The dashboard NetworkPolicy blocked egress to the kube-apiserver (kube-proxy
DNATs kubernetes.default.svc 10.32.0.1:443 -> 172.16.0.11:6443, and both
10.32/16 and 100.64/15 were excepted). On a FRESH sidecar start (e.g. after
the CI deploy's scale-0->1) tailscale must read its ts-state Secret via the
apiserver -> without the allow it crashlooped 'context deadline exceeded' ->
bad gateway on dashboard.fxhnt.ai. Adds the 6443->172.16.0.11/32 egress rule,
mirroring the dagster NP fix (06d12fd). Pre-existing gap, surfaced by the
first pipeline deploy that recreated the dashboard pod.
The dashboard/dagster manifests bundled the tailscale-sidecar SA+Role+RoleBinding,
which forced the webhook-triggered fxhnt-ci-deployer SA to hold create/update/patch
on roles/rolebindings in its own namespace — a privilege-escalation primitive. Move
those 6 objects to infra/k8s/rbac/tailscale-sidecars.yaml, applied once out-of-band
(not by CI); trim the deployer Role to drop rbac.authorization.k8s.io entirely, and
drop serviceaccounts too since neither CI-applied manifest creates one anymore.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
C1 (Critical, CI review): dagster webserver/daemon + K8sRunLauncher job_image
were pinned to a hardcoded tag (dagster-k8s-25e3d7c), so a mode=build dep bump
updated the dashboard (:latest) but left dagster + its run Jobs on stale deps
-> version skew in the nightly ETL. Now :latest with image_pull_policy Always.
I1 (Important): a trap scales the dashboard back to replicas=1 on ANY exit
path, so a failure between scale-0 and scale-1 can't strand the cockpit at 0.
Superseded by fxhnt-cockpit-workflowtemplate.yaml + fxhnt-build-sensor.yaml
+ fxhnt-ci-rbac.yaml (all validated end-to-end, both modes). The old files
targeted decommissioned infra (ci-compile-cpu pool, gitea-sshd.foxhunt,
MinIO artifacts) and no longer worked.
The {{=sprig.trunc(...)}} expression wasn't evaluated by this Argo (v4.0.6) —
Kaniko received it literally and rejected it as an invalid tag. Use the plain
{{workflow.parameters.commit-sha}} substitution (which works everywhere else
in this template); the full 40-char sha is a valid Docker tag, no trunc needed.
/busybox/sh -c parsed the {{=sprig.trunc(...)}} destination and errored on
the '(' -> syntax error, exit 2. Switched to Kaniko's entrypoint + a plain
YAML args list (the proven msp build-image pattern): Argo evaluates the
expression and passes it straight to Kaniko, no shell. Also pin executor
v1.23.2 (matches msp; no busybox needed).
Requested cpu:2/mem:4Gi was sized for the removed dedicated ci-compile-cpu
pool; the shared large nodes (3800m, ~1.3-1.6 CPU free) couldn't schedule it
(Insufficient cpu, autoscaler didn't add nodes). cpu:1/mem:3Gi request
(limit 3/10Gi) fits and still builds fine (Kaniko is I/O-bound here).
The dashboard+dagster manifests bundle a ConfigMap, ServiceAccount, and the
tailscale-sidecar Role/RoleBinding alongside the Deployment, so kubectl apply
of the whole file needs those types. RBAC-management is scoped to foxhunt
only (documented as a deliberate, namespace-local trade-off).
archiveLogs=true was inherited from the old MinIO-backed pipeline; this
Argo has no artifact repository configured, so log archival failed the
step. We don't need archived logs -> false.
The cp-key-to-~/.ssh idiom failed under Argo's executor because emissary
doesn't set HOME=/root, so git couldn't find the key -> clone exit 128.
GIT_SSH_COMMAND with the absolute key path is HOME-independent (verified
cloning under HOME=/nonexistent). Applied to all three git-clone steps.
