# CV6 AI Trading OS — Bug Report
**Date:** 2026-06-30  |  **Type:** ACTUAL RUNTIME DATA
**Source:** Live stability run (420 trades executed)

---

## Bug Summary

| ID | Severity | Status | Title |
|----|----------|--------|-------|
| BUG-001 | MEDIUM | OPEN | UnicodeEncodeError on SELL trade log write (Windows cp1252) |
| BUG-002 | HIGH | OPEN | WebSocket not functional — uvicorn[standard] missing |
| BUG-003 | LOW | OPEN | bcrypt version detection warning on every login |
| BUG-004 | HIGH | OPEN | 7 secondary endpoints return 404/422 — path mismatch or unimplemented |

---

## BUG-001 — [MEDIUM] UnicodeEncodeError on SELL trade log write (Windows cp1252)

**Module:** `app/paper_trading/paper_router.py`  
**Status:** OPEN  
**Trigger:** Every paper SELL execution on Windows

### Root Cause
The trade `notes` field contains a Unicode arrow character (\u2192 →). Windows terminal stdout uses cp1252 encoding which cannot encode \u2192. SQLAlchemy's echo logger tries to write the INSERT SQL with this character to stdout and raises UnicodeEncodeError inside the logging thread.

### Impact
Logging error printed to stderr/stdout but the actual DB COMMIT succeeds. The trade IS persisted to SQLite. No data loss. No API error returned to client. However: log file is noisy, and on a server with strict logging the crash could prevent log rotation or monitoring pipelines from parsing the log.

### Log Evidence
```
UnicodeEncodeError: 'charmap' codec can't encode character '\u2192' in position 260: character maps to <undefined>
```

### Suggested Fix
Replace the arrow character in the notes string with ASCII equivalent: `f'Paper trade: BUY@{result["_buy_price"]} -> SELL@{result["_exit_price"]}'` (use `->` instead of `→`). Alternatively: set `PYTHONIOENCODING=utf-8` environment variable before starting uvicorn.

**File:** `app/paper_trading/paper_router.py`

---

## BUG-002 — [HIGH] WebSocket not functional — uvicorn[standard] missing

**Module:** `uvicorn / app/websocket/`  
**Status:** OPEN  
**Trigger:** Every WebSocket connection attempt from frontend

### Root Cause
Uvicorn was installed without the [standard] extras. The `websockets` and `wsproto` libraries are missing. Without them, uvicorn cannot upgrade HTTP connections to WebSocket protocol. The frontend connects to /ws/ticks, /ws/live, /ws/market — all return HTTP 404.

### Impact
Market Watch page has no live tick feed. Real-time chart updates unavailable. ConnectionResetError [WinError 10054] fires on every frontend WebSocket reconnect attempt, flooding the backend log. The log showed 30+ such errors during a single verify run.

### Log Evidence
```
WARNING: No supported WebSocket library detected. Please use 'pip install uvicorn[standard]', or install 'websockets' or 'wsproto' manually.
INFO: GET /ws/ticks HTTP/1.1 404 Not Found
```

### Suggested Fix
Run: `pip install "uvicorn[standard]"` inside the .venv. This installs websockets and httptools. Then restart the backend. WebSocket routes should upgrade correctly.

**File:** `requirements.txt / .venv`

---

## BUG-003 — [LOW] bcrypt version detection warning on every login

**Module:** `.venv/Lib/site-packages/passlib/handlers/bcrypt.py`  
**Status:** OPEN  
**Trigger:** Every POST /users/login call

### Root Cause
passlib tries to read `bcrypt.__about__.__version__` to detect the library version. The installed bcrypt version removed the `__about__` module. This causes an AttributeError which passlib catches and logs as '(trapped) error reading bcrypt version'.

### Impact
Login still succeeds and JWT is issued correctly. Pure cosmetic noise in the log. No security impact. No performance impact.

### Log Evidence
```
(trapped) error reading bcrypt version
AttributeError: module 'bcrypt' has no attribute '__about__'
```

### Suggested Fix
Pin passlib to a version compatible with the installed bcrypt: `pip install passlib==1.7.4 bcrypt==4.0.1` OR upgrade passlib: `pip install --upgrade passlib`

**File:** `.venv (dependency version mismatch)`

---

---

## BUG-004 — [HIGH] 7 secondary endpoints return 404/422 during full endpoint sweep

**Module:** Multiple routers (risk, portfolio, signal, strategy, indicators, execution, market)  
**Status:** OPEN  
**Trigger:** Every GET request to these paths during stability run pre-sweep and post-sweep

### Root Cause
During the full endpoint sweep, 7 non-paper-trading endpoints returned 404 or 422. The paths tested are plausible based on router names but may not match the actual registered routes. Alternatively the endpoints exist but require query parameters or a request body that was not supplied.

### Runtime Evidence (from stability run — both pre-run and post-run sweeps)
```
FAIL [404]   14.16ms  GET /risk/metrics
FAIL [404]   14.96ms  GET /portfolio/
FAIL [404]   15.74ms  GET /signal/latest
FAIL [404]    3.95ms  GET /strategy/
FAIL [404]   26.98ms  GET /indicators/list
FAIL [422]   30.12ms  GET /execution/orders  ← 422 = endpoint exists, missing required param
FAIL [404]   34.12ms  GET /market/status
```

### Impact
These 7 endpoints correspond to UI pages: Risk, Portfolio, Signal, Strategy, Charts (indicators), Execution, Market Watch. If the frontend calls these exact paths, those pages return empty or error state to the user. Trade engine (paper trading) is unaffected — all 420 trade calls returned 200.

### Suggested Fix
Map each router file to find the actual registered paths. Do NOT guess or speculate — read each router file (`app/risk/risk_router.py`, `app/portfolio/portfolio_router.py`, etc.) to find the real route decorators, then verify with actual HTTP calls.

**Files:** `app/risk/`, `app/portfolio/`, `app/signal/`, `app/strategy/`, `app/indicators/`, `app/execution/`, `app/api/market_api.py`

---

## Runtime API Failures

**None.** All 420 trade API calls returned 200 OK.


---
*All bugs captured from actual runtime logs and API responses.*
*No speculative bugs included.*