Add files via upload

AutomatedSetupModal.jsx

@@ -0,0 +1,242 @@
+import { useState, useEffect, useRef, useMemo } from "react";
+import { isValidLimit, computeMaxDailyExposure, computeExposurePctOfBalance } from "../lib/automatedLimits.js";
+
+/**
+ * AutomatedSetupModal.jsx
+ *
+ * Replaces the prompt()/alert() placeholder that used to sit inline in
+ * Dashboard.jsx's handleTierChange. This is the one moment in the whole
+ * app where a human hands off standing permission to trade without a
+ * per-trade tap -- tradeGate.js already refuses to enable that tier
+ * without finite, positive limits (no "unlimited" option, checked on
+ * every signal, not just here); this form is the honest UI for setting
+ * them, not just a barrier to get past.
+ *
+ * SIGNATURE ELEMENT: the two numbers a person types here (max per trade,
+ * max trades per day) don't mean anything on their own -- their PRODUCT
+ * is the real question ("how much could this commit in a single day if
+ * every trade hit the cap"). That's computed live below the inputs, and
+ * related to the actual USD balance when known, rather than left as an
+ * exercise for the reader. Framed explicitly as a ceiling, not a loss
+ * estimate -- each trade is a grid buy, not a guaranteed loss, and
+ * overstating this as "money you will lose" would be its own kind of
+ * dishonesty this project has consistently tried to avoid elsewhere
+ * (see tradeGate.js and covenant_unified_v8.py's own HONESTY NOTEs).
+ *
+ * Validation lives in two places on purpose, not by accident: the fast
+ * inline check here (so the submit button reflects reality as you type,
+ * and you never even attempt a bad submission) AND tradeGate.js's own
+ * enableAutomated() (the actual authority -- see its own comment: "no
+ * unlimited option"). If those two ever disagreed, the gate wins; this
+ * form's job is to never let that disagreement surface as a raw
+ * exception, not to be a second source of truth.
+ */
+
+const FIELD_STYLE = {
+  width: "100%", padding: "10px 12px", background: "#0d0f12",
+  border: "1px solid #2a2d33", borderRadius: 8, color: "#e8e6e1",
+  fontSize: 15, fontFamily: "ui-monospace, monospace",
+};
+
+function Field({ label, hint, value, onChange, inputRef, autoFocus, invalidMessage }) {
+  const [touched, setTouched] = useState(false);
+  const showError = touched && value !== "" && !isValidLimit(value);
+  return (
+    <div style={{ marginBottom: 16 }}>
+      <label style={{ fontSize: 12, color: "#8a8d93", letterSpacing: 0.5, display: "block", marginBottom: 6 }}>
+        {label}
+      </label>
+      <input
+        ref={inputRef}
+        autoFocus={autoFocus}
+        type="number"
+        inputMode="decimal"
+        min="0"
+        step="any"
+        placeholder="0"
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        onBlur={() => setTouched(true)}
+        style={{
+          ...FIELD_STYLE,
+          borderColor: showError ? "#5a2626" : FIELD_STYLE.border,
+        }}
+      />
+      <div style={{ fontSize: 11, color: showError ? "#e08a8a" : "#5a5d63", marginTop: 5, minHeight: 14 }}>
+        {showError ? invalidMessage : hint}
+      </div>
+    </div>
+  );
+}
+
+export default function AutomatedSetupModal({ open, onCancel, onConfirm, usdBalance }) {
+  const [maxPerTradeUsd, setMaxPerTradeUsd] = useState("");
+  const [maxDailyTradesCount, setMaxDailyTradesCount] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [submitError, setSubmitError] = useState(null);
+  const firstFieldRef = useRef(null);
+
+  // Reset to a blank form every time the modal is (re)opened -- stale
+  // values from a cancelled attempt shouldn't reappear silently later.
+  useEffect(() => {
+    if (open) {
+      setMaxPerTradeUsd("");
+      setMaxDailyTradesCount("");
+      setSubmitError(null);
+      setSubmitting(false);
+    }
+  }, [open]);
+
+  useEffect(() => {
+    if (!open) return;
+    function onKeyDown(e) {
+      if (e.key === "Escape") onCancel();
+    }
+    document.addEventListener("keydown", onKeyDown);
+    return () => document.removeEventListener("keydown", onKeyDown);
+  }, [open, onCancel]);
+
+  const perTradeValid = isValidLimit(maxPerTradeUsd);
+  const dailyCountValid = isValidLimit(maxDailyTradesCount);
+  const bothValid = perTradeValid && dailyCountValid;
+
+  const maxDailyExposure = useMemo(
+    () => computeMaxDailyExposure(maxPerTradeUsd, maxDailyTradesCount),
+    [maxPerTradeUsd, maxDailyTradesCount]
+  );
+
+  const exposurePctOfBalance = useMemo(
+    () => computeExposurePctOfBalance(maxDailyExposure, usdBalance),
+    [maxDailyExposure, usdBalance]
+  );
+
+  if (!open) return null;
+
+  async function handleConfirm() {
+    if (!bothValid || submitting) return;
+    setSubmitting(true);
+    setSubmitError(null);
+    try {
+      await onConfirm({
+        maxPerTradeUsd: Number(maxPerTradeUsd),
+        maxDailyTradesCount: Number(maxDailyTradesCount),
+      });
+      // Success: the parent flips `open` to false via its own state once
+      // gate.enableAutomated() has actually taken effect, so this modal
+      // doesn't need (and shouldn't guess) its own success transition.
+    } catch (e) {
+      setSubmitError(e?.message || "Could not enable automated trading.");
+      setSubmitting(false);
+    }
+  }
+
+  return (
+    <div
+      role="presentation"
+      onMouseDown={(e) => { if (e.target === e.currentTarget) onCancel(); }}
+      style={{
+        position: "fixed", inset: 0, background: "rgba(5,6,7,0.72)",
+        display: "flex", alignItems: "flex-end", justifyContent: "center",
+        zIndex: 1000,
+      }}
+    >
+      <div
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="automated-setup-title"
+        style={{
+          width: "100%", maxWidth: 480, background: "#16181c",
+          borderTop: "1px solid #2a2d33", borderLeft: "1px solid #2a2d33", borderRight: "1px solid #2a2d33",
+          borderRadius: "18px 18px 0 0", padding: "10px 20px 24px",
+          boxShadow: "0 -8px 40px rgba(0,0,0,0.5)",
+          animation: "sheet-rise 180ms ease-out",
+        }}
+      >
+        <style>{`
+          @keyframes sheet-rise { from { transform: translateY(24px); opacity: 0.4; } to { transform: translateY(0); opacity: 1; } }
+          @media (prefers-reduced-motion: reduce) { * { animation-duration: 0.001ms !important; } }
+        `}</style>
+
+        <div style={{ width: 36, height: 4, borderRadius: 2, background: "#2a2d33", margin: "0 auto 16px" }} />
+
+        <h2 id="automated-setup-title" style={{ fontSize: 16, fontWeight: 500, margin: "0 0 4px", color: "#e8e6e1" }}>
+          Enable automated trading
+        </h2>
+        <p style={{ fontSize: 12.5, color: "#8a8d93", margin: "0 0 20px", lineHeight: 1.5 }}>
+          The gate runs the strategy on a timer within the limits below. A Ledger
+          confirmation is still required for every trade — this cannot be
+          switched off at any tier.
+        </p>
+
+        <Field
+          label="Max USD per trade"
+          hint="A finite amount, required — there is no unlimited option."
+          invalidMessage="Enter a number greater than 0."
+          value={maxPerTradeUsd}
+          onChange={setMaxPerTradeUsd}
+          inputRef={firstFieldRef}
+          autoFocus
+        />
+        <Field
+          label="Max trades per day"
+          hint="Resets at midnight UTC."
+          invalidMessage="Enter a number greater than 0."
+          value={maxDailyTradesCount}
+          onChange={setMaxDailyTradesCount}
+        />
+
+        <div style={{
+          background: "#0d0f12", border: "1px solid #21242a", borderRadius: 10,
+          padding: "12px 14px", marginBottom: 20,
+        }}>
+          <div style={{ fontSize: 11, color: "#8a8d93", letterSpacing: 0.5, marginBottom: 6 }}>
+            WORST-CASE DAILY DEPLOYMENT
+          </div>
+          <div style={{ fontFamily: "ui-monospace, monospace", fontSize: 20, color: bothValid ? "#c9a24b" : "#5a5d63" }}>
+            {bothValid ? `$${maxDailyExposure.toLocaleString(undefined, { maximumFractionDigits: 2 })}` : "—"}
+          </div>
+          <div style={{ fontSize: 11.5, color: "#5a5d63", marginTop: 4, lineHeight: 1.4 }}>
+            {bothValid
+              ? exposurePctOfBalance !== null
+                ? `If every trade hits the per-trade cap, ${exposurePctOfBalance.toFixed(0)}% of your current $${usdBalance.toFixed(2)} balance in one day.`
+                : "If every trade hits the per-trade cap. Not a loss estimate — each trade is a grid buy, not a guaranteed loss."
+              : "Fill in both fields to see the ceiling this sets."}
+          </div>
+        </div>
+
+        {submitError && (
+          <div style={{ background: "#2a1616", border: "1px solid #5a2626", borderRadius: 8, padding: 10, marginBottom: 16, fontSize: 12, color: "#e08a8a" }}>
+            {submitError}
+          </div>
+        )}
+
+        <div style={{ display: "flex", gap: 10 }}>
+          <button
+            onClick={onCancel}
+            disabled={submitting}
+            style={{
+              flex: 1, padding: 12, borderRadius: 8, border: "1px solid #2a2d33",
+              background: "transparent", color: "#a8abb1", fontSize: 14, fontWeight: 500,
+            }}
+          >
+            Cancel
+          </button>
+          <button
+            onClick={handleConfirm}
+            disabled={!bothValid || submitting}
+            style={{
+              flex: 2, padding: 12, borderRadius: 8, border: "1px solid #c9a24b",
+              background: bothValid && !submitting ? "#20242b" : "#16181c",
+              color: bothValid && !submitting ? "#c9a24b" : "#55585e",
+              fontSize: 14, fontWeight: 500,
+              cursor: bothValid && !submitting ? "pointer" : "default",
+              opacity: bothValid ? 1 : 0.6,
+            }}
+          >
+            {submitting ? "Enabling\u2026" : "Enable automated trading"}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}

