fix: auto-provision audit signing secret, log real futures_analyze failure reasons

hermes_overlay/tools/futures_dashboard_api.py

@@ -13,6 +13,7 @@ import calendar
 from decimal import Decimal, InvalidOperation
 import hashlib
 import json
+import logging
 import math
 import os
 import re
@@ -60,6 +61,7 @@ from trading.rate_limit import (
 )
 
 router = APIRouter()
+logger = logging.getLogger("hermesface.futures_dashboard_api")
 _paper_cycle_lock = asyncio.Lock()
 _reconciliation_supervisor = None
 _reconciliation_task: asyncio.Task | None = None
@@ -1556,9 +1558,22 @@ async def futures_analyze(payload: _CycleRequest, http_request: Request) -> JSON
     except PlanVersionConflict as exc:
         raise HTTPException(status_code=409, detail="Stale analysis version; refresh and analyze again") from exc
     except PlanValidationError as exc:
+        # The client only ever sees the generic 422 message (avoids leaking
+        # internal decision/geometry details), but the actual reason is
+        # otherwise invisible anywhere - not even a WARNING was logged. Log
+        # it server-side only so a real bug (vs. an expected fail-closed
+        # block on insufficient/stale market data) is diagnosable.
+        logger.warning(
+            "futures_analyze: plan validation failed for %s (owner=%s): %s",
+            normalized.ds4, owner_id, exc,
+        )
         raise HTTPException(status_code=422, detail="Trade plan validation failed") from exc
     except Exception as exc:
         public_message = "Futures analysis failed"
+        logger.warning(
+            "futures_analyze: analysis cycle failed for %s (owner=%s): %s: %s",
+            normalized.ds4, owner_id, type(exc).__name__, exc,
+        )
         _dash_state.record_analysis_failure(public_message, _sanitize_text(type(exc).__name__))
         raise HTTPException(status_code=503, detail=public_message) from exc
 

scripts/sync_hf.py

@@ -474,6 +474,38 @@ class HermesFullSync:
         print("[SYNC] Admin login wired: HERMES_DASHBOARD_BASIC_AUTH_USERNAME/PASSWORD "
               "set from HERMES_ADMIN_USERNAME/HERMES_ADMIN_PASSWORD")
 
+    def _configure_audit_signing_secret(self):
+        """Persist and wire HERMES_AUDIT_SIGNING_SECRET for the trading overlay.
+
+        trading.domain.audit_repo requires this env var to write tamper-evident
+        (HMAC-signed, hash-chained) audit rows. Without it every trade-cycle
+        write falls back to an unsigned "legacy" row and logs a WARNING -
+        every ~15s in practice. HERMES_ENV isn't "production" here so it never
+        blocks anything, it just silently degrades audit integrity forever.
+        Generate a secret once and persist it exactly like the dashboard auth
+        secret, so it's stable across restarts. An operator-provided
+        HERMES_AUDIT_SIGNING_SECRET Space secret always wins.
+        """
+        if os.environ.get("HERMES_AUDIT_SIGNING_SECRET", "").strip():
+            return
+        secret_path = HERMES_DATA / ".audit_signing_secret"
+        try:
+            if secret_path.exists():
+                secret = secret_path.read_text().strip()
+            else:
+                secret = secrets.token_hex(32)  # 64 hex chars, well over the 32-char minimum
+                secret_path.parent.mkdir(parents=True, exist_ok=True)
+                secret_path.write_text(secret)
+                try:
+                    os.chmod(secret_path, 0o600)
+                except Exception:
+                    pass
+            if secret:
+                os.environ["HERMES_AUDIT_SIGNING_SECRET"] = secret
+                print("[SYNC] Audit integrity signing configured (persisted secret)")
+        except Exception as e:
+            print(f"[SYNC] WARNING: could not configure audit signing secret: {e}")
+
     def _normalize_runtime_config(self):
         """Normalize resource and auxiliary settings for a free HF Space.
 
@@ -985,6 +1017,7 @@ class HermesFullSync:
             return None
 
         self._configure_admin_auth()
+        self._configure_audit_signing_secret()
         env = os.environ.copy()
         env["HERMES_HOME"] = str(HERMES_DATA)
         env["GATEWAY_ALLOW_ALL_USERS"] = "true"