feat: register and audit prospective alpha calls by market

.github/workflows/deploy.yml

@@ -62,6 +62,7 @@ jobs:
           WRANGLER_SEND_METRICS: 'false'
         run: |
           test -n "$CLOUDFLARE_API_TOKEN" || { echo "Configure the production Cloudflare deployment secret."; exit 1; }
-          npm --prefix cloudflare run deploy -- --var "SOURCE_REVISION:$(git rev-parse HEAD)"
+          source_content_hash=$(PYTHONPATH=backend python -c 'from app.core.release import source_content_hash; print(source_content_hash())')
+          npm --prefix cloudflare run deploy -- --var "SOURCE_REVISION:$(git rev-parse HEAD)" --var "SOURCE_CONTENT_HASH:$source_content_hash"
       - name: Verify public release
         run: python scripts/verify_deployment.py --timeout 120

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2.3.0 — 2026-10-14
+
+- Register new equity and Forex calls prospectively, preserving source identity, frozen inputs, timestamps and protected-code fingerprints.
+- Add a read-only Alpha Desk with separate markets, explicit exclusions, net-cost reconciliation and closure-date confidence intervals.
+- Include older closed trades in Alpha and exclude expired unfilled orders; remove duplicate live-forward sample counts.
+- Mark unverified historical positive grades as insufficient evidence.
+- Stop startup after failed database restores. Periodic embedded backups still do not guarantee zero-loss recovery.
+- Verify actual protected backend/script content during automated deployment, in addition to source revision and version.
+
+
 ## v2.2.0 | ASCENT and canonical release
 
 - Added bounded ASCENT calibration source experiments, frozen temporal holdouts, independent gates, persistent lineage and Evolution.

README.md

@@ -46,14 +46,15 @@ The supported configuration is paper trading and research. There is no broker ex
 
 These pages read snapshots; opening a page does not launch training or research. The public gateway permits only reviewed GET/HEAD APIs. Legacy diagnostic operations remain private. Administrative research and deployment use private credentials and trusted maintainer tools.
 
-## What ships in 2.2
+## What ships in 2.3
 
+- **Prospective Alpha Desk.** New equity and Forex decisions are registered before outcomes with frozen input hashes, provider/availability metadata, an actual registration timestamp and a protected-code fingerprint. Markets are evaluated separately; stale inputs, unfilled orders and unreconciled costs cannot create a qualified track record. [Read the evaluation contract](docs/ALPHA_DESK.md).
 - **Bounded source evolution.** ASCENT generates four actual calibration source candidates per generation, tests them, freezes selection and evaluates the selected candidate against untouched evidence. Candidates can alter confidence calibration only.
 - **Capability-free evaluation.** A restricted arithmetic interpreter permits finite constants, the scalar confidence input, arithmetic and min/max. Candidate code receives no filesystem, environment, network or host execution.
 - **Independent validation.** Purged chronological development folds, a frozen holdout, baseline comparisons, asset/regime coverage, calibration regression checks and conservative time-block uncertainty gates determine retention.
 - **Persistent experiments.** SQL checkpoints, source/evaluator/data hashes, consumed-holdout records and private artifacts preserve lineage and failures.
 - **Data rejection at the boundary.** Invalid price candles and conflicting Forex records are excluded. Old external Forex projections and advice are rejected by the current policy.
-- **Reproducible releases.** Locked web dependencies, backend/migration checks, gateway tests, reviewed data hashes and one-way GitHub deployment.
+- **Reproducible releases.** Locked web dependencies, backend/migration checks, gateway tests, reviewed data hashes and one-way GitHub deployment. The backend reports a fingerprint computed from its actual protected runtime files; deployment verification checks this against the verified checkout.
 
 ASCENT retains research artifacts. It does not automatically merge code, replace a production champion, promote an HF model or place orders. Its budget is at most 2,000 observations, four candidates and 90 cooperative seconds per cycle, with at most eight generations per day. It uses no external inference or paid GPU job. Database operations are not forcibly preempted.
 

backend/alembic/versions/0045_alpha_call_registry.py

@@ -0,0 +1,31 @@
+"""Register prospective alpha calls without modifying legacy evidence."""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB
+
+revision = '0045_alpha_call_registry'
+down_revision = '0044_ascent_evolution'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table('alpha_call_registrations',
+        sa.Column('id',sa.Integer(),primary_key=True),
+        sa.Column('source_uid',sa.String(220),nullable=False,unique=True),
+        sa.Column('source_type',sa.String(32),nullable=False),
+        sa.Column('source_id',sa.Integer(),nullable=False),
+        sa.Column('market',sa.String(16),nullable=False),
+        sa.Column('asset',sa.String(32),nullable=False),
+        sa.Column('decision_at',sa.DateTime(),nullable=False),
+        sa.Column('registered_at',sa.DateTime(),nullable=False),
+        sa.Column('source_revision',sa.String(40),nullable=False),
+        sa.Column('source_content_hash',sa.String(64),nullable=False),
+        sa.Column('manifest_json',sa.JSON().with_variant(JSONB,'postgresql'),nullable=False),
+        sa.Column('manifest_sha256',sa.String(64),nullable=False))
+    op.create_index('ix_alpha_call_registrations_market','alpha_call_registrations',['market'])
+    op.create_index('ix_alpha_call_registrations_registered_at','alpha_call_registrations',['registered_at'])
+
+
+def downgrade():
+    op.drop_table('alpha_call_registrations')

backend/app/api/routers/alpha.py

@@ -10,6 +10,11 @@ from app.engine.facade import BlumEngineFacade
 router = APIRouter(tags=["Alpha"])
 
 
+@router.get("/api/alpha/desk")
+def alpha_desk(db: Session = Depends(get_db)) -> dict:
+    return BlumEngineFacade().alpha_desk_snapshot(db)
+
+
 @router.get("/trader-brain/alpha")
 @router.get("/api/trader-brain/alpha")
 def alpha(db: Session = Depends(get_db)) -> dict:

backend/app/api/routers/runtime.py

@@ -4,7 +4,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy.orm import Session
 
 from app.core.config import get_settings
-from app.core.release import source_revision
+from app.core.release import source_revision, source_content_hash
 from app.core.database import get_db
 from app.runtime.facade import BlumRuntimeFacade
 from app.services.central_brain_runtime import CentralBrainRuntime, LearningHealthService, SnapshotProducerService, SnapshotWatchdogService
@@ -18,7 +18,7 @@ router = APIRouter(tags=["Runtime"])
 
 @router.get("/api/runtime/release")
 def runtime_release() -> dict:
-    return {"version": settings.app_version, "source_revision": source_revision(),
+    return {"version": settings.app_version, "source_revision": source_revision(), "source_content_hash": source_content_hash(),
             "mode": "paper_research", "github": "https://github.com/SignalLayerLabs/Blum"}
 
 

backend/app/core/config.py

@@ -5,7 +5,7 @@ from pydantic_settings import BaseSettings
 
 class Settings(BaseSettings):
     app_name: str = "Blum AI Financial Intelligence"
-    app_version: str = "2.2.0"
+    app_version: str = "2.3.0"
     public_observatory_enabled: bool = Field(default=False, alias="BLUM_PUBLIC_OBSERVATORY_ENABLED")
     environment: str = Field(default="demo", alias="ENVIRONMENT")
     database_url: str = Field(

backend/app/core/release.py

@@ -2,6 +2,8 @@
 from __future__ import annotations
 
 import json
+import hashlib
+from functools import lru_cache
 import os
 from pathlib import Path
 import re
@@ -10,6 +12,27 @@ import subprocess
 BUILD_REVISION = Path(__file__).parents[1] / 'data' / 'build_revision.json'
 
 
+def content_hash_for_root(root: Path) -> str:
+    """Fingerprint protected runtime code, independently of declared revision variables."""
+    files = [*root.joinpath('backend/app').rglob('*.py'),
+             *root.joinpath('scripts').rglob('*.py'),
+             *root.joinpath('scripts').rglob('*.sh')]
+    result = hashlib.sha256()
+    for file in sorted(set(files), key=lambda path: path.relative_to(root).as_posix()):
+        relative = file.relative_to(root).as_posix().encode()
+        content = file.read_bytes()
+        result.update(len(relative).to_bytes(8, 'big'))
+        result.update(relative)
+        result.update(len(content).to_bytes(8, 'big'))
+        result.update(content)
+    return result.hexdigest()
+
+
+@lru_cache(maxsize=1)
+def source_content_hash() -> str:
+    return content_hash_for_root(Path(__file__).parents[3])
+
+
 def source_revision() -> str:
     if BUILD_REVISION.is_file():
         try:

backend/app/data/public_api_routes.json

@@ -2,7 +2,7 @@
   "/health", "/startup/status", "/system/status",
   "/api/brain/snapshot", "/api/training/snapshot", "/api/paper-trading/snapshot",
   "/api/paper-trading/trades/{source_engine}/{source_trade_id}",
-  "/api/alpha/snapshot", "/api/ascent/status",
+  "/api/alpha/snapshot", "/api/alpha/desk", "/api/ascent/status",
   "/api/runtime/release", "/api/runtime/status", "/api/runtime/contracts",
   "/api/engine/status", "/api/engine/contracts", "/api/engine/agents",
   "/api/analyst/status", "/api/analyst/contracts", "/api/architecture/contracts",

backend/app/engine/brain/trader_brain.py

@@ -291,6 +291,10 @@ class TraderBrainService:
         live_game = latest_row(db, LiveForwardPaperGame)
         benchmarks = latest_benchmarks(db)
         paper_rows = db.scalars(select(LiveForwardPaperTrade).order_by(desc(LiveForwardPaperTrade.created_at)).limit(500)).all()
+        closed_history = db.scalars(select(LiveForwardPaperTrade)
+            .where(LiveForwardPaperTrade.status == "CLOSED")
+            .order_by(desc(LiveForwardPaperTrade.closed_at), desc(LiveForwardPaperTrade.id)).limit(500)).all()
+        paper_rows = list({row.id: row for row in [*paper_rows, *closed_history]}.values())
         excluded_evidence_types = {
             "PAPER_FORWARD_INTRADAY_EXPERIMENTAL",
             "PAPER_FORWARD_INVALID_ENTRY_GEOMETRY",
@@ -334,7 +338,8 @@ class TraderBrainService:
         verdict = alpha_verdict_from_splits(evidence_split, evidence_grade)
         latest_update = latest_alpha_update_from_splits(evidence_split) or latest_paper_forward_update(eligible_paper_rows, benchmarks)
         primary_evidence = primary_alpha_evidence(evidence_split)
-        total_evidence_sample = sum(int(split.get("sample_size") or 0) for split in evidence_split.values() if isinstance(split, dict))
+        # live_forward is a second view of paper_forward, not independent observations.
+        total_evidence_sample = sum(int(split.get("sample_size") or 0) for key, split in evidence_split.items() if isinstance(split, dict) and key != "live_forward")
         unified_payload = unified_paper.get("payload") or {}
         unified_counts = (unified_payload.get("counts") or {}).get("aggregate") or {}
         unified_metrics = (unified_payload.get("metrics") or {}).get("aggregate") or {}
@@ -1569,8 +1574,9 @@ def trading_game_evidence_split(rows: list[TradingGameTrade], *, label: str, dat
         "win_rate": round(wins / len(rows), 4) if rows else None,
         "profit_factor": profit_factor,
         "max_drawdown": average_present(drawdown_values),
-        "evidence_grade": grade,
-        "evidence_reason": reason,
+        "evidence_grade": grade if grade in {"NO_DATA", "WEAK"} else "INSUFFICIENT_EVIDENCE",
+        "evidence_reason": "Legacy historical results lack independently verified input and evaluation provenance; descriptive returns are not a validated alpha claim.",
+        "provenance_status": "UNVERIFIED_LEGACY",
         "data_source": data_source,
         "last_updated_at": latest_iso([row.created_at for row in rows if row.created_at]),
         "results": [historical_trade_result(row) for row in rows[:6]],
@@ -1888,11 +1894,15 @@ def latest_iso(values: list[Any]) -> str | None:
 
 
 def paper_forward_trade_is_closed(row: LiveForwardPaperTrade) -> bool:
+    if str(row.status or "").upper() in {"EXPIRED", "INVALIDATED", "SKIPPED", "REJECTED", "DATA_BLOCKED"}:
+        return False
+    if str(row.outcome_label or row.close_reason or "").upper() in {"ORDER_NOT_FILLED", "SIGNAL_DECAY_BEFORE_ENTRY"}:
+        return False
     return bool(
         row.closed_at
         or row.exit_price is not None
         or row.close_reason
-        or str(row.status or "").upper() in {"CLOSED", "EXITED", "EXPIRED", "INVALIDATED"}
+        or str(row.status or "").upper() in {"CLOSED", "EXITED"}
     )
 
