diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..03526fe
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,29 @@
+name: quant-os-ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  deterministic-local:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Validate deterministic Quant OS
+        run: bash scripts/validate_all.sh
+      - name: Reject generated bundle drift
+        run: git diff --exit-code -- dist status/status-data.js
+      - name: Reject tracked credential paths
+        shell: bash
+        run: |
+          if git ls-files \
+            | grep -E '(^|/)(\.env(\.[^/]+)?|secrets|credentials|userdata_mini)(/|$)' \
+            | grep -Ev '(^|/)\.env\.example$'; then
+            echo "credential-like tracked path detected"
+            exit 1
+          fi
+      - name: Reject credential-like tracked content
+        run: python3 tools/check_tracked_secrets.py
diff --git a/.gitignore b/.gitignore
index 1d2d2d9..3f67614 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,13 +14,15 @@ htmlcov/
 venv/
 
 # Generated evidence and local data
-artifacts/
+/artifacts/
 reports/
 runs/
-data/raw/
-data/canonical/
-data/snapshots/
-data/qlib/
+/build/
+/data/
+/data/raw/
+/data/canonical/
+/data/snapshots/
+/data/qlib/
 mlruns/
 *.parquet
 *.duckdb
diff --git a/CLAUDE.md b/CLAUDE.md
index 3666851..d362ddc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,15 +1,18 @@
 # CLAUDE.md
 
-This directory is the executable source of truth for Quant OS. `quant60` is
-its first A-share Baseline kernel/package; the project itself also owns data,
-research, portfolio, execution, evidence, and platform adapters. Obsidian
-contains research and status documentation only.
+This independent repository is the executable source of truth for Quant OS.
+`quant_os` is the long-lived product namespace. `quant60` is the compatibility
+namespace for the first A-share Baseline protocol and V1 artifacts; maturity
+scores belong to profiles, never to package names. Obsidian contains research
+and status documentation only.
 
 ## Development commands
 
 Run all commands from this directory:
 
 ```bash
+make architecture
+make standard
 make test
 make bundle
 make smoke
@@ -50,5 +53,8 @@ A change is complete only when:
 1. unit/integration tests pass;
 2. hosted bundles rebuild and pass Python 3.6 syntax checks;
 3. the deterministic smoke and manifest verifier pass;
-4. docs state the exact evidence class and remaining external gate;
-5. no secret or machine-specific absolute path is added to tracked artifacts.
+4. architecture and maturity profile checks pass;
+5. docs state the exact evidence class and remaining external gate;
+6. no secret or machine-specific absolute path is added to executable or public
+   artifacts. Migration/getting-started docs may name the user-confirmed local
+   checkout, but generated evidence must stay repository-relative.
diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
index 546809f..f2696e6 100644
--- a/IMPLEMENTATION_PLAN.md
+++ b/IMPLEMENTATION_PLAN.md
@@ -102,7 +102,8 @@ Qlib 两次 smoke 使用的是确定性两股票 synthetic fixture，性能没
 
 - 同一个 TargetPackage 的聚宽完整 package/plan/orders/fills 导出和本地 peer；
 - 同一个 TargetPackage 的授权 QMT built-in 与 qmttools 回测导出；
-- 至少 20 个交易日的真实 QMT/broker shadow；
+- Baseline 60 至少 20 个交易日、Production 80 同一冻结候选至少 60 个交易日
+  的真实 QMT/broker shadow；
 - 同一 canonical 输入的 L1—L5 差异报告。
 
 **状态**：部分完成；JoinQuant runtime smoke 已执行，但 strict comparison、
@@ -130,7 +131,8 @@ guarded TWAP/POV 和影子证据。
 - 券商实际状态码映射与脱敏回调；
 - 实际 QMT query API 的失败/空列表合同探针；
 - durable scheduler/recovery daemon；
-- 20 个交易日 shadow、日终零未知账差和故障恢复演练；
+- Baseline 60 的 20 个交易日 shadow（Production 80 为同一冻结候选 60 日）、
+  日终零未知账差和故障恢复演练；
 - 券商权限、频率、软件和程序化交易报告确认。
 
 **状态**：仅有未认证的安全边界；不可视为 live-ready。
diff --git a/MIGRATION.md b/MIGRATION.md
new file mode 100644
index 0000000..37bca7e
--- /dev/null
+++ b/MIGRATION.md
@@ -0,0 +1,76 @@
+# Quant OS 独立仓迁移记录
+
+迁移日期：2026-07-30
+
+## 目标位置
+
+- 本地：`/Users/zhangbiao/boat-workspace/Code/quant-os`
+- 远端：`https://git.gomars.fun/boat/quant-os.git`
+- 公共状态：`https://gomars.fun/quant-os/status/`
+- 原仓：`https://git.gomars.fun/boat/quants-strategies.git`
+
+## 历史保留方式
+
+从原仓已提交 `master` 执行：
+
+```text
+git subtree split --prefix=quant-os
+```
+
+路径提交映射：
+
+| 原仓提交 | 独立历史提交 | 内容 |
+| --- | --- | --- |
+| `e561efd` | `48c5f64` | A 股 60 分 Baseline 初始实现 |
+| `f998f4d` | `e5911ca` | Tushare → Qlib 数据桥 |
+| `692f6ef` | `00efeb7` | 公共状态控制台 |
+
+SHA 改变是路径提取的正常结果；作者、时间、顺序和文件历史保留。
+
+原工作树中尚未提交的 TargetPackage、五层链、release reachability 和真实
+JoinQuant execution smoke 被叠加到独立分支，并形成单独 checkpoint
+`919c64c`。原 `quants-strategies` 的 cash-layer 脏改没有进入新仓。
+
+## 本地运行状态
+
+以下目录被 Git 忽略，不进入远端；这是数据安全边界，不只是迁移便利：
+
+- `data/`
+- `artifacts/`
+- `mlruns/`
+- `.venv-*`
+
+迁移时复制前三类并校验清单；只记录文件数、总字节和相对路径/hash，不把
+数据内容或绝对源路径写入公开文档。旧 `.venv-qlib312` 接近 1 GB，脚本中包含原
+绝对路径，不能把“目录搬过去”视为有效环境；新仓应按固定 requirements 重建。
+旧环境在新仓完整验证前不删除。
+
+清单与复核命令：
+
+```bash
+python3 tools/inventory_local_assets.py <old-project-root> \
+  --output /tmp/quant-os-local-assets.json
+python3 tools/inventory_local_assets.py <new-project-root> \
+  --compare /tmp/quant-os-local-assets.json
+```
+
+清单不记录根目录，只记录 `data/`、`artifacts/`、`mlruns/` 的相对路径、字节数
+和 SHA-256；遇到 symlink 会拒绝继续。
+
+## 兼容政策
+
+- `quant-os` / `quant_os` 是新产品入口；
+- `quant60` CLI/import 和 V1 schemas 保留至少两个发布周期；
+- `portable-momentum` 只保留 smoke/example 身份；
+- 旧公共 URL 先保持 302 兼容跳转；稳定观察后再单独升级 308，不能直接 404；
+- 原仓最终只保留独立项目指针，不复制代码。
+
+## 完成条件
+
+1. 独立仓 clean clone 通过 `make local`；
+2. generated bundle/status 无 drift；
+3. secret/绝对路径检查通过；
+4. 新远端 commit 与本地 commit 相同；
+5. 新公共 URL 返回正确独立仓快照；
+6. 旧 URL 有兼容跳转；
+7. 最后才从旧仓移除 `quant-os/` 和旧专属 CI。
diff --git a/Makefile b/Makefile
index ac31528..0410166 100644
--- a/Makefile
+++ b/Makefile
@@ -4,11 +4,18 @@ SMOKE_DIR := artifacts/local-smoke
 RESEARCH_DIR := artifacts/research-smoke
 PARITY_REPORT := artifacts/mock-parity/report.json
 
-.PHONY: test bundle smoke verify research research-verify parity parity-verify doctor status status-check notebook-check notebook-smoke local
+.PHONY: test architecture standard bundle smoke verify research research-verify parity parity-verify doctor secret-scan status status-check notebook-check notebook-smoke local
 
 test:
 	PYTHONPATH=$(PROJECT_PYTHONPATH) $(PYTHON) -m unittest discover -s tests -p '*.py' -q
 
+architecture:
+	PYTHONPATH=$(PROJECT_PYTHONPATH) $(PYTHON) -m quant_os architecture check
+
+standard:
+	PYTHONPATH=$(PROJECT_PYTHONPATH) $(PYTHON) -m quant_os standard validate
+	PYTHONPATH=$(PROJECT_PYTHONPATH) $(PYTHON) -m quant_os standard evaluate
+
