
2026-06-07
## 요약
live trading risk limit/kill switch boundary task completed after 4 review loops; final verdict PASS.
## 루프 이력
| Plan | Review | Verdict | 메모 |
|------|--------|---------|------|
| `plan_cloud_G06_0.log` | `code_review_cloud_G06_0.log` | FAIL | max daily/open guard, risk rejected order/decision surface, Dart parser map drift 보완 필요 |
| `plan_cloud_G07_1.log` | `code_review_cloud_G07_1.log` | FAIL | same-account concurrent submit이 broker 전 count limit을 원자적으로 보장하지 못함 |
| `plan_cloud_G07_2.log` | `code_review_cloud_G07_2.log` | FAIL | account mutex 대기 전 stale risk snapshot과 nil broker unavailable precedence 보완 필요 |
| `plan_cloud_G07_3.log` | `code_review_cloud_G07_3.log` | PASS | queued submit이 최신 risk state를 보고 nil broker가 risk보다 먼저 unavailable을 반환함 |
## 구현/정리 내용
- live trading risk policy, default halted kill switch, broker 전 risk evaluation, rejected order + `LiveRiskDecision` response surface를 추가했다.
- worker/API/CLI/client contract parser and operator output surface를 live risk/kill switch 메시지에 맞춰 정렬했다.
- same-account submit을 account별 mutex로 직렬화해 risk usage 계산부터 broker result 저장까지 count-limit race를 막았다.
- account mutex 대기 후 최신 policy/kill switch를 snapshot하도록 조정하고, nil broker check를 validation 직후로 이동해 unavailable contract를 유지했다.
## 최종 검증
- `gofmt -l services/worker/internal/livetrading/service.go services/worker/internal/livetrading/service_test.go` - PASS; output empty
- `go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrder(QueuedKillSwitchBlocksBeforeBroker|Concurrent(MaxOpenOrders|MaxDailyOrders))' -count=1 -v` - PASS; queued kill switch and concurrent max open/daily tests passed
- `go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch|TestSubmitLiveOrderBrokerUnavailable' -count=1 -v` - PASS; nil broker unavailable precedence tests passed
- `go test ./services/worker/internal/livetrading` - PASS; package tests passed
- `go test ./services/worker/...` - PASS; worker module tests passed
- `bin/lint` - PASS; exit code 0 with existing Mattermost `avoid_print` info only
- `go test -race ./services/worker/internal/livetrading -run 'TestSubmitLiveOrder(QueuedKillSwitchBlocksBeforeBroker|Concurrent(MaxOpenOrders|MaxDailyOrders)|BrokerUnavailableWithDefaultKillSwitch)' -count=1` - PASS; focused race check passed
## Roadmap Completion
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Completed task ids:
- `risk-limits`: PASS; evidence=`plan_cloud_G07_3.log`, `code_review_cloud_G07_3.log`; verification=`go test ./services/worker/internal/livetrading`, `go test ./services/worker/...`, `bin/lint`
- Not completed task ids: 없음
## 잔여 Nit
- 없음
## 후속 작업
- 없음

0
agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/PLAN-cloud-G06.md → agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/plan_cloud_G06_0.log
View file

346
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/plan_cloud_G07_1.log Normal file
View file

@ -0,0 +1,346 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=1 tag=REVIEW_LIVE_RISK -->
# Plan - REVIEW_LIVE_RISK
## 이 파일을 읽는 구현 에이전트에게
`CODE_REVIEW-*-G??.md`의 구현 에이전트 소유 섹션을 채우는 것은 필수다. 구현 후 검증을 실행하고 실제 변경 내용, 설계 결정, 명령 출력(stdout/stderr)을 기록한 뒤 active 파일을 그대로 두고 리뷰 준비를 보고한다. 최종 판정, 로그 rename, `complete.log`, archive 이동은 code-review 전용이다.
구현 중 사용자만 결정할 수 있는 사항, 사용자 소유 외부 환경/secret, 또는 계획 범위 충돌 없이는 안전하게 진행할 수 없으면 active review stub의 `사용자 리뷰 요청` 섹션에 정확한 결정, 근거, 실행 명령/출력, 재개 조건을 기록하고 중단한다. 구현 에이전트는 사용자에게 직접 묻거나 선택지를 제시하거나 `request_user_input`을 호출하지 않는다. 후속 에이전트가 명령 재실행이나 산출물 수집으로 해소할 수 있는 검증 증거 공백은 사용자 리뷰 요청이 아니다.
## 배경
첫 리뷰에서 live risk policy가 kill switch/notional만 막고 `MaxDailyOrders`와 `MaxOpenOrders`를 실제 submit guard로 쓰지 않는 것이 확인됐다. 또한 risk denial이 rejected/blocked order record와 `LiveRiskDecision` surface 없이 typed error만 반환해 headless 운영자가 차단 주문 근거를 안정적으로 볼 수 없다. `.proto` 확장으로 Dart generated output은 생겼지만 Flutter `altParserMap`도 새 live risk/kill switch messages를 등록하지 못한다.
## 사용자 리뷰 요청 흐름
구현 중 차단은 active `CODE_REVIEW-*-G??.md`의 `사용자 리뷰 요청` 섹션에 기록한다. 이 섹션은 `agent-ops/skills/common/_templates/implementation-user-review-request-section.md` 형식을 따른다. 구현 중 직접 사용자 프롬프트는 금지이며, code-review가 요청의 타당성을 검증하고 실제 `USER_REVIEW.md` 작성을 소유한다.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 분석 결과
### 읽은 파일
- `agent-ops/rules/project/rules.md`
- `agent-ops/rules/private/rules.md`
- `agent-ops/rules/common/rules-roadmap.md`
- `agent-roadmap/current.md`
- `agent-ops/skills/common/router.md`
- `agent-ops/skills/common/code-review/SKILL.md`
- `agent-ops/skills/common/plan/SKILL.md`
- `agent-ops/skills/common/_templates/implementation-user-review-request-section.md`
- `agent-ops/rules/project/domain/domain-model/rules.md`
- `agent-ops/rules/project/domain/contracts/rules.md`
- `agent-ops/rules/project/domain/worker/rules.md`
- `agent-ops/rules/project/domain/api/rules.md`
- `agent-ops/rules/project/domain/operations/rules.md`
- `agent-ops/rules/project/domain/client/rules.md`
- `agent-test/local/rules.md`
- `agent-test/local/domain-model-smoke.md`
- `agent-test/local/contracts-smoke.md`
- `agent-test/local/worker-smoke.md`
- `agent-test/local/api-smoke.md`
- `agent-test/local/operations-smoke.md`
- `agent-test/local/client-smoke.md`
- `agent-task/archive/2026/06/m-live-trading-boundary/01_broker_port/complete.log`
- `agent-task/archive/2026/06/m-live-trading-boundary/02+01_order_lifecycle/complete.log`
- `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/plan_cloud_G06_0.log`
- `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/code_review_cloud_G06_0.log`
- `packages/domain/trading/risk.go`
- `packages/domain/trading/risk_test.go`
- `packages/domain/trading/types.go`
- `services/worker/internal/livetrading/config.go`
- `services/worker/internal/livetrading/service.go`
- `services/worker/internal/livetrading/service_test.go`
- `services/worker/internal/socket/live.go`
- `services/worker/internal/socket/live_mapping.go`
- `services/worker/internal/socket/live_test.go`
- `services/worker/internal/contracts/parser_map.go`
- `packages/contracts/proto/alt/v1/live_trading.proto`
- `packages/contracts/gen/go/alt/v1/live_trading.pb.go`
- `services/api/internal/socket/live.go`
- `services/api/internal/socket/live_test.go`
- `services/api/internal/workerclient/client.go`
- `services/api/internal/contracts/parser_map.go`
- `services/api/internal/socket/backtest_test.go`
- `apps/cli/internal/operator/scenario.go`
- `apps/cli/internal/operator/runner.go`
- `apps/cli/internal/operator/output.go`
- `apps/cli/internal/operator/client.go`
- `apps/cli/internal/operator/client_test.go`
- `apps/cli/internal/operator/runner_live_test.go`
- `apps/cli/internal/operator/parser_map.go`
- `apps/cli/testdata/operator/live_risk_kill_switch.yaml`
- `apps/cli/testdata/operator/expected/live_risk_kill_switch.jsonl`
- `apps/cli/testdata/operator/headless_validation.md`
- `apps/client/lib/src/contracts/alt_contracts.dart`
- `apps/client/test/contracts/alt_contracts_test.dart`
- `apps/client/lib/src/generated/alt/v1/live_trading.pb.dart`
- `apps/client/lib/src/generated/alt/v1/live_trading.pbjson.dart`
### 테스트 환경 규칙
`test_env=local`이다. 적용 profile은 domain-model, contracts, worker, api, operations, client smoke다. 관련 명령은 `bin/contracts-gen`, `bin/contracts-check`, `go test ./packages/domain/...`, `go test ./packages/contracts/gen/go/...`, `go test ./services/worker/...`, `go test ./services/api/...`, `go test ./apps/cli/...`, `cd apps/client && flutter test test/contracts/alt_contracts_test.dart`, `bin/lint`다. 리뷰 중 focused rerun으로 `bin/contracts-check`, domain/worker/API/CLI/client focused tests, `gofmt -l`을 실행했고 `gofmt` drift는 수정했다.
### 테스트 커버리지 공백
- `MaxDailyOrders`와 `MaxOpenOrders`가 broker call 전 차단되는 테스트가 없다.
- Risk denial이 rejected/blocked live order record와 reason/decision을 반환하는 worker/API/CLI 테스트가 없다.
- Flutter `altParserMap`이 새 live risk/kill switch generated messages를 포함하는 테스트가 없다.
### 심볼 참조
Renamed/removed symbols: none. Follow-up은 additive proto/schema/domain changes와 call-site rollout이다.
### 분할 판단
공통 task group은 `m-live-trading-boundary`이고 현재 subtask는 `03+01,02_risk_kill_switch`다. predecessor `01`과 `02`는 `agent-task/archive/2026/06/m-live-trading-boundary/01_broker_port/complete.log`, `agent-task/archive/2026/06/m-live-trading-boundary/02+01_order_lifecycle/complete.log`로 충족됐다. 이번 follow-up은 첫 루프의 Required 보완만 다루므로 같은 subtask 안에서 plan=1로 이어간다.
### 범위 결정 근거
Account sync와 durable audit trail은 sibling subtask 범위이므로 수정하지 않는다. 새 broker adapter network integration이나 실제 외부 주문 smoke는 추가하지 않는다. Risk policy 수치 자체는 기본값을 유지하고, 수치 조정 UI는 만들지 않는다.
### 빌드 등급
Build lane `cloud-G07`, review lane `cloud-G07`. 실거래 제출 차단, protobuf schema/generated output, API/CLI/client parser contract가 함께 걸린 첫 리뷰 FAIL 보완이므로 cloud에서 큰 문맥을 유지한다.
## 의존 관계 및 구현 순서
Directory dependency source of truth: `03+01,02_risk_kill_switch` depends on predecessor indices `01` and `02`; 둘 다 archive `complete.log`로 충족됐다. 구현 순서는 risk count guard -> risk decision contract/CLI rollout -> Flutter parser map -> verification이다.
## 구현 체크리스트
- [ ] [REVIEW_LIVE_RISK-1] max daily/open live order limits를 submit guard에 적용한다.
- [ ] [REVIEW_LIVE_RISK-2] risk denial을 rejected/blocked order record와 `LiveRiskDecision` contract/CLI evidence로 남긴다.
- [ ] [REVIEW_LIVE_RISK-3] Flutter contract parser map과 contract test에 live risk/kill switch messages를 등록한다.
- [ ] [REVIEW_LIVE_RISK-4] focused verification과 affected module tests를 실행한다.
- [ ] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
### [REVIEW_LIVE_RISK-1] Order Count Risk Guard
#### 문제
`services/worker/internal/livetrading/config.go:17`은 `MaxDailyOrders=5`, `MaxOpenOrders=3`을 기본값으로 노출하지만 `services/worker/internal/livetrading/service.go:199`은 `trading.EvaluateRisk`만 호출한다. `packages/domain/trading/risk.go:61`은 kill switch, short selling, notional만 평가하므로 주문 수 제한이 broker call 전에 적용되지 않는다.
#### 해결 방법
`packages/domain/trading/risk.go`에 usage context를 추가하고 daily/open count를 평가한다. `SubmitLiveOrder`는 `s.mu` 아래에서 account별 same UTC day order count와 non-terminal open order count를 계산해 risk evaluation에 전달한다. Terminal status는 `filled`, `canceled`, `rejected`로 보고, 그 외 live status는 open으로 취급한다.
Before:
```go
// services/worker/internal/livetrading/service.go:194
policy := s.policy
ks := s.killSwitch
...
if decision := trading.EvaluateRisk(policy, ks, req.Intent); !decision.Allowed {
return LiveOrder{}, fmt.Errorf("%w: %s", ErrRiskBlocked, decision.Reason)
}
```
After:
```go
usage := s.riskUsageForAccount(req.AccountID, time.Now().UTC())
decision := trading.EvaluateRisk(policy, ks, req.Intent, usage)
if !decision.Allowed {
return s.recordRiskRejectedOrder(req, decision)
}
```
#### 수정 파일 및 체크리스트
- [ ] `packages/domain/trading/risk.go`에 `RiskUsage` 또는 동등한 context type과 count-limit evaluation을 추가한다.
- [ ] `packages/domain/trading/risk_test.go`에 daily/open count boundary tests를 추가한다.
- [ ] `services/worker/internal/livetrading/service.go`에 account별 usage 계산과 terminal status helper를 추가한다.
- [ ] `services/worker/internal/livetrading/service_test.go`에 `TestSubmitLiveOrderMaxDailyOrdersBlocksBeforeBroker`, `TestSubmitLiveOrderMaxOpenOrdersBlocksBeforeBroker`를 추가한다.
#### 테스트 작성
작성한다. 한도 직전은 broker 호출 허용, 한도 도달/초과는 broker 호출 전 차단을 검증한다. Rejected risk order는 open count에 포함되지 않는 것도 검증한다.
#### 중간 검증
```bash
go test ./packages/domain/... ./services/worker/internal/livetrading
```
기대 결과: exit code 0.
### [REVIEW_LIVE_RISK-2] Risk Decision Contract And Output
#### 문제
`services/worker/internal/livetrading/service.go:199`은 risk denial을 `LiveOrder{}` + error로 반환하므로 계획의 rejected/blocked order 저장이 없다. `packages/contracts/proto/alt/v1/live_trading.proto:137`의 `SubmitLiveOrderResponse`는 `order`/`error`만 있고 계획의 `LiveRiskDecision`이 없다. CLI도 live submit risk denial을 stable risk fields로 출력하지 못한다.
#### 해결 방법
Additive protobuf change로 `LiveRiskDecision`을 추가하고 `SubmitLiveOrderResponse`에 새 field number로 연결한다. Risk denial 시 worker는 broker를 호출하지 않고 in-memory live order를 `rejected` 상태로 저장하며 `RejectionReason`과 denied decision을 response에 담는다. 기존 typed error vocabulary는 유지하되, response에 rejected order와 decision도 함께 싣도록 API/CLI tests를 명시적으로 맞춘다.
Before:
```proto
// packages/contracts/proto/alt/v1/live_trading.proto:137
message SubmitLiveOrderResponse {
LiveOrder order = 1;
ErrorInfo error = 2;
}
```
After:
```proto
message LiveRiskDecision {
bool allowed = 1;
string reason = 2;
}
message SubmitLiveOrderResponse {
LiveOrder order = 1;
ErrorInfo error = 2;
LiveRiskDecision risk_decision = 3;
}
```
#### 수정 파일 및 체크리스트
- [ ] `packages/contracts/proto/alt/v1/live_trading.proto`에 `LiveRiskDecision`과 response field를 추가한다.
- [ ] `bin/contracts-gen`으로 Go/Dart generated output을 갱신한다.
- [ ] worker/API/CLI parser maps에 `LiveRiskDecision`을 등록한다.
- [ ] `services/worker/internal/socket/live_mapping.go`에 risk decision mapping을 추가한다.
- [ ] `services/worker/internal/socket/live.go`와 tests에 risk blocked response order/decision/error를 검증한다.
- [ ] `services/api/internal/socket/live.go`와 tests가 worker response의 order/decision/error를 그대로 forward하는지 검증한다.
- [ ] `apps/cli/internal/operator/runner.go`, `output.go`, `runner_live_test.go`, `live_risk_kill_switch.yaml`, expected JSONL에 risk-blocked submit evidence를 추가한다.
#### 테스트 작성
작성한다. Worker service, worker socket, API forwarder, CLI scenario tests가 broker-not-called, rejected order status, rejection reason, denied risk decision, expected typed error output을 검증해야 한다.
#### 중간 검증
```bash
bin/contracts-gen
bin/contracts-check
go test ./packages/contracts/gen/go/... ./services/worker/internal/livetrading ./services/worker/internal/socket ./services/api/internal/socket ./apps/cli/internal/operator
```
기대 결과: exit code 0.
### [REVIEW_LIVE_RISK-3] Flutter Parser Map
#### 문제
`apps/client/lib/src/generated/alt/v1/live_trading.pb.dart:1618`에 새 live risk/kill switch classes가 생겼지만 `apps/client/lib/src/contracts/alt_contracts.dart:59`의 parser map은 기존 live order lifecycle messages까지만 등록한다. `apps/client/test/contracts/alt_contracts_test.dart:16`도 old set과 `parsers.length == 33`만 검증한다.
#### 해결 방법
`altParserMap`에 `GetLiveRiskPolicyRequest/Response`, `LiveRiskPolicy`, `GetLiveKillSwitchRequest/Response`, `SetLiveKillSwitchRequest/Response`, `LiveKillSwitchState`, `LiveRiskDecision`을 추가한다. Contract test expected list와 parser count를 새 map 크기에 맞춘다.
#### 수정 파일 및 체크리스트
- [ ] `apps/client/lib/src/contracts/alt_contracts.dart`에 새 live risk/kill switch parser entries를 추가한다.
- [ ] `apps/client/test/contracts/alt_contracts_test.dart`에 새 messages와 expected parser count를 추가한다.
#### 테스트 작성
작성한다. 기존 round-trip parser test가 새 messages를 모두 순회하도록 확장한다.
#### 중간 검증
```bash
cd apps/client && flutter test test/contracts/alt_contracts_test.dart
```
기대 결과: exit code 0.
### [REVIEW_LIVE_RISK-4] Verification
#### 문제
첫 루프 검증은 Go focused tests와 `bin/lint`를 기록했지만, client parser map 신메시지 coverage와 risk denial decision evidence를 검증하지 못했다.
#### 해결 방법
affected module과 generated drift checks를 다시 실행하고 실제 stdout/stderr를 review stub에 남긴다.
#### 수정 파일 및 체크리스트
- [ ] `bin/contracts-check`를 실행한다.
- [ ] `go test ./packages/domain/...`를 실행한다.
- [ ] `go test ./packages/contracts/gen/go/...`를 실행한다.
- [ ] `go test ./services/worker/...`를 실행한다.
- [ ] `go test ./services/api/...`를 실행한다.
- [ ] `go test ./apps/cli/...`를 실행한다.
- [ ] `cd apps/client && flutter test test/contracts/alt_contracts_test.dart`를 실행한다.
- [ ] `bin/lint`를 실행한다.
- [ ] `gofmt -l <changed-go-files>` 결과가 비어 있는지 확인한다.
#### 테스트 작성
추가 테스트는 REVIEW_LIVE_RISK-1부터 REVIEW_LIVE_RISK-3에 포함한다.
#### 중간 검증
```bash
bin/contracts-check
go test ./packages/domain/...
go test ./packages/contracts/gen/go/...
go test ./services/worker/...
go test ./services/api/...
go test ./apps/cli/...
cd apps/client && flutter test test/contracts/alt_contracts_test.dart
bin/lint
```
기대 결과: 모두 exit code 0. `bin/lint`의 기존 Mattermost `avoid_print` info가 계속 나오면 기존 이슈로 기록하되 새 위반이 없어야 한다.
## 수정 파일 요약
| 파일 | 항목 |
|---|---|
| `packages/domain/trading/risk.go` | REVIEW_LIVE_RISK-1 |
| `packages/domain/trading/risk_test.go` | REVIEW_LIVE_RISK-1 |
| `services/worker/internal/livetrading/service.go` | REVIEW_LIVE_RISK-1, REVIEW_LIVE_RISK-2 |
| `services/worker/internal/livetrading/service_test.go` | REVIEW_LIVE_RISK-1, REVIEW_LIVE_RISK-2 |
| `packages/contracts/proto/alt/v1/live_trading.proto` | REVIEW_LIVE_RISK-2 |
| `packages/contracts/gen/go/alt/v1/live_trading.pb.go` | REVIEW_LIVE_RISK-2 |
| `apps/client/lib/src/generated/alt/v1/live_trading.pb.dart` | REVIEW_LIVE_RISK-2 |
| `apps/client/lib/src/generated/alt/v1/live_trading.pbjson.dart` | REVIEW_LIVE_RISK-2 |
| `services/worker/internal/contracts/parser_map.go` | REVIEW_LIVE_RISK-2 |
| `services/api/internal/contracts/parser_map.go` | REVIEW_LIVE_RISK-2 |
| `apps/cli/internal/operator/parser_map.go` | REVIEW_LIVE_RISK-2 |
| `services/worker/internal/socket/live.go` | REVIEW_LIVE_RISK-2 |
| `services/worker/internal/socket/live_mapping.go` | REVIEW_LIVE_RISK-2 |
| `services/worker/internal/socket/live_test.go` | REVIEW_LIVE_RISK-2 |
| `services/api/internal/socket/live.go` | REVIEW_LIVE_RISK-2 |
| `services/api/internal/socket/live_test.go` | REVIEW_LIVE_RISK-2 |
| `apps/cli/internal/operator/runner.go` | REVIEW_LIVE_RISK-2 |
| `apps/cli/internal/operator/output.go` | REVIEW_LIVE_RISK-2 |
| `apps/cli/internal/operator/runner_live_test.go` | REVIEW_LIVE_RISK-2 |
| `apps/cli/testdata/operator/live_risk_kill_switch.yaml` | REVIEW_LIVE_RISK-2 |
| `apps/cli/testdata/operator/expected/live_risk_kill_switch.jsonl` | REVIEW_LIVE_RISK-2 |
| `apps/client/lib/src/contracts/alt_contracts.dart` | REVIEW_LIVE_RISK-3 |
| `apps/client/test/contracts/alt_contracts_test.dart` | REVIEW_LIVE_RISK-3 |
## 최종 검증
```bash
bin/contracts-check
go test ./packages/domain/...
go test ./packages/contracts/gen/go/...
go test ./services/worker/...
go test ./services/api/...
go test ./apps/cli/...
cd apps/client && flutter test test/contracts/alt_contracts_test.dart
bin/lint
```
기대 결과: 모두 exit code 0. `bin/lint`의 기존 Mattermost `avoid_print` info가 계속 나오면 기존 이슈로 기록하고, 새 파일/변경 파일의 analyzer issue가 없어야 한다.
모든 코드 변경 완료 후 반드시 `CODE_REVIEW-*-G??.md`의 구현 에이전트 소유 섹션을 채운다. 이 파일 작성이 구현의 마지막 단계다.

150
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/plan_cloud_G07_2.log Normal file
View file

@ -0,0 +1,150 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=2 tag=REVIEW_REVIEW_LIVE_RISK -->
# Plan - REVIEW_REVIEW_LIVE_RISK
## 이 파일을 읽는 구현 에이전트에게
`CODE_REVIEW-*-G??.md`의 구현 에이전트 소유 섹션을 채우는 것은 필수다. 구현 후 검증을 실행하고 실제 변경 내용, 설계 결정, 명령 출력(stdout/stderr)을 기록한 뒤 active 파일을 그대로 두고 리뷰 준비를 보고한다. 최종 판정, 로그 rename, `complete.log`, archive 이동은 code-review 전용이다.
구현 중 사용자만 결정할 수 있는 사항, 사용자 소유 외부 환경/secret, 또는 계획 범위 충돌 없이는 안전하게 진행할 수 없으면 active review stub의 `사용자 리뷰 요청` 섹션에 정확한 결정, 근거, 실행 명령/출력, 재개 조건을 기록하고 중단한다. 구현 에이전트는 사용자에게 직접 묻거나 선택지를 제시하거나 `request_user_input`을 호출하지 않는다. 후속 에이전트가 명령 재실행이나 산출물 수집으로 해소할 수 있는 검증 증거 공백은 사용자 리뷰 요청이 아니다.
## 배경
G07 리뷰에서 `MaxDailyOrders`와 `MaxOpenOrders`가 순차 submit에는 적용되지만, concurrent submit에서는 `riskUsageForAccount` 조회와 broker 호출/order 저장 사이에 reservation이 없어 동일 account의 여러 요청이 같은 pre-submit count를 보고 broker까지 도달할 수 있음이 확인됐다. 이 follow-up은 기존 contract/API/CLI surface를 넓히지 않고 worker submit guard의 동시성 보장만 보완한다.
## 사용자 리뷰 요청 흐름
구현 중 차단은 active `CODE_REVIEW-*-G??.md`의 `사용자 리뷰 요청` 섹션에 기록한다. 구현 중 직접 사용자 프롬프트는 금지이며, code-review가 요청의 타당성을 검증하고 실제 `USER_REVIEW.md` 작성을 소유한다.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 분석 결과
### 읽은 파일
- `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/plan_cloud_G07_1.log`
- `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/code_review_cloud_G07_1.log`
- `services/worker/internal/livetrading/service.go`
- `services/worker/internal/livetrading/service_test.go`
- `packages/domain/trading/risk.go`
- `packages/domain/trading/types.go`
- `services/worker/internal/socket/live.go`
- `apps/cli/testdata/operator/expected/live_risk_kill_switch.jsonl`
### 테스트 환경 규칙
`test_env=local`이다. 적용 profile은 worker smoke를 중심으로, risk guard가 contract/CLI output을 건드리지 않았는지 확인하기 위해 contracts, API, operations, client focused checks를 유지한다.
### 테스트 커버리지 공백
- `MaxDailyOrders`와 `MaxOpenOrders` tests가 순차 호출만 검증한다.
- broker call이 지연된 상태에서 같은 account의 두 submit이 동시에 시작될 때, broker call count와 rejected order record를 검증하는 테스트가 없다.
### 범위 결정 근거
이번 follow-up은 worker submit path의 count-limit 동시성 보장만 다룬다. Protobuf schema, API/CLI action surface, Flutter parser map은 G07에서 추가됐고 reviewer 검증을 통과했으므로 변경하지 않는다. CLI fixture reason/documentation은 concurrent guard 구현 중 실제 output을 재확인해 필요하면 함께 정렬하되, 새 기능 범위로 확장하지 않는다.
### 빌드 등급
Build lane `cloud-G07`, review lane `cloud-G07`. live order submission과 risk guard의 동시성 safety를 다루므로 기존 cloud-G07 route를 유지한다.
## 구현 체크리스트
- [ ] [REVIEW_REVIEW_LIVE_RISK-1] same-account concurrent submit에서도 max daily/open live order guard가 broker 호출 전 원자적으로 적용되게 한다.
- [ ] [REVIEW_REVIEW_LIVE_RISK-2] focused verification과 affected module checks를 실행한다.
- [ ] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
### [REVIEW_REVIEW_LIVE_RISK-1] Atomic Risk Reservation
#### 문제
`services/worker/internal/livetrading/service.go:199`에서 usage를 읽은 뒤 lock을 해제하고, `service.go:212`에서 broker를 호출한 다음 `service.go:217` 이후에 order를 저장한다. 같은 account에서 두 submit이 동시에 들어오면 둘 다 기존 count만 보고 allowed가 되어 broker call까지 도달할 수 있다.
#### 해결 방법
같은 account의 submit risk evaluation과 order count 반영이 broker 호출 전후로 순서화되게 만든다. 구현 방식은 아래 중 하나를 선택하되, 테스트로 broker 전 한도 보장을 증명해야 한다.
- account별 submit mutex를 두고, 같은 account의 `SubmitLiveOrder`는 risk usage 계산부터 broker result 저장까지 직렬화한다.
- 또는 broker 호출 전에 `pending` 상태의 provisional live order를 in-memory registry에 원자적으로 reserve하고, broker result로 record를 갱신한다. broker error 시 provisional record 처리 정책도 테스트로 명확히 한다.
선호안은 account별 submit mutex다. 전체 `s.mu`를 broker 호출 동안 잡지 말고, account별 lock으로 같은 account submit만 직렬화해 cancel/get이나 다른 account submit의 불필요한 blocking을 줄인다.
#### 수정 파일 및 체크리스트
- [ ] `services/worker/internal/livetrading/service.go`에 account별 submit/risk serialization 또는 broker 전 reservation을 추가한다.
- [ ] 기존 `riskUsageForAccount` 호출과 `recordRiskRejectedOrder`가 새 locking 규칙에서 data race나 double lock 없이 동작하게 정리한다.
- [ ] `services/worker/internal/livetrading/service_test.go`에 concurrent max open order test를 추가한다.
- [ ] `services/worker/internal/livetrading/service_test.go`에 concurrent max daily order test를 추가한다.
- [ ] blocking fake broker를 사용해 한 요청이 broker 안에서 대기 중일 때 두 번째 요청이 broker에 도달하지 않는지 검증한다.
- [ ] `gofmt`를 실행한다.
#### 테스트 작성
작성한다. 최소 테스트:
- `TestSubmitLiveOrderConcurrentMaxOpenOrdersBlocksBeforeBroker`: `MaxOpenOrders=1`, `MaxDailyOrders=0`, kill switch off. 첫 submit이 fake broker 안에서 block된 동안 두 번째 submit을 시작한다. 첫 submit을 release한 뒤 broker call count가 1이고 두 번째 submit이 `ErrRiskBlocked` + rejected order가 되는지 확인한다.
- `TestSubmitLiveOrderConcurrentMaxDailyOrdersBlocksBeforeBroker`: `MaxDailyOrders=1`, `MaxOpenOrders=0`에서 동일한 보장을 확인한다.
#### 중간 검증
```bash
go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrderConcurrent(MaxOpenOrders|MaxDailyOrders)' -count=1
go test ./services/worker/internal/livetrading
```
기대 결과: exit code 0.
### [REVIEW_REVIEW_LIVE_RISK-2] Verification
#### 문제
동시성 보완은 worker submit path에 직접 닿는다. 기존 surface가 drift 나지 않았는지 affected checks를 다시 남겨야 한다.
#### 해결 방법
worker focused test와 affected module smoke를 실행하고 실제 stdout/stderr를 review stub에 붙인다.
#### 수정 파일 및 체크리스트
- [ ] `gofmt -l <changed-go-files>` 결과가 비어 있는지 확인한다.
- [ ] `bin/contracts-check`를 실행한다.
- [ ] `go test ./packages/domain/...`를 실행한다.
- [ ] `go test ./packages/contracts/gen/go/...`를 실행한다.
- [ ] `go test ./services/worker/...`를 실행한다.
- [ ] `go test ./services/api/...`를 실행한다.
- [ ] `go test ./apps/cli/...`를 실행한다.
- [ ] `cd apps/client && flutter test test/contracts/alt_contracts_test.dart`를 실행한다.
- [ ] `bin/lint`를 실행한다.
#### 테스트 작성
추가 테스트는 REVIEW_REVIEW_LIVE_RISK-1에 포함한다.
#### 중간 검증
```bash
gofmt -l packages/domain/trading/risk.go packages/domain/trading/risk_test.go services/worker/internal/livetrading/config.go services/worker/internal/livetrading/service.go services/worker/internal/livetrading/service_test.go services/worker/internal/socket/live.go services/worker/internal/socket/live_mapping.go services/worker/internal/socket/live_test.go services/worker/internal/contracts/parser_map.go services/api/internal/socket/live.go services/api/internal/socket/live_test.go services/api/internal/workerclient/client.go services/api/internal/contracts/parser_map.go services/api/internal/socket/backtest_test.go apps/cli/internal/operator/client.go apps/cli/internal/operator/client_test.go apps/cli/internal/operator/output.go apps/cli/internal/operator/parser_map.go apps/cli/internal/operator/runner.go apps/cli/internal/operator/runner_live_test.go apps/cli/internal/operator/scenario.go
bin/contracts-check
go test ./packages/domain/...
go test ./packages/contracts/gen/go/...
go test ./services/worker/...
go test ./services/api/...
go test ./apps/cli/...
cd apps/client && flutter test test/contracts/alt_contracts_test.dart
bin/lint
```
기대 결과: 모두 exit code 0. `bin/lint`의 기존 Mattermost `avoid_print` info는 기존 이슈로 기록하되 새 위반이 없어야 한다.
## 수정 파일 요약
| 파일 | 항목 |
|---|---|
| `services/worker/internal/livetrading/service.go` | REVIEW_REVIEW_LIVE_RISK-1 |
| `services/worker/internal/livetrading/service_test.go` | REVIEW_REVIEW_LIVE_RISK-1 |
| `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/CODE_REVIEW-cloud-G07.md` | REVIEW_REVIEW_LIVE_RISK-2 |

