The non-interactive `login_with_credentials` path already speaks to
`AuthServiceClient` via gRPC. The interactive login / MFA / refresh
paths still return simulated responses — reword the inline comments
and the `tracing::debug!` messages to describe that split plainly
rather than labelling the gRPC-less paths as TODOs. The SECURITY
warn!() lines are untouched so the runtime signal remains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1. fxt MCP server tests: set XDG_CONFIG_HOME to writable temp dir
in test helper. On CI, $HOME=/root/ but pod runs as uid 1000,
so FileTokenStorage::new() fails reading /root/.config/.
2. risk test_hf_gate_check: remove sub-100μs latency assertion
(correctness test, not benchmark — flaky under CPU contention).
3. ml-labeling fractional_diff: remove sub-1μs latency assertions
from correctness tests (latency benchmark is already #[ignore]d).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace simulated login in fxt CLI with real AuthServiceClient gRPC call
- Add auth proto to fxt build.rs compile list and lib.rs proto module
- Add api.access permission to JWT claims issued by AuthGrpcService
- Remove orphaned ci-sensor.yaml (replaced by cluster-applied version)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- JWT issuer now foxhunt-api across all 16 files (services, tests, config, docker-compose)
- Remove serde alias api_gateway_url from FxtConfig (no backwards compat)
- Remove api_gateway CLI alias from e2e orchestrator
- All services must deploy simultaneously for JWT validation to match
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add live training metrics monitor CLI command (streaming & one-shot) using
the monitoring gRPC service. Update DQN tests to match post-fix defaults:
IQN disabled, CQL alpha=0.1, v_min/v_max widened, 26D search space.
- train.rs: `fxt train monitor [--once] [--model X] [--interval N]`
- Rewrite gradient collapse test for BF16 mixed precision awareness
- Update inference test config to match trainer defaults (IQN off, CQL on)
- Update production smoke test for 26D parameter space
- Add dqn_action_collapse_fix_test.rs verifying all 6 root cause fixes
- Add planning docs for monitoring service and epoch financial metrics
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add Training cockpit sub-tabs (Live/History) with expandable per-epoch
detail panel showing financial metrics, RL diagnostics, and gradient health.
History tab fetches completed/failed runs from ListTrainingJobs RPC.
Add scrollable pod table to Pods cockpit and compact pods summary to
Overview bottom row. Fix K8s API egress in api-gateway NetworkPolicy
(monitoring-service→prometheus, apply existing K8s API CIDR rules).
Add 62 new unit tests across event_loop (51) and data_fetcher (11)
covering all StateUpdate variants, ring buffer eviction, epoch history
accumulation, pod scroll helpers, and navigation edge cases.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All 32 MCP tool handlers now make real gRPC calls to the API Gateway
instead of returning stub responses. Covers: service monitoring,
training management, trading operations, ML inference, risk metrics,
broker status, data acquisition, cluster resources, agent control,
config management, and hyperopt tuning.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- StreamSystemStatus now queries real Prometheus data (was all zeros)
- StreamAlerts returns honest unimplemented (was sending empty events)
- Training epoch shows "N" not "N/0" (max_epochs not in proto)
- GPU power shows "300W" not "300W / 0W" when limit unavailable
- Services cockpit shows error reason when service is DOWN
- System status polling detects staleness after 3 consecutive failures
- Training cockpit header shows active K8s job count
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All 30 MCP tool handlers now return structured JSON error with
isError=true instead of fake "stub: would ..." placeholder responses.
Tool registrations preserved so list_tools still works.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
config_service.proto (package foxhunt.config, 4 RPCs) was a subset of
config.proto (package config, 12 RPCs). Migrated api_gateway to implement
ConfigService from config.proto directly. Removed dead config_service()
method from fxt client.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
57 references updated across source, tests, benches, and config.
Proto package name foxhunt.tli kept for wire compatibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace three occurrences of String::new() used as "fetch all" filter
values in gRPC request construction with a named FILTER_ALL constant,
making the intent explicit.
The api_gateway monitoring handler was reviewed but its Prometheus URL
appears only once in tests, so no constant was extracted (single-use).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use em-dash (—) consistently instead of mix of - and — for "no data"
placeholders across all cockpits (data, trading, risk, services, pods)
- Collapse pipeline status section to single "not connected" message
instead of showing 4 misleading rows of dashes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a new gRPC stream spawner that subscribes to SubscribeClusterPods
and groups pods by service name for the pods cockpit view. Follows the
same backoff/reconnect pattern used by all other stream spawners.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add K8s pod data structures to TUI state layer for the upcoming pods
cockpit view. PodData represents individual pods, PodGroupData groups
them by service with ready/total counts. The StateUpdate::Pods variant
and apply_update handler wire the data path from gRPC streams to state.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Flip 4 positions in the base64 payload instead of 1 to eliminate
any chance of environmental flakiness from OsRng contention.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Auto-refresh: before non-auth commands, if the access token is expired
but a refresh token exists, silently regenerate tokens. Prints
"Token refreshed." to stderr so users know what happened.