Dashboard.jsx

@@ -0,0 +1,169 @@
+import { useState, useEffect, useCallback } from "react";
+import { TIERS } from "../lib/tradeGate.js";
+import { getTierRank, isTierClickable } from "../lib/tierNavigation.js";
+import AutomatedSetupModal from "./AutomatedSetupModal.jsx";
+
+/**
+ * Dashboard.jsx
+ *
+ * Design intent: this is a trading terminal, not a marketing page --
+ * dense, precise, calm. The tier ladder (dashboard -> manual ->
+ * automated) is rendered as a real structural element because it IS
+ * the real security model (see tradeGate.js), not decoration. Numbers
+ * that came from the walk-forward-validated baseline are visually
+ * distinguished from numbers the live adaptive layer just computed --
+ * conflating "this was proven out-of-sample" with "this is a live
+ * guess" in the UI would be the same category of silent-failure this
+ * whole project has consistently flagged as the dangerous thing to do.
+ */
+
+const TIER_INFO = [
+  { key: TIERS.DASHBOARD, label: "Dashboard", desc: "Read-only. Balances and strategy status." },
+  { key: TIERS.MANUAL, label: "Manual approval", desc: "See signals, tap to confirm, sign on Ledger." },
+  { key: TIERS.AUTOMATED, label: "Automated", desc: "Runs within limits you set. Ledger confirmation still required per trade." },
+];
+
+function TierLadder({ currentTier, onRequestTierChange }) {
+  const currentRank = getTierRank(currentTier);
+  return (
+    <div style={{ display: "flex", flexDirection: "column", gap: 8 }}>
+      {TIER_INFO.map((tier, i) => {
+        const active = i === currentRank;
+        const clickable = isTierClickable(currentTier, tier.key);
+        const reachable = clickable || active;
+        return (
+          <button
+            key={tier.key}
+            disabled={!clickable}
+            onClick={() => onRequestTierChange(tier.key)}
+            style={{
+              display: "flex", justifyContent: "space-between", alignItems: "center",
+              padding: "12px 14px", borderRadius: 10, textAlign: "left",
+              border: active ? "1px solid #c9a24b" : "1px solid #2a2d33",
+              background: active ? "#20242b" : "#16181c",
+              color: reachable ? "#e8e6e1" : "#55585e",
+              opacity: reachable ? 1 : 0.5, cursor: clickable ? "pointer" : "default",
+            }}
+          >
+            <span>
+              <div style={{ fontFamily: "ui-monospace, monospace", fontSize: 13, letterSpacing: 0.5 }}>
+                {i < currentRank ? "\u2713 " : active ? "\u25CF " : "\u25CB "}{tier.label.toUpperCase()}
+              </div>
+              <div style={{ fontSize: 12, color: "#8a8d93", marginTop: 2 }}>{tier.desc}</div>
+            </span>
+            {active && <span style={{ fontSize: 11, color: "#c9a24b" }}>ACTIVE</span>}
+          </button>
+        );
+      })}
+    </div>
+  );
+}
+
+function NumberRow({ label, value, source, mono = true }) {
+  const sourceColor = source === "walk_forward_validated" ? "#5fb87a" : source === "conservative_default" ? "#8a8d93" : "#c9a24b";
+  return (
+    <div style={{ display: "flex", justifyContent: "space-between", padding: "6px 0", borderBottom: "1px solid #21242a" }}>
+      <span style={{ fontSize: 13, color: "#a8abb1" }}>{label}</span>
+      <span style={{ display: "flex", alignItems: "center", gap: 6 }}>
+        <span style={{ fontFamily: mono ? "ui-monospace, monospace" : "inherit", fontSize: 13, color: "#e8e6e1" }}>{value}</span>
+        {source && <span style={{ width: 6, height: 6, borderRadius: "50%", background: sourceColor }} title={source} />}
+      </span>
+    </div>
+  );
+}
+
+export default function Dashboard({ gate, ledgerSupport }) {
+  const [snapshot, setSnapshot] = useState(null);
+  const [error, setError] = useState(null);
+  const [loading, setLoading] = useState(true);
+  const [tier, setTier] = useState(gate.tier);
+  const [automatedModalOpen, setAutomatedModalOpen] = useState(false);
+
+  const refresh = useCallback(async () => {
+    try {
+      setLoading(true);
+      const s = await gate.getDashboardSnapshot();
+      setSnapshot(s);
+      setError(null);
+    } catch (e) {
+      setError(e.message);
+    } finally {
+      setLoading(false);
+    }
+  }, [gate]);
+
+  useEffect(() => { refresh(); }, [refresh]);
+
+  const handleTierChange = (key) => {
+    if (key === TIERS.DASHBOARD) {
+      // FIXED -- this button rendered clickable at manual/automated tiers
+      // (see TierLadder's `reachable` check) but had no matching branch
+      // here, so tapping it silently did nothing. Confirmed empirically
+      // before this fix, not assumed. De-escalating trust should never
+      // be the hard path, and "hard path" turns out to have included
+      // "doesn't work at all."
+      gate.disableTrading();
+      setTier(gate.tier);
+    } else if (key === TIERS.MANUAL) {
+      gate.enableManual();
+      setTier(gate.tier);
+    } else if (key === TIERS.AUTOMATED) {
+      setAutomatedModalOpen(true);
+    }
+  };
+
+  const handleConfirmAutomated = async ({ maxPerTradeUsd, maxDailyTradesCount }) => {
+    // Let a thrown TradeGateError propagate -- AutomatedSetupModal catches
+    // it and displays it inline. Only close the modal and advance tier
+    // state on genuine success, so a rejected attempt never looks like it
+    // silently succeeded.
+    gate.enableAutomated({ maxPerTradeUsd, maxDailyTradesCount });
+    setTier(gate.tier);
+    setAutomatedModalOpen(false);
+  };
+
+  const usdBalance = snapshot?.balances?.find((b) => b.asset === "USD")?.available ?? null;
+
+  return (
+    <div style={{ background: "#0d0f12", minHeight: "100%", padding: 16, fontFamily: "system-ui, sans-serif", color: "#e8e6e1" }}>
+      <div style={{ marginBottom: 18 }}>
+        <div style={{ fontSize: 12, color: "#8a8d93", letterSpacing: 1 }}>ASSET</div>
+        <div style={{ fontSize: 22, fontFamily: "ui-monospace, monospace" }}>{gate.asset.toUpperCase()}</div>
+      </div>
+
+      {!ledgerSupport.supported && (
+        <div style={{ background: "#2a1f16", border: "1px solid #5a4426", borderRadius: 8, padding: 10, marginBottom: 14, fontSize: 12, color: "#d9b26a" }}>
+          Ledger unavailable in this browser: {ledgerSupport.reason}
+        </div>
+      )}
+
+      {error && (
+        <div style={{ background: "#2a1616", border: "1px solid #5a2626", borderRadius: 8, padding: 10, marginBottom: 14, fontSize: 12, color: "#e08a8a" }}>
+          {error}
+        </div>
+      )}
+
+      <div style={{ background: "#16181c", border: "1px solid #21242a", borderRadius: 12, padding: 14, marginBottom: 16 }}>
+        <NumberRow label="Price" value={loading ? "\u2026" : `$${snapshot?.price?.toFixed(4) ?? "--"}`} />
+        {snapshot?.balances?.map((b) => (
+          <NumberRow key={b.asset} label={`Balance (${b.asset})`} value={b.available.toFixed(b.asset === "USD" ? 2 : 6)} />
+        ))}
+      </div>
+
+      <div style={{ fontSize: 12, color: "#8a8d93", letterSpacing: 1, marginBottom: 8 }}>CAPABILITY</div>
+      <TierLadder currentTier={tier} onRequestTierChange={handleTierChange} />
+
+      <div style={{ marginTop: 20, fontSize: 11, color: "#5a5d63", display: "flex", gap: 10 }}>
+        <span><span style={{ color: "#5fb87a" }}>\u25CF</span> walk-forward validated</span>
+        <span><span style={{ color: "#8a8d93" }}>\u25CF</span> conservative default</span>
+      </div>
+
+      <AutomatedSetupModal
+        open={automatedModalOpen}
+        onCancel={() => setAutomatedModalOpen(false)}
+        onConfirm={handleConfirmAutomated}
+        usdBalance={usdBalance}
+      />
+    </div>
+  );
+}