 bundle:
 	$(PYTHON) tools/bundle_platforms.py
 
@@ -31,8 +38,12 @@ parity-verify:
 	PYTHONPATH=$(PROJECT_PYTHONPATH) $(PYTHON) tools/export_mock_parity.py verify $(PARITY_REPORT)
 
 doctor:
+	PYTHONPATH=$(PROJECT_PYTHONPATH) $(PYTHON) -m quant_os doctor
 	PYTHONPATH=$(PROJECT_PYTHONPATH) $(PYTHON) tools/capability_probe.py
 
+secret-scan:
+	$(PYTHON) tools/check_tracked_secrets.py
+
 status:
 	$(PYTHON) tools/build_public_status.py
 
@@ -45,4 +56,4 @@ notebook-check:
 notebook-smoke:
 	$(PYTHON) tools/run_colab_notebook.py notebooks/quant_os_colab.ipynb --execute
 
-local: test bundle smoke verify research research-verify parity parity-verify doctor status-check notebook-check notebook-smoke
+local: architecture standard test bundle smoke verify research research-verify parity parity-verify doctor secret-scan status-check notebook-check notebook-smoke
diff --git a/README.md b/README.md
index c530107..18b67d6 100644
--- a/README.md
+++ b/README.md
@@ -1,13 +1,20 @@
-# Quant OS：个人 A 股 60 分 Baseline 工程
+# Quant OS：个人 A 股量化研究到受限生产的独立工程
 
-Quant OS 是项目名；`quant60` 是第一版 A 股 Baseline 的 Python
-包、CLI namespace 与 artifact 协议前缀。
+Quant OS 已从 `quants-strategies` 拆成独立项目。`quant-os` / `quant_os`
+是长期 CLI/import；`quant60` 是第一版 A 股 Baseline 的兼容包、CLI namespace
+与 V1 artifact 协议前缀。60/80 是证据 profile，不再写进产品名。
 
-本项目把 2026-07-22 的技术选型文章落成一个可执行、可审计的模块化单体：
-本地与 Colab 可零账号运行工程 smoke；JQData 登录后可生成不可变快照并直接
-运行 PIT 本地回测/目标决策；聚宽、QMT 与 Qlib 有各自明确的运行入口。
+> 当前交易执行范围仅覆盖上交所、深交所（沪深）。北交所尚未接入，
+> 所有北交所委托必须 `fail closed`；代码映射支持 `.BJ` / `.XBSE`
+> 不代表具备北交所回测或实盘交易能力。
 
-> 当前状态仍是 `NOT_BASELINE_60`。本地五层 vertical slice、单测、
+本项目正在把 2026-07-22 的技术选型实现，从 `quant60` legacy 内核迁移成
+严格边界、可执行、可审计的模块化单体：本地与 Colab 可零账号运行工程
+smoke；JQData 登录后可生成不可变快照并直接运行 PIT 本地回测/目标决策；
+聚宽、QMT 与 Qlib 有各自明确的运行入口。
+
+> 当前状态仍是 `NOT_BASELINE_60`，80 分评估为
+> `BLOCKED_FROM_LIMITED_LIVE`、0/100 已验证证据分。本地五层 vertical slice、单测、
 > synthetic、fake harness、Qlib fixture、真实聚宽 hosted 动量 smoke，以及
 > 单个 synthetic-research TargetPackage 的真实聚宽 **execution smoke**，
 > 都不能代替授权真实数据 OOS、逐层同输入 parity、真实 QMT、券商影子盘、
@@ -17,15 +24,30 @@ Quant OS 是项目名；`quant60` 是第一版 A 股 Baseline 的 Python
 > [`docs/AUDIT_2026-07-25.md`](docs/AUDIT_2026-07-25.md) 与
 > [`gate_scorecard.json`](gate_scorecard.json)。
 
+> 新依赖检查当前只覆盖 `src/quant_os/`；约 26k 行 legacy 仍位于
+> `src/quant60/`、根级 `adapters/`、`platforms/` 与 `tools/`，按 vertical
+> slice 迁移。`doctor.ok = true` 只表示独立仓必需文件和**新 namespace**
+> 边界有效，不表示 legacy 已分层，也不表示达到 60/80。生产 trust provider /
+> issuer registry 尚未实现，仓库不能自行签发正向 80 分资格。
+
+先读：
+
+- [80 分标准](docs/standards/QUANT_OS_80_STANDARD.md)
+- [60 与 80 的差别](docs/standards/BASELINE_60_VS_PRODUCTION_80.md)
+- [面向 80 的三平面架构](docs/architecture/ARCHITECTURE_80.md)
+- [新架构上手](docs/getting-started/GETTING_STARTED_80.md)
+- [独立仓迁移记录](MIGRATION.md)
+
 ## 在线公开验收面板
 
 公开只读入口：
 
-[`https://gomars.fun/quants-strategies/quant-os/status/index.html`](https://gomars.fun/quants-strategies/quant-os/status/index.html)
+[`https://gomars.fun/quant-os/status/`](https://gomars.fun/quant-os/status/)
 
-页面从 `gate_scorecard.json`、平台矩阵、bundle manifest 和证据文档生成
-脱敏的构建时快照，逐层展示数据、模型、回测平台、券商影子盘与 G1—G10
-缺口。它不是实时服务健康页，不发布本地行情、账户状态或运行 artifacts。
+页面从 Production 80 machine profile、`gate_scorecard.json`、平台矩阵、
+bundle manifest 和证据文档生成脱敏的构建时快照，逐层展示数据、模型、
+回测平台、券商影子盘与证据缺口。它不是实时服务健康页，不发布本地行情、
+账户状态或运行 artifacts。
 
 更新权威记录后必须重新生成并检查页面数据：
 
@@ -49,7 +71,7 @@ python3 tools/build_public_status.py --check
 | QMT built-in/qmttools | 默认动量 smoke；TargetPackage 模式为 Python 3.6 backtest-only 消费器 | Python 3.6 语法、TargetPackage/fake/qmttools 合约 | 需要已授权 QMT 客户端、历史数据权限与 TargetPackage 实跑导出 |
 | Qlib 0.9.7 | native momentum backtest；Alpha158/LightGBM CLI/Recorder 工作流 | Python 3.12 两条 fixture 已真实跑通，并保存表级 hash、行列/时间边界和重算指标 | synthetic 两股票没有投资价值；无真实 OOS、L3/L4 parity |
 | Tushare → Qlib | 只读盘点 completed Parquet、校验 checksum、构建/验证不可变 provider、运行本地回测 | 93 个 completed 文件已验证；早期未复权 provider 与两次 byte-identical momentum run | 下载仅到 1993-10；缺复权、真实 benchmark、历史成分/ST/停牌/涨跌停，不能进入生产 decision |
-| XtTrader shadow | 只读账户查询、HMAC 账户绑定、broker observation/snapshot、零下单 target-diff 计划与完整 verifier | fake broker/QMT 合约；所有 broker mutation 均不可达 | 需要授权 QMT 环境的账户合同探针、20 日影子、恢复/对账和券商确认 |
+| XtTrader shadow | 只读账户查询、HMAC 账户绑定、broker observation/snapshot、零下单 target-diff 计划与完整 verifier | fake broker/QMT 合约；所有 broker mutation 均不可达 | 需要授权 QMT 环境的账户合同探针、恢复/对账和券商确认；Baseline 60 至少 20 个交易日，Production 80 当前缺口为同一冻结候选至少 60 个交易日 |
 
 `portable-momentum-v1` 只是当前真实跑过聚宽的跨引擎连通性 smoke，不是
 60 分 Baseline。Baseline 的权威决策留在本地：冻结 Ridge model bundle，
@@ -68,13 +90,14 @@ make local
 
 它依次执行：
 
-1. 全量单元/合约测试；
-2. 聚宽与 QMT 单文件 bundle；
-3. synthetic execution smoke 与完整 manifest verifier；
-4. synthetic research-to-target 与 research manifest verifier；
-5. JoinQuant/QMT mock parity 报告及校验；
-6. capability probe；
-7. Colab notebook 语法检查和逐 cell 本地执行。
+1. 新 namespace 依赖边界和 80 分 profile 评估；
+2. 全量单元/合约测试；
+3. 聚宽与 QMT 单文件 bundle；
+4. synthetic execution smoke 与完整 manifest verifier；
+5. synthetic research-to-target 与 research manifest verifier；
+6. JoinQuant/QMT mock parity 报告及校验；
+7. capability probe；
+8. Colab notebook 语法检查和逐 cell 本地执行。
 
 等价的脚本入口：
 
@@ -437,7 +460,9 @@ key。它必须稳定备份、限制访问且绝不
 官方 query API 对“失败”和“空列表”的返回合同，并记录实际
 terminal/xtquant build、确认 `XtTrade.traded_amount` 成交金额语义与允许
 误差。当前 amount 只是被认证的 informational fact，不参与 target quantity
-或 proposed delta。之后还要累计至少 20 个交易日、恢复演练和零未知账差。
+或 proposed delta。之后还要先满足 Baseline 60 的至少 20 个交易日 shadow、
+恢复演练和零未知账差；Production 80 当前要求同一冻结候选累计至少 60 个
+交易日。
 
 ## Qlib 0.9.7
 
@@ -553,7 +578,8 @@ real_platform_pass = false
 gate_credit = []
 ```
 
-真实 G9 仍要求聚宽/QMT 导出与至少 20 个交易日 QMT 影子记录。完整层级、
+Baseline 60 的真实 G9 仍要求聚宽/QMT 导出与至少 20 个交易日 QMT 影子记录；
+Production 80 当前要求同一冻结候选至少 60 个交易日。完整层级、
 容差和 reason code 见
 [`docs/CROSS_ENGINE_CONSISTENCY.md`](docs/CROSS_ENGINE_CONSISTENCY.md)。
 
@@ -593,7 +619,8 @@ factor risk、CVXPY、TWAP/POV 或 Ridge 上游四层在 hosted 环境被调用
 - 聚宽已有单包 TargetPackage execution 导出，但仍缺授权真实数据的多期
   TargetPackage、本地/聚宽逐层同输入对账；QMT 尚无真实 peer 导出，QMT
   历史 ST 权限正例、账户 query 合同、
-  20 日只读影子、回调/恢复/对账尚未形成真实证据；
+  Baseline 60 所需 20 日只读影子、回调/恢复/对账尚未形成真实证据；
+  Production 80 还要求同一冻结候选累计至少 60 个交易日 shadow；
 - 自动 scheduler、日终对账服务、监控告警与 kill-switch 演练未形成连续证据；
 - 实际券商程序化交易报告、权限、频率与软件要求尚未书面确认。
 
diff --git a/apps/status/README.md b/apps/status/README.md
new file mode 100644
index 0000000..3bda048
--- /dev/null
+++ b/apps/status/README.md
@@ -0,0 +1,7 @@
+# Public status application
+
+The deployable static artifact currently remains in `status/` so the canonical
+public URL stays `/quant-os/status/`. It is a build-time, non-secret evidence
+snapshot, not a live health endpoint.
