Gate 12 specification — signed Bot Worker Sidecar and Host Supervisor

[tonywxx]

Scope

This specification revalidates historical recovery child #137 against the reviewed current HEAD and defines the first remaining Gate 12 slice: the signed adaq-bot-worker Sidecar and its Host-owned supervision boundary. It does not implement Gate Parent #156 or the deployment/control workflow in #143.

Current-head facts

• Reviewed repository: tonywxx/adaq, commit 10b342e (fix(paper): add Paper Trading Workspace description to context).
• Gate 12 child [Paper Operations] Gate 12 child — Paper Trading Workspace and confirmed reconciliation #139 is closed with current-head Paper Trading Workspace evidence.
• adaq-bot-runtime currently provides DeploymentBundle, DecisionClock, RuntimeAttempt, lifecycle transitions, and target validation contracts, but no production Worker binary, IPC, process supervisor, signature verification, or Host integration.
• The repository has Factor, Model, and Strategy component WITs, but no Bot IPC WIT or Worker process boundary.
• Release and V1 acceptance matrices currently build and package macOS ARM64 (aarch64-apple-darwin) and Windows x86_64 (x86_64-pc-windows-msvc). Linux runtime catalog support does not make Linux Desktop/Worker release support.
• Existing OperationsStore persists bounded, redacted Operational Events and Worker health dimensions. Durable Bot Runtime Attempt and account/order correlation remain Gate 12 deployment/control work.

Domain decisions

• A Bot Worker is one isolated, prebuilt, versioned, signed Rust adaq-bot-worker child process for one active Trading Bot. Sidecar describes packaging; child process describes isolation.
• The Host Supervisor remains the sole authority for credentials, Provider access, market-data distribution, account reconciliation, reservations, hard Risk, OMS, Paper Execution Adapters, durable Bot Attempt records, operator controls, emergency actions, deadlines, and recovery.
• The Worker receives one verified immutable Deployment Bundle, immutable decision inputs, Decision Clock data, and only the read-only state required by the frozen pipeline. It evaluates the frozen Feature/Model/Strategy pipeline and returns candidate Strategy Targets and bounded diagnostics. The historical phrase that the Worker “receives targets” is superseded.
• The Host validates availability, scope, identity, freshness, Decision Deadline, and stale-target rules before any Target can reach Risk or OMS. A Worker never receives credentials, Provider Order APIs, account authority, or an order-submission capability.
• The Worker supports both existing Decision Clock forms (ClosedBar and ScheduledCrossSection) and both existing Strategy component worlds (strategy and portfolio-strategy). Missing, late, incomplete, or invalid inputs produce no new risk-increasing Target.
• Worker IPC is private, versioned, bounded newline-delimited JSON over child stdin/stdout. stderr is diagnostic-only. It uses a handshake, request identity, bounded frames, heartbeat, decision, target/no-target, fault, and shutdown messages. It is not a network service, public WIT, or remote-worker API.
• Worker identity is verified before launch using a dedicated Worker signing trust root, the exact platform binary hash, Bundle identity, platform tag, and protocol/runtime compatibility. The Worker signing key is separate from the Tauri Updater key; private signing material is never bundled or persisted as domain data.
• The Worker Runtime Policy is frozen in the Deployment Bundle. It covers protocol/frame bounds, startup and handshake deadlines, heartbeat interval/timeout, per-decision deadline, output bounds, and runtime resource limits. The implementation may inject small policies in tests, but the product has no user-editable policy UI.
• Worker faults, malformed or late output, missed heartbeat, parent loss, resource-limit breach, and replacement are fail-closed and enter retained Worker health/diagnostic evidence through the existing Operations boundary. There is no automatic return to Running.
• V1 Recovery R9 — Deliver the signed Bot Worker Sidecar and Host Supervisor #137 reuses adaq-bot-runtime, component SDK/WIT execution, Tauri Sidecar packaging, and OperationsStore. V1 Recovery R10 — Deliver Bot deployment, control, and recovery workflows #143 owns durable Bot Runtime Attempt persistence, OKX Paper binding, Risk/OMS, Start/Pause/Resume/Stop/Flatten, account recovery, and the bilingual operation surface.

