KOL feeds: fix dead/blocked sources, drop stale feeds (29→25)
Feed-health pass over KOL_FEEDS: - raoulpal: stale Substack (last 2024-05) → Real Vision podcast feed - dampedspring: paywalled (0 entries) → free "Damped Spring 101" Substack - unchained: Cloudflare 403 → canonical Megaphone podcast feed - lynalden: Cloudflare 202 → FeedBurner mirror - glassnode: recovered via httpx http2=True (was 403 on HTTP/1.1) - browser User-Agent + Accept headers on feed fetch - removed dead feeds with no active replacement: placeholder, dragonfly, niccarter, eugene - pin h2==4.3.0 (required by http2=True) All 25 remaining feeds verified fetching real body content; newest post per feed ≤88d. Bundles in-flight KOL-module work already in the working tree (kol_x ingest, migration 027, tests). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
k
@@ -63,6 +63,7 @@ Four signal sources → one bot → optional Hyperliquid execution
|
||||
│ 1. Trump Truth Social │── auto-classify (DeepSeek) → "buy"/"short"/"noise"
|
||||
│ (every post, <3s) │ if actionable: Trump scalp auto-open (System 1)
|
||||
└──────────────────────────┘ Tight 1.5% SL, 12h cooldown, ≥30min min-hold
|
||||
Optional: post prediction tweet via x_poster.py
|
||||
|
||||
┌──────────────────────────┐
|
||||
│ 2. Macro Vibes │── 8 daily macro indicators (AHR999, F&G, etc.)
|
||||
@@ -72,10 +73,11 @@ Four signal sources → one bot → optional Hyperliquid execution
|
||||
5-rung stop ladder, de-risk, pyramid, peak-trail.
|
||||
|
||||
┌──────────────────────────┐
|
||||
│ 3. KOL talks-vs-trades │── Substack/podcast ingest + ETH on-chain diff
|
||||
│ (19 KOLs, daily) │ Divergence (publicly bullish, secretly selling)
|
||||
│ 3. KOL talks-vs-trades │── Substack/podcast/X ingest + ETH on-chain diff
|
||||
│ (29 feeds, daily) │ Divergence (publicly bullish, secretly selling)
|
||||
└──────────────────────────┘ is the platform's highest-conviction signal.
|
||||
Telegram alert only — never auto-trades.
|
||||
x_analysis.py adds real-time X post scoring.
|
||||
|
||||
┌──────────────────────────┐
|
||||
│ 4. Funding extreme │── Hourly BTC perp funding scan
|
||||
@@ -102,13 +104,18 @@ linked) = Trump auto-trade + /adopt manage-only flow for sys2.
|
||||
- Batch / reanalysis uses `AI_MODEL` (quality, ~10s)
|
||||
- **Trading**: Hyperliquid SDK; API-wallet keys are envelope-encrypted with
|
||||
`ENCRYPTION_KEY` (KEK), per-user DEK derivation via `crypto.py`.
|
||||
- **Prices**: Binance WS (`binance.py`) feeds `price_store` + powers the
|
||||
`tp_sl_monitor` per-tick evaluator.
|
||||
- **Prices**: Two feeds:
|
||||
- `binance.py` WebSocket → BTC, ETH, SOL, TRUMP, BNB, DOGE, LINK, AAVE
|
||||
- `hl_price_feed.py` polls HL `allMids` every 2s → HYPE, PURR (HL-native assets not on Binance)
|
||||
Both pump `price_store` + `tp_sl_monitor` on every tick.
|
||||
- **Telegram**: long-poll mode (single instance), HTML messages, inline
|
||||
keyboards. `telegram.py` send/edit/answer + `telegram_bot.py` commands.
|
||||
Public channel broadcast (`TELEGRAM_PUBLIC_CHANNEL_ID` env) sends a
|
||||
sanitised `format_public_post` version (no execution details, tier label
|
||||
instead of raw confidence) after every per-user fan-out in `_dispatch`.
|
||||
- **X (Twitter)**: `x_poster.py` — optional viral prediction tweets after each
|
||||
actionable Trump signal. Gated by `x_enabled=False` (off by default). Full
|
||||
no-op if creds missing. OAuth 1.0a hand-signed with stdlib hmac — no extra deps.
