Place orders via interactive confirmation (no bypass/passphrase)

[eaitbrahim]

Option A, as agreed: placing a live order no longer needs bypass mode, the arm-bypass token, or the dangerous-action passphrase. In confirm mode the agent shows the previewed order and asks; it places only on an explicit yes. Bypass mode is untouched and stays the headless path for future autonomous use.

The rails are untouched — this is important

Every order still runs the 15 hard rails first. The confirmation is an additional human gate after they pass, never a replacement. There's a test pinning that a rail-vetoed order never reaches the prompt — the rails run first, the human second. So removing the bypass ceremony did not weaken any hard limit.

Why this was small

The executor was already built for it — execute takes confirm_fn(preview) -> bool; the agent just hardcoded it to None. This threads a real confirm_fn through run_once / loop / _handle_exits (all defaulting to None, so every existing caller and test is unchanged and still fails closed), and keel agent passes an interactive prompt in confirm mode.

_interactive_confirm renders the broker preview and asks; it fails closed on a non-TTY, so a script or cron never trades unattended.

Net effect

Placing an order goes from:

python3 -c "authz.set_passphrase(...)"   # no CLI for this
keel arm-bypass --passphrase ...
keel agent --bypass --passphrase ...

to:

keel agent
  Rails PASSED. Coinbase order preview:
    order_total: 5.00 ...
  Place this order? [y/N]: y

Arguably safer for supervised use — a human looks at the real order every single time instead of pre-authorizing a window.

Tests

approved → places the BUY (+ its OCO bracket); declined → nothing; no confirm_fn → still nothing (backward compat); confirm_fn sees the preview; a rail veto never reaches the prompt; _interactive_confirm yes/no/non-TTY; and the agent command wires the interactive prompt in confirm mode, None in bypass.

Follow-ups (not in this PR)

• The go-live runbook (Go-live runbook for the first supervised live order #116, unmerged) still describes the old bypass/passphrase dance and must be rewritten against this.
• Still on your list: ship config.yaml in the release + a seed-the-db command — coming as a separate PR.

1266 tests pass (up from 1258), ruff clean.

🤖 Generated with Claude Code