+
+The next migration replaces Markdown parsing with a machine claims index.
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index f736644..f1176ed 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -300,8 +300,9 @@ synthetic/fake 数据是合同测试，不是市场证据；Qlib synthetic fixtu
 - 授权真实数据训练的冻结模型包和真实 OOS 证据；
 - 真实数据校准的风险、冲击、容量和 TCA；
 - 授权真实数据的多期 JoinQuant 导出、逐层本地对账与真实 QMT peer；
-- 券商状态映射、restart recovery daemon、20 日 shadow 与连续对账；
-- 运维监控、kill-switch 演练和程序化交易合规确认。
+- 券商状态映射、restart recovery daemon、连续对账，以及 Production 80
+  要求的同一冻结候选 60 日 shadow（Baseline 60 的前置门槛为 20 日）；
+- 运维监控、kill-switch 演练和券商程序化交易报告/核查确认。
 
 所以 Quant OS 已具备本地五层 vertical slice 与 TargetPackage 平台边界，
 但仍只是可继续填证据的候选骨架，不是已经达到整体 60 分的实盘系统。证据政策见
diff --git a/docs/BASELINE_VERTICAL_SLICE.md b/docs/BASELINE_VERTICAL_SLICE.md
index 1d92b0b..1cf4988 100644
--- a/docs/BASELINE_VERTICAL_SLICE.md
+++ b/docs/BASELINE_VERTICAL_SLICE.md
@@ -117,7 +117,9 @@ true；Universe、Alpha、Portfolio、Risk 仍为 false，因此
    smoke 作为线路先验，但仍要导出完整多期 identity/plan/orders/fills。
 5. 做 local/JoinQuant/QMT 逐层差异；任何 `UNEXPLAINED` 必须为零。当前无
    QMT peer，所以 G9 仍未通过。
-6. 完成至少 20 个交易日 QMT 只读 shadow、重启/回调/对账和合规确认。
+6. 完成 Baseline 60 所需的至少 20 个交易日 QMT 只读 shadow、重启/回调/
+   对账和券商程序化交易报告/核查确认。Production 80 当前要求同一冻结候选
+   至少 60 个交易日。
 
 ## 用户什么时候需要参与
 
diff --git a/docs/CROSS_ENGINE_CONSISTENCY.md b/docs/CROSS_ENGINE_CONSISTENCY.md
index 82acf5f..423cb28 100644
--- a/docs/CROSS_ENGINE_CONSISTENCY.md
+++ b/docs/CROSS_ENGINE_CONSISTENCY.md
@@ -244,7 +244,7 @@ PYTHONPATH=src:. python -m platforms.qlib_runner \
 | real JoinQuant export vs local canonical run | Yes，覆盖的 layers/dates |
 | licensed qmttools run with saved version/result | Yes，覆盖的 layers |
 | XtTrader shadow using real broker snapshot | Yes，pre-trade/order semantics |
-| ≥20 trading days QMT shadow, zero unexplained differences | 文章 G9 必需 |
+| ≥20 trading days QMT shadow, zero unexplained differences | Baseline 60 的 G9 必需；Production 80 另要求同一冻结候选 ≥60 日 |
 
 真实 JoinQuant smoke 已运行；QMT 和 broker shadow 尚未运行，而且
 JoinQuant 仍缺同输入导出与 local peer，所以 G9 继续为 `not_passed`。
diff --git a/docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md b/docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md
index a2ef506..e6e73e9 100644
--- a/docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md
+++ b/docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md
@@ -68,6 +68,8 @@ still missing:
   portable plan, orders and fills;
 - a local canonical run over the exact same frozen inputs;
 - layer-by-layer L1—L4 comparison with enumerated difference reasons;
-- a real QMT peer run and at least 20 trading days of broker shadow evidence.
+- a real QMT peer run and the Baseline-60 minimum of 20 trading days of broker
+  shadow evidence; Production 80 requires at least 60 trading days for the same
+  frozen candidate.
 
 Accordingly, `gate_scorecard.json` remains `NOT_BASELINE_60`.
diff --git a/docs/PLATFORM_MATRIX.md b/docs/PLATFORM_MATRIX.md
index e8546db..a43c6bf 100644
--- a/docs/PLATFORM_MATRIX.md
+++ b/docs/PLATFORM_MATRIX.md
@@ -16,7 +16,7 @@
 | QMT local harness | built-in wrapper 合同 | Python ≥3.10，无账号 | Python 3.6 source、`ContextInfo` 回滚模拟、动量 smoke 与 TargetPackage 合同 | 不证明 QMT |
 | QMT built-in bundle | GUI backtest-only | 授权 QMT 客户端/历史数据 | 两种模式都硬限制 backtest；TargetPackage 模式不重算上游四层；模块全局 `g` | 尚无 TargetPackage 真实 QMT run/export；10% GUI 配置和执行时钟待取证 |
 | qmttools runner | native-Python QMT backtest/history | 券商分发 `xtquant` + 已登录 terminal | 固定中证 500/10% 参与率、参数、只读 preflight 和 hard backtest/history 合同已测 | 尚无专有运行时实跑 |
-| XtTrader read-only shadow | 账户绑定 target-diff 与 broker observation | MiniQMT/QMT、账户查询权限、既有本地 HMAC key | HMAC 账户绑定 + authenticated evidence envelope、decision/observation semantic replay、资产/持仓/委托/成交恒等式、fail-closed exact verifier 与 fake broker 合同 | HMAC 不是 broker attestation；仍缺官方 query 失败/空结果合同、callback/restart、20 日真实 shadow；not live-ready |
+| XtTrader read-only shadow | 账户绑定 target-diff 与 broker observation | MiniQMT/QMT、账户查询权限、既有本地 HMAC key | HMAC 账户绑定 + authenticated evidence envelope、decision/observation semantic replay、资产/持仓/委托/成交恒等式、fail-closed exact verifier 与 fake broker 合同 | HMAC 不是 broker attestation；仍缺官方 query 失败/空结果合同及 callback/restart；Baseline 60 至少 20 个交易日，Production 80 当前缺口为同一冻结候选至少 60 个交易日；not live-ready |
 | Qlib native momentum | signal/model research | CPython 3.12 + exactly `pyqlib==0.9.7` | 真实本地 fixture 成功，24 signal；保存 signal/report hash、表边界和重算 portfolio 指标 | synthetic 两股票；无真实数据/OOS，无 L3/L4 parity |
 | Qlib Alpha158/LightGBM | model fit + Recorder workflow | 同上 + LightGBM/MLflow stack | 真实 fixture 完成 model/Recorder；读取 portfolio report，保存表 hash、边界、重算指标与 artifact path | synthetic 两股票性能无意义；真实 provider/OOS 和冻结模型缺失 |
 | Tushare local → Qlib | completed Parquet 的只读盘点、不可变 provider 与本地研究 smoke | 同上 + `pyarrow==24.0.0`；本地镜像 | 93 个 completed 文件全部通过 size/SHA/row-count；v4 provider verifier 成功；同一动量命令连续两次 evidence JSON 逐 byte 相同 | `daily` 仅完成约 8.2%，缺复权、真实 benchmark、PIT 成分/ST/停牌/涨跌停；`production_ready=false` |
diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 0000000..7d52a5d
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,10 @@
+# Quant OS documentation map
+
+- 80 分标准：[`standards/QUANT_OS_80_STANDARD.md`](standards/QUANT_OS_80_STANDARD.md)
+- 60 与 80：[`standards/BASELINE_60_VS_PRODUCTION_80.md`](standards/BASELINE_60_VS_PRODUCTION_80.md)
+- 新架构：[`architecture/ARCHITECTURE_80.md`](architecture/ARCHITECTURE_80.md)
+- 上手：[`getting-started/GETTING_STARTED_80.md`](getting-started/GETTING_STARTED_80.md)
+- 独立仓 ADR：[`adr/0001-independent-project-and-three-planes.md`](adr/0001-independent-project-and-three-planes.md)
+- 当前实现架构：[`../docs/ARCHITECTURE.md`](ARCHITECTURE.md)
+- 平台矩阵：[`PLATFORM_MATRIX.md`](PLATFORM_MATRIX.md)
+- Tushare 数据：[`TUSHARE_LOCAL_DATA.md`](TUSHARE_LOCAL_DATA.md)
diff --git a/docs/TUSHARE_LOCAL_DATA.md b/docs/TUSHARE_LOCAL_DATA.md
index 516c400..739db6c 100644
--- a/docs/TUSHARE_LOCAL_DATA.md
+++ b/docs/TUSHARE_LOCAL_DATA.md
@@ -111,7 +111,7 @@ Signal/Target/Order/Broker 合同。当前 Tushare adapter 只实现第一条链
 从 Quant OS 根目录执行。镜像路径只放在当前 shell 环境变量中，不写入 Git：
 
 ```bash
-export QUANT_OS_ROOT=/path/to/quants-strategies/quant-os
+export QUANT_OS_ROOT=/path/to/quant-os
 export TUSHARE_MIRROR_ROOT=/path/to/tushare-mirror
 cd "$QUANT_OS_ROOT"
 
diff --git a/docs/adr/0001-independent-project-and-three-planes.md b/docs/adr/0001-independent-project-and-three-planes.md
new file mode 100644
index 0000000..f03bc0c
--- /dev/null
+++ b/docs/adr/0001-independent-project-and-three-planes.md
@@ -0,0 +1,35 @@
+# ADR-0001：Quant OS 独立仓与三平面模块化单体
+
+- 状态：Accepted
+- 日期：2026-07-30
+
+## 背景
+
+Quant OS 原位于 `quants-strategies/quant-os`，把操作系统框架和具体策略仓库
+混在一起；包名 `quant60` 又把成熟度写进产品身份。继续迭代到 80 会造成路径、
+CI、发布 URL、import 和 artifact 身份持续破坏。