|
||||
|
||||
---
|
||||
|
||||
@@ -122,13 +129,18 @@ app/
|
||||
│ ├── user.py /subscribe|settings|manual-window|auto-trade
|
||||
│ ├── telegram.py /telegram/{preferences,bind,unbind,test}
|
||||
│ ├── macro.py /macro/{snapshot,history}
|
||||
│ └── kol.py /kol/{posts,digest,wallets,divergence}
|
||||
│ ├── kol.py /kol/{posts,digest,wallets,divergence}
|
||||
│ ├── performance.py /performance ← wallet-scoped real-money stats (30d)
|
||||
│ ├── funding_reversal.py /funding/snapshot ← live funding state + 7d history
|
||||
│ ├── funding_signal.py /signal/{status,toggle,history} ← breakout monitor
|
||||
│ └── dev.py Dev-only routes (only mounted in development env)
|
||||
├── services/
|
||||
│ ├── bot_engine.py ★ TRADING CORE — process_post, _execute_for_subscriber,
|
||||
│ │ _broadcast_trade_alert (WS failure notifications),
|
||||
│ │ close_and_finalize, partial_derisk, pyramid_add
|
||||
│ ├── adoption.py ★ /adopt + /release flow (sys2 manage-only)
|
||||
│ ├── tp_sl_monitor.py Per-price-tick close evaluator. on_price_tick is
|
||||
│ │ called from binance.py once per second
|
||||
│ │ called from binance.py + hl_price_feed.py once/sec
|
||||
│ ├── hyperliquid.py HL trader (open/close/reduce/leverage)
|
||||
│ ├── recovery.py Startup rehydration of open BotTrades into watchdog
|
||||
│ ├── reconciler.py Every 60s: compare DB ↔ HL state, mark drift
|
||||
@@ -136,13 +148,31 @@ app/
|
||||
│ ├── signal_categories.py CRITICAL CONFIG — sys1/sys2 sources, ladders,
|
||||
│ │ leverage clamping, protective stop formulas
|
||||
│ ├── regime_filter.py Sys1 only — recent-move / vol-contraction gates
|
||||
│ ├── analysis.py AI signal scoring (DeepSeek)
|
||||
│ ├── analysis.py AI signal scoring (DeepSeek) for Trump posts
|
||||
│ ├── x_analysis.py AI scoring for X (Twitter) KOL posts. Three tiers:
|
||||
│ │ TRADE_SIGNAL / DIRECTIONAL / NOISE. Strict NOISE
|
||||
│ │ default — most X posts should be filtered out.
|
||||
│ │ Consumed by kol_x.py. tickers come out in the
|
||||
│ │ {ticker,action,conviction} shape kol_divergence reads.
|
||||
│ ├── x_poster.py X (Twitter) auto-poster for Trump signals.
|
||||
│ │ Fires a prediction tweet then a follow-up at
|
||||
│ │ +x_followup_minutes with the actual move. Gated by
|
||||
│ │ x_enabled env var (False by default). Full no-op
|
||||
│ │ if creds missing — never blocks signal flow.
|
||||
│ ├── entry_filter.py Cheap text-based pre-filter (skip RT/URL-only)
|
||||
│ ├── telegram.py send_message / edit_message / answer_callback
|
||||
│ ├── telegram_bot.py Long-poll loop + /start /digest /adopt /release ...
|
||||
│ ├── telegram_digest.py Daily 3-section brief (rule-based; no LLM)
|
||||
│ ├── price_store.py In-memory latest price per asset
|
||||
│ ├── price_backfill.py Backfill historical 5min bars from Binance
|
||||
│ ├── hl_price_feed.py Supplemental HL price feed for HL-native assets
|
||||
│ │ (HYPE, PURR). Polls allMids every 2s. Runs
|
||||
│ │ alongside binance.py. Without this, TP/SL
|
||||
│ │ silently stops protecting HL-native trades.
|
||||
│ ├── backtest.py Single-post backtest harness. Fetches 1m Binance
|
||||
│ │ candles for [published_at, +max_hold_h] and
|
||||
│ │ replays current exit rules. Conservative (uses
|
||||
│ │ HIGH/LOW within bar). No fees. Batch runner on top.