- FXT_PASSWORD: login reads password from this env var when set,
skipping the interactive prompt. Safer than a --password flag
(env vars don't appear in ps output or shell history).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
FoxhuntClient now holds an AuthInterceptor<FileTokenStorage> and
all 11 typed service accessors use with_interceptor() instead of
bare Channel::new(). This ensures every outgoing RPC automatically
includes the JWT Bearer token when one is cached on disk.
The bare channel() accessor is preserved for LoginClient which
needs unauthenticated access for the initial login RPC.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds accessor methods for all 11 service clients (trading, ml, ml_training,
broker_gateway, trading_agent, monitoring, config, data_acquisition, risk,
health, config_service). All clients share a single gRPC channel.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
fxt now compiles from the same service protos as all backend services.
Deleted 8 fat-client protos (3,286 lines) from bin/fxt/proto/.
Updated include_proto! macros to use new package names (trading, ml,
config instead of foxhunt.tli, foxhunt.ml, foxhunt.config).
Added risk, data_acquisition, and config_service proto modules.
Fixed duplicate include_proto in agent.rs to use crate::proto.
Existing command implementations will be rewritten to use new proto
types in Task 6.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add print_financial_metrics() to the monitor command, displaying
per-model Sharpe ratio (color-coded green/yellow/red), win rate,
max drawdown, profit factor, total return, trade count, and
action distribution (BUY/SELL/HOLD percentages). Only shown when
sessions report non-zero financial data.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add Sharpe/Win% columns to training list table, financial summary lines
(Sharpe, Sortino, Win Rate, Max DD, PF, Return, Avg, Trades) to the
detail overview, action distribution (BUY/SELL/HOLD %) to current metrics,
and four new sparklines (Sharpe, Win Rate, Max DD, Total Return) to the
Metrics sub-tab.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- trade_ml.rs: Replace 3 mock data fallbacks (submit, predictions,
performance) with proper error propagation. Commands now fail
honestly when the API Gateway is unreachable instead of silently
returning fake data. Mark 3 integration tests as #[ignore].
- monitoring_service: Add tonic-health with set_serving for
MonitoringServiceServer. Enables grpc_health_probe readiness checks.
- ml_training_service: Add tonic-health with set_serving for
MlTrainingServiceServer. Wired into both TLS and non-TLS paths.
- data_acquisition_service: Add tonic-health with set_serving for
DataAcquisitionServiceServer.
- ml/cuda_streams: Fix pre-existing unused variable clippy warning.
All 8 services now have standard gRPC health checking enabled.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The fxt client was using a hardcoded dev fallback secret for JWT signing,
causing InvalidSignature errors against the API gateway. Now reads
jwt_secret from ~/.foxhunt/config.toml with fallback chain:
env var > config file > dev secret.
Also updates default api_gateway_url to https://api.fxhnt.ai.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DashboardState with 4 tab substates (Training/Trading/Risk/System),
ring buffers for loss history and fills, scroll support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add DNS record, nginx gRPC proxy block, network policy for Tailscale
ingress, and auto-detect fxhnt.ai in fxt monitor URL derivation.
Show GPU telemetry even when no training sessions are active.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a new CLI subcommand that connects to the monitoring service via
gRPC to display live training metrics. Supports single-snapshot mode
(--once), model filtering (--model), and configurable streaming
interval. Renders per-model epoch/loss table, GPU telemetry, hyperopt
progress, and health counters.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- ibapi handshake: retry once after 1s on first failure (IB Gateway
needs time to release stale client_id slots after disconnection)
- test_load_nonexistent_config → test_load_config_succeeds: remove
default-value assertions that fail when ~/.foxhunt/config.toml exists
(defaults already tested by test_serde_defaults and test_default_config)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Match the actual K8s broker-gateway service port discovered during
live validation of fxt broker check.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The IB Gateway JVM uses non-blocking I/O on port 4002, which causes
EAGAIN errors with ibapi's blocking Client::connect(). The gnzsnz
image provides socat on port 4004 as a stable proxy that bridges
blocking clients to the non-blocking gateway socket.
Port 4004 is the correct client-facing port for paper mode (4003 for
live). The K8s readiness probe stays on 4002 since TCP probes work
fine with non-blocking sockets.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
