v0.1.12

## 🌀 v0.1.12 — Correlation regime timeline, three new providers, MetaTrader 5 + a reliability wave

`v0.1.12` rolls up nearly two weeks of work since 0.1.11 (2026-07-10) — the headlines: a **correlation regime timeline** that answers *"when did the market fuse into one bloc, and are we in that state now?"*, **three new LLM providers** plus catalog-based endpoint resolution that makes every provider work with just a key, the **MetaTrader 5 (Exness) broker connector** (12 brokers), the **Strategy Development Manager** skill, **Binance USD-M perpetuals** with historical funding, and a broad **reliability wave** — strict-JSON/finite hardening, session/journal robustness, an 80× vectorization, and the native `zai` streaming fix.

This release is available on **PyPI**, **ClawHub**, and GitHub Releases.

```bash
pip install -U vibe-trading-ai
# or
uv tool install --reinstall vibe-trading-ai
```

## Highlights

### 🌀 Correlation regime timeline

A new additive `GET /correlation/regime` endpoint and an opt-in **"Regime timeline"** strip on the Correlation tab (#756, closes #719, thanks @ebujinovch). It reuses the same price data `/correlation` already fetches: rolling pairwise correlations reduce to an **edge-density** scalar per bar (the fraction of asset pairs whose |ρ| clears a threshold), the series is **causally smoothed** (trailing window — never reads the future), and a **two-threshold hysteresis state machine** marks contiguous FUSED episodes, with a dead band that suppresses chatter. It shares `/correlation`'s auth + rate-limit budget, floors the window so short timelines can't return empty, and is explicitly **descriptive risk context, not a trading signal**. Backed by the `correlation-regime` skill (#557).

### 🔌 Three new LLM providers + robust endpoint resolution

Native adapters for **SiliconFlow** (CN + Global, #565, thanks @UNHNQ), **iFlytek Spark** (#537, thanks @FenjuFu), and the **native Anthropic Messages API** (#695, thanks @jelech; `pip install "vibe-trading-ai[anthropic]"`), plus **MiniMax regional endpoints** (#731, thanks @octo-patch). Underneath, provider credentials are resolved through one centralized path (#563, thanks @shadowinlife), and two long-standing rough edges are fixed (#758): when no `*_BASE_URL` is set, the backend now **falls back to each provider's canonical catalog endpoint** (the same default Web Settings already used) instead of silently defaulting to `api.openai.com` — so a provider works with just a key — and an endpoint that streams **zero chunks falls back to a non-streaming invoke** rather than erroring, with an HTML-error-page hint when a base URL is misconfigured.

### 📈 MetaTrader 5 (Exness) connector + `mt5` data source — 12 brokers

A first-class MetaTrader 5 broker connector (#481, thanks @StaniellG) — full read surface plus order placement against a locally running terminal, with a **bidirectional identity guard** (paper profile ⇔ demo `trade_mode`, login pinned, contest rejected) and connector-level `max_order_volume` / `max_order_notional_usd` caps on demo AND live. The live mandate gate gains `forex`/`cfd` instrument vocabulary and a **lot-aware sizing hook** so USD caps bind on lot-sized orders (0.1 lot EURUSD ≈ $10,800, never 0.1 × quote). The `mt5` loader heads the forex fallback chain (broker-exact symbols with Exness suffix discovery, 1m–1D bars). Broker connectors: 11 → **12**; market-data sources → **23**.

### 🧬 Strategy Development Manager

`sdm_register` / `sdm_status` / `sdm_decay_scan` turn academic papers and broker research into **registered factors and strategies** (#457, closes #455, thanks @shadowinlife), backed by a persistent SQLite artifact store (`UNIQUE(name, universe)`) and automated **IC/Sharpe decay monitoring** driving an `active → monitoring → decayed → disabled` lifecycle. Ships with pluggable OCR for `read_document` (local RapidOCR by default; cloud Qwen-VL is explicit opt-in only, never auto-selected).

### ₿ Binance USD-M perpetuals

Explicit `BTC-USDT-PERP` routing with **execution/mark price separation** (fail-closed when the two aren't timestamp-synchronized) and historical **funding settlements** (#470/#716, thanks @honginp). Maintenance brackets are decoupled from the live authenticated fetch and supplied as a **validated, content-hashed artifact** instead (#757), so a plain `-PERP` backtest stays **zero-credential** — the regression where every perp fetch required a Binance API key is gone.

### 👁️ Pluggable OCR + LLM-vision extraction

`read_document` gains a pluggable OCR engine architecture with optional **LLM-vision extraction** and a configurable text-density threshold (#548, thanks @shadowinlife) — local by default, cloud engines opt-in only, never auto-selected.

