fix grid accounting and secure dependencies

Author: Henry

backend_api_python/app/services/strategy_v2/runtime.py

@@ -65,6 +65,28 @@ def _position_key(symbol: object, position_side: object = "") -> str:
     return f"{base}::{side}" if side else base
 
 
+def _grid_order_identity(client_order_id: object) -> tuple[int, str, str, int] | None:
+    """Return the stable grid-cell identity encoded by the V2 robot template."""
+    parts = str(client_order_id or "").strip().split("-")
+    if len(parts) != 5 or parts[0] != "grid":
+        return None
+    try:
+        cell_index = int(parts[1])
+        cycle = int(parts[4])
+    except (TypeError, ValueError):
+        return None
+    position_side = _normalize_position_side(parts[2])
+    phase = str(parts[3] or "").strip().lower()
+    if (
+        cell_index < 0
+        or cycle < 1
+        or not position_side
+        or phase not in {"entry", "exit"}
+    ):
+        return None
+    return cell_index, position_side, phase, cycle
+
+
 def _snapshot_state_value(value: Any) -> Any:
     if isinstance(value, pd.Timestamp):
         return {
@@ -597,6 +619,7 @@ def __init__(
         self.executions: list[dict[str, Any]] = []
         self.closed_trades: list[dict[str, Any]] = []
         self._entries: dict[str, dict[str, Any]] = {}
+        self._grid_entries: dict[str, dict[str, Any]] = {}
         self._protections: dict[str, ProtectionState] = {}
         self.protection_events: list[dict[str, Any]] = []
         self.order_ledger: list[dict[str, Any]] = []
@@ -814,6 +837,7 @@ def execute(
                 "commission": fee,
                 "balance": self.portfolio.total_value,
                 "reason": order.reason,
+                "client_order_id": str(order.client_order_id or ""),
                 "signal_time": _backtest_time_iso(order.signal_time if order.signal_time is not None else timestamp),
                 "fill_reference": fill_reference,
                 "reference_price": open_price,
@@ -1279,14 +1303,19 @@ def _record_closed_trade(
             entry_quantity = max(float(entry.get("quantity") or 0.0), closing_quantity)
             entry_fee = float(entry.get("commission") or 0.0) * closing_quantity / entry_quantity
             direction = 1.0 if old_amount > 0 else -1.0
-            gross_profit = (float(execution["price"]) - float(entry.get("price") or old_cost)) * closing_quantity * direction
+            gross_profit = (
+                float(execution["price"]) - float(entry.get("price") or old_cost)
+            ) * closing_quantity * direction
             profit = gross_profit - entry_fee - close_fee
-            self.closed_trades.append({
+            account_entry_price = float(entry.get("price") or old_cost)
+            account_entry_time = str(entry.get("time") or execution["time"])
+            grid_match = self._consume_grid_entry(execution, closing_quantity, close_fee)
+            trade = {
                 "symbol": symbol,
                 "side": str(entry.get("side") or ("long" if old_amount > 0 else "short")),
-                "entry_time": str(entry.get("time") or execution["time"]),
+                "entry_time": account_entry_time,
                 "exit_time": str(execution["time"]),
-                "entry_price": float(entry.get("price") or old_cost),
+                "entry_price": account_entry_price,
                 "exit_price": float(execution["price"]),
                 "quantity": closing_quantity,
                 "amount": closing_quantity,
@@ -1297,7 +1326,27 @@ def _record_closed_trade(
                 "commission": entry_fee + close_fee,
                 "balance": float(execution.get("balance") or 0.0),
                 "close_reason": str(execution.get("reason") or "strategy"),
-            })
+                "profit_basis": "account_average",
+            }
+            if grid_match is not None:
+                trade.update({
+                    "entry_time": grid_match["entry_time"],
+                    "entry_price": grid_match["entry_price"],
+                    "gross_profit": grid_match["gross_profit"],
+                    "entry_commission": grid_match["entry_commission"],
+                    "commission": grid_match["commission"],
+                    "profit": grid_match["profit"],
+                    "matched_entry_price": grid_match["entry_price"],
+                    "grid_matched_profit": grid_match["profit"],
+                    "grid_cell_index": grid_match["cell_index"],
+                    "grid_cycle": grid_match["cycle"],
+                    "profit_basis": "grid_cell",
+                    "account_entry_time": account_entry_time,
+                    "account_avg_entry_price": account_entry_price,
+                    "account_gross_profit": gross_profit,
+                    "account_realized_profit": profit,
+                })
+            self.closed_trades.append(trade)
             remaining = max(0.0, entry_quantity - closing_quantity)
             if remaining > 1e-12 and old_amount * target_amount >= 0:
                 entry["quantity"] = remaining
@@ -1326,6 +1375,90 @@ def _record_closed_trade(
                     "commission": open_fee,
                     "side": opening_side,
                 }
+            self._record_grid_entry(execution, opening_quantity, open_fee)
+
+    @staticmethod
+    def _grid_entry_key(
+        position_key: str,
+        identity: tuple[int, str, str, int],
+    ) -> str:
+        cell_index, position_side, _, cycle = identity
+        return f"{position_key}|{cell_index}|{position_side}|{cycle}"
+
+    def _record_grid_entry(
+        self,
+        execution: Mapping[str, Any],
+        quantity: float,
+        commission: float,
+    ) -> None:
+        identity = _grid_order_identity(execution.get("client_order_id"))
+        if identity is None or identity[2] != "entry" or quantity <= 1e-12:
+            return
+        position_key = str(execution.get("position_key") or execution.get("symbol") or "")
+        key = self._grid_entry_key(position_key, identity)
+        current = self._grid_entries.get(key)
+        if current is None:
+            self._grid_entries[key] = {
+                "cell_index": identity[0],
+                "position_side": identity[1],
+                "cycle": identity[3],
+                "entry_time": str(execution.get("time") or ""),
+                "entry_price": float(execution.get("price") or 0.0),
+                "quantity": float(quantity),
+                "commission": float(commission),
+            }
+            return
+        previous_quantity = float(current.get("quantity") or 0.0)
+        combined_quantity = previous_quantity + float(quantity)
+        if combined_quantity <= 1e-12:
+            return
+        current["entry_price"] = (
+            float(current.get("entry_price") or 0.0) * previous_quantity
+            + float(execution.get("price") or 0.0) * float(quantity)
+        ) / combined_quantity
+        current["quantity"] = combined_quantity
+        current["commission"] = float(current.get("commission") or 0.0) + float(commission)
+
+    def _consume_grid_entry(
+        self,
+        execution: Mapping[str, Any],
+        closing_quantity: float,
+        close_commission: float,
+    ) -> dict[str, Any] | None:
+        identity = _grid_order_identity(execution.get("client_order_id"))
+        if identity is None or identity[2] != "exit" or closing_quantity <= 1e-12:
+            return None
+        position_key = str(execution.get("position_key") or execution.get("symbol") or "")
+        key = self._grid_entry_key(position_key, identity)
+        entry = self._grid_entries.get(key)
+        available = float((entry or {}).get("quantity") or 0.0)
+        if entry is None or available + 1e-10 < closing_quantity:
+            return None
+
+        entry_commission_total = float(entry.get("commission") or 0.0)
+        entry_commission = entry_commission_total * closing_quantity / max(available, 1e-12)
+        remaining = max(0.0, available - closing_quantity)
+        if remaining <= 1e-12:
+            self._grid_entries.pop(key, None)
+        else:
+            entry["quantity"] = remaining
+            entry["commission"] = max(0.0, entry_commission_total - entry_commission)
+
+        entry_price = float(entry.get("entry_price") or 0.0)
+        exit_price = float(execution.get("price") or 0.0)
+        direction = 1.0 if identity[1] == "long" else -1.0
+        gross_profit = (exit_price - entry_price) * closing_quantity * direction
+        commission = entry_commission + float(close_commission)
+        return {
+            "cell_index": identity[0],
+            "cycle": identity[3],
+            "entry_time": str(entry.get("entry_time") or execution.get("time") or ""),
+            "entry_price": entry_price,
+            "entry_commission": entry_commission,
+            "commission": commission,
+            "gross_profit": gross_profit,
+            "profit": gross_profit - commission,
+        }
 
