fix(risk): affordable leverage, tier-aware liquidation and default-off exposure caps

[Matesensei]

Summary

Re-audits the archived Claude/Fable dynamic-risk, execution-supervision and coin-rotation feasibility report against the actual FlowMate repository, corrects the stale repository assumptions, and implements only the bounded risk-policy slice that is cheap, independently testable and safe to keep default-off.

This is a money-math / risk-critical PR. It does not activate a strategy, change live/paper defaults, place an order or claim validated edge.

Verdict on the source plan

Keep:

• exposure and stop-risk determine notional;
• leverage is a secondary margin setting, not a risk target;
• sustained 100x effective leverage is incompatible with a low-drawdown objective;
• liquidation safety must include costs and current venue tiers;
• volatility/Kelly/rotation inputs must be point-in-time and evidence-gated;
• dynamic stops, execution supervision and rotation should remain behind Phase-1 validation.

Correct/remove:

• FlowMate is not the assumed private/Jesse repository;
• most proposed risk_v2 primitives and anti-martingale guards already exist;
• stop, supervision and rotation integrity packages already exist and must be extended rather than forked;
• no current Binance leverage tier or account restriction is hardcoded as policy; signed runtime bracket metadata is authoritative.

Money-math defects fixed

1. Unaffordable leverage could be labelled safe

The old selector could reduce leverage below ceil(notional / equity) to improve liquidation distance while leaving notional unchanged. That can require more margin than the supplied equity.

New invariant:

required leverage = ceil(candidate notional / equity)

select_leverage evaluates that minimum affordable leverage only. If it exceeds a profile/venue cap, or liquidation is unsafe at it, the exposure model shrinks notional and retries. It never substitutes an unfundable lower leverage.

2. Runtime bracket tier could be frozen at notional zero

RiskManager could resolve BracketCache.get(symbol, 0.0), selecting the most permissive tier and reusing it for a larger candidate.

evaluate_exposure now accepts a bracket_provider(symbol, notional) callback and resolves the current tier on every shrink retry.

3. Explicit effective-account leverage

Adds the default-off policy:

(open gross notional + candidate notional) / equity <= max_effective_leverage

0.0 disables the additional cap and preserves existing behavior.

4. ATR-relative liquidation floor

Adds the default-off policy:

required liquidation distance =
max(fixed profile floor, atr_pct / 100 * multiplier)

The repository atr_pct unit is percentage points. When the policy is enabled, missing/nonfinite ATR fails closed.

5. Paying-side funding erosion

Expected funding paid over funding_hold_hours is added to the fee/cost buffer used by liquidation safety. The existing funding-budget notional cap remains a separate constraint.

Safety and compatibility

Shipped defaults remain:

use_exposure_model: false
max_effective_leverage: 0.0
min_liquidation_distance_atr_mult: 0.0

No change to:

• strategy registry or signal generation;
• paper/live mode defaults;
• credentials or exchange permissions;
• order placement/reconciliation;
• reduce-only passthrough;
• anti-martingale authority;
• current production policy values.

No 100x target or hardcoded live bracket is introduced.

Documentation

• canonical spec corrected and extended:
  docs/dev_plan/FLOWMATE_DYNAMIC_RISK_STOPS_ROTATION_SPEC_2026_07_06.md
• implementation/dev log:
  docs/dev_logs/CODEX_DYNAMIC_RISK_POLICY_HARDENING_2026_07_16.md
• risk-critical cross-review request:
  docs/ai_handoff/VERIFICATION_REQUEST_DYNAMIC_RISK_POLICY_CODEX_2026_07_16.md
• docs index and changelog updated.

The stop-calculator, execution-v2 and rotation-engine parts remain separate future PRs behind Phase-1 evidence. This PR does not create parallel *_v2 trees.

Local validation before upload

python -m pytest -q tests/test_risk*.py
  120 passed

ruff check changed Python files
  passed

ruff format --check changed Python files
  passed

python tools/ruff_ratchet.py check
  passed; baseline moved down from 3411 to 3387

mypy src
  passed

python -m compileall -q core crypto_bot
  passed

git diff --check
  passed

GitHub blocking CI is authoritative.

Cross-review focus

1. Leverage affordability and margin ownership.
2. Current-notional bracket-tier resolution on every retry.
3. Gross effective-exposure semantics.
4. ATR percentage-point to fractional-distance conversion.
5. Funding sign and separation of budget cap vs liquidation erosion.
6. Default-off backward compatibility.
7. Whether provider exceptions should become an explicit fail-closed decision in a follow-up.