+
+## 决策
+
+1. Quant OS 迁为独立项目 `boat/quant-os`。
+2. `quant-os` / `quant_os` 是长期产品 CLI/import。
+3. `baseline-60` / `production-80` 是 profile，不是新包。
+4. 使用三平面模块化单体，专有 SDK 通过 adapter/runtime 隔离。
+5. `quant60` 和 V1 artifact 至少保留两个兼容发布周期。
+6. 迁仓和大模块重构分成独立提交；先证明行为等价，再按 vertical slice 拆分。
+
+## 后果
+
+正面：
+
+- 策略仓与框架生命周期解耦；
+- 80 分标准成为机器可验收控制面；
+- QMT mutation authority 可以独立封闭；
+- 历史证据和 Colab/平台入口有稳定产品名。
+
+代价：
+
+- 一段时间内同时存在 `quant_os` 与 `quant60`；
+- 根级 legacy adapters/platforms 仍需逐步迁移；
+- 新旧公开 URL 需要并行和重定向；
+- subtree split 会重写原路径提交 SHA，必须保存映射。
diff --git a/docs/architecture/ARCHITECTURE_80.md b/docs/architecture/ARCHITECTURE_80.md
new file mode 100644
index 0000000..cfdeeab
--- /dev/null
+++ b/docs/architecture/ARCHITECTURE_80.md
@@ -0,0 +1,167 @@
+# Quant OS 面向 80 分的目标架构
+
+状态：本轮已建立边界、长期 namespace、机器标准和兼容入口；大模块拆分按
+vertical slice 继续进行，不声称已经完成 26k 行重写。
+
+## 1. 架构选择
+
+采用**严格边界的模块化单体 + 专有 runtime 代理**，不是微服务。
+
+原因：
+
+- 个人系统不需要承担微服务的网络、部署和分布式一致性成本；
+- QMT、聚宽、Qlib、JQData 有互不兼容的 Python/SDK 运行时，必须物理隔离；
+- 决策身份、证据链和本地重放需要单一仓库和明确的事务边界；
+- 模块边界可以先在进程内强制，达到真实吞吐或隔离需求后再拆服务。
+
+## 2. 三平面
+
+```mermaid
+flowchart LR
+  B["Composition root<br/>CLI · runtime wiring"] --> C
+  B --> X
+  C["Control plane<br/>RunSpec · orchestration · release policy"] --> A["Application use cases"]
+  A --> D["Data plane<br/>PIT → research → portfolio → execution"]
+  D --> P["Ports"]
+  X["Adapters / proprietary runtimes<br/>JQData · Qlib · JoinQuant · QMT · XtTrader"] --> P
+  D --> E["EvidenceSink port"]
+  C --> E
+  X --> E
+  E --> V["Evidence plane<br/>manifest · parity · scorecard · claims"]
+```
+
+硬规则：
+
+- Control plane 只编排 RunSpec、状态和发布，不计算信号，不直接调用券商 SDK。
+- Data plane 只消费不可变输入，产生 model、weight 和 execution intent；它不读
+  网页状态或 Gate。
+- Evidence plane 只记录已经发生的事实，不得修改 target、order 或 broker fact。
+- Adapter 向内实现 port；core 永远不 import `jqdatasdk`、`qlib`、`xtquant`
+  或 hosted 平台全局 API。
+- `ReadBrokerPort` 与 `TradeBrokerPort` 分离。拥有查询权不等于拥有下单权。
+- `composition` 是唯一同时依赖 application/control 与 adapters 的受检装配根；
+  adapter 只实现 port，不反向 import application。
+
+## 3. 依赖方向
+
+```text
+foundation
+    ↑
+contracts / ports
+    ↑
+data | research | portfolio | execution
+    ↑
+application
+    ↑
+control
+    ↑
+composition / CLI
+
+adapters ──implements──> ports
+evidence <── consumes immutable envelopes
+composition ──wires──> application + control + adapters
+```
+
+新 namespace 的边界由 `quant_os.architecture.validate_architecture` 扫描 AST
+执行。CI 会拒绝例如 `research -> execution`、`data -> control` 的倒置依赖，
+也会拒绝新层绕回根级 `quant60`、`adapters`、`platforms` 或 `tools`。
+只有 `composition` 可以临时调用 compatibility 内核；每个 vertical slice
+迁完后继续收窄。
+
+## 4. 目录
+
+```text
+src/quant_os/
+  foundation/    # ID、双时钟、symbol、money
+  contracts/     # DTO、schema registry、版本迁移
+  ports/         # Data/Engine/ReadBroker/TradeBroker/EvidenceSink
+  data/          # PIT snapshot、catalog、quality
+  research/      # feature、split、model、evaluate
+  portfolio/     # risk、cost、capacity、optimizer
+  execution/     # intent、OMS、reconcile、kill switch
+  application/   # ingest/train/backtest/publish/shadow use cases
+  control/       # RunSpec、orchestrator、release policy
+  evidence/      # manifest、claim、parity、maturity
+  adapters/      # provider/platform/broker implementations
+  composition/   # 唯一受检进程装配根
+
+runtimes/        # portable36、JoinQuant、QMT built-in、Colab
+profiles/        # baseline-60、production-80
+examples/        # 永不晋级为候选的 smoke 策略
+status/          # 可发布静态验收快照
+```
+
+`quant_os` 是长期产品 namespace；成熟度只存在于 profile。当前 AST checker
+只覆盖新 namespace（现为迁移壳层与新增控制代码），不会把约 26k 行 legacy
+自动宣称为已分层。`quant60` 保留两个
+兼容发布周期，继续读取/写入现有 V1 artifact，避免历史证据失效。
+
+## 5. 当前代码如何迁移
+
+| 当前模块 | 问题 | 目标位置 | 迁移条件 |
+| --- | --- | --- | --- |
+| `portable_core.py` | symbol、TargetPackage、动量、sizing、delta 混合 | foundation/contracts/portfolio/execution + example | golden vectors 先行 |
+| `experiment.py` | fixture、研究、编排、证据混合 | research + application + evidence | real snapshot Ridge slice 接通 |
+| `qmt_shadow.py` | 规划、签名、落盘、重放 3595 行 | execution/application/evidence | 真 QMT contract probe 后冻结 |
+| `snapshot_pipeline.py` | 数据、决策、broker clock 混合并依赖 backtest 私有函数 | data + application + execution | 先建立公共合同 |
+| `backtest.py` | engine 与 artifact publisher 混合 | local adapter + evidence | V1 manifest reader 保持兼容 |
+| 平台 wrapper | JoinQuant/QMT 重复执行逻辑 | shared portable36 consumer + thin mapping | Python 3.6 golden test |
+| status builder | 解析 Markdown 形成机器状态 | 只读 machine claims index | 标准/assessment 已先机器化 |
+
+## 6. 唯一决策权威
+
+当前最大结构问题不是文件太大，而是存在两个上游决策权威：
+
+1. 真实 provider snapshot 仍走 `portable-momentum-v1`；
+2. Ridge 五层链只在 synthetic research 中产生 TargetPackage。
+
+目标必须统一为：
+
+```text
+authorized immutable PIT snapshot
+  -> frozen feature/model
+  -> portfolio + independent post-risk
+  -> TargetPackage (weights, no account quantities)
+  -> JoinQuant/QMT thin execution consumer
+```
+
+hosted runtime 不再现场重算 Alpha。`portable-momentum` 永远留在 example/smoke，
+不能被默认 bundler 静默提升成生产候选。
+
+跨引擎 strict peer 是 local、JoinQuant 与 QMT 的 L1—L5。Qlib 只比较其声明
+参与的层级；只有显式导出同一冻结模型和组合实现时，才可提升比较范围。
+Alpha158/LightGBM 研究工作流不能冒充 portable candidate 的 L3/L4 peer。
+
+## 7. 分阶段路线
+
+### 已在本轮落地
+
+- 独立仓历史分支；
+- `quant_os` 长期 CLI/import，`quant60` 兼容；
+- 七维 80 分 machine profile 和 fail-closed evaluator；
+- standard/profile canonical hash、可信 Baseline 前置、不可跳过的 77→canary→80
+  授权链及 `TEST_ONLY` 信任隔离；
+- 新 namespace 层级和依赖检查；
+- composition root 与 adapter 单向依赖；
+- ReadBroker/TradeBroker/EvidenceSink port；
+- 独立根 CI；
+- 独立仓 clean-clone 测试修复；
+- 架构、标准、迁移和上手文档。
+
+### 下一阶段
+
+1. 建立 golden vectors 和 V1/V2 schema registry；
+2. 把真实 snapshot 接入 Ridge 主链，消除双决策权威；
+3. 先拆一个完整 vertical slice，而不是按文件批量搬家；
+4. 平台 wrapper 收敛为同一个 portable consumer；
+5. status builder 改读统一 claims index，不再解析 Markdown；
+6. 取得真实 QMT 后接通 read-only contract probe、shadow 和对账。
+
+### 依赖外部环境的阶段
+
+- 完整授权 JQData/OOS；
+- 多期真实聚宽导出；
+- 真 QMT/qmttools/XtTrader；
+- 60 个交易日 shadow；
+- 10 个交易日受限资金 canary；
+- 生产 SLO、RPO/RTO、凭据轮换、券商程序化交易确认。
diff --git a/docs/getting-started/GETTING_STARTED_80.md b/docs/getting-started/GETTING_STARTED_80.md
new file mode 100644
index 0000000..cc064bb
--- /dev/null
+++ b/docs/getting-started/GETTING_STARTED_80.md
@@ -0,0 +1,299 @@
+# Quant OS 新架构上手
+
+这份文档只给出当前真实可运行入口。每一步都标明它需要什么、产生什么，以及
+不能证明什么。
+
+## 0. 先认清当前声明
+
+```text
+Baseline 60: NOT_BASELINE_60 (0/10 gates)
+Production 80: BLOCKED_FROM_LIMITED_LIVE (0/100 verified evidence points)
+Broker mutation: disabled
+Investment value claim: false
+```
+
+这是 fail-closed 结论，不妨碍运行本地工程 smoke。
+
+## 1. 本地路径和安装
+
+独立仓：
+
+```text
+~/boat-workspace/Code/quant-os
+```
+
+推荐 Python 3.12：
+
+```bash
+cd ~/boat-workspace/Code/quant-os
+python3.12 -m venv .venv-core
+source .venv-core/bin/activate
+python -m pip install -e .