 

backend/app/engine/contracts.py

@@ -4,7 +4,7 @@ from dataclasses import asdict, dataclass, field
 from typing import Any, Literal
 
 
-ENGINE_VERSION = "2.2.0"
+ENGINE_VERSION = "2.3.0"
 PROJECT_FEATURE_SET = "clean-core"
 BLUM_ANALYST_REPOSITORY = "Italianhype/Blum-Analyst"
 

backend/app/engine/facade.py

@@ -127,7 +127,12 @@ class BlumEngineFacade:
         return UnifiedPaperTradingProjectionService().detail(db, source_engine, source_trade_id)
 
     def alpha_snapshot(self, db: Session) -> dict:
-        return TraderBrainService().alpha(db)
+        from app.services.alpha_desk import AlphaDeskService
+        return {**TraderBrainService().alpha(db), "registered_alpha_desk": AlphaDeskService().snapshot(db)}
+
+    def alpha_desk_snapshot(self, db: Session) -> dict:
+        from app.services.alpha_desk import AlphaDeskService
+        return AlphaDeskService().snapshot(db)
 
     def agent_evidence(self, db: Session, *, agents: list[str] | None = None, limit: int = 8) -> dict:
         return collect_agent_evidence(db, names=agents, limit=limit)

backend/app/models.py

@@ -10,6 +10,22 @@ from app.core.database import Base
 JsonType = JSON().with_variant(JSONB, "postgresql")
 
 
+class AlphaCallRegistration(Base):
+    __tablename__ = "alpha_call_registrations"
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    source_uid: Mapped[str] = mapped_column(String(220), unique=True)
+    source_type: Mapped[str] = mapped_column(String(32))
+    source_id: Mapped[int] = mapped_column(Integer)
+    market: Mapped[str] = mapped_column(String(16), index=True)
+    asset: Mapped[str] = mapped_column(String(32))
+    decision_at: Mapped[datetime] = mapped_column(DateTime)
+    registered_at: Mapped[datetime] = mapped_column(DateTime, index=True)
+    source_revision: Mapped[str] = mapped_column(String(40))
+    source_content_hash: Mapped[str] = mapped_column(String(64))
+    manifest_json: Mapped[dict] = mapped_column(JsonType)
+    manifest_sha256: Mapped[str] = mapped_column(String(64))
+
+
 class AscentGeneration(Base):
     __tablename__ = "ascent_generations"
     id: Mapped[int] = mapped_column(Integer, primary_key=True)

backend/app/services/alpha_desk.py

@@ -0,0 +1,299 @@
+"""Prospective call registration and bounded, market-separated evidence reads.
+
+The registry proves what this deployment recorded, not external data correctness
+or competitor superiority. It never upgrades legacy records into forward calls.
+"""
+from __future__ import annotations
+
+from collections import Counter, defaultdict
+from datetime import date, datetime, timezone
+import hashlib
+import json
+import math
+import random
+
+from sqlalchemy import desc, func, select
+
+from app.core.release import source_revision, source_content_hash
+from app.models import AlphaCallRegistration, ForexDecision, ForexPosition, LiveForwardPaperTrade
+from app.services.paper_forward_direction import is_forex_identity, normalize_side, paper_trade_evidence_is_eligible, validate_trade_plan
+from app.services.persistence import database_persistence_status
+
+WINDOW = 2000
+METHODOLOGY = 'prospective-alpha-desk-v1'
+
+
+def utc(value):
+    if isinstance(value,str):
+        try:
+            value=datetime.fromisoformat(value.replace('Z','+00:00'))
+        except ValueError:
+            return None
+    if isinstance(value,date) and not isinstance(value,datetime):
+        value=datetime.combine(value,datetime.min.time())
+    if not isinstance(value,datetime):
+        return None
+    return value.astimezone(timezone.utc).replace(tzinfo=None) if value.tzinfo else value
+
+
+def number(value):
+    if isinstance(value,bool) or not isinstance(value,(int,float)):
+        return None
+    return float(value) if math.isfinite(value) else None
+
+
+def mapping(value):
+    return value if isinstance(value,dict) else {}
+
+
+def provider_name(value):
+    return isinstance(value,str) and bool(value.strip())
+
+
+def safe_json(value):
+    if isinstance(value,dict): return {str(k):safe_json(v) for k,v in value.items()}
+    if isinstance(value,(list,tuple)): return [safe_json(v) for v in value]
+    if isinstance(value,(datetime,date)): return value.isoformat()
+    if isinstance(value,float) and not math.isfinite(value): return {'invalid_number':str(value)}
+    return value
+
+
+def digest(value):
+    return hashlib.sha256(json.dumps(safe_json(value),sort_keys=True,separators=(',',':'),allow_nan=False).encode()).hexdigest()
+
+
+def manifest(source):
+    if isinstance(source,LiveForwardPaperTrade):
+        return safe_json({'source_uid':'paper:'+source.trade_uid,'asset':source.ticker,
+            'direction':source.side,'decision_at':source.decision_timestamp,
+            'market':source.market,'asset_type':source.asset_type,'benchmark':source.benchmark_ticker,
+            'expected_net_edge':source.net_expectancy_bps,
+            'model':source.model_version_used,'inputs':source.frozen_decision_payload or {}})
+    if isinstance(source,ForexDecision):
+        return safe_json({'source_uid':'forex:'+source.decision_uid,'asset':source.pair,
+            'direction':source.direction,'decision_at':source.decision_timestamp,
+            'model':source.strategy_id,'inputs':source.input_snapshot or {},
+            'proposal':source.proposal_json or {},'risk':source.risk_json or {}})
+    raise ValueError('UNSUPPORTED_ALPHA_SOURCE')
+
+
+class AlphaCallRegistry:
+    def register(self,db,source,*,registered_at=None):
+        db.flush()
+        frozen=manifest(source)
+        uid=frozen['source_uid']
+        sha=digest(frozen)
+        existing=db.scalar(select(AlphaCallRegistration).where(AlphaCallRegistration.source_uid==uid))
+        if existing:
+            if existing.manifest_sha256!=sha:
+                raise ValueError('FROZEN_CALL_CHANGED')
+            return existing
+        now=utc(registered_at or datetime.now(timezone.utc))
+        decision=utc(source.decision_timestamp)
+        if decision is None or decision>now:
+            raise ValueError('INVALID_REGISTRATION_TIME')
+        if isinstance(source,LiveForwardPaperTrade) and (source.closed_at is not None or source.status in {'CLOSED','EXPIRED','INVALIDATED'}):
+            raise ValueError('RETROSPECTIVE_REGISTRATION_FORBIDDEN')
+        if isinstance(source,ForexDecision) and db.scalar(select(ForexPosition.id).where(
+            ForexPosition.decision_id==source.id,ForexPosition.closed_at.is_not(None)).limit(1)):
+            raise ValueError('RETROSPECTIVE_REGISTRATION_FORBIDDEN')
+        forex=isinstance(source,ForexDecision) or is_forex_identity(ticker=source.ticker,market=source.market,asset_type=source.asset_type)
+        record=AlphaCallRegistration(source_uid=uid,source_type='forex' if isinstance(source,ForexDecision) else 'paper',
+            source_id=source.id,market='forex' if forex else 'equity',asset=frozen['asset'],decision_at=decision,
+            registered_at=now,source_revision=source_revision(),source_content_hash=source_content_hash(),manifest_json=frozen,manifest_sha256=sha)
+        db.add(record)
+        db.flush()
+        return record
+
+
+def provenance(record):
+    frozen=mapping(record.manifest_json)
+    inputs=mapping(frozen.get('inputs'))
+    decision=utc(record.decision_at)
+    blockers=[]
+    if not isinstance(frozen.get('inputs'),dict): blockers.append('INVALID_INPUT_SHAPE')
+    if (utc(record.registered_at)-decision).total_seconds()>300:
+        blockers.append('REGISTRATION_DELAY')
+    if record.source_type=='forex':
+        quote=mapping(inputs.get('quote'))
+        stamp=utc(quote.get('timestamp'))
+        provider=quote.get('source')
+        bid,ask=number(quote.get('bid')),number(quote.get('ask'))
+        if bid is None or ask is None or bid<=0 or ask<bid:
+            blockers.append('INVALID_QUOTE')
+        availability=[utc(inputs.get('as_of'))]
+        frames=mapping(inputs.get('timeframes'))
+        if not frames: blockers.append('MISSING_PROVENANCE')
+        availability += [utc(frame.get('acquired_at')) for frame in frames.values() if isinstance(frame,dict)]
+        limit=180
+    else:
+        context=mapping(inputs.get('price_context'))
+        stamp=utc(context.get('market_timestamp') or context.get('latest_date'))
+        provider=context.get('provider')
+        availability=[utc(context.get('available_at'))]
+        limit=180 if record.market=='forex' else 96*3600
+        price=number(context.get('latest_price'))
+        if price is None or price<=0: blockers.append('INVALID_QUOTE')
+        quality=number(context.get('data_quality_score'))
+        if quality is None or not 70<=quality<=100: blockers.append('LOW_DATA_QUALITY')
+    if not provider_name(provider) or stamp is None or not availability or any(value is None for value in availability):
+        blockers.append('MISSING_PROVENANCE')
+    if stamp is not None and decision is not None:
+        if stamp>decision: blockers.append('FUTURE_INPUT')
+        elif (decision-stamp).total_seconds()>limit: blockers.append('STALE_AT_DECISION')
+    if any(value is not None and value>decision for value in availability): blockers.append('FUTURE_INPUT')
+    if record.source_type=='forex':
+        for frame in frames.values():
+            if not isinstance(frame,dict):
+                blockers.append('MISSING_PROVENANCE')
+                continue
+            timestamp=utc(frame.get('market_timestamp'))
+            if timestamp is None or not provider_name(frame.get('provider')): blockers.append('MISSING_PROVENANCE')
+            elif timestamp>decision: blockers.append('FUTURE_INPUT')
+            quality=number(frame.get('quality_score'))
+            if quality is None or not 70<=quality<=100: blockers.append('LOW_DATA_QUALITY')
+    return list(dict.fromkeys(blockers)),stamp,limit
+
+
+def paired_interval(rows):
+    groups=defaultdict(list)
+    for row in rows:
+        if number(row.get('excess')) is not None:
+            groups[str(row['date'])].append(float(row['excess']))
+    values=[v for group in groups.values() for v in group]
+    result={'observations':len(values),'dates':len(groups),'assets':len({r['asset'] for r in rows}),
+        'mean':sum(values)/len(values) if values else None,'lower_95':None,'upper_95':None,
+        'positive_sample':False,'method':'closure-date cluster bootstrap; no multiple-testing correction'}
+    if len(groups)<2: return result
+    blocks=[(sum(v),len(v)) for v in groups.values()]
+    rng=random.Random(3407)
+    draws=[]
+    for _ in range(800):
+        selected=rng.choices(blocks,k=len(blocks))
+        draws.append(sum(v for v,n in selected)/sum(n for v,n in selected))
+    draws.sort()
+    result['lower_95'],result['upper_95']=draws[19],draws[779]
+    result['positive_sample']=len(values)>=100 and len(groups)>=30 and result['assets']>=3 and result['lower_95']>0
+    return result
+
+
+class AlphaDeskService:
+    def snapshot(self,db,*,now=None):
+        now=utc(now or datetime.now(timezone.utc))
+        records=list(db.scalars(select(AlphaCallRegistration).order_by(desc(AlphaCallRegistration.registered_at),desc(AlphaCallRegistration.id)).limit(WINDOW)))
+        paper_ids=[r.source_id for r in records if r.source_type=='paper']
+        forex_ids=[r.source_id for r in records if r.source_type=='forex']
+        papers={r.id:r for r in db.scalars(select(LiveForwardPaperTrade).where(LiveForwardPaperTrade.id.in_(paper_ids)))} if paper_ids else {}
+        decisions={r.id:r for r in db.scalars(select(ForexDecision).where(ForexDecision.id.in_(forex_ids)))} if forex_ids else {}
+        positions=defaultdict(list)
+        if forex_ids:
+            for row in db.scalars(select(ForexPosition).where(ForexPosition.decision_id.in_(forex_ids))): positions[row.decision_id].append(row)
+        journal=[]
+        for record in records:
+            source=papers.get(record.source_id) if record.source_type=='paper' else decisions.get(record.source_id)
+            rows=positions[record.source_id] if record.source_type=='forex' else []
+            journal.append(self._call(record,source,rows,now))
+        markets={key:self._market([r for r in journal if r['market']==key]) for key in ('equity','forex')}
+        total=int(db.scalar(select(func.count(AlphaCallRegistration.id))) or 0)
+        persistence=database_persistence_status()
+        return {'status':'READY','methodology_version':METHODOLOGY,'generated_at':now.isoformat(),
+            'registered_count':total,'window':{'limit':WINDOW,'evaluated':len(records),'truncated':total>WINDOW},
+            'markets':markets,'journal':journal[:40],
+            'durability':{'mode':persistence['mode'],
+                'strict_no_reset_mode':persistence['strict_no_reset_mode'],
+                'zero_loss_restart_guaranteed':False,
+                'note':'Durability depends on the configured database and recovery policy; this read model does not certify zero-loss restarts.'},
+            'policy':'Prospective registration only. Markets remain separate. Sample evidence has no production-promotion authority. Confidence is heuristic. Competitor superiority is unverified.'}
+
+    def _call(self,record,source,positions,now):
+        blockers,stamp,ttl=provenance(record)
+        if utc(record.registered_at)>now: blockers.append('FUTURE_REGISTRATION')
+        frozen=mapping(record.manifest_json)
+        if digest(frozen)!=record.manifest_sha256: blockers.append('REGISTRY_INTEGRITY_FAILED')
+        if source is None: blockers.append('SOURCE_MISSING')
+        elif digest(manifest(source))!=record.manifest_sha256: blockers.append('SOURCE_CHANGED')
+        position=positions[0] if len(positions)==1 else None
+        if len(positions)>1: blockers.append('AMBIGUOUS_POSITION')
+        trade=source if record.source_type=='paper' else position
+        status=str(getattr(trade,'status',None) or getattr(source,'status','MISSING')).upper()
+        closed_at=utc(getattr(trade,'closed_at',None))
+        entry=number(getattr(trade,'entry_price',None))
+        exit_price=number(getattr(trade,'exit_price',None))
+        opened=utc(getattr(trade,'opened_at',None))
+        side=normalize_side(frozen.get('direction'))
+        inputs=mapping(frozen.get('inputs'))
+        plan=mapping(inputs.get('trade_plan')) or mapping(frozen.get('proposal'))
+        stop=number(plan.get('stop_price') or plan.get('stop_loss') or plan.get('invalidation_level') or plan.get('stop'))
+        target=number(plan.get('target_1') or plan.get('target'))
+        planned_entry=number(plan.get('entry_price') or plan.get('entry') or mapping(inputs.get('price_context')).get('latest_price'))
+        try:
+            validate_trade_plan(side,entry=planned_entry,stop=stop,targets=[target])
+        except (ValueError,TypeError):
+            blockers.append('INVALID_PLAN')
+        net_r=number(getattr(trade,'r_multiple',None) if record.source_type=='paper' else getattr(trade,'realized_r',None))
+        contract=mapping(getattr(trade,'contract_json',None)) if record.source_type=='forex' else {}
+        notional=number(getattr(trade,'notional_value',None) if record.source_type=='paper' else contract.get('notional_value'))
+        net=number(getattr(trade,'net_pnl_eur',None) if record.source_type=='paper' else getattr(trade,'net_pnl',None))
+        gross=number(getattr(trade,'gross_pnl_eur',None) if record.source_type=='paper' else getattr(trade,'gross_pnl',None))
+        cost_fields=('spread_cost','slippage_cost','commission_cost') if record.source_type=='paper' else ('spread_cost','slippage_cost','commission','swap_accrued')
+        parts=[number(getattr(trade,k,None)) for k in cost_fields]
+        costs=(sum(parts) if record.source_type=='paper' else sum(parts[:3])-parts[3]) if all(v is not None for v in parts) else None
+        stored_cost=number(getattr(trade,'costs_paid',None)) if record.source_type=='paper' else costs
+        benchmark=number(getattr(trade,'benchmark_return_same_period',None)) if record.source_type=='paper' else None
+        outcome='PENDING'
+        realized=False
+        paired=None
+        net_return=None
+        if status=='CLOSED':
+            outcome='CLOSED'
+            quantity=number(getattr(trade,'position_size',None) if record.source_type=='paper' else getattr(trade,'quantity_lots',None))
+            if quantity is None or quantity<=0: blockers.append('MISSING_FILL')
+            if closed_at is None or closed_at>now or opened is None or opened<utc(record.decision_at) or closed_at<=opened or closed_at<=utc(record.registered_at): blockers.append('NON_CAUSAL_OUTCOME')
+            if entry is None or exit_price is None or entry<=0 or exit_price<=0 or side is None or net is None or gross is None or costs is None or stored_cost is None:
+                blockers.append('INVALID_ACCOUNTING')
+            elif any(value<0 for value in parts[:3]): blockers.append('INVALID_ACCOUNTING')
+            elif not math.isclose(gross-net,costs,rel_tol=1e-6,abs_tol=1e-5) or not math.isclose(costs,stored_cost,rel_tol=1e-6,abs_tol=1e-5): blockers.append('COST_RECONCILIATION_FAILED')
+            if record.source_type=='paper' and source is not None and not paper_trade_evidence_is_eligible(source): blockers.append('INVALID_ACCOUNTING')
+            realized=not blockers
+            if realized and notional is not None and notional>0:
+                holding=(exit_price/entry-1)*(1 if side=='LONG' else -1)
+                if math.isclose(gross,holding*notional,rel_tol=1e-4,abs_tol=1e-5):
+                    net_return=net/notional*100
+                    paired=net_return-benchmark if benchmark is not None else None
+                else: blockers.append('NOTIONAL_RETURN_MISMATCH')
+            if realized and paired is None: blockers.append('MISSING_PAIRED_BENCHMARK')
+        elif status in {'EXPIRED','INVALIDATED','REJECTED','SKIPPED','BLOCKED','NO_TRADE'}:
+            outcome='NO_FILL'
+        else:
+            if stamp is not None and (now-stamp).total_seconds()>ttl: blockers.append('QUOTE_STALE_NOW')
+        expected=number(frozen.get('expected_net_edge')) if record.source_type=='paper' else number(mapping(frozen.get('proposal')).get('expected_net_pips'))
+        if outcome=='PENDING' and expected is None: blockers.append('NO_STORED_EDGE_ESTIMATE')
+        return {'source_uid':record.source_uid,'market':record.market,'asset':record.asset,
+            'status':status,'outcome_status':outcome,'direction':side,'decision_at':record.decision_at.isoformat(),
+            'registered_at':record.registered_at.isoformat(),'source_revision':record.source_revision,
+            'source_content_hash':record.source_content_hash,
+            'input_sha256':record.manifest_sha256,'provider':mapping(inputs.get('quote')).get('source') if record.source_type=='forex' else mapping(inputs.get('price_context')).get('provider'),
+            'quote_at':stamp.isoformat() if stamp else None,'quote_age_seconds':max(0,(now-stamp).total_seconds()) if stamp else None,
+            'entry':entry,'stop':stop,'target':target,'model':frozen.get('model'),
+            'confidence':number((mapping(frozen.get('proposal')) or inputs).get('confidence')),
+            'confidence_semantics':'HEURISTIC_NOT_PROBABILITY','expected_net_edge':expected,
+            'edge_units':'bps' if record.source_type=='paper' else 'pips',
+            'qualified_closed':realized,'net_pnl':net if realized else None,'net_r':net_r if realized else None,
+            'net_return_percent':net_return,'paired_excess_percent':paired,'closed_at':closed_at.isoformat() if closed_at else None,
+            'active_eligible':outcome=='PENDING' and not blockers and expected is not None and expected>0,
+            'blockers':list(dict.fromkeys(blockers))}
+
+    @staticmethod
+    def _market(rows):
+        closed=[r for r in rows if r['qualified_closed']]
+        paired=[{'asset':r['asset'],'date':r['closed_at'][:10],'excess':r['paired_excess_percent']} for r in closed if r['paired_excess_percent'] is not None]
+        interval=paired_interval(paired)
+        active=sorted([r for r in rows if r['active_eligible']],key=lambda r:r['expected_net_edge'],reverse=True)[:10]
+        exclusions=Counter(b for r in rows for b in r['blockers'])
+        returns=[r['net_return_percent'] for r in closed if r['net_return_percent'] is not None]
+        return {'registered':len(rows),'qualified_closed':len(closed),'paired_sample':len(paired),
+            'observed_net_pnl':sum(r['net_pnl'] for r in closed) if closed else None,
+            'mean_net_return_percent':sum(returns)/len(returns) if returns else None,
+            'mean_paired_excess_percent':interval['mean'],'paired_interval':interval,
+            'verdict':'POSITIVE_PAIRED_SAMPLE' if interval['positive_sample'] else 'INSUFFICIENT_EVIDENCE',
+            'active_calls':active,'exclusions':dict(exclusions),'closed_coverage':{'assets':interval['assets'],'dates':interval['dates']}}

