2026-08-04 🔧 Correctness pass: fundamentals, A-share prices, oversized results: SEC reporting periods are now keyed on their (start, end) span — a 10-Q files the true quarter and the year-to-date frame under the same end date and fiscal period, so period="annual" had been returning a single quarter for AAPL FY2018–2020 (a 4.2× understatement) and every fiscal-Q4 slot in a quarterly series carried the full-year figure; get_fundamentals("AAPL.US") no longer answers ok:true with an all-null panel. Tushare A-share prices are now corporate-action adjusted in both the factor bench and backtests — a raw close-to-close return across an ex-date was off by up to 47 percentage points (300750.SZ, 2023-04-26) — and the CSI300 bench masks each date to its point-in-time index membership. Cross-market composite backtests refuse a mixed-currency code set instead of summing CNY, USD and KRW into one equity curve; option legs are marked at the volatility they were opened at, removing a fabricated day-zero P&L of up to +93% of premium; oversized tool results are paged by whole record with an explicit total instead of being cut mid-JSON; and calc_metrics reports tracking error and benchmark beta.

2026-08-03 ⏰ Timezone-aware scheduled research + unblocked stock screening: Scheduled jobs now take an optional IANA timezone and evaluate cron on that zone's wall clock, so a cadence survives DST — a spring-forward gap is skipped and a fall-back ambiguous time runs once — while cron fields gain comma lists and ranges (1,3-5), jobs without a timezone keep UTC semantics, and the web UI gains a Scheduled page in all five locales where it previously had no scheduling surface at all (#954, closes #953, thanks @ngoanpv). A screening request no longer dead-ends: a many-candidate shortlist counts as an answer rather than a stalled resolution and retires once a candidate is locked, and price validation stops reading ticker digits, localized dates, share counts, and position costs as quoted prices — while still refusing any quote outside recorded OHLC evidence (closes #955). Agent memory also gets exact index-anchor matching and a respected result bound (#956, #957, thanks @santhreal).

2026-08-02 🧠 Live model discovery, truthful runtime identity, and a verified dependency refresh: Settings now discovers configured-provider models on demand with stable warning codes and five-locale controls, while each reply records and reloads the immutable provider/model/reasoning identity that actually served it—cleared safely when sessions change (#924, thanks @QCYTSN). Nine hash-locked Python updates plus jsdom/postcss also landed with exact-version imports, 330 focused tests, the production build, 373 frontend tests, full main CI, and Dependency Graph green (#949, #948); the breaking MCP 2.0 bump remains unmerged pending a complete lock/runtime migration (#950).

2026-08-01 🧮 Options strategy analytics + market sentiment + auditable USD-M research: A new options payoff workflow analytically calculates expiry P&L extrema, exact breakevens—including continuous zero-P&L intervals—engine-aligned entry commissions, and spot × IV scenarios through Agent and MCP (#946, rebuilt from #883, thanks @he-yufeng). The read-only sentiment tool scores arbitrary text locally and retrieves the crypto Fear & Greed Index without an API key (#939, thanks @Robin1987China). Strict USD-M backtests now persist ordered fill, funding, risk, and liquidation events plus a fidelity summary, while rejecting unsupported 100× intervals (#936, thanks @honginp). Reliability improvements also ensure symbol and venue resolution precedes market-data calls, final quoted prices are checked against recorded OHLC evidence, scheduled research retries transient failures, and nested MCP results serialize cleanly.

2026-07-31 🔧 USD-M liquidation lifecycle + technical indicators + user-level state dirs: Opt-in perpetual_strict mode settles historical funding before fills and executes isolated/cross margin breaches as real liquidations (#903, thanks @honginp). A read-only technical_indicators tool computes RSI/MACD/Bollinger/SMA/EMA through the existing loaders (#921, refs #920, thanks @Robin1987China). Sessions, runs, swarm runs, and uploads now live under ~/.vibe-trading (relocatable via VIBE_TRADING_HOME) with a one-time automatic migration (#925, closes #904, thanks @MuggleJinx). Plus ten correctness fixes — Yahoo .SS classified as A-share, bare/prefix-style A-share codes, slash-delimited crypto pairs, nan/inf guards (#919, #926–#935, thanks @santhreal).

