Trader Portfolio CgCAUTION
🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated
Overview
🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated
ef7d4f0535e5OBSERVED · 2026-09-26What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
---
name: trader-portfolio-cg
description: Mean-variance portfolio optimization via Conjugate Gradient — 40-60× faster than the legacy Neumann path (ADR-126 Phase 3, ADR-123 Wedge 8)
allowed-tools: Bash Read mcp__ruflo-sublinear__solve mcp__plugin_ruflo-core_ruflo__memory_store mcp__plugin_ruflo-core_ruflo__memory_retrieve mcp__plugin_ruflo-core_ruflo__memory_search mcp__plugin_ruflo-core_ruflo__agentdb_pattern-search
argument-hint: "[--portfolio-id ID] [--tolerance 1e-6]"
---
Solve the mean-variance optimization `Σ · x = μ` via Conjugate Gradient instead of the legacy Neumann series.
**Why CG instead of Neumann (ADR-123 Wedge 8):**
- Neumann series: ~50 μs at n=256 (legacy `npx neural-trader --portfolio optimize`)
- Conjugate Gradient: ~816 ns at n=256 (this skill)
- Measured speedup: 40-60×; parity within 1e-4 on a fixed seed.
The covariance matrix Σ is symmetric positive-definite by construction (it's a Gram matrix on real returns), so CG is provably optimal — it converges in at most n iterations with no preconditioning, and typically far fewer when eigenvalues cluster.
**Disable flag**: set `RUFLO_NEURAL_TRADER_DISABLE_CG=1` to skip the CG path entirely and fall through to step 4's legacy Neumann route. Useful for A/B validation or when an upstream covariance regression breaks SPD.
**Native dispatch flag**: set `RUFLO_SUBLINEAR_NATIVE=1` to force the adapter to attempt the native `mcp__ruflo-sublinear__solve` path even when `globalThis` doesn't expose the tool (e.g. when the harness mounts it via a different transport). On any native-dispatch failure the adapter cleanly falls back to the local JS CG and records `method: 'cg-local'` in the artifact metadata — so the regression is auditable.
Steps:
1. **Ensure neural-trader is available**:
```bash
npm ls neural-trader 2>/dev/null || npm install --ignore-scripts neural-trader
```
2. **Read the current covariance matrix Σ and expected-return vector μ** from neural-trader's portfolio API:
```bash
# Primary path (preferred — clean JSON):
npx neural-trader --portfolio current --json
# Fallback paths if the --json flag is unavailable on the installed version:
npx neural-trader --portfolio current # parse the text output
# OR pull from AgentDB if a prior run stored the matrix there:
```
```text
mcp__plugin_ruflo-core_ruflo__memory_search({ query: "covariance matrix current", namespace: "trading-risk", limit: 1 })
```
The skill expects the response to include `covariance: number[][]` (n × n) and `expectedReturns: number[]` (length n).
3. **Solve Σ · x = μ via the SublinearAdapter** (preferred path) when `RUFLO_NEURAL_TRADER_DISABLE_CG` is unset:
```js
import { sublinearAdapter } from '../../src/sublinear-adapter.mjs';
const result = await sublinearAdapter.solveCG(COVARIANCE, EXPECTED_RETURNS, {
tolerance: 1e-6,
maxIterations: 200,
});
// result.solution — optimal weights (number[])
// result.iterations — CG iterations executed
// result.residual — final ||A·x − b||2
// result.latencyMs — wall-clock latency
// result.method — 'cg-sublinear-native' | 'cg-local' <-- READ THIS
// result.solver — '[email protected]' | 'local-js-cg'
// result.degraded — true if input failed SPD checks (fall back to step 4)
```
The adapter does the dispatch itself: it probes for `mcp__ruflo-sublinear__solve` on `globalThis` (and honours `RUFLO_SUBLINEAR_NATIVE=1` as a manual override), routes through the native kernel when reachable, and falls back transparently to the embedded ~50-LOC JS CG when not. The math is identical either way — CG, dense form, n × n SPD covariance. The operator reads `result.method` to know which backend produced the artifact.
The native MCP tool's wire shape (for direct callers who want to bypass the adapter):
```text
mcp__ruflo-sublinear__solve({
matrix: COVARIANCE,
rhs: EXPECTED_RETURNS,
algorithm: "cg",
tolerance: 1e-6,
maxIterations: 200
})
```
Output:
```ts
{ solution: number[], iterations: number, residual: number }
```
4. **Fallback (legacy Neumann)** — if step 3 reports `degraded: true` (non-SPD input, non-square matrix, MCP error) OR if `RUFLO_NEURAL_TRADER_DISABLE_CG=1`:
```bash
npx neural-trader --portfolio optimize
```
Capture the weights output and tag the artifact metadata with `method: 'neumann-fallback'` and a `reason` field.
5. **Store the optimal weights** to `trading-risk` namespace with full provenance metadata. **Take `method` and `solver` straight from the adapter's result so the operator can verify which backend ran**:
```text
mcp__plugin_ruflo-core_ruflo__memory_store({
key: "portfolio-weights-PORTFOLIO_ID-TIMESTAMP",
namespace: "trading-risk",
value: JSON.stringify({
weights: result.solution, // number[] from step 3 (or weights from step 4 fallback)
method: result.method, // 'cg-sublinear-native' | 'cg-local' | 'neumann-fallback'
solver: result.solver, // '[email protected]' | 'local-js-cg' | 'neural-trader-cli'
iterations: result.iterations,
residual: result.residual,
latencyMs: result.latencyMs,
capturedAt: NEW_DATE_ISO,
reason: FALLBACK_REASON || null
})
})
```
The `trading-risk` namespace is canonical (ADR-126 Phase 1; the five-namespace alignment). Long-lived — no TTL — because portfolio weights are the audit trail Phase 4 will Ed25519-sign.
6. **Cross-check against historical patterns** (optional but recommended):
```text
mcp__plugin_ruflo-core_ruflo__agentdb_pattern-search({
query: "portfolio weights Sharpe regime:CURRENT_REGIME",
namespace: "trading-risk"
})
```
If the new weights differ by more than 30% in any single asset from the historical median, flag for human review before applying. This is a guard-rail, not a hard block.
**Acceptance criteria Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
crates
plugin/agents
plugin/commands
plugin/skills
Gates applied: no_behavioural_pass.
ef7d4f0535e5full audit observations/trust-audit/skill/ruvnet__trader-portfolio-cg.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-26 | ef7d4f0535e5 | CAUTION | B | 89 | first audit |
Questions
What does the Trader Portfolio Cg skill do?
🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated
Is Trader Portfolio Cg safe to install?
With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can Trader Portfolio Cg access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (ef7d4f0535e5), read on 2026-09-26. The repository is watched, and a new audit runs when it changes — this is the first audit.