Release 1.229.0

See release notes.

Author: cjdsellers

.docker/DockerfileUbuntu

@@ -14,9 +14,10 @@
 # Remove the image
 # docker image rm nautilus-dev
 
+FROM rust:1.96.0-slim-bookworm@sha256:b5f842fac1e3b4ff718a652a8e0173b62d9403ec826ef4998880b9347db30684 AS rust-toolchain
+
 # Pin to specific digest for supply-chain security (ubuntu:22.04 as of 2026-04-30)
 FROM ubuntu@sha256:962f6cadeae0ea6284001009daa4cc9a8c37e75d1f5191cf0eb83fe565b63dd7
-
 # Set environment variables
 ENV DEBIAN_FRONTEND=noninteractive
 ENV BUILD_MODE=release
@@ -39,23 +40,27 @@ RUN apt-get update && apt-get install -y \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Rust
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-ENV PATH="/root/.cargo/bin:${PATH}"
+COPY --from=rust-toolchain /usr/local/cargo /usr/local/cargo
+COPY --from=rust-toolchain /usr/local/rustup /usr/local/rustup
+ENV CARGO_HOME="/usr/local/cargo" \
+    RUSTUP_HOME="/usr/local/rustup" \
+    PATH="/usr/local/cargo/bin:${PATH}"
+
+# Set working directory
+WORKDIR /workspace
 
 # Install uv
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh
-ENV PATH="/root/.cargo/bin:/root/.local/bin:${PATH}"
+COPY --from=ghcr.io/astral-sh/uv:0.11.23@sha256:d0a0a753ab981624b49c97abc98821c1c09f4ca69d1ef5cee69c501be3d88479 \
+  /uv /uvx /root/.local/bin/
+ENV PATH="/root/.local/bin:${PATH}"
 
 # Install Python 3.13
-RUN uv python install
-
-# Set working directory
-WORKDIR /workspace
+RUN uv python install 3.13
 
 # Copy only necessary files for dependency setup
 # The actual source code will be mounted as a volume
-COPY ../scripts/rust-toolchain.sh scripts/
-COPY ../Cargo.toml Cargo.lock pyproject.toml rust-toolchain.toml ./
+COPY scripts/rust-toolchain.sh scripts/
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
 
 # Set up Rust toolchain based on project requirements
 RUN bash scripts/rust-toolchain.sh > /tmp/toolchain.txt && \

.docker/jupyterlab.dockerfile

@@ -1,5 +1,6 @@
-ARG GIT_TAG=develop
-FROM ghcr.io/nautechsystems/nautilus_trader:$GIT_TAG
+ARG BASE_IMAGE_REPOSITORY=ghcr.io/nautechsystems/nautilus_trader:latest
+ARG BASE_IMAGE_DIGEST=ffaf4104402164d483371ecb27e21b16231293c416adb9771f9bd97a04f27673
+FROM ${BASE_IMAGE_REPOSITORY}@sha256:${BASE_IMAGE_DIGEST}
 
 COPY docs/tutorials /opt/pysetup/tutorials
 
@@ -28,9 +29,8 @@ RUN curl -fsSL --retry 3 \
     mv /tmp/eurusd_instrument.parquet /catalog/data/currency_pair/EURUSD.SIM/part-0.parquet
 
 # Install UV
-COPY scripts/uv-version.sh scripts/
-COPY pyproject.toml ./
-RUN UV_VERSION=$(bash scripts/uv-version.sh) && curl -LsSf https://astral.sh/uv/$UV_VERSION/install.sh | sh
+COPY --from=ghcr.io/astral-sh/uv:0.11.23@sha256:d0a0a753ab981624b49c97abc98821c1c09f4ca69d1ef5cee69c501be3d88479 \
+  /uv /uvx /root/.local/bin/
 