README.md

@@ -1,2 +1,115 @@
-# Sentinel-Witness
-A path forward for morally good people to contribute to and grow
+# Ledger Trading Dashboard
+
+Phone-first PWA: Ledger hardware wallet + Coinbase/Kraken/Crypto.com, staged
+dashboard → manual-approval → automated execution, driven by walk-forward-
+validated grid/bracket strategy parameters (see the companion `strategy/`
+Python project) with a real-time adaptive layer on top.
+
+## What's actually tested vs. what needs your device
+
+This was built in a sandboxed environment with no access to Coinbase/
+Kraken/Crypto.com's APIs, no WebHID, no real Ledger. That shaped what
+"tested" can honestly mean here:
+
+| Module | Tested | How |
+|---|---|---|
+| `secureStorage.js` | Yes | Full encrypt/decrypt round trip, wrong-passphrase-fails-closed, fresh salt/IV per save — real IndexedDB via `fake-indexeddb`, not mocked |
+| `gridMath.js` | Yes | Lookahead safety, capital-safety invariant, parity against the Python engine's validated $12 dead-weight case, throttle-never-hits-zero |
+| `exchanges/kraken.js`, `cryptocom.js` signing | Yes | Determinism, structural correctness (output length/format), key-order invariance |
+| `exchanges/coinbase.js` JWT | Partially | ES256 JWT structure and signature cryptographically verified against a generated key pair — confirms the *mechanism* is right. Does **not** confirm a real Coinbase CDP key imports cleanly; that needs your actual key |
+| `tradeGate.js` tier enforcement | Yes | Every limit-rejection path, tier-gating path, and the "no unlimited option" guarantee, via a mock exchange |
+| `ledger.js` | No — cannot be | Needs a real browser (WebHID) and a real device |
+| Live exchange calls (balances, order placement) | No — cannot be | This sandbox's network can't reach any of the three exchanges |
+| UI (`Dashboard.jsx`, `App.jsx`) | No — cannot be | Needs a real browser |
+
+Run `npm test` to re-run everything that *can* run outside a browser.
+
+## Setup
+
+```
+npm install
+npm run dev      # local dev server
+npm run build    # production build, output in dist/
+```
+
+### Exchange credentials
+- **Kraken**: create an API key with Query Funds + Create/Cancel orders
+  permissions (not Withdraw). Enter the key + secret in the app; they're
+  encrypted with your passphrase and stored only in this browser's
+  IndexedDB.
+- **Crypto.com**: same shape (API key + secret), trading permissions only.
+- **Coinbase**: create a CDP API key (Advanced Trade). The downloaded
+  private key must be PKCS8 PEM (`-----BEGIN PRIVATE KEY-----`). If yours
+  says `-----BEGIN EC PRIVATE KEY-----`, convert it first:
+  `openssl pkcs8 -topk8 -nocrypt -in your-key.pem -out converted.pem`
+
+None of these should ever have withdrawal permission. This app only ever
+needs to read balances and place/cancel limit orders.
+
+## Security model
+
+- **Ledger**: signing happens on-device with a physical confirmation.
+  This code never sees a seed phrase or private key — see `ledger.js`'s
+  docstring. WebHID (required for the Ledger connection) works in Chrome/
+  Edge on desktop and Android; it does **not** work in any iOS browser,
+  including Safari-based ones on iPhone. On iOS, this needs a native app
+  with Ledger's Bluetooth SDK instead — flagged, not built here.
+- **Exchange credentials**: AES-GCM encrypted with a key derived from
+  your passphrase (PBKDF2, 210k iterations), stored in this browser's
+  IndexedDB. This is real protection against someone reading files off
+  disk. It is **not** equivalent to a native app's OS Keychain/Keystore —
+  a PWA can't reach either. See `secureStorage.js` and the in-app
+  `SecurityNotice` component.
+- **Trade execution guardrails**: all enforced in `tradeGate.js`, not
+  just documented — automated tier refuses to start without finite,
+  positive `maxPerTradeUsd` and `maxDailyTradesCount` (no unlimited
+  option), both re-checked on every signal, not just at setup. Every
+  execution path requires the Ledger confirmation step; there is no
+  code path that skips it.
+
+## What's genuinely not built yet
+
+- **XRP unsigned-transaction-blob assembly.** `tradeGate.executeApprovedSignal()`
+  gets all the way to calling the Ledger and reading the address, then
+  throws an explicit `not_implemented` error rather than faking a
+  completed trade. Turning a `{pair, price, quantity}` signal into the
+  actual bytes `signXrpTransaction()` needs to sign (proper XRP Ledger
+  transaction encoding, sequence numbers, fees, submission to a node)
+  is real protocol work not done in this pass — flagged loudly rather
+  than stubbed quietly, per this whole project's standing rule about
+  silent failures being the dangerous kind.
+- PWA icons (`icon-192.png`, `icon-512.png` referenced in `vite.config.js`)
+  aren't generated.
+- Only XRP is wired through the UI/gate end-to-end; the strategy guide
+  covers DOGE too (see `src/lib/strategyGuide.js`) but the app only
+  asks for one asset right now.
+
+## Automated-tier setup
+
+`AutomatedSetupModal.jsx` replaced the earlier `prompt()`/`alert()`
+placeholder. Real form, real inline validation (mirrors
+`tradeGate.js`'s own `enableAutomated()` check exactly — see
+`src/lib/automatedLimits.js` — so the UI never blocks something the gate
+would allow or vice versa), and a live "worst-case daily deployment"
+figure (`maxPerTradeUsd × maxDailyTradesCount`, related to current USD
+balance when known) so the two numbers you're locking in mean something
+concrete before you confirm, not just two blank fields. Covered by
+`src/lib/__tests__/automatedLimits.test.js`.
+
+While wiring this in, found and fixed a second bug: the "Dashboard" tier
+button rendered clickable while at manual/automated tier (stepping down
+is deliberately always open, from any tier — see `tierNavigation.js`),
+but `handleTierChange` had no branch for it, so tapping it silently did
+nothing. Confirmed empirically before fixing (not assumed), and now
+covered by `src/lib/__tests__/tierNavigation.test.js`, which asserts the
+dashboard-tier case directly rather than just the fields it happened to
+break in.
+
+## Re-generating the strategy guide
+
+`src/lib/strategyGuide.js` embeds a snapshot from
+`recursive_strategy_optimizer.py` (the Python walk-forward optimizer, in
+the companion `strategy/` project — re-run that periodically, it's
+designed for it). Either replace the `BAKED_IN_GUIDE` constant with fresh
+output, or host the JSON somewhere and call `refreshGuide(url)` so the
+app picks up updates without a rebuild.

automatedLimits.js

@@ -0,0 +1,42 @@
+/**
+ * automatedLimits.js
+ *
+ * Pure logic behind AutomatedSetupModal.jsx, pulled out of the component
+ * for the same reason gridMath.js and strategyGuide.js already live here
+ * rather than inside a .jsx file: this project's test runner only
+ * executes plain .js under src/lib/__tests__/ (no JSX transform in that
+ * path, by design -- see package.json's "test" script), so logic left
+ * inline in a component is logic that never gets a regression test.
+ * That gap is exactly how Dashboard.jsx's dead dashboard-tier button
+ * shipped unnoticed -- see tierNavigation.js for the other half of that
+ * fix.
+ *
+ * isValidLimit() intentionally mirrors tradeGate.js's own enableAutomated()
+ * check (finite, > 0, nothing stricter) rather than inventing a separate
+ * rule -- if this ever drifted from the gate's actual check, the UI could
+ * either block something the gate would allow, or (worse) look valid
+ * here and still throw at the gate. Kept identical on purpose.
+ */
+
+export function isValidLimit(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return false;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0;
+}
+
+/** Worst-case, not expected-case: what it would mean if every single
+ * trade, every day, hit the per-trade cap. Returns null rather than NaN
+ * or 0 when inputs aren't both valid yet, so a caller can't accidentally
+ * render "$0" and have it read as a real answer. */
+export function computeMaxDailyExposure(maxPerTradeUsd, maxDailyTradesCount) {
+  if (!isValidLimit(String(maxPerTradeUsd)) || !isValidLimit(String(maxDailyTradesCount))) return null;
+  return Number(maxPerTradeUsd) * Number(maxDailyTradesCount);
+}
+
+/** null when there's no balance to relate the exposure to yet (still
+ * loading, or a zero/missing USD balance) -- distinguished from 0 for
+ * the same "don't render a fake-looking real number" reason as above. */
+export function computeExposurePctOfBalance(maxDailyExposure, usdBalance) {
+  if (maxDailyExposure === null || !Number.isFinite(usdBalance) || usdBalance <= 0) return null;
+  return (maxDailyExposure / usdBalance) * 100;
+}