171
agent-task/archive/2026/06/m-live-trading-boundary/03+01,02_risk_kill_switch/plan_cloud_G07_3.log Normal file
View file

@ -0,0 +1,171 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=3 tag=REVIEW_REVIEW_REVIEW_LIVE_RISK -->
# Plan - REVIEW_REVIEW_REVIEW_LIVE_RISK
## 이 파일을 읽는 구현 에이전트에게
`CODE_REVIEW-*-G??.md`의 구현 에이전트 소유 섹션을 채우는 것은 필수다. 구현 후 검증을 실행하고 실제 변경 내용, 설계 결정, 명령 출력(stdout/stderr)을 기록한 뒤 active 파일을 그대로 두고 리뷰 준비를 보고한다. 최종 판정, 로그 rename, `complete.log`, archive 이동은 code-review 전용이다.
구현 중 사용자만 결정할 수 있는 사항, 사용자 소유 외부 환경/secret, 또는 계획 범위 충돌 없이는 안전하게 진행할 수 없으면 active review stub의 `사용자 리뷰 요청` 섹션에 정확한 결정, 근거, 실행 명령/출력, 재개 조건을 기록하고 중단한다. 구현 에이전트는 사용자에게 직접 묻거나 선택지를 제시하거나 `request_user_input`을 호출하지 않는다. 후속 에이전트가 명령 재실행이나 산출물 수집으로 해소할 수 있는 검증 증거 공백은 사용자 리뷰 요청이 아니다.
## 배경
plan=2 구현은 account별 submit mutex로 same-account concurrent submit을 직렬화해 count-limit broker 진입 문제를 보완했다. 이번 리뷰에서는 두 가지 남은 Required가 확인됐다.
- account mutex를 기다리기 전에 `policy`/`killSwitch`를 snapshot해서, 대기 중 kill switch나 policy가 바뀌면 queued submit이 stale state로 broker에 도달할 수 있다.
- `NewService(nil)`의 기본 halted kill switch 상태에서 submit이 `ErrBrokerUnavailable` 대신 `ErrRiskBlocked`로 분류될 수 있어 nil broker unavailable contract가 깨진다.
## 사용자 리뷰 요청 흐름
구현 중 차단은 active `CODE_REVIEW-*-G??.md`의 `사용자 리뷰 요청` 섹션에 기록한다. 구현 중 직접 사용자 프롬프트는 금지이며, code-review가 요청의 타당성을 검증하고 실제 `USER_REVIEW.md` 작성을 소유한다.
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 분석 결과
### 읽은 파일
- `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/plan_cloud_G07_2.log`
- `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/code_review_cloud_G07_2.log`
- `services/worker/internal/livetrading/service.go`
- `services/worker/internal/livetrading/service_test.go`
- `packages/domain/trading/risk.go`
- `services/worker/internal/socket/live.go`
- `services/worker/internal/socket/live_mapping.go`
- `services/worker/internal/socket/live_test.go`
- `services/api/internal/socket/live.go`
- `apps/cli/internal/operator/runner.go`
- `apps/cli/internal/operator/output.go`
### 테스트 환경 규칙
`test_env=local`이다. 이번 follow-up의 직접 수정 범위는 worker live trading service이므로 worker smoke 기준 `go test ./services/worker/...`를 baseline으로 둔다. 기존 cross-domain contract/API/CLI/client surface는 plan=1/2 로그에서 검증됐으므로, 이번 수정이 그 surface를 건드리지 않으면 focused worker checks와 `bin/lint`로 닫는다. 만약 contracts/API/CLI/client 파일을 추가로 건드리면 해당 domain smoke 명령도 다시 실행하고 review stub에 실제 stdout/stderr를 남긴다.
### 테스트 커버리지 공백
- account mutex 대기 중 kill switch가 `halted=true`로 바뀌는 queued submit case가 없다.
- default halted kill switch 상태의 `NewService(nil)` submit이 unavailable을 우선 반환하는지 검증하지 않는다.
### 범위 결정 근거
이번 follow-up은 `services/worker/internal/livetrading`의 submit guard ordering만 수정한다. Protobuf schema, parser maps, API forwarding, CLI output, Flutter parser map은 기존 루프에서 추가 및 검증됐고 이번 Required와 직접 관련이 없으므로 변경하지 않는다.
### 빌드 등급
Build lane `cloud-G07`, review lane `cloud-G07`. live order submission의 money-moving guard ordering과 concurrency timing을 다루는 반복 Required이므로 cloud-G07 route를 유지한다.
## 구현 체크리스트
- [ ] [REVIEW_REVIEW_REVIEW_LIVE_RISK-1] account mutex 대기 후 현재 policy/kill switch로 risk를 평가하게 한다.
- [ ] [REVIEW_REVIEW_REVIEW_LIVE_RISK-2] nil broker submit은 기본 kill switch 상태에서도 `ErrBrokerUnavailable`을 우선 반환하게 한다.
- [ ] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
### [REVIEW_REVIEW_REVIEW_LIVE_RISK-1] Current Risk State Under Account Lock
#### 문제
`services/worker/internal/livetrading/service.go:211`에서 `policy`와 `killSwitch`를 복사한 뒤 account mutex를 기다린다. 같은 account의 첫 submit이 broker 안에서 mutex를 잡고 있는 동안 두 번째 submit이 stale unhalted state를 복사한 채 대기하면, 그 사이 kill switch가 halted로 바뀌어도 두 번째 submit은 stale state로 risk를 통과할 수 있다.
#### 해결 방법
account mutex를 먼저 획득한 뒤, usage 계산과 `trading.EvaluateRisk` 직전에 `policyMu` 아래에서 현재 `policy`와 `killSwitch`를 복사한다.
Before:
```go
s.policyMu.RLock()
policy := s.policy
ks := s.killSwitch
s.policyMu.RUnlock()
acctMu := s.submitLockForAccount(req.AccountID)
acctMu.Lock()
defer acctMu.Unlock()
```
After:
```go
acctMu := s.submitLockForAccount(req.AccountID)
acctMu.Lock()
defer acctMu.Unlock()
s.policyMu.RLock()
policy := s.policy
ks := s.killSwitch
s.policyMu.RUnlock()
```
#### 수정 파일 및 체크리스트
- [ ] `services/worker/internal/livetrading/service.go`에서 policy/kill switch snapshot을 account mutex 획득 후로 이동한다.
- [ ] `services/worker/internal/livetrading/service_test.go`에 queued submit이 account mutex 대기 중 kill switch 변경을 반영하는 테스트를 추가한다.
- [ ] 기존 concurrent max daily/open tests가 계속 통과하는지 확인한다.
#### 테스트 작성
작성한다. 예시 이름:
- `TestSubmitLiveOrderQueuedKillSwitchBlocksBeforeBroker`: 첫 submit을 blocking broker 안에 진입시킨 뒤 두 번째 submit을 시작한다. 두 번째 submit이 account mutex에서 대기 중일 때 `svc.SetKillSwitch(trading.KillSwitchState{Halted: true, Reason: "operator halt"})`를 호출하고 첫 broker를 release한다. 기대 결과는 broker call count 1, 첫 submit 성공, 두 번째 submit `ErrRiskBlocked`, rejected order status, risk reason `"operator halt"`다.
#### 중간 검증
```bash
go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrder(QueuedKillSwitchBlocksBeforeBroker|Concurrent(MaxOpenOrders|MaxDailyOrders))' -count=1 -v
```
기대 결과: exit code 0.
### [REVIEW_REVIEW_REVIEW_LIVE_RISK-2] Broker Unavailable Precedence
#### 문제
`SubmitLiveOrder`는 risk evaluation 뒤에 nil broker를 확인한다. `NewService(nil)`은 기본 kill switch가 halted라서 submit이 `ErrBrokerUnavailable` 대신 `ErrRiskBlocked` + rejected order로 반환될 수 있다. 이는 nil broker mode의 unavailable contract와 typed unavailable surface를 흐린다.
#### 해결 방법
request validation이 끝난 직후, account mutex 획득과 risk evaluation 전에 `s.broker == nil`을 검사한다. nil broker이면 order record를 만들지 않고 `ErrBrokerUnavailable`을 반환한다.
#### 수정 파일 및 체크리스트
- [ ] `services/worker/internal/livetrading/service.go`에서 nil broker check를 validation 직후로 이동한다.
- [ ] `services/worker/internal/livetrading/service_test.go`에 default kill switch 상태에서도 nil broker가 unavailable을 우선 반환하는 테스트를 추가한다.
- [ ] 기존 `TestSubmitLiveOrderBrokerUnavailable`가 새 테스트와 중복되면 하나로 정리하되 unavailable precedence를 명시한다.
#### 테스트 작성
작성한다. 예시 이름:
- `TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch`: `svc := NewService(nil)`에서 kill switch를 변경하지 않고 confirmed request를 submit한다. 기대 결과는 `errors.Is(err, ErrBrokerUnavailable)`이고 `ErrRiskBlocked`가 아니어야 한다.
#### 중간 검증
```bash
go test ./services/worker/internal/livetrading -run 'TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch|TestSubmitLiveOrderBrokerUnavailable' -count=1 -v
```
기대 결과: exit code 0.
## 최종 검증
```bash
gofmt -l services/worker/internal/livetrading/service.go services/worker/internal/livetrading/service_test.go
go test ./services/worker/internal/livetrading
go test ./services/worker/...
bin/lint
```
기대 결과: 모두 exit code 0. `bin/lint`의 기존 Mattermost `avoid_print` info는 기존 이슈로 기록하되 새 위반이 없어야 한다.
## 수정 파일 요약
| 파일 | 항목 |
|---|---|
| `services/worker/internal/livetrading/service.go` | REVIEW_REVIEW_REVIEW_LIVE_RISK-1, REVIEW_REVIEW_REVIEW_LIVE_RISK-2 |
| `services/worker/internal/livetrading/service_test.go` | REVIEW_REVIEW_REVIEW_LIVE_RISK-1, REVIEW_REVIEW_REVIEW_LIVE_RISK-2 |
| `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/CODE_REVIEW-cloud-G07.md` | 구현 결과와 검증 evidence 기록 |

159
agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/CODE_REVIEW-cloud-G06.md
View file

@ -1,159 +0,0 @@
<!-- task=m-live-trading-boundary/03+01,02_risk_kill_switch plan=0 tag=LIVE_RISK -->
# Code Review Reference - LIVE_RISK
> **[IMPLEMENTING AGENT — READ FIRST] Filling in this file is the mandatory final step of implementation.**
> The task is NOT complete until every implementation-owned section below is filled in.
> Complete the `구현 체크리스트`; the final checklist item is mandatory before saving.
> Fill implementation-owned sections, then stop with active files in place and report ready for review.
> If implementation is blocked by a user-only decision, user-owned external environment prerequisite, or scope conflict, fill `사용자 리뷰 요청` with evidence and stop with active files in place; code-review decides whether to write `USER_REVIEW.md`. Evidence gaps that a follow-up agent can close by rerunning commands or collecting artifacts are normal follow-up issues, not user-review blockers by themselves.
> Do not ask the user directly, present choices in chat, or call `request_user_input` during implementation; record the needed decision in `사용자 리뷰 요청` and stop for code-review.
> Finalization (`코드리뷰 결과`, log rename, `complete.log`, archive moves, `코드리뷰 전용 체크리스트`) is review-agent-only, even after compaction/resume.
> Follow the ownership table at the bottom of this file for which sections you own.
## 개요
date=2026-06-07
task=m-live-trading-boundary/03+01,02_risk_kill_switch, plan=0, tag=LIVE_RISK
## Roadmap Targets
- Milestone: `agent-roadmap/phase/trading-expansion/milestones/live-trading-boundary.md`
- Task ids:
- `risk-limits`: 실거래 전 최소 risk limit과 kill switch가 있다.
- Completion mode: check-on-pass
## 이 파일을 읽는 리뷰 에이전트에게
> **[REVIEW AGENT ONLY]** 아래 종결 절차는 코드리뷰 에이전트 전용이다. 구현 에이전트는 이 섹션을 실행하지 않는다.
각 항목의 구현을 실제 소스 파일과 대조하고, `검증 결과` 섹션의 출력이 코드와 일치하는지 확인하세요.
리뷰 완료는 아래 순서까지 끝난 상태를 의미합니다.
1. 판정을 append한다.
2. `CODE_REVIEW-cloud-G06.md` -> `code_review_cloud_G06_N.log`, `PLAN-cloud-G06.md` -> `plan_cloud_G06_M.log`로 아카이브한다.
3. PASS이면 `complete.log` 작성 후 active task 디렉터리를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동한다. WARN/FAIL이면 user-review gate를 확인한 뒤 다음 active plan/review 파일 또는 `USER_REVIEW.md`를 작성한다. `USER_REVIEW.md`가 사용자 결정으로 완료/PASS 해소되면 code-review가 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log` 작성 후 archive 이동한다.
4. PASS이고 task group이 `m-<milestone-slug>`이면 완료 이벤트 메타데이터를 보고한다. roadmap 상태 체크와 `update-roadmap` 호출은 런타임 책임이다.
5. 적용 가능한 `코드리뷰 전용 체크리스트` 항목을 최종 `.log` 위치에서 체크한 뒤 보고한다.
---
## 구현 항목별 완료 여부
| 항목 | 완료 여부 |
|------|---------|
| [LIVE_RISK-1] live risk policy domain/config defaults를 추가한다. | [ ] |
| [LIVE_RISK-2] worker submit path에 risk guard와 kill switch를 적용한다. | [ ] |
| [LIVE_RISK-3] risk/kill switch contract, API forwarder, CLI actions/output을 추가한다. | [ ] |
| [LIVE_RISK-4] focused verification과 affected module tests를 실행한다. | [ ] |
## 구현 체크리스트
- [ ] [LIVE_RISK-1] live risk policy domain/config defaults를 추가한다.
- [ ] [LIVE_RISK-2] worker submit path에 risk guard와 kill switch를 적용한다.
- [ ] [LIVE_RISK-3] risk/kill switch contract, API forwarder, CLI actions/output을 추가한다.
- [ ] [LIVE_RISK-4] focused verification과 affected module tests를 실행한다.
- [ ] CODE_REVIEW-*-G??.md의 구현 에이전트 소유 섹션을 실제 구현 내용과 검증 출력으로 채운다. 이 항목이 완료되기 전에는 구현이 완료된 것이 아니다.
## 코드리뷰 전용 체크리스트
> **[REVIEW AGENT ONLY]** 이 체크리스트는 코드리뷰 에이전트만 사용한다.
> 구현 에이전트는 이 섹션을 수정하거나 체크하지 않는다.
- [ ] `코드리뷰 결과`에 `PASS`, `WARN`, `FAIL` 중 하나의 판정을 append한다.
- [ ] 판정과 `차원별 평가`, Required/Suggested/Nit 분류가 서로 일치한다.
- [ ] active `CODE_REVIEW-*-G??.md`를 `code_review_cloud_G06_N.log`로 아카이브한다.
- [ ] active `PLAN-*-G??.md`를 `plan_cloud_G06_M.log`로 아카이브한다.
- [ ] `.gitignore`의 Agent-Ops 관리 block이 `agent-task/**/*.md`와 `agent-task/**/*.log`를 unignore하고 `agent-roadmap/current.md`를 ignore하는지 확인한다.
- [ ] PASS이면 `agent-ops/skills/common/code-review/templates/complete-log-template.md` 기준으로 `complete.log`를 작성하고 active `.md` 파일을 남기지 않는다.
- [ ] PASS이면 active task 디렉터리 `agent-task/m-live-trading-boundary/03+01,02_risk_kill_switch/`를 `agent-task/archive/YYYY/MM/m-live-trading-boundary/03+01,02_risk_kill_switch/`로 이동하고 최종 archive 경로에서 이 체크리스트를 갱신한다.
- [ ] PASS이고 task group이 `m-<milestone-slug>`이면 런타임이 읽을 완료 이벤트 메타데이터를 보고하고, roadmap 수정이나 `update-roadmap` 직접 호출을 하지 않는다.
- [ ] PASS split 작업이면 이동 후 빈 active parent `agent-task/m-live-trading-boundary/`를 제거하거나, 남은 sibling/file이 있어 유지했다고 확인한다.
- [ ] WARN/FAIL이고 user-review gate가 트리거되지 않았으면 다음 active `PLAN-{build_lane}-GNN.md`와 `CODE_REVIEW-{review_lane}-GNN.md`를 작성하고 `complete.log`를 작성하지 않는다.
- [ ] USER_REVIEW이면 `agent-ops/skills/common/code-review/templates/user-review-template.md` 기준으로 `USER_REVIEW.md`를 작성하고 active `PLAN-*.md`, `CODE_REVIEW-*.md`, `complete.log`를 남기지 않는다.
- [ ] USER_REVIEW가 사용자 결정으로 완료/PASS 해소되면 `USER_REVIEW.md`를 해소 상태로 갱신하고 `complete.log`를 작성한 뒤 task directory를 archive로 이동한다.
## 계획 대비 변경 사항
_구현 에이전트가 계획과 다르게 구현한 부분을 이유와 함께 기록한다._
## 주요 설계 결정
_구현 에이전트가 주요 설계 결정 사항을 기록한다._
## 사용자 리뷰 요청
_기본값은 `없음`이다. 구현 중 사용자 결정, 사용자 소유 외부 환경/secret/서비스 준비, 또는 계획 범위 변경 없이는 안전하게 진행할 수 없으면 아래 항목을 실제 내용으로 교체하고, 구현을 중단한 뒤 active 파일을 그대로 둔 채 리뷰를 요청한다. 구현 에이전트는 사용자에게 직접 질문하거나 선택지를 제시하거나 `request_user_input`을 호출하지 않는다. 후속 에이전트가 명령 재실행이나 산출물 수집으로 해소할 수 있는 검증 증거 공백만으로는 사용자 리뷰 요청을 작성하지 않는다._
- 상태: 없음
- 사유 유형: 없음
- 결정 필요: 없음
- 차단 근거: 없음
- 실행한 검증/명령: 없음
- 자동 후속 불가 이유: 없음
- 재개 조건: 없음
## 리뷰어를 위한 체크포인트
- `01_broker_port`와 `02+01_order_lifecycle` completion이 prerequisite로 충족됐는지 확인한다.
- Kill switch default가 safe default이며 config/test fixture로 조정 가능한지 확인한다.
- Risk denial이 broker call 이전에 발생하고 fake broker call count test가 있는지 확인한다.
- Risk policy가 주문 type capability를 닫지 않는지 확인한다.
- CLI/API가 secret/account number를 tracked fixture에 기록하지 않는지 확인한다.
## 검증 결과
_구현 에이전트가 각 중간 검증 및 최종 검증 명령 실행 후 출력을 여기에 붙여 넣는다._
필수 규칙:
- 검증 명령은 고정된 계약이다. 임의로 대체하지 않는다.
- 대체가 필요하면 `계획 대비 변경 사항`에 이유와 대체 명령을 기록한다.
- `검증 결과`에는 실제 stdout/stderr를 붙여 넣는다.
- 사용자 리뷰 요청으로 명령을 끝까지 실행하지 못했다면 `사용자 리뷰 요청`에 실행한 명령, 실제 출력, 미실행 명령의 사유를 기록한다.
- mobile/UI hang, timeout, 또는 2분 무진행은 blind retry를 중단하고 focused rerun 명령과 screenshot/window/UI-tree evidence path를 남기며, 불가능하면 정확한 사유를 남긴다.
### LIVE_RISK-1 중간 검증
```text
$ go test ./packages/domain/...
(output)
```
### LIVE_RISK-2 중간 검증
```text
$ go test ./services/worker/internal/livetrading ./services/worker/internal/socket
(output)
```
### LIVE_RISK-3 중간 검증
```text
$ bin/contracts-gen
(output)
$ bin/contracts-check
(output)
$ go test ./services/api/internal/socket ./apps/cli/internal/operator
(output)
```
### 최종 검증
```text
$ bin/contracts-check
(output)
$ go test ./packages/domain/...
(output)
$ go test ./packages/contracts/gen/go/...
(output)
$ go test ./services/worker/...
(output)
$ go test ./services/api/...
(output)
$ go test ./apps/cli/...
(output)
$ bin/lint
(output)
```
---
> **[IMPLEMENTING AGENT — BEFORE SAVING] Have you filled in every implementation-owned section: completion table, implementation checklist, changes from plan, design decisions, and verification output?**
> If anything is blank, go back and fill it in before saving this file.
> Leave review-agent-only sections unchanged.

15
apps/cli/internal/operator/client.go
View file

@ -186,6 +186,21 @@ func (c *APIClient) GetLiveOrder(ctx context.Context, req *altv1.GetLiveOrderReq
return sendTyped[*altv1.GetLiveOrderRequest, *altv1.GetLiveOrderResponse](c, ctx, req)
}
// GetLiveRiskPolicy retrieves the current live trading risk policy.
func (c *APIClient) GetLiveRiskPolicy(ctx context.Context, req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
return sendTyped[*altv1.GetLiveRiskPolicyRequest, *altv1.GetLiveRiskPolicyResponse](c, ctx, req)
}
// GetLiveKillSwitch retrieves the current live kill switch state.
func (c *APIClient) GetLiveKillSwitch(ctx context.Context, req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
return sendTyped[*altv1.GetLiveKillSwitchRequest, *altv1.GetLiveKillSwitchResponse](c, ctx, req)
}
// SetLiveKillSwitch sets the live kill switch state.
func (c *APIClient) SetLiveKillSwitch(ctx context.Context, req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
return sendTyped[*altv1.SetLiveKillSwitchRequest, *altv1.SetLiveKillSwitchResponse](c, ctx, req)
}
// sendTyped is the shared request path for every API call. It derives the
// request timeout from the context deadline and maps a dropped connection to
// ErrTransport so each method stays a one-line forwarder and the transport vs.