The reanimated template used the OLD foxhunt-cluster gitea SSH service
(gitea-sshd.foxhunt), which doesn't exist on bizworx -> git clone failed
with exit 128. The real service is gitea-ssh.gitea.svc:22 (verified: the
argo-git-ssh-key deploy key resolves gitadmin/fxhnt HEAD there).
Argo's executor reads a valueFrom.path output parameter from a mounted
volume, not the container rootfs -> /tmp/mode gave 'no such file or
directory'. /workspace is the shared emptyDir the step already mounts.
The reanimated template inherited topology.kubernetes.io/zone=fr-par-2 from
the old ci-compile-cpu pool, but all nodes (and every fxhnt workload)
are in fr-par-1 -> pods were Unschedulable. pool-name=large alone is correct.
First real workflow run surfaced two gaps: (1) the WorkflowTemplate's SA
argo-workflow didn't exist in foxhunt (only in argo where msp builds);
(2) argo-events-sa couldn't submit workflows cross-ns into foxhunt. Adds
the SA, a least-privilege deployer Role (apply/scale/annotate/rollout the
dashboard+dagster deployments, exactly what kubectl-deploy runs), the Argo
workflowtaskresults role, and a foxhunt-scoped workflow-submitter binding.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
commit-sha (from the untrusted Gitea webhook body.after) was substituted
INLINE into shell scripts via {{workflow.parameters.commit-sha}} in all
three git-clone/decide-mode steps -> a malicious payload could inject shell
on a cluster-privileged pod. Now passed via ENV + hex-validated before use
(the build-image template's pattern), and mode is allowlist-checked. Closes
the background security review's Orchestrator Template Injection finding.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Verified live: fxhnt-dashboard has its own dedicated tailscale sidecar
(TS_HOSTNAME=fxhnt-dashboard) and there is no Ingress/Gateway/VirtualService
in ns foxhunt routing dashboard.fxhnt.ai anywhere. fxhnt-ingress is an
unrelated nginx+tailscale pod (its own Deployment/Service, own tailscale
identity) for git/ssh routes, not the dashboard. The tailscale-session race
on `rollout restart` is real, so keep scale 0->1. Added the
fxhnt.io/deployed-sha annotation on both fxhnt-dashboard and dagster before
the rollouts, per the CI/CD plan Task 2.
The CronJob invoked `fxhnt backfill-xsp-opra` (removed in Task 3); with the
command gone it would crash-loop. Its only purpose was freezing OPRA marks
for VRP recompute. OPRA data already frozen in xsp_option_bars (KEPT).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
IBC's parser rejected '8:00 AM' ('Auto restart time setting must be hh:mm AM/PM'),
leaving the daily auto-restart UNCONFIGURED, so the gateway churned ~35 restarts over
2 days instead of one clean daily cycle. Zero-padded to '08:00 AM' — IBC now logs
'Auto restart time set to 08:00 AM' (verified live 2026-07-20, fresh pod RESTARTS=0).
08:00 UTC is before the 09:00 UTC UCITS rebalance window so the daily restart won't
collide with execution. Also bumped liveness failureThreshold 5->6 (180s) for the
reauth window.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
compare-measured-precompute is now the Dagster bybit_book_precompute asset
(K8sRunLauncher, own memory) — cron + NP deleted. vrp-rebalancer deleted
(shelved/falsified; vrp_nav de-wired from the nightly). Armed factory +
ucits-volume-ibkr in the manifests (source of truth) to match the live state;
bybit-rebalancer (no testnet creds) + ibkr-rebalancer (PRIIPs) stay suspended.