+```
+
+核心无第三方运行依赖。JQData、Qlib 和 QMT 必须使用各自独立环境。
+当前 CLI 的 profile、配置和 bundle 是仓库资产，不嵌入 wheel。已安装的
+`quant-os` 应在 checkout 内运行；从其他目录调用新命令时显式写：
+
+```bash
+quant-os --project-root ~/boat-workspace/Code/quant-os doctor
+```
+
+wheel 不是独立的数据/runtime 分发包。
+
+## 2. 十分钟理解三平面
+
+- Control plane：选择 RunSpec、编排 use case、做发布判定。
+- Data plane：不可变 PIT 数据 → 特征/模型 → 权重 → execution intent。
+- Evidence plane：记录 hash、来源、平台事实、差异和 Gate；不能修改决策。
+
+平台和供应商只通过 adapter/port 进入。读券商与下单是两个独立接口。
+
+## 3. 工程体检
+
+状态：`[已实现｜无需账号]`
+
+```bash
+quant-os doctor
+quant-os architecture check
+quant-os standard validate
+quant-os standard evaluate
+```
+
+预期：
+
+- `doctor.ok = true`：目录、入口、profile 和新 namespace 边界有效；
+- `standard evaluate.ok = true`：评估过程有效；
+- `qualified = false`：当前没有达到 80，属于正确结果。
+
+`doctor.architecture.scope = new_namespace_only` 表示 AST checker 只覆盖
+`src/quant_os/`；legacy `quant60` 和根级 adapter/platform/tool 仍在迁移。
+它证明工程和标准可验证，不证明全部旧代码已经分层、策略有效或平台可用。
+
+没有 editable install 时可用：
+
+```bash
+PYTHONPATH=src:. python -m quant_os doctor
+```
+
+## 4. 无账号本地 demo
+
+状态：`[已实现｜无需账号]`
+
+完整验证：
+
+```bash
+make local
+```
+
+较短路径：
+
+```bash
+quant-os smoke \
+  --config configs/baseline.json \
+  --output artifacts/local-smoke
+
+quant-os verify-manifest artifacts/local-smoke/manifest.json
+
+quant-os research-smoke --output artifacts/research-smoke
+quant-os verify-research-manifest artifacts/research-smoke/manifest.json
+```
+
+`quant-os` 在这些命令上调用兼容的 `quant60` V1 内核。产物仍使用 V1 identity，
+因此历史 verifier 不会失效。
+
+本地 demo 证明：
+
+- 核心规则、ledger、manifest 和 hash 可重放；
+- synthetic 五层链能够生成 ModelBundle 和 TargetPackage；
+- 平台 bundle 可生成并通过 fake contract。
+
+它不证明：
+
+- 真实市场收益；
+- 真实 JQData 完整性；
+- 真实 QMT 或券商执行；
+- 60/80 达标。
+
+## 5. Tushare 数据与 Qlib
+
+状态：`[已实现到技术 smoke｜真实镜像仍不完整]`
+
+先阅读 [`../TUSHARE_LOCAL_DATA.md`](../TUSHARE_LOCAL_DATA.md)。当前盘点表明
+completed Parquet 能校验并转换为 managed Qlib provider，但缺复权、真实
+benchmark、历史成分、ST、停牌和涨跌停，不能进入生产 decision。
+
+典型流程：
+
+```bash
+PYTHONPATH=src:. python tools/tushare_qlib.py inventory --help
+PYTHONPATH=src:. python tools/tushare_qlib.py build --help
+PYTHONPATH=src:. python tools/tushare_qlib.py verify --help
+PYTHONPATH=src:. python -m platforms.qlib_runner --help
+```
+
+具体参数以 Tushare 文档和本机 inventory 为准。不要为了跑通而静默补缺失字段。
+
+这条路径证明数据桥和 Qlib runtime 可用，不证明 Ridge Baseline、G1/G2 或
+投资价值。
+
+## 6. JQData → 本地 PIT
+
+状态：`[已实现 adapter｜需要授权账号]`
+
+```bash
+python3.12 -m venv .venv-jqdata
+source .venv-jqdata/bin/activate
+python -m pip install -r requirements/jqdata.txt
+
+PYTHONPATH=src:. python tools/jqdata_snapshot.py \
+  --index 000905.XSHG \
+  --start 2024-01-02 \
+  --end 2024-12-31 \
+  --output data/snapshots/csi500-2024
+
+quant-os snapshot-backtest \
+  --snapshot data/snapshots/csi500-2024/manifest.json \
+  --config configs/baseline.json \
+  --output artifacts/csi500-2024-backtest
+```
+
+凭据只通过无回显登录或本地 secret source 注入，不进入命令历史、Git、OB、
+notebook 或 artifact。
+
+重要限制：当前 snapshot backtest/decision 仍走
+`portable-momentum-v1` compatibility path；它尚未接入真实 Ridge 五层权威。
+
+## 7. Colab
+
+状态：`[默认流程已实现｜JQData/Qlib cell 需对应授权/运行时]`
+
+打开 `notebooks/quant_os_colab.ipynb`。独立仓 clone 目标为：
+
+```text
+https://git.gomars.fun/boat/quant-os.git
+```
+
+默认 cell 不需要账号。`RUN_JQDATA=True` 和 `RUN_QLIB=True` 是显式可选。
+Colab 禁止上传券商凭据、账户号、持仓/成交、QMT userdata 或未获许可的行情。
+
+本地先验证 notebook：
+
+```bash
+python tools/run_colab_notebook.py notebooks/quant_os_colab.ipynb
+python tools/run_colab_notebook.py notebooks/quant_os_colab.ipynb --execute
+```
+
+## 8. 聚宽
+
+状态：`[bundle 已实现｜上传/导出需要登录聚宽]`
+
+动量 smoke：
+
+```bash
+python tools/bundle_platforms.py
+```
+
+TargetPackage consumer：
+
+```bash
+python tools/bundle_platforms.py \
+  --target-package artifacts/research-smoke/target_package.json \
+  --output-dir dist/target-package
+```
+
+上传 `dist/target-package/joinquant_strategy.py` 后，必须保存平台运行参数、日志、
+订单、成交和同输入 hash。当前已有一次 synthetic-research package 的真实
+execution smoke，只证明 execution consumer，不计 G9/60/80。
+
+## 9. QMT
+
+状态：`[bundle/fake/read-only 框架已实现｜真运行需要 Windows QMT 账号]`
+
+当前可做：
+
+```bash
+python tools/bundle_platforms.py
+PYTHONPATH=src:. python tools/export_mock_parity.py export \
+  --output artifacts/mock-parity/report.json
+PYTHONPATH=src:. python tools/export_mock_parity.py verify \
+  artifacts/mock-parity/report.json
+```
+
+取得 QMT 后按顺序启用：
+
+1. built-in 历史回测；
+2. qmttools 回测导出；
+3. XtTrader 只读 contract probe；
+4. broker snapshot 与 shadow plan；
+5. callback/restart/reconcile；
+6. 完成券商程序化交易报告确认后，才讨论 TradeBrokerPort。
+
+账号、userdata 路径和账户标识不放进 Git/OB。当前没有任何 operator 可运行的
+实盘下单命令，这是有意的安全边界。
+
+## 10. 如何读 60/80 状态
+
+```bash
+quant-os standard evaluate
+```
+
+重点字段：
+
+- `raw_score`：只有达到最低 evidence tier 且 hash 有效的控制项得分；
+- `effective_score`：应用 60/canary cap 后的分数；
+- `hard_gate_failures`：任何一项都阻断上线；
+- `domain_floor_failures`：防止用文档/单一领域堆分；
+- `prerequisites`：60、QMT、券商确认、shadow、canary、P0/P1；
+- `standard_canonical_sha256`：本次评估解释所使用的精确标准版本；
+- `pre_canary_authorization`：授权 ID/hash、有效期和 verifier/issuer provenance；
+- `pre_canary_authorization_valid_as_of_assessment`：授权在评估日是否仍可开始或继续
+  canary；过期后为 false，但不会否定期限内已完成的历史 canary chain；
+- `canary_authorization_chain_verified`：E4 canary 是否引用同一有效授权、处于合法
+  时间窗，并以实际最大资本/notional、标的、流量和 breach/stop 记录证明未突破
+  hard caps；
+- `verification_environment` / `test_only`：测试 verifier 永远不能冒充生产信任；
+- `pre_canary_authorized`：只有生产 issuer registry 核验后才可能为真；
+- `trusted_attestation_verified`：最终 promotion attestation 是否由信任边界核验；
+- `qualified`：唯一可用于 promotion policy 的布尔值。
+
+当前 CLI 没有注入 production trust provider / issuer registry，所以它只能
+诚实评估当前全负状态，不能接受手工伪造的 `passed` 或自行颁发 60/80。