96
apps/cli/internal/operator/client_test.go
View file

@ -38,24 +38,30 @@ type fakeAPI struct {
submitLiveOrderResp *altv1.SubmitLiveOrderResponse
cancelLiveOrderResp *altv1.CancelLiveOrderResponse
getLiveOrderResp *altv1.GetLiveOrderResponse
getLiveRiskPolicyResp *altv1.GetLiveRiskPolicyResponse
getLiveKillSwitchResp *altv1.GetLiveKillSwitchResponse
setLiveKillSwitchResp *altv1.SetLiveKillSwitchResponse
getBacktestRunFunc func(req *altv1.GetBacktestRunRequest) (*altv1.GetBacktestRunResponse, error)
mu sync.Mutex
instReq *altv1.ListInstrumentsRequest
barsReq *altv1.ListBarsRequest
startBacktestReq *altv1.StartBacktestRequest
getBacktestRunReq *altv1.GetBacktestRunRequest
importDailyBarsReq *altv1.ImportDailyBarsRequest
startPaperReq *altv1.StartPaperTradingRequest
getPaperStateReq *altv1.GetPaperTradingStateRequest
submitPaperOrderReq *altv1.SubmitPaperOrderRequest
cancelPaperOrderReq *altv1.CancelPaperOrderRequest
fillPaperOrderReq *altv1.FillPaperOrderRequest
submitLiveOrderReq *altv1.SubmitLiveOrderRequest
cancelLiveOrderReq *altv1.CancelLiveOrderRequest
getLiveOrderReq *altv1.GetLiveOrderRequest
calls []string
mu sync.Mutex
instReq *altv1.ListInstrumentsRequest
barsReq *altv1.ListBarsRequest
startBacktestReq *altv1.StartBacktestRequest
getBacktestRunReq *altv1.GetBacktestRunRequest
importDailyBarsReq *altv1.ImportDailyBarsRequest
startPaperReq *altv1.StartPaperTradingRequest
getPaperStateReq *altv1.GetPaperTradingStateRequest
submitPaperOrderReq *altv1.SubmitPaperOrderRequest
cancelPaperOrderReq *altv1.CancelPaperOrderRequest
fillPaperOrderReq *altv1.FillPaperOrderRequest
submitLiveOrderReq *altv1.SubmitLiveOrderRequest
cancelLiveOrderReq *altv1.CancelLiveOrderRequest
getLiveOrderReq *altv1.GetLiveOrderRequest
getLiveRiskPolicyReq *altv1.GetLiveRiskPolicyRequest
getLiveKillSwitchReq *altv1.GetLiveKillSwitchRequest
setLiveKillSwitchReq *altv1.SetLiveKillSwitchRequest
calls []string
}
// recordCall appends an action name in receive order so tests can assert that a
@ -228,6 +234,42 @@ func (f *fakeAPI) lastGetLiveOrderReq() *altv1.GetLiveOrderRequest {
return f.getLiveOrderReq
}
func (f *fakeAPI) setGetLiveRiskPolicyReq(req *altv1.GetLiveRiskPolicyRequest) {
f.mu.Lock()
defer f.mu.Unlock()
f.getLiveRiskPolicyReq = req
}
func (f *fakeAPI) lastGetLiveRiskPolicyReq() *altv1.GetLiveRiskPolicyRequest {
f.mu.Lock()
defer f.mu.Unlock()
return f.getLiveRiskPolicyReq
}
func (f *fakeAPI) setGetLiveKillSwitchReq(req *altv1.GetLiveKillSwitchRequest) {
f.mu.Lock()
defer f.mu.Unlock()
f.getLiveKillSwitchReq = req
}
func (f *fakeAPI) lastGetLiveKillSwitchReq() *altv1.GetLiveKillSwitchRequest {
f.mu.Lock()
defer f.mu.Unlock()
return f.getLiveKillSwitchReq
}
func (f *fakeAPI) setSetLiveKillSwitchReq(req *altv1.SetLiveKillSwitchRequest) {
f.mu.Lock()
defer f.mu.Unlock()
f.setLiveKillSwitchReq = req
}
func (f *fakeAPI) lastSetLiveKillSwitchReq() *altv1.SetLiveKillSwitchRequest {
f.mu.Lock()
defer f.mu.Unlock()
return f.setLiveKillSwitchReq
}
// startFakeAPIServer starts a proto-socket server on a free localhost port that
// answers hello/list_instruments/list_bars with the supplied canned responses
// and records the received requests. It returns the ws:// URL and stops the
@ -383,6 +425,30 @@ func startFakeAPIServer(t *testing.T, api *fakeAPI) string {
}
return &altv1.GetLiveOrderResponse{}, nil
})
protoSocket.AddRequestListenerTyped[*altv1.GetLiveRiskPolicyRequest, *altv1.GetLiveRiskPolicyResponse](&c.Communicator, func(req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
api.recordCall("get_live_risk_policy")
api.setGetLiveRiskPolicyReq(req)
if api.getLiveRiskPolicyResp != nil {
return api.getLiveRiskPolicyResp, nil
}
return &altv1.GetLiveRiskPolicyResponse{}, nil
})
protoSocket.AddRequestListenerTyped[*altv1.GetLiveKillSwitchRequest, *altv1.GetLiveKillSwitchResponse](&c.Communicator, func(req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
api.recordCall("get_live_kill_switch")
api.setGetLiveKillSwitchReq(req)
if api.getLiveKillSwitchResp != nil {
return api.getLiveKillSwitchResp, nil
}
return &altv1.GetLiveKillSwitchResponse{}, nil
})
protoSocket.AddRequestListenerTyped[*altv1.SetLiveKillSwitchRequest, *altv1.SetLiveKillSwitchResponse](&c.Communicator, func(req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
api.recordCall("set_live_kill_switch")
api.setSetLiveKillSwitchReq(req)
if api.setLiveKillSwitchResp != nil {
return api.setLiveKillSwitchResp, nil
}
return &altv1.SetLiveKillSwitchResponse{}, nil
})
}
if err := srv.Start(ctx); err != nil {

47
apps/cli/internal/operator/output.go
View file

@ -80,6 +80,21 @@ type StepEvent struct {
BrokerOrderID string
BrokerStatus string
OperatorConfirmed bool
// Live kill switch output fields. They render for get/set_live_kill_switch steps.
KillSwitchHalted bool
KillSwitchReason string
// Live risk policy output fields. They render for get_live_risk_policy steps.
MaxDailyOrders int
MaxOpenOrders int
AllowShortSelling bool
// Live risk decision output fields. They render for submit_live_order steps
// when a LiveRiskDecision is present in the response (i.e. risk-blocked submit).
HasRiskDecision bool
RiskDecisionAllow bool
RiskDecisionReason string
}
// RunSummary is the final record describing a whole scenario run.
@ -205,6 +220,23 @@ func (o *Writer) WriteStep(ev StepEvent) {
fields["operator_confirmed"] = ev.OperatorConfirmed
}
}
if ev.Action == string(ActionGetLiveKillSwitch) || ev.Action == string(ActionSetLiveKillSwitch) {
fields["kill_switch_halted"] = ev.KillSwitchHalted
if ev.KillSwitchReason != "" {
fields["kill_switch_reason"] = ev.KillSwitchReason
}
}
if ev.Action == string(ActionGetLiveRiskPolicy) {
fields["max_daily_orders"] = ev.MaxDailyOrders
fields["max_open_orders"] = ev.MaxOpenOrders
fields["allow_short_selling"] = ev.AllowShortSelling
}
if ev.HasRiskDecision {
fields["risk_decision_allowed"] = ev.RiskDecisionAllow
if ev.RiskDecisionReason != "" {
fields["risk_decision_reason"] = ev.RiskDecisionReason
}
}
o.writeJSON(fields)
return
}
@ -298,6 +330,21 @@ func (o *Writer) WriteStep(ev StepEvent) {
line += " operator_confirmed=true"
}
}
if ev.Action == string(ActionGetLiveKillSwitch) || ev.Action == string(ActionSetLiveKillSwitch) {
line += fmt.Sprintf(" kill_switch_halted=%v", ev.KillSwitchHalted)
if ev.KillSwitchReason != "" {
line += fmt.Sprintf(" kill_switch_reason=%q", ev.KillSwitchReason)
}
}
if ev.Action == string(ActionGetLiveRiskPolicy) {
line += fmt.Sprintf(" max_daily_orders=%d max_open_orders=%d allow_short_selling=%v", ev.MaxDailyOrders, ev.MaxOpenOrders, ev.AllowShortSelling)
}
if ev.HasRiskDecision {
line += fmt.Sprintf(" risk_decision_allowed=%v", ev.RiskDecisionAllow)
if ev.RiskDecisionReason != "" {
line += fmt.Sprintf(" risk_decision_reason=%q", ev.RiskDecisionReason)
}
}
fmt.Fprintln(o.w, line)
}

11
apps/cli/internal/operator/parser_map.go
View file

@ -63,6 +63,17 @@ func messageFactories() []func() proto.Message {
func() proto.Message { return &altv1.CancelLiveOrderResponse{} },
func() proto.Message { return &altv1.GetLiveOrderRequest{} },
func() proto.Message { return &altv1.GetLiveOrderResponse{} },
// live risk/kill switch surface: policy query, kill switch query/set
func() proto.Message { return &altv1.GetLiveRiskPolicyRequest{} },
func() proto.Message { return &altv1.GetLiveRiskPolicyResponse{} },
func() proto.Message { return &altv1.LiveRiskPolicy{} },
func() proto.Message { return &altv1.GetLiveKillSwitchRequest{} },
func() proto.Message { return &altv1.GetLiveKillSwitchResponse{} },
func() proto.Message { return &altv1.SetLiveKillSwitchRequest{} },
func() proto.Message { return &altv1.SetLiveKillSwitchResponse{} },
func() proto.Message { return &altv1.LiveKillSwitchState{} },
// live risk decision: included in SubmitLiveOrderResponse when risk blocked
func() proto.Message { return &altv1.LiveRiskDecision{} },
}
}

122
apps/cli/internal/operator/runner.go
View file

@ -502,7 +502,7 @@ func runStep(ctx context.Context, client *APIClient, scenario string, step Step,
if serr != nil {
return transportEvent3(ev, serr)
}
return evaluateLiveOrder(ev, step, sresp.GetError(), sresp.GetOrder())
return evaluateLiveOrder(ev, step, sresp.GetError(), sresp.GetOrder(), sresp.GetRiskDecision())
case ActionCancelLiveOrder:
liveOrderID := interpolate(step.Request.LiveOrderID, savedValues)
@ -513,7 +513,7 @@ func runStep(ctx context.Context, client *APIClient, scenario string, step Step,
if cerr != nil {
return transportEvent3(ev, cerr)
}
return evaluateLiveOrder(ev, step, cresp.GetError(), cresp.GetOrder())
return evaluateLiveOrder(ev, step, cresp.GetError(), cresp.GetOrder(), nil)
case ActionGetLiveOrder:
liveOrderID := interpolate(step.Request.LiveOrderID, savedValues)
@ -524,7 +524,39 @@ func runStep(ctx context.Context, client *APIClient, scenario string, step Step,
if gerr != nil {
return transportEvent3(ev, gerr)
}
return evaluateLiveOrder(ev, step, gresp.GetError(), gresp.GetOrder())
return evaluateLiveOrder(ev, step, gresp.GetError(), gresp.GetOrder(), nil)
case ActionGetLiveRiskPolicy:
rpresp, rperr := client.GetLiveRiskPolicy(stepCtx, &altv1.GetLiveRiskPolicyRequest{
AccountId: step.Request.AccountID,
})
if rperr != nil {
return transportEvent3(ev, rperr)
}
ev2, code := evaluateLiveRiskPolicy(ev, step, rpresp.GetError(), rpresp.GetPolicy())
return ev2, code, ""
case ActionGetLiveKillSwitch:
gksresp, gkserr := client.GetLiveKillSwitch(stepCtx, &altv1.GetLiveKillSwitchRequest{
AccountId: step.Request.AccountID,
})
if gkserr != nil {
return transportEvent3(ev, gkserr)
}
ev2, code := evaluateLiveKillSwitch(ev, step, gksresp.GetError(), gksresp.GetState())
return ev2, code, ""
case ActionSetLiveKillSwitch:
sksresp, skserr := client.SetLiveKillSwitch(stepCtx, &altv1.SetLiveKillSwitchRequest{
AccountId: step.Request.AccountID,
Halted: step.Request.Halted,
Reason: step.Request.KillSwitchReason,
})
if skserr != nil {
return transportEvent3(ev, skserr)
}
ev2, code := evaluateLiveKillSwitch(ev, step, sksresp.GetError(), sksresp.GetState())
return ev2, code, ""
default:
// Validation rejects unknown actions, so reaching here means a runner is
@ -836,11 +868,11 @@ func evaluatePaperOrder(ev StepEvent, step Step, errInfo *altv1.ErrorInfo, order
}
// evaluateLiveOrder checks a live order lifecycle response. order is the typed
// LiveOrder (nil on a typed error). The returned string is the live order id,
// saved so a later cancel/get step can interpolate {{steps.<id>.live_order.id}}.
// The live order status set is open (broker-defined strings), so only a non-empty
// expect.live_order_status is compared verbatim — no closed-set restriction.
func evaluateLiveOrder(ev StepEvent, step Step, errInfo *altv1.ErrorInfo, order *altv1.LiveOrder) (StepEvent, int, string) {
// LiveOrder (nil on a typed error). riskDecision is non-nil only for
// submit_live_order steps when the risk guard blocked the submission.
// The returned string is the live order id, saved so a later cancel/get step
// can interpolate {{steps.<id>.live_order.id}}.
func evaluateLiveOrder(ev StepEvent, step Step, errInfo *altv1.ErrorInfo, order *altv1.LiveOrder, riskDecision *altv1.LiveRiskDecision) (StepEvent, int, string) {
expectsError := step.Expect.Status == statusError
var liveOrderID string
@ -851,6 +883,11 @@ func evaluateLiveOrder(ev StepEvent, step Step, errInfo *altv1.ErrorInfo, order
ev.BrokerOrderID = order.GetBrokerId()
ev.BrokerStatus = order.GetBrokerStatus()
}
if riskDecision != nil {
ev.HasRiskDecision = true
ev.RiskDecisionAllow = riskDecision.GetAllowed()
ev.RiskDecisionReason = riskDecision.GetReason()
}
if errInfo != nil {
ev.ErrorCode = errInfo.GetCode()
@ -912,6 +949,75 @@ func interpolate(val string, savedValues map[string]string) string {
return val
}
// evaluateLiveKillSwitch checks a get/set kill switch response against expectations.
func evaluateLiveKillSwitch(ev StepEvent, step Step, errInfo *altv1.ErrorInfo, state *altv1.LiveKillSwitchState) (StepEvent, int) {
expectsError := step.Expect.Status == statusError
if errInfo != nil {
ev.ErrorCode = errInfo.GetCode()
ev.ErrorMessage = errInfo.GetMessage()
if !expectsError {
ev.Status = statusError
return ev, codeAppError
}
if step.Expect.ErrorCode != "" && step.Expect.ErrorCode != errInfo.GetCode() {
ev.Status = statusMismatch
return ev, codeAppError
}
ev.Status = statusOK
return ev, codeOK
}
if expectsError {
ev.Status = statusMismatch
ev.ErrorMessage = "expected a typed error but the request succeeded"
return ev, codeAppError
}
if state != nil {
ev.KillSwitchHalted = state.GetHalted()
ev.KillSwitchReason = state.GetReason()
}
ev.Status = statusOK
return ev, codeOK
}
// evaluateLiveRiskPolicy checks a get_live_risk_policy response against expectations.
func evaluateLiveRiskPolicy(ev StepEvent, step Step, errInfo *altv1.ErrorInfo, policy *altv1.LiveRiskPolicy) (StepEvent, int) {
expectsError := step.Expect.Status == statusError
if errInfo != nil {
ev.ErrorCode = errInfo.GetCode()
ev.ErrorMessage = errInfo.GetMessage()
if !expectsError {
ev.Status = statusError
return ev, codeAppError
}
if step.Expect.ErrorCode != "" && step.Expect.ErrorCode != errInfo.GetCode() {
ev.Status = statusMismatch
return ev, codeAppError
}
ev.Status = statusOK
return ev, codeOK
}
if expectsError {
ev.Status = statusMismatch
ev.ErrorMessage = "expected a typed error but the request succeeded"
return ev, codeAppError
}
if policy != nil {
ev.MaxDailyOrders = int(policy.GetMaxDailyOrders())
ev.MaxOpenOrders = int(policy.GetMaxOpenOrders())
ev.AllowShortSelling = policy.GetAllowShortSelling()
}
ev.Status = statusOK
return ev, codeOK
}
func interpolateSlice(slice []string, savedValues map[string]string) []string {
if len(slice) == 0 {
return nil

211
apps/cli/internal/operator/runner_live_test.go
View file

@ -178,6 +178,217 @@ func TestRunSubmitLiveOrderCancelGetInterpolation(t *testing.T) {
}
}
func TestRunGetLiveRiskPolicy(t *testing.T) {
api := &fakeAPI{
getLiveRiskPolicyResp: &altv1.GetLiveRiskPolicyResponse{
Policy: &altv1.LiveRiskPolicy{MaxDailyOrders: 5, MaxOpenOrders: 3, AllowShortSelling: false},
},
}
url := startFakeAPIServer(t, api)
sc := &Scenario{
Name: "live_risk_kill_switch",
Steps: []Step{
{
ID: "get_policy",
Action: ActionGetLiveRiskPolicy,
Request: Request{AccountID: "live-acct-1"},
Expect: Expect{Status: "ok"},
},
},
}
out, code := runScenario(t, sc, url)
if code != codeOK {
t.Fatalf("exit code = %d, want 0 (out=%q)", code, out)
}
if !strings.Contains(out, "max_daily_orders=5") {
t.Errorf("output %q missing max_daily_orders=5", out)
}
if !strings.Contains(out, "max_open_orders=3") {
t.Errorf("output %q missing max_open_orders=3", out)
}
if !strings.Contains(out, "allow_short_selling=false") {
t.Errorf("output %q missing allow_short_selling=false", out)
}
}
func TestRunGetLiveKillSwitch(t *testing.T) {
api := &fakeAPI{
getLiveKillSwitchResp: &altv1.GetLiveKillSwitchResponse{
State: &altv1.LiveKillSwitchState{Halted: true, Reason: "kill switch active by default"},
},
}
url := startFakeAPIServer(t, api)
sc := &Scenario{
Name: "live_risk_kill_switch",
Steps: []Step{
{
ID: "get_ks",
Action: ActionGetLiveKillSwitch,
Request: Request{AccountID: "live-acct-1"},
Expect: Expect{Status: "ok"},
},
},
}
out, code := runScenario(t, sc, url)
if code != codeOK {
t.Fatalf("exit code = %d, want 0 (out=%q)", code, out)
}
if !strings.Contains(out, "kill_switch_halted=true") {
t.Errorf("output %q missing kill_switch_halted=true", out)
}
}
func TestRunSetLiveKillSwitchResume(t *testing.T) {
api := &fakeAPI{
setLiveKillSwitchResp: &altv1.SetLiveKillSwitchResponse{
State: &altv1.LiveKillSwitchState{Halted: false, Reason: "operator cleared"},
},
}
url := startFakeAPIServer(t, api)
sc := &Scenario{
Name: "live_risk_kill_switch",
Steps: []Step{
{
ID: "set_ks",
Action: ActionSetLiveKillSwitch,
Request: Request{
AccountID: "live-acct-1",
Halted: false,
KillSwitchReason: "operator cleared",
},
Expect: Expect{Status: "ok"},
},
},
}
out, code := runScenario(t, sc, url)
if code != codeOK {
t.Fatalf("exit code = %d, want 0 (out=%q)", code, out)
}
if !strings.Contains(out, "kill_switch_halted=false") {
t.Errorf("output %q missing kill_switch_halted=false", out)
}
got := api.lastSetLiveKillSwitchReq()
if got == nil {
t.Fatal("server did not receive a set_live_kill_switch request")
}
if got.GetHalted() != false {
t.Errorf("server received halted = true, want false")
}
if got.GetReason() != "operator cleared" {
t.Errorf("server received reason = %q, want %q", got.GetReason(), "operator cleared")
}
}
func TestLiveRiskKillSwitchFixtureIsValid(t *testing.T) {
yamlPath := filepath.Join("..", "..", "testdata", "operator", "live_risk_kill_switch.yaml")
if _, err := LoadScenario(yamlPath); err != nil {
t.Fatalf("live_risk_kill_switch.yaml failed validation: %v", err)
}
expectedPath := filepath.Join("..", "..", "testdata", "operator", "expected", "live_risk_kill_switch.jsonl")
f, err := os.Open(expectedPath)
if err != nil {
t.Fatalf("open expected fixture: %v", err)
}
defer f.Close()
scanner := bufio.NewScanner(f)
sawPolicy := false
sawKillSwitch := false
sawRiskDecision := false
sawSummary := false
for scanner.Scan() {
line := strings.TrimSpace(scanner.Text())
if line == "" {
continue
}
var rec map[string]any
if err := json.Unmarshal([]byte(line), &rec); err != nil {
t.Fatalf("expected fixture line not valid JSON: %v", err)
}
if rec["action"] == "get_live_risk_policy" && rec["max_daily_orders"] != nil {
sawPolicy = true
}
if rec["kill_switch_halted"] != nil {
sawKillSwitch = true
}
if rec["risk_decision_allowed"] != nil {
sawRiskDecision = true
}
if rec["type"] == "summary" {
sawSummary = true
}
}
if err := scanner.Err(); err != nil {
t.Fatalf("scan expected fixture: %v", err)
}
if !sawPolicy {
t.Error("expected fixture missing a get_live_risk_policy line with max_daily_orders")
}
if !sawKillSwitch {
t.Error("expected fixture missing a kill_switch_halted field")
}
if !sawRiskDecision {
t.Error("expected fixture missing a risk_decision_allowed field (risk-blocked submit evidence)")
}
if !sawSummary {
t.Error("expected fixture missing a summary line")
}
}
func TestRunSubmitLiveOrderRiskBlockedIncludesDecision(t *testing.T) {
api := &fakeAPI{submitLiveOrderResp: &altv1.SubmitLiveOrderResponse{
Order: &altv1.LiveOrder{
Id: "lo-live-acct-1-1",
Status: "rejected",
BrokerId: "",
},
Error: &altv1.ErrorInfo{Code: "invalid_request", Message: "live order blocked by risk policy: kill switch is active"},
RiskDecision: &altv1.LiveRiskDecision{Allowed: false, Reason: "kill switch is active"},
}}
url := startFakeAPIServer(t, api)
sc := &Scenario{
Name: "live_risk_kill_switch",
Steps: []Step{
{
ID: "submit_risk_blocked",
Action: ActionSubmitLiveOrder,
Request: Request{
AccountID: "live-acct-1",
InstrumentID: "KRX:005930",
Side: "buy",
Quantity: "1",
OrderType: "market",
OperatorConfirmed: true,
OperatorID: "operator-1",
},
Expect: Expect{Status: "error", ErrorCode: "invalid_request"},
},
},
}
out, code := runScenario(t, sc, url)
if code != codeOK {
t.Fatalf("exit code = %d, want 0 (out=%q)", code, out)
}
if !strings.Contains(out, "live_order_id=lo-live-acct-1-1") {
t.Errorf("output %q missing live_order_id=lo-live-acct-1-1", out)
}
if !strings.Contains(out, "live_order_status=rejected") {
t.Errorf("output %q missing live_order_status=rejected", out)
}
if !strings.Contains(out, "risk_decision_allowed=false") {
t.Errorf("output %q missing risk_decision_allowed=false", out)
}
if !strings.Contains(out, "kill switch is active") {
t.Errorf("output %q missing kill switch reason", out)
}
}
func TestLiveOrderLifecycleFixtureIsValid(t *testing.T) {
yamlPath := filepath.Join("..", "..", "testdata", "operator", "live_order_lifecycle.yaml")
if _, err := LoadScenario(yamlPath); err != nil {

26
apps/cli/internal/operator/scenario.go
View file

@ -58,6 +58,12 @@ const (
ActionCancelLiveOrder Action = "cancel_live_order"
// ActionGetLiveOrder retrieves the current status of a live order.
ActionGetLiveOrder Action = "get_live_order"
// ActionGetLiveRiskPolicy retrieves the current live trading risk policy.
ActionGetLiveRiskPolicy Action = "get_live_risk_policy"
// ActionGetLiveKillSwitch retrieves the current live kill switch state.
ActionGetLiveKillSwitch Action = "get_live_kill_switch"
// ActionSetLiveKillSwitch sets the live kill switch state (halt/resume).
ActionSetLiveKillSwitch Action = "set_live_kill_switch"
)
// validActions is the closed set used for strict dry-run validation.
@ -80,6 +86,9 @@ var validActions = map[Action]bool{
ActionSubmitLiveOrder: true,
ActionCancelLiveOrder: true,
ActionGetLiveOrder: true,
ActionGetLiveRiskPolicy: true,
ActionGetLiveKillSwitch: true,
ActionSetLiveKillSwitch: true,
}
// validOrderSides is the set of order side strings a submit_paper_order may use.
@ -282,6 +291,11 @@ type Request struct {
IdempotencyKey string `yaml:"idempotency_key"`
LiveOrderID string `yaml:"live_order_id"`
// Kill switch fields. Halted sets the kill switch state for set_live_kill_switch.
// KillSwitchReason is the reason message carried with the state change.
Halted bool `yaml:"halted"`
KillSwitchReason string `yaml:"kill_switch_reason"`
// PollingInterval configures how often the runner polls for updates.
PollingInterval Duration `yaml:"polling_interval"`
// PollingTimeout configures the maximum time to wait during polling.
@ -540,6 +554,18 @@ func validateRequest(step Step) error {
if strings.TrimSpace(step.Request.LiveOrderID) == "" {
return fmt.Errorf("step %q: get_live_order requires request.live_order_id", step.ID)
}
case ActionGetLiveRiskPolicy:
if step.Request.AccountID == "" {
return fmt.Errorf("step %q: get_live_risk_policy requires request.account_id", step.ID)
}
case ActionGetLiveKillSwitch:
if step.Request.AccountID == "" {
return fmt.Errorf("step %q: get_live_kill_switch requires request.account_id", step.ID)
}
case ActionSetLiveKillSwitch:
if step.Request.AccountID == "" {
return fmt.Errorf("step %q: set_live_kill_switch requires request.account_id", step.ID)
}
case ActionImportDailyBars:
if step.Request.Provider == "" {
return fmt.Errorf("step %q: import_daily_bars requires request.provider", step.ID)

5
apps/cli/testdata/operator/expected/live_risk_kill_switch.jsonl vendored Normal file
View file

@ -0,0 +1,5 @@
{"action":"get_live_risk_policy","allow_short_selling":false,"max_daily_orders":5,"max_open_orders":3,"scenario":"live_risk_kill_switch","status":"ok","step":"get_policy","type":"step"}
{"action":"get_live_kill_switch","kill_switch_halted":true,"kill_switch_reason":"kill switch active by default","scenario":"live_risk_kill_switch","status":"ok","step":"get_ks_halted","type":"step"}
{"action":"submit_live_order","error_code":"invalid_request","live_order_id":"lo-live-acct-1-1","live_order_status":"rejected","risk_decision_allowed":false,"risk_decision_reason":"kill switch is active","scenario":"live_risk_kill_switch","status":"ok","step":"submit_risk_blocked","type":"step"}
{"action":"set_live_kill_switch","kill_switch_halted":false,"kill_switch_reason":"operator cleared for trading session","scenario":"live_risk_kill_switch","status":"ok","step":"clear_ks","type":"step"}
{"exit_code":0,"passed":4,"scenario":"live_risk_kill_switch","status":"ok","steps":4,"type":"summary"}

1
apps/cli/testdata/operator/headless_validation.md vendored
View file

@ -40,6 +40,7 @@ ALT 운영 UI 게이트(`agent-ops/rules/project/rules.md`의 "운영 UI 구현
| `paper_trading_state` | `alt operator scenario run --file testdata/operator/paper_trading_state.yaml --api-url ws://127.0.0.1:18030/socket --output jsonl` | `testdata/operator/paper_trading_state.yaml` | `testdata/operator/expected/paper_trading_state.jsonl` | `scenario`, `status`, `type`, `action`, `account_id`, `run_id`, `run_status`, `cash`, `equity_point_count`, `fill_count`, `latest_equity`, `position_count`, `risk` | `0` (성공/terminal 도착), `1` (typed error/mismatch) | yes | paper trading dashboard (account 상태/포지션/평가금액/리스크) | `StartPaperTradingResponse.run.id`, `run_status`; `GetPaperTradingStateResponse.account_id`, `cash`, `equity_point_count`, `fill_count`, `latest_equity`, `position_count`, `risk_rejections`; summary `status`/`exit_code` | Flutter dashboard 레이아웃 미정 |
| `paper_order_lifecycle` | `alt operator scenario run --file testdata/operator/paper_order_lifecycle.yaml --api-url ws://127.0.0.1:18030/socket --output jsonl` | `testdata/operator/paper_order_lifecycle.yaml` | `testdata/operator/expected/paper_order_lifecycle.jsonl` | `scenario`, `status`, `type`, `action`, `account_id`, `run_id`, `run_status`, `cash`, `equity_point_count`, `fill_count`, `latest_equity`, `position_count`, `risk`, `order_id`, `order_status`, `fill_price` | `0` (성공/terminal 도착), `1` (typed error/mismatch) | yes | paper order management list (주문 상태/체결가/취소) | `StartPaperTradingResponse.run.id`, `run_status`; `SubmitPaperOrderResponse.order.id`, `order_status`; `FillPaperOrderResponse.fill_price`, `order_status`; `CancelPaperOrderResponse.order_status`; `GetPaperTradingStateResponse.account_id`, `cash`, `fill_count`; summary `status`/`exit_code` | Flutter 주문 목록/상세 레이아웃 미정 |
| `live_order_lifecycle` | `alt operator scenario run --file testdata/operator/live_order_lifecycle.yaml --api-url ws://127.0.0.1:18030/socket --output jsonl` | `testdata/operator/live_order_lifecycle.yaml` | `testdata/operator/expected/live_order_lifecycle.jsonl` | `scenario`, `status`, `type`, `action`, `live_order_id`, `live_order_status`, `broker_order_id`, `broker_status`, `operator_confirmed` | `0` (성공/operator gate 통과), `1` (typed error/confirmation missing/mismatch) | yes | live order management (실주문 상태/취소/브로커 상태) | `SubmitLiveOrderResponse.order.id`, `order.status`, `order.broker_id`, `order.broker_status`; `OperatorConfirmation.confirmed`; `CancelLiveOrderResponse.order.status`; `GetLiveOrderResponse.order.status`; summary `status`/`exit_code` | Flutter 실주문 목록/상세 레이아웃 미정 |
| `live_risk_kill_switch` | `alt operator scenario run --file testdata/operator/live_risk_kill_switch.yaml --api-url ws://127.0.0.1:18030/socket --output jsonl` | `testdata/operator/live_risk_kill_switch.yaml` | `testdata/operator/expected/live_risk_kill_switch.jsonl` | `scenario`, `status`, `type`, `action`, `max_daily_orders`, `max_open_orders`, `allow_short_selling`, `kill_switch_halted`, `kill_switch_reason` | `0` (성공/정책 조회·킬스위치 해제), `1` (typed error/mismatch) | yes | live risk 제어 패널 (정책 표시·킬스위치 토글) | `GetLiveRiskPolicyResponse.policy.max_daily_orders`, `max_open_orders`, `allow_short_selling`; `GetLiveKillSwitchResponse.state.halted`, `state.reason`; `SetLiveKillSwitchResponse.state.halted`, `state.reason`; summary `status`/`exit_code` | Flutter 킬스위치 토글·정책 표시 레이아웃 미정 |
## Exit code 계약 보강 노트