Final: Dagster owns all nightly ETL+precompute; K8s CronJobs own execution only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Configure K8sRunLauncher in the dagster-instance ConfigMap: each run launches
as its own K8s Job so the heavy bybit_book_precompute asset (6-8Gi op_tags)
runs isolated, never OOMing the 4Gi daemon. Launched Jobs git-sync the same
code (initContainer + emptyDir /code, same gitea+key), get the fund env +
secrets (DSN/PGPASSWORD/databento/tiingo), and need NO PVC (compute is
Postgres-only; unlock calendar is DB-first, so the RWO surfer PVC stays with
the daemon — no deadlock). Validated: DagsterInstance.from_config loads it as
K8sRunLauncher. No extra NP needed (no postgres ingress NP + no default-deny,
so launched Jobs reach postgres/gitea with open egress).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add Jobs/pods/events RBAC to the tailscale-dagster SA (K8sRunLauncher launches
each run as its own Job) and point both dagster containers at the new
fxhnt-cockpit:dagster-k8s-25e3d7c image (dagster_k8s 0.28.22 baked in). The
K8sRunLauncher instance config comes next once the daemon is verified on the
new image.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Operator: go all-Dagster properly + build the image right. Diagnosis
corrected: Dagster ETL was healthy all along (23:30 run SUCCESS, 14 assets,
forward_nav fresh); the stale data is the SUSPENDED compare-measured cron that
writes bybit_sleeve_ret. That cron exists because the compute needs 6-8Gi and
OOM-killed the 4Gi daemon — so the correct all-Dagster fix is K8sRunLauncher
(per-run Jobs with own memory), not daemon-run assets. Plan: add dagster-k8s,
build+push via podman (Argo/Kaniko pipeline is dead), add Job-launch RBAC,
configure K8sRunLauncher + per-asset memory, fold sleeve-ret/backtest-refs into
the DAG, materialize+verify, then delete compare-measured+VRP crons and arm
execution. Also commits the harmless working_directory=/code/src fix.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fxhnt-ingress proxy (nginx wildcard-TLS + socat SSH + kernel-mode tailscale)
now 3/3 and serving dashboard/cockpit/dagster/git.fxhnt.ai. EVAL P2 PASS:
from the devbox over the tailnet -> proxy tailnet IP 100.93.141.11, all four
hosts return HTTP 200 with a valid *.fxhnt.ai LE cert chain — foxhunt still
fully live, zero DNS change.
Three fixes to get there:
- Added tailscale-fxhnt-ingress SA+Role+RoleBinding (sidecar needs ts-state
Secret RBAC; mirrors tailscale-dagster).
- Re-applied dagster.yaml (its NP ingress fxhnt-ingress edit was committed
but never applied on-cluster -> dagster vhost hung).
- Added non-headless gitea-clusterip Service (ns gitea, 10.32.x): the Helm
gitea-http/gitea-ssh are headless -> resolve to 100.64.x pod IPs the
kernel-mode TS sidecar can't reach (CGNAT overlap). nginx+socat retarget it.
C4 DNS target recorded as 100.93.141.11 in the runbook. Phase-1 prep complete.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
P1: fxhnt-wildcard Certificate (*.fxhnt.ai) on bizworx. DNS-01 initially
403'd because fxhnt.ai zone is in the foxhunt project (c293eb98) and the
bizworx cert-manager key's DomainsDNSFullAccess was scoped to the bizworx
project only. Domain-move is blocked by Scaleway (external apex 'Root zone
can't be updated'), so fixed via IAM: added a rule granting
DomainsDNSFullAccess scoped to c293eb98 on policy bizworx-prod-runtime-scoped
(scw iam rule create; original rule untouched). Challenge then progressed
past 403 to normal DNS propagation wait.
P2 (draft, not applied): fxhnt-ingress = nginx (wildcard TLS termination) +
socat (git SSH) + tailscale sidecar, fronting the 3 fund vhosts by ClusterIP
(git/dashboard+cockpit/dagster). Uses ClusterIP not pod IPs (bizworx TS
sidecars reach 10.32.x ClusterIPs but not 100.64 pod IPs — CGNAT overlap,
both verified). dagster NP ingress already retargeted to this proxy's label.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two corrections found while prepping P2:
1. The earlier 10.32.0.1/32 apiserver-egress fix was WRONG: kube-proxy
DNATs kubernetes.default.svc (10.32.0.1:443) to the REAL apiserver
endpoint 172.16.0.11:6443 BEFORE NetworkPolicy eval, and 172.16.0.0/16
is in the public-HTTPS except list -> still blocked -> tailscale sidecar
crashlooped again -> pod NotReady -> dagster Service had NO endpoints.