covenant_trading_bridge.py

@@ -0,0 +1,218 @@
+#!/usr/bin/env python3
+"""
+covenant_trading_bridge.py -- NEW. Connects the grid/bracket trading
+strategy (covenant/strategy/, ledger-app/) to Covenant's real ledger,
+ethics gate, and succession systems. Kept as a SEPARATE module rather
+than folded into covenant_unified_v8.py itself: that file's own internal
+organization already separates concerns into focused classes
+(StakingPool, SuccessionGuardianSystem, CovenantGuardian, ...) combined
+by CovenantUnifiedMaster -- trading-bridge logic is one more such
+concern, not core blockchain/governance machinery, and keeping it
+separate means covenant_unified_v8.py's already-long patch-log history
+doesn't have to absorb a domain that isn't its own. One small, clearly-
+delineated route is added to CovenantAPI (see the PATCH LOG v8.6 block
+in covenant_unified_v8.py) so this bridge is reachable over the same
+running API, not a second server to operate.
+
+WHY PROFIT, NOT EVERY FILL, IS WHAT GETS RECORDED: a BUY converts USD
+held at an exchange into an asset held at the same exchange -- it isn't
+new value entering the system, it's an external asset swap Covenant has
+no natural way to represent (the existing Transaction model moves
+EXISTING sender balance to a receiver; a buy has no Covenant-side
+"sender" with that balance, because the balance lives at Kraken/Coinbase/
+Crypto.com, not on this ledger). A completed round-trip SELL is
+different: run_grid_backtest's own fill discipline (grid_engine.py) only
+closes a position above its own cost basis, so a realized profit is a
+genuine new economic fact, structurally analogous to genesis's one-time
+mint -- not a transfer between two Covenant parties. Modeled that way
+here (record_ledger_entry with reason="trading_profit", gated by a real
+signature) rather than forced through the peer-to-peer Transaction/mining
+pipeline, which would need a fictional zero-balance "sender" and either
+fail its own balance check or require yet another hasattr-style special
+case -- exactly the fail-open shape this codebase's own patch log (items
+H, and generally) has spent several rounds closing elsewhere. Consistent
+with genesis's mint, but NOT unconditional the way genesis's one-time
+bootstrap mint is: every credit here requires a real signature from the
+pool's own key, verified before the ledger entry is written.
+
+WHY A GIFT IS A LEDGER CREDIT, NOT AN AUTO-STAKE: Covenant's own /stake
+route requires the STAKER's own signature (verify_stake_signature) --
+auto-staking on a new node's behalf using the POOL's authority would
+mean staking without the actual keyholder's consent, a real regression
+against a pattern this file enforces everywhere else. A gift here credits
+the recipient's spendable balance; if they want it staked, they submit
+their own signed /stake call, same as anyone else.
+
+SCOPE BOUNDARY, STATED PLAINLY: SuccessionGuardianSystem registration
+below covers who is authorized to sign FUTURE Covenant-ledger entries for
+the trading pool -- a software/cryptographic fact this code can actually
+enforce. It does NOT and cannot transfer control of the real exchange
+accounts (Coinbase/Kraken/Crypto.com) or the physical Ledger hardware
+wallet those accounts' keys ultimately depend on. That is real-world
+estate planning (a will, a secured note with recovery details, whatever
+the person's jurisdiction requires) outside what any code here can
+enforce. Do not let a clean succession registration on this side create
+the impression the whole operation's succession is handled -- it is one
+necessary piece, not the whole picture.
+"""
+
+import sys
+import time
+sys.path.insert(0, "/home/claude/covenant")
+
+from covenant_unified_v8 import (
+    _domain_frame, Database, StakingPool, SuccessionGuardianSystem,
+    ReasoningSentinel, JudgmentResult, TradingBridgeError,
+)
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.backends import default_backend
+import base64
+
+
+def trading_profit_payload(pool_pubkey: str, asset: str, exchange: str, external_ref: str,
+                            pnl_usd: float, timestamp: float) -> bytes:
+    return _domain_frame(b"COVENANT_TRADING_PROFIT_V1", pool_pubkey, asset, exchange,
+                          external_ref, str(pnl_usd), str(timestamp))
+
+
+def verify_trading_profit_signature(pool_pubkey_pem: str, asset: str, exchange: str, external_ref: str,
+                                     pnl_usd: float, timestamp: float, signature_b64: str) -> bool:
+    try:
+        payload = trading_profit_payload(pool_pubkey_pem, asset, exchange, external_ref, pnl_usd, timestamp)
+        pub_key = serialization.load_pem_public_key(pool_pubkey_pem.encode(), backend=default_backend())
+        pub_key.verify(
+            base64.b64decode(signature_b64), payload,
+            padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH),
+            hashes.SHA256(),
+        )
+        return True
+    except Exception:
+        return False
+
+
+def node_gift_payload(pool_pubkey: str, recipient_pubkey: str, amount: float, timestamp: float) -> bytes:
+    return _domain_frame(b"COVENANT_NODE_GIFT_V1", pool_pubkey, recipient_pubkey, str(amount), str(timestamp))
+
+
+def verify_node_gift_signature(pool_pubkey_pem: str, recipient_pubkey: str, amount: float,
+                                timestamp: float, signature_b64: str) -> bool:
+    try:
+        payload = node_gift_payload(pool_pubkey_pem, recipient_pubkey, amount, timestamp)
+        pub_key = serialization.load_pem_public_key(pool_pubkey_pem.encode(), backend=default_backend())
+        pub_key.verify(
+            base64.b64decode(signature_b64), payload,
+            padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH),
+            hashes.SHA256(),
+        )
+        return True
+    except Exception:
+        return False
+
+
+class TradingBridge:
+    """
+    Wraps a running Covenant node's db/sentinel/staking_pool/succession
+    with the two trading-specific operations (report_realized_profit,
