Vibe-Trading

📰 News

⚠️ Security warning: The X account VibeTrading_HKU, Virtuals project 101845, and token contract 0x640BDBF77b6447E8b7DB7894cED84BD1c40571f4 are not official Vibe-Trading assets. We have never launched or endorsed any token or memecoin. Do not buy, connect a wallet, or sign anything. Details.

• 2026-08-27 🛑 The kill-switch sweep now survives restarts and stops trusting a flaky broker: during a halt, the cancel-and-flatten sweep counted any broker response as success — but the MCP adapter turns a failed call into a {"status": "error"} envelope, so a dropped connection produced a compliant-looking audit trail while the resting order stayed live; error envelopes now fail closed in both passes (#1232). The sweep's fired-once latch also lived only in memory: a restart with flatten orders still working replayed the whole sweep — a fresh market order per position, enough to flip a long book net short; the latch is now persisted next to the HALT sentinel and bound to its halt episode, so clearing and re-tripping still re-arms it (#1233). New: every market's data-source fallback order is visible and reorderable in Settings → Data Source Priority — hot-applied, persisted per market (MARKET_DATA_ORDER_*), and strictly a reordering: adding or dropping sources is refused, and without an override the defaults are untouched (#1231); Binance USD-M reconciliation results now land as tamper-evident drift evidence artifacts — strict JSON, fail-closed on incomplete or unsupported snapshots, no order surface (#1230, toward #1030). Thanks @he-yufeng, @sambazhu, and @honginp!
• 2026-08-26 ♻️ A live Alpaca order that loses its broker response stops being a mystery, and gold backtests stop being frictionless: the order gate now durably owns every Alpaca submission before the broker write, recovers the outcome by exact client_order_id only, attributes fills against the signed position delta, and HALTs on any contradiction — recovery never resubmits (#1213, #1221, #1222). Fixed: metals used FX pip/lot conventions, making gold's spread ~1,460× too cheap and rounding positions under 1,000 oz to zero (#1226); Futu HKD holdings were valued as USD, overstated by roughly the USD/HKD rate (#1228); Shadow Account read PnL keys the runner never emits, so every successful backtest reported PnL = 0.00 (#1217); streamed LLM calls never requested usage, under-reporting swarm output tokens ~18–36× (#1225). New: opt-in read-only Binance USD-M account snapshots — two allowlisted signed reads, no order surface (#1229, toward #1030); portfolio OAuth reconnects run in a bounded subprocess that cannot strand the web process or the callback port (#1211). Thanks @Elfsa-Miranda, @P1Piyush, @JaxonHu1024, @he-yufeng, @honginp, and @goatyyc!
• 2026-08-25 🛡️ Two live-gate fail-opens closed, and purged CV stops wiping the training set between test blocks: Alpaca shorts booked as positive exposure (qty is a magnitude, direction lives in side), so selling more loosened max_total_exposure_usd instead of tightening it — quantity is now signed on both the TAP JSON and direct-SDK paths (#1209); OKX/Futu reads flattened a rejected API call into "empty book, status: ok", letting the mandate gate evaluate limits against nothing — they now return the error envelope the gate fails closed on (#1212). Both are Phase 0 of the audit roadmap in #1207. Fixed: combinatorial purged CV treated non-contiguous test blocks as one span, purging every training observation between them; segments now purge individually and an emptied fold raises (#1204); the credit-risk functions refuse NaN/inf inputs instead of returning NaN scores or a "grey" verdict (#1215, closes #1214). New: swarm workers retry with capped equal-jitter backoff (#1210, toward #1208), and vibe-trading --swarm-retry <run_id> / /swarm retry reruns a failed run, keeping completed tasks with --resume (#1194). Thanks @he-yufeng, @santhreal, @Robin1987China, @pengpengyi92, and @SiMinus!

• 2026-08-24 🔗 IBKR's official MCP goes from "lists tools" to a working read-only portfolio source, and scheduling gets an agent tool that cannot act alone: #1178 fixed the URL, but IBKR's gateway still rejected FastMCP's stock OAuth client registration before login. An IBKR-scoped OAuth provider — browser-profile headers, token_endpoint_auth_method: none, a stable callback port, and stale-registration recovery, applied only when the MCP host is api.ibkr.com — completes authorization (#1186), and the live-account-verified get_account_summary / get_account_positions tools now back the generic account/position reads, making ibkr-live-official-mcp-readonly an eligible /portfolio source (#1190, closes #1126). New: the agent sees exactly one scheduling tool, scheduled_research — its propose_create/propose_cancel never touch the job store until you confirm on the surface you are on (Web card, CLI y/N, or an exact confirm/确认 reply in IM), delivery targets are opaque operator-configured refs that never expose a raw chat/user id, and a job past its end_at expires instead of firing again (#1187). Fixed: the comps and three-st