QT desk: the risk check and the approve gate (C9, desk.proto 1.3.0)

[dominickdupuy]

Implements the AlgoLens side of contract C9 (trade-ngin PR #204, commit 7ec6076e, desk.proto 1.3.0 GetDeskRisk).

Vendoring

• proto/algogators/desk.proto 1.3.0, byte-identical to trade-ngin@7ec6076e; SOURCE updated; stubs regenerated with grpcio-tools 1.84.0; versions.py says desk=1.3.0.

API

• DeskAgentPort.get_desk_risk / DeskClient.get_desk_risk: a read, not a command. Returns the report as a camelCase dict (state no_book|model|desk|override, auditId, withinLimits, approvedOverride, breaches, m, bindingTerm, overLimitAfterRounding, overLimitByHold, refused, symbols, grossLeverage/netLeverage/marginCushion/equityToMargin (None when unset, via HasField), limits) or raises DeskRiskUnavailable(<status name>).

• GetDeskState and LookupApproval carry risk: the report, {"unavailable": reason}, or null before the first book. Both now take the agent.

• Approve gate in PublishDesk, before the row and the engine call. 409 when:

  • a save is still pending or running;
  • the check can't be read (fail closed);
  • state desk and the report's auditId is not the latest done save;
  • state desk, not within limits, no approved override.

  The model book, no book and an approved override pass. A published day is left to the existing C3 refusal. The fallback/system publish paths and the engine are unchanged.

Frontend

• domain/qt/desk.ts: DeskRisk types, riskBreachReason (part of approveBlockedReason, after the lock and cutoff checks), and pure helpers for the report (badge, binding line, limits vs readings, moved symbols), with unit tests.
• New components/qt/RiskReport.tsx (theme-aware), rendered under Asked-vs-given on the desk panel and on the approval page.
• On a breach, the desk panel shows a prompt next to the disabled Approve. It opens the existing override request form.

Tests

• Use cases: the gate's cases and the risk carried in state and on the approval page.
• Desk client: an in-process server, the version header, field mapping, HasField nulls, errors.
• Routes: the 409 body.
• Integration: NullAgent reports the model book. The rescind test now finishes its save before re-approving and checks that a running save blocks approval.
• Locally, the API suite with Postgres 16 (561 passed), vitest (150 passed) and the vite build all pass.