2026-07-30 🎨 Rebuilt WebUI + Korea (KRX) market + an OpenBB Workspace bridge: The web UI lands its guided-minimalism overhaul — no first-frame flash, one durable activity object per turn with a live reasoning whisper and a reload-safe tool trail, LLM-written session titles, full five-locale parity. Korea equity (KRX: KOSPI/KOSDAQ) becomes the 9th backtest engine — execution-time ±30% band, long-only, 2026 0.20% transaction tax, optional pykrx loader (#693, thanks @JungHoonGhae) — plus an OpenBB Workspace bridge (#817, thanks @shugaoye) and a read-only Taiwan snapshot tool (#848, thanks @TSENGCHIENFENG). Correctness: daily price bands are judged at execution time, not from the decision bar's close; a session runs one attempt at a time (HTTP 409) and a user stop is its own terminal state (#676, thanks @tyj147454413-cmd). Plus durable traces (#662), secret-scrubbed tool results (#675), fail-closed tool arguments (#913/#911, thanks @santhreal), direct-OpenAI reasoning_effort (#755, thanks @1anter), and numeric guards across the risk x-ray / edge density / options engine (#909/#908/#907).

2026-07-29 🔧 Gap-safe returns + liquidation risk modeling + a risk x-ray in every run: bar_returns no longer erases the real move across a trading halt longer than the forward-fill window — the resumption move was silently recorded as 0, understating volatility and inflating Sharpe — and an inf prior price can no longer read as a clean −100% (#895, thanks @darkknight4563). Annualisation now covers all 24 data sources at every interval, with a coverage test that fails CI when a loader lands without entries (#891, closes #884, thanks @Robin1987China). USD-M perpetual research gains deterministic isolated & cross margin liquidation evaluation (#889, thanks @honginp), and every portfolio backtest now emits risk x-ray artifacts (risk_xray.json/.md) with headline concentration/vol/drawdown metrics (#900, thanks @he-yufeng). The connector CLI now loads ~/.vibe-trading/.env, so env-sourced broker credentials resolve again (#902, closes #901, thanks @MuggleJinx). Plus indent-preserving channel message splits and skill-frontmatter parsing at EOF (#867/#861, thanks @santhreal).

2026-07-28 🔧 Next-gen Claude models unblocked + sign-safe returns: Claude models that deprecate the temperature field (opus-4-7, opus-5, sonnet-5) now work — the adapter drops the field when the API rejects it, retries once, and remembers the model, so no per-release patch is needed (#890, closes #856, thanks @yagnikpipaliya). Non-interactive vibe-trading run now injects a host session id: research-goal tools previously failed on every call while the run still reported success (#885). Buy-and-hold returns are sign-safe — a near-zero prior close no longer explodes the compounded benchmark, and an exact-zero close no longer yields inf/nan (#872, thanks @darkknight4563). The frontend moves to Node 22 + React Router 8, clearing a high-severity advisory.

2026-07-27 🔧 Correlation integrity + vn.py 4.0 export repair + an encoding batch: The rolling correlation matrix no longer forward-fills missing closes — a halted session was being scored as a fabricated 0% return against the peer's real move, distorting the matrix (#873, thanks @ddy4633). The vn.py export skill is repaired for the vn.py 4.x layout, where vnpy.app.cta_strategy no longer exists upstream — templates now import from vnpy_ctastrategy (#869, thanks @y85998607). Plus a six-fix batch: UTF-16 BOM decoding in the document reader and trade-journal CSVs, currency symbols stripped before numeric coercion, BTCUSDT-style symbols inferred as crypto, lowercase 1h/1d intervals annualized correctly, and CJK characters preserved in skill directory slugs (#862, #863, #864, #865, #866, #868, thanks @santhreal).

2026-07-26 🔒 Dependency lock + universe transparency: Docker’s hash-locked install works again, with a new CI lock check (#858, closes #847). alpha bench now discloses CSI300/SP500 sources, counts, degraded fallbacks, and survivorship bias (#859, closes #845). Actions and five frontend dependencies were also refreshed (#850–#852).

2026-07-25 🔧 Perpetual realism + MCP crash fix + a correctness batch: USD-M perpetuals gain margin state contracts (#798, thanks @honginp) and the engine now consumes historical funding rates instead of fetching-and-ignoring them (#819, thanks @g0rdonL). MCP dataclass results no longer crash on a false Circular reference detected (#849, thanks @Echoandelementwebsites), and alpha bench CLI/HTML forward the _meta survivorship disclosure (#841, closes #797, thanks @AmirF194). Plus 12 correctness fixes across journals, connectors, and channels (#799–#810, thanks @santhreal), and a real account label in CLI balances (#843, closes #846, thanks @Robin1987China).

