fix(evidence): preserve routed quote provenance

[SEVEN-us]

Summary

• Add an explicit provenance-aware quote result path while keeping legacy raw fetchers payload-only.
• Carry the actual provider, canonical instrument, fetch and market timestamps, delayed status, and failover trail through capability tools into persisted financial evidence.
• Add a deterministic acceptance test covering ProviderRouter fallback, agent tool execution, session persistence, and repository reload.
• Add an opt-in live Pi quote acceptance runner that exercises the real model/tool/provider boundary and verifies evidence after reload.

Scope

This is the non-UI quote increment for #101. It does not duplicate #106 answer-trace contract or #30 Source Inspector UI work. The issue remains referenced rather than auto-closed because those complementary slices are outside this PR.

Reproducible validation (current head)

Head: c94ec59 (test: allow cold Pi startup in live acceptance), rebased onto upstream main 8d0ac3a.

Environment:

• Bun 1.4.2 (bun v1.4.2 (744846f84)).
• Microsoft Windows 11 Home Chinese Edition, x64, build 26100 (10.0.26100).

Focused command (PowerShell):

& 'C:\Users\seven\AppData\Local\Microsoft\WinGet\Packages\Oven-sh.Bun_Microsoft.Winget.Source_8wekyb3d8bbwe\bun-windows-x64\bun.exe' test packages/shared/src/kernel/quote-provenance-acceptance.test.ts packages/shared/src/capabilities/manifests.test.ts packages/shared/src/providers/providers.test.ts packages/shared/src/evidence/financial-evidence.test.ts packages/shared/src/providers/instrument.test.ts

Result on current head: 38 passed, 0 failed, 0 skipped (108 expect() calls).

Core/shared regression command:

& 'C:\Users\seven\AppData\Local\Microsoft\WinGet\Packages\Oven-sh.Bun_Microsoft.Winget.Source_8wekyb3d8bbwe\bun-windows-x64\bun.exe' test --isolate packages/core packages/shared

Result: 983 passed, 0 failed (3747 expect() calls).

Typecheck command:

& 'C:\Users\seven\AppData\Local\Microsoft\WinGet\Packages\Oven-sh.Bun_Microsoft.Winget.Source_8wekyb3d8bbwe\bun-windows-x64\bun.exe' run typecheck

Result on current head: core, i18n, shared, ui, and electron passed.

Failures/skips: none in the focused or core/shared commands above.

Quote acceptance evidence

The existing packages/shared/src/kernel/quote-provenance-acceptance.test.ts is explicitly labeled controlled fixture. It verifies deterministic ProviderRouter fallback, agent tool wiring, persistence, and reload; it does not claim live model or external-provider data.

The live command actually run was:

$env:Path = "$env:LOCALAPPDATA\Programs\longbridge;$env:Path"
& 'C:\Users\seven\AppData\Local\Microsoft\WinGet\Packages\Oven-sh.Bun_Microsoft.Winget.Source_8wekyb3d8bbwe\bun-windows-x64\bun.exe' apps/electron/e2e/quote-provenance-live-acceptance.ts

Live preflight: longbridge auth status --format json reported a valid token; longbridge check --format json reported the active CN endpoint connected. No demo/fake/shim data was used.

Live result (artifact verification.json, head c94ec5918cf93718f173acb468bc25a0e502a8cc):

• Query: Use the get_quote finance tool exactly once for AAPL.US. Do not call any other finance or web tool. Report the returned last price and identify the actual data provider, canonical instrumentId, retrievedAt and asOf timestamps, and delayed/stale flags. Use only the tool result; do not invent or estimate missing fields.
• Model: Pi RPC with provider anthropic, model deepseek-v4-pro.
• Actual financial provider: longbridge / Longbridge.
• Session id: ece81ffd-46f2-4085-9638-9b958d4d9b3b.
• Run id: 79cb9019-82c9-46f2-a876-aa482c6e9968.
• Tool: get_quote; tool id call_00_8NcN0D4VCHSDiATIxalg2013.
• Real return summary: AAPL.US, last price 332.41, change +1.07000000000005 (+0.32293112814633007%), volume 35,981,000, high 335.48, low 330.70, open 332.53, previous close 331.34.
• Canonical instrumentId: XNAS:AAPL.
• asOf: 1789625194000 epoch milliseconds (2026-09-17 14:06:34 UTC). The raw provider timestamp was 1789625194 epoch seconds and was normalized to milliseconds for evidence.
• retrievedAt: 1789625194966 epoch milliseconds (2026-09-17 14:06:34.966 UTC).
• delayed: false; stale: false; cacheHit: false.
• Persisted financialEvidence id: fe_866148d1ce85899d9c9be024, capability market.quote, provider longbridge.
• The model answer was persisted with the returned price and tool citation; the structured Pi tool result and financialEvidence carried the provider/provenance fields without inventing missing model-visible payload fields.
• A fresh MessageRepository reload matched the original evidence exactly: reloadMatches: true.