Correct fix: allow egress to 172.16.0.11:6443 (post-DNAT dest). Now
3/3 stable, endpoints populate. (apiserver endpoint from
NAME ENDPOINTS AGE
kubernetes 172.16.0.11:6443 85d.)
2. dagster NP ingress referenced foxhunt-only label tailscale-gitlab-proxy;
retargeted to app.kubernetes.io/name=fxhnt-ingress (the bizworx proxy
built in P2) so dagster.fxhnt.ai can be fronted.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The dagster NP's public-HTTPS rule excepts the bizworx service CIDR
(10.32.0.0/16), which contains the apiserver ClusterIP 10.32.0.1. The
tailscale sidecar reads/writes its ts-state Secret via
kubernetes.default.svc, so it timed out (context deadline exceeded) and
crashlooped -> pod stuck 2/3. Add a surgical 10.32.0.1/32:443 egress
allow. daemon+webserver were always healthy; sidecar-only fix -> now 3/3.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
bybit_sleeve_ret (the cockpit sim's precompute + the recon gate's reconciliation
reference) was refreshed only WEEKLY, via the separate fxhnt-backtest-refs CronJob
(0 2 * * 1). The live forward book updates DAILY, so it ran up to a week ahead of
its reconciliation reference — the recent forward days couldn't be reconciled and
the recon gate silently skips its divergence band without a fresh ref (false-PASS
risk on the real-capital book).
Fold `backtest-refs --all` into the existing DAILY fxhnt-compare-measured-precompute
CronJob (already own-memory 6Gi/8Gi, pinned to the 16GB ci-compile-cpu autoscale
pool, identical egress). Now one daily job runs, in order: bybit-spread-refresh,
compare-measured-precompute (compare_measured_cache), backtest-refs --all
(bybit_sleeve_ret + backtest_summary refs). Both writers run independently (a
compare failure must not starve the recon ref); the Job still fails if either does.
NOT compute-once: the per-coin (compare) and per-sleeve (refs) paths stay separate
computations — co-scheduled only, so the numbers are unchanged. Retires the weekly
fxhnt-backtest-refs.yaml (its generic report-ref dispatch is covered by the same
`backtest-refs --all`; no live tooling references its name).
Apply is manual (deploy skips CronJob manifests):
kubectl apply -f infra/k8s/jobs/fxhnt-compare-measured-precompute-cronjob.yaml
kubectl delete cronjob fxhnt-backtest-refs -n foxhunt
kubectl delete networkpolicy fxhnt-backtest-refs -n foxhunt
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Validated 2026-07-16: under yahoo the EU equity book drops (Yahoo has no CBU0.L);
under ibkr it sizes 441d / $1M ceiling / Sharpe 1.30 on authoritative on-exchange
volume of the exact traded lines. CronJob keeps ibkr_pit_volume fresh; empty ->
coverage guard -> nav fallback (graceful).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Runs in the multistrat-rebalancer network context (git-sync + pip ib_async +
ib-gateway:4004 ingress-allowed), writes real on-exchange volume to the DB; the
daemon reads it when FXHNT_ALLOCATION_UCITS_VOLUME_SOURCE=ibkr. 08:30 weekdays.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The scale-0->1 deploy step (516499a) failed: the argo-workflow SA had
deployments[patch] (for rollout restart) but not deployments/scale (kubectl
scale) nor pods (kubectl wait --for=delete pod). Grant deployments/scale
[patch,update] + pods [get,list,watch]. No outage — it failed before touching
the running dashboard.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The cockpit deploy workflow rollout-restarted deploy/fxhnt-dashboard, which
briefly overlaps two tailscale sessions on the same identity -> session race ->
the external dashboard.fxhnt.ai proxy link goes stale and the cockpit reads
'down' after every deploy (observed 2026-07-15). The dashboard's tailscale
sidecar serves the public URL, so it must be scaled to 0 (clean session
teardown) before a fresh non-overlapping one comes up. git-sync re-pulls src the
same way, so code still updates. dagster keeps rollout restart (no external