2026-07-24 🔀 Memory Tier 2, composable optimizer constraints + an interval-handling sweep: Persistent memory gains Tier 2 structural organization (#815, thanks @shadowinlife), and backtest optimizers accept composable weight constraints (#818, thanks @he-yufeng). Correctness: the daily-bar validator can opt in to non-positive prices — opening on negative bars while still rejecting zero (#816, closes #571, thanks @darkknight4563). Plus a 19-PR loader interval-normalization sweep: lowercase 1h/4h/1d/1w aliases accepted everywhere, unsupported intervals now fail fast instead of silently returning daily bars, Yahoo 4H maps to 1h, and MT5 accepts 1W/1M (#812–#838, thanks @santhreal), a trade-journal fix for Eastmoney Excel-serial dates (#811, thanks @santhreal), and a README nav-anchor fix (#840, thanks @dvirarad).

2026-07-23 🔧 Reliability sweep + strict alpha-bench surfaced + opt-in memory lifecycle: A 22-PR contributor batch. A broad reliability sweep fixes timeframe handling end to end — yfinance 1M→monthly (not minute), CCXT 1W/1M, akshare/india-broker rejecting unsupported intervals instead of silent daily, and the Tiger/Alpaca/OKX/Shoonya/Longbridge connectors keeping 1H/4H as hour bars — plus trade-journal Excel-date normalization (eastmoney float YYYYMMDD, Futu/Tonghuashun serial dates), finite-JSON report_audit, blank holding_days validation, and Feishu/CLI markdown table edges (#778–#794, thanks @santhreal). MT5 trading_history now coerces numpy scalars so JSON serialization no longer dies on int64 (#776, closes #774, thanks @shadowinlife), and PIT fundamentals dedup restated rows and stop the snapshot regressing to an older fiscal period on a late restatement (#772, closes #771, thanks @klmtseng). New: alpha bench --strict finally wires the strict same-universe random-control + OOS gate that shipped unreachable since 0.1.9 (#796, closes #773, thanks @he-yufeng), an opt-in memory lifecycle (quality scoring, Ebbinghaus decay, archive-only GC — all off by default) (#733, closes #732, thanks @shadowinlife), and backtest rebalance-notes artifacts + turnover metrics (#795, thanks @he-yufeng).

2026-07-22 🚀 v0.1.12 released (Release notes, pip install -U vibe-trading-ai): The correlation regime timeline adds a GET /correlation/regime endpoint + an opt-in Correlation-tab strip — edge density run through a causal hysteresis state machine that marks FUSED market episodes, descriptive risk context rather than a signal (#756, closes #719, thanks @ebujinovch). Provider endpoint resolution now falls back to each provider's canonical base URL and gracefully handles non-SSE endpoints, fixing the native zai provider on glm-5.1 (#758). Plus a strict-JSON / finite-number reliability sweep across metrics, factors, pattern, session, and journal (#761–#770, thanks @santhreal) and a Binance maintenance-bracket decouple that keeps -PERP backtests zero-credential (#757, thanks @honginp). Rolls up ~90 fixes since 0.1.11.

2026-07-21 🔧 Data-loader completeness + a reliability fix sweep: Partial market-data results now complete the missing symbols through the fallback chain and fail closed instead of silently shrinking the backtest universe (#689, closes #681, thanks @xkam7ar), and OKX bars use the history-candles endpoint with rate-limit retry for deep backfills (#644, thanks @tyj147454413-cmd). Plus a fix sweep: the MCP network guard accepts IPv6 / case-variant hosts (#750, thanks @Robin1987China), trade-journal parsers skip blank/NaN symbol rows (#749, thanks @Robin1987China), the Shadow Account skips the mined entry-hour gate on daily bars (#748, thanks @Robin1987China), and MiniMax regional API endpoints are selectable (#731, thanks @octo-patch).