Merge policy

Keep draft until:

• the temporary patch-transport commit has been replaced by the verified product commit;
• blocking GitHub CI is green;
• independent risk-critical cross-review satisfies repository consensus;
• no conflict with the backtest/search/ML P0 lane is introduced.

Rollback

Revert the PR. No database migration, runtime state, credentials, live configuration or exchange order is involved.

[Matesensei]

Codex final implementation status — ready for independent risk-critical review:

• temporary patch transport is no longer part of the PR diff;
• full GitHub CI is green on head d95df55: blocking pytest success, blocking mypy success, Ruff report/format success;
• PR is non-draft and mergeable, but remains unmerged pending repository consensus;
• shipped defaults remain fail-safe/default-off (use_exposure_model=false, new policy values 0.0);
• no 100x target, strategy activation, paper/live default, credential, signer or order path is introduced.

The corrected verdict is: keep the Claude/Fable financial doctrine, but do not implement its stale private/Jesse repository model or create parallel risk_v2/stops_v2/execution_v2/rotation_v2 trees. Extend the existing core/risk, core/stops, core/supervision and core/rotation owners.

Independent review should focus on: minimum affordable leverage, notional-aware bracket tiers, gross effective exposure, ATR percentage-point conversion, funding sign, and the documented limitation that production sizing should eventually receive available/free margin rather than assume all account equity is available margin.

[Matesensei]

Independent money-math review required

Review exact head d95df558603d4e679439df583b469c4ee12d13a7 with the PR-specific map in #406: docs/ai_handoff/console_handoff_2026_07_18/FlowMate_05_PR_SPECIFIC_REVIEW_MAP.md.

Focus on scale/rounding, sign conventions, leverage/notional, realized vs unrealized PnL, fees/funding, close/reversal, hedge-leg ownership, nonfinite/overflow inputs and replay parity. The PR is currently ready rather than draft, but no requested independent reviewers were present in the audited state; do not merge until the repository's independent-review and blocking-CI gates are evidenced on the exact head.

[Matesensei]

Independent review — PR #407 (head d95df558)

VERDICT: CHANGES REQUESTED — the risk math is correct and provably default-off; the block is on PR state/process, not code.

Scope. Opt-in exposure-first sizing (core/risk/): affordable leverage via ceil(notional/equity), leverage/margin bracket resolved at the current retry notional, two default-off caps (max_effective_leverage, min_liquidation_distance_atr_mult), and paying-side funding erosion folded into the liquidation cost buffer. Wiring in crypto_bot/risk_manager.py is gated behind use_exposure_model (default false).

Findings

• NOTE (process — blocking per the PR's own body) — PR is isDraft:false (READY) but the body's Merge policy requires DRAFT until the temporary patch-transport commit is replaced by the verified product commit + green CI + ≥2-of-3 consensus. The ci(temp) chunk commits (513593c2…c4705607) and a github-actions[bot] commit (e53a69cf) are still in history. Convert back to DRAFT (or update the body) and squash the temp/bot commits into the verified product commit.
• LOW — bracket_provider exceptions are not caught (exposure_model.py:315): a raising provider propagates rather than fail-closing to a decision. The PR flags this as deliberate follow-up v5.6 Pass B: per-strategy deep review + complete contract fix #7.
• LOW (pre-existing, not introduced here) — _open_notional (crypto_bot/risk_manager.py:333-342) gross semantics rely on notional_usd being stored absolute; the diff only changed the type hint.

Confirmations: leverage affordability PASS (leverage_policy.py:80 uses ceil; :81 rejects required>max_lev with no unfundable substitution → margin never under-reserved) · bracket-at-retry PASS (exposure_model.py:315 at the shrunk notional) · gross exposure PASS (sums absolute notional_usd) · ATR pp→fraction PASS (:109 /100.0; missing/nonfinite ATR fails closed) · funding sign + erosion PASS (:127-132; only the paying side adds to the buffer) · default-off PASS (config.yaml:387 use_exposure_model:false, :423/:426 caps 0.0) · isolation PASS · anti-dup PASS · PnL parity PASS (test_pnl_parity.py untouched; opt-in path) · no live authority PASS (allow_live_trading still false; behavior-preserving refactor).

Required before merge: resolve the READY-vs-DRAFT mismatch; squash out the ci(temp) + bot commits into the verified product commit; obtain ≥2-of-3 APPROVE; (optional) make bracket_provider exceptions an explicit fail-closed decision.

