feat(chartctl): Chart Deployments — remote EA deployment over HTTP

[Marinski]

Chart Deployments (chartctl)

Chart Deployments (chartctl) lets you attach Expert Advisors to charts with .set files over the HTTP API — no RDP, no terminal restart, and no manual chart work.

The API stores the desired state, while a resident Loader EA inside the terminal reconciles charts to match that state and reports the observed state back. A deployment only reaches the running state after the Loader confirms the Expert Advisor is actually live on a chart.

New Endpoints

Method	Endpoint	Description
POST / GET / DELETE	/experts, /experts/<hash>	Stage, list, or remove EA .ex5 files
POST / GET	/sets, /sets/<name>	Stage, list, or inspect .set files (returns parsed inputs)
POST / GET	/deployments	Create or list deployments
GET / PATCH / DELETE	/deployments/<id>	Inspect, pause/resume, change set, or delete a deployment
POST	/deployments/reconcile	Force an immediate reconcile
GET	/charts	Live chart / EA inventory
GET	/loader	Loader EA status and version
POST	/charts/<id>/screenshot	Capture a chart as PNG
POST	/charts/<id>/close	Close any chart by ID
GET / PUT	/webrequest	Read or update the WebRequest allowlist
POST	/webrequest/apply	Re-apply the allowlist immediately

What's Included

• mt5api/chartctl/ — paths, setparse, tpl_builder, registry, command
• mt5api/handlers/chartctl.py — lock-free REST surface, gated by CHARTCTL_ENABLED (config-driven; routes are omitted when disabled)
• mt5api/handlers/webrequest.py — WebRequest allowlist provisioning
• mt5api/chartctl/autoit_webrequest.py — AutoIt GUI automation
• assets/experts/MT5ChartLoader.mq5 — reference Loader EA (~60 lines)
• assets/experts/include/ChartControl.mqh — portable protocol include
• assets/autoit/ — AutoIt interpreter and GUI automation scripts
• scripts/compile-chartctl-loader.bat — zero-touch bootstrap compiler
• scripts/config_helper.py — write_ini emits [StartUp] Expert= and provides the chartctl_enabled query command
• docs/chart-control-protocol.md — complete protocol specification
• tests/test_chartctl_units.py + tests/test_chartctl_endpoints.py — 43 tests plus a Python fake_loader for Linux CI (no MT5 dependency)
• tests/test_webrequest.py — 23 tests covering the allowlist codec and endpoints
• examples/chartctl/deploy.sh — runnable deployment example

Zero-Touch Bootstrap

No RDP step is required.

On VM boot:

1. compile-chartctl-loader.bat compiles the Loader in every broker base using MetaEditor64.
2. The resulting .ex5 is propagated to every terminal instance.
3. config_helper.py write_ini adds a [StartUp] section to mt5start.ini.

The Loader automatically attaches when the terminal starts.

To disable this behavior for a specific terminal, set:

chartctl: false

How It Works

The Loader polls desired.json, reconciles the desired state with actual charts, writes observed.json so the API knows what is actually running. All handler endpoints are lock-free and perform only file I/O.

WebRequest Allowlist

Two application methods selected automatically at runtime: AutoIt GUI automation (Windows VM) or common.ini encoding (Bare Metal).

Changelog

See the CHANGELOG.md Unreleased section for the complete list of changes.

Testing

pytest tests/ --ignore=tests/integration --ignore=tests/test_requirements_sync.py
→ 284 passed
  • 43 chartctl tests
  • 23 webrequest tests
  • 218 existing tests

[Marinski]

Merge order: this one goes last

These three were built in a sequence and should land in it:

1. feat(ops): recreate VM containers that are persistently unhealthy #15 — vm-watchdog
2. feat(compile): POST /compile — MQL5 source in, .ex5 out #16 — POST /compile
3. feat(chartctl): Chart Deployments — remote EA deployment over HTTP #10 — this PR

All three are now rebased on current master independently, so each shows MERGEABLE on its own. That is a little misleading, and worth stating rather than letting it be discovered at merge time.

Merging this one before the other two would not break anything — but it makes the other two harder, because the overlap lands on them instead. This PR is the widest of the three (it touches mt5api/config.py, main.py, server.py, scripts/config_helper.py, Dockerfile.test, run.sh, README.md, CHANGELOG.md), so it is the cheapest one to rebase and the most expensive one to rebase around.

What actually happens, rehearsed rather than assumed

I merged all three locally in the order above:

Step	Result
master + #15	clean
+ #16	clean
+ #10 (this PR)	conflicts in 4 files

So even in the right order this one needs a rebase once the first two land. The conflicts are all additive collisions, not semantic ones:

• mt5api/server.py — feat(compile): POST /compile — MQL5 source in, .ex5 out #16 and this both add an import and a route block in the same two places
• Dockerfile.test — both append a script to the same COPY line
• CHANGELOG.md, docs/rest-api.md — both add an entry at the same anchor

Every one resolves as a union. Nothing here disagrees about behaviour; the two features just grew into the same lines.

I will rebase and force-push this within a few minutes of #16 landing, so it does not sit in a conflicted state. Ping me if you would rather I do it in a different order, or if you plan to merge this one first — the rehearsal is cheap to redo the other way round.

[psyb0t]

I verified assets/autoit/AutoIt3_x64.exe against AutoIt's official v3.3.18.0 portable archive. The SHA-256 is 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7 on both sides, and the files are byte-for-byte identical. That resolves the binary provenance concern.

One required packaging fix remains before merge. AutoIt's EULA permits redistribution, including inside another product, but requires every copy to include its copyright and trademark notices and a copy of the EULA. Please add the unmodified official AutoIt EULA and required notices under assets/autoit/, then this part is good to go.

[Marinski]

Done in 4eae86b — assets/autoit/ now satisfies the EULA's own redistribution condition ("each copy should include all copyright and trademark notices, and shall be accompanied by a copy of this EULA"):

• EULA.htm — the official EULA, verbatim as the AutoIt Team publishes it in the AutoIt v3 documentation, matching the release the bundled binary ships in. Not retyped, not reformatted.
• NOTICE.txt — the copyright notice taken from the binary's own version resource (© 1999-2025 Jonathan Bennett & AutoIt Team), the trademark notice from autoitscript.com, full provenance (version 3.3.18.0, the sha256 you verified, source archive), and an explicit line that the .au3 scripts beside it are this repository's own automation, not AutoIt's.

While there I re-downloaded the official portable archive and confirmed the same byte-identity you did (5d69a932…), so binaries.lock.json's provenance note no longer leans on the signature alone — it now records the archive verification from both sides of this review and points at the EULA/notice files as the redistribution terms. docs/chart-deployments.md references NOTICE.txt where the bundled interpreter is introduced. make verify-binaries still passes.

Merge order

#15 → #16 → #18 → #10 — this one last, as before. It is the widest of the four and shares mt5api/config.py, scripts/config_helper.py, config.yaml.example, and the [Unreleased] changelog section with #16 and #18, plus run.sh/Dockerfile.test with #15. It is already rebased onto current master (post-#17; the Dockerfile.test COPY conflict resolved as the union), and the standing commitment from the earlier rehearsal holds: I will re-rebase promptly after each predecessor merges.