2026-07-20 🔀 Providers, MetaTrader 5, and a reliability sweep: Native Anthropic Messages API (optional [anthropic] extra, #695, thanks @jelech), SiliconFlow (#565, thanks @UNHNQ), and iFlytek Spark (#537, thanks @FenjuFu) join the provider roster, and a MetaTrader 5 (Exness) broker connector + mt5 forex/metal data source lands (broker connectors → 12, #481, thanks @StaniellG). Plus a provider-agnostic llm-vision OCR engine (#548, thanks @shadowinlife), an 80× signal-alignment vectorization (#698, thanks @shadowinlife), historical Binance USD-M funding/bracket data (#716, thanks @honginp), a swarm MCP-discovery cache (#704), and a reliability consolidation closing 13 SSE/session/CLI/swarm/scheduler issues (#584, thanks @xkam7ar). Correctness: options partial-close now honors the requested quantity instead of flattening the lot (#577), centralized provider credential resolution (#563), queued-cancel handling (#641), a frontend streaming-DOM race (#717, thanks @Marnie0415), and the connector CLI renderers (#726, thanks @nareshkps).

2026-07-19 🔧 Real US/HK stock-news articles + MCP factor-analysis fix + a robustness pass: The stock-news tool now returns real Yahoo Finance articles (title/url/source/published/snippet) for US and HK tickers instead of related-instrument matches, still routed through the frozen IP-throttled client (#730, thanks @yxhuang). The MCP factor_analysis tool is realigned to the registered tool's real CSV contract, so calls no longer die on KeyError before running (#715, closes #635, thanks @Robin1987China). Plus a robustness pass: the whole Kimi K-series (k2/k3/…/for-coding) now auto-forces temperature=1 as the API requires (#701, thanks @sambazhu), and split_message, PDF page ranges, and trade-journal date filters all fail fast on degenerate or inverted input instead of hanging or silently returning nothing (#727–#729, thanks @santhreal).

2026-07-18 🔧 Binance crypto fallback + parallel-execution and correctness fixes: A Binance loader joins the crypto historical-data fallback chain (#643, thanks @tyj147454413-cmd), and the IBKR connector moves to a thread-local connection pool with snapshot quotes, fixing hangs under parallel agent runs (#636, thanks @MikeCer). Plus a correctness pass: factor analysis rejects non-positive n_groups, inverted period ranges and non-positive detection windows fail fast, an unnamed DatetimeIndex in the correlation matrix is handled, equity.csv nav/value column aliases are accepted, and empty A-share codes are no longer coerced to 000000.SZ (#709–#714, thanks @santhreal). A correlation-rewiring stability factor joins the academic zoo (#705, thanks @ebujinovch), the fundamental zoo is whitelisted for factor analysis (#707, thanks @sambazhu), persisted run state is now fsync-durable (#645, thanks @tyj147454413-cmd), and the dev extra installs the documented Black/Ruff toolchain (#634, thanks @xkam7ar).

2026-07-17 🧩 Correlation-regime skill + a broad backtest / data / live-safety correctness pass: a new correlation-regime detection skill (bundled skills → 88, #557, thanks @ebujinovch), a Longbridge runtime connection card (#569, thanks @fanfpy), and user-defined swarm presets loaded from ~/.vibe-trading (#570, thanks @darkknight4563). Plus hardening across the stack: silent-data-corruption fixes in the Futu / Tencent / CCXT / mootdx loaders, look-ahead-bias and strict-OOS guards in the factor bench and Shadow Account, live-trading safety (signed exposure caps, atomic daily order limits, consent-first mandate commits, fail-closed live state), and journal / QVeris-budget / swarm / CI-gate improvements (#552, thanks @xor-xe; much of the correctness work by @xkam7ar).

2026-07-16 🔧 Dependency lock repaired + Windows settings save fix: the hash-verified runtime lock is regenerated so Docker's pip install --require-hashes resolves cleanly again, fixing the incompatible caio/pydantic-core/websockets pins (#564, closes #558, thanks @tianrking). Saving Agent LLM settings from the Web UI no longer returns HTTP 500 on Windows — the POSIX-only os.fchmod hardening is now platform-guarded, with a regression test for platforms without fchmod (#561, thanks @CRui5in).

2026-07-15 🧮 Backtest correctness + Portfolio Studio core: A 10-PR convergence pass made rebalances causal and order-independent, charged terminal close costs, reported fill-derived turnover, enforced exposure caps, and kept validation output finite and strict (#530/#531/#532/#540). Charts now reuse the run's actual data source, repeatable market queries are no longer dropped, and .env loads refresh cached config (#535/#544/#554). Portfolio Studio #456 and config bug #541 are closed; provider fixes #528/#529 closed too. Thanks @YZY0108, @santhreal, @Robin1987China, @xkam7ar, @Marnie0415, and @marichu99.

