gordon-exchange

Purpose

Exchange client library for the Gordon platform. Everything that talks to Binance lives here: REST clients, WebSocket streams, rate limiter, and fee model. gordon-executor instantiates an authenticated futures client; gordon-data instantiates a read-only spot client. No other service touches Binance directly.

gordon-core was absorbed into this crate at 2.0.0 (audit H2b, 2026-04-24) — pub mod core { errors, types } is the residue. The cross-service market primitives (Candle, Pair, Side, Timeframe) moved to gordon-domain at 5.0.0 and are re-exported from gordon_exchange::core::types for source compatibility.

Version + status

5.0.2 — stable. 3.0.0 removed the paper-trading simulator; 5.0.0 completed the market-primitives move to gordon-domain. Backend close-out audit H2b complete.

Public surface

• gordon_exchange::binance::BinanceExchange — authenticated Futures REST + WS. Trading-capable keys only in gordon-executor.
• gordon_exchange::binance::BinanceRestClient — unauthenticated or read-only Futures REST.
• gordon_exchange::binance::BinanceWebSocket — Futures user-data stream + kline streams.
• gordon_exchange::binance::BinanceSpotRestClient — read-only Spot REST (gordon-data, story 07e).
• gordon_exchange::binance::BinanceSpotWs — Spot WebSocket.
• gordon_exchange::binance::RateLimiter — per-IP / per-UID / per-weight token buckets aligned with Binance published weight budget.
• gordon_exchange::traits::Exchange — trait surface implemented by BinanceExchange.
• gordon_exchange::core::errors::GordonError — adapter-level error (distinct from the platform-level gordon_kernel::GordonError; two coexist by design until a future collapse epic).
• gordon_exchange::core::types::* — Direction, MarginMode, Order, OrderStatus, OrderType, Position, Portfolio. Market primitives re-exported from gordon-domain.

Dual-network support

Testnet and prod are selected by a runtime testnet: bool field on BinanceRestClient::new / BinanceWebSocket::new / BinanceSpotRestClient::new / BinanceSpotWs::new. Never a build-time feature flag. Tests override via with_base_url.

Binance testnet (real exchange API, separate keys) is the forward-test gate. No paper-trading mode exists in v7.

Authority boundaries

• Only gordon-executor holds trading-capable keys. gordon-exchange provides the client; the secret lives in the executor vault slot.
• gordon-data may carry read-only keys — startup probe checks BinanceAccount::can_withdraw == false and refuses to boot on a mismatch. Separate API-key principal from the executor's.
• No other service instantiates an authenticated Binance client.

Invariants

• No silent retries on order submission. place_order and every submit_order / close_position / modify_stop_price path go through post_signed_no_retry. A lost response might mean the order already landed; a silent retry would double-submit or mask the first landing behind a duplicate clientOrderId rejection. Tests pin the 5xx and 429 non-retry cases.
• Rate limits enforced client-side by a shared token bucket. The exchange is never relied upon to reject for the platform.
• Two GordonError types coexist. The adapter-level gordon_exchange::core::errors::GordonError and the platform-level gordon_kernel::GordonError are distinct. Import the path you need — do not paper over with a blanket re-export.
• Zero #[allow(...)] in production code.

Dependencies of note

• gordon-domain — Candle, Pair, Side, Timeframe are owned there since 5.0.0.
• No dependency on gordon-strategy, gordon-data, or any service crate.

Where it lives

• Repo: gordon-exchange/
• kellnr: https://kellnr.lepaux.com/crates/gordon-exchange (LAN-only)

Related

• gordon-domain — canonical market primitives since 5.0.0.
• gordon-strategy — explicitly has no exchange dependency; strategies consume already-fetched data.