fix(broker): enforce operator broker truth boundary

tests/runtime/test_broker_provider.py

@@ -0,0 +1,83 @@
+"""REQ-119 provider source and refresh lifecycle regressions."""
+from types import SimpleNamespace
+
+import pytest
+
+from trex_core.runtime.broker_provider import (
+    BrokerCredentialUnavailable,
+    ConfigBrokerProvider,
+)
+from trex_core.runtime.config import DaemonConfig, KISConfig, PortfolioHubConfig
+
+
+def _cfg(*, fetched=True, broker="kis"):
+    return DaemonConfig(
+        dsn="postgresql://test/test", broker=broker, execution_interval_sec=1,
+        kis=KISConfig("https://openapivts.example", "env-key", "env-secret", "env-account", 1, False),
+        portfolio_hub=PortfolioHubConfig("http://hub"), credential_fetch_enabled=fetched,
+    )
+
+
+class _Broker:
+    def __init__(self): self.credentials = []
+    def reinitialize(self, credential): self.credentials.append(credential)
+
+
+class _Read:
+    def __init__(self, ctx=None, error=None): self.ctx, self.error, self.calls = ctx, error, 0
+    def fetch_broker_credential(self):
+        self.calls += 1
+        if self.error:
+            raise self.error
+        return self.ctx
+
+
+def _ctx(version="v1"):
+    return SimpleNamespace(trading_enabled=True, broker=SimpleNamespace(
+        account_ref="synthetic-account", app_key="synthetic-key", app_secret="synthetic-secret",
+        credential_version=version,
+    ))
+
+
+def test_fetched_provider_constructs_once_reuses_and_refreshes_without_env_fallback(monkeypatch):
+    broker = _Broker()
+    monkeypatch.setattr("trex_core.runtime.broker_provider._make_env_broker", lambda cfg: broker)
+    read = _Read(_ctx())
+    provider = ConfigBrokerProvider(_cfg(), read_port=read)
+
+    got, source = provider.get_broker_for_read()
+    assert got is broker
+    assert source.mode == "fetched"
+    assert source.identity_label == "credential-version:v1"
+    assert broker.credentials[0].app_key == "synthetic-key"
+    assert read.calls == 1
+    assert provider.refresh_day_start_credential() == source
+    assert read.calls == 1  # same day cache, no broker/token churn
+
+
+def test_fetched_provider_failure_is_sanitized_and_never_constructs_env_broker(monkeypatch):
+    monkeypatch.setattr("trex_core.runtime.broker_provider._make_env_broker", lambda cfg: pytest.fail("env fallback"))
+    provider = ConfigBrokerProvider(_cfg(), read_port=_Read(ctx=None, error=RuntimeError("secret payload")))
+    with pytest.raises(BrokerCredentialUnavailable) as raised:
+        provider.get_broker_for_read()
+    assert raised.value.code == "portfolio_hub_unavailable"
+    assert "secret" not in str(raised.value)
+
+
+def test_enabled_paper_never_fetches_kis_credentials(monkeypatch):
+    read = _Read(_ctx())
+    provider = ConfigBrokerProvider(_cfg(broker="paper"), read_port=read)
+    _, source = provider.get_broker_for_read()
+    assert source.mode == "env"
+    assert read.calls == 0
+
+
+def test_break_glass_is_distinct_and_skips_fetch(monkeypatch):
+    broker = _Broker()
+    monkeypatch.setenv("TREX_KIS_BROKER_BREAK_GLASS", "true")
+    monkeypatch.setattr("trex_core.runtime.broker_provider._make_env_broker", lambda cfg: broker)
+    read = _Read(_ctx())
+    _, source = ConfigBrokerProvider(_cfg(), read_port=read).get_broker_for_read()
+    assert source.mode == "break_glass"
+    assert source.identity_label == "operator-break-glass"
+    assert read.calls == 0

tests/runtime/test_cli_broker_failure.py

@@ -0,0 +1,53 @@
+"""REQ-120 CLI failure boundary regression tests."""
+import sys
+import types
+from types import SimpleNamespace
+
+# This worktree intentionally lacks pika. CLI imports only messaging topology for
+# these tests; install a minimal import-time stub without contacting a broker.
+_pika = types.ModuleType("pika")
+_pika.__path__ = []
+_pika.URLParameters = lambda *a, **k: None
+_pika.BlockingConnection = object
+_pika.BasicProperties = object
+_pika_exceptions = types.ModuleType("pika.exceptions")
+_pika_exceptions.AMQPError = Exception
+_pika.exceptions = _pika_exceptions
+sys.modules.setdefault("pika", _pika)
+sys.modules.setdefault("pika.exceptions", _pika_exceptions)
+
+from trex_core.application.broker_port import BrokerBalanceError  # noqa: E402
+from trex_core.runtime import cli  # noqa: E402
+from trex_core.runtime.config import DaemonConfig  # noqa: E402
+
+
+def _args(*, as_json=True):
+    return SimpleNamespace(portfolio_id="PF-1", all=False, json=as_json, dry_run=True,
+                           yes=True, live=False, instance=None, config=None, config_path=None)
+
+
+def test_sync_balance_failure_is_sanitized_and_happens_before_db(monkeypatch, capsys):
+    class Provider:
+        def get_broker_for_read(self):
+            return SimpleNamespace(get_balance=lambda: (_ for _ in ()).throw(BrokerBalanceError("authentication_failed"))), None
+    monkeypatch.setattr("trex_core.runtime.broker_provider.build_broker_provider", lambda cfg: Provider())
+    # A DB object being constructed would prove the boundary arrived too late.
+    monkeypatch.setattr("trex_core.adapters.portfolio.reconcile_warning_store.PostgreSQLReconcileWarningStore",
+                        lambda *a: (_ for _ in ()).throw(AssertionError("DB touched")))
+    assert cli._cmd_sync(_args(), DaemonConfig("dsn", "paper", 1), lambda _: True) == 1
+    captured = capsys.readouterr()
+    assert '"authentication_failed"' in captured.err
+    assert "broker balance unavailable" in captured.err
+
+
+def test_verify_balance_failure_never_leaks_payload_or_opens_db(monkeypatch, capsys):
+    class Provider:
+        def get_broker_for_read(self):
+            return SimpleNamespace(get_balance=lambda: (_ for _ in ()).throw(BrokerBalanceError("transport_failed"))), None
+    monkeypatch.setattr("trex_core.runtime.broker_provider.build_broker_provider", lambda cfg: Provider())
+    monkeypatch.setattr("trex_core.adapters.persistence.postgresql.PostgreSQLSlotRepository",
+                        lambda *a: (_ for _ in ()).throw(AssertionError("DB touched")))
+    assert cli._cmd_verify(_args(), DaemonConfig("dsn", "paper", 1)) == 1
+    captured = capsys.readouterr()
+    assert '"transport_failed"' in captured.err
+    assert "payload-secret" not in captured.err