+    gift_stake_to_new_node) plus a succession-registration convenience
+    wrapper. Constructed with the SAME objects CovenantUnifiedMaster
+    already built -- this class adds behavior, it does not stand up a
+    second, parallel copy of the ledger/db/succession system.
+    """
+
+    def __init__(self, db: Database, sentinel: ReasoningSentinel, staking_pool: StakingPool,
+                 succession: SuccessionGuardianSystem):
+        self.db = db
+        self.sentinel = sentinel
+        self.staking_pool = staking_pool
+        self.succession = succession
+
+    def report_realized_profit(self, pool_pubkey_pem: str, asset: str, exchange: str, external_ref: str,
+                                pnl_usd: float, timestamp: float, signature_b64: str) -> dict:
+        """
+        Credits `pnl_usd` to the trading pool's Covenant balance, gated
+        by a real signature over (pool_pubkey, asset, exchange,
+        external_ref, pnl_usd, timestamp) -- see module docstring for why
+        this is a signed mint-style credit, not a peer-to-peer
+        Transaction. `external_ref` (e.g. an exchange order id) plus
+        timestamp double as replay protection via the caller's own
+        nonce-seen table, same pattern as every other signed action in
+        this codebase (see /claim_rewards, /unstake) -- enforced at the
+        API route (see PATCH LOG v8.6 in covenant_unified_v8.py), not
+        re-implemented here, so there's one nonce-checking pattern in the
+        system, not two slightly-different ones.
+        """
+        if pnl_usd <= 0:
+            raise TradingBridgeError(
+                f"report_realized_profit called with pnl_usd={pnl_usd} <= 0 -- this bridge only "
+                f"records REALIZED PROFIT (see module docstring); a non-positive value means either "
+                f"a losing trade (which this strategy's take-profit gating should make structurally "
+                f"impossible for a CLOSED trade -- see grid_engine.py's own note on this) or a caller "
+                f"bug. Refusing rather than writing a nonsensical ledger entry."
+            )
+        if not verify_trading_profit_signature(pool_pubkey_pem, asset, exchange, external_ref,
+                                                 pnl_usd, timestamp, signature_b64):
+            raise TradingBridgeError("Invalid trading-profit signature -- refusing to credit the ledger.")
+
+        # Audit-trail judgment, NOT a hard gate -- see module docstring on
+        # why this is soft here specifically. A profit report has no
+        # peer-to-peer "sender" content to judge for the kind of thing
+        # MockJudge's keyword scan is even meant to catch; logging the
+        # judgment keeps the same audit pattern the rest of the system
+        # uses without pretending a hard gate here would mean something
+        # it doesn't.
+        judgment = self.sentinel.judge.evaluate(
+            {"origin": "trading_bracket_grid", "asset": asset, "exchange": exchange,
+             "external_ref": external_ref, "pnl_usd": pnl_usd},
+            self.sentinel.principles,
+        )
+        ref_id = f"trading_profit:{exchange}:{external_ref}"
+        self.db.save_judgment(ref_id, judgment)
+        self.db.record_ledger_entry(pool_pubkey_pem, pnl_usd, "trading_profit", ref_id=ref_id)
+
+        return {
+            "credited": pnl_usd, "new_balance": self.db.get_balance(pool_pubkey_pem),
+            "judgment": judgment.reasoning, "ref_id": ref_id,
+        }
+
+    def gift_stake_to_new_node(self, pool_pubkey_pem: str, recipient_pubkey_pem: str, amount: float,
+                                timestamp: float, signature_b64: str) -> dict:
+        """
+        Non-usurious by construction: a straight ledger credit, zero
+        consideration, no interest, no repayment obligation -- reason
+        string is "node_gift", deliberately distinct from "stake_lock"
+        or anything loan-shaped. Requires the POOL's real signature
+        (proving the operator authorized this specific gift, to this
+        specific recipient, for this specific amount) -- an attacker who
+        merely knows a recipient pubkey cannot drain the pool by calling
+        this. Does NOT stake on the recipient's behalf -- see module
+        docstring; they stake it themselves via the existing signed
+        /stake route if they choose to.
+        """
+        if amount <= 0:
+            raise TradingBridgeError("Gift amount must be positive.")
+        if not verify_node_gift_signature(pool_pubkey_pem, recipient_pubkey_pem, amount, timestamp, signature_b64):
+            raise TradingBridgeError("Invalid node-gift signature -- refusing to move funds.")
+        balance = self.db.get_balance(pool_pubkey_pem)
+        if balance < amount:
+            raise TradingBridgeError(f"Insufficient pool balance: have {balance:.2f}, need {amount:.2f}.")
+
+        ref_id = f"node_gift:{pool_pubkey_pem[:16]}:{recipient_pubkey_pem[:16]}:{timestamp}"
+        self.db.record_ledger_entry(pool_pubkey_pem, -amount, "node_gift_sent", ref_id=ref_id)
+        self.db.record_ledger_entry(recipient_pubkey_pem, amount, "node_gift_received", ref_id=ref_id)
+
+        return {
+            "gifted": amount, "pool_balance_after": self.db.get_balance(pool_pubkey_pem),
+            "recipient_balance_after": self.db.get_balance(recipient_pubkey_pem), "ref_id": ref_id,
+        }
+
+    def register_pool_succession(self, pool_pubkey_pem: str, successor_pubkey_pem: str,
+                                  guardian_pubkeys: list, threshold: int,
+                                  heartbeat_interval_days: float = 30, grace_period_days: float = 15) -> tuple:
+        """Thin, documented wrapper -- see module docstring's SCOPE
+        BOUNDARY before treating this as complete succession coverage
+        for the trading operation as a whole."""
+        return self.succession.register(
+            pool_pubkey_pem, successor_pubkey_pem, guardian_pubkeys,
+            threshold, heartbeat_interval_days, grace_period_days,
+        )

