Implement RiskGate and the end-to-end stubbed OrderExecutor pipeline

[carndog]

Outcome

Prove the complete PriceObserved → TradeSignal → RiskGate → TradeDecision → ExecuteOrder flow without placing an order.

RiskGate applies the exact PortfolioRiskPolicy and PerformanceObjectiveSchedule revisions effective at the decision instant to an auditable portfolio-performance snapshot.

Acceptance criteria

• Resolve the PortfolioRiskPolicy revision effective at the real or simulated decision instant
• Resolve the PerformanceObjectiveSchedule revision and objective period effective at the same instant
• Load or build the immutable portfolio-performance snapshot used for the decision
• Validate portfolio allocation, per-order cap, instrument exposure, portfolio exposure, open-order state, reserved pending exposure and daily-loss circuit breaker
• Apply return-protection bands using progress within the selected objective period
• Approve, reduce or reject the proposed exposure with explicit reason codes
• Ensure RiskGate cannot increase requested exposure, invent a trade or reverse its direction
• Preserve permission for genuinely risk-reducing actions when new risk is restricted
• Reject safely when required policy, objective, valuation or exposure data is missing, inconsistent or stale
• Reserve approved pending exposure transactionally so concurrent signals cannot consume the same capacity
• Create the stable execution request identifier only for an approved execution intent
• Publish ExecuteOrderV1 only for an approved non-zero amount
• Keep OrderExecutor as a stub that records the intended request and never calls eToro
• Make duplicate and out-of-order deliveries unable to create duplicate execution intents or reservations
• Persist a traceable link from each decision and execution intent to its originating signal, all three configuration revisions, objective period and portfolio-performance snapshot
• Record definition hashes and evaluator code version needed for deterministic explanation
• Link end-to-end telemetry without exposing definitions, proprietary parameters or live values
• Test unchanged approval, reduced approval, rejection, stale data, concurrent capacity, duplicate, retry and kill-switch paths

Dependencies

• Versioned message contracts: Define versioned message contracts, envelope and rule-revision semantics #14
• PortfolioRiskPolicy Domain and XML contract: Define the revision-controlled PortfolioRiskPolicy domain and XML contract #49
• Persisted policy revisions: Persist and administer PortfolioRiskPolicy revisions #52
• PerformanceObjectiveSchedule semantics: Define revision-controlled PerformanceObjectiveSchedule semantics and XML #51
• Persisted objective-schedule revisions: Persist and administer PerformanceObjectiveSchedule revisions #50
• Portfolio-performance snapshots: Build auditable portfolio performance snapshots for RiskGate #53

Out of scope

• Calling the eToro API
• Live credentials
• Generating trading signals