proxy). See reference_fxhnt_dashboard_proxy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Live probe on DU9600528 (2026-07-15): SMART+ISIN returns 0 results for all
five UCITS lines (SMART grabs the wrong US grey-market listing or nothing);
LSEETF+ISIN+USD resolves each cleanly, and SMART stays in every valid-exchange
set so orders still route. Two fixes: (1) UcitsListing.exchange default
SMART->LSEETF; (2) _resolve_contract qualifies the ISIN WITHOUT a symbol (the
map ticker is cosmetic and differs from the USD line's real symbol: IEF->IDTM,
GLD->IGLN). Map tickers corrected to the USD lines. Rebalancer envelope
1,000,000 -> 100,000. 2004 tests green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The EU-domiciled DU paper account can't trade US ETFs (PRIIPs/KID). Arm the
PRIIPs-legal UCITS leg (fxhnt-ucits-rebalancer, --venue ucits, ISIN-resolved
contracts + real UCITS pricing) on a weekday 09:00 UTC slot inside LSE/Euronext
hours so the UCITS ETFs actually price + fill; suspend the US leg
(fxhnt-ibkr-rebalancer) which only KID-rejects on this account. Paper only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A fresh tws_settings PVC mounts root-owned; the gnzsnz container runs as the
non-root ibgateway user (UID/GID 1000) -> "Permission denied" writing jts.ini
-> crashloop. fsGroup: 1000 makes the volume group-writable. Verified: new pod
ready, 0 restarts, "IBC: Login has completed".
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Three fixes to the sole IBKR paper execution gateway:
- replicas 0->1: the manifest said "dev-mode paused" (replicas:0) while the live
cluster ran 1 — a drift that would scale IBKR execution to ZERO on any re-apply.
- AUTO_RESTART_TIME "8:00 AM" UTC + TIME_ZONE Etc/UTC: IBC restarts the gateway
IN-PLACE daily ("does not require daily 2FA validation") instead of the container
exiting on IBKR's forced reset — the cause of ~13 container restarts + a full
re-login each time. 08:00 UTC is clear of the 14:35 rebalancer + 23:30 nightly.
- TWS_SETTINGS_PATH + a 1Gi PVC: persist jts.ini/IBC config across pod restarts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Phase 0b (venue consolidation) made `xsfunding` + `unlock` report-kind,
routed through `_persist_bybit_book`/`_BYBIT_BOOK_SIDS` in this CronJob's
`backtest-refs --all` batch path — NOT inline. The stale header wrongly
listed them (and crypto_tstrend/stablecoin, which aren't in the registry)
among the inline refs. Reword to reflect the actual split: the report-kind
sids this Job covers are bybit_4edge / bybit_4edge_levered / positioning /
xsfunding / unlock; the truly-inline (recompute-replay) refs are only
multistrat / vrp. (This is why unlock had no ref until this Job ran.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The fxhnt-forward CronJob was superseded by the deterministic-forward-state
Dagster assets (dagster.yaml cutover) and had been suspended/dead since before
0a — its args referenced the long-removed `fetch --crypto` + `forward-track`
CLI. Deleted the orphaned live CronJob + its dead NetworkPolicy (whose egress
still whitelisted Binance for a job that no longer runs), removed the netpol
stanza from fxhnt-cockpit.yaml, and refreshed the now-stale RBAC comment.
The batch/cronjobs RBAC rule stays (still used by the bybit/ibkr rebalancers +
compare-measured-precompute). Live objects already deleted via kubectl.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Alpaca's rebalancer CronJob has been suspended with 401'd keys since Task 4's
venue consolidation; IBKR paper is already the live forward-track venue for
the multi-strat book. This removes the dead code/config/manifests instead of
leaving them to rot, and relabels the multistrat/multistrat_exec registry
venues from the vestigial "alpaca-paper" to "ibkr-equity" (they execute on
IBKR paper, not Alpaca — exec_venue itself is still computed dynamically at
runtime).