Acceptance contract

• A prebuilt Rust adaq-bot-worker is produced, versioned, signed, and bundled for macOS ARM64 and Windows x86_64.
• The Host rejects an absent, wrong, malformed, unsigned, hash-mismatched, platform-incompatible, protocol-incompatible, or Bundle-incompatible Worker before launch.
• The bounded stdin/stdout protocol rejects oversized, malformed, duplicated, out-of-order, stale, and unknown messages with bounded diagnostics and no partial Target.
• The Worker verifies one immutable Deployment Bundle and evaluates the frozen Feature/Model/Strategy pipeline without credentials, Provider Order APIs, account authority, Risk authority, or OMS access.
• Both Decision Clock forms and both Strategy component worlds are covered by deterministic success and no-new-target tests.
• Startup, heartbeat, decision, and output limits are deterministic, frozen in the Bundle policy, and enforced by the Supervisor.
• Crash, hang, malformed output, missed heartbeat, deadline miss, parent loss, Worker replacement, and Host restart all block new risk and retain explicit evidence; no path automatically returns to Running.
• Worker health/fault/diagnostic evidence uses the existing Host Operations boundary without creating a parallel event store or taking ownership of durable Bot Attempt/account/order records.
• Automated checks and packaging/runtime evidence cover both declared Worker platforms. Packaged macOS Desktop smoke proves the bundled Worker can be located, verified, launched, and fail closed; no new React route or locale work is part of this slice.
• Release preflight confirms the User-owned version files and lockfile are consistent at 0.9.5; the existing version edits are preserved rather than reverted.
• English issue evidence records the reviewed commit, Worker artifact/hash/signature/platform/protocol identities, failure matrix, recovery result, and limitations without credentials or private paths.

Out of scope

• Bot deployment UI, Start/Pause/Resume/Stop/Flatten controls, durable Bot Runtime Attempt schema, OKX account/reconciliation integration, Risk, OMS, Paper order execution, or bilingual operation workflow.
• Cloud or remote Workers, Linux Desktop/Worker release support, Real Trading, generated per-Bot executables, arbitrary source compilation at deployment, or Worker pools.
• A public Bot WIT, network IPC, HTTP service, remote control API, or generic workflow/event store.
• Automatic recovery to Running, automatic retry, stale-target replay, unreviewed strategy switching, or credential/provider access in the Worker.
• Closing Gate Parent [Paper Operations] Gate 12 — Accept Paper Step 9: Prepare Account and Deploy Bot #156, accepting Gate 12, or granting Workflow Continuation Approval.

Ticketing

• A fresh implementation child created from this specification is the only /implement target for this slice.
• It is a child of Gate Parent [Paper Operations] Gate 12 — Accept Paper Step 9: Prepare Account and Deploy Bot #156 and replaces historical V1 Recovery R9 — Deliver the signed Bot Worker Sidecar and Host Supervisor #137 as the native prerequisite for V1 Recovery R10 — Deliver Bot deployment, control, and recovery workflows #143.
• Historical V1 Recovery R9 — Deliver the signed Bot Worker Sidecar and Host Supervisor #137 remains a planning record and is not implemented directly.

Source decisions

• ADR-0048: supervised prebuilt Worker and Host authority.
• ADR-0049: causal Closed-Bar and scheduled-batch decisions.
• ADR-0050: explicit fail-closed Bot Runtime Attempts.
• CONTEXT.md: Bot Supervisor, Bot Worker, Bot Deployment Bundle, Bot Runtime Attempt, Decision Schedule, and Target terminology.

[tonywxx]

Closure audit at current main HEAD 727ee6a: the signed Bot Worker Sidecar and Host Supervisor specification has been delivered by implementation child #190, which is CLOSED with its implementation and verification evidence. Gate Parent #156 is accepted and CLOSED. Historical #137 remains planning-only; the remaining deployment and control scope was delivered by #192. No implementation work remains in this specification issue.