# REL-012: cost-basis canonical parse 및 안전 sync seed 긴급 핫픽스

- Status: **Released**
- Profile: `app-service`
- Priority: **urgent**
- Owner: 팀장 / 운영팀
- Included batch: **BAT-058** (`REQ-123`)
- Source discovery: [`dcy-038`](../discovery/dcy-038_20260716_cost-basis-response-contract-and-safe-sync-seeding.md)
- Batch verification: [`BAT-058 verification`](../batches/bat-058_20260716_cost-basis-safe-sync-seed/verification.md) — lead `confirm-batch-verification`, QC-7 `PASS-WITH-NOTES`
- Operations handoff: [`REL-012 deployment request`](../runbooks/rel-012-cost-basis-safe-sync-seed-ops-handoff.md)

## Release intent

portfolio-hub의 기존 cost-basis 응답에서 canonical `cost_basis_per_unit`을 우선 해석하고, broker quantity가 양수인 inactive-slot onboarding에서 WAC/avg_price를 얻지 못하면 live sync가 slot status/qty/avg_price/warning을 쓰지 않은 채 non-zero로 fail-closed하도록 한다. dry-run은 sanitized source/reason과 no-write preview를 제공한다.

## Source publication boundary

| Item | Current evidence | Release constraint |
| --- | --- | --- |
| Remote `origin/main` | [`869e07f`](https://github.com/fourblocks2020/trex-core/commit/869e07fb34bd8a65d330da58a28cbcb1505b9625) | BAT-058 source and immutable REL/runbook manifest are included; this is the recorded release-manifest revision. |
| BAT-058 candidate | [`81a853a`](https://github.com/fourblocks2020/trex-core/commit/81a853a314391da7a8bc9df5517013c7fd296d61), reachable from `origin/main` | Reviewed code payload was deployed; operational evidence is recorded in the REL-012 execution record. |
| Immutable deploy payload | [`81a853a`](https://github.com/fourblocks2020/trex-core/commit/81a853a314391da7a8bc9df5517013c7fd296d61) | Immutable **code/test payload** checked out for the daemon rollout. |
| Authoritative release manifest | [`869e07f`](https://github.com/fourblocks2020/trex-core/commit/869e07fb34bd8a65d330da58a28cbcb1505b9625) | Immutable REL/runbook manifest recorded with the operational evidence. |

The immutable daemon deploy payload and the release manifest have distinct roles: `81a853a` is the verified code/test payload; `869e07f` is the immutable release/runbook manifest. Operations recorded both revisions in the [REL-012 execution evidence](evidence/rel-012_20260717_execution-evidence.md). The pre-execution authorization boundary is historical: the approved daemon restart and read/dry-run smoke completed without a release-scope stop condition. `sync --live` remains a separately authorized per-target operational action and is not deployment smoke.

## Included scope

1. `cost_basis_per_unit` canonical priority parsing and approved legacy compatibility chain (`avg_cost` → `wac` → `cost_basis`) only when canonical is absent.
2. Canonical invalid/null/non-numeric/zero/negative values are not silently masked by a legacy value; diagnostic reasons remain sanitized.
3. Inactive slot + positive broker quantity + unavailable WAC: dry-run no-write preview; live non-zero fail-closed with no slot/warning mutation.
4. Existing HOLDING reconciliation remains compatible; sanitized CLI/operator diagnostics preserve `seeded_avg_price`, source, and absence reason.

## Explicit exclusions / no-go

- portfolio-hub API/schema/auth changes, token/config changes, dependency upgrade, DB migration, direct DB edit/delete, AMQP wire/topology change.
- Any `sync --live`, `--yes` live write, automatic remediation, order action (`enter`/`exit`/`cancel`), or target portfolio selection.
- Changing `credential_fetch_enabled`, break-glass mode, instance configuration, endpoint, or secrets.
- Strategy daemon deployment.

