* docs/11-gui-streamlit.md — replaces the original spec with what was
actually built: implementation status table, real page filenames
(1_Status, 2_Audit, 3_Equity, 4_History, 5_Position), per-page
inventory of implemented vs deferred sections, GUI ↔ engine table
showing arm_kill/disarm_kill via manual_actions and the
not_supported markers for force_close + approve/reject_proposal,
consumer signature with cron */1, lock model clarified (no GUI
lockfile), DoD updated with current state.
* docs/05-data-model.md — manual_actions is no longer "pianificata":
populated by gui/data_layer.py, drained by the manual_actions job;
per-kind status table (arm/disarm OK, others not_supported).
* docs/09-development-roadmap.md — Phase 4.5 marked implemented with
per-task ✅/⏳ markers for the deferred items (auto-refresh,
AppTest, force-close hook).
* docs/06-operational-flow.md — adds Flusso 5b describing the
manual_actions consumer pattern (enqueue → KillSwitch transition →
audit log linkage).
360/360 tests still pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Conclude il doc drift residuo dei tre documenti che ancora
descrivevano il modello di esercizio pre-Fase 4 (memory/brain-bridge,
push_user_instruction, conferma manuale). Aggiornati per riflettere
l'engine autonomo notify-only attuale, con tutti gli ultimi
hardening integrati.
docs/02-architecture.md:
- Diagramma a blocchi: rimosso cerbero-memory ↔ Cerbero core,
aggiunto annotation sull'audit chain con anchor SQLite.
- Tabella stack: httpx pooling al posto dell'SDK mcp, hash chain
con anchor in system_state.
- Layout cartelle: aggiunte runtime/lockfile.py,
runtime/orchestrator.py, runtime/recovery.py, scripts/dead_man.sh,
state/migrations/0002_audit_anchor.sql.
- Sequenze entry/monitor riscritte all'auto-execute via
place_combo_order, niente attesa conferma utente.
- Nuova sezione "Lifecycle del container" con boot order, scheduler,
SIGTERM clean shutdown, lock release.
- Failure modes aggiornati: environment mismatch, audit anchor
mismatch, lock occupato.
docs/05-data-model.md:
- Filosofia estesa con la regola dell'audit chain e l'anchor.
- Schema instructions: payload_json riferito ai response Deribit
(combo_instrument, order_id, state) invece di
push_user_instruction.
- Aggiunta migration 0002_audit_anchor.sql con last_audit_hash.
- Schema log JSONL: campi cycle e cycle_id propagati da
structlog.contextvars.
- Sezione "Audit log" descrive il formato concretamente in uso
(separatori | con prev_hash/hash) ed elenco eventi reali
(ENGINE_START, RECOVERY_DONE, ENTRY_PLACED, HOLD, EXIT_FILLED,
KILL_SWITCH_*, ALERT, KELLY_RECALIBRATED).
- Sezione backup riferita allo job APScheduler ora schedulato
(0 * * * *).
docs/07-risk-controls.md:
- Nuova tabella trigger automatici allineata al codice (column
"Implementato" punta ai moduli runtime/safety reali).
- Sezione "Single-instance lock" introdotta (fcntl.flock,
EngineLock, caveat multi-host).
- Sezione "Anti-truncation" che descrive il flusso anchor: callback
on_append → SQLite → check al boot.
- "Cap di rischio" estesa con i due nuovi filter dealer-gamma e
liquidation-heatmap (§2.8).
- Sezione "Versionamento config" cita execution.environment,
execution.eur_to_usd, dealer_gamma_min, dealer_gamma_filter_enabled,
liquidation_filter_enabled.
- Escalation tree concretizzata sull'AlertManager con i metodi
reali (low/medium/high/critical).
Test: 335 pass, 1 skip (sqlite3 CLI).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adriano