36
apps/cli/testdata/operator/live_risk_kill_switch.yaml vendored Normal file
View file

@ -0,0 +1,36 @@
name: live_risk_kill_switch
timeout: 10s
steps:
- id: get_policy
action: get_live_risk_policy
request:
account_id: live-acct-1
expect:
status: ok
- id: get_ks_halted
action: get_live_kill_switch
request:
account_id: live-acct-1
expect:
status: ok
- id: submit_risk_blocked
action: submit_live_order
request:
account_id: live-acct-1
instrument_id: KRX:005930
side: buy
quantity: "1"
order_type: market
operator_confirmed: true
operator_id: operator-1
expect:
status: error
error_code: invalid_request
- id: clear_ks
action: set_live_kill_switch
request:
account_id: live-acct-1
halted: false
kill_switch_reason: "operator cleared for trading session"
expect:
status: ok

18
apps/client/lib/src/contracts/alt_contracts.dart
View file

@ -74,5 +74,23 @@ Map<String, GeneratedMessage Function(List<int>)> altParserMap() {
GetLiveOrderRequest.fromBuffer,
GetLiveOrderResponse.getDefault().info_.qualifiedMessageName:
GetLiveOrderResponse.fromBuffer,
GetLiveRiskPolicyRequest.getDefault().info_.qualifiedMessageName:
GetLiveRiskPolicyRequest.fromBuffer,
GetLiveRiskPolicyResponse.getDefault().info_.qualifiedMessageName:
GetLiveRiskPolicyResponse.fromBuffer,
LiveRiskPolicy.getDefault().info_.qualifiedMessageName:
LiveRiskPolicy.fromBuffer,
GetLiveKillSwitchRequest.getDefault().info_.qualifiedMessageName:
GetLiveKillSwitchRequest.fromBuffer,
GetLiveKillSwitchResponse.getDefault().info_.qualifiedMessageName:
GetLiveKillSwitchResponse.fromBuffer,
SetLiveKillSwitchRequest.getDefault().info_.qualifiedMessageName:
SetLiveKillSwitchRequest.fromBuffer,
SetLiveKillSwitchResponse.getDefault().info_.qualifiedMessageName:
SetLiveKillSwitchResponse.fromBuffer,
LiveKillSwitchState.getDefault().info_.qualifiedMessageName:
LiveKillSwitchState.fromBuffer,
LiveRiskDecision.getDefault().info_.qualifiedMessageName:
LiveRiskDecision.fromBuffer,
};
}

667
apps/client/lib/src/generated/alt/v1/live_trading.pb.dart
View file

@ -1259,15 +1259,89 @@ class SubmitLiveOrderRequest extends $pb.GeneratedMessage {
void clearIdempotencyKey() => $_clearField(4);
}
/// LiveRiskDecision carries the outcome of a risk policy evaluation for a live
/// order submission. It is included in SubmitLiveOrderResponse when the risk
/// guard blocked the order so headless operators can surface the denial reason
/// alongside the rejected order record.
class LiveRiskDecision extends $pb.GeneratedMessage {
factory LiveRiskDecision({
$core.bool? allowed,
$core.String? reason,
}) {
final result = create();
if (allowed != null) result.allowed = allowed;
if (reason != null) result.reason = reason;
return result;
}
LiveRiskDecision._();
factory LiveRiskDecision.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory LiveRiskDecision.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'LiveRiskDecision',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOB(1, _omitFieldNames ? '' : 'allowed')
..aOS(2, _omitFieldNames ? '' : 'reason')
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
LiveRiskDecision clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
LiveRiskDecision copyWith(void Function(LiveRiskDecision) updates) =>
super.copyWith((message) => updates(message as LiveRiskDecision))
as LiveRiskDecision;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static LiveRiskDecision create() => LiveRiskDecision._();
@$core.override
LiveRiskDecision createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static LiveRiskDecision getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<LiveRiskDecision>(create);
static LiveRiskDecision? _defaultInstance;
@$pb.TagNumber(1)
$core.bool get allowed => $_getBF(0);
@$pb.TagNumber(1)
set allowed($core.bool value) => $_setBool(0, value);
@$pb.TagNumber(1)
$core.bool hasAllowed() => $_has(0);
@$pb.TagNumber(1)
void clearAllowed() => $_clearField(1);
@$pb.TagNumber(2)
$core.String get reason => $_getSZ(1);
@$pb.TagNumber(2)
set reason($core.String value) => $_setString(1, value);
@$pb.TagNumber(2)
$core.bool hasReason() => $_has(1);
@$pb.TagNumber(2)
void clearReason() => $_clearField(2);
}
/// SubmitLiveOrderResponse carries the submitted live order or a typed error.
/// When the order was blocked by the risk policy, order carries the rejected
/// in-memory record and risk_decision carries the denial reason.
class SubmitLiveOrderResponse extends $pb.GeneratedMessage {
factory SubmitLiveOrderResponse({
LiveOrder? order,
$0.ErrorInfo? error,
LiveRiskDecision? riskDecision,
}) {
final result = create();
if (order != null) result.order = order;
if (error != null) result.error = error;
if (riskDecision != null) result.riskDecision = riskDecision;
return result;
}
@ -1288,6 +1362,8 @@ class SubmitLiveOrderResponse extends $pb.GeneratedMessage {
subBuilder: LiveOrder.create)
..aOM<$0.ErrorInfo>(2, _omitFieldNames ? '' : 'error',
subBuilder: $0.ErrorInfo.create)
..aOM<LiveRiskDecision>(3, _omitFieldNames ? '' : 'riskDecision',
subBuilder: LiveRiskDecision.create)
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
@ -1331,6 +1407,17 @@ class SubmitLiveOrderResponse extends $pb.GeneratedMessage {
void clearError() => $_clearField(2);
@$pb.TagNumber(2)
$0.ErrorInfo ensureError() => $_ensure(1);
@$pb.TagNumber(3)
LiveRiskDecision get riskDecision => $_getN(2);
@$pb.TagNumber(3)
set riskDecision(LiveRiskDecision value) => $_setField(3, value);
@$pb.TagNumber(3)
$core.bool hasRiskDecision() => $_has(2);
@$pb.TagNumber(3)
void clearRiskDecision() => $_clearField(3);
@$pb.TagNumber(3)
LiveRiskDecision ensureRiskDecision() => $_ensure(2);
}
/// CancelLiveOrderRequest cancels a pending live order by its live order id.
@ -1615,6 +1702,586 @@ class GetLiveOrderResponse extends $pb.GeneratedMessage {
$0.ErrorInfo ensureError() => $_ensure(1);
}
/// LiveRiskPolicy describes the active risk limits applied before any live order
/// reaches the broker. All limits are adjustable at runtime; a zero value for
/// a numeric limit means the limit is not enforced.
class LiveRiskPolicy extends $pb.GeneratedMessage {
factory LiveRiskPolicy({
$core.Iterable<$core.MapEntry<$core.String, $core.String>>?
maxOrderNotionalByCurrency,
$core.int? maxDailyOrders,
$core.int? maxOpenOrders,
$core.bool? allowShortSelling,
}) {
final result = create();
if (maxOrderNotionalByCurrency != null)
result.maxOrderNotionalByCurrency.addEntries(maxOrderNotionalByCurrency);
if (maxDailyOrders != null) result.maxDailyOrders = maxDailyOrders;
if (maxOpenOrders != null) result.maxOpenOrders = maxOpenOrders;
if (allowShortSelling != null) result.allowShortSelling = allowShortSelling;
return result;
}
LiveRiskPolicy._();
factory LiveRiskPolicy.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory LiveRiskPolicy.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'LiveRiskPolicy',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..m<$core.String, $core.String>(
1, _omitFieldNames ? '' : 'maxOrderNotionalByCurrency',
entryClassName: 'LiveRiskPolicy.MaxOrderNotionalByCurrencyEntry',
keyFieldType: $pb.PbFieldType.OS,
valueFieldType: $pb.PbFieldType.OS,
packageName: const $pb.PackageName('alt.v1'))
..aI(2, _omitFieldNames ? '' : 'maxDailyOrders')
..aI(3, _omitFieldNames ? '' : 'maxOpenOrders')
..aOB(4, _omitFieldNames ? '' : 'allowShortSelling')
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
LiveRiskPolicy clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
LiveRiskPolicy copyWith(void Function(LiveRiskPolicy) updates) =>
super.copyWith((message) => updates(message as LiveRiskPolicy))
as LiveRiskPolicy;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static LiveRiskPolicy create() => LiveRiskPolicy._();
@$core.override
LiveRiskPolicy createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static LiveRiskPolicy getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<LiveRiskPolicy>(create);
static LiveRiskPolicy? _defaultInstance;
/// max_order_notional_by_currency maps a currency code (e.g. "KRW", "USD")
/// to the maximum allowed notional value per order as a decimal string.
@$pb.TagNumber(1)
$pb.PbMap<$core.String, $core.String> get maxOrderNotionalByCurrency =>
$_getMap(0);
@$pb.TagNumber(2)
$core.int get maxDailyOrders => $_getIZ(1);
@$pb.TagNumber(2)
set maxDailyOrders($core.int value) => $_setSignedInt32(1, value);
@$pb.TagNumber(2)
$core.bool hasMaxDailyOrders() => $_has(1);
@$pb.TagNumber(2)
void clearMaxDailyOrders() => $_clearField(2);
@$pb.TagNumber(3)
$core.int get maxOpenOrders => $_getIZ(2);
@$pb.TagNumber(3)
set maxOpenOrders($core.int value) => $_setSignedInt32(2, value);
@$pb.TagNumber(3)
$core.bool hasMaxOpenOrders() => $_has(2);
@$pb.TagNumber(3)
void clearMaxOpenOrders() => $_clearField(3);
@$pb.TagNumber(4)
$core.bool get allowShortSelling => $_getBF(3);
@$pb.TagNumber(4)
set allowShortSelling($core.bool value) => $_setBool(3, value);
@$pb.TagNumber(4)
$core.bool hasAllowShortSelling() => $_has(3);
@$pb.TagNumber(4)
void clearAllowShortSelling() => $_clearField(4);
}
/// LiveKillSwitchState captures whether live order submission is globally halted.
/// The safe default is halted=true; operators must explicitly disable the kill
/// switch before any live order can reach the broker.
class LiveKillSwitchState extends $pb.GeneratedMessage {
factory LiveKillSwitchState({
$core.bool? halted,
$core.String? reason,
}) {
final result = create();
if (halted != null) result.halted = halted;
if (reason != null) result.reason = reason;
return result;
}
LiveKillSwitchState._();
factory LiveKillSwitchState.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory LiveKillSwitchState.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'LiveKillSwitchState',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOB(1, _omitFieldNames ? '' : 'halted')
..aOS(2, _omitFieldNames ? '' : 'reason')
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
LiveKillSwitchState clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
LiveKillSwitchState copyWith(void Function(LiveKillSwitchState) updates) =>
super.copyWith((message) => updates(message as LiveKillSwitchState))
as LiveKillSwitchState;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static LiveKillSwitchState create() => LiveKillSwitchState._();
@$core.override
LiveKillSwitchState createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static LiveKillSwitchState getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<LiveKillSwitchState>(create);
static LiveKillSwitchState? _defaultInstance;
@$pb.TagNumber(1)
$core.bool get halted => $_getBF(0);
@$pb.TagNumber(1)
set halted($core.bool value) => $_setBool(0, value);
@$pb.TagNumber(1)
$core.bool hasHalted() => $_has(0);
@$pb.TagNumber(1)
void clearHalted() => $_clearField(1);
@$pb.TagNumber(2)
$core.String get reason => $_getSZ(1);
@$pb.TagNumber(2)
set reason($core.String value) => $_setString(1, value);
@$pb.TagNumber(2)
$core.bool hasReason() => $_has(1);
@$pb.TagNumber(2)
void clearReason() => $_clearField(2);
}
/// GetLiveRiskPolicyRequest queries the active risk policy for a live account.
class GetLiveRiskPolicyRequest extends $pb.GeneratedMessage {
factory GetLiveRiskPolicyRequest({
$core.String? accountId,
}) {
final result = create();
if (accountId != null) result.accountId = accountId;
return result;
}
GetLiveRiskPolicyRequest._();
factory GetLiveRiskPolicyRequest.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory GetLiveRiskPolicyRequest.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'GetLiveRiskPolicyRequest',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOS(1, _omitFieldNames ? '' : 'accountId')
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveRiskPolicyRequest clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveRiskPolicyRequest copyWith(
void Function(GetLiveRiskPolicyRequest) updates) =>
super.copyWith((message) => updates(message as GetLiveRiskPolicyRequest))
as GetLiveRiskPolicyRequest;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static GetLiveRiskPolicyRequest create() => GetLiveRiskPolicyRequest._();
@$core.override
GetLiveRiskPolicyRequest createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static GetLiveRiskPolicyRequest getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<GetLiveRiskPolicyRequest>(create);
static GetLiveRiskPolicyRequest? _defaultInstance;
@$pb.TagNumber(1)
$core.String get accountId => $_getSZ(0);
@$pb.TagNumber(1)
set accountId($core.String value) => $_setString(0, value);
@$pb.TagNumber(1)
$core.bool hasAccountId() => $_has(0);
@$pb.TagNumber(1)
void clearAccountId() => $_clearField(1);
}
/// GetLiveRiskPolicyResponse returns the active risk policy or a typed error.
class GetLiveRiskPolicyResponse extends $pb.GeneratedMessage {
factory GetLiveRiskPolicyResponse({
LiveRiskPolicy? policy,
$0.ErrorInfo? error,
}) {
final result = create();
if (policy != null) result.policy = policy;
if (error != null) result.error = error;
return result;
}
GetLiveRiskPolicyResponse._();
factory GetLiveRiskPolicyResponse.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory GetLiveRiskPolicyResponse.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'GetLiveRiskPolicyResponse',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOM<LiveRiskPolicy>(1, _omitFieldNames ? '' : 'policy',
subBuilder: LiveRiskPolicy.create)
..aOM<$0.ErrorInfo>(2, _omitFieldNames ? '' : 'error',
subBuilder: $0.ErrorInfo.create)
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveRiskPolicyResponse clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveRiskPolicyResponse copyWith(
void Function(GetLiveRiskPolicyResponse) updates) =>
super.copyWith((message) => updates(message as GetLiveRiskPolicyResponse))
as GetLiveRiskPolicyResponse;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static GetLiveRiskPolicyResponse create() => GetLiveRiskPolicyResponse._();
@$core.override
GetLiveRiskPolicyResponse createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static GetLiveRiskPolicyResponse getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<GetLiveRiskPolicyResponse>(create);
static GetLiveRiskPolicyResponse? _defaultInstance;
@$pb.TagNumber(1)
LiveRiskPolicy get policy => $_getN(0);
@$pb.TagNumber(1)
set policy(LiveRiskPolicy value) => $_setField(1, value);
@$pb.TagNumber(1)
$core.bool hasPolicy() => $_has(0);
@$pb.TagNumber(1)
void clearPolicy() => $_clearField(1);
@$pb.TagNumber(1)
LiveRiskPolicy ensurePolicy() => $_ensure(0);
@$pb.TagNumber(2)
$0.ErrorInfo get error => $_getN(1);
@$pb.TagNumber(2)
set error($0.ErrorInfo value) => $_setField(2, value);
@$pb.TagNumber(2)
$core.bool hasError() => $_has(1);
@$pb.TagNumber(2)
void clearError() => $_clearField(2);
@$pb.TagNumber(2)
$0.ErrorInfo ensureError() => $_ensure(1);
}
/// GetLiveKillSwitchRequest queries the current kill switch state.
class GetLiveKillSwitchRequest extends $pb.GeneratedMessage {
factory GetLiveKillSwitchRequest({
$core.String? accountId,
}) {
final result = create();
if (accountId != null) result.accountId = accountId;
return result;
}
GetLiveKillSwitchRequest._();
factory GetLiveKillSwitchRequest.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory GetLiveKillSwitchRequest.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'GetLiveKillSwitchRequest',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOS(1, _omitFieldNames ? '' : 'accountId')
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveKillSwitchRequest clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveKillSwitchRequest copyWith(
void Function(GetLiveKillSwitchRequest) updates) =>
super.copyWith((message) => updates(message as GetLiveKillSwitchRequest))
as GetLiveKillSwitchRequest;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static GetLiveKillSwitchRequest create() => GetLiveKillSwitchRequest._();
@$core.override
GetLiveKillSwitchRequest createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static GetLiveKillSwitchRequest getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<GetLiveKillSwitchRequest>(create);
static GetLiveKillSwitchRequest? _defaultInstance;
@$pb.TagNumber(1)
$core.String get accountId => $_getSZ(0);
@$pb.TagNumber(1)
set accountId($core.String value) => $_setString(0, value);
@$pb.TagNumber(1)
$core.bool hasAccountId() => $_has(0);
@$pb.TagNumber(1)
void clearAccountId() => $_clearField(1);
}
/// GetLiveKillSwitchResponse returns the current kill switch state or a typed error.
class GetLiveKillSwitchResponse extends $pb.GeneratedMessage {
factory GetLiveKillSwitchResponse({
LiveKillSwitchState? state,
$0.ErrorInfo? error,
}) {
final result = create();
if (state != null) result.state = state;
if (error != null) result.error = error;
return result;
}
GetLiveKillSwitchResponse._();
factory GetLiveKillSwitchResponse.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory GetLiveKillSwitchResponse.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'GetLiveKillSwitchResponse',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOM<LiveKillSwitchState>(1, _omitFieldNames ? '' : 'state',
subBuilder: LiveKillSwitchState.create)
..aOM<$0.ErrorInfo>(2, _omitFieldNames ? '' : 'error',
subBuilder: $0.ErrorInfo.create)
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveKillSwitchResponse clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
GetLiveKillSwitchResponse copyWith(
void Function(GetLiveKillSwitchResponse) updates) =>
super.copyWith((message) => updates(message as GetLiveKillSwitchResponse))
as GetLiveKillSwitchResponse;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static GetLiveKillSwitchResponse create() => GetLiveKillSwitchResponse._();
@$core.override
GetLiveKillSwitchResponse createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static GetLiveKillSwitchResponse getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<GetLiveKillSwitchResponse>(create);
static GetLiveKillSwitchResponse? _defaultInstance;
@$pb.TagNumber(1)
LiveKillSwitchState get state => $_getN(0);
@$pb.TagNumber(1)
set state(LiveKillSwitchState value) => $_setField(1, value);
@$pb.TagNumber(1)
$core.bool hasState() => $_has(0);
@$pb.TagNumber(1)
void clearState() => $_clearField(1);
@$pb.TagNumber(1)
LiveKillSwitchState ensureState() => $_ensure(0);
@$pb.TagNumber(2)
$0.ErrorInfo get error => $_getN(1);
@$pb.TagNumber(2)
set error($0.ErrorInfo value) => $_setField(2, value);
@$pb.TagNumber(2)
$core.bool hasError() => $_has(1);
@$pb.TagNumber(2)
void clearError() => $_clearField(2);
@$pb.TagNumber(2)
$0.ErrorInfo ensureError() => $_ensure(1);
}
/// SetLiveKillSwitchRequest sets the kill switch to halted or unhalted.
class SetLiveKillSwitchRequest extends $pb.GeneratedMessage {
factory SetLiveKillSwitchRequest({
$core.String? accountId,
$core.bool? halted,
$core.String? reason,
}) {
final result = create();
if (accountId != null) result.accountId = accountId;
if (halted != null) result.halted = halted;
if (reason != null) result.reason = reason;
return result;
}
SetLiveKillSwitchRequest._();
factory SetLiveKillSwitchRequest.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory SetLiveKillSwitchRequest.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'SetLiveKillSwitchRequest',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOS(1, _omitFieldNames ? '' : 'accountId')
..aOB(2, _omitFieldNames ? '' : 'halted')
..aOS(3, _omitFieldNames ? '' : 'reason')
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
SetLiveKillSwitchRequest clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
SetLiveKillSwitchRequest copyWith(
void Function(SetLiveKillSwitchRequest) updates) =>
super.copyWith((message) => updates(message as SetLiveKillSwitchRequest))
as SetLiveKillSwitchRequest;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static SetLiveKillSwitchRequest create() => SetLiveKillSwitchRequest._();
@$core.override
SetLiveKillSwitchRequest createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static SetLiveKillSwitchRequest getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<SetLiveKillSwitchRequest>(create);
static SetLiveKillSwitchRequest? _defaultInstance;
@$pb.TagNumber(1)
$core.String get accountId => $_getSZ(0);
@$pb.TagNumber(1)
set accountId($core.String value) => $_setString(0, value);
@$pb.TagNumber(1)
$core.bool hasAccountId() => $_has(0);
@$pb.TagNumber(1)
void clearAccountId() => $_clearField(1);
@$pb.TagNumber(2)
$core.bool get halted => $_getBF(1);
@$pb.TagNumber(2)
set halted($core.bool value) => $_setBool(1, value);
@$pb.TagNumber(2)
$core.bool hasHalted() => $_has(1);
@$pb.TagNumber(2)
void clearHalted() => $_clearField(2);
@$pb.TagNumber(3)
$core.String get reason => $_getSZ(2);
@$pb.TagNumber(3)
set reason($core.String value) => $_setString(2, value);
@$pb.TagNumber(3)
$core.bool hasReason() => $_has(2);
@$pb.TagNumber(3)
void clearReason() => $_clearField(3);
}
/// SetLiveKillSwitchResponse returns the new kill switch state or a typed error.
class SetLiveKillSwitchResponse extends $pb.GeneratedMessage {
factory SetLiveKillSwitchResponse({
LiveKillSwitchState? state,
$0.ErrorInfo? error,
}) {
final result = create();
if (state != null) result.state = state;
if (error != null) result.error = error;
return result;
}
SetLiveKillSwitchResponse._();
factory SetLiveKillSwitchResponse.fromBuffer($core.List<$core.int> data,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromBuffer(data, registry);
factory SetLiveKillSwitchResponse.fromJson($core.String json,
[$pb.ExtensionRegistry registry = $pb.ExtensionRegistry.EMPTY]) =>
create()..mergeFromJson(json, registry);
static final $pb.BuilderInfo _i = $pb.BuilderInfo(
_omitMessageNames ? '' : 'SetLiveKillSwitchResponse',
package: const $pb.PackageName(_omitMessageNames ? '' : 'alt.v1'),
createEmptyInstance: create)
..aOM<LiveKillSwitchState>(1, _omitFieldNames ? '' : 'state',
subBuilder: LiveKillSwitchState.create)
..aOM<$0.ErrorInfo>(2, _omitFieldNames ? '' : 'error',
subBuilder: $0.ErrorInfo.create)
..hasRequiredFields = false;
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
SetLiveKillSwitchResponse clone() => deepCopy();
@$core.Deprecated('See https://github.com/google/protobuf.dart/issues/998.')
SetLiveKillSwitchResponse copyWith(
void Function(SetLiveKillSwitchResponse) updates) =>
super.copyWith((message) => updates(message as SetLiveKillSwitchResponse))
as SetLiveKillSwitchResponse;
@$core.override
$pb.BuilderInfo get info_ => _i;
@$core.pragma('dart2js:noInline')
static SetLiveKillSwitchResponse create() => SetLiveKillSwitchResponse._();
@$core.override
SetLiveKillSwitchResponse createEmptyInstance() => create();
@$core.pragma('dart2js:noInline')
static SetLiveKillSwitchResponse getDefault() => _defaultInstance ??=
$pb.GeneratedMessage.$_defaultFor<SetLiveKillSwitchResponse>(create);
static SetLiveKillSwitchResponse? _defaultInstance;
@$pb.TagNumber(1)
LiveKillSwitchState get state => $_getN(0);
@$pb.TagNumber(1)
set state(LiveKillSwitchState value) => $_setField(1, value);
@$pb.TagNumber(1)
$core.bool hasState() => $_has(0);
@$pb.TagNumber(1)
void clearState() => $_clearField(1);
@$pb.TagNumber(1)
LiveKillSwitchState ensureState() => $_ensure(0);
@$pb.TagNumber(2)
$0.ErrorInfo get error => $_getN(1);
@$pb.TagNumber(2)
set error($0.ErrorInfo value) => $_setField(2, value);
@$pb.TagNumber(2)
$core.bool hasError() => $_has(1);
@$pb.TagNumber(2)
void clearError() => $_clearField(2);
@$pb.TagNumber(2)
$0.ErrorInfo ensureError() => $_ensure(1);
}
const $core.bool _omitFieldNames =
$core.bool.fromEnvironment('protobuf.omit_field_names');
const $core.bool _omitMessageNames =