 
 class StrategyV2BacktestRunner:
@@ -1591,6 +1724,19 @@ def _result(self) -> dict[str, Any]:
         closed_trades = list(self.broker.closed_trades)
         executions = list(self.broker.executions)
         profits = [float(item.get("profit") or 0.0) for item in closed_trades]
+        account_realized_profits = [
+            float(
+                item.get("account_realized_profit")
+                if item.get("account_realized_profit") is not None
+                else item.get("profit") or 0.0
+            )
+            for item in closed_trades
+        ]
+        grid_matched_profits = [
+            float(item.get("grid_matched_profit") or 0.0)
+            for item in closed_trades
+            if item.get("profit_basis") == "grid_cell"
+        ]
         wins = [value for value in profits if value > 0]
         losses = [value for value in profits if value < 0]
         returns = pd.Series(values, dtype="float64").pct_change().dropna() if values else pd.Series(dtype="float64")
@@ -1677,6 +1823,14 @@ def _result(self) -> dict[str, Any]:
             "worstTrade": min(profits) if profits else 0.0,
             "avgTrade": average_profit,
             "averageProfit": average_profit,
+            "accountRealizedProfit": sum(account_realized_profits),
+            "gridMatchedProfit": sum(grid_matched_profits),
+            "gridMatchedTradeCount": len(grid_matched_profits),
+            "tradeProfitBasis": (
+                "grid_cell_when_available"
+                if grid_matched_profits
+                else "account_average"
+            ),
             "totalProfit": final - initial,
             "sharpeRatio": sharpe_ratio,
             "annualizedReturn": annualized_return,
@@ -1713,7 +1867,14 @@ def _attribution(self, initial: float) -> dict[str, Any]:
             commission_by_symbol[symbol] = commission_by_symbol.get(symbol, 0.0) + float(execution.get("commission") or 0.0)
         for trade in self.broker.closed_trades:
             symbol = str(trade.get("symbol") or "")
-            realized_by_symbol[symbol] = realized_by_symbol.get(symbol, 0.0) + float(trade.get("profit") or 0.0)
+            account_profit = (
+                trade.get("account_realized_profit")
+                if trade.get("account_realized_profit") is not None
+                else trade.get("profit")
+            )
+            realized_by_symbol[symbol] = (
+                realized_by_symbol.get(symbol, 0.0) + float(account_profit or 0.0)
+            )
         rows = []
         for symbol in sorted(set(commission_by_symbol) | set(realized_by_symbol) | set(self.broker.portfolio.positions)):
             position = self.broker.portfolio.positions.get(symbol)

