fix(review): address #175 audit findings

MEDIUM:
- agentic_decision.js: do NOT retry our own abort-timeout — only fast-failing
  connection errors. A timed-out request already consumed a full window;
  retrying it up to 4x could span most of the ~5min tick. Gate on
  controller.signal.aborted. +1 test.
- persona-agent-eval.ts: drop the redundant post-matrix integrity block —
  runProfileMatrix already enforces the posture (assert/warn/off) and returns
  result.integrity, so the duplicate double-warned in 'warn' and was dead in
  'assert'. Thread allowMixed:true explicitly; remove now-unused assertRealBackend.

LOW cleanup:
- Remove dead canCommand prop from PerformanceTab (interface + route caller).
- Delete orphaned PerformanceCopilotPanel.tsx (last import went with the fills rail).
- Remove stale useOperatorAuth mock from PerformanceTab.test.tsx.
- operator-matrix-smoke: guard --max-turns NaN + require auth before driving.

Verified: agentic_decision 21 tests, PerformanceTab 31, evals+arena tsc clean.

Author: drewstone

arena/src/components/bot-detail/PerformanceCopilotPanel.tsx

@@ -645,7 +645,6 @@ function BenchmarkStrip({ summary }: { summary: BotPerformanceSummary }) {
 interface PerformanceTabProps {
   bot: Bot;
   isLive: boolean;
-  canCommand?: boolean;
 }
 
 export function PerformanceTab({ bot, isLive }: PerformanceTabProps) {

arena/src/components/bot-detail/PerformanceTab.tsx

@@ -119,10 +119,6 @@ const lightweightChartMock = vi.hoisted(() => {
     volumeSeries,
   };
 });
-const operatorAuthMock = vi.hoisted(() => ({
-  isAuthenticated: false,
-  token: null as string | null,
-}));
 const useBotMarketCandlesMock = vi.hoisted(() => vi.fn(() => ({
   data: [] as typeof mockMarketCandles,
 })));
@@ -269,19 +265,6 @@ function makeTrade(overrides: Partial<Trade>): Trade {
   };
 }
 
-vi.mock('~/lib/hooks/useOperatorAuth', () => ({
-  useOperatorAuth: () => ({
-    token: operatorAuthMock.token,
-    isAuthenticated: operatorAuthMock.isAuthenticated,
-    isAuthenticating: false,
-    authenticate: vi.fn(),
-    clearCachedToken: vi.fn(),
-    error: null,
-    getCachedToken: vi.fn(() => operatorAuthMock.token),
-    getToken: vi.fn(async () => operatorAuthMock.token),
-  }),
-}));
-
 vi.mock('~/lib/hooks/useChartTheme', () => ({
   useChartTheme: () => ({
     positive: '#0f0',
@@ -354,8 +337,6 @@ describe('PerformanceTab', () => {
       data: mockMarketCandles,
     }));
     useBotMarketCandlesMock.mockClear();
-    operatorAuthMock.isAuthenticated = false;
-    operatorAuthMock.token = null;
     lightweightChartMock.areaSeries.createPriceLine.mockClear();
     lightweightChartMock.areaSeries.applyOptions.mockClear();
     lightweightChartMock.areaSeries.removePriceLine.mockClear();

arena/src/components/bot-detail/__tests__/PerformanceTab.test.tsx

@@ -463,7 +463,7 @@ export default function BotDetailPage() {
   const renderWorkspace = () => {
     switch (activeSection) {
       case 'performance':
-        return <PerformanceTab bot={bot} isLive={botIsLive} canCommand={canCommandBot} />;
+        return <PerformanceTab bot={bot} isLive={botIsLive} />;
       case 'portfolio':
         return (
           <PortfolioWorkspace

arena/src/routes/arena.bot.$id.tsx

@@ -23,6 +23,18 @@ if (!operatorUrl) {
 }
 const privateKey = arg('--private-key') ?? process.env.OPERATOR_PRIVATE_KEY
 const token = arg('--token') ?? process.env.OPERATOR_API_TOKEN
+if (!privateKey && !token) {
+  console.error(
+    'operator-matrix-smoke: --private-key or --token (or OPERATOR_PRIVATE_KEY/OPERATOR_API_TOKEN) required to drive the operator',
+  )
+  process.exit(2)
+}
+
+const maxTurns = Number(arg('--max-turns') ?? 4)
+if (!Number.isFinite(maxTurns) || maxTurns < 1) {
+  console.error('operator-matrix-smoke: --max-turns must be a positive number')
+  process.exit(2)
+}
 
 // Exactly one cell: one model x one persona x one market, one rep.
 const summary = await runTradingPersonaEval({
@@ -34,7 +46,7 @@ const summary = await runTradingPersonaEval({
   markets: [defaultScenarios()[0]!],
   intents: [STANDARD_USER_INTENTS[0]!],
   reps: 1,
-  maxTurnsPerShot: Number(arg('--max-turns') ?? 4),
+  maxTurnsPerShot: maxTurns,
   maxConcurrency: 1,
   // A single live cell: warn (don't hard-throw) so the smoke reports the result
   // even if the inner operator LLM spend isn't visible to the integrity guard.