216
apps/client/lib/src/generated/alt/v1/live_trading.pbjson.dart
View file

@ -432,6 +432,20 @@ final $typed_data.Uint8List submitLiveOrderRequestDescriptor = $convert.base64De
'RvcGVyYXRvckNvbmZpcm1hdGlvbhInCg9pZGVtcG90ZW5jeV9rZXkYBCABKAlSDmlkZW1wb3Rl'
'bmN5S2V5');
@$core.Deprecated('Use liveRiskDecisionDescriptor instead')
const LiveRiskDecision$json = {
'1': 'LiveRiskDecision',
'2': [
{'1': 'allowed', '3': 1, '4': 1, '5': 8, '10': 'allowed'},
{'1': 'reason', '3': 2, '4': 1, '5': 9, '10': 'reason'},
],
};
/// Descriptor for `LiveRiskDecision`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List liveRiskDecisionDescriptor = $convert.base64Decode(
'ChBMaXZlUmlza0RlY2lzaW9uEhgKB2FsbG93ZWQYASABKAhSB2FsbG93ZWQSFgoGcmVhc29uGA'
'IgASgJUgZyZWFzb24=');
@$core.Deprecated('Use submitLiveOrderResponseDescriptor instead')
const SubmitLiveOrderResponse$json = {
'1': 'SubmitLiveOrderResponse',
@ -452,13 +466,23 @@ const SubmitLiveOrderResponse$json = {
'6': '.alt.v1.ErrorInfo',
'10': 'error'
},
{
'1': 'risk_decision',
'3': 3,
'4': 1,
'5': 11,
'6': '.alt.v1.LiveRiskDecision',
'10': 'riskDecision'
},
],
};
/// Descriptor for `SubmitLiveOrderResponse`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List submitLiveOrderResponseDescriptor = $convert.base64Decode(
'ChdTdWJtaXRMaXZlT3JkZXJSZXNwb25zZRInCgVvcmRlchgBIAEoCzIRLmFsdC52MS5MaXZlT3'
'JkZXJSBW9yZGVyEicKBWVycm9yGAIgASgLMhEuYWx0LnYxLkVycm9ySW5mb1IFZXJyb3I=');
'JkZXJSBW9yZGVyEicKBWVycm9yGAIgASgLMhEuYWx0LnYxLkVycm9ySW5mb1IFZXJyb3ISPQoN'
'cmlza19kZWNpc2lvbhgDIAEoCzIYLmFsdC52MS5MaXZlUmlza0RlY2lzaW9uUgxyaXNrRGVjaX'
'Npb24=');
@$core.Deprecated('Use cancelLiveOrderRequestDescriptor instead')
const CancelLiveOrderRequest$json = {
@ -544,3 +568,193 @@ const GetLiveOrderResponse$json = {
final $typed_data.Uint8List getLiveOrderResponseDescriptor = $convert.base64Decode(
'ChRHZXRMaXZlT3JkZXJSZXNwb25zZRInCgVvcmRlchgBIAEoCzIRLmFsdC52MS5MaXZlT3JkZX'
'JSBW9yZGVyEicKBWVycm9yGAIgASgLMhEuYWx0LnYxLkVycm9ySW5mb1IFZXJyb3I=');
@$core.Deprecated('Use liveRiskPolicyDescriptor instead')
const LiveRiskPolicy$json = {
'1': 'LiveRiskPolicy',
'2': [
{
'1': 'max_order_notional_by_currency',
'3': 1,
'4': 3,
'5': 11,
'6': '.alt.v1.LiveRiskPolicy.MaxOrderNotionalByCurrencyEntry',
'10': 'maxOrderNotionalByCurrency'
},
{'1': 'max_daily_orders', '3': 2, '4': 1, '5': 5, '10': 'maxDailyOrders'},
{'1': 'max_open_orders', '3': 3, '4': 1, '5': 5, '10': 'maxOpenOrders'},
{
'1': 'allow_short_selling',
'3': 4,
'4': 1,
'5': 8,
'10': 'allowShortSelling'
},
],
'3': [LiveRiskPolicy_MaxOrderNotionalByCurrencyEntry$json],
};
@$core.Deprecated('Use liveRiskPolicyDescriptor instead')
const LiveRiskPolicy_MaxOrderNotionalByCurrencyEntry$json = {
'1': 'MaxOrderNotionalByCurrencyEntry',
'2': [
{'1': 'key', '3': 1, '4': 1, '5': 9, '10': 'key'},
{'1': 'value', '3': 2, '4': 1, '5': 9, '10': 'value'},
],
'7': {'7': true},
};
/// Descriptor for `LiveRiskPolicy`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List liveRiskPolicyDescriptor = $convert.base64Decode(
'Cg5MaXZlUmlza1BvbGljeRJ6Ch5tYXhfb3JkZXJfbm90aW9uYWxfYnlfY3VycmVuY3kYASADKA'
'syNi5hbHQudjEuTGl2ZVJpc2tQb2xpY3kuTWF4T3JkZXJOb3Rpb25hbEJ5Q3VycmVuY3lFbnRy'
'eVIabWF4T3JkZXJOb3Rpb25hbEJ5Q3VycmVuY3kSKAoQbWF4X2RhaWx5X29yZGVycxgCIAEoBV'
'IObWF4RGFpbHlPcmRlcnMSJgoPbWF4X29wZW5fb3JkZXJzGAMgASgFUg1tYXhPcGVuT3JkZXJz'
'Ei4KE2FsbG93X3Nob3J0X3NlbGxpbmcYBCABKAhSEWFsbG93U2hvcnRTZWxsaW5nGk0KH01heE'
'9yZGVyTm90aW9uYWxCeUN1cnJlbmN5RW50cnkSEAoDa2V5GAEgASgJUgNrZXkSFAoFdmFsdWUY'
'AiABKAlSBXZhbHVlOgI4AQ==');
@$core.Deprecated('Use liveKillSwitchStateDescriptor instead')
const LiveKillSwitchState$json = {
'1': 'LiveKillSwitchState',
'2': [
{'1': 'halted', '3': 1, '4': 1, '5': 8, '10': 'halted'},
{'1': 'reason', '3': 2, '4': 1, '5': 9, '10': 'reason'},
],
};
/// Descriptor for `LiveKillSwitchState`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List liveKillSwitchStateDescriptor = $convert.base64Decode(
'ChNMaXZlS2lsbFN3aXRjaFN0YXRlEhYKBmhhbHRlZBgBIAEoCFIGaGFsdGVkEhYKBnJlYXNvbh'
'gCIAEoCVIGcmVhc29u');
@$core.Deprecated('Use getLiveRiskPolicyRequestDescriptor instead')
const GetLiveRiskPolicyRequest$json = {
'1': 'GetLiveRiskPolicyRequest',
'2': [
{'1': 'account_id', '3': 1, '4': 1, '5': 9, '10': 'accountId'},
],
};
/// Descriptor for `GetLiveRiskPolicyRequest`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List getLiveRiskPolicyRequestDescriptor =
$convert.base64Decode(
'ChhHZXRMaXZlUmlza1BvbGljeVJlcXVlc3QSHQoKYWNjb3VudF9pZBgBIAEoCVIJYWNjb3VudE'
'lk');
@$core.Deprecated('Use getLiveRiskPolicyResponseDescriptor instead')
const GetLiveRiskPolicyResponse$json = {
'1': 'GetLiveRiskPolicyResponse',
'2': [
{
'1': 'policy',
'3': 1,
'4': 1,
'5': 11,
'6': '.alt.v1.LiveRiskPolicy',
'10': 'policy'
},
{
'1': 'error',
'3': 2,
'4': 1,
'5': 11,
'6': '.alt.v1.ErrorInfo',
'10': 'error'
},
],
};
/// Descriptor for `GetLiveRiskPolicyResponse`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List getLiveRiskPolicyResponseDescriptor = $convert.base64Decode(
'ChlHZXRMaXZlUmlza1BvbGljeVJlc3BvbnNlEi4KBnBvbGljeRgBIAEoCzIWLmFsdC52MS5MaX'
'ZlUmlza1BvbGljeVIGcG9saWN5EicKBWVycm9yGAIgASgLMhEuYWx0LnYxLkVycm9ySW5mb1IF'
'ZXJyb3I=');
@$core.Deprecated('Use getLiveKillSwitchRequestDescriptor instead')
const GetLiveKillSwitchRequest$json = {
'1': 'GetLiveKillSwitchRequest',
'2': [
{'1': 'account_id', '3': 1, '4': 1, '5': 9, '10': 'accountId'},
],
};
/// Descriptor for `GetLiveKillSwitchRequest`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List getLiveKillSwitchRequestDescriptor =
$convert.base64Decode(
'ChhHZXRMaXZlS2lsbFN3aXRjaFJlcXVlc3QSHQoKYWNjb3VudF9pZBgBIAEoCVIJYWNjb3VudE'
'lk');
@$core.Deprecated('Use getLiveKillSwitchResponseDescriptor instead')
const GetLiveKillSwitchResponse$json = {
'1': 'GetLiveKillSwitchResponse',
'2': [
{
'1': 'state',
'3': 1,
'4': 1,
'5': 11,
'6': '.alt.v1.LiveKillSwitchState',
'10': 'state'
},
{
'1': 'error',
'3': 2,
'4': 1,
'5': 11,
'6': '.alt.v1.ErrorInfo',
'10': 'error'
},
],
};
/// Descriptor for `GetLiveKillSwitchResponse`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List getLiveKillSwitchResponseDescriptor = $convert.base64Decode(
'ChlHZXRMaXZlS2lsbFN3aXRjaFJlc3BvbnNlEjEKBXN0YXRlGAEgASgLMhsuYWx0LnYxLkxpdm'
'VLaWxsU3dpdGNoU3RhdGVSBXN0YXRlEicKBWVycm9yGAIgASgLMhEuYWx0LnYxLkVycm9ySW5m'
'b1IFZXJyb3I=');
@$core.Deprecated('Use setLiveKillSwitchRequestDescriptor instead')
const SetLiveKillSwitchRequest$json = {
'1': 'SetLiveKillSwitchRequest',
'2': [
{'1': 'account_id', '3': 1, '4': 1, '5': 9, '10': 'accountId'},
{'1': 'halted', '3': 2, '4': 1, '5': 8, '10': 'halted'},
{'1': 'reason', '3': 3, '4': 1, '5': 9, '10': 'reason'},
],
};
/// Descriptor for `SetLiveKillSwitchRequest`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List setLiveKillSwitchRequestDescriptor =
$convert.base64Decode(
'ChhTZXRMaXZlS2lsbFN3aXRjaFJlcXVlc3QSHQoKYWNjb3VudF9pZBgBIAEoCVIJYWNjb3VudE'
'lkEhYKBmhhbHRlZBgCIAEoCFIGaGFsdGVkEhYKBnJlYXNvbhgDIAEoCVIGcmVhc29u');
@$core.Deprecated('Use setLiveKillSwitchResponseDescriptor instead')
const SetLiveKillSwitchResponse$json = {
'1': 'SetLiveKillSwitchResponse',
'2': [
{
'1': 'state',
'3': 1,
'4': 1,
'5': 11,
'6': '.alt.v1.LiveKillSwitchState',
'10': 'state'
},
{
'1': 'error',
'3': 2,
'4': 1,
'5': 11,
'6': '.alt.v1.ErrorInfo',
'10': 'error'
},
],
};
/// Descriptor for `SetLiveKillSwitchResponse`. Decode as a `google.protobuf.DescriptorProto`.
final $typed_data.Uint8List setLiveKillSwitchResponseDescriptor = $convert.base64Decode(
'ChlTZXRMaXZlS2lsbFN3aXRjaFJlc3BvbnNlEjEKBXN0YXRlGAEgASgLMhsuYWx0LnYxLkxpdm'
'VLaWxsU3dpdGNoU3RhdGVSBXN0YXRlEicKBWVycm9yGAIgASgLMhEuYWx0LnYxLkVycm9ySW5m'
'b1IFZXJyb3I=');

11
apps/client/test/contracts/alt_contracts_test.dart
View file

@ -47,9 +47,18 @@ void main() {
CancelLiveOrderResponse(),
GetLiveOrderRequest(),
GetLiveOrderResponse(),
GetLiveRiskPolicyRequest(),
GetLiveRiskPolicyResponse(),
LiveRiskPolicy(),
GetLiveKillSwitchRequest(),
GetLiveKillSwitchResponse(),
SetLiveKillSwitchRequest(),
SetLiveKillSwitchResponse(),
LiveKillSwitchState(),
LiveRiskDecision(),
];
expect(parsers.length, equals(33));
expect(parsers.length, equals(42));
for (final msg in expectedMessages) {
final qualifiedName = msg.info_.qualifiedMessageName;

679
packages/contracts/gen/go/alt/v1/live_trading.pb.go
View file

@ -902,18 +902,77 @@ func (x *SubmitLiveOrderRequest) GetIdempotencyKey() string {
return ""
}
// LiveRiskDecision carries the outcome of a risk policy evaluation for a live
// order submission. It is included in SubmitLiveOrderResponse when the risk
// guard blocked the order so headless operators can surface the denial reason
// alongside the rejected order record.
type LiveRiskDecision struct {
state protoimpl.MessageState `protogen:"open.v1"`
Allowed bool `protobuf:"varint,1,opt,name=allowed,proto3" json:"allowed,omitempty"`
Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *LiveRiskDecision) Reset() {
*x = LiveRiskDecision{}
mi := &file_alt_v1_live_trading_proto_msgTypes[10]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *LiveRiskDecision) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*LiveRiskDecision) ProtoMessage() {}
func (x *LiveRiskDecision) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[10]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use LiveRiskDecision.ProtoReflect.Descriptor instead.
func (*LiveRiskDecision) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{10}
}
func (x *LiveRiskDecision) GetAllowed() bool {
if x != nil {
return x.Allowed
}
return false
}
func (x *LiveRiskDecision) GetReason() string {
if x != nil {
return x.Reason
}
return ""
}
// SubmitLiveOrderResponse carries the submitted live order or a typed error.
// When the order was blocked by the risk policy, order carries the rejected
// in-memory record and risk_decision carries the denial reason.
type SubmitLiveOrderResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
Order *LiveOrder `protobuf:"bytes,1,opt,name=order,proto3" json:"order,omitempty"`
Error *ErrorInfo `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
RiskDecision *LiveRiskDecision `protobuf:"bytes,3,opt,name=risk_decision,json=riskDecision,proto3" json:"risk_decision,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *SubmitLiveOrderResponse) Reset() {
*x = SubmitLiveOrderResponse{}
mi := &file_alt_v1_live_trading_proto_msgTypes[10]
mi := &file_alt_v1_live_trading_proto_msgTypes[11]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@ -925,7 +984,7 @@ func (x *SubmitLiveOrderResponse) String() string {
func (*SubmitLiveOrderResponse) ProtoMessage() {}
func (x *SubmitLiveOrderResponse) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[10]
mi := &file_alt_v1_live_trading_proto_msgTypes[11]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@ -938,7 +997,7 @@ func (x *SubmitLiveOrderResponse) ProtoReflect() protoreflect.Message {
// Deprecated: Use SubmitLiveOrderResponse.ProtoReflect.Descriptor instead.
func (*SubmitLiveOrderResponse) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{10}
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{11}
}
func (x *SubmitLiveOrderResponse) GetOrder() *LiveOrder {
@ -955,6 +1014,13 @@ func (x *SubmitLiveOrderResponse) GetError() *ErrorInfo {
return nil
}
func (x *SubmitLiveOrderResponse) GetRiskDecision() *LiveRiskDecision {
if x != nil {
return x.RiskDecision
}
return nil
}
// CancelLiveOrderRequest cancels a pending live order by its live order id.
type CancelLiveOrderRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
@ -966,7 +1032,7 @@ type CancelLiveOrderRequest struct {
func (x *CancelLiveOrderRequest) Reset() {
*x = CancelLiveOrderRequest{}
mi := &file_alt_v1_live_trading_proto_msgTypes[11]
mi := &file_alt_v1_live_trading_proto_msgTypes[12]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@ -978,7 +1044,7 @@ func (x *CancelLiveOrderRequest) String() string {
func (*CancelLiveOrderRequest) ProtoMessage() {}
func (x *CancelLiveOrderRequest) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[11]
mi := &file_alt_v1_live_trading_proto_msgTypes[12]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@ -991,7 +1057,7 @@ func (x *CancelLiveOrderRequest) ProtoReflect() protoreflect.Message {
// Deprecated: Use CancelLiveOrderRequest.ProtoReflect.Descriptor instead.
func (*CancelLiveOrderRequest) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{11}
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{12}
}
func (x *CancelLiveOrderRequest) GetAccountId() string {
@ -1019,7 +1085,7 @@ type CancelLiveOrderResponse struct {
func (x *CancelLiveOrderResponse) Reset() {
*x = CancelLiveOrderResponse{}
mi := &file_alt_v1_live_trading_proto_msgTypes[12]
mi := &file_alt_v1_live_trading_proto_msgTypes[13]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@ -1031,7 +1097,7 @@ func (x *CancelLiveOrderResponse) String() string {
func (*CancelLiveOrderResponse) ProtoMessage() {}
func (x *CancelLiveOrderResponse) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[12]
mi := &file_alt_v1_live_trading_proto_msgTypes[13]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@ -1044,7 +1110,7 @@ func (x *CancelLiveOrderResponse) ProtoReflect() protoreflect.Message {
// Deprecated: Use CancelLiveOrderResponse.ProtoReflect.Descriptor instead.
func (*CancelLiveOrderResponse) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{12}
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{13}
}
func (x *CancelLiveOrderResponse) GetOrder() *LiveOrder {
@ -1072,7 +1138,7 @@ type GetLiveOrderRequest struct {
func (x *GetLiveOrderRequest) Reset() {
*x = GetLiveOrderRequest{}
mi := &file_alt_v1_live_trading_proto_msgTypes[13]
mi := &file_alt_v1_live_trading_proto_msgTypes[14]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@ -1084,7 +1150,7 @@ func (x *GetLiveOrderRequest) String() string {
func (*GetLiveOrderRequest) ProtoMessage() {}
func (x *GetLiveOrderRequest) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[13]
mi := &file_alt_v1_live_trading_proto_msgTypes[14]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@ -1097,7 +1163,7 @@ func (x *GetLiveOrderRequest) ProtoReflect() protoreflect.Message {
// Deprecated: Use GetLiveOrderRequest.ProtoReflect.Descriptor instead.
func (*GetLiveOrderRequest) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{13}
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{14}
}
func (x *GetLiveOrderRequest) GetAccountId() string {
@ -1125,7 +1191,7 @@ type GetLiveOrderResponse struct {
func (x *GetLiveOrderResponse) Reset() {
*x = GetLiveOrderResponse{}
mi := &file_alt_v1_live_trading_proto_msgTypes[14]
mi := &file_alt_v1_live_trading_proto_msgTypes[15]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@ -1137,7 +1203,7 @@ func (x *GetLiveOrderResponse) String() string {
func (*GetLiveOrderResponse) ProtoMessage() {}
func (x *GetLiveOrderResponse) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[14]
mi := &file_alt_v1_live_trading_proto_msgTypes[15]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@ -1150,7 +1216,7 @@ func (x *GetLiveOrderResponse) ProtoReflect() protoreflect.Message {
// Deprecated: Use GetLiveOrderResponse.ProtoReflect.Descriptor instead.
func (*GetLiveOrderResponse) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{14}
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{15}
}
func (x *GetLiveOrderResponse) GetOrder() *LiveOrder {
@ -1167,6 +1233,444 @@ func (x *GetLiveOrderResponse) GetError() *ErrorInfo {
return nil
}
// LiveRiskPolicy describes the active risk limits applied before any live order
// reaches the broker. All limits are adjustable at runtime; a zero value for
// a numeric limit means the limit is not enforced.
type LiveRiskPolicy struct {
state protoimpl.MessageState `protogen:"open.v1"`
// max_order_notional_by_currency maps a currency code (e.g. "KRW", "USD")
// to the maximum allowed notional value per order as a decimal string.
MaxOrderNotionalByCurrency map[string]string `protobuf:"bytes,1,rep,name=max_order_notional_by_currency,json=maxOrderNotionalByCurrency,proto3" json:"max_order_notional_by_currency,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
MaxDailyOrders int32 `protobuf:"varint,2,opt,name=max_daily_orders,json=maxDailyOrders,proto3" json:"max_daily_orders,omitempty"`
MaxOpenOrders int32 `protobuf:"varint,3,opt,name=max_open_orders,json=maxOpenOrders,proto3" json:"max_open_orders,omitempty"`
AllowShortSelling bool `protobuf:"varint,4,opt,name=allow_short_selling,json=allowShortSelling,proto3" json:"allow_short_selling,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *LiveRiskPolicy) Reset() {
*x = LiveRiskPolicy{}
mi := &file_alt_v1_live_trading_proto_msgTypes[16]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *LiveRiskPolicy) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*LiveRiskPolicy) ProtoMessage() {}
func (x *LiveRiskPolicy) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[16]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use LiveRiskPolicy.ProtoReflect.Descriptor instead.
func (*LiveRiskPolicy) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{16}
}
func (x *LiveRiskPolicy) GetMaxOrderNotionalByCurrency() map[string]string {
if x != nil {
return x.MaxOrderNotionalByCurrency
}
return nil
}
func (x *LiveRiskPolicy) GetMaxDailyOrders() int32 {
if x != nil {
return x.MaxDailyOrders
}
return 0
}
func (x *LiveRiskPolicy) GetMaxOpenOrders() int32 {
if x != nil {
return x.MaxOpenOrders
}
return 0
}
func (x *LiveRiskPolicy) GetAllowShortSelling() bool {
if x != nil {
return x.AllowShortSelling
}
return false
}
// LiveKillSwitchState captures whether live order submission is globally halted.
// The safe default is halted=true; operators must explicitly disable the kill
// switch before any live order can reach the broker.
type LiveKillSwitchState struct {
state protoimpl.MessageState `protogen:"open.v1"`
Halted bool `protobuf:"varint,1,opt,name=halted,proto3" json:"halted,omitempty"`
Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *LiveKillSwitchState) Reset() {
*x = LiveKillSwitchState{}
mi := &file_alt_v1_live_trading_proto_msgTypes[17]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *LiveKillSwitchState) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*LiveKillSwitchState) ProtoMessage() {}
func (x *LiveKillSwitchState) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[17]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use LiveKillSwitchState.ProtoReflect.Descriptor instead.
func (*LiveKillSwitchState) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{17}
}
func (x *LiveKillSwitchState) GetHalted() bool {
if x != nil {
return x.Halted
}
return false
}
func (x *LiveKillSwitchState) GetReason() string {
if x != nil {
return x.Reason
}
return ""
}
// GetLiveRiskPolicyRequest queries the active risk policy for a live account.
type GetLiveRiskPolicyRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *GetLiveRiskPolicyRequest) Reset() {
*x = GetLiveRiskPolicyRequest{}
mi := &file_alt_v1_live_trading_proto_msgTypes[18]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *GetLiveRiskPolicyRequest) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*GetLiveRiskPolicyRequest) ProtoMessage() {}
func (x *GetLiveRiskPolicyRequest) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[18]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use GetLiveRiskPolicyRequest.ProtoReflect.Descriptor instead.
func (*GetLiveRiskPolicyRequest) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{18}
}
func (x *GetLiveRiskPolicyRequest) GetAccountId() string {
if x != nil {
return x.AccountId
}
return ""
}
// GetLiveRiskPolicyResponse returns the active risk policy or a typed error.
type GetLiveRiskPolicyResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
Policy *LiveRiskPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
Error *ErrorInfo `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *GetLiveRiskPolicyResponse) Reset() {
*x = GetLiveRiskPolicyResponse{}
mi := &file_alt_v1_live_trading_proto_msgTypes[19]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *GetLiveRiskPolicyResponse) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*GetLiveRiskPolicyResponse) ProtoMessage() {}
func (x *GetLiveRiskPolicyResponse) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[19]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use GetLiveRiskPolicyResponse.ProtoReflect.Descriptor instead.
func (*GetLiveRiskPolicyResponse) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{19}
}
func (x *GetLiveRiskPolicyResponse) GetPolicy() *LiveRiskPolicy {
if x != nil {
return x.Policy
}
return nil
}
func (x *GetLiveRiskPolicyResponse) GetError() *ErrorInfo {
if x != nil {
return x.Error
}
return nil
}
// GetLiveKillSwitchRequest queries the current kill switch state.
type GetLiveKillSwitchRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *GetLiveKillSwitchRequest) Reset() {
*x = GetLiveKillSwitchRequest{}
mi := &file_alt_v1_live_trading_proto_msgTypes[20]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *GetLiveKillSwitchRequest) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*GetLiveKillSwitchRequest) ProtoMessage() {}
func (x *GetLiveKillSwitchRequest) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[20]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use GetLiveKillSwitchRequest.ProtoReflect.Descriptor instead.
func (*GetLiveKillSwitchRequest) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{20}
}
func (x *GetLiveKillSwitchRequest) GetAccountId() string {
if x != nil {
return x.AccountId
}
return ""
}
// GetLiveKillSwitchResponse returns the current kill switch state or a typed error.
type GetLiveKillSwitchResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
State *LiveKillSwitchState `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
Error *ErrorInfo `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *GetLiveKillSwitchResponse) Reset() {
*x = GetLiveKillSwitchResponse{}
mi := &file_alt_v1_live_trading_proto_msgTypes[21]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *GetLiveKillSwitchResponse) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*GetLiveKillSwitchResponse) ProtoMessage() {}
func (x *GetLiveKillSwitchResponse) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[21]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use GetLiveKillSwitchResponse.ProtoReflect.Descriptor instead.
func (*GetLiveKillSwitchResponse) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{21}
}
func (x *GetLiveKillSwitchResponse) GetState() *LiveKillSwitchState {
if x != nil {
return x.State
}
return nil
}
func (x *GetLiveKillSwitchResponse) GetError() *ErrorInfo {
if x != nil {
return x.Error
}
return nil
}
// SetLiveKillSwitchRequest sets the kill switch to halted or unhalted.
type SetLiveKillSwitchRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
Halted bool `protobuf:"varint,2,opt,name=halted,proto3" json:"halted,omitempty"`
Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *SetLiveKillSwitchRequest) Reset() {
*x = SetLiveKillSwitchRequest{}
mi := &file_alt_v1_live_trading_proto_msgTypes[22]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *SetLiveKillSwitchRequest) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*SetLiveKillSwitchRequest) ProtoMessage() {}
func (x *SetLiveKillSwitchRequest) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[22]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use SetLiveKillSwitchRequest.ProtoReflect.Descriptor instead.
func (*SetLiveKillSwitchRequest) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{22}
}
func (x *SetLiveKillSwitchRequest) GetAccountId() string {
if x != nil {
return x.AccountId
}
return ""
}
func (x *SetLiveKillSwitchRequest) GetHalted() bool {
if x != nil {
return x.Halted
}
return false
}
func (x *SetLiveKillSwitchRequest) GetReason() string {
if x != nil {
return x.Reason
}
return ""
}
// SetLiveKillSwitchResponse returns the new kill switch state or a typed error.
type SetLiveKillSwitchResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
State *LiveKillSwitchState `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
Error *ErrorInfo `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *SetLiveKillSwitchResponse) Reset() {
*x = SetLiveKillSwitchResponse{}
mi := &file_alt_v1_live_trading_proto_msgTypes[23]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *SetLiveKillSwitchResponse) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*SetLiveKillSwitchResponse) ProtoMessage() {}
func (x *SetLiveKillSwitchResponse) ProtoReflect() protoreflect.Message {
mi := &file_alt_v1_live_trading_proto_msgTypes[23]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use SetLiveKillSwitchResponse.ProtoReflect.Descriptor instead.
func (*SetLiveKillSwitchResponse) Descriptor() ([]byte, []int) {
return file_alt_v1_live_trading_proto_rawDescGZIP(), []int{23}
}
func (x *SetLiveKillSwitchResponse) GetState() *LiveKillSwitchState {
if x != nil {
return x.State
}
return nil
}
func (x *SetLiveKillSwitchResponse) GetError() *ErrorInfo {
if x != nil {
return x.Error
}
return nil
}
var File_alt_v1_live_trading_proto protoreflect.FileDescriptor
const file_alt_v1_live_trading_proto_rawDesc = "" +
@ -1260,10 +1764,14 @@ const file_alt_v1_live_trading_proto_rawDesc = "" +
"account_id\x18\x01 \x01(\tR\taccountId\x12/\n" +
"\x06intent\x18\x02 \x01(\v2\x17.alt.v1.LiveOrderIntentR\x06intent\x12Q\n" +
"\x15operator_confirmation\x18\x03 \x01(\v2\x1c.alt.v1.OperatorConfirmationR\x14operatorConfirmation\x12'\n" +
"\x0fidempotency_key\x18\x04 \x01(\tR\x0eidempotencyKey\"k\n" +
"\x0fidempotency_key\x18\x04 \x01(\tR\x0eidempotencyKey\"D\n" +
"\x10LiveRiskDecision\x12\x18\n" +
"\aallowed\x18\x01 \x01(\bR\aallowed\x12\x16\n" +
"\x06reason\x18\x02 \x01(\tR\x06reason\"\xaa\x01\n" +
"\x17SubmitLiveOrderResponse\x12'\n" +
"\x05order\x18\x01 \x01(\v2\x11.alt.v1.LiveOrderR\x05order\x12'\n" +
"\x05error\x18\x02 \x01(\v2\x11.alt.v1.ErrorInfoR\x05error\"[\n" +
"\x05error\x18\x02 \x01(\v2\x11.alt.v1.ErrorInfoR\x05error\x12=\n" +
"\rrisk_decision\x18\x03 \x01(\v2\x18.alt.v1.LiveRiskDecisionR\friskDecision\"[\n" +
"\x16CancelLiveOrderRequest\x12\x1d\n" +
"\n" +
"account_id\x18\x01 \x01(\tR\taccountId\x12\"\n" +
@ -1277,6 +1785,37 @@ const file_alt_v1_live_trading_proto_rawDesc = "" +
"\rlive_order_id\x18\x02 \x01(\tR\vliveOrderId\"h\n" +
"\x14GetLiveOrderResponse\x12'\n" +
"\x05order\x18\x01 \x01(\v2\x11.alt.v1.LiveOrderR\x05order\x12'\n" +
"\x05error\x18\x02 \x01(\v2\x11.alt.v1.ErrorInfoR\x05error\"\xdd\x02\n" +
"\x0eLiveRiskPolicy\x12z\n" +
"\x1emax_order_notional_by_currency\x18\x01 \x03(\v26.alt.v1.LiveRiskPolicy.MaxOrderNotionalByCurrencyEntryR\x1amaxOrderNotionalByCurrency\x12(\n" +
"\x10max_daily_orders\x18\x02 \x01(\x05R\x0emaxDailyOrders\x12&\n" +
"\x0fmax_open_orders\x18\x03 \x01(\x05R\rmaxOpenOrders\x12.\n" +
"\x13allow_short_selling\x18\x04 \x01(\bR\x11allowShortSelling\x1aM\n" +
"\x1fMaxOrderNotionalByCurrencyEntry\x12\x10\n" +
"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"E\n" +
"\x13LiveKillSwitchState\x12\x16\n" +
"\x06halted\x18\x01 \x01(\bR\x06halted\x12\x16\n" +
"\x06reason\x18\x02 \x01(\tR\x06reason\"9\n" +
"\x18GetLiveRiskPolicyRequest\x12\x1d\n" +
"\n" +
"account_id\x18\x01 \x01(\tR\taccountId\"t\n" +
"\x19GetLiveRiskPolicyResponse\x12.\n" +
"\x06policy\x18\x01 \x01(\v2\x16.alt.v1.LiveRiskPolicyR\x06policy\x12'\n" +
"\x05error\x18\x02 \x01(\v2\x11.alt.v1.ErrorInfoR\x05error\"9\n" +
"\x18GetLiveKillSwitchRequest\x12\x1d\n" +
"\n" +
"account_id\x18\x01 \x01(\tR\taccountId\"w\n" +
"\x19GetLiveKillSwitchResponse\x121\n" +
"\x05state\x18\x01 \x01(\v2\x1b.alt.v1.LiveKillSwitchStateR\x05state\x12'\n" +
"\x05error\x18\x02 \x01(\v2\x11.alt.v1.ErrorInfoR\x05error\"i\n" +
"\x18SetLiveKillSwitchRequest\x12\x1d\n" +
"\n" +
"account_id\x18\x01 \x01(\tR\taccountId\x12\x16\n" +
"\x06halted\x18\x02 \x01(\bR\x06halted\x12\x16\n" +
"\x06reason\x18\x03 \x01(\tR\x06reason\"w\n" +
"\x19SetLiveKillSwitchResponse\x121\n" +
"\x05state\x18\x01 \x01(\v2\x1b.alt.v1.LiveKillSwitchStateR\x05state\x12'\n" +
"\x05error\x18\x02 \x01(\v2\x11.alt.v1.ErrorInfoR\x05errorBCZAgit.toki-labs.com/toki/alt/packages/contracts/gen/go/alt/v1;altv1b\x06proto3"
var (
@ -1291,7 +1830,7 @@ func file_alt_v1_live_trading_proto_rawDescGZIP() []byte {
return file_alt_v1_live_trading_proto_rawDescData
}
var file_alt_v1_live_trading_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
var file_alt_v1_live_trading_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
var file_alt_v1_live_trading_proto_goTypes = []any{
(*GetLiveBrokerCapabilitiesRequest)(nil), // 0: alt.v1.GetLiveBrokerCapabilitiesRequest
(*GetLiveBrokerCapabilitiesResponse)(nil), // 1: alt.v1.GetLiveBrokerCapabilitiesResponse
@ -1303,54 +1842,72 @@ var file_alt_v1_live_trading_proto_goTypes = []any{
(*LiveAuditEvent)(nil), // 7: alt.v1.LiveAuditEvent
(*OperatorConfirmation)(nil), // 8: alt.v1.OperatorConfirmation
(*SubmitLiveOrderRequest)(nil), // 9: alt.v1.SubmitLiveOrderRequest
(*SubmitLiveOrderResponse)(nil), // 10: alt.v1.SubmitLiveOrderResponse
(*CancelLiveOrderRequest)(nil), // 11: alt.v1.CancelLiveOrderRequest
(*CancelLiveOrderResponse)(nil), // 12: alt.v1.CancelLiveOrderResponse
(*GetLiveOrderRequest)(nil), // 13: alt.v1.GetLiveOrderRequest
(*GetLiveOrderResponse)(nil), // 14: alt.v1.GetLiveOrderResponse
nil, // 15: alt.v1.LiveOrderIntent.CustomTagsEntry
nil, // 16: alt.v1.LiveAuditEvent.DetailEntry
(*ErrorInfo)(nil), // 17: alt.v1.ErrorInfo
(Market)(0), // 18: alt.v1.Market
(Venue)(0), // 19: alt.v1.Venue
(*Quantity)(nil), // 20: alt.v1.Quantity
(*Price)(nil), // 21: alt.v1.Price
(*BacktestTrade)(nil), // 22: alt.v1.BacktestTrade
(*Decimal)(nil), // 23: alt.v1.Decimal
(*LiveRiskDecision)(nil), // 10: alt.v1.LiveRiskDecision
(*SubmitLiveOrderResponse)(nil), // 11: alt.v1.SubmitLiveOrderResponse
(*CancelLiveOrderRequest)(nil), // 12: alt.v1.CancelLiveOrderRequest
(*CancelLiveOrderResponse)(nil), // 13: alt.v1.CancelLiveOrderResponse
(*GetLiveOrderRequest)(nil), // 14: alt.v1.GetLiveOrderRequest
(*GetLiveOrderResponse)(nil), // 15: alt.v1.GetLiveOrderResponse
(*LiveRiskPolicy)(nil), // 16: alt.v1.LiveRiskPolicy
(*LiveKillSwitchState)(nil), // 17: alt.v1.LiveKillSwitchState
(*GetLiveRiskPolicyRequest)(nil), // 18: alt.v1.GetLiveRiskPolicyRequest
(*GetLiveRiskPolicyResponse)(nil), // 19: alt.v1.GetLiveRiskPolicyResponse
(*GetLiveKillSwitchRequest)(nil), // 20: alt.v1.GetLiveKillSwitchRequest
(*GetLiveKillSwitchResponse)(nil), // 21: alt.v1.GetLiveKillSwitchResponse
(*SetLiveKillSwitchRequest)(nil), // 22: alt.v1.SetLiveKillSwitchRequest
(*SetLiveKillSwitchResponse)(nil), // 23: alt.v1.SetLiveKillSwitchResponse
nil, // 24: alt.v1.LiveOrderIntent.CustomTagsEntry
nil, // 25: alt.v1.LiveAuditEvent.DetailEntry
nil, // 26: alt.v1.LiveRiskPolicy.MaxOrderNotionalByCurrencyEntry
(*ErrorInfo)(nil), // 27: alt.v1.ErrorInfo
(Market)(0), // 28: alt.v1.Market
(Venue)(0), // 29: alt.v1.Venue
(*Quantity)(nil), // 30: alt.v1.Quantity
(*Price)(nil), // 31: alt.v1.Price
(*BacktestTrade)(nil), // 32: alt.v1.BacktestTrade
(*Decimal)(nil), // 33: alt.v1.Decimal
}
var file_alt_v1_live_trading_proto_depIdxs = []int32{
2, // 0: alt.v1.GetLiveBrokerCapabilitiesResponse.broker_capabilities:type_name -> alt.v1.LiveBrokerCapability
17, // 1: alt.v1.GetLiveBrokerCapabilitiesResponse.error:type_name -> alt.v1.ErrorInfo
18, // 2: alt.v1.LiveBrokerCapability.markets:type_name -> alt.v1.Market
19, // 3: alt.v1.LiveBrokerCapability.venues:type_name -> alt.v1.Venue
20, // 4: alt.v1.LiveOrderIntent.quantity:type_name -> alt.v1.Quantity
21, // 5: alt.v1.LiveOrderIntent.limit_price:type_name -> alt.v1.Price
15, // 6: alt.v1.LiveOrderIntent.custom_tags:type_name -> alt.v1.LiveOrderIntent.CustomTagsEntry
20, // 7: alt.v1.LiveOrder.quantity:type_name -> alt.v1.Quantity
21, // 8: alt.v1.LiveOrder.limit_price:type_name -> alt.v1.Price
22, // 9: alt.v1.LiveOrder.fill:type_name -> alt.v1.BacktestTrade
23, // 10: alt.v1.LiveAccountSnapshot.cash:type_name -> alt.v1.Decimal
23, // 11: alt.v1.LiveAccountSnapshot.total_equity:type_name -> alt.v1.Decimal
23, // 12: alt.v1.LiveAccountSnapshot.available_margin:type_name -> alt.v1.Decimal
20, // 13: alt.v1.LivePositionSnapshot.quantity:type_name -> alt.v1.Quantity
21, // 14: alt.v1.LivePositionSnapshot.avg_price:type_name -> alt.v1.Price
21, // 15: alt.v1.LivePositionSnapshot.current_price:type_name -> alt.v1.Price
23, // 16: alt.v1.LivePositionSnapshot.market_value:type_name -> alt.v1.Decimal
23, // 17: alt.v1.LivePositionSnapshot.pnl:type_name -> alt.v1.Decimal
16, // 18: alt.v1.LiveAuditEvent.detail:type_name -> alt.v1.LiveAuditEvent.DetailEntry
27, // 1: alt.v1.GetLiveBrokerCapabilitiesResponse.error:type_name -> alt.v1.ErrorInfo
28, // 2: alt.v1.LiveBrokerCapability.markets:type_name -> alt.v1.Market
29, // 3: alt.v1.LiveBrokerCapability.venues:type_name -> alt.v1.Venue
30, // 4: alt.v1.LiveOrderIntent.quantity:type_name -> alt.v1.Quantity
31, // 5: alt.v1.LiveOrderIntent.limit_price:type_name -> alt.v1.Price
24, // 6: alt.v1.LiveOrderIntent.custom_tags:type_name -> alt.v1.LiveOrderIntent.CustomTagsEntry
30, // 7: alt.v1.LiveOrder.quantity:type_name -> alt.v1.Quantity
31, // 8: alt.v1.LiveOrder.limit_price:type_name -> alt.v1.Price
32, // 9: alt.v1.LiveOrder.fill:type_name -> alt.v1.BacktestTrade
33, // 10: alt.v1.LiveAccountSnapshot.cash:type_name -> alt.v1.Decimal
33, // 11: alt.v1.LiveAccountSnapshot.total_equity:type_name -> alt.v1.Decimal
33, // 12: alt.v1.LiveAccountSnapshot.available_margin:type_name -> alt.v1.Decimal
30, // 13: alt.v1.LivePositionSnapshot.quantity:type_name -> alt.v1.Quantity
31, // 14: alt.v1.LivePositionSnapshot.avg_price:type_name -> alt.v1.Price
31, // 15: alt.v1.LivePositionSnapshot.current_price:type_name -> alt.v1.Price
33, // 16: alt.v1.LivePositionSnapshot.market_value:type_name -> alt.v1.Decimal
33, // 17: alt.v1.LivePositionSnapshot.pnl:type_name -> alt.v1.Decimal
25, // 18: alt.v1.LiveAuditEvent.detail:type_name -> alt.v1.LiveAuditEvent.DetailEntry
3, // 19: alt.v1.SubmitLiveOrderRequest.intent:type_name -> alt.v1.LiveOrderIntent
8, // 20: alt.v1.SubmitLiveOrderRequest.operator_confirmation:type_name -> alt.v1.OperatorConfirmation
4, // 21: alt.v1.SubmitLiveOrderResponse.order:type_name -> alt.v1.LiveOrder
17, // 22: alt.v1.SubmitLiveOrderResponse.error:type_name -> alt.v1.ErrorInfo
4, // 23: alt.v1.CancelLiveOrderResponse.order:type_name -> alt.v1.LiveOrder
17, // 24: alt.v1.CancelLiveOrderResponse.error:type_name -> alt.v1.ErrorInfo
4, // 25: alt.v1.GetLiveOrderResponse.order:type_name -> alt.v1.LiveOrder
17, // 26: alt.v1.GetLiveOrderResponse.error:type_name -> alt.v1.ErrorInfo
27, // [27:27] is the sub-list for method output_type
27, // [27:27] is the sub-list for method input_type
27, // [27:27] is the sub-list for extension type_name
27, // [27:27] is the sub-list for extension extendee
0, // [0:27] is the sub-list for field type_name
27, // 22: alt.v1.SubmitLiveOrderResponse.error:type_name -> alt.v1.ErrorInfo
10, // 23: alt.v1.SubmitLiveOrderResponse.risk_decision:type_name -> alt.v1.LiveRiskDecision
4, // 24: alt.v1.CancelLiveOrderResponse.order:type_name -> alt.v1.LiveOrder
27, // 25: alt.v1.CancelLiveOrderResponse.error:type_name -> alt.v1.ErrorInfo
4, // 26: alt.v1.GetLiveOrderResponse.order:type_name -> alt.v1.LiveOrder
27, // 27: alt.v1.GetLiveOrderResponse.error:type_name -> alt.v1.ErrorInfo
26, // 28: alt.v1.LiveRiskPolicy.max_order_notional_by_currency:type_name -> alt.v1.LiveRiskPolicy.MaxOrderNotionalByCurrencyEntry
16, // 29: alt.v1.GetLiveRiskPolicyResponse.policy:type_name -> alt.v1.LiveRiskPolicy
27, // 30: alt.v1.GetLiveRiskPolicyResponse.error:type_name -> alt.v1.ErrorInfo
17, // 31: alt.v1.GetLiveKillSwitchResponse.state:type_name -> alt.v1.LiveKillSwitchState
27, // 32: alt.v1.GetLiveKillSwitchResponse.error:type_name -> alt.v1.ErrorInfo
17, // 33: alt.v1.SetLiveKillSwitchResponse.state:type_name -> alt.v1.LiveKillSwitchState
27, // 34: alt.v1.SetLiveKillSwitchResponse.error:type_name -> alt.v1.ErrorInfo
35, // [35:35] is the sub-list for method output_type
35, // [35:35] is the sub-list for method input_type
35, // [35:35] is the sub-list for extension type_name
35, // [35:35] is the sub-list for extension extendee
0, // [0:35] is the sub-list for field type_name
}
func init() { file_alt_v1_live_trading_proto_init() }
@ -1367,7 +1924,7 @@ func file_alt_v1_live_trading_proto_init() {
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
RawDescriptor: unsafe.Slice(unsafe.StringData(file_alt_v1_live_trading_proto_rawDesc), len(file_alt_v1_live_trading_proto_rawDesc)),
NumEnums: 0,
NumMessages: 17,
NumMessages: 27,
NumExtensions: 0,
NumServices: 0,
},