- Delete src/fxhnt/adapters/broker/alpaca.py, AlpacaSettings + the `alpaca`
config field; move the one real setting it carried (min_order_notional,
a generic "skip sub-min-notional dust" floor for any future
fractional-capable broker) onto ExecutionSettings.
- Remove the `--broker` option and its alpaca branches from `execute` and
`execute-multistrat` (cli.py) — IBKR is now implicit; IbkrBroker was
already the module-level import, so the branch was pure dead code once
Alpaca is gone.
- Delete infra/k8s/jobs/fxhnt-alpaca-rebalancer.yaml and
infra/k8s/secrets/alpaca-credentials.yaml; delete the superseded
infra/k8s/services/multistrat-rebalancer.yaml (PVC + NetworkPolicy +
CronJob), replaced by fxhnt-ibkr-rebalancer. Drop the now-invalid
`--broker ibkr` argument from fxhnt-ibkr-rebalancer.yaml and
fxhnt-ucits-rebalancer.yaml (the flag no longer exists).
- Delete tests/integration/test_alpaca_broker.py (tested the deleted
adapter directly); add tests/unit/test_no_alpaca.py as a standing guard
(no "alpaca" substring anywhere in src/fxhnt + IbkrBroker still imports).
- Update test_registry_multistrat_exec.py + test_cockpit_ssot.py (venue
label) and test_cli_execute_helpers.py (drop the broker_name kwarg and
AlpacaBroker fake, use IbkrBroker instead) to match.
MANUAL cluster ops (not run by CI, record only):
kubectl delete cronjob/fxhnt-alpaca-rebalancer secret/alpaca-credentials -n foxhunt
kubectl delete cronjob/multistrat-rebalancer networkpolicy/multistrat-rebalancer pvc/multistrat-state -n foxhunt
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Step 1 investigation (verified, no code migration needed): the live paper
path (paper_book.py, paper_sleeves.py, paper_backfill.py) has ZERO
DuckDbFeatureStore/.duckdb/read_parquet usage — it only consumes a store via
get_feature_store(). The only non-test DuckDbFeatureStore constructor is
get_feature_store() itself (adapters/warehouse/__init__.py), gated behind the
explicit feature_store == "duckdb" opt-in; the default feature_store="postgres"
(config.py) returns TimescaleFeatureStore. DuckDB is dev/test/opt-in-only on
the live path — no migration required.
- Add tests/unit/test_no_live_duckdb_files.py: asserts Settings().feature_store
defaults to "postgres" and get_feature_store() returns TimescaleFeatureStore,
not DuckDbFeatureStore, locking the safety invariant noted in config.py (a
Job that forgets FXHNT_FEATURE_STORE can't silently write a throwaway DuckDB
file). Uses a sqlite DSN (matching every other TimescaleFeatureStore test in
this repo) so the unit test needs no live Postgres server.
- Retire the orphaned B3 platform Jobs/PVC (no kustomization/script referenced
them): infra/k8s/jobs/fxhnt-backtest-ingest-job.yaml,
fxhnt-backtest-verdict-job.yaml, infra/k8s/storage/fxhnt-backtest-pvc.yaml.
- Mark equity_backtest_runner.py PARKED in its module docstring (no live
consumer; revivable — plugs into backtest_refs when an equity strat is
added to the registry). Logic unchanged.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Refactor _persist_track_backtest_ref (assets.py) to delegate to the unified backtest_ref dispatcher
instead of re-implementing the recompute-replay path inline, and wire xsfunding's missing sleeve-kind
ref through it (bug A's asset half) using the Binance-scoped feature store. Replace the manual
fxhnt-bybit-sleeve-ret Job with a weekly-scheduled fxhnt-backtest-refs CronJob running
`fxhnt backtest-refs --all` (bug B) so the report-kind refs (bybit_4edge/bybit_4edge_levered/positioning)
no longer depend on a human remembering to apply a one-off Job.
