feat(runtime): enforce the risk block instead of only recording it

[AetherAI3]

What this fixes

risk { ... } parsed, type-checked, reached the IR as a risk.limits node, and passed IR validation — and then did nothing. The trail ended at nano/runtime/vm.py, where a comment stated risk.limits "carries no series value" and stage 2 never looked at it again. The existence of a field in the IR was not evidence of enforcement.

Full path audited: lexer → parser → ast → checker → codegen → risk.limits in IR → module validation → VM → intents/log → bridge.

keyword	in IR before	enforced before	enforced now
max_daily_loss	yes	no	yes — risk.daily_loss
max_drawdown	yes	no	yes — risk.drawdown
max_orders_per_day	yes	no	yes — risk.orders_today
stop_trading_after_losses	yes	no	yes — risk.consecutive_losses
min_confidence	yes	no	yes — the intent's own confidence
max_position_size	yes	no	no, deliberately — logged risk.unenforced
max_open_positions	yes	no	no, deliberately — logged risk.unenforced

The two that are not enforced, and why

max_position_size cannot be made honest: a Nano intent carries action, asset and confidence, and no order size. The available approximation — refuse when the current size already exceeds the cap — permits an arbitrarily large overage on the very trade that causes it. That would put the words "max position size" on a control that does not bound position size.

max_open_positions fails differently. A host could supply risk.open_positions and Nano could compare it. But Nano cannot distinguish an opening trade from a closing one, so such a gate would also block the sell that closes a position and returns you under the cap. A cap that blocks the exit is worse than no cap.

Both still parse, range-check, and travel to the host inside risk.limits. The runtime logs risk.unenforced naming each and stating why. Documented in docs/status.md as a deliberate boundary, not a to-do.

Also refused: deriving a calendar day for max_orders_per_day. Epoch-seconds → day boundary needs a timezone convention, which would be invented semantics. The host maintains and reports risk.orders_today; Nano only compares.

Semantics, pinned rather than described

• Boundary — allowed band inclusive, breach strictly outside, tested with math.nextafter on both sides. stop_trading_after_losses 3 names the first unacceptable count, so the band is [0, 2].
• Missing values fail CLOSED — absent signal, None, non-numeric, bool, NaN, ±inf all breach. NaN compares false against every threshold and -inf sits below every threshold, so a naive observed > limit would wave through the two most dangerous inputs a gate can be handed.
• Units — fractions, never percent. max_daily_loss 2 is already a compile error.
• Measurement namespace — risk. prefix. A dot cannot appear in a Nano identifier, so the channel is unreachable from source and cannot collide with a feed signal.
• Multiple violations — logged in a fixed declaration order from a module-level tuple, never dict order. Pinned by a permuted-declaration-order test on raw IR.
• PAUSE and OBSERVE are never suppressed. A breaker that silences its own halt is worse than none. escalate is not gated either.
• No hidden state — the gate holds limits and the frame only. run_frames builds a fresh gate per frame.

Invariants

No new effect string, so KNOWN_EFFECTS, EFFECT_ORDER and moduleHash are unmoved. nano/bridge/** byte-untouched, so the DecisionGate seam is intact — suppression is strictly subtractive and recorded in the log; Nano gains no authority to act. stdlib only (math). No import cycle.

Baseline compatibility is byte-proven, not asserted: all 38 corpus strategies were compiled and executed on both trees, serializing IR hash plus the full run dict including every log entry — 243,137 bytes, diff identical.

Two behavior changes

1. A declared min_confidence beside an actuating intent that cannot carry a confidence (execute(), or a bare buy(X)/sell(X)) is now a compile-time NanoTypeError with line and column. Every such program proposed nothing at every input before this change; rejecting at the door is the honest surface. No corpus or library entry is affected.
2. validate_risk_limit requires a real int for counting limits, so a document carrying max_open_positions: 5.0 is now refused at load. The loader now matches what the compiler always did.

Both are documented in docs/language.md.

Verification

• 556 passed, 2 skipped on Python 3.11.9 and 3.13.14, rebased onto current main.
• 30/30 mutation campaign — every guard was broken in turn and the suite confirmed red, then restored. An independent reviewer ran its own 31 mutations and re-derived the result without using this lane's tooling.
• PYTHONHASHSEED 0 / 1 / 99999 / 424242 — identical results.
• Reviewed adversarially three times by a reviewer that did not write the patch; every finding closed and re-verified against the reviewer's original reproductions.

Rebase note

Rebased from 811d6c7 onto current main. Three additive conflicts resolved: the nano/runtime/__init__.py import block (upstream's SignalFrame kept alongside the risk exports) and the docs/status.md bridge row (this lane's corrected row kept, upstream's new Watchdog row kept beside it).

While rebasing, tests/test_watchdog.py::test_the_receipt_answers_the_four_questions failed with assert '1.0.1' == '1.0.0' — it hardcodes nano_version, so it would break on this and every future release. It now derives from nano.__version__, matching the fix applied to the CLI version test.

🤖 Generated with Claude Code