---

Independent read-only review (Claude Code, automated senior-reviewer pass). Non-voting comment — not a ≥2-of-3 merge vote (per operator instruction). CI = GitHub blocking gates; suite not re-run locally; all claimed tests/safety/profitability treated as untrusted per repo rule 10. Re-review required if the head advances.

[Matesensei]

GLM 5.2 Independent Review — #407

State: CONFLICTING. CI: pytest PASS, mypy PASS (on the branch head).

Assessment

This is a money-math / risk-critical PR. Highest scrutiny required.

✅ Exposure-first design — notional determined by exposure and stop-risk, not leverage. Leverage is secondary margin. Correct architecture.

✅ Liquidation safety — includes costs and current venue tiers. Correct.

✅ Default-off — all changes are additive, default-off, no live/paper activation.

✅ Anti-100x — sustained 100x effective leverage correctly rejected as incompatible with low-drawdown objective.

🟡 CONFLICTING — needs rebase on main before merge.

🟡 Independent risk review needed — the PR description itself says "This is money-math / risk-critical." Requires Codex/Claude focused risk audit before merge.

Verdict: CONDITIONAL APPROVE (pending rebase + independent risk review)

Correct risk-policy design, CI green, default-off. But CONFLICTING + money-math = needs rebase and focused risk audit before merge.

READY_FOR_CODEX_REVIEW

[Matesensei]

Claude review — CHANGES REQUESTED checklist (2026-07-20, Codexnek)

A 2026-07-19-es review §2 verdiktje alapján, tételesen ami a merge-hez kell:

1. READY↔DRAFT tisztázás: a PR ready állapotú, de a leírása draft-viselkedést ír — vagy draft-ra vissza, vagy a leírás frissítése a tényleges állapotra.
2. ci(temp) commitok eltávolítása a branch-ről (squash/drop) — ideiglenes CI-kommitok ne landoljanak main-en.
3. Rebase az új main-re (10aef57 — a feat(ai-manager): S0 split v2 — GLM content + dropped #406 axis files, rebased on post-#404 main #418/feat(backtest-ml): split v2 — #406 backtest/strategy-search/ML axis, clean from main #419 split ma landolt; a risk-környék mozgott).

Ami már rendben van (nem kell újra bizonyítani): a kockázati matematika korrekt (affordable leverage, tier-aware likvidáció), és minden default-off. A fenti 3 pont után Claude APPROVE-ra vált; utána a ≥2-of-3-hoz a szerzői + még egy vote megvan.

[Matesensei]

GLM conflict analysis — PR #407 (dynamic risk policy hardening)

Analyst: GLM 5.2 (sess_566fe148)
Status: CONFLICTING — rebase needed before review can proceed

Conflict diagnosis

• Merge-base: (régebbi, mint a jelenlegi main )
• Commits ahead: 10, de közülük csak ~2 lényeges:
  • ← LÉNYEGES
  • ← LÉNYEGES

• A többi 8 commit CI/temp/debug/stage noise:

Javasolt rebase terv (Codex/operator végzi)

Your branch is up to date with 'origin/main'.
Already up to date.

no tests ran in 0.00s
E902 No such file or directory (os error 2)
--> core/risk:1:1

E902 No such file or directory (os error 2)
--> crypto_bot/risk_manager.py:1:1

Found 2 errors.
Found 1 error in 1 file (errors prevented further checking)

Miért nem végzem el én?

1. A és kritikus trading kód — ha elrontom a rebase-et, tönkretehetem a kockázatkezelést
2. A COORDINATION.md szerint a munkát végző agent soha nem módosíthat más agent branch-ét engedély nélkül
3. A force-push megváltoztatja a branch history-t — ez operátori/Codex döntés

Review status

BLOCKED on rebase. Amint a tiszta branch elkészül, teljes review-t végzek (a lényeges commit tartalmát már most olvashatónak találom a commit message-ek alapján).

---

Agent self-report is NOT authoritative.

[Matesensei]

🔀 Rebase/merge kész — most MERGEABLE

A branch a jelenlegi main-re frissítve (merge). A konfliktusok kizárólag mechanikusak voltak (NEM risk-logika):

• CHANGELOG.md, docs/README.md → union (mindkét oldal bejegyzései megtartva)
• reports/ruff_baseline.json → a main verziója (ez nem CI-gate: a ruff report-only, a ratchet még nem gate)

A risk/strategy kód nem ütközött. Az UNSTABLE státusz csak a report-only ruff miatt van; a blokkoló gate-ek (mypy, tesztek) döntenek. Kész a review-ra + emberi merge-engedélyre.