### 🧰 Platform & safety

- **Look-ahead-bias fix across all five portfolio optimizers** (#487, thanks @YZY0108) — weights executed at a bar's open no longer include that bar's close-to-close return. Plus realized portfolio turnover metrics for every optimizer (#478, thanks @Robin1987China).
- **Security hardening** — all 10 findings from the 2026-07-10 external audit closed (#476): AST-hardened backtest sandbox, short-lived SSE auth tickets, hardened Compose, `/correlation` auth + rate limiting, security headers, hash-locked dependencies, and SHA-pinned Actions.
- **80× signal-alignment vectorization** (#698, thanks @shadowinlife) and swarm MCP tool-discovery caching (#704) cut wall-clock on wide panels and multi-worker runs.
- **Opt-in TAP mode for Alpaca** (#377, thanks @0xZKnw), **IBKR thread-local connection pool + snapshot quotes** (#636, thanks @MikeCer), **Robinhood `account_number` wiring** (#726, thanks @nareshkps), the **Requesty** gateway provider (#474, thanks @Thibaultjaigu), and **user swarm-presets discovery** (#570, thanks @darkknight4563).
- **Two new academic factors** — Frazzini-Pedersen betting-against-beta (#480, thanks @YogeshModi24) and `academic_corr_rewire` (#705, thanks @ebujinovch): Alpha Zoo 460 → **462 across 5 families**.

### 🛠️ Reliability & correctness wave

- **Strict-JSON / finite-number hardening** across the backtest + tools stack (thanks @santhreal) — risk ratios stay finite when equity crosses zero (#765) or annualizes an explosive path (#739/#740); scalar metrics (#766), factor IC std (#767), and pattern trend-slope (#764) emit strict RFC-8259 JSON (`null`, never `NaN`/`Infinity`); Black-Scholes helpers treat non-positive spot/strike as intrinsic (#744).
- **Session / journal robustness** — one corrupt `session.json` (#762) or schema-bad `messages.jsonl` line (#763) no longer aborts listing/reading; Excel float-stringified A-share codes (#770), unicode-dash PDF page ranges (#769), `export KEY=` dotenv lines (#768), and yahoo `1m` bars (#761) all parse correctly.
- **Broad reliability** — cancellation is honored before the first AgentLoop iteration (#641, closes #638), a frontend `insertBefore` streaming DOM-race is fixed (#717, thanks @Marnie0415), the composite engine falls back for unknown symbols (#734), codex stream HTTP failures are classified for correct retry (#663), and #584 (thanks @xkam7ar) closes a batch of packaging/web/scheduler/swarm/CLI issues.

### 🙌 Contributor cycle

~90 correctness/reliability fixes and features from a wide contributor cohort — @santhreal (a 30-PR correctness sweep), @xkam7ar (reliability + QVeris hardening), @shadowinlife (SDM, OCR, vectorization), @ebujinovch (regime timeline), @honginp (Binance perps), @StaniellG (MetaTrader 5), and many more. Full per-person credits live in the README Contributors section and the [CHANGELOG](https://github.com/HKUDS/Vibe-Trading/blob/main/CHANGELOG.md). Thanks also to @GabbaTauchi for the zai bug report (#758).

## Install / upgrade

| Channel | Command |
|---|---|
| **PyPI** | `pip install -U vibe-trading-ai` |
| **uv tool** | `uv tool install --reinstall vibe-trading-ai` |
| **ClawHub** (Claude Desktop / OpenClaw / MCP clients) | `clawhub install vibe-trading` or update the installed skill |
| **Docker** | `docker compose pull && docker compose up -d` |

Remote API/Web deployments should set `API_AUTH_KEY` and explicit trusted CORS origins; local CLI and localhost Web UI workflows stay low-friction.

## By the numbers

**Numbers at 0.1.12**: 8 backtest engines + `options_portfolio` · **462** alphas / 5 families · **88** skills · 30 swarm presets · **23** market-data sources · **12** broker connectors · **75** free-mode tools (78 with QVeris) · 54 MCP tools · 5 optimizers · 16 IM adapters.

### Validation

Full backend suite **6,019 passed** (only pre-existing env/network fails, confirmed against clean main); frontend build + **310 vitest** green; wheel verified (`vibe_trading_ai-0.1.12`, contents spot-checked). Protected agent core (`src/agent`, `src/session`, `src/providers`) reviewed for every change.

**Full changelog:** [CHANGELOG.md](https://github.com/HKUDS/Vibe-Trading/blob/main/CHANGELOG.md) · **Compare:** [v0.1.11...v0.1.12](https://github.com/HKUDS/Vibe-Trading/compare/v0.1.11...v0.1.12)
</content>