evals/src/bin/operator-matrix-smoke.ts

@@ -36,7 +36,6 @@ import {
   FileSystemTraceStore,
   TraceEmitter,
   agentProfileHash,
-  assertRealBackend,
   recordRunsToScorecard,
   summarizeBackendIntegrity,
   validateRunRecord,
@@ -486,6 +485,7 @@ async function runOperatorMatrix(
     maxConcurrency: options.maxConcurrency ?? 1,
     ...(options.costCeiling !== undefined ? { costCeiling: options.costCeiling } : {}),
     integrity: options.integrity ?? 'assert',
+    allowMixed: true,
     personaOf: (s) => s.persona.id,
     dispatch: async (profile, scenario, ctx) => {
       const groundTruth = groundTruthByMarket.get(scenario.market.id)
@@ -561,21 +561,11 @@ async function runOperatorMatrix(
     byPersona[persona] = { meanScore: rollup.meanComposite, n: rollup.n }
   }
 
-  // 'assert' (default) hard-fails on a stub/unconfigured backend; 'warn' logs the
-  // same diagnosis but returns the report so the caller still gets a result;
-  // 'off' is silent. Only 'assert' may throw.
-  const integrityMode = options.integrity ?? 'assert'
-  let integrity: BackendIntegrityReport
-  if (integrityMode === 'assert') {
-    integrity = assertRealBackend(result.records, { allowMixed: true })
-  } else {
-    integrity = summarizeBackendIntegrity(result.records)
-    if (integrityMode === 'warn' && integrity.verdict !== 'real') {
-      console.warn(
-        `[operator-matrix] backend integrity: ${integrity.verdict} — ${integrity.diagnosis}`,
-      )
-    }
-  }
+  // runProfileMatrix already enforces the integrity posture passed above
+  // ('assert' throws on a stub backend, 'warn' logs, 'off' skips) and returns the
+  // whole-matrix report. Reuse it rather than re-running the guard, which would
+  // double-warn in 'warn' mode and be dead code in 'assert' mode.
+  const integrity = result.integrity
 
   const best =
     byProfile.length === 0

evals/src/trading/persona-agent-eval.ts

@@ -150,10 +150,7 @@ async function postChatCompletion(opts) {
         signal: controller.signal,
       });
     } catch {
-      // Connection reset / DNS / TLS / aborted-timeout reaching the provider.
-      // This was the dominant live failure ("error sending request for url") for
-      // bots that call the model every tick — and it is transient, so it MUST be
-      // retried like a 429, not fail-closed to a missed decision.
+      // Connection reset / DNS / TLS error, OR our own abort-timeout firing.
       threw = true;
     }
     clearTimeout(timer);
@@ -164,8 +161,14 @@ async function postChatCompletion(opts) {
         return null;
       }
     }
+    // A fast-failing connection error ("error sending request for url" — the
+    // dominant live failure for bots that call the model every tick) is transient
+    // and MUST be retried like a 429. But our OWN abort-timeout already consumed a
+    // full timeoutMs window, so retrying it `retries` times could span most of the
+    // ~5min tick interval — treat a timeout as non-retryable and fail closed.
+    const timedOut = threw && controller.signal.aborted;
     const status = threw ? 0 : (response && Number(response.status));
-    const retryable = threw || status === 429 || (status >= 500 && status < 600);
+    const retryable = (threw && !timedOut) || status === 429 || (status >= 500 && status < 600);
     if (attempt < retries && retryable) {
       // Escalating backoff spanning a sustained-throttle window (the shared key
       // can stay 429 across a full per-minute bucket under fleet concurrency),

trading-blueprint-lib/src/prompts/tools/agentic_decision.js

@@ -110,6 +110,26 @@ test('retries a transient network throw then succeeds', async () => {
   assert.equal(d.action, 'buy');
 });
 
+test('does NOT retry our own abort-timeout (would blow the tick budget)', async () => {
+  let calls = 0;
+  // A request that hangs until the AbortController fires, then rejects — exactly
+  // how a slow endpoint manifests. Distinct from a fast connection error: a
+  // timeout already consumed a full window, so retrying it would span the tick.
+  const hangUntilAbort = (_url, opts) =>
+    new Promise((_resolve, reject) => {
+      calls += 1;
+      opts.signal.addEventListener('abort', () => reject(new Error('aborted')), { once: true });
+    });
+  const d = await agenticDecision(SPEC, {
+    env: ENV,
+    timeoutMs: 20,
+    backoffMs: [1, 1, 1, 1],
+    fetch: hangUntilAbort,
+  });
+  assert.equal(d, null);
+  assert.equal(calls, 1, 'a timeout is not retried');
+});
+
 test('disabled when TRADING_AGENTIC_DECISIONS=0', async () => {
   assert.equal(agenticDecisionsEnabled({ ZAI_API_KEY: 'k', TRADING_AGENTIC_DECISIONS: '0' }), false);
   const d = await agenticDecision(SPEC, {