backend_api_python/requirements.lock

@@ -1,7 +1,7 @@
 # Generated from requirements.txt for the verified Python 3.12 Linux production image.
 # Regenerate and validate this file whenever direct production requirements change.
 aiohappyeyeballs==2.7.1
-aiohttp==3.14.1
+aiohttp==3.14.3
 aiohttp-fast-zlib==0.3.0
 aiosignal==1.4.0
 akracer==0.0.14
@@ -17,7 +17,7 @@ beautifulsoup4==4.15.0
 billiard==4.2.4
 blinker==1.9.0
 build==1.5.0
-ccxt==4.5.70
+ccxt==4.5.73
 celery==5.6.3
 certifi==2026.6.17
 cffi==2.0.0
@@ -27,7 +27,7 @@ click-didyoumean==0.3.1
 click-plugins==1.1.1.2
 click-repl==0.3.0
 coincurve==21.0.0
-cryptography==49.0.0
+cryptography==50.0.0
 curl-cffi==0.15.0
 decorator==5.3.1
 distro==1.9.0
@@ -92,7 +92,7 @@ pygments==2.20.0
 pyjwt==2.13.0
 pyluach==2.3.0
 pyotp==2.10.0
-pypdf==6.14.2
+pypdf==6.15.0
 pyproject-hooks==1.2.0
 pysocks==1.7.1
 python-dateutil==2.9.0.post0

backend_api_python/requirements.txt

@@ -4,23 +4,28 @@ Werkzeug>=3.1.8
 flask-cors==6.0.5
 finnhub-python>=2.4.29
 yfinance>=1.5.2
-ccxt>=4.5.69
+ccxt>=4.5.73
+# GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and
+# GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+
+aiohttp>=3.14.3,<3.15
 pandas>=3.0.5
 # Strategy API V2 technical indicator runtime. The 0.6.x wheels bundle the C library.
 TA-Lib==0.7.1
 exchange-calendars>=4.13.2,<5
 requests>=2.34.2
 websocket-client>=1.9.0,<2
 litellm>=1.93.0,<1.94
-# ccxt 4.5.69/4.5.70 pins certifi==2026.6.17. Keep the direct floor
+# ccxt 4.5.73 pins certifi==2026.6.17. Keep the direct floor
 # aligned with the exchange client until ccxt relaxes its constraint.
 certifi>=2026.6.17
 PySocks>=1.7.1
 akshare>=1.18.80
 # GHSA-752w-5fwx-jx9f (crit header); 2.12.0+
 PyJWT>=2.13.0,<3
 python-dotenv>=1.2.2
-cryptography>=49.0.0
+# GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+
+# ccxt 4.5.73 currently constrains cryptography to the 50.x release line.
+cryptography>=50.0.0,<51
 # TOTP MFA and QR code generation
 pyotp>=2.10.0
 qrcode[pil]>=8.2
@@ -41,7 +46,8 @@ flask-smorest>=0.47.0,<0.48
 marshmallow>=4.3.0,<5
 PyYAML>=6.0.3
 # Server-side PDF export for AI analysis reports
-pypdf>=6.14.2,<7
+# GHSA-fp3f-mc75-235c / GHSA-fwg2-594c-jp42 (unbounded PDF resource use); 6.15.0+
+pypdf>=6.15.0,<7
 reportlab>=5.0.0
 # Password hashing
 bcrypt>=5.0.0