2026-07-14 🌉 Longbridge market data + modern MCP transport + provider reliability: Longbridge joins the historical-data fallback layer with key-gated credentials, date-window splitting, strict completeness checks, and an opt-in SDK dependency; four China-market flow tools gain verified Tushare fallbacks, and negative final equity no longer crashes backtest metrics. The MCP server now supports Streamable HTTP, write_file safely recovers aliased or missing path arguments, hypothesis updates reject unsupported fields, and Correlation requests are authenticated. NVIDIA NIM is now a first-class provider across Web Settings and both CLI onboarding paths, with a versioned compatibility User-Agent to address the reported 403; Web Settings now writes to the canonical ~/.vibe-trading/.env, migrates legacy configuration, and reports permission failures clearly, fixing the DeepSeek save-time 500 (#534, closes #516/#524; #528/#529). Thanks @fanfpy, @asahikiko, @santhreal, @sTunnaSu, @abhishekjaisinghani, @huangcheng, @ShiroKSH, @Meru143, @DIEGOD79, and @not-knope for the code, reports, and diagnosis.

2026-07-13 🔒 Security hardening: all 10 external-audit findings closed + contributor batch: every finding from the 2026-07-10 external security audit (issue #476, discussion #468) is now addressed on main — Docker multi-stage rebuild with digest-pinned images, an AST-hardened backtest sandbox blocking network/subprocess/eval/os.environ/unsafe-open (including inside nested function bodies), short-lived single-use SSE auth tickets, hardened Compose (read-only rootfs, dropped capabilities, resource limits), auth + rate limiting on /correlation, security headers, hash-locked dependencies, and more. Also merged: opt-in TAP mode for Alpaca key isolation (#377, thanks @0xZKnw), realized portfolio turnover surfaced in backtest metrics (#478, thanks @Robin1987China), a Frazzini-Pedersen betting-against-beta academic factor (Alpha Zoo → 461, #480, thanks @YogeshModi24), a look-ahead-bias fix across all 5 portfolio optimizers (#487, thanks @YZY0108), and two preflight/provider-config fixes (#479/#484, closes #477/#482, thanks @ananaymital/@Bortlesboat).

2026-07-12 🧪 Strategy Development Manager + contributor fix batch: the new strategy-dev-manager skill (#87) turns academic papers and broker research into registered factors/strategies with a persistent artifact store and automated IC/Sharpe decay monitoring — sdm_register / sdm_status / sdm_decay_scan drive an active → monitoring → decayed → disabled lifecycle over ~/.vibe-trading/ (#457, closes #455, thanks @shadowinlife). Also merged: the Correlation tab accepts bare tickers (AAPL,SPY) and walks the full loader fallback chain (#472, closes #471, thanks @yxhuang), the local loader honors requested intervals via OHLCV resampling (#467, thanks @Shizoqua), Binance USD-M perpetual history lands with explicit BTC-USDT-PERP routing + execution/mark price separation as the first #462 slice (#470, thanks @honginp), FastMCP transport imports now work across both module layouts (#469, thanks @roberttidball), and Requesty is available as an OpenAI-compatible LLM gateway provider (#474, thanks @Thibaultjaigu).

2026-07-11 🚀 v0.1.11 released (pip install -U vibe-trading-ai): rolls up three weeks since 0.1.10 — first-class Indian equity (NSE/BSE) backtesting, the PIT-safe fundamental factor layer (Alpha Zoo → 460), the 16-adapter IM channel runtime, end-to-end scheduled research, optional QVeris premium data, and today's contributor batch: a turnover-aware optimizer (#466, thanks @Robin1987China), an analyze_image vision tool + NapCat DM pairing + the IM-media read fix (#464/#463/#465, thanks @fei-moss), Longbridge Decimal serialization (#459, thanks @fanfpy), and packaged-manifest count guards (#461, thanks @asahikiko). Full details: CHANGELOG · release notes.