67
packages/contracts/proto/alt/v1/live_trading.proto
View file

@ -134,10 +134,22 @@ message SubmitLiveOrderRequest {
string idempotency_key = 4;
}
// LiveRiskDecision carries the outcome of a risk policy evaluation for a live
// order submission. It is included in SubmitLiveOrderResponse when the risk
// guard blocked the order so headless operators can surface the denial reason
// alongside the rejected order record.
message LiveRiskDecision {
bool allowed = 1;
string reason = 2;
}
// SubmitLiveOrderResponse carries the submitted live order or a typed error.
// When the order was blocked by the risk policy, order carries the rejected
// in-memory record and risk_decision carries the denial reason.
message SubmitLiveOrderResponse {
LiveOrder order = 1;
ErrorInfo error = 2;
LiveRiskDecision risk_decision = 3;
}
// CancelLiveOrderRequest cancels a pending live order by its live order id.
@ -163,3 +175,58 @@ message GetLiveOrderResponse {
LiveOrder order = 1;
ErrorInfo error = 2;
}
// LiveRiskPolicy describes the active risk limits applied before any live order
// reaches the broker. All limits are adjustable at runtime; a zero value for
// a numeric limit means the limit is not enforced.
message LiveRiskPolicy {
// max_order_notional_by_currency maps a currency code (e.g. "KRW", "USD")
// to the maximum allowed notional value per order as a decimal string.
map<string, string> max_order_notional_by_currency = 1;
int32 max_daily_orders = 2;
int32 max_open_orders = 3;
bool allow_short_selling = 4;
}
// LiveKillSwitchState captures whether live order submission is globally halted.
// The safe default is halted=true; operators must explicitly disable the kill
// switch before any live order can reach the broker.
message LiveKillSwitchState {
bool halted = 1;
string reason = 2;
}
// GetLiveRiskPolicyRequest queries the active risk policy for a live account.
message GetLiveRiskPolicyRequest {
string account_id = 1;
}
// GetLiveRiskPolicyResponse returns the active risk policy or a typed error.
message GetLiveRiskPolicyResponse {
LiveRiskPolicy policy = 1;
ErrorInfo error = 2;
}
// GetLiveKillSwitchRequest queries the current kill switch state.
message GetLiveKillSwitchRequest {
string account_id = 1;
}
// GetLiveKillSwitchResponse returns the current kill switch state or a typed error.
message GetLiveKillSwitchResponse {
LiveKillSwitchState state = 1;
ErrorInfo error = 2;
}
// SetLiveKillSwitchRequest sets the kill switch to halted or unhalted.
message SetLiveKillSwitchRequest {
string account_id = 1;
bool halted = 2;
string reason = 3;
}
// SetLiveKillSwitchResponse returns the new kill switch state or a typed error.
message SetLiveKillSwitchResponse {
LiveKillSwitchState state = 1;
ErrorInfo error = 2;
}

126
packages/domain/trading/risk.go Normal file
View file

@ -0,0 +1,126 @@
package trading
import (
"math/big"
"strings"
"git.toki-labs.com/toki/alt/packages/domain/market"
)
// RiskPolicy defines the live order submission limits applied before any broker
// call. All fields are adjustable at runtime via the worker livetrading config.
// A zero-value policy with no currency limits and zero max-counts means no
// numeric limits are applied, but the kill switch still applies separately.
type RiskPolicy struct {
// MaxOrderNotionalByCurrency is the maximum allowed notional value per
// order, keyed by currency. An absent currency key means no limit for that
// currency. Notional is evaluated only when a limit_price is present in the
// order intent (i.e. for limit orders).
MaxOrderNotionalByCurrency map[market.Currency]market.Decimal
// MaxDailyOrders is the maximum number of orders allowed per calendar day.
// Zero means no limit is applied.
MaxDailyOrders int
// MaxOpenOrders is the maximum number of orders that may be in a non-
// terminal status at the same time. Zero means no limit is applied.
MaxOpenOrders int
// AllowShortSelling, when false, rejects sell-side orders without checking
// the current position (strict mode). Set to true to allow short selling.
AllowShortSelling bool
}
// KillSwitchState captures whether live order submission is globally halted.
// The safe default is Halted=true; operators must explicitly disable the kill
// switch before any live order can reach the broker.
type KillSwitchState struct {
// Halted, when true, blocks all live order submissions regardless of risk
// policy. Safe default is true.
Halted bool
// Reason is a human-readable explanation for the current kill switch state.
Reason string
}
// DefaultKillSwitch returns the safe initial kill switch state (halted=true).
func DefaultKillSwitch() KillSwitchState {
return KillSwitchState{Halted: true, Reason: "kill switch active by default"}
}
// RiskDecision is the outcome of a risk policy evaluation.
type RiskDecision struct {
Allowed bool
Reason string
}
// RiskUsage carries the account-level counters used to enforce count-based risk
// limits. The service computes these from its in-memory order registry before
// calling EvaluateRisk.
type RiskUsage struct {
// DailyOrderCount is the number of orders already submitted for the account
// on the current UTC calendar day (including all statuses).
DailyOrderCount int
// OpenOrderCount is the number of orders in a non-terminal status for the
// account. Terminal statuses are filled, canceled, and rejected.
OpenOrderCount int
}
// EvaluateRisk evaluates the kill switch and risk policy for a given order
// intent. It returns a RiskDecision with Allowed=false and a human-readable
// Reason when any guard is triggered.
//
// Evaluation order:
// 1. Kill switch halted → block immediately.
// 2. Short selling disallowed → block sell orders (strict, no position check).
// 3. Order notional exceeds limit for the limit_price currency → block.
// 4. Daily order count at or above MaxDailyOrders (when > 0) → block.
// 5. Open order count at or above MaxOpenOrders (when > 0) → block.
func EvaluateRisk(policy RiskPolicy, ks KillSwitchState, intent OrderIntent, usage RiskUsage) RiskDecision {
if ks.Halted {
reason := "kill switch is active"
if ks.Reason != "" {
reason = ks.Reason
}
return RiskDecision{Allowed: false, Reason: reason}
}
if !policy.AllowShortSelling && intent.Side == OrderSideSell {
return RiskDecision{Allowed: false, Reason: "short selling is not allowed"}
}
if len(policy.MaxOrderNotionalByCurrency) > 0 && intent.LimitPrice.Amount.Value != "" {
cur := intent.LimitPrice.Currency
if limit, ok := policy.MaxOrderNotionalByCurrency[cur]; ok && limit.Value != "" {
notional := computeNotional(intent.Quantity.Amount.Value, intent.LimitPrice.Amount.Value)
if notional != nil {
limitRat := new(big.Rat)
if _, ok := limitRat.SetString(strings.TrimSpace(limit.Value)); ok {
if notional.Cmp(limitRat) > 0 {
return RiskDecision{Allowed: false, Reason: "order notional exceeds limit"}
}
}
}
}
}
if policy.MaxDailyOrders > 0 && usage.DailyOrderCount >= policy.MaxDailyOrders {
return RiskDecision{Allowed: false, Reason: "daily order limit reached"}
}
if policy.MaxOpenOrders > 0 && usage.OpenOrderCount >= policy.MaxOpenOrders {
return RiskDecision{Allowed: false, Reason: "open order limit reached"}
}
return RiskDecision{Allowed: true, Reason: "risk check passed"}
}
// computeNotional returns qty * price as a *big.Rat, or nil when either value
// is not a valid decimal string.
func computeNotional(qty, price string) *big.Rat {
qtyRat := new(big.Rat)
if _, ok := qtyRat.SetString(strings.TrimSpace(qty)); !ok {
return nil
}
priceRat := new(big.Rat)
if _, ok := priceRat.SetString(strings.TrimSpace(price)); !ok {
return nil
}
return new(big.Rat).Mul(qtyRat, priceRat)
}

232
packages/domain/trading/risk_test.go Normal file
View file

@ -0,0 +1,232 @@
package trading
import (
"testing"
"git.toki-labs.com/toki/alt/packages/domain/market"
)
func krwPolicy(maxNotional string) RiskPolicy {
return RiskPolicy{
MaxOrderNotionalByCurrency: map[market.Currency]market.Decimal{
market.CurrencyKRW: {Value: maxNotional},
},
MaxDailyOrders: 5,
MaxOpenOrders: 3,
AllowShortSelling: false,
}
}
func buyIntent(qty, limitPrice string) OrderIntent {
return OrderIntent{
InstrumentID: "KRX:005930",
Side: OrderSideBuy,
Quantity: market.Quantity{Amount: market.Decimal{Value: qty}},
Type: OrderTypeLimit,
LimitPrice: market.Price{
Currency: market.CurrencyKRW,
Amount: market.Decimal{Value: limitPrice},
},
}
}
func TestEvaluateRiskKillSwitchHaltedBlocks(t *testing.T) {
ks := KillSwitchState{Halted: true, Reason: "manual halt"}
dec := EvaluateRisk(RiskPolicy{}, ks, buyIntent("1", "75000"), RiskUsage{})
if dec.Allowed {
t.Error("expected risk denied when kill switch is halted")
}
if dec.Reason != "manual halt" {
t.Errorf("unexpected reason %q", dec.Reason)
}
}
func TestEvaluateRiskKillSwitchDefaultReasonFallback(t *testing.T) {
ks := KillSwitchState{Halted: true, Reason: ""}
dec := EvaluateRisk(RiskPolicy{}, ks, buyIntent("1", "75000"), RiskUsage{})
if dec.Allowed {
t.Error("expected risk denied when kill switch is halted")
}
if dec.Reason == "" {
t.Error("expected fallback reason, got empty string")
}
}
func TestEvaluateRiskKillSwitchOffAllows(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := krwPolicy("1000000")
dec := EvaluateRisk(policy, ks, buyIntent("1", "75000"), RiskUsage{})
if !dec.Allowed {
t.Errorf("expected allowed, got reason %q", dec.Reason)
}
}
func TestEvaluateRiskShortSellingBlocked(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{AllowShortSelling: false}
intent := OrderIntent{
InstrumentID: "KRX:005930",
Side: OrderSideSell,
Quantity: market.Quantity{Amount: market.Decimal{Value: "1"}},
Type: OrderTypeMarket,
}
dec := EvaluateRisk(policy, ks, intent, RiskUsage{})
if dec.Allowed {
t.Error("expected sell order blocked when short selling is disallowed")
}
}
func TestEvaluateRiskShortSellingAllowed(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{AllowShortSelling: true}
intent := OrderIntent{
InstrumentID: "KRX:005930",
Side: OrderSideSell,
Quantity: market.Quantity{Amount: market.Decimal{Value: "1"}},
Type: OrderTypeMarket,
}
dec := EvaluateRisk(policy, ks, intent, RiskUsage{})
if !dec.Allowed {
t.Errorf("expected sell allowed when AllowShortSelling=true, got reason %q", dec.Reason)
}
}
func TestEvaluateRiskNotionalBelowLimitAllows(t *testing.T) {
ks := KillSwitchState{Halted: false}
// 10 * 75000 = 750000 < 1000000
dec := EvaluateRisk(krwPolicy("1000000"), ks, buyIntent("10", "75000"), RiskUsage{})
if !dec.Allowed {
t.Errorf("expected allowed, got %q", dec.Reason)
}
}
func TestEvaluateRiskNotionalAboveLimitBlocks(t *testing.T) {
ks := KillSwitchState{Halted: false}
// 20 * 75000 = 1500000 > 1000000
dec := EvaluateRisk(krwPolicy("1000000"), ks, buyIntent("20", "75000"), RiskUsage{})
if dec.Allowed {
t.Error("expected blocked when notional exceeds limit")
}
}
func TestEvaluateRiskNotionalExactlyAtLimitAllows(t *testing.T) {
ks := KillSwitchState{Halted: false}
// 10 * 100000 = 1000000 == 1000000
dec := EvaluateRisk(krwPolicy("1000000"), ks, buyIntent("10", "100000"), RiskUsage{})
if !dec.Allowed {
t.Errorf("expected allowed at exact limit, got %q", dec.Reason)
}
}
func TestEvaluateRiskMarketOrderSkipsNotionalCheck(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := krwPolicy("1000000")
// market order has no limit price, so no notional check
intent := OrderIntent{
InstrumentID: "KRX:005930",
Side: OrderSideBuy,
Quantity: market.Quantity{Amount: market.Decimal{Value: "9999"}},
Type: OrderTypeMarket,
}
dec := EvaluateRisk(policy, ks, intent, RiskUsage{})
if !dec.Allowed {
t.Errorf("expected market order allowed (no limit_price to check notional), got %q", dec.Reason)
}
}
func TestEvaluateRiskDifferentCurrencyNotionalUnchecked(t *testing.T) {
ks := KillSwitchState{Halted: false}
// policy only sets KRW limit; USD order should pass
policy := krwPolicy("1000000")
intent := OrderIntent{
InstrumentID: "NYSE:AAPL",
Side: OrderSideBuy,
Quantity: market.Quantity{Amount: market.Decimal{Value: "100"}},
Type: OrderTypeLimit,
LimitPrice: market.Price{
Currency: market.CurrencyUSD,
Amount: market.Decimal{Value: "200"},
},
}
dec := EvaluateRisk(policy, ks, intent, RiskUsage{})
if !dec.Allowed {
t.Errorf("expected USD order allowed when only KRW limit set, got %q", dec.Reason)
}
}
func TestEvaluateRiskMaxDailyOrdersAllowsBelowLimit(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{MaxDailyOrders: 5}
// 4 orders submitted today — one more should be allowed
dec := EvaluateRisk(policy, ks, buyIntent("1", ""), RiskUsage{DailyOrderCount: 4})
if !dec.Allowed {
t.Errorf("expected allowed when daily count below limit, got %q", dec.Reason)
}
}
func TestEvaluateRiskMaxDailyOrdersBlocksAtLimit(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{MaxDailyOrders: 5}
// exactly 5 orders already submitted — next must be blocked
dec := EvaluateRisk(policy, ks, buyIntent("1", ""), RiskUsage{DailyOrderCount: 5})
if dec.Allowed {
t.Error("expected blocked when daily order count equals limit")
}
}
func TestEvaluateRiskMaxDailyOrdersBlocksAboveLimit(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{MaxDailyOrders: 5}
dec := EvaluateRisk(policy, ks, buyIntent("1", ""), RiskUsage{DailyOrderCount: 7})
if dec.Allowed {
t.Error("expected blocked when daily order count exceeds limit")
}
}
func TestEvaluateRiskMaxDailyOrdersZeroMeansNoLimit(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{MaxDailyOrders: 0}
dec := EvaluateRisk(policy, ks, buyIntent("1", ""), RiskUsage{DailyOrderCount: 999})
if !dec.Allowed {
t.Errorf("expected allowed when MaxDailyOrders=0 (no limit), got %q", dec.Reason)
}
}
func TestEvaluateRiskMaxOpenOrdersAllowsBelowLimit(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{MaxOpenOrders: 3}
// 2 open orders — one more should be allowed
dec := EvaluateRisk(policy, ks, buyIntent("1", ""), RiskUsage{OpenOrderCount: 2})
if !dec.Allowed {
t.Errorf("expected allowed when open count below limit, got %q", dec.Reason)
}
}
func TestEvaluateRiskMaxOpenOrdersBlocksAtLimit(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{MaxOpenOrders: 3}
// exactly 3 open orders — next must be blocked
dec := EvaluateRisk(policy, ks, buyIntent("1", ""), RiskUsage{OpenOrderCount: 3})
if dec.Allowed {
t.Error("expected blocked when open order count equals limit")
}
}
func TestEvaluateRiskMaxOpenOrdersZeroMeansNoLimit(t *testing.T) {
ks := KillSwitchState{Halted: false}
policy := RiskPolicy{MaxOpenOrders: 0}
dec := EvaluateRisk(policy, ks, buyIntent("1", ""), RiskUsage{OpenOrderCount: 999})
if !dec.Allowed {
t.Errorf("expected allowed when MaxOpenOrders=0 (no limit), got %q", dec.Reason)
}
}
func TestDefaultKillSwitchIsHalted(t *testing.T) {
ks := DefaultKillSwitch()
if !ks.Halted {
t.Error("default kill switch must be halted=true")
}
if ks.Reason == "" {
t.Error("default kill switch must include a non-empty reason")
}
}