covenant_unified_v8.py

@@ -197,6 +197,84 @@ PATCH LOG — v7.2 (balance ledger + /stake signature requirement)
    Fixed: the route now reads both fields from the request body.
 """
 
+# ---------------------------------------------------------------------------
+# PATCH LOG -- v8.6: TRADING BRIDGE -- REALIZED TRADING PROFIT BECOMES REAL
+# COVENANT LEDGER VALUE, FUNDING THE NODE-GIFTING STRUCTURE
+# ----------------------------------------------------------------
+#   N. Connects the grid/bracket trading strategy (separate project:
+#      strategy/, ledger-app/) to this ledger. Implemented in a SEPARATE
+#      module, covenant_trading_bridge.py, not folded into this file --
+#      see that module's docstring for why. Two routes added below, both
+#      requiring the same domain-tagged RSA-PSS signature scheme
+#      (_domain_frame) every other value-moving action here already uses,
+#      plus nonce-based replay protection matching /claim_rewards and
+#      /unstake:
+#        POST /trading/report_profit -- credits realized trading P&L to
+#          the pool's ledger balance. A signed, mint-style credit (like
+#          genesis's one-time mint, but gated by a real signature EVERY
+#          time, never unconditional) rather than forced through the
+#          peer-to-peer Transaction/mining pipeline, which has no natural
+#          "sender" for value that originated outside Covenant entirely.
+#        POST /trading/gift -- the actual node-gifting mechanism: a
+#          straight ledger credit, zero consideration, reason=
+#          "node_gift" (deliberately not "stake_lock" or anything
+#          loan-shaped) -- non-usurious by construction. Does NOT
+#          auto-stake for the recipient; they stake it themselves via the
+#          existing signed /stake route, consistent with this file's
+#          standing rule that staking requires the staker's own
+#          signature.
+#      VERIFIED EMPIRICALLY before wiring in (see covenant_trading_
+#      bridge.py's own test run): forged signatures rejected, negative/
+#      zero pnl rejected, over-balance gifts rejected, gifts confirmed
+#      NOT auto-staked, recipient confirmed able to stake their gift via
+#      the normal existing path.
+#      SCOPE BOUNDARY, NOT SOLVED HERE: SuccessionGuardianSystem
+#      registration for the pool's key (already usable, zero changes
+#      needed) makes WHO CAN SIGN future ledger entries for the trading
+#      pool a real, enforceable cryptographic fact. It does NOT and
+#      cannot transfer control of the actual exchange accounts or the
+#      physical Ledger hardware wallet those accounts ultimately depend
+#      on -- that is real-world estate planning outside anything code can
+#      enforce. Flagged loudly rather than implied solved.
+# ---------------------------------------------------------------------------
+
+# ---------------------------------------------------------------------------
+# PATCH LOG -- v8.7: PRODUCTION WSGI SERVER (waitress)
+# ----------------------------------------------------------------
+#   O. Requested: replace werkzeug's run_simple (module docstring's own
+#      FOUR FATAL BUGS item 2 is literally about this same call site --
+#      weird_science.py originally forgot to import it at all) with a
+#      real production WSGI server. run_simple prints its own warning on
+#      every start ("This is a development server. Do not use it in a
+#      production deployment.") -- that warning was accurate, not
+#      decorative, and this closes it. Chosen: waitress -- pure Python,
+#      no C-extension build step (relevant since run_sandboxed() already
+#      documents a POSIX-only fork() constraint elsewhere in this file;
+#      not adding a second platform constraint via the WSGI layer too),
+#      actively maintained, and its defaults are sane enough that most of
+#      the "production hardening" is just making waitress's own existing
+#      defaults explicit in the serve() call (see CovenantAPI.run())
+#      rather than inventing new configuration surface.
+#      NOT SOLVED BY THIS CHANGE, STATED PLAINLY SO IT ISN'T ASSUMED FIXED:
+#      /mine's proof-of-work runs synchronously in whichever waitress
+#      thread handles that request -- real CPU-bound work under the GIL,
+#      which more WSGI threads does not parallelize (see WSGI_THREADS'S
+#      own comment). And CovenantAPI.host still defaults to "0.0.0.0" --
+#      unchanged in this pass, deliberately: that's a distinct, already-
+#      flagged decision (network exposure given this file's own
+#      documented "NO API AUTHENTICATION ANYWHERE") separate from which
+#      WSGI server answers the socket, and bundling an unrequested
+#      default change into a response to a specific "use waitress"
+#      instruction risks exactly the kind of silent scope creep this
+#      file's own patch log has criticized elsewhere. Left for its own
+#      explicit decision.
+#      VERIFIED EMPIRICALLY: a real waitress-served instance started,
+#      confirmed no dev-server warning in output, confirmed a real HTTP
+#      round-trip (GET /chain) still succeeds -- see session notes.
+# ---------------------------------------------------------------------------
+
+
+
 import json
 import time
 import hashlib
@@ -217,7 +295,34 @@ from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa, padding
 from cryptography.hazmat.backends import default_backend
 from flask import Flask, request, jsonify
-from werkzeug.serving import run_simple  # <- the import weird_science.py forgot
+from waitress import serve  # PRODUCTION WSGI SERVER -- see PATCH LOG v8.7. Replaces
+                             # werkzeug's run_simple, which prints its own warning that
+                             # it is a development server not meant for production use.
+
+# NEW v8.6 -- TradingBridgeError defined HERE, not imported. The prior
+# version of this block did `try: from covenant_trading_bridge import
+# TradingBridgeError except ImportError: class TradingBridgeError...` --
+# confirmed by a live HTTP test (not by reading the code) to silently
+# create TWO DISTINCT class objects: covenant_trading_bridge.py imports
+# Database/StakingPool/SuccessionGuardianSystem/etc. FROM this file, so
+# when THIS file's top-level import tried to pull TradingBridgeError from
+# covenant_trading_bridge before those classes were even defined yet
+# (this import sits above their definitions), the circular import failed
+# with ImportError every time, silently triggering the fallback class
+# instead of the real one. Every /trading/gift and /trading/report_fill
+# error path then raised the REAL TradingBridgeError (from
+# covenant_trading_bridge.py, imported successfully later via the lazy
+# import in CovenantUnifiedMaster.__init__, by which point this module
+# had finished loading) while the route's `except TradingBridgeError`
+# was bound to the FALLBACK class -- so it never matched, and every
+# rejected trading-bridge request surfaced as an unhandled 500 instead of
+# the intended 400 with a clear message. Confirmed via id() comparison:
+# the two classes were different objects, same name. Fixed by defining
+# it once, here, and having covenant_trading_bridge.py import THIS one
+# (see that file's own import list) instead of each file trying to
+# obtain it from the other.
+class TradingBridgeError(Exception):
+    pass
 