backend/app/services/forex_trader.py

@@ -523,6 +523,8 @@ class BlumForexTraderCore:
                 "finrlx_quant": quant_payload,
             }
             if not evaluation.approved:
+                from app.services.alpha_desk import AlphaCallRegistry
+                AlphaCallRegistry().register(db, decision)
                 rejected.append({"pair": market.pair, "blockers": list(evaluation.blockers)})
                 blockers.extend(evaluation.blockers)
                 continue
@@ -532,6 +534,8 @@ class BlumForexTraderCore:
             if not risk.decision.startswith("APPROVE"):
                 decision.status = "REJECTED"
                 decision.blockers = list(risk.blockers)
+                from app.services.alpha_desk import AlphaCallRegistry
+                AlphaCallRegistry().register(db, decision)
                 rejected.append({"pair": market.pair, "blockers": list(risk.blockers)})
                 blockers.extend(risk.blockers)
                 evidence = self.learning.record_outcome(db, decision_id=decision.id, outcome="RISK_BLOCK_CORRECT", payload={
@@ -544,6 +548,8 @@ class BlumForexTraderCore:
                 if evidence:
                     learning_events.append(evidence.outcome)
                 continue
+            from app.services.alpha_desk import AlphaCallRegistry
+            AlphaCallRegistry().register(db, decision)
             request = ForexOrderRequest.from_proposal(
                 evaluation.proposal,
                 quantity_lots=risk.quantity_lots,

backend/app/services/live_forward_paper_trading.py

@@ -113,6 +113,17 @@ class LiveForwardPaperTradingService(_TradingLabLiveForwardService):
         game = self.active_or_create_live_game(db)
         now = datetime.utcnow()
         ticker = normalize_text(decision_payload.get("ticker")).upper()
+        context = dict(decision_payload.get("price_context") or {})
+        if not context.get("provider") or not context.get("available_at"):
+            asset = db.scalar(select(Asset).where(Asset.ticker == ticker).limit(1))
+            if asset is not None:
+                latest = db.scalar(select(PriceHistory).where(PriceHistory.asset_id == asset.id)
+                    .order_by(desc(PriceHistory.date)).limit(1))
+                if (latest is not None and latest.created_at is not None and latest.created_at <= now
+                    and context.get("latest_date") == latest.date.isoformat()
+                    and safe_float(context.get("latest_price"), None) == float(latest.close)):
+                    context.update(provider=latest.provider, available_at=latest.created_at.isoformat(), source_price_id=latest.id)
+                    decision_payload = {**decision_payload, "price_context": context}
         plan = decision_payload.get("trade_plan") or {}
         setup_type = normalize_text((decision_payload.get("setup") or {}).get("setup_type")) or "unknown_setup"
         entry_trigger = normalize_text(plan.get("entry_trigger") or plan.get("confirmation_condition")) or "live_forward_candidate"
@@ -357,6 +368,8 @@ class LiveForwardPaperTradingService(_TradingLabLiveForwardService):
             self.append_event(db, trade.id, "DATA_BLOCKED", block_reason, payload={"price_context": decision_payload.get("price_context"), "actionability_diagnosis": diagnosis_payload})
         elif status in {"SKIPPED", "WAITING_FOR_TRIGGER"}:
             self.append_event(db, trade.id, "ACTIONABILITY_REJECTED", block_reason, payload={**actionability_event_payload(decision_payload, diagnosis, feedback), "classification": decision_payload_with_diagnosis["paper_forward_classification"]}, price_used=price if price > 0 else None)
+        from app.services.alpha_desk import AlphaCallRegistry
+        AlphaCallRegistry().register(db, trade)
         return trade
 
     def append_event(
@@ -2485,6 +2498,9 @@ def latest_price_context_for_asset(db: Session, asset: Asset, *, data_quality_sc
     return {
         "latest_price": safe_float(latest.close, None) if latest else None,
         "latest_date": latest.date.isoformat() if latest and latest.date else None,
+        "provider": latest.provider if latest else None,
+        "available_at": latest.created_at.isoformat() if latest and latest.created_at else None,
+        "source_price_id": latest.id if latest else None,
         "latest_volume": safe_float(latest.volume, None) if latest else None,
         "rows": rows,
         "data_quality_score": safe_float(data_quality_score, 0.0),