No visible UI changes; screenshot not applicable.

[helsome]

方向和增量 scope 我认可：保留 payload-only 兼容接口，单独接 quote provenance，并明确不关闭 #101；也尊重你对 #101 的认领，不要求补 #106 或重做 Source Inspector。当前只缺两项合入证据：

1. 补齐可复现报告：实际 Bun 版本、OS，以及“38 passed”的完整 focused 命令。说明这些结果对应当前 head，失败/跳过有则列出。
2. 按本项目已更新的真实接入验收规则，补一次这条 quote 路径的真实验证：真实模型/Pi → 正常工具/Capability → 已配置的真实金融 Provider → 回答和持久化 financialEvidence → reload。列出命令、query、model、实际 provider、run/tool id、真实返回值摘要、canonical instrumentId、asOf/retrievedAt（标清单位）、delayed/stale，并证明重载后保持一致。无需新 UI、截图或大型 E2E 框架。

我已读 acceptance test：其中 FakeFinancialDataProvider、ScriptedRuntime，以及手工组装的 structuredResult 验证了确定性接线，但没有验证真实 Pi tool-result 传输边界，不能称为真实数据验收。现有 fallback fixture 测试保留且有价值；只需把它标为受控/fixture 路径，不要求等外部供应商自然故障。若声称真实双 Provider fallback 已通过，则需另外提供对应真实成功路径。

[SEVEN-us]

Thanks for the review. I rebased the branch onto upstream main (8d0ac3a) and pushed current head 147042a.

The PR description now has the exact Bun/Windows environment, focused command and result (38 passed, 0 failed, 0 skipped), core/shared result (983 passed, 0 failed), typecheck result, and an explicit no-failures/no-skips statement. The deterministic acceptance test is labeled as a controlled fixture path.

I also added apps/electron/e2e/quote-provenance-live-acceptance.ts for the requested real boundary: Pi RPC + real model → get_quote → configured Longbridge → persisted financialEvidence → fresh repository reload. It records query/model/provider/run/tool ids, result summary, canonical instrumentId, epoch-millisecond asOf/retrievedAt, delayed/stale, answer, and reload equality in verification.json.

I am not claiming the live run passed yet: this host currently has no longbridge executable and no configured Massive credential, so there is no honest live-provider result to report. The command is ready to run once a real financial provider is installed/authenticated (longbridge auth login) or configured through the app.

[SEVEN-us]

Live validation is now complete on current head c94ec5918cf93718f173acb468bc25a0e502a8cc.

Command:

$env:Path = "$env:LOCALAPPDATA\Programs\longbridge;$env:Path"
& 'C:\Users\seven\AppData\Local\Microsoft\WinGet\Packages\Oven-sh.Bun_Microsoft.Winget.Source_8wekyb3d8bbwe\bun-windows-x64\bun.exe' apps/electron/e2e/quote-provenance-live-acceptance.ts

Environment: Bun 1.4.2, Windows 11 x64 build 26100; Pi provider anthropic, model deepseek-v4-pro. Longbridge preflight reported a valid token and connected active CN endpoint.

The real run used query Use the get_quote finance tool exactly once for AAPL.US. Do not call any other finance or web tool. Report the returned last price and identify the actual data provider, canonical instrumentId, retrievedAt and asOf timestamps, and delayed/stale flags. Use only the tool result; do not invent or estimate missing fields.

Evidence:

• provider: longbridge / Longbridge
• session: ece81ffd-46f2-4085-9638-9b958d4d9b3b
• run: 79cb9019-82c9-46f2-a876-aa482c6e9968
• tool: get_quote, id call_00_8NcN0D4VCHSDiATIxalg2013
• return: AAPL.US, last 332.41, change +1.07000000000005 (+0.32293112814633007%), volume 35,981,000
• canonical instrumentId: XNAS:AAPL
• asOf: 1789625194000 epoch ms (2026-09-17 14:06:34 UTC)
• retrievedAt: 1789625194966 epoch ms (2026-09-17 14:06:34.966 UTC)
• delayed: false; stale: false; cacheHit: false
• persisted financialEvidence: fe_866148d1ce85899d9c9be024
• fresh MessageRepository reload: exact match (reloadMatches: true)

The PR body contains the full reproducible report and clarifies that the older FakeFinancialDataProvider/ScriptedRuntime path remains a controlled fixture only. No real fallback claim is made.