|
||||
│ ├── crypto.py HL API-key envelope encryption
|
||||
│ ├── scanner_state.py In-memory toggle + observability for scanners
|
||||
│ ├── macro/
|
||||
@@ -153,31 +183,58 @@ app/
|
||||
│ │ ├── btc_bottom_reversal.py 2-of-3 AHR999 + 200WMA + Pi Bottom
|
||||
│ │ ├── funding_reversal.py Hourly funding extreme
|
||||
│ │ └── sma_reclaim.py (archive — not scheduled)
|
||||
│ ├── kol_substack.py RSS ingest for 19 KOL feeds
|
||||
│ ├── kol_substack.py RSS ingest for 29 KOL feeds (substack/blog/podcast)
|
||||
│ ├── kol_x.py X (Twitter) ingest via twitterapi.io → x_analysis →
|
||||
│ │ KolPost(source="twitter"). Daily 01:30 UTC. No-op
|
||||
│ │ if twitterapi_io_key unset. Provides the post-side
|
||||
│ │ feed for X-only KOLs (andrewkang, murad).
|
||||
│ ├── kol_onchain.py HL public API + Etherscan diff
|
||||
│ ├── kol_divergence.py Cross-ref talks vs trades within ±7d
|
||||
│ ├── kol_analysis.py AI ticker/direction/conviction extract
|
||||
│ ├── kol_analysis.py AI ticker/direction/conviction extract (Substack)
|
||||
│ ├── bottom_indicators.py AHR999 / Pi Cycle / 200WMA math
|
||||
│ └── funding_signal.py Real-time funding extreme detector
|
||||
│ ├── funding_signal.py Real-time funding extreme detector
|
||||
│ └── signed_request.py EIP-191 signature verification (+ replay cache)
|
||||
├── scrapers/
|
||||
│ └── truth_social.py CNN + trumpstruth.org pollers (5s interval)
|
||||
│ ├── truth_social.py CNN archive poller (5s interval) — primary
|
||||
│ └── trumpstruth.py trumpstruth.org RSS fallback poller. Same post id
|
||||
│ hash → automatic dedup. Whoever sees first wins.
|
||||
│ Offset by half the interval so the two pollers
|
||||
│ don't hit upstream simultaneously.
|
||||
├── ws/
|
||||
│ └── manager.py WebSocket fan-out for live UI updates
|
||||
│ └── manager.py WebSocket fan-out for live UI updates.
|
||||
│ Broadcasts trade_alert events (execution_failed /
|
||||
│ insufficient_balance / budget_reached) via
|
||||
│ _broadcast_trade_alert() in bot_engine.py.
|
||||
├── models.py ★ All SQLAlchemy models in one file
|
||||
├── database.py Async engine + session factory
|
||||
├── config.py Pydantic Settings — reads .env
|
||||
└── main.py FastAPI lifespan, scheduler setup, route mount
|
||||
Includes: singleton lock guard (one-leader, multi-
|
||||
worker safe), deep health check /api/health/deep,
|
||||
boot-grace window for price feeds.
|
||||
|
||||
alembic/versions/ Migrations (numbered NNN). Latest = 026
|
||||
026 = composite index (wallet_address, closed_at) on bot_trades
|
||||
scripts/ One-shot ops
|
||||
├── preflight.py Pre-launch readiness gate (env / DB / TG / AI)
|
||||
├── launch_smoke.py End-to-end smoke (14 checks against running API)
|
||||
├── launch_seed.py Pre-launch data prep: drops test sources, trims KOL
|
||||
│ window to last 30d, refetches all upstream sources.
|
||||
│ Run ONCE before flipping traffic to a fresh DB.
|
||||
├── seed_kol_wallets.py Seeds the KOL wallet table with known addresses.
|
||||
│ Idempotent (INSERT OR IGNORE). Run once at first deploy.