2026-07-10 🇮🇳 Indian equity (NSE/BSE) support + centralized env config: a dedicated IndiaEquityEngine lands — T+1 delivery, circuit bands, and a config-driven STT/stamp/exchange/SEBI/GST cost stack — with .NS/.BO symbol routing, an opt-in read-only Shoonya/Dhan data bridge, and 255 alpha101/qlib158 factors opted into the new equity_in universe (#305, thanks @muku314115). Environment variables now flow through a single Pydantic EnvConfig schema with an AST-based CI gate against future os.getenv sprawl (#440, closes #438, thanks @shadowinlife). Also: a second-confirmation dialog before committing a real trading mandate plus unified error toasts (#453, thanks @wison1717-maker), scheduled-research route tests (#452, thanks @Robin1987China), and GLM thinking models no longer lose their reasoning stream on the zhipu provider (#458).

2026-07-09 🧯 Docker startup unblocked + provider/CLI contributor batch: Docker/server startup no longer crashes when FastAPI route iteration sees an included-router-like entry without path (#450, thanks @Penn-Live). We also landed the queued quick-win contributor fixes: loader fetch() signatures now match the protocol across OKX / Tushare / yfinance (#437, thanks @shadowinlife), the CLI resume prompt preserves the first user message (#448, closes #447, thanks @morluto), Codex OAuth defaults to openai-codex/gpt-5.4 (#446, thanks @morluto), Kimi for Coding is available as a distinct provider (#435, thanks @yxhuang), opencode provider mappings are wired (#444, thanks @imsankz), and Tushare reference code fences now say python instead of pyhton (#449, thanks @flash1234pku). Validation included focused server/CLI/provider/loader tests plus a Docker build and /health smoke.

2026-07-08 💎 Fundamental factor layer (Phase 1) + optional QVeris premium data + maintainer day: PIT-safe SEC fundamentals now flow into daily factor panels — fund:* panel columns, filed-date anchoring with restatement and YTD-frame protection, and 4 new quality/value factors (registry now 460 alphas). Data routing gains an optional premium track: the 18 free sources stay the default, while QVeris unlocks 63+ providers via Settings → QVeris or vibe-trading data mode paid (see the QVeris section below). Also: api_server modularization completed (1,103 → 371 lines, #424 closing #331, thanks @shadowinlife), backtest validation.json no longer requires a pre-existing artifacts dir (#429, thanks @isaveall), clearer --swarm-run errors (#428, thanks @isaveall), and we reverted the governance stack that broke session chats (#433, thanks @yxhuang for the precise diagnosis).

2026-07-07 ✅ Contributor PR batch: merged the queued contributor work for IM channel timeout configuration (#413, thanks @SyntaxSawdust), Alpha Library social previews and the beginner tutorial (#396, #393, thanks @kadaliao), value-investing skills / tools / committee presets (#407, thanks @sambazhu), zero-sized order-field handling in trading_place_order (#417, thanks @irfanallana-oss), and timezone-aware UTC timestamps across session/API paths (#397, thanks @mustafakamal88).

2026-07-06 🧭 Preflight hardening, API slices, and CN search fallback: provider preflight no longer follows redirects (#404, closes #402, thanks @SyntaxSawdust), the remaining API routes moved into focused modules (#387, superseding #383-#386, thanks @shadowinlife), and CN web-search fallbacks now include Alibaba Cloud IQS (#408, thanks @sambazhu). Maintainer cleanup added no-network fallback tests and EOF whitespace cleanup (fbac74f); main CI is green (run 28780619018).

2026-07-05 ✅ Contributor PR queue closed + Windows baseline green: merged the four non-draft PRs selected for today's maintainer pass. A-share mootdx batch pulls now let KeyboardInterrupt / SystemExit propagate instead of being swallowed by a bare except (#399, closes #398, thanks @shadowinlife). The Settings route slice and patched dependency floors are now merged under their original contributor PRs (#382, #390, thanks @shadowinlife and @aeonframework). Windows baseline compatibility now isolates loader caches, makes OAuth cache assertions platform-aware, skips one fork-only mock test on Windows, and bypasses proxies for MCP loopback fixtures (#401, thanks @Elfsa-Miranda). Validation: 4701 passed, 47 skipped.

2026-07-04 🧩 API route slices, tutorial docs, and dependency floors: IM channel and Settings routes moved out of api_server.py into src/api/channels_routes.py and src/api/settings_routes.py, continuing the narrow #331 modularization path from contributor work (#379, #382, thanks @shadowinlife). The wiki gained a Chinese beginner tutorial for non-finance readers (#393, thanks @kadaliao), and dependency floors now keep Pillow / LangChain / LangGraph on the installable patched track (#390, thanks @aeonframework).