 RUN uv pip install --system jupyterlab datafusion
 

.docker/nautilus_trader.dockerfile

@@ -1,16 +1,21 @@
-# Pin to specific digest for supply-chain security (python:3.13-slim as of 2026-04-30)
-FROM python@sha256:a0779d7c12fc20be6ec6b4ddc901a4fd7657b8a6bc9def9d3fde89ed5efe0a3d AS base
+FROM rust:1.96.0-slim-bookworm@sha256:b5f842fac1e3b4ff718a652a8e0173b62d9403ec826ef4998880b9347db30684 AS rust-toolchain
+
+# Pin to specific digest for supply-chain security (python:3.13-slim as of 2026-04-30).
+# Keep the version tag: scripts/ci/check-docker-toolchain-pins.bash treats it as the
+# canonical Docker Python version and aligns the site-packages paths below to it.
+FROM python:3.13-slim@sha256:a0779d7c12fc20be6ec6b4ddc901a4fd7657b8a6bc9def9d3fde89ed5efe0a3d AS base
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     PIP_NO_CACHE_DIR=off \
     PIP_DISABLE_PIP_VERSION_CHECK=on \
     PIP_DEFAULT_TIMEOUT=100 \
     PYO3_PYTHON="/usr/local/bin/python3" \
     PYSETUP_PATH="/opt/pysetup" \
-    RUSTUP_TOOLCHAIN="stable" \
+    CARGO_HOME="/usr/local/cargo" \
+    RUSTUP_HOME="/usr/local/rustup" \
     BUILD_MODE="release" \
     CC="clang"
-ENV PATH="/root/.local/bin:/root/.cargo/bin:$PATH"
+ENV PATH="/root/.local/bin:/usr/local/cargo/bin:$PATH"
 WORKDIR $PYSETUP_PATH
 
 FROM base AS builder
@@ -22,12 +27,12 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Install Rust
-RUN curl https://sh.rustup.rs -sSf | bash -s -- -y
+COPY --from=rust-toolchain /usr/local/cargo /usr/local/cargo
+COPY --from=rust-toolchain /usr/local/rustup /usr/local/rustup
 
 # Install UV
-COPY scripts/uv-version.sh scripts/
-COPY pyproject.toml ./
-RUN UV_VERSION=$(bash scripts/uv-version.sh) && curl -LsSf https://astral.sh/uv/$UV_VERSION/install.sh | sh
+COPY --from=ghcr.io/astral-sh/uv:0.11.23@sha256:d0a0a753ab981624b49c97abc98821c1c09f4ca69d1ef5cee69c501be3d88479 \
+  /uv /uvx /root/.local/bin/
 
 # Install package requirements
 COPY uv.lock pyproject.toml build.py ./
@@ -37,6 +42,8 @@ RUN uv sync --no-install-package nautilus_trader
 COPY Cargo.toml ./
 COPY Cargo.lock ./
 COPY crates ./crates
+COPY patches ./patches
+COPY examples/tutorials ./examples/tutorials
 RUN cargo build --lib --release --all-features
 