|
||||
├── rescore_v5.py Re-score every Post with current AI prompt
|
||||
├── backfill_signals.py Fill in signal for posts missing it
|
||||
└── verify_sys2_lifecycle.py Manual System-2 lifecycle walk-through
|
||||
|
||||
tests/ pytest, 64 tests, fast (<1s total)
|
||||
tests/ pytest, 83 tests, fast (<3s total)
|
||||
├── test_adoption.py Adoption + release flow (snapshot-style, no real HL/AI)
|
||||
├── test_telegram_digest.py Daily digest formatting
|
||||
├── test_kol_x.py X ingest: dedup / mapping / no-op (mocked fetch+AI)
|
||||
├── test_ratelimit.py Rate limit coverage (BUG-02 fix)
|
||||
├── test_bottom_reversal_strategy.py btc_bottom_reversal 2-of-3 logic
|
||||
├── test_macro_fetchers_timing.py Macro fetcher timeout + error handling
|
||||
└── test_production_readiness.py Environment / config sanity checks
|
||||
```
|
||||
|
||||
---
|
||||
@@ -206,6 +263,7 @@ Confidence min 88 (platform) / user 85 (platform)
|
||||
Circuit breaker sys1_* sys2_* (independent)
|
||||
Daily budget Full daily_budget_usd n/a — user controls notional on HL
|
||||
Telegram alert Trump alert format Macro/funding alert + /adopt CTA
|
||||
X tweet Optional prediction tweet n/a
|
||||
```
|
||||
|
||||
**If you're tempted to put sys2 logic in `_execute_for_subscriber`**: stop.
|
||||
@@ -237,11 +295,11 @@ minimalism — don't extend them.
|
||||
circuit_breaker (sys2 CB still gates adopt!) /
|
||||
already_adopted / concurrency_cap (3)
|
||||
c. Re-read HL state inside lock (fresh entry/size/lev)
|
||||
d. Resolve sys2_protective_stop_pct(HL_actual_leverage)
|
||||
e. INSERT BotTrade with eff_* frozen + sys2_mode + hl_order_id="adopted:<ts>"
|
||||
d. Reject if leverage > SYS2_MAX_LEVERAGE (BUG-09 fix)
|
||||
e. Resolve sys2_protective_stop_pct(HL_actual_leverage)
|
||||
f. INSERT BotTrade with eff_* frozen + sys2_mode + hl_order_id="adopted:<ts>"
|
||||
+ trigger_post_id=NULL
|
||||
f. register_trade() with full ladder/de-risk/addon/peak_trail
|
||||
└─ Telegram confirmation w/ ladder summary
|
||||
g. register_trade() with full ladder/de-risk/addon/peak_trail
|
||||
|
||||
4. tp_sl_monitor drives the position
|
||||
└─ Stop ratchet, downside de-risk partial reduces, pyramid add-ons,
|
||||
@@ -249,17 +307,11 @@ minimalism — don't extend them.
|
||||
lock-protected partial_derisk / pyramid_add / close_and_finalize.
|
||||
|
||||
5a. User wants out: /release
|
||||
└─ release_management(wallet, trade_id):
|
||||
a. Sets BotTrade.released_at = now
|
||||
b. unregister(trade_id) from watchdog
|
||||
└─ Sets BotTrade.released_at = now; unregister(trade_id) from watchdog
|
||||
└─ HL position UNTOUCHED — bot stops driving, user has manual control
|
||||
└─ Across restarts: recovery skips released rows (released_at filter)
|
||||
└─ Reconciler skips them. Released trades don't appear in
|
||||
/positions/open or the digest "your status" line.
|
||||
|
||||
5b. Bot drives the close (ladder / max-hold)
|
||||
└─ close_and_finalize() atomic claim sets closed_at, computes pnl
|
||||
└─ Trade is now CLOSED (closed_at set, exit_price + pnl_usd written)
|
||||
|
||||
5c. User force-closes via UI: POST /api/positions/{id}/close
|
||||
└─ manual_close calls close_and_finalize(force=True) — bypasses
|
||||
@@ -268,13 +320,30 @@ minimalism — don't extend them.
|
||||
6. Recovery on restart:
|
||||
└─ recovery.rehydrate_open_trades reads BotTrade WHERE closed_at IS NULL
|
||||
AND released_at IS NULL
|
||||
└─ For each: rebuild ladder from sys2_mode + (category OR adopted fallback).