backend/tests/test_alpha_desk.py

@@ -0,0 +1,379 @@
+from datetime import datetime, timedelta
+
+import pytest
+from sqlalchemy import create_engine, select
+from sqlalchemy.orm import Session
+from sqlalchemy.pool import StaticPool
+
+from app.core.database import Base
+from app.models import LiveForwardPaperGame, LiveForwardPaperTrade
+
+NOW = datetime(2026, 10, 13, 12)
+
+
+@pytest.fixture
+def db():
+    engine = create_engine('sqlite:///:memory:',connect_args={'check_same_thread':False},poolclass=StaticPool)
+    Base.metadata.create_all(engine)
+    with Session(engine) as session:
+        yield session
+    engine.dispose()
+
+
+def paper(db, *, uid='one', ticker='SPY', market='equity'):
+    game = db.scalar(select(LiveForwardPaperGame))
+    if game is None:
+        game = LiveForwardPaperGame(game_id='desk-test')
+        db.add(game)
+        db.flush()
+    row = LiveForwardPaperTrade(
+        game_id=game.id, trade_uid=uid, duplicate_key=uid, ticker=ticker,
+        setup_type='trend', model_version_used='baseline', side='LONG',
+        market=market, status='OPEN', decision_timestamp=NOW,
+        opened_at=NOW + timedelta(minutes=1), entry_price=100, position_size=1,
+        stop_loss=95, target_1=110, confidence=65, notional_value=100,
+        accounting_status='VALID', accounting_version='paper-forward-direction-v2',
+        evidence_type='PAPER_FORWARD', benchmark_ticker='SPY',
+        frozen_decision_payload={'confidence':65, 'side':'LONG',
+            'trade_plan':{'entry_price':100, 'stop_price':95, 'target_1':110},
+            'price_context':{'provider':'test-market-feed', 'latest_date':NOW.date().isoformat(),
+                'available_at':(NOW-timedelta(minutes=1)).isoformat(),
+                'latest_price':100, 'data_quality_score':90}},
+    )
+    db.add(row)
+    db.flush()
+    return row
+
+
+def close(row, *, benchmark=3, net=9):
+    row.status='CLOSED'
+    row.closed_at=NOW+timedelta(days=1)
+    row.exit_price=110
+    row.gross_pnl_eur=10
+    row.net_pnl_eur=net
+    row.costs_paid=1
+    row.commission_cost=1
+    row.r_multiple=1.8
+    row.benchmark_return_same_period=benchmark
+
+
+def register(db, row):
+    from app.services.alpha_desk import AlphaCallRegistry
+    return AlphaCallRegistry().register(db,row,registered_at=NOW+timedelta(seconds=1))
+
+
+def snapshot(db):
+    from app.services.alpha_desk import AlphaDeskService
+    db.flush()
+    return AlphaDeskService().snapshot(db,now=NOW+timedelta(days=2))
+
+
+def test_registration_is_idempotent_and_refuses_changed_frozen_inputs(db):
+    row=paper(db)
+    original=register(db,row)
+    assert register(db,row).id==original.id
+    row.frozen_decision_payload={**row.frozen_decision_payload,'confidence':99}
+    with pytest.raises(ValueError,match='CHANGED'):
+        register(db,row)
+
+
+def test_closed_legacy_call_cannot_be_registered_prospectively(db):
+    from app.services.alpha_desk import AlphaCallRegistry
+    row=paper(db)
+    close(row)
+    with pytest.raises(ValueError,match='RETROSPECTIVE'):
+        AlphaCallRegistry().register(db,row,registered_at=NOW+timedelta(days=2))
+    assert snapshot(db)['markets']['equity']['qualified_closed']==0
+
+
+def test_paired_alpha_uses_cost_adjusted_holding_return(db):
+    row=paper(db)
+    register(db,row)
+    close(row)
+    payload=snapshot(db)
+    equity=payload['markets']['equity']
+    assert equity['qualified_closed']==1
+    assert equity['paired_sample']==1
+    assert equity['mean_net_return_percent']==9
+    assert equity['mean_paired_excess_percent']==6
+    assert equity['verdict']=='INSUFFICIENT_EVIDENCE'
+    assert payload['journal'][0]['confidence_semantics']=='HEURISTIC_NOT_PROBABILITY'
+
+
+@pytest.mark.parametrize('failure,expected',[
+    ('future','FUTURE_INPUT'),('stale','STALE_AT_DECISION'),
+    ('provider','MISSING_PROVENANCE'),('mutated','SOURCE_CHANGED'),
+    ('cost','COST_RECONCILIATION_FAILED'),('nan','INVALID_ACCOUNTING'),
+])
+def test_invalid_evidence_stays_visible_and_cannot_raise_sample(db,failure,expected):
+    row=paper(db)
+    context=row.frozen_decision_payload['price_context']
+    if failure=='future': context['available_at']=(NOW+timedelta(hours=1)).isoformat()
+    if failure=='stale': context['latest_date']=(NOW-timedelta(days=10)).date().isoformat()
+    if failure=='provider': context.pop('provider')
+    register(db,row)
+    close(row)
+    if failure=='mutated': row.frozen_decision_payload={**row.frozen_decision_payload,'confidence':99}
+    if failure=='cost': row.net_pnl_eur=20
+    if failure=='nan': row.costs_paid=float('inf')
+    payload=snapshot(db)
+    assert payload['markets']['equity']['qualified_closed']==0
+    assert expected in payload['journal'][0]['blockers']
+
+
+def test_missing_benchmark_and_inconsistent_notional_do_not_become_zero_alpha(db):
+    row=paper(db)
+    register(db,row)
+    close(row,benchmark=None)
+    payload=snapshot(db)
+    assert payload['markets']['equity']['qualified_closed']==1
+    assert payload['markets']['equity']['paired_sample']==0
+    assert payload['markets']['equity']['mean_paired_excess_percent'] is None
+    row.benchmark_return_same_period=3
+    row.notional_value=1000
+    assert snapshot(db)['markets']['equity']['paired_sample']==0
+
+
+def test_unfilled_orders_never_contribute_realized_pnl(db):
+    row=paper(db)
+    register(db,row)
+    row.status='EXPIRED'
+    row.net_pnl_eur=500
+    row.closed_at=NOW+timedelta(days=1)
+    payload=snapshot(db)
+    assert payload['markets']['equity']['qualified_closed']==0
+    assert payload['markets']['equity']['observed_net_pnl'] is None
+    assert payload['journal'][0]['outcome_status']=='NO_FILL'
+
+
+def test_forex_and_equity_samples_are_not_pooled(db):
+    equity=paper(db,uid='eq')
+    forex=paper(db,uid='fx',ticker='EURUSD=X',market='forex')
+    register(db,equity)
+    register(db,forex)
+    close(equity)
+    close(forex,net=-10)
+    payload=snapshot(db)
+    assert payload['markets']['equity']['qualified_closed']==1
+    assert payload['markets']['forex']['qualified_closed']==0
+    assert 'pooled_alpha' not in payload
+
+
+def test_reading_desk_does_not_register_legacy_calls_or_write_rows(db):
+    row=paper(db)
+    db.commit()
+    first=snapshot(db)
+    second=snapshot(db)
+    assert first['registered_count']==second['registered_count']==0
+    assert db.get(LiveForwardPaperTrade,row.id).status=='OPEN'
+    assert not db.new and not db.dirty and not db.deleted
+
+
+def test_date_cluster_interval_requires_breadth_and_reports_literal_positive_mean():
+    from app.services.alpha_desk import paired_interval
+    rows=[{'date':f'2026-01-{i%30+1:02d}','asset':str(i%3),'excess':2.0} for i in range(120)]
+    result=paired_interval(rows)
+    assert result['mean']==result['lower_95']==result['upper_95']==2
+    assert result['observations']==120 and result['dates']==30 and result['assets']==3
+    assert result['positive_sample'] is True
+    assert paired_interval(rows[:20])['positive_sample'] is False
+    assert paired_interval([{**row,'date':'2026-01-01'} for row in rows])['positive_sample'] is False
+
+
+def test_active_call_with_invalid_geometry_is_not_ranked(db):
+    row=paper(db)
+    row.net_expectancy_bps=50
+    row.frozen_decision_payload['trade_plan']['stop_price']=105
+    register(db,row)
+    from app.services.alpha_desk import AlphaDeskService
+    result=AlphaDeskService().snapshot(db,now=NOW+timedelta(seconds=2))
+    assert result['markets']['equity']['active_calls']==[]
+    assert 'INVALID_PLAN' in result['journal'][0]['blockers']
+
+
+def test_paper_candidate_creator_registers_original_inputs_before_any_outcome(db):
+    from app.models import AlphaCallRegistration
+    from app.services.live_forward_paper_trading import LiveForwardPaperTradingService
+    candidate={'ticker':'SPY','side':'LONG','asset':{'asset_type':'etf'},
+        'setup':{'setup_type':'test'},'confidence':70,'trade_plan':{'stop_price':95,'target_1':110},
+        'price_context':{'latest_price':100,'latest_date':NOW.date().isoformat(),'rows':100,'data_quality_score':90}}
+    row=LiveForwardPaperTradingService().create_candidate(db,candidate)
+    record=db.scalar(select(AlphaCallRegistration).where(AlphaCallRegistration.source_id==row.id))
+    assert record is not None
+    assert record.manifest_json['inputs']['price_context']['latest_price']==100
+    assert record.registered_at>=record.decision_at
+    assert row.closed_at is None
+
+
+def test_alpha_includes_older_closed_trades_and_deduplicates_live_evidence(db):
+    from app.services.trader_brain import TraderBrainService
+    row=paper(db,uid='older')
+    close(row)
+    row.created_at=NOW-timedelta(days=20)
+    for i in range(501):
+        newer=paper(db,uid=f'no-fill-{i}')
+        newer.created_at=NOW+timedelta(seconds=i)
+        newer.status='EXPIRED'
+    db.commit()
+    payload=TraderBrainService().alpha(db)
+    assert payload['evidence_split']['paper_forward']['closed_trade_count']==1
+    assert payload['total_evidence_sample_size']==1
+
+
+def test_positive_historical_rows_without_provenance_are_not_strong_evidence():
+    from app.engine.brain.trader_brain import trading_game_evidence_split
+    from app.models import TradingGameTrade
+    rows=[TradingGameTrade(ticker='SPY',net_pnl_eur=10,realized_r_multiple=2,
+        pnl_percent=10,benchmark_return_same_period=2,outcome_label='win') for _ in range(120)]
+    result=trading_game_evidence_split(rows,label='Historical Replay',data_source='trading_game_trades')
+    assert result['evidence_grade']=='INSUFFICIENT_EVIDENCE'
+    assert result['provenance_status']=='UNVERIFIED_LEGACY'
+
+
+def test_desk_api_is_read_only_and_does_not_register_a_legacy_row(db):
+    from fastapi.testclient import TestClient
+    from app.main import app
+    from app.core.database import get_db
+    row=paper(db)
+    db.commit()
+    def dependency():
+        yield db
+    app.dependency_overrides[get_db]=dependency
+    try:
+        client=TestClient(app)
+        response=client.get('/api/alpha/desk')
+        assert response.status_code==200
+        assert response.json()['registered_count']==0
+        assert client.post('/api/alpha/desk',json={}).status_code==405
+        assert db.get(LiveForwardPaperTrade,row.id).status=='OPEN'
+    finally:
+        app.dependency_overrides.clear()
+
+
+def forex_source(db):
+    from app.models import ForexDecision,ForexTraderCycle,ForexPosition
+    cycle=ForexTraderCycle(cycle_uid='fx-test',cycle_key='fx-test',configuration_hash='test-config',
+        data_coverage_hash='test-input',code_commit='test-revision')
+    db.add(cycle)
+    db.flush()
+    row=ForexDecision(cycle_id=cycle.id,decision_uid='fx-test-call',pair='EURUSD=X',
+        strategy_id='frozen-baseline',status='APPROVED',direction='LONG',decision_timestamp=NOW,
+        input_snapshot={'as_of':NOW.isoformat(),'quote':{'bid':1.1,'ask':1.101,
+            'timestamp':(NOW-timedelta(seconds=10)).isoformat(),'source':'market-feed'},
+            'timeframes':{'1m':{'market_timestamp':(NOW-timedelta(seconds=20)).isoformat(),
+                'acquired_at':(NOW-timedelta(seconds=10)).isoformat(),'provider':'market-feed','quality_score':90}}},
+        proposal_json={'entry':1.1,'stop':1.09,'target':1.12,'confidence':0.6,'expected_net_pips':30})
+    db.add(row)
+    db.flush()
+    position=ForexPosition(position_uid='fx-test-position',decision_id=row.id,pair=row.pair,
+        strategy_id=row.strategy_id,direction='LONG',quantity_lots=0.001,entry_price=1.1,
+        stop_price=1.09,target_price=1.12,current_price=1.1,opened_at=NOW+timedelta(seconds=2),
+        contract_json={'account_fx_rate':1.0,'fx_rate_source':'IDENTITY'})
+    db.add(position)
+    db.flush()
+    return row,position
+
+
+def test_native_forex_swap_credit_is_income_and_never_pooled_with_equity(db):
+    row,position=forex_source(db)
+    register(db,row)
+    position.status='CLOSED'
+    position.closed_at=NOW+timedelta(hours=1)
+    position.exit_price=1.12
+    position.gross_pnl=2
+    position.spread_cost=0.4
+    position.slippage_cost=0.3
+    position.commission=0.3
+    position.swap_accrued=0.5
+    position.net_pnl=1.5
+    result=snapshot(db)
+    assert result['markets']['forex']['qualified_closed']==1
+    assert result['markets']['forex']['observed_net_pnl']==1.5
+    assert result['markets']['forex']['paired_sample']==0
+    assert result['markets']['equity']['qualified_closed']==0
+
+
+@pytest.mark.parametrize('native_forex', [False, True])
+def test_closed_record_without_positive_fill_is_unqualified(db,native_forex):
+    if native_forex:
+        row,position=forex_source(db)
+        register(db,row)
+        position.status='CLOSED'
+        position.closed_at=NOW+timedelta(hours=1)
+        position.exit_price=1.12
+        position.quantity_lots=0
+    else:
+        row=paper(db)
+        register(db,row)
+        close(row)
+        row.position_size=0
+    payload=snapshot(db)
+    market='forex' if native_forex else 'equity'
+    assert payload['markets'][market]['qualified_closed']==0
+    assert 'MISSING_FILL' in payload['journal'][0]['blockers']
+
+
+def test_completed_forex_position_cannot_be_retroactively_registered(db):
+    from app.services.alpha_desk import AlphaCallRegistry
+    row,position=forex_source(db)
+    position.status='CLOSED'
+    position.closed_at=NOW+timedelta(hours=1)
+    db.flush()
+    with pytest.raises(ValueError,match='RETROSPECTIVE'):
+        AlphaCallRegistry().register(db,row,registered_at=NOW+timedelta(days=1))
+
+
+def test_unavailable_quality_and_delayed_registration_block_forward_qualification(db):
+    row=paper(db)
+    row.frozen_decision_payload['price_context']['data_quality_score']=10
+    from app.services.alpha_desk import AlphaCallRegistry
+    AlphaCallRegistry().register(db,row,registered_at=NOW+timedelta(hours=1))
+    close(row)
+    result=snapshot(db)
+    assert result['markets']['equity']['qualified_closed']==0
+    assert 'LOW_DATA_QUALITY' in result['journal'][0]['blockers']
+    assert 'REGISTRATION_DELAY' in result['journal'][0]['blockers']
+
+
+def test_candidate_freezes_matching_database_price_provenance(db):
+    from app.models import Asset,PriceHistory
+    from app.services.live_forward_paper_trading import LiveForwardPaperTradingService
+    now=datetime.utcnow()
+    asset=Asset(ticker='SPY',name='SPY',category='ETF',sector='equity',country='US',asset_type='ETF')
+    db.add(asset)
+    db.flush()
+    price=PriceHistory(asset_id=asset.id,date=now.date()-timedelta(days=1),open=99,high=101,low=98,
+        close=100,volume=1000000,provider='stooq',created_at=now-timedelta(hours=1))
+    db.add(price)
+    db.flush()
+    candidate={'ticker':'SPY','side':'LONG','asset':{'asset_type':'ETF'},'setup':{'setup_type':'trend'},
+        'confidence':70,'trade_plan':{'stop_price':95,'target_1':110},
+        'price_context':{'latest_price':100,'latest_date':price.date.isoformat(),'data_quality_score':90,'rows':100}}
+    row=LiveForwardPaperTradingService().create_candidate(db,candidate)
+    context=row.frozen_decision_payload['price_context']
+    assert context['provider']=='stooq'
+    assert context['source_price_id']==price.id
+    assert context['available_at']==price.created_at.isoformat()
+
+
+@pytest.mark.parametrize('failure',['inputs','context','provider','quality','frames','empty_frames'])
+def test_invalid_source_shapes_stay_visible_without_qualifying_or_breaking_reads(db,failure):
+    native=failure in {'frames','empty_frames'}
+    if native:
+        row,position=forex_source(db)
+        row.input_snapshot['timeframes']=['malformed'] if failure=='frames' else {}
+        register(db,row)
+        position.status='CLOSED'
+        position.closed_at=NOW+timedelta(hours=1)
+        position.exit_price=1.12
+    else:
+        row=paper(db)
+        if failure=='inputs': row.frozen_decision_payload=['malformed']
+        if failure=='context': row.frozen_decision_payload['price_context']=['malformed']
+        if failure=='provider': row.frozen_decision_payload['price_context']['provider']={'not':'a name'}
+        if failure=='quality': row.frozen_decision_payload['price_context']['data_quality_score']=1000
+        register(db,row)
+        close(row)
+    result=snapshot(db)
+    assert result['markets']['forex' if native else 'equity']['qualified_closed']==0
+    assert result['journal'][0]['blockers']

