feat(cli): add SDK-backed Gemini Markets CLI

[fuller]

Summary

• Add the SDK-backed Gemini Markets CLI for public market data, prediction markets, account balances, orders, and real-time streams.
• Add OAuth PKCE login with secure OS keychain credential storage and token refresh persistence.
• Extend the Go SDK with the OAuth, authenticated service, and stream prerequisites required by the CLI.
• Keep the CLI thin: command validation and rendering stay in the CLI while API and transport behavior remain in the SDK.

Validation

• CLI make check: module verification, tests, race tests, vet, build, package docs, and help smoke test.
• Full SDK tests, race tests, and vet.
• Production OAuth status, ticker, balances, order book, and authenticated WebSocket smoke tests.
• Production out-of-the-money spot order placed, confirmed unfilled, cancelled, and verified inactive with no observed balance change.
• git diff --check.

The CLI remains pre-release; release automation and published binaries are intentionally left for follow-up work.

[nostradamus-bot]

Nostradamus Risk Rating — Medium

The PR adds a new OAuth PKCE credential lifecycle (login, storage, refresh) for a CLI that can place orders on the Gemini exchange, with internal/credentials/file_keyring.go introducing plaintext JSON credential storage (0600) as a headless fallback and a predictable loopback port (8787) during the login flow. No existing HMAC signing primitives are modified and no new unauthenticated attack surface is exposed to the Gemini API, keeping likelihood at Medium despite the High sensitivity of the credential management components.

[ximt]

Requested changes. I found seven actionable correctness and safety issues, described inline: the stream lifecycle subscriber can be closed on overflow and is silently discarded; credentials are keyed only by profile rather than environment; prediction-order validation hard-codes a price grid and accepts decimal syntax the API validator rejects; history-only flags can be silently ignored; time-bounded history accepts an offset the API ignores; and the README claims the current SDK tags are signed when they are only annotated. CLI and SDK go test ./..., go test -race ./..., go vet ./..., formatting, module verification, and CLI help/build checks pass, but those checks do not cover these contract mismatches.

[sdlc-pr-bot]

Change Control Evidence Check

Authorization — ❌ Fail

Evidence:

• Linear ticket: ⚠️ No ticket linked
• Change owner: Andrew Fuller
• Type of change: Normal

Testing — ✅ Pass

Evidence:

• Tests from CI checks: ➖ No tests ran
• Security scans: ✅ Passed
• Testing summary: ✅ Found in PR description
  • Summary: CLI and SDK testing completed including module verification, race condition detection, linting, build validation, and smoke tests across production OAuth, ticker, balances, order book, and WebSocket functionality. Production spot order lifecycle testing (placement, confirmation, cancellation, and verification) completed successfully with no balance changes observed.
• Evidence link: View run

Approval — ✅ Pass

Evidence:

• Approver: Jimmy Huang
• Approval source: GitHub PR Review
• Approval timestamp: 2026-09-08 23:38 UTC

Segregation of Duties — ✅ Pass

Validated:

• PR author: Andrew Fuller
• Commit author(s): dgame84, fuller
• Approver: Jimmy Huang
• Result: Implementer and approver are different people ✅

---

Last checked: 2026-09-09 00:13 UTC

↩ Re-run Clarissa if tickets, CI, or approvals have changed.

[ximt]

Re-reviewed the latest head 269a940. The author addressed all previously reported correctness and safety issues, and I found no new critical or important code findings. CLI, SDK, generator, race, vet, formatting, module verification, and published-spec checks pass. Approved from a code-review perspective. The separate ssdlc/validation check is still failing because its evidence report has no linked ticket/authorization metadata.