baton-trade

The only write path, and it is gated.

The gated order path to Alpaca. The agent running a strategy does not hold order tools at all: its toolset is scoped to data-only families, so placing, replacing, cancelling and closing are absent from what it can call. The single remaining write path is this module, and every route through it passes an approval gate first, enforced by the type system rather than by policy: the approval token cannot be constructed outside the gate, and submit requires one.