backend/tests/test_migration_chain.py

@@ -88,6 +88,7 @@ def test_full_migration_chain_reaches_head_on_sqlite(tmp_path):
         "ascent_generations",
         "ascent_experiments",
         "ascent_evidence_use",
+        "alpha_call_registrations",
     }
 
     assert required_tables.issubset(tables)
@@ -102,7 +103,7 @@ def test_full_migration_chain_reaches_head_on_sqlite(tmp_path):
         "accounting_recomputed_at",
     }.issubset(paper_trade_columns)
     with engine.connect() as connection:
-        assert connection.execute(text("select version_num from alembic_version")).scalar_one() == "0044_ascent_evolution"
+        assert connection.execute(text("select version_num from alembic_version")).scalar_one() == "0045_alpha_call_registry"
 
     downgrade = subprocess.run(
         [sys.executable, "-m", "alembic", "downgrade", "base"],

backend/tests/test_release_content_hash.py

@@ -0,0 +1,30 @@
+from pathlib import Path
+
+
+def test_release_hash_detects_protected_code_changes_and_ignores_generated_revision(tmp_path):
+    from app.core.release import content_hash_for_root
+    source=tmp_path/'backend/app/core'
+    source.mkdir(parents=True)
+    file=source/'example.py'
+    file.write_text('value = 1\n')
+    scripts=tmp_path/'scripts'
+    scripts.mkdir()
+    script=scripts/'start.sh'
+    script.write_text('exit 0\n')
+    original=content_hash_for_root(tmp_path)
+    (source/'build_revision.json').write_text('{"source_revision":"changed"}')
+    assert content_hash_for_root(tmp_path)==original
+    file.write_text('value = 2\n')
+    changed=content_hash_for_root(tmp_path)
+    assert changed!=original
+    script.write_text('exit 1\n')
+    assert content_hash_for_root(tmp_path)!=changed
+
+
+def test_identical_release_code_has_same_hash_across_checkout_paths(tmp_path):
+    from app.core.release import content_hash_for_root
+    for name in ['first','second']:
+        file=tmp_path/name/'backend/app/example.py'
+        file.parent.mkdir(parents=True)
+        file.write_text('identical protected source\n')
+    assert content_hash_for_root(tmp_path/'first')==content_hash_for_root(tmp_path/'second')

backend/tests/test_restore_failure_guard.py

@@ -0,0 +1,56 @@
+"""Run the actual startup script against failed restore tools and an isolated backup."""
+import os
+from pathlib import Path
+import subprocess
+
+
+def test_failed_logical_restore_does_not_run_migrations_or_destroy_the_backup(tmp_path):
+    fake=tmp_path/'bin'
+    fake.mkdir()
+    tools={'service':'exit 0', 'python3':'exit 0',
+        'su':'case "$*" in *pg_restore*) exit 21;; *information_schema.tables*) echo 0;; *) exit 0;; esac'}
+    for name,body in tools.items():
+        path=fake/name
+        path.write_text('#!/bin/sh\n'+body+'\n')
+        path.chmod(0o700)
+    persistence=tmp_path/'data'
+    persistence.mkdir()
+    backup=persistence/'embedded_postgres_blum.dump'
+    backup.write_bytes(b'failed-test-backup-kept-for-recovery')
+    env={**os.environ,'PATH':str(fake)+':/usr/bin:/bin','DATABASE_URL':'',
+        'BLUM_PERSIST_DIR':str(persistence),'BLUM_LOCAL_POSTGRES_DATA_DIR':str(tmp_path/'local-postgres')}
+    script=Path(__file__).parents[2]/'scripts/start.sh'
+    result=subprocess.run(['/bin/bash',str(script)],env=env,capture_output=True,text=True,timeout=15)
+    assert result.returncode!=0
+    assert 'Applying Alembic migrations' not in result.stdout
+    assert 'Refusing startup' in result.stdout
+    assert backup.read_bytes()==b'failed-test-backup-kept-for-recovery'
+    # A partial restore may have created tables. A container retry must still fail.
+    (fake/'su').write_text('#!/bin/sh\ncase "$*" in *information_schema.tables*) echo 45;; *) exit 0;; esac\n')
+    retry=subprocess.run(['/bin/bash',str(script)],env=env,capture_output=True,text=True,timeout=15)
+    assert 'Applying Alembic migrations' not in retry.stdout
+    assert 'incomplete restore' in retry.stdout
+
+
+def test_unusable_physical_backup_without_logical_recovery_refuses_empty_startup(tmp_path):
+    fake=tmp_path/'bin'
+    fake.mkdir()
+    for name,body in {'service':'exit 0','python3':'exit 0','pg_dropcluster':'exit 0',
+        'pg_createcluster':'exit 0','su':'case "$*" in *information_schema.tables*) echo 0;; *) exit 0;; esac'}.items():
+        path=fake/name
+        path.write_text('#!/bin/sh\n'+body+'\n')
+        path.chmod(0o700)
+    persistence=tmp_path/'data'
+    physical=persistence/'embedded_postgres_physical'
+    physical.mkdir(parents=True)
+    (physical/'ready').touch()
+    (physical/'base.tar.gz').write_bytes(b'invalid recovery archive')
+    local=tmp_path/'local-postgres'
+    local.mkdir()
+    env={**os.environ,'PATH':str(fake)+':/usr/bin:/bin','DATABASE_URL':'',
+        'BLUM_PERSIST_DIR':str(persistence),'BLUM_LOCAL_POSTGRES_DATA_DIR':str(local)}
+    script=Path(__file__).parents[2]/'scripts/start.sh'
+    result=subprocess.run(['/bin/bash',str(script)],env=env,capture_output=True,text=True,timeout=15)
+    assert result.returncode!=0
+    assert 'Applying Alembic migrations' not in result.stdout
+    assert 'Refusing startup' in result.stdout

backend/tests/test_space_startup.py

@@ -28,7 +28,7 @@ def test_embedded_postgres_restore_supports_custom_and_bootstrap_fallbacks() ->
     assert 'embedded_postgres_blum.sql"' in source
     assert 'Restoring legacy PostgreSQL backup' in source
     assert "BLUM_LEGACY_POSTGRES_BACKUP_FILE" in source
-    assert 'su postgres -c "psql -d blum" < "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}"' in source
+    assert 'su postgres -c "psql -v ON_ERROR_STOP=1 -d blum" < "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}"' in source
     assert 'psql -d blum < \\"${BLUM_LEGACY_POSTGRES_BACKUP_FILE}\\"' not in source
 