+单元测试即使构造满分证据，也只能得到 `TEST_ONLY_STRUCTURAL_PASS`；
+production verifier 是明确 backlog。
+
+公开页只展示脱敏静态快照，不是实时健康页：
+
+```text
+https://gomars.fun/quant-os/status/
+```
+
+## 11. 新策略如何接入
+
+状态：`[目标 API｜本轮只定义边界，尚未完成 Strategy SDK]`
+
+策略最终应留在 `quants-strategies`，通过版本化 StrategySpec/port 进入 Quant OS。
+策略只提供特征、预测或目标权重逻辑，不能自行：
+
+- 读取券商 secret；
+- 调用 TradeBrokerPort；
+- 修改 evidence；
+- 绕过独立风险；
+- 把 hosted 平台变成第二个 Alpha 权威。
+
+当前新增策略仍按现有 `quant60` 实验接口工作，待 V2 StrategySpec 和 golden
+vectors 完成后迁移。
+
+## 12. 建议的学习顺序
+
+1. 跑 `doctor` 和 `standard evaluate`；
+2. 跑 `make local`，打开 manifest 看 hash/identity；
+3. 对照 60/80 文档解释为什么 synthetic 不得分；
+4. 阅读三平面架构和 ReadBroker/TradeBroker 拆分；
+5. 盘点 Tushare provider，再跑 Qlib technical smoke；
+6. 获得 JQData 后生成真实 snapshot；
+7. 先做真实聚宽多期导出，再接真实 QMT；
+8. 最后才累计 shadow/canary。
+
+任何时候发现“代码可以下单，但证据/规则/券商确认还没到”，正确行为都是让
+系统保持停机。
diff --git a/docs/standards/BASELINE_60_VS_PRODUCTION_80.md b/docs/standards/BASELINE_60_VS_PRODUCTION_80.md
new file mode 100644
index 0000000..378e959
--- /dev/null
+++ b/docs/standards/BASELINE_60_VS_PRODUCTION_80.md
@@ -0,0 +1,57 @@
+# Quant OS 60 分与 80 分的边界
+
+## 一句话区别
+
+- 60 分回答：同一策略研究链是否**可运行、可重放、可审计，并可进入只读 shadow**？
+- 80 分回答：同一已报告版本是否已经在真实券商和受限资金 canary 下，满足
+  **本 profile 明示的账户、报告、风控、恢复与审计控制项**？
+
+80 不是替代 60；60 的 G1—G10 全部通过是 80 的前置。
+
+## 对照表
+
+| 责任 | 60 分 Baseline | 80 分受限生产 | 当前状态 |
+| --- | --- | --- | --- |
+| 系统定位 | research-to-shadow baseline；无资金发送权 | limited-production/canary-ready | 未达到 60 |
+| 数据 | 有 PIT 合同、不可变快照和真实抽样重放 | 完整生产 PIT、许可、SLO、质量告警、恢复/回填 | fake JQData + 不完整 Tushare |
+| 研究 | purge/embargo walk-forward、冻结 OOS 和成本后结果 | 再加真实容量、选择治理、registry、drift、champion/challenger | Ridge 只接 synthetic |
+| 策略收益 | 可报告冻结 OOS，但不能用 synthetic 冒充 | 仍按预注册 mandate 判断，不设全局 Sharpe 门槛 | 无投资价值声明 |
+| 风险 | A 股规则和事前/事后风险合同 | 独立且不可绕过的真实账户风控，失效即拒单 | 组件存在，未接真实券商 |
+| 执行 | 本地 fill model、平台薄 wrapper、订单状态机合同 | 有效期规则包、真实 OMS、幂等/重连/重启、真实 TCA | 聚宽仅窄执行 smoke |
+| 跨引擎 | local/JQ/QMT 同输入层级 parity，未知差异为零 | local/JQ/QMT 做 L1—L5 strict peer；Qlib 只在声明层级比较，另有订单/成交 difference ledger | mock parity，无真 QMT |
+| QMT | bundle、qmttools、只读 shadow 入口 | 真账号 query/callback/reject/partial/cancel/reconnect/cross-day | fake contract |
+| 对账 | 影子计划与 broker snapshot 有可重放合同 | 每个交易日现金、持仓、可卖、订单、成交 100% 对账 | 无真实连续序列 |
+| Shadow | 至少 20 个交易日，验证研究到券商只读链 | 同一冻结候选至少 60 个交易日；重大变更重置 | 0 日真实 QMT |
+| 实盘 | 明确禁止宣称可实盘 | 先以 E3 独立授权冻结资本/标的/流量/停机 hard caps；只有授权仍有效才能开始或继续 canary。E4 canary claim 反向引用授权，并逐项证明实际资本/notional、标的、流量未超限以及 breach 已触发 fail-closed stop，完成至少 10 个交易日；禁止自动扩容。已在期限内完成的历史 canary 可于到期后晋级复核 | 未授权 |
+| 运维 | runbook、停机条件、恢复设计 | 监控告警、P0/P1、RPO=0、交易窗口 RTO≤15 分钟及故障演练 | 无生产演练 |
+| 发布 | 可复现 manifest、schema 和 bundle hash | 原子晋级、审批、签名、依赖清单、回滚演练 | 独立 CI 正在建立 |
+| 安全 | 凭据不入 Git/OB/artifact，默认关闭券商 mutation | secret store、最小权限、轮换/撤销、日志脱敏、供应链治理 | 仅仓库级边界 |
+| 合规 | 明确程序化交易义务和需券商确认 | 已完成首次报告，实际版本与报告一致，重大变更受控 | 无券商确认 |
+| 资本权限 | `NONE` | 小额、单策略、单账户、有限标的且有 hard cap | `NONE` |
+| 达标标签 | `BASELINE_60_VERIFIED` | `PRE_CANARY_AUTHORIZED` → `LIMITED_LIVE_VERIFIED` | `NOT_BASELINE_60` |
+
+80 分的 21 个生产 Hard Gate 权重合计正好 80，缺一项都不能用软项补偿。额外
+20 分描述数据冗余、模型选择治理、真实 TCA 和未来监管模式等成熟度余量。
+所有正向 evidence 都必须绑定同一 subject、standard/profile canonical hash
+并经过外部可信 verifier；60 分也不能靠 scorecard 手填。当前 production
+issuer registry 尚未实现，所以当前只能得到负向、fail-closed 结论；测试
+verifier 最多得到 `TEST_ONLY_*`，不会得到正式 60/80。
+
+## 不能混淆的三类分数
+
+1. **系统成熟度**：本标准 0—100，关心数据、执行、运维、合规。
+2. **策略证据**：按预注册 mandate 判断 OOS、容量、风险和 canary，不用基础设施
+   分数掩盖没有 Alpha。
+3. **实际收益**：只来自真实账户或具备适用授权、版本冻结的研究报告，不是系统
+   成熟度分数。
+
+一个工程完美但没有有效策略的系统，可以有很高的系统成熟度，但不能发布一个
+没有通过策略 mandate 的 model；一个回测收益很好但缺少风控、券商确认和恢复
+能力的策略，同样不能上线。
+
+## 为什么 80 仍不是“机构满分”
+
+80 面向个人自有资金的受限生产。完整机构化还需要组织隔离、独立复核、多账户/
+多策略资本分配、法务与合规职能、供应商管理、审计留存、业务连续性、人员权限
+和可能的持牌/私募义务。未来进入外部资金模式时必须切换独立的
+`REGULATED_MODE`，不能沿用个人 profile。
diff --git a/docs/standards/QUANT_OS_80_STANDARD.md b/docs/standards/QUANT_OS_80_STANDARD.md
new file mode 100644
index 0000000..c924197
--- /dev/null
+++ b/docs/standards/QUANT_OS_80_STANDARD.md
@@ -0,0 +1,220 @@
+# Quant OS 80 分受限生产验证标准
+
+基准日：2026-07-30
+机器权威：[`profiles/production-80/standard.json`](../../profiles/production-80/standard.json)
+当前评估：[`profiles/production-80/current-assessment.json`](../../profiles/production-80/current-assessment.json)
+
+## 结论先说
+
+80 分不是“代码功能比 60 分多一点”，而是系统责任发生了变化：
+
+> 60 分证明系统能在受控数据和研究/影子环境中被复现；80 分证明同一个已报告、
+> 已版本化、可审计的系统，已经在真实券商链路下完成受限资金验证，并且故障时
+> 会自动停，而不是继续错。
+
+当前 Quant OS 为 `NOT_BASELINE_60`，80 分机器评估是
+`BLOCKED_FROM_LIMITED_LIVE`，已验证得分为 0/100。这不等于“没有代码”，而是
+目前的代码、synthetic、mock 和单次聚宽执行 smoke 没有达到本标准规定的
+E2—E4 外部证据等级。当前 production trust provider / issuer registry 尚未
+实现，因此 evaluator 能验证 profile、subject、claim envelope 与 hash 结构，
+但不能自行颁发正向 80 分资格。
+
+80 分代表个人自有资金系统的**受限生产已验证**。它不代表：
+
+- 有超额收益或任何投资回报保证；
+- 获得机构牌照；
+- 可以管理第三方资金，或接受他人委托并代其决策、执行交易；
+- 券商必然开放程序化交易权限；
+- 法律意见。
+
+## 1. 判定公式
+
+状态分两步，避免“尚未实盘，却要先拿实盘证据”的循环：
+
+1. `PRE_CANARY_AUTHORIZED`：除 `D6-CANARY` 外的 20 个 Hard Gate 全部通过，
+   得分至少 77，60 分、真实 QMT、券商确认、60 日 shadow、P0/P1 和同一冻结
+   subject 全部满足，并取得独立的 E3 可信 canary 授权。该不可变授权绑定标准
+   hash、pre-canary projection、账户/策略、有效期、资本/notional、标的白名单、
+   “申报+撤单”流量和停机条件；只有评估日仍在授权有效期内，状态才能保持
+   `PRE_CANARY_AUTHORIZED` 或 `CANARY_RUNNING`。它不是 E4 实盘结果，也不是
+   常规实盘许可。
+2. `LIMITED_LIVE_VERIFIED`：完成至少 10 个交易日 canary 后，21 个 Hard Gate
+   全部通过，七个维度**合计**证据得分不低于 80/100，并取得绑定整个 assessment
+   hash 的可信 E4 promotion attestation。D6-CANARY 的 E4 claim 必须反向引用
+   前述授权 ID/hash，并证明 `authorized_at < canary window <= expires_on`；
+   claim 还必须记录 canary 实际最大资本、gross notional、标的、每秒/每日
+   “申报+撤单”流量、是否自动扩容，以及 breach 与 fail-closed stop event 的
+   逐项关联。任一实际值超过授权即不得通过。若 canary 已在授权到期前合法完成，