|
||||
The fallback for trigger_post_id IS NULL is the critical fix —
|
||||
without it adopted trades lose their entire sys2 ladder on restart.
|
||||
└─ For each sys2 trade: rebuild ladder from sys2_mode + adopted fallback.
|
||||
Also reschedules _time_stop_check with remaining seconds (elapsed windows
|
||||
fire immediately with delay=0). This is the critical fix — without it
|
||||
adopted trades lose their entire sys2 ladder on restart.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Singleton lock guard (critical infrastructure detail)
|
||||
|
||||
`main.py:lifespan` calls `_acquire_singleton_lock()` at boot using an
|
||||
advisory file lock (`/tmp/trumpsignal-backend.lock`, configurable via
|
||||
`SINGLETON_LOCK_PATH`). Only ONE process — "the leader" — starts the
|
||||
scheduler, scrapers, price feeds, and Telegram poller. Any additional
|
||||
worker (e.g. accidental `--workers 2`) serves HTTP reads only and logs
|
||||
`SINGLETON LOCK NOT ACQUIRED`. The OS releases the lock automatically
|
||||
when the leader exits, so a crashed leader unblocks the next start.
|
||||
|
||||
The `/api/health/deep` endpoint surfaces `"is_leader": false` and adds
|
||||
it to `problems[]` so uptime monitors catch mis-configured multi-worker
|
||||
deployments.
|
||||
|
||||
---
|
||||
|
||||
## Critical invariants checklist (when reviewing any trading change)
|
||||
|
||||
- [ ] Does this code path respect `released_at IS NULL`?
|
||||
@@ -308,8 +377,7 @@ minimalism — don't extend them.
|
||||
7. Add a `/yoursource on|off` command in `telegram_bot.py`.
|
||||
8. If sys2: extend `signal_categories._CATEGORY_EXITS` if it needs a custom
|
||||
exit profile (otherwise default works).
|
||||
9. Add the deep-link path in `telegram.format_post` AND `telegram.format_public_post`
|
||||
(both the per-user private alert and the public channel use the same path map).
|
||||
9. Add the deep-link path in `telegram.format_post` AND `telegram.format_public_post`.
|
||||
|
||||
### Add a new bot command
|
||||
|
||||
@@ -328,6 +396,15 @@ minimalism — don't extend them.
|
||||
2. Mirror the field on the SQLAlchemy model in `app/models.py`.
|
||||
3. Apply locally: `DATABASE_URL=<sqlite> alembic upgrade head`.
|
||||
|
||||
### Enable X (Twitter) posting
|
||||
|
||||
1. Create a Twitter developer app with OAuth 1.0a user context permissions.
|
||||
2. Set in `.env`: `X_API_KEY`, `X_API_SECRET`, `X_ACCESS_TOKEN`,
|
||||
`X_ACCESS_SECRET`, `X_ENABLED=true`.
|
||||
3. Optionally tune: `X_DAILY_CAP` (default 40), `X_FOLLOWUP_MINUTES` (default 15).
|
||||
4. Verify with a dry-run: set `X_ENABLED=false` and check logs — the poster
|
||||
logs what it WOULD tweet without sending.
|
||||
|
||||
### Deploy
|
||||
|
||||
```bash
|
||||
@@ -340,16 +417,27 @@ python scripts/launch_smoke.py --base https://api.trumpalpha.io
|
||||
|
||||
---
|
||||
|
||||
## Running it
|
||||
|
||||
```bash
|
||||
cd backend && python -m venv venv && source venv/bin/activate
|
||||
pip install -r requirements.txt
|
||||
cp .env.example .env # fill in: ENCRYPTION_KEY, AI_API_KEY, INGEST_API_KEY
|
||||
uvicorn app.main:app --reload # dev only; prod uses --workers 1, no --reload
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Testing
|
||||
|
||||
```bash
|
||||
source venv/bin/activate
|
||||
python -m pytest tests/ -q # full suite, ~0.5s
|
||||
python -m pytest tests/ -q # 79 tests, ~2s
|
||||
python scripts/preflight.py # env + DB + TG + AI auth checks
|
||||
python scripts/launch_smoke.py # 14 end-to-end checks vs running API
|
||||
```
|
||||
|
||||
64 tests. Adoption + telegram_digest are snapshot-style (no real HL/AI).