 # ---------------------------------------------------------------------------
 # Constants
@@ -251,6 +356,20 @@ BASE_REGISTRATION_DIFFICULTY = 2
 # that never matched request.endpoint ("add_transaction"/"add_peer") except
 # for "mine", which happened to match by coincidence. Fixed here.
 RATE_LIMIT_DEFAULT = 20  # per 60s, unlisted/read endpoints
+
+# NEW v8.7 -- waitress's thread pool size. NOTE, stated plainly rather than
+# implied solved by "production WSGI server": /mine runs real proof-of-work
+# (block.mine() at MINING_DIFFICULTY) directly in the request-handling
+# thread. That's genuine CPU-bound work under CPython's GIL -- more
+# waitress threads does NOT parallelize it, it only lets OTHER requests
+# (reads, non-mining writes) continue being served by a different thread
+# while one thread is busy mining. If concurrent mining throughput ever
+# becomes a real requirement, that needs mining moved to a separate
+# process (e.g. via multiprocessing, same pattern run_sandboxed() already
+# uses for code proposals), not a thread-count tweak. Not done here --
+# flagged, not fixed, consistent with this file's own standing rule.
+WSGI_THREADS = 6
+
 RATE_LIMIT = {
     "add_transaction": 10,
     "mine": 1,
@@ -2531,6 +2650,7 @@ class P2PNode:
         self.friendship: Optional[FriendshipTracker] = None
         self.staking_pool: Optional[StakingPool] = None
         self.succession: Optional[SuccessionGuardianSystem] = None
+        self.trading_bridge = None  # NEW v8.6 -- see covenant_trading_bridge.py
         self.code_guardian: "CovenantGuardian" = CovenantGuardian()  # NEW v8.0
         self.rate_limiter = RateLimiter()
         self.adaptive_pow_manager = AdaptivePoWManager(db) if ADAPTIVE_POW else None
@@ -2565,6 +2685,28 @@ class P2PNode:
         for pid, (host, port) in peers:
             threading.Thread(target=self._send_raw, args=(host, port, json.dumps(message)), daemon=True).start()
 
+    def propagate_trading_event(self, event_type: str, payload: dict):
+        """NEW v8.6 -- closes the gap confirmed empirically while testing
+        the trading bridge live: record_ledger_entry (used by
+        report_realized_profit/gift_stake_to_new_node, following genesis
+        mint's own pattern) only ever applies LOCALLY -- only /mine
+        triggers propagate_block. That's the exact same gap already
+        documented for staking (PATCH LOG item 9: 'no propagate_stake()
+        anywhere'), now showing up here too, and closed the same way
+        propagate_transaction already works: broadcast the full signed
+        payload, and the RECEIVING node independently re-verifies the
+        signature before applying anything -- never trusts a peer's
+        claim that a signature was valid. event_type is "profit" or
+        "gift"; payload carries everything _handle_peer needs to call
+        the SAME bridge functions the original node called, so
+        verification logic exists in exactly one place."""
+        message = {"type": "TRADING_EVENT_PROPAGATE", "event_type": event_type, "payload": payload,
+                   "node_id": self.node_id, "nonce": f"{event_type}{payload.get('timestamp')}{secrets.token_hex(4)}"}
+        with self.peers_lock:
+            peers = list(self.peers.items())
+        for pid, (host, port) in peers:
+            threading.Thread(target=self._send_raw, args=(host, port, json.dumps(message)), daemon=True).start()
+
     def _send_raw(self, host: str, port: int, data: str):
         try:
             with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
@@ -2980,8 +3122,79 @@ class CovenantAPI:
             self.node.crisis_reason = ""
             return jsonify({"status": "success", "message": "crisis_mode cleared"})
 