+   后续 E4 promotion 可以在授权到期后复核这段历史链；到期不能倒推抹除已经发生
+   的受控观察，但也不能继续开放新的 canary 交易。
+
+完整 80 分必须同时满足：
+
+1. 七个维度合计证据得分不低于 80/100；
+2. 60 分 G1—G10 全部通过；
+3. 所有 Hard Gate 通过；
+4. 每个维度至少获得该维度 60% 的分数；
+5. 同一冻结候选累计至少 60 个交易日真实 QMT shadow；
+6. 受限资金 canary 至少 10 个交易日；
+7. 没有未关闭 P0/P1；
+8. 已取得券商程序化交易报告/核查确认，部署版本与报告事实一致；
+9. 已有真实 QMT 运行证据；
+10. assessment、每份 evidence claim 和最终 attestation 都绑定相同的
+    candidate、release、model、dataset、账户 pseudonym 与 material-change
+    epoch，以及同一个 canonical `standard.json` SHA-256；Baseline 60 还必须
+    引用可信 evaluator 的签名结果和 canonical profile hash。
+
+机器 profile 中 21 个 Hard Gate 的权重恰好合计 80；其余 20 分是数据冗余、
+champion/challenger、真实 TCA 与未来监管模式等成熟度余量。换句话说，80
+不能靠软项补偿任何生产核心门；81—100 表示更高的冗余和治理深度。
+
+不可补偿规则：
+
+- 60 分未通过，最终分封顶 59；
+- 没有 canary，最终分封顶 79；
+- 任一 Hard Gate 失败，即使原始分超过 80，也不得上线；
+- 代码、文档、mock、fixture 和单元测试不能替代真实数据、真实平台、真实券商
+  或持续运行证据；
+- 不允许人工把 `not_passed` 改成 `passed`。通过项必须提供仓库相对路径、
+  证据等级、SHA-256、绑定同一 subject 的 claim envelope，并由配置在外部
+  trust provider 中的 verifier 核验；最终 attestation 还必须绑定整个
+  assessment 的 canonical hash。
+- canary 不能跳过 77 分授权：授权使用独立 E3 authority，canary observation
+  使用 E4，并以授权 hash、评估日有效期、时间窗和“授权上限 vs 实际观测”
+  hard caps 形成不可断开的链；风险、数据、规则或对账 breach 必须引用同窗
+  stop event，且该 stop 明确停止交易、禁止自动恢复。
+- 当前仓库没有生产 verifier 或信任根；单独编辑 JSON、复用无关文件或拿
+  `standard.json` 冒充 E4 都不能产生正向资格。测试 verifier 只能产生
+  `TEST_ONLY_PRE_CANARY_PASS` / `TEST_ONLY_STRUCTURAL_PASS`，`qualified`
+  仍为 false。
+
+cap 用于分数呈现，Hard Gate/prerequisite 用于资格阻断，二者是纵深防御。
+这些时长、维度和内部限额是 Quant OS 的工程标准，不是监管机关原文。
+
+## 2. 证据等级
+
+| 等级 | 定义 | 可证明什么 | 不能证明什么 |
+| --- | --- | --- | --- |
+| E0 | 口头结论、设计文档、源文件存在 | 意图和设计边界 | 代码可运行、市场有效、平台有效 |
+| E1 | 确定性本地测试、synthetic、fixture、mock | 算法/合同/故障路径在受控环境成立 | 真实数据、平台、券商和收益 |
+| E2 | 授权真实数据、冻结 OOS，或外部权威原始证据 | 数据/研究可重放，或规则/权属来源可核验 | 券商执行、持续运行 |
+| E3 | 真实平台/券商 shadow，或绑定生产环境的运维、数据、安全、合规控制观察/独立 canary 授权 | 真实平台、账户状态、生产控制链路或受限实盘授权边界 | 已发生的资金实盘行为 |
+| E4 | 受限资金、受控 live canary | 小范围真实生产行为 | 自动扩容、机构级规模或投资收益 |
+
+每个控制项声明最低证据等级。更高等级可以覆盖更低等级，但 claim 的 control、
+subject、evidence type、authority、时点和来源 hash 必须满足该项 acceptance；
+不能拿一份无关 E4 文件替代数据或研究证据。当前实现已经强制 control/subject/
+standard/profile hash、pre-authorization chain 和带 verifier/issuer/key/policy
+provenance 的验证决定；生产 issuer registry、允许的 evidence type/
+authority/freshness policy 仍是下一阶段交付，因此当前不能颁发正向 60/80。
+
+## 3. 七个评分维度
+
+| 维度 | 分值 | 核心问题 | 关键 Hard Gate |
+| --- | ---: | --- | --- |
+| D1 数据与 PIT 真值 | 15 | 决策日看到的是否真是当时可得数据，数据是否有许可、时效和恢复能力 | 完整 PIT、许可/lineage/数据 SLO |
+| D2 研究与模型治理 | 15 | 是否在真实长样本 OOS 下冻结，模型是否可追责、过期和回滚 | OOS、成本/容量、Model Registry |
+| D3 跨引擎一致性 | 10 | 本地、聚宽、QMT strict peer 是否一致；Qlib 是否只在声明层级比较 | local/JQ/QMT L1—L5 identity、difference ledger |
+| D4 执行与独立风控 | 15 | 策略能否绕过验资验券、规则、OMS 和 kill-switch | 独立风控、2026 规则包、幂等 OMS |
+| D5 真实 QMT 与券商真值 | 15 | 查询、回报、重连、持仓、可卖、订单和成交是否由券商事实驱动 | 真 QMT、逐日 100% 对账、可重放证据 |
+| D6 运维、灾备与审计 | 15 | 是否经历足够长的 shadow/canary，故障能否恢复 | 60 日 shadow、10 日 canary、RPO/RTO |
+| D7 合规与安全 | 15 | 是否先报告后交易、账户和业务符合本 profile 边界、系统与报告一致、凭据受控 | 个人自营范围、券商确认、异常交易防线、安全 |
+
+25 个控制项、权重和 acceptance 以机器 profile 为准。文档只解释标准，不替代
+profile。
+
+## 4. 当前差距
+
+当前评估全部保持 `not_passed`，主要原因如下：
+
+- G1—G10 仍是 0/10，未满足 80 分前置；
+- Ridge 五层链的上游研究输入仍是 synthetic；
+- JQData 真实完整 PIT 长样本未进入冻结模型和 TargetPackage tape；
+- 聚宽只有一次 synthetic-research TargetPackage execution consumer 观察；
+- QMT 只有语法、fake contract 与只读 shadow 框架，没有真实账号证据；
+- 没有 60 个交易日真实 shadow；
+- 没有受限资金 canary；
+- 没有券商程序化交易报告/核查确认；
+- 2026-07-06 生效（含部分继续暂缓实施条款）的交易规则尚未形成状态化规则包；
+- 没有生产数据 SLO、真实 TCA、持续监控、RPO/RTO 演练、签名发布和凭据轮换证据。
+- 没有 production trust provider、issuer registry 和可验证的 promotion
+  attestation，因此 evaluator 即使未来看到手工 `passed` 也不会自行授予资格。
+
+因此，本轮交付只建立“能客观判断什么时候达到 80”的标准和架构，不声称已经
+达到 80。
+
+## 5. 监管硬事实与内部工程门槛
+
+下面只概括与系统设计直接相关的规则事实。券商协议和后续有效规则可能更严格，
+实盘以券商书面确认及当时有效规则为准。
+
+### 5.1 规则事实
+
+1. 《证券法》第 45 条将程序自动生成或下达交易指令纳入程序化交易，要求符合
+   证监会规定并向交易所报告，不得影响交易系统安全或正常交易秩序。
+2. 《证券市场程序化交易管理规定（试行）》自 2024-10-08 实施。客户必须向
+   券商报告账户、资金/杠杆、策略、指令执行、最高申报速率、日最高申报笔数、
+   软件名称/版本/开发主体和联系人等；券商核查确认后才能开始程序化交易。
+3. 沪、深、北程序化交易实施细则自 2025-07-07 施行，个人投资者明确纳入。
+   资金、杠杆、联系人、策略、速率、软件或停止交易等重大变化需要按规定变更
+   报告，实际交易行为会与报告事实比对。
+4. 交易所重点监控瞬时申报速率异常、频繁瞬时撤单、频繁拉抬打压和短时间大额
+   成交。低于高频定义不等于监管安全。
+5. 单账户申报加撤单最高达到 300 笔/秒，或单日达到 20,000 笔，属于高频交易。
+   这是高频分类阈值，不是低于阈值即可免责的安全港。
+6. 沪深《交易规则（2026 年修订）》自 2026-07-06 施行，但上交所通知同时
+   明确部分既有条文继续暂缓实施。规则生效不等于每一条款均已启用；系统不能
+   继续依赖旧硬编码，也必须建模 `effective/suspended/resumed/repealed` 状态。
+7. 对实施细则列明情形，会员应当按照委托协议等约定采取拒绝程序化交易委托、
+   撤销相关申报等措施；具体适用仍以券商协议和当时有效规则为准。
+8. 突发故障或重大差错时，系统必须具备暂停、撤单、错误处理和应急处置能力。
+
+### 5.2 Quant OS 内部门槛
+
+- 账户模式固定为 `PERSONAL_PROPRIETARY`。出现第三方资金、接受他人委托并代其
+  决策或执行交易、向他人提供收费投资顾问服务，或与他人共享交易控制权时，
+  系统 fail closed，转入单独的法律/合规适用性评估。仅购买或阅读第三方研究
+  信息本身不等于代客指令。
+- 没有券商确认、实际委托协议和版本一致性证据，TradeBrokerPort 保持禁用。
+- machine profile 的日频 Baseline 默认上限按“Quant OS 发出的全部委托申报
+  尝试 + 撤单请求”合计，每账户及实际控制账户组均不超过 10 条/秒、
+  1,000 条/交易日。日撤单率 = 策略主动撤单请求 / 已接受委托申报；拒单不进
+  分母，部分成交后主动撤单进分子，交易所自动撤单不进分子。达到 30% 预警并
+  人工复核；更严规则优先。这是内部限额，不是监管安全港。
+- 当前交易能力范围明确为沪深；北交所为 `excluded/fail_closed`。规则包按市场、
+  板块、证券类型及发布、生效、暂缓、恢复、废止日期版本化。规则未知、过期、
+  暂缓或不完整时拒单。
+- Colab 只允许上传供应商许可范围内的脱敏研究数据，绝不上传券商凭据、账户号、
+  持仓、成交或个人敏感信息。
+
+## 6. 官方来源
+
+- [中华人民共和国证券法（全国人大）](https://www.npc.gov.cn/c2/c30834/201912/t20191231_304436.html)
+- [证券市场程序化交易管理规定（试行）（证监会 PDF）](https://www.csrc.gov.cn/csrc/c101954/c7480579/7480579/files/%E9%99%84%E4%BB%B61%EF%BC%9A%E8%AF%81%E5%88%B8%E5%B8%82%E5%9C%BA%E7%A8%8B%E5%BA%8F%E5%8C%96%E4%BA%A4%E6%98%93%E7%AE%A1%E7%90%86%E8%A7%84%E5%AE%9A%EF%BC%88%E8%AF%95%E8%A1%8C%EF%BC%89.pdf)
+- [上交所程序化交易管理实施细则](https://www.sse.com.cn/lawandrules/sselawsrules2025/trade/universal/c/c_20250612_10781696.shtml)