|
||||
Adoption + telegram_digest are snapshot-style (no real HL/AI).
|
||||
End-to-end trading is verified manually via the bot.
|
||||
|
||||
---
|
||||
@@ -395,6 +483,12 @@ this for you" to "you opened it, bot manages your discipline".
|
||||
- **`_execute_for_subscriber` has lots of `if sub["_is_system_2"]` branches.**
|
||||
Dead code under v2.0 (process_post early-returns for sys2). Kept for diff
|
||||
minimalism — don't extend or re-enable.
|
||||
- **`kol_x.X_KOLS` handle ≠ X username.** `handle` is the CANONICAL key
|
||||
(e.g. "cryptohayes") that MUST match `KolWallet.handle` so divergence can
|
||||
join post-side ↔ on-chain; `x_username` is the screen name fetched from X.
|
||||
andrewkang/murad wallets stay dark (zero divergence detections) until X
|
||||
ingestion supplies their post side — that's the whole reason kol_x exists.
|
||||
Empty `twitterapi_io_key` → kol_x is a full no-op (no error).
|
||||
- **`funding_reversal` source is in `SYSTEM_2_SOURCES`? No.** It's
|
||||
intentionally NOT in either supported set — it ingests as a Post for
|
||||
audit + sends Telegram alert via the CTA path, but doesn't trigger any
|
||||
@@ -407,119 +501,44 @@ this for you" to "you opened it, bot manages your discipline".
|
||||
Useful for telemetry filtering.
|
||||
- **`telegram.send_message` accepts `int | str` for `chat_id`.** Intentional.
|
||||
Integer = private chat, string = public channel username (e.g. `"@trumpalpha"`).
|
||||
The public channel uses the string form; per-user alerts still pass integers.
|
||||
- **`format_public_post` deliberately omits `expected_move_pct`,
|
||||
`invalidation_price`, and `/adopt` CTA.** Execution-sensitive data stays
|
||||
private (per-user). The public version shows confidence tier (HIGH/MED/LOW)
|
||||
instead of the raw score for readability.
|
||||
- **`_adopt_locks` in adoption.py looks like it should have a cap like
|
||||
`_wallet_open_locks` (512).** It doesn't yet — see Known Issues below.
|
||||
private. The public version shows confidence tier (HIGH/MED/LOW) instead
|
||||
of the raw score.
|
||||
- **`_adopt_locks` in adoption.py** is an `OrderedDict` capped at 512 with
|
||||
LRU eviction — matches the `_WALLET_LOCK_MAX` pattern in `bot_engine`.
|
||||
- **`trumpstruth.py` runs at half-interval offset** — the two CNN + trumpstruth
|
||||
pollers are deliberately staggered so they don't hammer upstream simultaneously.
|
||||
The offset is `truth_social_poll_seconds // 2`, set via APScheduler
|
||||
`next_run_time` at boot.
|
||||
|
||||
---
|
||||
|
||||
## Open known issues (not blocking launch but worth fixing later)
|
||||
|
||||
- ~~**`_time_stop_check` tasks not rehydrated on restart** (BUG-01, FIXED 2026-05-29):~~
|
||||
`recovery.py` now imports `_time_stop_check` + `_background_tasks` from
|
||||
`bot_engine` and `get_exit_profile` from `signal_categories`. After each
|
||||
`register_trade()` call for a sys2 trade, it checks `exit_profile.time_stop_hours`,
|
||||
computes remaining seconds, and reschedules the task. Elapsed windows (backend
|
||||
was down longer than the time-stop period) fire immediately with `delay_seconds=0`.
