Superseded by fxhnt-cockpit-workflowtemplate.yaml + fxhnt-build-sensor.yaml
+ fxhnt-ci-rbac.yaml (all validated end-to-end, both modes). The old files
targeted decommissioned infra (ci-compile-cpu pool, gitea-sshd.foxhunt,
MinIO artifacts) and no longer worked.
Local cockpit (dev-cockpit-local.sh, bizworx context) serves the migrated DB
read-only; numbers cross-checked against the DB: /paper IBKR card $1,029,015
== ibkr_account_nav.nlv latest, bybit Sh 2.11 / unlock Sh 1.03 == backtest_summary.
The /paper IBKR card renders the real DU account (not the 'not connected'
empty-state that degraded in a prior session). Forward tracks intact: anchor
t0 dates are original historical inceptions, not re-incepted to today — DB-anchor
SSOT survived the migration; recon gate recomputes correctly.
Also fixed dev-cockpit-local.sh to pass --extra web --extra pg (bare uv run
failed ModuleNotFoundError: uvicorn/psycopg on a fresh env).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The IBKR paper account (DU9600528) IS connected and trading: the armed
fxhnt-ucits-rebalancer (0 9 * * 1-5) books the multi-strat ETF leg through
UCITS lines (EU KID/PRIIPs blocks the US-ETF leg, whose rebalancer is
correctly suspended). Prod already rendered it ($1,029,621, 5 holdings).
Two self-inflicted "not connected" artifacts fixed:
- scripts/dev_cockpit_local.py did NOT wire ibkr_account_repo, so the LOCAL
dev cockpit always showed the IBKR card empty regardless of real data —
a misleading local-verification artifact. Now wires every repo prod wires.
- paper.html's new orientation banner hardcoded "not connected yet" (written
from that stale local view). Made it data-aware (keyed on ibkr_view) so it
states the live NLV + holdings when trading, "not connected yet" only when
genuinely empty — it can't drift from the card beneath it.
Adds a regression assertion: connected account => banner says "live now,
trading through UCITS" and never "not connected yet".
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Task 7e only renamed venue="binance" -> "legacy" to pass the substring guard;
the dual-venue repo machinery was left in place even though bybit is the ONLY
live venue. PaperRepo now hardcodes every discriminated read/write to a
_BYBIT_VENUE = "bybit" module constant instead of a constructor venue param
(removed) -- reads/writes ONLY the bybit rows, so the orphaned legacy/binance
rows from the retired combined-crypto book (Task 7d) are never touched.
nav_summary's venue arg is dropped the same way (every caller always passed
"bybit"). cockpit_models keeps the venue column (dropping it from the PK is a
separate prod schema migration, documented in the report for the merge
runbook) with reworded comments reflecting the single-venue reality.
Test fallout: deleted test_paper_repo_venue.py (tested the now-removed
dual-venue isolation) and 3 "does-not-touch-binance" tests that constructed
PaperRepo(venue="binance"); mechanically dropped the venue kwarg everywhere
else. Added a guard assertion that PaperRepo.__init__ has no venue param.
Full suite green (1853 passed); binance substring guard still 0 hits.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds seed_cockpit_demo.py script to populate the cockpit database with
representative forward track data (4 strategies), nav histories, backtest
summaries, and allocation/funding snapshots. Idempotent — safe to re-run
multiple times. Supports env override FXHNT_OPERATIONAL_DSN (defaults to
sqlite:///./cockpit-demo.db).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scripts/dev-cockpit-local.sh port-forwards prod postgres to 15432 (5432 is usually owned by a local pg, so
the forward would fail 'address in use'), wires the DSN from the db-credentials secret, and serves the REAL
cockpit on :8801 via scripts/dev_cockpit_local.py — which builds the repos WITHOUT .migrate() so it never
writes DDL to prod. Iterate on cockpit UI in a real browser on real data in seconds, not 9-min Argo deploys.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Argo WorkflowTemplate fxhnt-cockpit mirrors foxhunt's build-ci-image (Kaniko) + compile-and-deploy (kubectl):
clones root/fxhnt over in-cluster gitlab-shell, builds infra/docker/fxhnt.Dockerfile to the internal registry
(native registry+token access, no laptop push, no private-CA trust), applies manifests + rolls the dashboard.
Manifests corrected to the cluster's real secrets: DSN via PGPASSWORD (db-credentials), DATABENTO via
databento-credentials, TS via tailscale-auth; image -> internal gitlab registry.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