 COPY nautilus_trader ./nautilus_trader

.github/OVERVIEW.md

@@ -28,20 +28,20 @@ CI/CD, testing, publishing, and automation within the NautilusTrader repository.
   release publication and attestation verification. Uses Depot 8-core runners for Linux and Windows
   builds. Includes a plan step that skips builds on docs-only changes and skips Rust tests on
   Python-only changes.
-- **build-v2.yml**: CI pipeline for the v2 Rust-native system. Uses Depot 8-core runners for Linux builds.
+- **build-v2.yml**: CI pipeline for the v2 Rust-native system. Runs Linux builds on the self-hosted `build-v2` pool.
 - **build-docs.yml**: dispatches documentation build on `master` and `nightly` pushes.
 - **cli-binaries.yml**: builds and publishes CLI binaries for multiple platforms.
 - **codeql-analysis.yml**: CodeQL security scans for Python and Rust on PRs to `master`, pushes to
   `nightly`, and manual dispatch.
-- **copilot-setup-steps.yml**: environment setup for GitHub Copilot coding agent.
 - **coverage.yml**: coverage report generation, currently paused and runs only on `workflow_dispatch`.
 - **docker.yml**: builds and pushes multi-platform Docker images (`nautilus_trader`, `jupyterlab`)
   using Buildx and native ARM runners.
 - **nightly-docs-features-check.yml**: nightly docs.rs build checks and crate feature compatibility verification.
 - **nightly-merge.yml**: auto-merges `develop` into `nightly` when CI succeeds.
-- **nightly-tests.yml**: extended test suites too slow for PR builds - turmoil network tests plus
-  macOS, Windows, and Linux ARM build-and-test jobs that run daily at 12:00 UTC to give early
-  visibility on develop before `nightly-merge` at 14:00 UTC.
+- **nightly-tests.yml**: extended test suites too slow for PR builds - turmoil network tests,
+  macOS, Windows, and Linux ARM build-and-test jobs, plus final Cargo publish-plan and dry-run
+  checks that run daily at 12:00 UTC to give early visibility on develop before `nightly-merge`
+  at 14:00 UTC.
 - **performance.yml**: Rust/Python benchmarks on `nightly`, reporting to CodSpeed.
 - **security-audit.yml**: nightly supply chain security checks (cargo-audit, cargo-deny,
   cargo-vet, pip-audit, osv-scanner, and Zizmor).
@@ -109,11 +109,16 @@ CI/CD, testing, publishing, and automation within the NautilusTrader repository.
   repo `nautechsystems/nautilus_trader`, workflow `build.yml`, and environment `release`; the
   job uses a short-lived token from `rust-lang/crates-io-auth-action` and no long-lived cargo token.
 - **Post-publish verification**: `publish-release-integrity` verifies PyPI files against
-  `dist-manifest.json`, verifies PyPI provenance publisher metadata, verifies crates.io entries
-  were trusted-published by this repository, records whether each crate matches the release commit
-  or was already published, uploads `crates-manifest.json`, attaches attestation siblings, and
-  cleans up release workflow artifacts. `publish-github-release` then publishes the draft release
-  and verifies GitHub's release attestation.
+  `dist-manifest.json`, verifies PyPI provenance publisher metadata, and verifies crates.io entries
+  were trusted-published by this repository. These verifier calls retry transient
+  Sigstore/Rekor/TUF lag, while provenance and identity mismatches fail fast. The job records
+  whether each crate matches the release commit, was already published, or matched an explicit
+  `CRATES_IO_MANUAL_PUBLISH_EXCEPTIONS` `crate@version` entry for emergency token-publish
+  recovery. Manual entries are recorded in `crates-manifest.json` with
+  `release_status: "manual_token_publish"`. Malformed or unused exception entries fail the job. The
+  job uploads `crates-manifest.json`, attaches attestation siblings, and cleans up release workflow
+  artifacts. `publish-github-release` then publishes the draft release and verifies GitHub's
+  release attestation.
 - **Caching**: Rust target directory cache (`Swatinem/rust-cache`), prek hook environments, and test
   data caches speed up workflows while preserving hermetic builds. Rust cache saves are restricted
   to push events to prevent PR cache pollution.

.github/actionlint.yaml

@@ -3,8 +3,6 @@ self-hosted-runner:
     - depot-ubuntu-22.04-8
     - depot-ubuntu-22.04-arm-8
     - depot-windows-2022-8
-    - depot-macos-14
-    - depot-macos-15
     - self-hosted-linux-x86
     - build
     - build-v2

.github/actions/common-wheel-build/action.yml

@@ -102,4 +102,4 @@ runs:
       shell: bash
       run: |-
         bash scripts/ci/retry-on-corruption.sh uv sync --all-groups --all-extras --no-install-package nautilus_trader
-        bash scripts/ci/retry-on-corruption.sh uv pip install dist/*.whl
+        bash scripts/ci/retry-on-corruption.sh uv pip install dist/nautilus_trader-*.whl

.github/actions/upload-artifact-wheel/action.yml

@@ -9,15 +9,16 @@ runs:
       if: >-
         github.event_name == 'push' &&
         (github.ref_name == 'develop' || github.ref_name == 'nightly' ||
-        github.ref_name == 'master' || github.ref_name == 'test-ci')
+        github.ref_name == 'master' || github.ref_name == 'test-ci' ||
+        github.ref_name == 'test-ci-v2')
       id: vars
       run: |
         if [ ! -d "./dist" ]; then
           echo "Error: dist directory not found"
           exit 1
         fi
 
-        ASSET_PATH=$(find ./dist -name "nautilus_trader-*.whl" -type f | xargs ls -t 2>/dev/null | head -n 1)
+        ASSET_PATH=$(find ./dist -name "nautilus_trader-*.whl" -type f -print | sort | head -n 1)
 
         if [ -z "$ASSET_PATH" ]; then
           echo "Error: No nautilus_trader wheel files found in dist directory"
@@ -30,11 +31,13 @@ runs:
       if: >-
         github.event_name == 'push' &&
         (github.ref_name == 'develop' || github.ref_name == 'nightly' ||
-        github.ref_name == 'master' || github.ref_name == 'test-ci')
+        github.ref_name == 'master' || github.ref_name == 'test-ci' ||
+        github.ref_name == 'test-ci-v2')
       # https://github.com/actions/upload-artifact
       # Use wildcard to flatten dist/ prefix: path before first wildcard is stripped
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ env.ASSET_NAME }}
         path: dist/nautilus_trader-*.whl
+        if-no-files-found: error
         retention-days: 1