11
services/api/internal/contracts/parser_map.go
View file

@ -61,6 +61,17 @@ func messageFactories() []func() proto.Message {
func() proto.Message { return &altv1.CancelLiveOrderResponse{} },
func() proto.Message { return &altv1.GetLiveOrderRequest{} },
func() proto.Message { return &altv1.GetLiveOrderResponse{} },
// live risk/kill switch surface: policy query, kill switch query/set
func() proto.Message { return &altv1.GetLiveRiskPolicyRequest{} },
func() proto.Message { return &altv1.GetLiveRiskPolicyResponse{} },
func() proto.Message { return &altv1.LiveRiskPolicy{} },
func() proto.Message { return &altv1.GetLiveKillSwitchRequest{} },
func() proto.Message { return &altv1.GetLiveKillSwitchResponse{} },
func() proto.Message { return &altv1.SetLiveKillSwitchRequest{} },
func() proto.Message { return &altv1.SetLiveKillSwitchResponse{} },
func() proto.Message { return &altv1.LiveKillSwitchState{} },
// live risk decision: included in SubmitLiveOrderResponse when risk blocked
func() proto.Message { return &altv1.LiveRiskDecision{} },
}
}

90
services/api/internal/socket/backtest_test.go
View file

@ -15,43 +15,49 @@ import (
// fakeWorkerClient is a controllable WorkerClient for handler tests. It records
// the last forwarded request and returns canned responses/errors.
type fakeWorkerClient struct {
startReq *altv1.StartBacktestRequest
getRunReq *altv1.GetBacktestRunRequest
listReq *altv1.ListBacktestRunsRequest
detailReq *altv1.GetBacktestRunDetailRequest
resultReq *altv1.GetBacktestResultRequest
compareReq *altv1.CompareBacktestRunsRequest
instReq *altv1.ListInstrumentsRequest
barsReq *altv1.ListBarsRequest
importReq *altv1.ImportDailyBarsRequest
paperStartReq *altv1.StartPaperTradingRequest
paperStateReq *altv1.GetPaperTradingStateRequest
paperSubmitReq *altv1.SubmitPaperOrderRequest
paperCancelReq *altv1.CancelPaperOrderRequest
paperFillReq *altv1.FillPaperOrderRequest
liveCapReq *altv1.GetLiveBrokerCapabilitiesRequest
liveSubmitReq *altv1.SubmitLiveOrderRequest
liveCancelReq *altv1.CancelLiveOrderRequest
liveGetReq *altv1.GetLiveOrderRequest
startReq *altv1.StartBacktestRequest
getRunReq *altv1.GetBacktestRunRequest
listReq *altv1.ListBacktestRunsRequest
detailReq *altv1.GetBacktestRunDetailRequest
resultReq *altv1.GetBacktestResultRequest
compareReq *altv1.CompareBacktestRunsRequest
instReq *altv1.ListInstrumentsRequest
barsReq *altv1.ListBarsRequest
importReq *altv1.ImportDailyBarsRequest
paperStartReq *altv1.StartPaperTradingRequest
paperStateReq *altv1.GetPaperTradingStateRequest
paperSubmitReq *altv1.SubmitPaperOrderRequest
paperCancelReq *altv1.CancelPaperOrderRequest
paperFillReq *altv1.FillPaperOrderRequest
liveCapReq *altv1.GetLiveBrokerCapabilitiesRequest
liveSubmitReq *altv1.SubmitLiveOrderRequest
liveCancelReq *altv1.CancelLiveOrderRequest
liveGetReq *altv1.GetLiveOrderRequest
liveRiskPolicyReq *altv1.GetLiveRiskPolicyRequest
liveGetKillSwitchReq *altv1.GetLiveKillSwitchRequest
liveSetKillSwitchReq *altv1.SetLiveKillSwitchRequest
startRes *altv1.StartBacktestResponse
getRunRes *altv1.GetBacktestRunResponse
listRes *altv1.ListBacktestRunsResponse
detailRes *altv1.GetBacktestRunDetailResponse
resultRes *altv1.GetBacktestResultResponse
compareRes *altv1.CompareBacktestRunsResponse
instRes *altv1.ListInstrumentsResponse
barsRes *altv1.ListBarsResponse
importRes *altv1.ImportDailyBarsResponse
paperStartRes *altv1.StartPaperTradingResponse
paperStateRes *altv1.GetPaperTradingStateResponse
paperSubmitRes *altv1.SubmitPaperOrderResponse
paperCancelRes *altv1.CancelPaperOrderResponse
paperFillRes *altv1.FillPaperOrderResponse
liveCapRes *altv1.GetLiveBrokerCapabilitiesResponse
liveSubmitRes *altv1.SubmitLiveOrderResponse
liveCancelRes *altv1.CancelLiveOrderResponse
liveGetRes *altv1.GetLiveOrderResponse
startRes *altv1.StartBacktestResponse
getRunRes *altv1.GetBacktestRunResponse
listRes *altv1.ListBacktestRunsResponse
detailRes *altv1.GetBacktestRunDetailResponse
resultRes *altv1.GetBacktestResultResponse
compareRes *altv1.CompareBacktestRunsResponse
instRes *altv1.ListInstrumentsResponse
barsRes *altv1.ListBarsResponse
importRes *altv1.ImportDailyBarsResponse
paperStartRes *altv1.StartPaperTradingResponse
paperStateRes *altv1.GetPaperTradingStateResponse
paperSubmitRes *altv1.SubmitPaperOrderResponse
paperCancelRes *altv1.CancelPaperOrderResponse
paperFillRes *altv1.FillPaperOrderResponse
liveCapRes *altv1.GetLiveBrokerCapabilitiesResponse
liveSubmitRes *altv1.SubmitLiveOrderResponse
liveCancelRes *altv1.CancelLiveOrderResponse
liveGetRes *altv1.GetLiveOrderResponse
liveRiskPolicyRes *altv1.GetLiveRiskPolicyResponse
liveGetKillSwitchRes *altv1.GetLiveKillSwitchResponse
liveSetKillSwitchRes *altv1.SetLiveKillSwitchResponse
err error
connectErr error
@ -153,6 +159,18 @@ func (f *fakeWorkerClient) GetLiveOrder(ctx context.Context, req *altv1.GetLiveO
f.liveGetReq = req
return f.liveGetRes, f.err
}
func (f *fakeWorkerClient) GetLiveRiskPolicy(ctx context.Context, req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
f.liveRiskPolicyReq = req
return f.liveRiskPolicyRes, f.err
}
func (f *fakeWorkerClient) GetLiveKillSwitch(ctx context.Context, req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
f.liveGetKillSwitchReq = req
return f.liveGetKillSwitchRes, f.err
}
func (f *fakeWorkerClient) SetLiveKillSwitch(ctx context.Context, req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
f.liveSetKillSwitchReq = req
return f.liveSetKillSwitchRes, f.err
}
func validStart() *altv1.StartBacktestRequest {
return &altv1.StartBacktestRequest{Spec: &altv1.BacktestRunSpec{StrategyId: "strat-abc"}}

96
services/api/internal/socket/live.go
View file

@ -46,9 +46,105 @@ func apiLiveHandlers(worker workerclient.WorkerClient) []sessionHandler {
})
},
},
{
requestType: protoSocket.TypeNameOf(&altv1.GetLiveRiskPolicyRequest{}),
register: func(client *protoSocket.WsClient) {
protoSocket.AddRequestListenerTyped[*altv1.GetLiveRiskPolicyRequest, *altv1.GetLiveRiskPolicyResponse](&client.Communicator, func(req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
return handleGetLiveRiskPolicy(worker, req)
})
},
},
{
requestType: protoSocket.TypeNameOf(&altv1.GetLiveKillSwitchRequest{}),
register: func(client *protoSocket.WsClient) {
protoSocket.AddRequestListenerTyped[*altv1.GetLiveKillSwitchRequest, *altv1.GetLiveKillSwitchResponse](&client.Communicator, func(req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
return handleGetLiveKillSwitch(worker, req)
})
},
},
{
requestType: protoSocket.TypeNameOf(&altv1.SetLiveKillSwitchRequest{}),
register: func(client *protoSocket.WsClient) {
protoSocket.AddRequestListenerTyped[*altv1.SetLiveKillSwitchRequest, *altv1.SetLiveKillSwitchResponse](&client.Communicator, func(req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
return handleSetLiveKillSwitch(worker, req)
})
},
},
}
}
func handleGetLiveRiskPolicy(worker workerclient.WorkerClient, req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
if req.GetAccountId() == "" {
return &altv1.GetLiveRiskPolicyResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorInvalidRequest, Message: "get_live_risk_policy: account_id is required"},
}, nil
}
if worker == nil {
return &altv1.GetLiveRiskPolicyResponse{Error: workerUnavailable()}, nil
}
ctx, cancel := context.WithTimeout(context.Background(), workerRequestTimeout)
defer cancel()
if err := worker.Connect(ctx); err != nil {
return &altv1.GetLiveRiskPolicyResponse{Error: workerErrorInfo(err)}, nil
}
res, err := worker.GetLiveRiskPolicy(ctx, req)
if err != nil {
return &altv1.GetLiveRiskPolicyResponse{Error: workerErrorInfo(err)}, nil
}
if res == nil {
return &altv1.GetLiveRiskPolicyResponse{Error: internalError("worker returned no live risk policy response")}, nil
}
return res, nil
}
func handleGetLiveKillSwitch(worker workerclient.WorkerClient, req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
if req.GetAccountId() == "" {
return &altv1.GetLiveKillSwitchResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorInvalidRequest, Message: "get_live_kill_switch: account_id is required"},
}, nil
}
if worker == nil {
return &altv1.GetLiveKillSwitchResponse{Error: workerUnavailable()}, nil
}
ctx, cancel := context.WithTimeout(context.Background(), workerRequestTimeout)
defer cancel()
if err := worker.Connect(ctx); err != nil {
return &altv1.GetLiveKillSwitchResponse{Error: workerErrorInfo(err)}, nil
}
res, err := worker.GetLiveKillSwitch(ctx, req)
if err != nil {
return &altv1.GetLiveKillSwitchResponse{Error: workerErrorInfo(err)}, nil
}
if res == nil {
return &altv1.GetLiveKillSwitchResponse{Error: internalError("worker returned no live kill switch response")}, nil
}
return res, nil
}
func handleSetLiveKillSwitch(worker workerclient.WorkerClient, req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
if req.GetAccountId() == "" {
return &altv1.SetLiveKillSwitchResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorInvalidRequest, Message: "set_live_kill_switch: account_id is required"},
}, nil
}
if worker == nil {
return &altv1.SetLiveKillSwitchResponse{Error: workerUnavailable()}, nil
}
ctx, cancel := context.WithTimeout(context.Background(), workerRequestTimeout)
defer cancel()
if err := worker.Connect(ctx); err != nil {
return &altv1.SetLiveKillSwitchResponse{Error: workerErrorInfo(err)}, nil
}
res, err := worker.SetLiveKillSwitch(ctx, req)
if err != nil {
return &altv1.SetLiveKillSwitchResponse{Error: workerErrorInfo(err)}, nil
}
if res == nil {
return &altv1.SetLiveKillSwitchResponse{Error: internalError("worker returned no set live kill switch response")}, nil
}
return res, nil
}
func handleGetLiveBrokerCapabilities(worker workerclient.WorkerClient, req *altv1.GetLiveBrokerCapabilitiesRequest) (*altv1.GetLiveBrokerCapabilitiesResponse, error) {
if req.GetAccountId() == "" {
return &altv1.GetLiveBrokerCapabilitiesResponse{

121
services/api/internal/socket/live_test.go
View file

@ -160,6 +160,14 @@ func TestLiveParserMapContainsLiveMessages(t *testing.T) {
&altv1.CancelLiveOrderResponse{},
&altv1.GetLiveOrderRequest{},
&altv1.GetLiveOrderResponse{},
&altv1.GetLiveRiskPolicyRequest{},
&altv1.GetLiveRiskPolicyResponse{},
&altv1.LiveRiskPolicy{},
&altv1.GetLiveKillSwitchRequest{},
&altv1.GetLiveKillSwitchResponse{},
&altv1.SetLiveKillSwitchRequest{},
&altv1.SetLiveKillSwitchResponse{},
&altv1.LiveKillSwitchState{},
} {
name := protoSocket.TypeNameOf(m)
if _, ok := pm[name]; !ok {
@ -168,6 +176,119 @@ func TestLiveParserMapContainsLiveMessages(t *testing.T) {
}
}
func TestHandleGetLiveRiskPolicyForward(t *testing.T) {
worker := &fakeWorkerClient{
liveRiskPolicyRes: &altv1.GetLiveRiskPolicyResponse{
Policy: &altv1.LiveRiskPolicy{MaxDailyOrders: 5, MaxOpenOrders: 3, AllowShortSelling: false},
},
isConnected: true,
}
resp, err := handleGetLiveRiskPolicy(worker, &altv1.GetLiveRiskPolicyRequest{AccountId: "acct-1"})
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if resp.GetError() != nil {
t.Fatalf("unexpected typed error: %+v", resp.GetError())
}
if resp.GetPolicy() == nil {
t.Fatal("expected policy, got nil")
}
if resp.GetPolicy().GetMaxDailyOrders() != 5 {
t.Errorf("expected max_daily_orders 5, got %d", resp.GetPolicy().GetMaxDailyOrders())
}
if worker.liveRiskPolicyReq == nil {
t.Error("expected worker to be called")
}
}
func TestHandleGetLiveRiskPolicyMissingAccountID(t *testing.T) {
worker := &fakeWorkerClient{isConnected: true}
resp, err := handleGetLiveRiskPolicy(worker, &altv1.GetLiveRiskPolicyRequest{})
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if resp.GetError() == nil {
t.Fatal("expected typed error, got nil")
}
if resp.GetError().GetCode() != backtestErrorInvalidRequest {
t.Errorf("expected invalid_request, got %q", resp.GetError().GetCode())
}
if worker.liveRiskPolicyReq != nil {
t.Error("worker should not be called when account_id is missing")
}
}
func TestHandleGetLiveKillSwitchForward(t *testing.T) {
worker := &fakeWorkerClient{
liveGetKillSwitchRes: &altv1.GetLiveKillSwitchResponse{
State: &altv1.LiveKillSwitchState{Halted: true, Reason: "kill switch active by default"},
},
isConnected: true,
}
resp, err := handleGetLiveKillSwitch(worker, &altv1.GetLiveKillSwitchRequest{AccountId: "acct-1"})
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if resp.GetError() != nil {
t.Fatalf("unexpected typed error: %+v", resp.GetError())
}
if resp.GetState() == nil {
t.Fatal("expected state, got nil")
}
if !resp.GetState().GetHalted() {
t.Error("expected halted=true")
}
if worker.liveGetKillSwitchReq == nil {
t.Error("expected worker to be called")
}
}
func TestHandleSetLiveKillSwitchForward(t *testing.T) {
worker := &fakeWorkerClient{
liveSetKillSwitchRes: &altv1.SetLiveKillSwitchResponse{
State: &altv1.LiveKillSwitchState{Halted: false, Reason: "operator cleared"},
},
isConnected: true,
}
resp, err := handleSetLiveKillSwitch(worker, &altv1.SetLiveKillSwitchRequest{
AccountId: "acct-1",
Halted: false,
Reason: "operator cleared",
})
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if resp.GetError() != nil {
t.Fatalf("unexpected typed error: %+v", resp.GetError())
}
if resp.GetState() == nil {
t.Fatal("expected state, got nil")
}
if resp.GetState().GetHalted() {
t.Error("expected halted=false after operator clear")
}
if resp.GetState().GetReason() != "operator cleared" {
t.Errorf("unexpected reason: %q", resp.GetState().GetReason())
}
if worker.liveSetKillSwitchReq == nil {
t.Error("expected worker to be called")
}
}
func TestHandleSetLiveKillSwitchMissingAccountID(t *testing.T) {
worker := &fakeWorkerClient{isConnected: true}
resp, err := handleSetLiveKillSwitch(worker, &altv1.SetLiveKillSwitchRequest{Halted: false})
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if resp.GetError() == nil {
t.Fatal("expected typed error, got nil")
}
if resp.GetError().GetCode() != backtestErrorInvalidRequest {
t.Errorf("expected invalid_request, got %q", resp.GetError().GetCode())
}
}
func TestHandleSubmitLiveOrderForward(t *testing.T) {
worker := &fakeWorkerClient{
liveSubmitRes: &altv1.SubmitLiveOrderResponse{Order: &altv1.LiveOrder{Id: "lo-1", Status: "submitted"}},

18
services/api/internal/workerclient/client.go
View file

@ -66,6 +66,12 @@ type WorkerClient interface {
SubmitLiveOrder(ctx context.Context, req *altv1.SubmitLiveOrderRequest) (*altv1.SubmitLiveOrderResponse, error)
CancelLiveOrder(ctx context.Context, req *altv1.CancelLiveOrderRequest) (*altv1.CancelLiveOrderResponse, error)
GetLiveOrder(ctx context.Context, req *altv1.GetLiveOrderRequest) (*altv1.GetLiveOrderResponse, error)
// Live risk/kill switch surface. Policy query and kill switch get/set stay
// worker-owned; the API only validates and forwards.
GetLiveRiskPolicy(ctx context.Context, req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error)
GetLiveKillSwitch(ctx context.Context, req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error)
SetLiveKillSwitch(ctx context.Context, req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error)
}
type socketClient struct {
@ -222,6 +228,18 @@ func (c *socketClient) GetLiveOrder(ctx context.Context, req *altv1.GetLiveOrder
return sendTyped[*altv1.GetLiveOrderRequest, *altv1.GetLiveOrderResponse](c, ctx, req)
}
func (c *socketClient) GetLiveRiskPolicy(ctx context.Context, req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
return sendTyped[*altv1.GetLiveRiskPolicyRequest, *altv1.GetLiveRiskPolicyResponse](c, ctx, req)
}
func (c *socketClient) GetLiveKillSwitch(ctx context.Context, req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
return sendTyped[*altv1.GetLiveKillSwitchRequest, *altv1.GetLiveKillSwitchResponse](c, ctx, req)
}
func (c *socketClient) SetLiveKillSwitch(ctx context.Context, req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
return sendTyped[*altv1.SetLiveKillSwitchRequest, *altv1.SetLiveKillSwitchResponse](c, ctx, req)
}
// sendTyped is the shared request path for every worker call. It centralises
// context-cancellation, deadline-derived timeouts, and the unavailable/timeout
// error mapping so each new request method stays a one-line forwarder and the

11
services/worker/internal/contracts/parser_map.go
View file

@ -57,6 +57,17 @@ func messageFactories() []func() proto.Message {
func() proto.Message { return &altv1.CancelLiveOrderResponse{} },
func() proto.Message { return &altv1.GetLiveOrderRequest{} },
func() proto.Message { return &altv1.GetLiveOrderResponse{} },
// live risk/kill switch surface: policy query, kill switch query/set
func() proto.Message { return &altv1.GetLiveRiskPolicyRequest{} },
func() proto.Message { return &altv1.GetLiveRiskPolicyResponse{} },
func() proto.Message { return &altv1.LiveRiskPolicy{} },
func() proto.Message { return &altv1.GetLiveKillSwitchRequest{} },
func() proto.Message { return &altv1.GetLiveKillSwitchResponse{} },
func() proto.Message { return &altv1.SetLiveKillSwitchRequest{} },
func() proto.Message { return &altv1.SetLiveKillSwitchResponse{} },
func() proto.Message { return &altv1.LiveKillSwitchState{} },
// live risk decision: included in SubmitLiveOrderResponse when risk blocked
func() proto.Message { return &altv1.LiveRiskDecision{} },
}
}

21
services/worker/internal/livetrading/config.go Normal file
View file

@ -0,0 +1,21 @@
package livetrading
import (
"git.toki-labs.com/toki/alt/packages/domain/market"
"git.toki-labs.com/toki/alt/packages/domain/trading"
)
// DefaultRiskPolicy returns the worker's conservative default live risk policy.
// These values limit accidental large orders; operators can adjust them at
// runtime via Service.SetRiskPolicy without restarting the worker.
func DefaultRiskPolicy() trading.RiskPolicy {
return trading.RiskPolicy{
MaxOrderNotionalByCurrency: map[market.Currency]market.Decimal{
market.CurrencyKRW: {Value: "1000000"},
market.CurrencyUSD: {Value: "1000"},
},
MaxDailyOrders: 5,
MaxOpenOrders: 3,
AllowShortSelling: false,
}
}

148
services/worker/internal/livetrading/service.go
View file

@ -73,28 +73,82 @@ var (
// ErrInvalidIntent is returned when the live order intent is malformed:
// missing instrument_id, invalid side, non-positive quantity, or missing type.
ErrInvalidIntent = errors.New("invalid live order intent")
// ErrRiskBlocked is returned when the kill switch is halted or the order
// intent violates the active risk policy. The broker is never called.
ErrRiskBlocked = errors.New("live order blocked by risk policy")
)
// Service is the worker-owned live trading runtime. It keeps an in-memory order
// registry and delegates execution to a BrokerPort. A nil BrokerPort means live
// trading is disabled; all order operations return ErrBrokerUnavailable.
type Service struct {
broker BrokerPort
mu sync.RWMutex
orders map[string]*LiveOrder
seq int64
broker BrokerPort
mu sync.RWMutex
orders map[string]*LiveOrder
seq int64
policyMu sync.RWMutex
policy trading.RiskPolicy
killSwitch trading.KillSwitchState
acctMuMu sync.Mutex // protects acctMus
acctMus map[string]*sync.Mutex // per-account submit serialization
}
// NewService creates a Service backed by broker. Pass nil to operate in a
// disabled/unavailable mode (broker capability probe and order operations all
// return ErrBrokerUnavailable).
// NewService creates a Service backed by broker with the default risk policy
// and a halted kill switch. Pass nil broker to operate in disabled/unavailable
// mode (broker capability probe and order operations all return ErrBrokerUnavailable).
func NewService(broker BrokerPort) *Service {
return &Service{
broker: broker,
orders: make(map[string]*LiveOrder),
broker: broker,
orders: make(map[string]*LiveOrder),
policy: DefaultRiskPolicy(),
killSwitch: trading.DefaultKillSwitch(),
acctMus: make(map[string]*sync.Mutex),
}
}
// submitLockForAccount returns the per-account mutex for submit serialization,
// creating it if it does not yet exist.
func (s *Service) submitLockForAccount(accountID string) *sync.Mutex {
s.acctMuMu.Lock()
mu, ok := s.acctMus[accountID]
if !ok {
mu = &sync.Mutex{}
s.acctMus[accountID] = mu
}
s.acctMuMu.Unlock()
return mu
}
// GetRiskPolicy returns the current risk policy.
func (s *Service) GetRiskPolicy() trading.RiskPolicy {
s.policyMu.RLock()
defer s.policyMu.RUnlock()
return s.policy
}
// SetRiskPolicy replaces the active risk policy.
func (s *Service) SetRiskPolicy(policy trading.RiskPolicy) {
s.policyMu.Lock()
s.policy = policy
s.policyMu.Unlock()
}
// GetKillSwitch returns the current kill switch state.
func (s *Service) GetKillSwitch() trading.KillSwitchState {
s.policyMu.RLock()
defer s.policyMu.RUnlock()
return s.killSwitch
}
// SetKillSwitch replaces the active kill switch state and returns the new state.
func (s *Service) SetKillSwitch(ks trading.KillSwitchState) trading.KillSwitchState {
s.policyMu.Lock()
s.killSwitch = ks
s.policyMu.Unlock()
return ks
}
// GetLiveBrokerCapabilities proxies the capability probe to the BrokerPort.
func (s *Service) GetLiveBrokerCapabilities(ctx context.Context, accountID string) (trading.BrokerCapability, error) {
if s.broker == nil {
@ -153,16 +207,40 @@ func (s *Service) SubmitLiveOrder(ctx context.Context, req SubmitRequest) (LiveO
if err := validateIntent(req.Intent); err != nil {
return LiveOrder{}, err
}
// Nil broker check before acquiring account mutex so ErrBrokerUnavailable
// takes precedence over risk evaluation regardless of kill switch state.
if s.broker == nil {
return LiveOrder{}, ErrBrokerUnavailable
}
// Serialize same-account submits from risk evaluation through broker call and
// order storage. Different accounts proceed independently.
acctMu := s.submitLockForAccount(req.AccountID)
acctMu.Lock()
defer acctMu.Unlock()
// Snapshot policy and kill switch after acquiring the account mutex so
// queued submits see the current state rather than a stale pre-wait copy.
s.policyMu.RLock()
policy := s.policy
ks := s.killSwitch
s.policyMu.RUnlock()
now := time.Now().UTC()
s.mu.RLock()
usage := s.riskUsageForAccount(req.AccountID, now)
s.mu.RUnlock()
if decision := trading.EvaluateRisk(policy, ks, req.Intent, usage); !decision.Allowed {
return s.recordRiskRejectedOrder(req, decision, now)
}
result, err := s.broker.SubmitOrder(ctx, req.AccountID, req.Intent)
if err != nil {
return LiveOrder{}, err
}
now := time.Now().UTC()
s.mu.Lock()
s.seq++
id := fmt.Sprintf("lo-%s-%d", req.AccountID, s.seq)
@ -183,6 +261,56 @@ func (s *Service) SubmitLiveOrder(ctx context.Context, req SubmitRequest) (LiveO
return *order, nil
}
// isTerminalStatus returns true when status represents a final order state.
// Terminal orders are excluded from the open order count for risk evaluation.
func isTerminalStatus(status trading.OrderStatus) bool {
switch status {
case trading.OrderStatusFilled, trading.OrderStatusCanceled, trading.OrderStatusRejected:
return true
}
return false
}
// riskUsageForAccount returns the current daily and open order counts for
// accountID. Callers must hold s.mu (at least RLock) while calling this.
func (s *Service) riskUsageForAccount(accountID string, now time.Time) trading.RiskUsage {
todayUTC := now.Truncate(24 * time.Hour)
var daily, open int
for _, o := range s.orders {
if o.AccountID != accountID {
continue
}
if !o.CreatedAt.Before(todayUTC) {
daily++
}
if !isTerminalStatus(o.Status) {
open++
}
}
return trading.RiskUsage{DailyOrderCount: daily, OpenOrderCount: open}
}
// recordRiskRejectedOrder creates an in-memory rejected live order for a
// risk-blocked submission, stores it, and returns both the order and the
// typed ErrRiskBlocked error so the socket layer can surface both.
func (s *Service) recordRiskRejectedOrder(req SubmitRequest, decision trading.RiskDecision, now time.Time) (LiveOrder, error) {
s.mu.Lock()
s.seq++
id := fmt.Sprintf("lo-%s-%d", req.AccountID, s.seq)
order := &LiveOrder{
ID: id,
AccountID: req.AccountID,
Intent: req.Intent,
Status: trading.OrderStatusRejected,
RejectionReason: decision.Reason,
CreatedAt: now,
UpdatedAt: now,
}
s.orders[id] = order
s.mu.Unlock()
return *order, fmt.Errorf("%w: %s", ErrRiskBlocked, decision.Reason)
}
// CancelLiveOrder asks the BrokerPort to cancel the order identified by
// liveOrderID and updates the in-memory status with the broker response.
func (s *Service) CancelLiveOrder(ctx context.Context, accountID, liveOrderID string) (LiveOrder, error) {