 

backend/tests/test_trading_ml_persistence.py

@@ -174,4 +174,4 @@ def test_trading_ml_settings_have_evidence_bound_defaults():
 
 
 def test_migration_head_includes_ascent_after_evidence_decision_council():
-    assert migration_head() == "0044_ascent_evolution"
+    assert migration_head() == "0045_alpha_call_registry"

cloudflare/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "blum-cloudflare",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "blum-cloudflare",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "devDependencies": {
         "typescript": "7.0.2",
         "wrangler": "4.149.0"

cloudflare/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blum-cloudflare",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "private": true,
   "type": "module",
   "scripts": {

cloudflare/src/index.ts

@@ -107,8 +107,10 @@ async function releaseStatus(request: Request, env: Env): Promise<Response> {
     proxy(probe, env, '/api/runtime/release').then(boundedJSON)
   ]);
   const ready = startup?.api_ready === true && startup?.ui_ready === true && !startup?.last_error
-    && release?.source_revision === env.SOURCE_REVISION && release?.version === '2.2.0';
-  return json(env, {version: '2.2.0', source_revision: env.SOURCE_REVISION,
+    && release?.source_revision === env.SOURCE_REVISION && release?.version === '2.3.0'
+    && /^[0-9a-f]{64}$/.test(env.SOURCE_CONTENT_HASH) && release?.source_content_hash === env.SOURCE_CONTENT_HASH;
+  return json(env, {version: '2.3.0', source_revision: env.SOURCE_REVISION,
+    source_content_hash: release?.source_content_hash ?? null,
     worker_version: env.CF_VERSION_METADATA.id, backend_ready: ready,
     backend_source_revision:release?.source_revision ?? null,
     backend_version:release?.version ?? null,

cloudflare/tests/gateway.test.mjs

@@ -4,6 +4,7 @@ import worker from '../src/index.ts';
 
 const env = {
   BACKEND_ORIGIN: 'https://italianhype-blum.hf.space', SOURCE_REVISION: 'a'.repeat(40),
+  SOURCE_CONTENT_HASH: 'c'.repeat(64),
   CF_VERSION_METADATA: {id:'version'},
   ASSETS: {fetch: async () => new Response('<html>BLUM</html>', {headers:{'Content-Type':'text/html'}})}
 };
@@ -86,13 +87,17 @@ test('every backend truthy persistence alias is denied', async t => {
     assert.equal(r.status,400);
   }
 });
-test('release GET and HEAD require the exact backend revision', async t => {
+test('release GET and HEAD require the exact backend revision and source content', async t => {
   let revision = 'a'.repeat(40);
+  let content = 'c'.repeat(64);
   t.mock.method(globalThis,'fetch',async url => new Response(JSON.stringify(String(url).endsWith('/startup/status')
-    ? {api_ready:true,ui_ready:true,last_error:''} : {version:'2.2.0',source_revision:revision}), {headers:{'Content-Type':'application/json'}}));
+    ? {api_ready:true,ui_ready:true,last_error:''} : {version:'2.3.0',source_revision:revision,source_content_hash:content}), {headers:{'Content-Type':'application/json'}}));
   assert.equal((await worker.fetch(new Request('https://blum.example/api/release'),env)).status,200);
   const head = await worker.fetch(new Request('https://blum.example/api/release',{method:'HEAD'}),env);
   assert.equal(head.status,200); assert.equal(await head.text(),'');
+  content = 'd'.repeat(64);
+  assert.equal((await worker.fetch(new Request('https://blum.example/api/release'),env)).status,503);
+  content = 'c'.repeat(64);
   revision = 'b'.repeat(40);
   assert.equal((await worker.fetch(new Request('https://blum.example/api/release'),env)).status,503);
 });

cloudflare/wrangler.jsonc

@@ -15,7 +15,8 @@
   },
   "vars": {
     "BACKEND_ORIGIN": "https://italianhype-blum.hf.space",
-    "SOURCE_REVISION": "unavailable"
+    "SOURCE_REVISION": "unavailable",
+    "SOURCE_CONTENT_HASH": "unavailable"
   },
   "version_metadata": {"binding": "CF_VERSION_METADATA"},
   "observability": {"enabled": true, "head_sampling_rate": 0.1}

docs/ALPHA_DESK.md

@@ -0,0 +1,41 @@
+# Prospective Alpha Desk
+
+BLUM 2.3 records what its decision engines actually call before observing the outcome. The objective is a reproducible, cost-aware track record across equities/ETFs and Forex. Bloomberg product superiority and market-leading alpha are ambitions, not established results.
+
+## Registration
+
+New paper candidates and final Forex decisions register in the same transaction as their authoritative source records. A unique source identity prevents duplicate registration. The manifest freezes the decision, model/strategy, confidence and price inputs. Its SHA256, source revision and protected-code fingerprint preserve lineage. Changes to a registered manifest are rejected or shown as integrity blockers. Completed historical decisions cannot be retrospectively registered.
+
+The source engines retain order, risk and accounting authority. The registry is an audit record, not a second execution engine. It does not merge code or promote a model. Confidence is explicitly heuristic and is not advertised as a calibrated probability.
+
+## Qualification
+
+- Equity daily inputs may be at most 96 hours old at decision time. Forex inputs may be at most 180 seconds old.
+- A named provider and source/availability timestamps are required; future input timestamps fail. Available quality scores below 70 fail.
+- Registration delayed more than five minutes from the decision is unqualified. Current calls also need fresh quotes and an explicitly stored positive expected net edge.
+- Side and entry/stop/target geometry must be valid. A closed call requires actual opening and closing timestamps and registration before closure.
+- Net P/L must reconcile with gross P/L and recorded execution costs. Forex swap credits are income; debits are costs. Unfilled, rejected and expired orders never enter realized-performance samples.
+- Paired percentage alpha additionally needs a positive notional whose gross holding return matches recorded gross P/L, plus a finite same-period stored benchmark return. Missing or inconsistent values remain missing. Native Forex calls lacking the required notional/benchmark contract cannot produce paired alpha.
+
+These gates verify internal record consistency and declared source availability. They do not independently certify a provider's entire history, every model input, or all underlying database rows. A hash alone does not establish semantic validity. The prior data quarantines remain active.
+
+## Evaluation
+
+The service reads at most 2,000 recent registrations and reports truncation. Equity and Forex samples, exclusions and rankings are separate. Costs-qualified observations and paired benchmark observations have different counts. An absent P/L or benchmark displays as unavailable, not zero.
+
+A deterministic bootstrap resamples complete closure-date groups, with 800 draws and seed 3407. The interval is a two-sided 95% empirical interval. A positive paired-sample label requires 100 paired observations, 30 closure dates, three assets and a lower bound above zero. These are conservative application gates, not a universal statistical certification standard. The interval does not correct selection bias, repeated monitoring or every overlapping holding period; it never authorizes promotion.
+
+Irregular trade returns are not annualized into Sharpe ratios. Mean trade excursion is not represented as a portfolio equity-curve drawdown in this Desk. Legacy panels remain descriptive; positive historical grades without independently verified provenance are marked insufficient.
+
+## Operation and limits
+
+`GET /api/alpha/desk` and the existing Alpha snapshot read stored evidence. Page load cannot register calls, train weights or run orders. Public mutations remain blocked at Cloudflare and origin. Existing paid training stays disabled and all execution remains paper-only.
+
+The maintained Space uses embedded PostgreSQL and periodic object-storage backups. Registrations inherit that recovery policy; they are not a guarantee of zero-loss restart durability. Failed logical restores stop startup. External PostgreSQL with a verified durability/recovery configuration is required for stricter guarantees.
+
+The 2.3 registry starts empty. Legacy outcomes remain available, but cannot be counted as newly registered prospective calls. Qualification and independent forward performance must accumulate over real time.
+
+## Research references
+
+- [Bloomberg BQuant](https://professional.bloomberg.com/products/bloomberg-terminal/research/bquant/) describes Bloomberg's quantitative research platform; it supplies no public common test set establishing relative BLUM alpha.
+- [Bailey and López de Prado: The Deflated Sharpe Ratio](https://www.davidhbailey.com/dhbpapers/deflated-sharpe.pdf) explains selection bias and non-normality. BLUM does not label the Desk's bootstrap as DSR or as a multiple-testing correction.

docs/DEPLOYMENT.md

@@ -40,7 +40,8 @@ npm --prefix frontend run build
 npm ci --prefix cloudflare
 npm --prefix cloudflare run types
 npm --prefix cloudflare run typecheck
-npm --prefix cloudflare run deploy -- --var SOURCE_REVISION:$(git rev-parse HEAD)
+source_content_hash=$(PYTHONPATH=backend python -c 'from app.core.release import source_content_hash; print(source_content_hash())')
+npm --prefix cloudflare run deploy -- --var "SOURCE_REVISION:$(git rev-parse HEAD)" --var "SOURCE_CONTENT_HASH:$source_content_hash"
 ```
 
 Wrangler authentication is required for publication. A custom domain can be added later. This release does not alter unrelated DNS. Worker observability is enabled. Financial state is not stored in edge cache or a parallel Worker database.
@@ -55,7 +56,7 @@ curl -fsS https://italianhype-blum.hf.space/api/runtime/release
 curl -fsS https://blum.signallayerlabs.workers.dev/api/release
 ```
 
-Require api_ready=true, ui_ready=true, no startup last_error, and the exact GitHub source revision. HTML with HTTP200 is not API readiness. `scripts/verify_deployment.py` enforces this contract.
+Require api_ready=true, ui_ready=true, no startup last_error, and the exact GitHub source revision. The release API also reports source_content_hash, computed from protected backend and script files. The verifier compares it with the verified checkout, so changing a revision variable cannot make an older code image pass. HTML with HTTP200 is not API readiness. `scripts/verify_deployment.py` enforces this contract.
 
 The existing bucket stays attached. PostgreSQL remains on local disk; object storage holds physical recovery files and atomic logical backups. Embedded PostgreSQL supports one replica. Multiple replicas require an external database. Preserve recovery files and verify startup before declaring data recovery complete.
 
@@ -84,3 +85,7 @@ Keep BLUM_FOREX_HISTORY_ENABLED=false, BLUM_HF_TRAINING_ENABLED=false, BLUM_HF_T
 5. Additive migration 0044_ascent_evolution preserves existing data. Code rollback does not require dropping its tables or erasing evidence.
 
 Report outages and missing evidence explicitly. Do not fill unavailable charts or APIs with fabricated results.
+
+## Prospective call evidence
+
+New decisions register within their original database transactions. The read-only `/api/alpha/desk` never backfills legacy records or starts financial execution. Migration 0045 is additive. Source fingerprints establish recorded code content, not semantic data validity or model outperformance. See [Alpha Desk](ALPHA_DESK.md).

docs/superpowers/plans/2026-10-13-verified-alpha-desk.md

@@ -0,0 +1,65 @@
+# Verified Alpha Desk Implementation Plan
+
+> For agentic workers: use superpowers:executing-plans for native implementation and request an independent whole-branch review before merge.
+
+**Goal:** Release prospectively registered, provenance-aware alpha calls with independent equity and Forex evidence.
+
+**Architecture:** Existing decision engines retain authority. An additive registration table freezes a manifest before outcomes, and a bounded read service verifies it against source accounting. The existing Alpha page renders two market panels and the call journal.
+
+**Tech Stack:** Python/FastAPI, SQLAlchemy/Alembic/PostgreSQL, SQLite integration tests, Next.js/TypeScript, Cloudflare Workers.
+
+**Spec:** `docs/superpowers/specs/2026-10-13-verified-alpha-desk-design.md`
+
+## Global Constraints
+
+- Paper-only; no paid infrastructure or weight-training jobs.
+- At most 2,000 registered records per read; explicit window and exclusions.
+- Separate equity and Forex evaluations; no retrospective prospective registration.
+- Freshness: equities 96 hours, Forex 180 seconds. All sources available no later than decision.
+- Positive paired-sample verdict: 100 observations, 30 closure dates, three assets and positive 95% lower bound.
+- Confidence remains heuristic; no annualized Sharpe from irregular trades.
+
+## Review Focus
+
+- Repeated registration must preserve the original manifest even if source data later changes.
+- An unfilled order or non-finite cost must never become a winning realized trade.
+- A new source record with stale/future timestamps must remain visible but unqualified.
+- A missing benchmark or inconsistent notional must remain missing, not a zero-return baseline.
+- Startup must not continue after a failed logical database restore.
+
+### Task 1: Registration and audited read model
+
+Files: `backend/app/models.py`, migration `0045_alpha_call_registry.py`, `backend/app/services/alpha_desk.py`, `backend/tests/test_alpha_desk.py`.
+
+Interfaces: `AlphaCallRegistry.register(db, source, *, registered_at=None)` returns the immutable registration; `AlphaDeskService.snapshot(db, *, now=None)` returns the two market panels, bounded journal and exclusions. Pure `paired_interval(rows)` returns sample/date/asset coverage and bootstrap bounds.
+
+- [x] Write integration tests for idempotent registration and mutation rejection; observe missing-feature failure.
+- [x] Add the model, migration and registry; verify those tests.
+- [x] Write tests for stale/future provenance, late registration, absent benchmark, cost mismatch, rejected/unfilled calls and market separation; observe failure.
+- [x] Implement bounded source adapters, verified accounting and paired-date interval; verify focused tests.
+
+### Task 2: Capture new decisions and correct existing evidence
+
+Files: paper creator, Forex orchestrator, paper price-context builder, `backend/app/engine/brain/trader_brain.py`, associated integration tests.
+
+- [x] Test new registrations through the actual source engines and an older closed trade hidden by 500 newer non-fills.
+- [x] Capture final frozen inputs in the original transaction; include existing provider/availability metadata.
+- [x] Query closed trades independently, deduplicate IDs, remove double-counted live rows and mark unverified historical grades.
+- [x] Run affected source-engine and Brain tests.
+
+### Task 3: API, two-market product and recovery guard
+
+Files: Alpha router, facade, shared route JSON, Alpha page/components, `scripts/start.sh`, API and restore tests.
+
+- [x] Test read-only Desk GET and executable failed logical restore; observe failure.
+- [x] Expose the bounded Desk, render market panels and journal with source/freshness/coverage, and terminate failed restore startup.
+- [x] Verify API boundary and actual frontend rendering.
+
+### Task 4: Review and production release
+
+Files: version references, release documentation and deployment verifier.
+
+- [x] Set version 2.3.0 consistently and add Desk smoke verification.
+- [ ] Run full backend, frontend and gateway checks; obtain independent review and resolve concrete blockers.
+- [ ] Commit, push PR, attach it, merge after required CI and verify exact-revision deployment.
+- [ ] Capture public runtime, data/persistence limitations and live screenshots; publish GitHub 2.3.0 release.

