[D-Bluemoon]

Summary

Adds agent-side fractional-Kelly sizing, treasury-aligned risk evaluation primitives, transaction journaling and submission helpers, signer primitives, and credential redaction. Includes related tests, documentation, and supporting contract/binding updates.

Closed #93
Closed #94
Closed #95
Closed #96
Important runtime integrations remain unfinished and Rust/CI validation is not fully green.

What changed

• Added impact-aware fractional-Kelly sizing, with configurable sizing parameters, trade caps, and buy/sell sizing tests.
• Added a pure risk evaluator that models treasury create/buy limits, including agent roles and caps, liquidity, queue-reserved capital, rolling usage, market exposure, net exposure, and price policy.
• Added append-only JSONL transaction journal and bounded submission/retry helpers that preserve the same signed transaction envelope across retries.
• Added local, remote, and threshold multisig signer primitives with invocation policy checks and signing documentation.
• Added redaction utilities and applied redaction to structured logs and CLI error output.
• Connected sizing to trader strategy/runtime paths and added supporting configuration and tests.
• Fixed TWAP final-slice allocation and adjusted timing-sensitive test setup.
• Updated treasury error codes and generated TypeScript bindings; corrected contract build-script include handling and a shared Rust import.

What is not complete

• Risk enforcement is not wired into maker/trader decisions. The evaluator is currently a pure helper; the runtime does not yet load the full treasury risk state and use the result to approve or reject trades.
• A persistent kill switch is not implemented in the runtime flow.
• Journaled submission and restart reconciliation are not integrated into the adapter or CLIs. The journal and submit modules are standalone helpers; stable business-intent IDs and automatic recovery are still needed.
• Signer selection is not wired through CLI/config. The adapter supports an injected signer programmatically and retains the local secret-key path, but operators cannot select remote or multisig signing through the application configuration.
• Multisig uses a participant threshold, not Stellar signer weights. Production operational hardening, including durable audit and transport/mTLS configuration, remains follow-up work.

Validation

• npm run build in oracledesk-stellar/agents: passed.
• Agent tests excluding the Rust-backed spec-hasher test: 252 passed, 0 failed.
• git diff --check: passed.
• No unresolved merge entries or conflict markers were found in changed files.

Validation blockers

• The full Rust formatting/build checks are blocked by a parse error in contracts/reasoning-registry/src/lib.rs near line 948. That file was not changed in this work.
• The repository pins Rust 1.90, while Soroban SDK 27 requires Rust 1.91 or newer. As a result, the Rust-backed spec-hasher test fails under the pinned toolchain.
• Trying Rust 1.94 does not make validation clean: contract build scripts report stale vendored Wasm hashes. Those pins were not refreshed because doing so safely requires confirming deterministic CI-compatible Wasm builds.
• Therefore, this PR does not claim that the full CI suite passes.

Follow-up

Wire risk checks and the kill switch into runtime decisions; integrate journaled submission and restart reconciliation; expose signer selection through config/CLI and address weighted multisig/operational requirements; then resolve the Rust parse, toolchain, and Wasm-pin blockers and rerun full CI.