+        # -------------------------------------------------------------
+        # PATCH LOG -- v8.6: TRADING BRIDGE (see covenant_trading_bridge.py
+        # for the full design rationale). Two routes, both requiring a real
+        # signature from the trading pool's own key -- same authorization
+        # model as /stake, /claim_rewards, /unstake: no separate API auth
+        # layer, the signature over the specific action IS the auth.
+        # Nonce/replay protection follows the exact pattern already used by
+        # /claim_rewards and /unstake (nonce_key from action+params+
+        # timestamp, checked via is_nonce_seen/mark_nonce_seen) rather than
+        # inventing a second convention.
+        # -------------------------------------------------------------
+        @self.app.route("/trading/report_fill", methods=["POST"])
+        def trading_report_fill():
+            if self.node.trading_bridge is None:
+                return jsonify({"status": "error", "message": "Trading bridge not available on this node (covenant_trading_bridge.py not importable)"}), 503
+            data = request.json or {}
+            pool_pubkey = data.get("pool_pubkey", "")
+            asset = data.get("asset", "")
+            exchange = data.get("exchange", "")
+            external_ref = data.get("external_ref", "")
+            pnl_usd = float(data.get("pnl_usd", 0.0))
+            timestamp = float(data.get("timestamp", 0.0))
+            signature = data.get("signature", "")
+            nonce_key = f"trading_profit:{pool_pubkey}:{exchange}:{external_ref}:{timestamp}"
+            if self.db.is_nonce_seen(nonce_key):
+                return jsonify({"status": "error", "message": "Duplicate/replayed profit report"}), 400
+            try:
+                result = self.node.trading_bridge.report_realized_profit(
+                    pool_pubkey, asset, exchange, external_ref, pnl_usd, timestamp, signature
+                )
+            except TradingBridgeError as e:
+                return jsonify({"status": "error", "message": str(e)}), 400
+            self.db.mark_nonce_seen(nonce_key)
+            return jsonify({"status": "success", **result})
+
+        @self.app.route("/trading/gift", methods=["POST"])
+        def trading_gift():
+            if self.node.trading_bridge is None:
+                return jsonify({"status": "error", "message": "Trading bridge not available on this node (covenant_trading_bridge.py not importable)"}), 503
+            data = request.json or {}
+            pool_pubkey = data.get("pool_pubkey", "")
+            recipient_pubkey = data.get("recipient_pubkey", "")
+            amount = float(data.get("amount", 0.0))
+            timestamp = float(data.get("timestamp", 0.0))
+            signature = data.get("signature", "")
+            nonce_key = f"node_gift:{pool_pubkey}:{recipient_pubkey}:{timestamp}"
+            if self.db.is_nonce_seen(nonce_key):
+                return jsonify({"status": "error", "message": "Duplicate/replayed gift"}), 400
+            try:
+                result = self.node.trading_bridge.gift_stake_to_new_node(
+                    pool_pubkey, recipient_pubkey, amount, timestamp, signature
+                )
+            except TradingBridgeError as e:
+                return jsonify({"status": "error", "message": str(e)}), 400
+            self.db.mark_nonce_seen(nonce_key)
+            return jsonify({"status": "success", **result})
+
     def run(self):
-        run_simple(self.host, self.port, self.app, threaded=True)
+        # PRODUCTION WSGI SERVER -- see PATCH LOG v8.7 (module docstring).
+        # connection_limit and channel_timeout are waitress's own defaults
+        # made explicit here rather than left implicit, so a future reader
+        # doesn't have to go check waitress's source to know what's
+        # actually in effect. clear_untrusted_proxy_headers=True is
+        # waitress's default as of the version pinned in requirements.txt;
+        # stated explicitly since silently relying on a library default
+        # that could change between versions is the same "invisible
+        # behavior" shape this file's own patch log has flagged elsewhere
+        # (e.g. PATCH LOG item H's hasattr guards).
+        serve(
+            self.app, host=self.host, port=self.port, threads=WSGI_THREADS,
+            connection_limit=100, channel_timeout=120,
+            clear_untrusted_proxy_headers=True,
+        )
 
 
 # ---------------------------------------------------------------------------
@@ -3015,6 +3228,17 @@ class CovenantUnifiedMaster:
         self.node.friendship = FriendshipTracker(self.db)
         self.node.staking_pool = StakingPool(self.db)
         self.node.succession = SuccessionGuardianSystem(self.db)
+        # NEW v8.6 -- see covenant_trading_bridge.py. Imported lazily here
+        # (not at module top) so covenant_unified_v8.py has zero hard
+        # dependency on the bridge module -- the core file must still
+        # import and run standalone even if the bridge file is absent,
+        # consistent with this module's own stated policy of not letting
+        # one concern's presence become a silent requirement for another's.
+        try:
+            from covenant_trading_bridge import TradingBridge
+            self.node.trading_bridge = TradingBridge(self.db, self.node.sentinel, self.node.staking_pool, self.node.succession)
+        except ImportError:
+            self.node.trading_bridge = None
 
         self.node.chain = self.db.load_chain()
         if self.node.chain:

requirements.txt

@@ -0,0 +1,11 @@
+# Core
+flask>=3.0,<4.0
+cryptography>=42.0,<44.0
+
+# Production WSGI server -- see PATCH LOG v8.7 in covenant_unified_v8.py.
+# Pure Python, no C-extension build step, works the same across platforms.
+waitress>=3.0,<4.0
+
+# Trading bridge test/dev dependency only -- not needed to run the node
+# itself, only to exercise covenant_trading_bridge.py's HTTP-level tests.
+requests>=2.31,<3.0

tierNavigation.js

@@ -0,0 +1,42 @@
+/**
+ * tierNavigation.js
+ *
+ * Single source of truth for "which tier buttons are clickable from here."
+ * Pulled out of Dashboard.jsx's TierLadder deliberately: before this, the
+ * reachability rule lived inline in JSX, and handleTierChange's if/else
+ * chain lived a few lines below it as a SEPARATE, hand-maintained list --
+ * two things that had to agree with each other but had no mechanism
+ * forcing them to. Confirmed empirically (see tierNavigation.test.js)
+ * that they'd already drifted: the dashboard-tier button rendered
+ * clickable at manual/automated tiers, but handleTierChange had no
+ * matching branch, so tapping it silently did nothing. Same shape as
+ * every other "two things that must agree, drifted apart, one caller
+ * didn't notice" bug this project's patch logs keep finding elsewhere --
+ * fixed here the same way those were: one source of truth, not two
+ * copies kept in sync by hand.
+ */
+
+import { TIERS } from "./tradeGate.js";
+
+export const TIER_ORDER = [TIERS.DASHBOARD, TIERS.MANUAL, TIERS.AUTOMATED];
+
+export function getTierRank(tierKey) {
+  return TIER_ORDER.indexOf(tierKey);
+}
+
+/**
+ * Every tier at or below (current + 1) is reachable -- stepping UP only
+ * ever unlocks the next rung, but stepping DOWN is always fully open,
+ * from any tier, in one tap. That asymmetry is deliberate (see
+ * tradeGate.js's own "de-escalating trust should never be the hard
+ * path"), not an oversight -- it's *why* dashboard is clickable from
+ * automated, which is exactly the case that had no handler.
+ */
+export function getClickableTierKeys(currentTierKey) {
+  const currentRank = getTierRank(currentTierKey);
+  return TIER_ORDER.filter((key, i) => i !== currentRank && i <= currentRank + 1);
+}
+
+export function isTierClickable(currentTierKey, targetTierKey) {
+  return getClickableTierKeys(currentTierKey).includes(targetTierKey);
+}