|
||||
|
||||
- ~~**Rate limit bypass via proxy x-forwarded-for** (BUG-02, HIGH, FIXED 2026-05-29):~~
|
||||
Two-part fix. (1) Frontend proxy `app/api/proxy/[...path]/route.ts` now
|
||||
relays the real client IP via `x-forwarded-for` / `x-real-ip`. (2) Backend
|
||||
had the matching gap: `slowapi`'s default `get_remote_address` reads
|
||||
`request.client.host` (the proxy IP, since uvicorn runs without
|
||||
`--proxy-headers`), so the relayed header was ignored and all users still
|
||||
shared one bucket. Now a shared `app/ratelimit.py` exposes `client_ip_key`
|
||||
(reads `x-forwarded-for[0]` → `x-real-ip` → peer) used by ONE shared
|
||||
`limiter` across `main.py`, `posts.py`, `prices.py`. Also registered
|
||||
`SlowAPIMiddleware` so `default_limits` (60/min) actually applies to every
|
||||
route — previously only the 2 decorated read endpoints were limited and all
|
||||
signed-mutation routes had no limit at all. Covered by `tests/test_ratelimit.py`.
|
||||
|
||||
- ~~**`close_and_finalize` double-failure leaves DB/HL state inconsistent**
|
||||
(BUG-03, MITIGATED 2026-05-29):~~ Full two-phase-commit is out of scope.
|
||||
Mitigation: `reconciler._reconcile_wallet` now runs a "ghost position" pass —
|
||||
queries DB-closed trades from the last 2h and cross-checks against HL open
|
||||
positions. Mismatches are logged at ERROR level and broadcast via WS
|
||||
(`reconcile_drift.ghost_positions`). Manual close required on HL UI.
|
||||
|
||||
- ~~**`_adopt_locks` has no capacity cap** (BUG-04, FIXED 2026-05-29):~~
|
||||
`adoption._adopt_locks` is now an `OrderedDict` capped at `_ADOPT_LOCK_MAX=512`
|
||||
with LRU eviction — matches the `_WALLET_LOCK_MAX` pattern in `bot_engine`.
|
||||
|
||||
- ~~**Reconciler runs wallets sequentially** (BUG-05, FIXED 2026-05-29):~~
|
||||
`reconcile_all_once` now fans out with `asyncio.gather` + `asyncio.Semaphore(10)`.
|
||||
Worst-case tail latency is `ceil(N/10) × 30s` instead of `N × 30s`.
|
||||
|
||||
- ~~**`/stop` also silently disables daily digest** (BUG-07, FIXED 2026-05-29):~~
|
||||
`send_daily_digest` no longer filters on `alerts_enabled` — digest and
|
||||
real-time alerts are independent. `/stop` reply updated to say "Real-time
|
||||
alerts paused … send `/digest off` to stop the daily brief separately".
|
||||
|
||||
- ~~**`binance.py` ASSET_MAP only had BTC + ETH** (BUG-08, CRITICAL, FIXED 2026-05-29):~~
|
||||
Trump's AI can set `target_asset` to SOL/TRUMP/BNB/DOGE/LINK/AAVE.
|
||||
`ASSET_MAP` now covers all those; `BINANCE_WS_URL` is derived from it
|
||||
automatically so the stream list and routing table can never diverge.
|
||||
**Still missing**: HYPE (HL-native, not on Binance) — trades on HYPE fall
|
||||
back to max-hold only until a supplemental HL price feed is added.
|
||||
|
||||
- ~~**`_close_locks` leaked one entry per concurrent-close loser** (BUG-11, FIXED 2026-05-29):~~
|
||||
`close_and_finalize` now pops `_close_locks[trade_id]` in the
|
||||
`rowcount == 0` early-return path, not just on the success paths.
|
||||
|
||||
- ~~**`signed_request._seen` O(n) purge at 5000 entries** (BUG-12, FIXED 2026-05-29):~~
|
||||
Threshold reduced to `_SEEN_PURGE_THRESHOLD = 1000` and the purge now
|
||||
builds an `expired` list in one pass rather than calling `dict.pop` in a loop.
|
||||
|
||||
- ~~**`_get_max_leverage` makes a fresh HL `meta()` call on every trade open**
|
||||
(BUG-10, FIXED 2026-05-29):~~ `_MAX_LEV_CACHE` added (same 300s TTL as
|
||||
`_SZ_DECIMALS_CACHE`). Cache miss populates ALL coins from the single
|
||||
`meta()` response, so concurrent opens pay one API call, not N.
|
||||
|
||||
- ~~**Trump daily budget split**~~ (FIXED 2026-05-29): System-2 is manage-only
|
||||
so the `sys2_pct` reservation no longer makes sense for auto-opens.