429
services/worker/internal/livetrading/service_test.go
View file

@ -3,7 +3,9 @@ package livetrading
import (
"context"
"errors"
"sync"
"testing"
"time"
"git.toki-labs.com/toki/alt/packages/domain/market"
"git.toki-labs.com/toki/alt/packages/domain/trading"
@ -81,6 +83,7 @@ func TestSubmitLiveOrderPreservesCustomOrderType(t *testing.T) {
},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
req := confirmedReq("acct-1", "KRX:005930", "kis_best_limit")
order, err := svc.SubmitLiveOrder(context.Background(), req)
@ -97,6 +100,7 @@ func TestSubmitLiveOrderCallsBrokerOnlyAfterConfirmation(t *testing.T) {
submitResult: OrderResult{BrokerOrderID: "b-1", Status: trading.OrderStatusSubmitted, BrokerStatus: "ACCEPTED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
// Unconfirmed: broker must NOT be called.
req := confirmedReq("acct-1", "KRX:005930", "market")
@ -266,6 +270,7 @@ func TestSubmitLiveOrderMalformedIntentDoesNotReachBroker(t *testing.T) {
func TestSubmitLiveOrderBrokerUnavailable(t *testing.T) {
svc := NewService(nil)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
req := confirmedReq("acct-1", "KRX:005930", "market")
_, err := svc.SubmitLiveOrder(context.Background(), req)
@ -280,6 +285,7 @@ func TestCancelLiveOrderTransitionsStatus(t *testing.T) {
cancelResult: OrderResult{BrokerOrderID: "broker-001", Status: trading.OrderStatusCanceled, BrokerStatus: "CANCELED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
order, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "limit"))
if err != nil {
@ -313,6 +319,7 @@ func TestGetLiveOrderReturnsBrokerStatus(t *testing.T) {
statusResult: OrderResult{BrokerOrderID: "broker-001", Status: trading.OrderStatusFilled, BrokerStatus: "FILLED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
order, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if err != nil {
@ -338,3 +345,425 @@ func TestGetLiveBrokerCapabilitiesUnavailable(t *testing.T) {
t.Fatalf("expected ErrBrokerUnavailable, got %v", err)
}
}
func TestSubmitLiveOrderKillSwitchBlocksBeforeBroker(t *testing.T) {
broker := &fakeBroker{
submitResult: OrderResult{BrokerOrderID: "b-1", Status: "submitted", BrokerStatus: "ACCEPTED"},
}
svc := NewService(broker)
// NewService starts with kill switch halted=true.
req := confirmedReq("acct-1", "KRX:005930", "market")
_, err := svc.SubmitLiveOrder(context.Background(), req)
if !errors.Is(err, ErrRiskBlocked) {
t.Fatalf("expected ErrRiskBlocked when kill switch is halted, got %v", err)
}
if broker.submitCalls != 0 {
t.Errorf("broker must not be called when kill switch is halted, got %d calls", broker.submitCalls)
}
}
func TestSubmitLiveOrderMaxNotionalBlocks(t *testing.T) {
broker := &fakeBroker{
submitResult: OrderResult{BrokerOrderID: "b-1", Status: "submitted", BrokerStatus: "ACCEPTED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
// 20 * 75000 = 1500000 > 1000000 (default KRW limit)
req := SubmitRequest{
AccountID: "acct-1",
Intent: trading.OrderIntent{
InstrumentID: market.InstrumentID("KRX:005930"),
Side: trading.OrderSideBuy,
Quantity: market.Quantity{Amount: market.Decimal{Value: "20"}},
Type: trading.OrderType("limit"),
LimitPrice: market.Price{Currency: market.CurrencyKRW, Amount: market.Decimal{Value: "75000"}},
},
Confirmation: OperatorConfirmation{Confirmed: true, OperatorID: "op-1"},
}
_, err := svc.SubmitLiveOrder(context.Background(), req)
if !errors.Is(err, ErrRiskBlocked) {
t.Fatalf("expected ErrRiskBlocked for excessive notional, got %v", err)
}
if broker.submitCalls != 0 {
t.Errorf("broker must not be called when notional exceeds limit, got %d calls", broker.submitCalls)
}
}
func TestSubmitLiveOrderRiskAllowedCallsBroker(t *testing.T) {
broker := &fakeBroker{
submitResult: OrderResult{BrokerOrderID: "b-1", Status: "submitted", BrokerStatus: "ACCEPTED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
// 1 * 75000 = 75000 < 1000000
req := SubmitRequest{
AccountID: "acct-1",
Intent: trading.OrderIntent{
InstrumentID: market.InstrumentID("KRX:005930"),
Side: trading.OrderSideBuy,
Quantity: market.Quantity{Amount: market.Decimal{Value: "1"}},
Type: trading.OrderType("limit"),
LimitPrice: market.Price{Currency: market.CurrencyKRW, Amount: market.Decimal{Value: "75000"}},
},
Confirmation: OperatorConfirmation{Confirmed: true, OperatorID: "op-1"},
}
_, err := svc.SubmitLiveOrder(context.Background(), req)
if err != nil {
t.Fatalf("expected success for allowed order, got %v", err)
}
if broker.submitCalls != 1 {
t.Errorf("expected exactly 1 broker call, got %d", broker.submitCalls)
}
}
func TestSetAndGetKillSwitch(t *testing.T) {
svc := NewService(nil)
got := svc.GetKillSwitch()
if !got.Halted {
t.Error("default kill switch must be halted")
}
svc.SetKillSwitch(trading.KillSwitchState{Halted: false, Reason: "test"})
got = svc.GetKillSwitch()
if got.Halted {
t.Error("expected kill switch unhalted after SetKillSwitch")
}
if got.Reason != "test" {
t.Errorf("expected reason %q, got %q", "test", got.Reason)
}
}
func TestSubmitLiveOrderMaxDailyOrdersBlocksBeforeBroker(t *testing.T) {
broker := &fakeBroker{
submitResult: OrderResult{BrokerOrderID: "b-1", Status: trading.OrderStatusSubmitted, BrokerStatus: "ACCEPTED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
// Lower limit to 2 so we hit it quickly in the test.
policy := svc.GetRiskPolicy()
policy.MaxDailyOrders = 2
svc.SetRiskPolicy(policy)
// First two submits must reach the broker.
for i := 0; i < 2; i++ {
_, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if err != nil {
t.Fatalf("submit %d unexpected error: %v", i+1, err)
}
}
if broker.submitCalls != 2 {
t.Fatalf("expected 2 broker calls before limit, got %d", broker.submitCalls)
}
// Third submit must be blocked before the broker.
_, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if !errors.Is(err, ErrRiskBlocked) {
t.Fatalf("expected ErrRiskBlocked at daily limit, got %v", err)
}
if broker.submitCalls != 2 {
t.Errorf("broker must not be called when daily limit is reached, got %d calls", broker.submitCalls)
}
}
func TestSubmitLiveOrderMaxOpenOrdersBlocksBeforeBroker(t *testing.T) {
broker := &fakeBroker{
submitResult: OrderResult{BrokerOrderID: "b-1", Status: trading.OrderStatusSubmitted, BrokerStatus: "ACCEPTED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
policy := svc.GetRiskPolicy()
policy.MaxOpenOrders = 2
policy.MaxDailyOrders = 0 // disable daily limit to isolate open-order check
svc.SetRiskPolicy(policy)
// Submit two open orders.
for i := 0; i < 2; i++ {
_, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if err != nil {
t.Fatalf("submit %d unexpected error: %v", i+1, err)
}
}
// Third submit must be blocked before the broker.
_, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if !errors.Is(err, ErrRiskBlocked) {
t.Fatalf("expected ErrRiskBlocked at open-order limit, got %v", err)
}
if broker.submitCalls != 2 {
t.Errorf("broker must not be called when open-order limit is reached, got %d calls", broker.submitCalls)
}
}
func TestSubmitLiveOrderRiskRejectedOrderNotCountedAsOpen(t *testing.T) {
broker := &fakeBroker{
submitResult: OrderResult{BrokerOrderID: "b-1", Status: trading.OrderStatusSubmitted, BrokerStatus: "ACCEPTED"},
}
svc := NewService(broker)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
policy := svc.GetRiskPolicy()
policy.MaxOpenOrders = 1
policy.MaxDailyOrders = 0
svc.SetRiskPolicy(policy)
// Submit one open order — at limit now.
_, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if err != nil {
t.Fatalf("first submit unexpected error: %v", err)
}
// Second attempt is blocked → creates a rejected order record.
rejOrder, err := svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if !errors.Is(err, ErrRiskBlocked) {
t.Fatalf("expected ErrRiskBlocked, got %v", err)
}
if rejOrder.Status != trading.OrderStatusRejected {
t.Errorf("expected rejected order, got status %q", rejOrder.Status)
}
// After a rejected order, open count must still be 1 (rejected is terminal).
// Temporarily set limit to 2 to allow a new open order.
policy.MaxOpenOrders = 2
svc.SetRiskPolicy(policy)
_, err = svc.SubmitLiveOrder(context.Background(), confirmedReq("acct-1", "KRX:005930", "market"))
if err != nil {
t.Errorf("expected allowed after policy relaxation (rejected order doesn't count as open), got %v", err)
}
}
func TestGetRiskPolicyReturnsDefault(t *testing.T) {
svc := NewService(nil)
p := svc.GetRiskPolicy()
if p.MaxDailyOrders != 5 {
t.Errorf("expected default MaxDailyOrders=5, got %d", p.MaxDailyOrders)
}
if p.MaxOpenOrders != 3 {
t.Errorf("expected default MaxOpenOrders=3, got %d", p.MaxOpenOrders)
}
if p.AllowShortSelling {
t.Error("expected default AllowShortSelling=false")
}
}
// blockingFakeBroker is a BrokerPort whose SubmitOrder blocks until released.
// It signals brokerEntered when the first call arrives so tests can synchronize.
type blockingFakeBroker struct {
result OrderResult
mu sync.Mutex
callCount int
brokerEntered chan struct{}
releaseCh chan struct{}
once sync.Once
}
func newBlockingFakeBroker(result OrderResult) *blockingFakeBroker {
return &blockingFakeBroker{
result: result,
brokerEntered: make(chan struct{}),
releaseCh: make(chan struct{}),
}
}
func (b *blockingFakeBroker) GetCapabilities(_ context.Context, _ string) (trading.BrokerCapability, error) {
return trading.BrokerCapability{}, nil
}
func (b *blockingFakeBroker) SubmitOrder(_ context.Context, _ string, _ trading.OrderIntent) (OrderResult, error) {
b.mu.Lock()
b.callCount++
b.mu.Unlock()
b.once.Do(func() { close(b.brokerEntered) })
<-b.releaseCh
return b.result, nil
}
func (b *blockingFakeBroker) CancelOrder(_ context.Context, _, _ string) (OrderResult, error) {
return OrderResult{}, nil
}
func (b *blockingFakeBroker) GetOrderStatus(_ context.Context, _, _ string) (OrderResult, error) {
return OrderResult{}, nil
}
func (b *blockingFakeBroker) calls() int {
b.mu.Lock()
defer b.mu.Unlock()
return b.callCount
}
func TestSubmitLiveOrderConcurrentMaxOpenOrdersBlocksBeforeBroker(t *testing.T) {
blocking := newBlockingFakeBroker(OrderResult{
BrokerOrderID: "b-1",
Status: trading.OrderStatusSubmitted,
BrokerStatus: "ACCEPTED",
})
svc := NewService(blocking)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
policy := svc.GetRiskPolicy()
policy.MaxOpenOrders = 1
policy.MaxDailyOrders = 0
svc.SetRiskPolicy(policy)
req := confirmedReq("acct-1", "KRX:005930", "market")
var wg sync.WaitGroup
orders := make([]LiveOrder, 2)
errs := make([]error, 2)
wg.Add(1)
go func() {
defer wg.Done()
orders[0], errs[0] = svc.SubmitLiveOrder(context.Background(), req)
}()
// Wait until submit 1 is inside the broker (holding the account mutex).
<-blocking.brokerEntered
wg.Add(1)
go func() {
defer wg.Done()
orders[1], errs[1] = svc.SubmitLiveOrder(context.Background(), req)
}()
// Release the broker so submit 1 stores its order and releases the account mutex.
close(blocking.releaseCh)
wg.Wait()
if blocking.calls() != 1 {
t.Errorf("expected 1 broker call, got %d", blocking.calls())
}
if errs[0] != nil {
t.Errorf("submit 1: expected success, got %v", errs[0])
}
if !errors.Is(errs[1], ErrRiskBlocked) {
t.Errorf("submit 2: expected ErrRiskBlocked, got %v", errs[1])
}
if orders[1].Status != trading.OrderStatusRejected {
t.Errorf("submit 2: expected rejected order status, got %q", orders[1].Status)
}
}
func TestSubmitLiveOrderConcurrentMaxDailyOrdersBlocksBeforeBroker(t *testing.T) {
blocking := newBlockingFakeBroker(OrderResult{
BrokerOrderID: "b-1",
Status: trading.OrderStatusSubmitted,
BrokerStatus: "ACCEPTED",
})
svc := NewService(blocking)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
policy := svc.GetRiskPolicy()
policy.MaxDailyOrders = 1
policy.MaxOpenOrders = 0
svc.SetRiskPolicy(policy)
req := confirmedReq("acct-1", "KRX:005930", "market")
var wg sync.WaitGroup
orders := make([]LiveOrder, 2)
errs := make([]error, 2)
wg.Add(1)
go func() {
defer wg.Done()
orders[0], errs[0] = svc.SubmitLiveOrder(context.Background(), req)
}()
<-blocking.brokerEntered
wg.Add(1)
go func() {
defer wg.Done()
orders[1], errs[1] = svc.SubmitLiveOrder(context.Background(), req)
}()
close(blocking.releaseCh)
wg.Wait()
if blocking.calls() != 1 {
t.Errorf("expected 1 broker call, got %d", blocking.calls())
}
if errs[0] != nil {
t.Errorf("submit 1: expected success, got %v", errs[0])
}
if !errors.Is(errs[1], ErrRiskBlocked) {
t.Errorf("submit 2: expected ErrRiskBlocked, got %v", errs[1])
}
if orders[1].Status != trading.OrderStatusRejected {
t.Errorf("submit 2: expected rejected order status, got %q", orders[1].Status)
}
}
func TestSubmitLiveOrderQueuedKillSwitchBlocksBeforeBroker(t *testing.T) {
blocking := newBlockingFakeBroker(OrderResult{
BrokerOrderID: "b-1",
Status: trading.OrderStatusSubmitted,
BrokerStatus: "ACCEPTED",
})
svc := NewService(blocking)
svc.SetKillSwitch(trading.KillSwitchState{Halted: false})
policy := svc.GetRiskPolicy()
policy.MaxOpenOrders = 0
policy.MaxDailyOrders = 0
svc.SetRiskPolicy(policy)
req := confirmedReq("acct-1", "KRX:005930", "market")
var wg sync.WaitGroup
orders := make([]LiveOrder, 2)
errs := make([]error, 2)
wg.Add(1)
go func() {
defer wg.Done()
orders[0], errs[0] = svc.SubmitLiveOrder(context.Background(), req)
}()
// Wait until submit 1 is inside the broker (holding the account mutex).
<-blocking.brokerEntered
wg.Add(1)
go func() {
defer wg.Done()
orders[1], errs[1] = svc.SubmitLiveOrder(context.Background(), req)
}()
// Give submit 2 time to reach the account mutex before changing kill switch state.
time.Sleep(time.Millisecond)
svc.SetKillSwitch(trading.KillSwitchState{Halted: true, Reason: "operator halt"})
close(blocking.releaseCh)
wg.Wait()
if blocking.calls() != 1 {
t.Errorf("expected 1 broker call, got %d", blocking.calls())
}
if errs[0] != nil {
t.Errorf("submit 1: expected success, got %v", errs[0])
}
if !errors.Is(errs[1], ErrRiskBlocked) {
t.Errorf("submit 2: expected ErrRiskBlocked, got %v", errs[1])
}
if orders[1].Status != trading.OrderStatusRejected {
t.Errorf("submit 2: expected rejected order, got %q", orders[1].Status)
}
if orders[1].RejectionReason != "operator halt" {
t.Errorf("submit 2: expected rejection reason 'operator halt', got %q", orders[1].RejectionReason)
}
}
func TestSubmitLiveOrderBrokerUnavailableWithDefaultKillSwitch(t *testing.T) {
// NewService(nil) default kill switch is halted=true. ErrBrokerUnavailable
// must take precedence over risk evaluation — no rejected order is created.
svc := NewService(nil)
req := confirmedReq("acct-1", "KRX:005930", "market")
_, err := svc.SubmitLiveOrder(context.Background(), req)
if !errors.Is(err, ErrBrokerUnavailable) {
t.Fatalf("expected ErrBrokerUnavailable even with default halted kill switch, got %v", err)
}
if errors.Is(err, ErrRiskBlocked) {
t.Error("ErrBrokerUnavailable must take precedence over ErrRiskBlocked for nil broker")
}
}

109
services/worker/internal/socket/live.go
View file

@ -10,15 +10,18 @@ import (
"git.toki-labs.com/toki/alt/services/worker/internal/livetrading"
)
// LiveService is the narrow interface for live broker capability discovery and
// the live order lifecycle. The livetrading package provides the concrete
// process-local implementation; the narrow interface keeps the handlers
// testable with a fake.
// LiveService is the narrow interface for live broker capability discovery,
// the live order lifecycle, and the risk/kill switch control surface.
// The livetrading package provides the concrete process-local implementation;
// the narrow interface keeps the handlers testable with a fake.
type LiveService interface {
GetLiveBrokerCapabilities(ctx context.Context, accountID string) (trading.BrokerCapability, error)
SubmitLiveOrder(ctx context.Context, req livetrading.SubmitRequest) (livetrading.LiveOrder, error)
CancelLiveOrder(ctx context.Context, accountID, liveOrderID string) (livetrading.LiveOrder, error)
GetLiveOrder(ctx context.Context, accountID, liveOrderID string) (livetrading.LiveOrder, error)
GetRiskPolicy() trading.RiskPolicy
GetKillSwitch() trading.KillSwitchState
SetKillSwitch(ks trading.KillSwitchState) trading.KillSwitchState
}
func liveHandlers(deps Deps) []sessionHandler {
@ -67,9 +70,91 @@ func liveHandlers(deps Deps) []sessionHandler {
)
},
},
{
requestType: protoSocket.TypeNameOf(&altv1.GetLiveRiskPolicyRequest{}),
register: func(client *protoSocket.WsClient) {
protoSocket.AddRequestListenerTyped[*altv1.GetLiveRiskPolicyRequest, *altv1.GetLiveRiskPolicyResponse](
&client.Communicator,
func(req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
return handleGetLiveRiskPolicy(deps, req)
},
)
},
},
{
requestType: protoSocket.TypeNameOf(&altv1.GetLiveKillSwitchRequest{}),
register: func(client *protoSocket.WsClient) {
protoSocket.AddRequestListenerTyped[*altv1.GetLiveKillSwitchRequest, *altv1.GetLiveKillSwitchResponse](
&client.Communicator,
func(req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
return handleGetLiveKillSwitch(deps, req)
},
)
},
},
{
requestType: protoSocket.TypeNameOf(&altv1.SetLiveKillSwitchRequest{}),
register: func(client *protoSocket.WsClient) {
protoSocket.AddRequestListenerTyped[*altv1.SetLiveKillSwitchRequest, *altv1.SetLiveKillSwitchResponse](
&client.Communicator,
func(req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
return handleSetLiveKillSwitch(deps, req)
},
)
},
},
}
}
func handleGetLiveRiskPolicy(deps Deps, req *altv1.GetLiveRiskPolicyRequest) (*altv1.GetLiveRiskPolicyResponse, error) {
if req.GetAccountId() == "" {
return &altv1.GetLiveRiskPolicyResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorInvalidRequest, Message: "get_live_risk_policy: account_id is required"},
}, nil
}
if deps.Live == nil {
return &altv1.GetLiveRiskPolicyResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorUnavailable, Message: "live trading is not available"},
}, nil
}
p := deps.Live.GetRiskPolicy()
return &altv1.GetLiveRiskPolicyResponse{Policy: riskPolicyToProto(p)}, nil
}
func handleGetLiveKillSwitch(deps Deps, req *altv1.GetLiveKillSwitchRequest) (*altv1.GetLiveKillSwitchResponse, error) {
if req.GetAccountId() == "" {
return &altv1.GetLiveKillSwitchResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorInvalidRequest, Message: "get_live_kill_switch: account_id is required"},
}, nil
}
if deps.Live == nil {
return &altv1.GetLiveKillSwitchResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorUnavailable, Message: "live trading is not available"},
}, nil
}
ks := deps.Live.GetKillSwitch()
return &altv1.GetLiveKillSwitchResponse{State: killSwitchToProto(ks)}, nil
}
func handleSetLiveKillSwitch(deps Deps, req *altv1.SetLiveKillSwitchRequest) (*altv1.SetLiveKillSwitchResponse, error) {
if req.GetAccountId() == "" {
return &altv1.SetLiveKillSwitchResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorInvalidRequest, Message: "set_live_kill_switch: account_id is required"},
}, nil
}
if deps.Live == nil {
return &altv1.SetLiveKillSwitchResponse{
Error: &altv1.ErrorInfo{Code: backtestErrorUnavailable, Message: "live trading is not available"},
}, nil
}
newKS := trading.KillSwitchState{
Halted: req.GetHalted(),
Reason: req.GetReason(),
}
result := deps.Live.SetKillSwitch(newKS)
return &altv1.SetLiveKillSwitchResponse{State: killSwitchToProto(result)}, nil
}
func handleGetLiveBrokerCapabilities(deps Deps, req *altv1.GetLiveBrokerCapabilitiesRequest) (*altv1.GetLiveBrokerCapabilitiesResponse, error) {
if req.GetAccountId() == "" {
return &altv1.GetLiveBrokerCapabilitiesResponse{
@ -125,9 +210,19 @@ func handleSubmitLiveOrder(deps Deps, req *altv1.SubmitLiveOrderRequest) (*altv1
order, err := deps.Live.SubmitLiveOrder(ctx, domainReq)
if err != nil {
code, msg := liveOrderErrorCode(err)
return &altv1.SubmitLiveOrderResponse{
resp := &altv1.SubmitLiveOrderResponse{
Error: &altv1.ErrorInfo{Code: code, Message: msg},
}, nil
}
// Risk-blocked submissions return both a rejected order record and the
// denial decision so headless operators can see which guard triggered.
if isLiveErr(err, livetrading.ErrRiskBlocked) && order.ID != "" {
resp.Order = liveOrderToProto(order)
resp.RiskDecision = riskDecisionToProto(trading.RiskDecision{
Allowed: false,
Reason: order.RejectionReason,
})
}
return resp, nil
}
return &altv1.SubmitLiveOrderResponse{Order: liveOrderToProto(order)}, nil
}
@ -200,6 +295,8 @@ func liveOrderErrorCode(err error) (code, message string) {
return backtestErrorInvalidRequest, err.Error()
case isLiveErr(err, livetrading.ErrInvalidIntent):
return backtestErrorInvalidRequest, err.Error()
case isLiveErr(err, livetrading.ErrRiskBlocked):
return backtestErrorInvalidRequest, err.Error()
case isLiveErr(err, livetrading.ErrBrokerUnavailable):
return backtestErrorUnavailable, err.Error()
case isLiveErr(err, livetrading.ErrOrderNotFound):

29
services/worker/internal/socket/live_mapping.go
View file

@ -115,3 +115,32 @@ func liveOrderToProto(o livetrading.LiveOrder) *altv1.LiveOrder {
func isLiveErr(err, target error) bool {
return errors.Is(err, target)
}
func riskPolicyToProto(p trading.RiskPolicy) *altv1.LiveRiskPolicy {
proto := &altv1.LiveRiskPolicy{
MaxDailyOrders: int32(p.MaxDailyOrders),
MaxOpenOrders: int32(p.MaxOpenOrders),
AllowShortSelling: p.AllowShortSelling,
}
if len(p.MaxOrderNotionalByCurrency) > 0 {
proto.MaxOrderNotionalByCurrency = make(map[string]string, len(p.MaxOrderNotionalByCurrency))
for cur, dec := range p.MaxOrderNotionalByCurrency {
proto.MaxOrderNotionalByCurrency[string(cur)] = dec.Value
}
}
return proto
}
func killSwitchToProto(ks trading.KillSwitchState) *altv1.LiveKillSwitchState {
return &altv1.LiveKillSwitchState{
Halted: ks.Halted,
Reason: ks.Reason,
}
}
func riskDecisionToProto(d trading.RiskDecision) *altv1.LiveRiskDecision {
return &altv1.LiveRiskDecision{
Allowed: d.Allowed,
Reason: d.Reason,
}
}

80
services/worker/internal/socket/live_test.go
View file

@ -3,6 +3,7 @@ package socket
import (
"context"
"errors"
"fmt"
"testing"
"time"
@ -22,6 +23,8 @@ type fakeLiveService struct {
cancelErr error
getOrder livetrading.LiveOrder
getErr error
policy trading.RiskPolicy
killSwitch trading.KillSwitchState
}
func (f *fakeLiveService) GetLiveBrokerCapabilities(ctx context.Context, accountID string) (trading.BrokerCapability, error) {
@ -40,6 +43,19 @@ func (f *fakeLiveService) GetLiveOrder(ctx context.Context, accountID, liveOrder
return f.getOrder, f.getErr
}
func (f *fakeLiveService) GetRiskPolicy() trading.RiskPolicy {
return f.policy
}
func (f *fakeLiveService) GetKillSwitch() trading.KillSwitchState {
return f.killSwitch
}
func (f *fakeLiveService) SetKillSwitch(ks trading.KillSwitchState) trading.KillSwitchState {
f.killSwitch = ks
return ks
}
func sampleLiveCapability() trading.BrokerCapability {
return trading.BrokerCapability{
Broker: trading.BrokerKIS,
@ -373,6 +389,26 @@ func TestHandleGetLiveOrderSuccess(t *testing.T) {
}
}
func TestHandleSubmitLiveOrderRiskBlockedReturnsInvalidRequest(t *testing.T) {
svc := &fakeLiveService{submitErr: livetrading.ErrRiskBlocked}
deps := Deps{Live: svc}
resp, err := handleSubmitLiveOrder(deps, &altv1.SubmitLiveOrderRequest{
AccountId: "acct-1",
Intent: &altv1.LiveOrderIntent{InstrumentId: "KRX:005930", Side: "buy", Type: "market"},
OperatorConfirmation: &altv1.OperatorConfirmation{Confirmed: true},
})
if err != nil {
t.Fatalf("unexpected go error: %v", err)
}
if resp.GetError() == nil {
t.Fatal("expected typed error, got nil")
}
if resp.GetError().GetCode() != backtestErrorInvalidRequest {
t.Errorf("expected invalid_request for risk-blocked, got %q", resp.GetError().GetCode())
}
}
func TestHandleSubmitLiveOrderLimitPriceCurrencyRoundTrip(t *testing.T) {
svc := &fakeLiveService{
submitOrder: livetrading.LiveOrder{
@ -418,6 +454,50 @@ func TestHandleSubmitLiveOrderLimitPriceCurrencyRoundTrip(t *testing.T) {
}
}
func TestHandleSubmitLiveOrderRiskBlockedIncludesOrderAndDecision(t *testing.T) {
rejOrder := livetrading.LiveOrder{
ID: "lo-acct-1-1",
AccountID: "acct-1",
Status: trading.OrderStatusRejected,
RejectionReason: "kill switch is active",
}
svc := &fakeLiveService{
submitOrder: rejOrder,
submitErr: fmt.Errorf("%w: kill switch is active", livetrading.ErrRiskBlocked),
}
deps := Deps{Live: svc}
resp, err := handleSubmitLiveOrder(deps, &altv1.SubmitLiveOrderRequest{
AccountId: "acct-1",
Intent: &altv1.LiveOrderIntent{InstrumentId: "KRX:005930", Side: "buy", Type: "market"},
OperatorConfirmation: &altv1.OperatorConfirmation{Confirmed: true},
})
if err != nil {
t.Fatalf("unexpected go error: %v", err)
}
if resp.GetError() == nil {
t.Fatal("expected typed error for risk-blocked, got nil")
}
if resp.GetError().GetCode() != backtestErrorInvalidRequest {
t.Errorf("expected invalid_request, got %q", resp.GetError().GetCode())
}
if resp.GetOrder() == nil {
t.Fatal("expected rejected order in response, got nil")
}
if resp.GetOrder().GetId() != "lo-acct-1-1" {
t.Errorf("unexpected order id: %q", resp.GetOrder().GetId())
}
if resp.GetRiskDecision() == nil {
t.Fatal("expected risk decision in response, got nil")
}
if resp.GetRiskDecision().GetAllowed() {
t.Error("expected risk decision allowed=false")
}
if resp.GetRiskDecision().GetReason() != "kill switch is active" {
t.Errorf("unexpected risk decision reason: %q", resp.GetRiskDecision().GetReason())
}
}
func TestHandleSubmitLiveOrderInvalidCurrencyReturnsInvalidRequest(t *testing.T) {
svc := &fakeLiveService{}
deps := Deps{Live: svc}