docs/superpowers/specs/2026-10-13-verified-alpha-desk-design.md

@@ -0,0 +1,36 @@
+# Verified Alpha Desk
+
+The user asks for development and release of the improvements we judge necessary to pursue a financial research platform superior to Bloomberg and a leading alpha caller. They explicitly chose both equities/ETFs and Forex, evaluated separately. Success in this release means verifiable prospective calls and honest comparable evidence; it does not mean an unsupported claim of superiority to proprietary products. Implementation and publication are delegated by the user. Work uses the existing task-owned clone and native execution, with independent review before merge.
+
+## Approach
+
+Reuse BLUM's authoritative paper and Forex decision engines. Add a prospective registration ledger and a read-only Alpha Desk to the existing Alpha page. A Bloomberg-scale data terminal needs licensed datasets and infrastructure; weight training requires valid datasets and a budget. Neither substitutes for a prospective, cost-aware track record. This release concentrates on that track record and fixes known read-model errors.
+
+## Registration and provenance
+
+One additive SQL table records source identity, market, actual registration time, source decision time, the frozen decision manifest and its SHA256. The paper candidate creator and Forex orchestrator register new decisions within their existing transactions. Rejected and unfilled calls remain visible. Registration is idempotent and refuses changes to an existing manifest. Historical rows are never retrospectively registered as prospective evidence. A source row missing a registration remains legacy evidence.
+
+Price provenance must identify a provider, market timestamp and availability timestamp. All timestamps must be at or before the decision. Equity daily data older than 96 hours and Forex quotes older than 180 seconds are unavailable for active calls. A Forex quote needs positive finite bid/ask, ask >= bid and named source; timeframe acquisition dates must not exceed the decision. Missing provenance, invalid side/geometry, non-finite values and source mutations block qualification. Confidence is an explicitly labelled heuristic, not a calibrated probability.
+
+## Evidence and ranking
+
+The Desk reads at most 2,000 registered calls, reports its window, and keeps equities and Forex separate. A closed call counts as qualified forward evidence only if registration preceded closure, input integrity remains intact, timestamps are causal, fill/accounting are valid and net P/L reconciles with explicit execution costs. Benchmark-relative percentage returns additionally require positive account-currency notional and gross-return/notional reconciliation. Missing benchmarks remain missing. Unfilled and rejected calls never enter realized-performance samples.
+
+Report observed P/L and R separately from qualified paired alpha. Do not annualize irregular per-trade returns or treat average trade excursion as portfolio drawdown. Cluster paired excess returns by closure date for a deterministic 95% bootstrap interval. A positive-sample verdict requires at least 100 paired observations, 30 closure dates and three assets, with a lower confidence bound above zero. This is sample evidence, never a production-promotion or competitor-superiority certificate. All failures and exclusions are counted. Existing positive historical grades are marked uncertified when provenance is not independently validated.
+
+Open eligible calls are shown with direction, frozen entry/stop/target, model, quote age, registration hash and source status. Rankings remain within each market and use stored expected net edge only; absent edge estimates are not invented. Prices are never fetched or financial decisions generated by page load.
+
+## Integration and persistence
+
+Expose a reviewed GET/HEAD `/api/alpha/desk` through the shared route policy and embed it in the existing Alpha snapshot. Keep mutations private and paper-only. Preserve existing source tables and additive migrations. Correct Alpha's newest-500 sampling to include a separate bounded query for older closed trades, deduplicate source identities and avoid counting the same live-forward row twice.
+
+Embedded PostgreSQL still uses periodic backups and cannot guarantee zero-loss restart durability. Make restore failures terminate startup rather than continue into a partially restored or empty database. Expose the actual durability mode in the Desk; do not claim this fixes recovery-point loss. Strict durability requires external PostgreSQL. No new paid infrastructure, GPU training or broker execution is enabled.
+
+## Verification and release
+
+Use real SQLite integration tests for registration, immutability, causal/stale inputs, net-cost reconciliation, unfilled outcomes, separate markets, read-only access and older closed trades. Test bootstrap evidence with hand-derived groups and insufficient samples. Test failed restore via executable shell fixtures. Run the full backend suite, frontend tests/build and gateway tests/types. Review, merge only after required CI passes, wait for exact-revision HF and Cloudflare readiness, smoke-test the Desk and five product surfaces, and publish BLUM 2.3.0 with reproducible reports and explicit limitations.
+
+## Sources
+
+- [Bloomberg BQuant](https://professional.bloomberg.com/products/bloomberg-terminal/research/bquant/): product comparison context, not an alpha-performance benchmark.
+- [Bailey and López de Prado, The Deflated Sharpe Ratio](https://www.davidhbailey.com/dhbpapers/deflated-sharpe.pdf): selection bias and non-normal returns require care. This release does not claim to implement DSR or turn a bootstrap interval into a multiple-testing correction.

frontend/app/alpha/page.tsx

@@ -6,6 +6,7 @@ import { api } from "@/lib/api";
 import { BloombergPanel, MetricCard, MiniSparkline, TerminalHeader } from "@/components/FinancialTerminal";
 import { LoadingState } from "@/components/LoadingState";
 import { StatusBadge } from "@/components/StatusBadge";
+import { AlphaDesk } from "@/components/AlphaDesk";
 
 const EVIDENCE_GRADE_ORDER = ["NO_DATA", "INSUFFICIENT_EVIDENCE", "WEAK", "MIXED", "PROMISING", "STRONG"];
 
@@ -69,6 +70,7 @@ export default function AlphaPage() {
         ]}
       />
 
+      <AlphaDesk data={data.registered_alpha_desk} />
       <section className="alpha-verdict-panel">
         <div>
           <span>Alpha Verdict</span>

frontend/components/AlphaDesk.tsx

@@ -0,0 +1,58 @@
+"use client";
+
+import { BloombergPanel } from "@/components/FinancialTerminal";
+import { StatusBadge } from "@/components/StatusBadge";
+import { alphaMarketView, alphaMetric } from "@/lib/alphaDeskView.mjs";
+
+export function AlphaDesk({ data }: { data: any }) {
+  if (!data) return <BloombergPanel title="Prospective Alpha Desk" value="unavailable"><p>The call registry is unavailable. Performance is not inferred from legacy records.</p></BloombergPanel>;
+  return (
+    <section aria-label="Prospective Alpha Desk" style={{ marginBottom: 16 }}>
+      <BloombergPanel title="Prospective Alpha Desk" value={`${data.registered_count ?? 0} registered`} subtitle="Calls recorded before outcomes. Equities and Forex are evaluated separately.">
+        <p style={{ color: "var(--text-secondary)", marginBottom: 12 }}>Only registered calls with causal inputs, valid fills and reconciled costs qualify. Imported history cannot create a forward track record. Confidence remains a heuristic.</p>
+        <div className="grid-2">
+          <Market data={data} market="equity" title="Equities / ETFs" />
+          <Market data={data} market="forex" title="Forex" />
+        </div>
+        <p style={{ color: "var(--text-secondary)", marginTop: 12 }}>Window: {data.window?.evaluated ?? 0} of {data.registered_count ?? 0} registrations, maximum {data.window?.limit ?? "—"}. {data.window?.truncated ? "Earlier registrations are outside this bounded read." : "All current registrations are included."} A positive paired sample requires 100 observations, 30 closure dates and three assets. The interval does not certify strategy promotion or competitor superiority.</p>
+        <p style={{ color: "var(--text-secondary)" }}>Recovery: {data.durability?.mode === "embedded_postgres" ? "periodic backups; the latest updates may be absent after a restart" : "external database; guarantees depend on its recovery configuration"}.</p>
+      </BloombergPanel>
+      <BloombergPanel title="Registered Call Journal" value={`${data.journal?.length ?? 0} shown`} subtitle="Original decisions, source integrity and explicit exclusions." dense>
+        <div style={{ overflowX: "auto" }}>
+          <table className="terminal-table" aria-label="Registered alpha calls">
+            <thead><tr><th>Asset / market</th><th>Recorded UTC</th><th>Direction / state</th><th>Source</th><th>Net account P/L</th><th>Paired excess</th><th>Qualification</th></tr></thead>
+            <tbody>{(data.journal ?? []).map((call: any) => <tr key={call.source_uid}>
+              <td>{call.asset}<br /><small>{call.market}</small></td>
+              <td>{call.registered_at?.replace("T", " ")}<br /><small title={call.input_sha256}>Input {call.input_sha256?.slice(0, 12)}</small></td>
+              <td>{call.direction ?? "unknown"}<br /><small>{call.status}</small></td>
+              <td>{call.provider ?? "unattributed"}<br /><small>{call.quote_at?.replace("T", " ") ?? "timestamp missing"}</small></td>
+              <td>{alphaMetric(call.net_pnl)}</td><td>{alphaMetric(call.paired_excess_percent, "%")}</td>
+              <td>{call.qualified_closed ? "Cost-qualified close" : call.outcome_status}<br /><small>{call.blockers?.join(" · ") || "No current blocker"}</small></td>
+            </tr>)}</tbody>
+          </table>
+          {!data.journal?.length && <p className="terminal-empty">No prospective calls registered yet. Existing historical and paper records remain descriptive evidence below.</p>}
+        </div>
+      </BloombergPanel>
+    </section>
+  );
+}
+
+function Market({ data, market, title }: { data: any; market: string; title: string }) {
+  const view = alphaMarketView(data, market);
+  return <BloombergPanel title={title} value={view.verdict.replaceAll("_", " ")} subtitle="No samples or performance pooled across markets.">
+    <StatusBadge label={view.verdict} />
+    <div className="brain-list dense" style={{ marginTop: 10 }}>
+      <div><span>Registered / cost-qualified / paired</span><strong>{view.registered} / {view.qualifiedClosed} / {view.paired}</strong></div>
+      <div><span>Mean paired excess</span><strong>{alphaMetric(view.alpha, "%")}</strong></div>
+      <div><span>95% closure-date interval</span><strong>{alphaMetric(view.interval.lower_95, "%")} to {alphaMetric(view.interval.upper_95, "%")}</strong></div>
+      <div><span>Closure dates / assets</span><strong>{view.interval.dates ?? 0} / {view.interval.assets ?? 0}</strong></div>
+      <div><span>Observed net account P/L</span><strong>{alphaMetric(view.pnl)}</strong></div>
+    </div>
+    <h3 style={{ marginTop: 14 }}>Current qualified calls</h3>
+    {view.active.map((call: any) => <div className="brain-list dense" key={call.source_uid}>
+      <div><strong>{call.asset} · {call.direction}</strong><p>Entry {alphaMetric(call.entry)} · Stop {alphaMetric(call.stop)} · Target {alphaMetric(call.target)}</p><span>Stored expected net edge: {alphaMetric(call.expected_net_edge)} {call.edge_units}. {call.model}</span></div>
+    </div>)}
+    {!view.active.length && <p>No current call passes the source, freshness and stored-edge gates.</p>}
+    <details style={{ marginTop: 10 }}><summary>Excluded evidence</summary>{Object.entries(view.exclusions).map(([reason, count]) => <p key={reason}>{reason.replaceAll("_", " ")}: {count}</p>)}{!Object.keys(view.exclusions).length && <p>No recorded exclusions in this window.</p>}</details>
+  </BloombergPanel>;
+}

frontend/lib/alphaDeskView.d.mts

@@ -0,0 +1,5 @@
+export function alphaMetric(value: unknown, unit?: string): string;
+export function alphaMarketView(data: any, market: string): {
+  registered: number; qualifiedClosed: number; paired: number; alpha: number | null;
+  pnl: number | null; interval: any; verdict: string; active: any[]; exclusions: Record<string, number>;
+};

frontend/lib/alphaDeskView.mjs

@@ -0,0 +1,18 @@
+export function alphaMetric(value, unit = '') {
+  return typeof value === 'number' && Number.isFinite(value) ? `${value.toFixed(3)}${unit}` : '—';
+}
+
+export function alphaMarketView(data, market) {
+  const source = data?.markets?.[market] ?? {};
+  return {
+    registered: source.registered ?? 0,
+    qualifiedClosed: source.qualified_closed ?? 0,
+    paired: source.paired_sample ?? 0,
+    alpha: source.mean_paired_excess_percent ?? null,
+    pnl: source.observed_net_pnl ?? null,
+    interval: source.paired_interval ?? {},
+    verdict: source.verdict ?? 'INSUFFICIENT_EVIDENCE',
+    active: source.active_calls ?? [],
+    exclusions: source.exclusions ?? {},
+  };
+}