|
||||
`daily_cap` for System-1 (Trump) is now `total_cap × 1.0` instead of
|
||||
`total_cap × (1 - sys2_pct)`. The split logic remains intact so it would
|
||||
work correctly if sys2 auto-open is ever re-enabled via ADR.
|
||||
|
||||
- ~~**HL high-leverage adoption**~~ (BUG-09, FIXED 2026-05-29): `adopt_position`
|
||||
now rejects positions where `leverage > SYS2_MAX_LEVERAGE` with error code
|
||||
`leverage_too_high`. Previously the protective stop was computed for 10×
|
||||
but applied to a 25× position — the stop was OUTSIDE the liquidation band.
|
||||
|
||||
- **`adopt:choose:BTC` callback may show stale prices** if user takes >60s
|
||||
to tap (HL fees, partial fills can change entry/size). adopt_position
|
||||
re-reads HL at mode-tap time so the FROZEN BotTrade is always fresh,
|
||||
but the picker label could be outdated.
|
||||
|
||||
- **Telegram bot offset on restart**: `getUpdates` may replay last 24h of
|
||||
messages on backend restart. Stale `/adopt` could re-fire. User can
|
||||
/release to recover.
|
||||
- ~~**Telegram bot offset on restart**~~ **FIXED 2026-06-01**: startup drain
|
||||
added. Stale `/adopt` replays suppressed.
|
||||
|
||||
- ~~**`pyramid_add` double-add on DB commit failure** (BUG-13, FIXED 2026-05-29):~~
|
||||
Same pattern as BUG-03 / partial_derisk. HL `open_position` succeeds but the
|
||||
subsequent `db.commit()` of `addon_steps_done` fails → retrigger sees same
|
||||
`step_idx` and double-adds. Fix: pre-claim `addon_steps_done = step_idx + 1`
|
||||
with a conditional UPDATE (WHERE `addon_steps_done == step_idx`) BEFORE calling
|
||||
HL. If `rowcount == 0`, return early. Second UPDATE writes `entry_price` and
|
||||
`size_usd` after fill confirmation.
|
||||
- **`/adopt` picker label** can show stale price if user waits >60s to tap
|
||||
(frozen BotTrade is always fresh, but the Telegram picker label may be outdated).
|
||||
|
||||
- ~~**`price_impact_monitor` measured wrong asset** (BUG-14, FIXED 2026-05-29):~~
|
||||
`truth_social.py` passed `analysis["asset"]` (BTC/ETH sentiment proxy) to
|
||||
`register_post` instead of `target_asset` (SOL/TRUMP/etc. — the perp we actually
|
||||
trade). Impact % was measuring BTC/ETH not the traded coin. Fix: introduced
|
||||
`tracked_asset = analysis.get("target_asset") or asset` and used it for
|
||||
`price_at_post`, `price_impact_asset`, and `register_post(asset=…)`.
|
||||
**Deferred security items (need interface change or DB migration):**
|
||||
- **C3**: Read endpoints pass `ts`/`sig` as URL query params → access log exposure.
|
||||
- **H4**: HL API key KEK uses single unsalted SHA-256. Needs re-encryption migration.
|
||||
- **M1**: Adopted sys2 positions miscounted against sys1 daily budget.
|
||||
- **M5**: `GET /telegram/{wallet}/status` unauthenticated — exposes chat_id/tg_username.
|
||||
|
||||
---
|
||||
|
||||
## Repos in this project
|
||||
|
||||
- **This repo** (`/Users/k/Public/Claude/backend`) — Python/FastAPI backend
|
||||
- **Sibling frontend** (`/Users/k/Public/Claude/trumpsignal`) — Next.js 16
|
||||
- **This repo** (`/Users/k/Public/trumpsignal/backend`) — Python/FastAPI backend
|
||||
- **Sibling frontend** (`/Users/k/Public/trumpsignal/frontend`) — Next.js 16
|
||||
dashboard at trumpsignal.com. See its own CLAUDE.md.
|
||||
|
||||
Both deployed independently. Backend serves the JSON API + Telegram bot.
|
||||
|
||||
Reference in New Issue
Block a user