2026-07-04 🧹 UTC timestamp cleanup for session and API paths: tightened the #395 timestamp fix so session, goal, channel, and API timestamps now emit timezone-aware UTC values in explicit ISO form.

2026-07-03 🛡️ Robinhood MCP refresh + API modularization + SSRF guard: Robinhood Agentic Trading now uses the current MCP tool names across generic reads, live-runner plumbing, default read-only seeds, and mandate-gate tests, while interactive startup honors the same .env search order as the provider loader (~/.vibe-trading/.env → agent/.env → $CWD/.env) (#391, closes #381 and #380). System routes (/health, /correlation, /system/shutdown, /skills, /api) moved into src/api/system_routes.py as the next narrow API modularization slice (#378, thanks @shadowinlife). Channel media SSRF defenses now reject CGNAT/mesh/non-global targets and QQ media redirects-to-internal before fetching (#389, thanks @hobostay).

2026-07-02 ⚡ Factor acceleration + safer runtime boundaries: hot rolling factor operators now use bottleneck/NumPy fast paths, alpha bench parallelism avoids repeated large-panel worker payloads, and base equity math has regression coverage (#376, closes #339, original work from #342 by @shadowinlife). Upload and Shadow report routes moved out of the monolithic api_server.py as the first narrow API modularization slice while #331 stays open (#375, based on #358, thanks @shadowinlife). Generated backtests now inherit only an allowlisted subprocess environment instead of the parent secrets surface (#374, closes #332), and IM channels gained /new session reset plus case-insensitive pairing commands (#372, closes #371, thanks @shadowinlife).

2026-07-01 🧹 Security polish + tracker cleanup: tightened API/Docker/frontend dev defaults, stabilized Settings channel and zh-CN edges, cleared frontend dependency/CSP alerts, and closed stale WhatsApp + paper-trading tracker items (#338, #351, #349, #365, #367, #350, #335, #283).

2026-06-30 💬 IM channel runtime for research delivery: Vibe-Trading can now attach the same agent session runtime to 16 built-in message adapters — WebSocket, Telegram, Slack, Discord, Matrix, WhatsApp, Signal, QQ/NapCat, WeChat/WeCom, Feishu/Lark, DingTalk, Teams, email, and Mochat. CLI (vibe-trading channels status/start/stop/login/pairing), REST (/channels/status, /channels/start, /channels/stop, /channels/pairing/command), and the Web UI Settings panel expose status, recovery hints, start/stop, and sender pairing; SDK-backed adapters stay behind extras such as vibe-trading-ai[telegram] or vibe-trading-ai[channels] (#341).

2026-06-29 🛡️ Live advisory safety + Trading 212 read-only connector + Windows/Gemini fixes: live order guards now have an opt-in, broker-agnostic PreTradeAdvisoryInterface that records advisory reviews without bypassing the mandate gate, kill switch, or audit trail (#328, closes #317, thanks @shadowinlife). Trading 212 joins the connector layer with read-only account, positions, orders, history, and instrument-metadata support; place_order / cancel_order still hard-refuse until a structural paper/live boundary exists (#321, closes #309, thanks @mvanhorn). Windows startup avoids the pandas 3.0 Timestamp crash via the <3.0.0 constraint (#329, closes #324, thanks @hannibal-lee); Gemini thought_signature dict-history replay was verified/fixed on main (#318); .US financial statements now route to SEC EDGAR instead of Eastmoney (#325); and the Alpha Library landing page got cache/date/selector/noscript/DNS-prefetch hardening while heavier CSP and social-card follow-ups stay tracked (#323).

2026-06-28 🧰 Cross-platform setup/dev + runtime and file-tool hardening: vibe-trading setup and vibe-trading dev now handle Windows TypeScript builds, launch the backend from the right cwd, use the Vite 5899 port, and shut child processes down cleanly (#292, thanks @digger-yu). Runtime status polling now degrades instead of crashing (#322); MCP OAuth cache keys are sanitized (#313); OpenAI defaults and Robinhood agent.json validation were tightened (#319, #320, thanks @mvanhorn); and file tools got isolated read/write roots plus broader sandbox tests (#299, thanks @skloxo).

2026-06-27 🧯 Content-filter resilience + Shadow Account feature contract cleanup: event-driven and swarm runs now skip individual LLM content-moderation hits, warn in r

(README truncated)