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "blum-ai-financial-intelligence-frontend",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "blum-ai-financial-intelligence-frontend",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "dependencies": {
         "@types/node": "^20.12.12",
         "@types/react": "^18.3.3",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blum-ai-financial-intelligence-frontend",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "private": true,
   "scripts": {
     "dev": "next dev -p 3000",

frontend/tests/alpha-desk-view.test.mjs

@@ -0,0 +1,18 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+test('unknown or non-finite alpha never renders as zero',async()=>{
+  const {alphaMetric}=await import('../lib/alphaDeskView.mjs');
+  assert.equal(alphaMetric(null,'%'),'—');
+  assert.equal(alphaMetric(Infinity,'%'),'—');
+  assert.equal(alphaMetric(-0.01,'%'),'-0.010%');
+});
+
+test('market view reads only the chosen market and preserves an absent benchmark',async()=>{
+  const {alphaMarketView}=await import('../lib/alphaDeskView.mjs');
+  const data={markets:{equity:{qualified_closed:100,mean_paired_excess_percent:6},forex:{qualified_closed:2,mean_paired_excess_percent:null}}};
+  const fx=alphaMarketView(data,'forex');
+  assert.equal(fx.qualifiedClosed,2);
+  assert.equal(fx.alpha,null);
+  assert.equal(fx.verdict,'INSUFFICIENT_EVIDENCE');
+});

package.json

@@ -1,6 +1,6 @@
 {
   "name": "blum-ai-financial-intelligence",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "private": true,
   "scripts": {
     "frontend:dev": "npm --prefix frontend run dev",

scripts/start.sh

@@ -7,6 +7,7 @@ export BLUM_DB_BACKUP_SECONDS="${BLUM_DB_BACKUP_SECONDS:-1800}"
 export BLUM_DB_RESTORE_JOBS="${BLUM_DB_RESTORE_JOBS:-2}"
 export BLUM_DB_INITIAL_BACKUP_DELAY_SECONDS="${BLUM_DB_INITIAL_BACKUP_DELAY_SECONDS:-60}"
 export BLUM_LOCAL_POSTGRES_DATA_DIR="${BLUM_LOCAL_POSTGRES_DATA_DIR:-/var/lib/postgresql/15/main}"
+BLUM_LOCAL_RESTORE_INCOMPLETE_FILE="${BLUM_LOCAL_POSTGRES_DATA_DIR}.restore-incomplete"
 export BLUM_PHYSICAL_POSTGRES_BACKUP_DIR="${BLUM_PERSIST_DIR}/embedded_postgres_physical"
 export BLUM_PHYSICAL_POSTGRES_BASE_BACKUP="${BLUM_PERSIST_DIR}/embedded_postgres_physical/base.tar.gz"
 export BLUM_PHYSICAL_POSTGRES_WAL_BACKUP="${BLUM_PERSIST_DIR}/embedded_postgres_physical/pg_wal.tar.gz"
@@ -134,11 +135,16 @@ cleanup_unsupported_persistent_postgres() {
 
 if [[ -z "${DATABASE_URL:-}" ]]; then
   echo "No DATABASE_URL provided. Starting embedded PostgreSQL for the Hugging Face Docker demo."
+  if [[ -f "${BLUM_LOCAL_RESTORE_INCOMPLETE_FILE}" ]]; then
+    echo "Refusing startup after an incomplete restore. Recover the local database before clearing its failure marker."
+    exit 1
+  fi
   mkdir -p "${BLUM_PERSIST_DIR}" || true
   cleanup_unsupported_persistent_postgres
   PHYSICAL_RESTORE_ATTEMPTED=false
   if [[ -f "${BLUM_PHYSICAL_POSTGRES_READY_FILE}" ]]; then
     PHYSICAL_RESTORE_ATTEMPTED=true
+    touch "${BLUM_LOCAL_RESTORE_INCOMPLETE_FILE}"
     start_restore_status_server
     if restore_embedded_postgres_physical_backup; then
       echo "Physical PostgreSQL recovery image restored to local disk."
@@ -166,27 +172,53 @@ if [[ -z "${DATABASE_URL:-}" ]]; then
   export BLUM_COMPRESSED_POSTGRES_PARTS_READY_FILE="${BLUM_PERSIST_DIR}/embedded_postgres_blum.sql.gz.parts-ready"
   export BLUM_LEGACY_POSTGRES_BACKUP_FILE="${BLUM_PERSIST_DIR}/embedded_postgres_blum.sql"
   TABLE_COUNT="$(su postgres -c "psql -d blum -tAc \"SELECT count(*) FROM information_schema.tables WHERE table_schema='public';\"" | tr -d '[:space:]')"
+  if [[ "${TABLE_COUNT:-0}" == "0" && "${PHYSICAL_RESTORE_ATTEMPTED}" == "true" ]] && ! { [[ -s "${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}" ]] || [[ -s "${BLUM_COMPRESSED_POSTGRES_BACKUP_FILE}" ]] || [[ -s "${BLUM_COMPRESSED_POSTGRES_PARTS_READY_FILE}" ]] || [[ -s "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}" ]]; }; then
+    echo "Refusing startup: physical recovery left no financial tables and no logical backup is available."
+    stop_restore_status_server
+    exit 1
+  fi
   if [[ "${TABLE_COUNT:-0}" == "0" ]] && { [[ -s "${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}" ]] || [[ -s "${BLUM_COMPRESSED_POSTGRES_BACKUP_FILE}" ]] || [[ -s "${BLUM_COMPRESSED_POSTGRES_PARTS_READY_FILE}" ]] || [[ -s "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}" ]]; }; then
     start_restore_status_server
   fi
   if [[ "${TABLE_COUNT:-0}" == "0" && -s "${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}" ]]; then
     echo "Restoring embedded PostgreSQL backup from ${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}."
     chmod a+r "${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}" || true
-    su postgres -c "pg_restore --jobs=${BLUM_DB_RESTORE_JOBS} --exit-on-error -d blum '${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}'" || echo "Custom backup restore failed; continuing with migrations."
+    touch "${BLUM_LOCAL_RESTORE_INCOMPLETE_FILE}"
+    if ! su postgres -c "pg_restore --jobs=${BLUM_DB_RESTORE_JOBS} --exit-on-error -d blum '${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}'"; then
+      echo "Custom backup restore failed. Refusing startup with incomplete financial evidence."
+      stop_restore_status_server
+      exit 1
+    fi
   elif [[ "${TABLE_COUNT:-0}" == "0" && -s "${BLUM_COMPRESSED_POSTGRES_BACKUP_FILE}" ]]; then
     echo "Restoring compressed PostgreSQL bootstrap from ${BLUM_COMPRESSED_POSTGRES_BACKUP_FILE}."
-    gzip -dc "${BLUM_COMPRESSED_POSTGRES_BACKUP_FILE}" | su postgres -c "psql -d blum" || echo "Compressed backup restore failed; continuing with migrations."
+    touch "${BLUM_LOCAL_RESTORE_INCOMPLETE_FILE}"
+    if ! gzip -dc "${BLUM_COMPRESSED_POSTGRES_BACKUP_FILE}" | su postgres -c "psql -v ON_ERROR_STOP=1 -d blum"; then
+      echo "Compressed backup restore failed. Refusing startup with incomplete financial evidence."
+      stop_restore_status_server
+      exit 1
+    fi
   elif [[ "${TABLE_COUNT:-0}" == "0" && -s "${BLUM_COMPRESSED_POSTGRES_PARTS_READY_FILE}" ]]; then
     echo "Restoring segmented PostgreSQL bootstrap from ${BLUM_COMPRESSED_POSTGRES_PART_PREFIX}.part-* ."
-    cat "${BLUM_COMPRESSED_POSTGRES_PART_PREFIX}".part-* | gzip -dc | su postgres -c "psql -d blum" || echo "Segmented backup restore failed; continuing with migrations."
+    touch "${BLUM_LOCAL_RESTORE_INCOMPLETE_FILE}"
+    if ! cat "${BLUM_COMPRESSED_POSTGRES_PART_PREFIX}".part-* | gzip -dc | su postgres -c "psql -v ON_ERROR_STOP=1 -d blum"; then
+      echo "Segmented backup restore failed. Refusing startup with incomplete financial evidence."
+      stop_restore_status_server
+      exit 1
+    fi
   elif [[ "${TABLE_COUNT:-0}" == "0" && -s "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}" ]]; then
     echo "Restoring legacy PostgreSQL backup from ${BLUM_LEGACY_POSTGRES_BACKUP_FILE}."
-    su postgres -c "psql -d blum" < "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}" || echo "Legacy backup restore failed; continuing with migrations."
+    touch "${BLUM_LOCAL_RESTORE_INCOMPLETE_FILE}"
+    if ! su postgres -c "psql -v ON_ERROR_STOP=1 -d blum" < "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}"; then
+      echo "Legacy backup restore failed. Refusing startup with incomplete financial evidence."
+      stop_restore_status_server
+      exit 1
+    fi
   elif [[ ! -s "${BLUM_EMBEDDED_POSTGRES_BACKUP_FILE}" && ! -s "${BLUM_COMPRESSED_POSTGRES_BACKUP_FILE}" && ! -s "${BLUM_LEGACY_POSTGRES_BACKUP_FILE}" ]]; then
     echo "No embedded PostgreSQL backup found yet. A new backup will be written periodically."
   else
     echo "Embedded PostgreSQL already contains tables; skipping restore."
   fi
+  rm -f "${BLUM_LOCAL_RESTORE_INCOMPLETE_FILE}"
   stop_restore_status_server
   export DATABASE_URL="postgresql+psycopg2://postgres:postgres@127.0.0.1:5432/blum"
   START_EMBEDDED_BACKUP_LOOP=true

scripts/verify_deployment.py

@@ -2,6 +2,8 @@
 import argparse
 import json
 import subprocess
+import sys
+from pathlib import Path
 import time
 import urllib.error
 import urllib.request
@@ -10,11 +12,14 @@ parser = argparse.ArgumentParser(description=__doc__)
 parser.add_argument('--backend-only', action='store_true')
 parser.add_argument('--timeout', type=int, default=120)
 args = parser.parse_args()
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'backend'))
+from app.core.release import source_content_hash
+expected_content_hash = source_content_hash()
 revision = subprocess.check_output(['git', 'rev-parse', 'HEAD'], text=True).strip()
 backend = 'https://italianhype-blum.hf.space'
 site = 'https://blum.signallayerlabs.workers.dev'
 verification_headers = {
-    'User-Agent': 'BLUM-Deployment-Verification/2.2.0 (+https://github.com/SignalLayerLabs/Blum)',
+    'User-Agent': 'BLUM-Deployment-Verification/2.3.0 (+https://github.com/SignalLayerLabs/Blum)',
 }
 
 def request(url, **kwargs):
@@ -35,8 +40,10 @@ while time.monotonic() < deadline:
         deployed = get_json(backend, '/api/runtime/release')
         if not startup.get('api_ready') or not startup.get('ui_ready') or startup.get('last_error'):
             raise ValueError('Backend is restoring or unavailable.')
-        if deployed.get('source_revision') != revision or deployed.get('version') != '2.2.0':
+        if deployed.get('source_revision') != revision or deployed.get('version') != '2.3.0':
             raise ValueError('Backend revision has not finished deploying.')
+        if deployed.get('source_content_hash') != expected_content_hash:
+            raise ValueError('Backend protected source content does not match the verified checkout.')
         break
     except (OSError, ValueError) as exc:
         last_error = str(exc)
@@ -46,10 +53,10 @@ else:
 print('Backend ready at', revision, flush=True)
 if not args.backend_only:
     public = get_json(site, '/api/release')
-    if public.get('source_revision') != revision or not public.get('backend_ready'):
+    if public.get('source_revision') != revision or public.get('source_content_hash') != expected_content_hash or not public.get('backend_ready'):
         raise SystemExit('Cloudflare revision or backend readiness mismatch.')
     for path in ['/api/brain/snapshot', '/api/training/snapshot', '/api/paper-trading/snapshot?limit=1',
-                 '/api/alpha/snapshot', '/api/ascent/status']:
+                 '/api/alpha/snapshot', '/api/alpha/desk', '/api/ascent/status']:
         payload = get_json(site, path)
         if not isinstance(payload, dict): raise SystemExit('Invalid snapshot: '+path)
         print('Verified JSON snapshot', path, flush=True)