A single-target `sync --live --yes` remains a separately approved post-release action even after this source rollout. It must not be used as a deployment smoke shortcut.

## Draft verification evidence

| Check | Result | Evidence / limitation |
| --- | --- | --- |
| Independent QC-7 | **PASS-WITH-NOTES** | Legacy-invalid focused `8 passed, 19 deselected`; affected suite `113 passed`; full suite `833 passed, 47 skipped`; Ruff/compileall/diff hygiene pass. |
| Release-prep full regression | **PASS** | 2026-07-17 delivery worktree: `833 passed, 47 skipped in 1.88s`. |
| Focused Ruff | **PASS** | Changed adapter/reconcile/CLI and relevant tests: `All checks passed!`. |
| Focused compile check | **PASS** | Six changed source/test paths, `compileall -q`, exit `0`. |
| Live broker, live PostgreSQL, production deploy | **PASS** | Operations returned secret-free primary evidence: pinned daemon rollout, startup acceptance, and permitted dry-run / verify smoke all PASS; see [execution evidence](evidence/rel-012_20260717_execution-evidence.md). |
| Source publication | **PUBLISHED / DEPLOYED** | Immutable daemon payload [`81a853a`](https://github.com/fourblocks2020/trex-core/commit/81a853a314391da7a8bc9df5517013c7fd296d61) is reachable from `origin/main`; manifest [`869e07f`](https://github.com/fourblocks2020/trex-core/commit/869e07fb34bd8a65d330da58a28cbcb1505b9625) and both revisions are recorded in the execution evidence. |

## Release approval gates

All release gates are recorded as satisfied in the [REL-012 execution evidence](evidence/rel-012_20260717_execution-evidence.md):

- [x] Reviewed source and REL/runbook manifest are published and immutable.
- [x] Operations verified payload `81a853a`, recorded manifest `869e07f`, and captured `ROLLBACK_REVISION`.
- [x] User explicitly authorized production execution; off-market window is recorded.
- [x] Operations confirmed clean checkout and unchanged runtime configuration / credential / break-glass modes.
- [x] Operations confirmed no dependency or migration delta.
- [x] Operations used the approved supervisor, recorded startup acceptance, and completed permitted dry-run / verify smoke with no write indication.

## Rollout and rollback policy

1. Use the pinned immutable source only; use the host’s existing approved supervisor to restart the same daemon with unchanged approved configuration.
2. After startup acceptance, run only the read/dry-run commands in the REL-012 runbook.
3. Stop and roll back on startup failure, traceback/error regression, unexpected credential/source-mode behavior, unexpected mutation indication, or smoke output that violates the no-write/fail-closed contract.
4. Roll back by restoring the actual captured `ROLLBACK_REVISION` and restarting with unchanged configuration. Do not run database rollback commands, direct DB edits, or live sync.

## Release Decision Evidence

- **Released Decision:** `Released` — lead `confirm-release` recorded after reviewing the release-specific execution record.
- **Rationale:** immutable payload `81a853a` was deployed with manifest `869e07f`; clean preflight, unchanged safety-sensitive configuration, daemon restart/startup, read-only dry-run/verify acceptance, and no rollback trigger are all documented as PASS.
- **Recorded by:** 팀장, based on secret-free `trex-op` evidence received 2026-07-17 13:42:37 KST.
- **Primary record:** [REL-012 execution evidence](evidence/rel-012_20260717_execution-evidence.md).
- **Boundary:** `sync --live` is not daemon rollout smoke; any later per-target use remains an independent approved operational action.

## Feedback Handoff

- **Observation summary:** post-restart `sync --all --dry-run` exited `0` with `145` skipped `broker_qty_zero` results and no write indication; `verify` exited `0` with no C-warned slots. No release-scope failure was reported.
- **Discovery / REQ input:** none from this rollout evidence.
- **Train boundary:** REL-012 is released, but M5 is not reclassified as Train Released because REL-011 still lacks a separate execution-evidence decision.