+- [深交所程序化交易管理实施细则通知](https://www.szse.cn/lawrules/rule/allrules/bussiness/t20250403_612770.html)
+- [北交所程序化交易管理实施细则](https://www.bse.cn/jygl_list/200025383.html)
+- [上交所交易规则（2026 年修订）](https://www.sse.com.cn/lawandrules/sselawsrules2025/stocks/exchange/c/c_20260424_10816482.shtml)
+- [深交所交易规则（2026 年修订）](https://www.szse.cn/lawrules/rule/trade/current/t20260424_620190.html)
+- [程序化交易委托协议示范文本（中证协）](https://www.sac.net.cn/zlgl/zlgz/202512/t20251231_69956.html)
+- [JR/T 0303—2024 投资研究时序数据参考模型](https://www.csrc.gov.cn/csrc/c100028/c7483073/content.shtml)
+- [个人信息保护法（全国人大）](https://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html)
+
+如果未来管理外部资金，个人 profile 立即失效。量化私募还涉及系统/数据安全、
+策略上线、防自成交/反向交易、超限控制以及长期保存等要求。参见
+[私募证券投资基金运作指引（中基协 PDF）](https://www.amac.org.cn/xwfb/xhyw/202304/P020231126355219356728.pdf)。
+
+## 7. 机器验收
+
+```bash
+PYTHONPATH=src:. python -m quant_os standard validate
+PYTHONPATH=src:. python -m quant_os standard evaluate
+```
+
+第一条验证标准本身权重、控制项和证据等级是否自洽；第二条重新评估当前证据。
+评估成功运行只表示“当前结构与负向结论有效”，不表示达到 80。必须看
+`qualification_state`、`qualified`、`pre_canary_authorization`、
+`canary_authorization_chain_verified`、`standard_canonical_sha256`、
+`verification_environment`、`trusted_attestation_verified`、`hard_gate_failures`、
+`domain_floor_failures` 和 `prerequisites`。当前 CLI 不注入生产 verifier，
+这是明确的未完成项，而不是允许手工绕过的入口。
diff --git a/examples/portable-momentum-smoke/README.md b/examples/portable-momentum-smoke/README.md
new file mode 100644
index 0000000..66f9131
--- /dev/null
+++ b/examples/portable-momentum-smoke/README.md
@@ -0,0 +1,5 @@
+# portable-momentum smoke
+
+`portable-momentum-v1` is a connectivity and contract example. It must never be
+promoted as the Ridge Baseline or as investment evidence. The default bundler
+compatibility mode will move here after golden-vector parity is frozen.
diff --git a/gate_scorecard.json b/gate_scorecard.json
index d037090..b324274 100644
--- a/gate_scorecard.json
+++ b/gate_scorecard.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.0",
   "system": "Quant OS / quant60 baseline kernel",
-  "audit_as_of": "2026-07-26",
+  "audit_as_of": "2026-07-30",
   "claim_policy": {
     "baseline_threshold": 60,
     "all_gates_required": true,
@@ -35,7 +35,7 @@
     "status": "not_scored",
     "reason": "Quant OS 已接通本地 synthetic 五层候选链，能冻结 Ridge ModelBundle、逐层 trace 和无股数 TargetPackageV1；一个 synthetic-research TargetPackage 已在真实 JoinQuant hosted 环境完成消费、账户/开盘价绑定、3 笔委托和 3 笔成交，因此 execution 层已有真实平台观察。但真实 provider-data 长样本/OOS 尚未接入，JoinQuant 没有重跑上游 Universe/Alpha/Portfolio/Risk，QMT peer 与逐层真实数据 parity 仍缺失，factor risk、CVXPY 和 guarded TWAP/POV 也尚未进入当前主链。因此它仍是 NOT_BASELINE_60，G9 未通过。",
     "verified_supporting_facts": [
-      "The current standard-library suite completed 285 tests with OK and 6 optional-runtime skips; successful local tests do not prove real-platform, broker or compliance gates.",
+      "The independent-repository standard-library suite completed 315 tests with OK and 6 optional-runtime skips; successful local tests do not prove real-platform, broker or compliance gates.",
       "The local synthetic research entrypoint now executes one causally linked Universe → Ridge Alpha → cost/risk-aware Portfolio → post-risk gate → reference Execution path, freezes a replayable ModelBundle, and publishes a hash-linked TargetPackageV1 and five-layer trace. This is structural synthetic evidence only.",
       "The connected candidate currently uses 60-session diagonal realized variance, explicit spread/fee/square-root-impact cost forecasts, the deterministic constrained optimizer, a post-target risk gate, and reference lot/T+1 order deltas. factor_risk.py, the optional CVXPY solver mode, and guarded TWAP/POV are not selected by the current main slice.",
       "JoinQuant and QMT target-package modes verify an exact embedded package tape, match the declared dual clock, bind platform equity/positions/sellable quantities/prices, and reject missing, duplicate or tampered packages without falling back to momentum. Both modes have local harness/contract evidence; JoinQuant execution alone now also has one narrow real hosted smoke.",
@@ -58,8 +58,8 @@
       "authorized JQData market snapshot, licence/lineage record and a frozen provider-data candidate tape",
       "authorized real-data multi-period JoinQuant TargetPackage run plus same-input local/JoinQuant layer-by-layer reconciliation",
       "real QMT TargetPackage built-in and qmttools backtest exports",
-      "real QMT historical-ST positive control, terminal/xtquant build record, broker query contract and trade-amount semantic probes, callback/restart and at least 20 trading days of shadow evidence",
-      "continuous reconciliation, recovery drills and broker compliance confirmation"
+      "real QMT historical-ST positive control, terminal/xtquant build record, broker query contract and trade-amount semantic probes, and callback/restart evidence; Baseline 60 requires at least 20 trading days of shadow, while the current Production 80 gap requires at least 60 trading days for the same frozen candidate",
+      "continuous reconciliation, recovery drills and broker programmatic-trading report/verification confirmation"
     ]
   },
   "gates": [
@@ -167,7 +167,7 @@
       "required_evidence": [
         "真实平台跨引擎 manifest",
         "逐层 signal/target/order 差异",
-        "QMT 至少 20 个交易日影子记录"
+        "Baseline 60 所需的 QMT 至少 20 个交易日影子记录；Production 80 另要求同一冻结候选至少 60 个交易日"
       ],
       "evidence": []
     },
diff --git a/notebooks/quant_os_colab.ipynb b/notebooks/quant_os_colab.ipynb
index e103b70..e9a2b3d 100644
--- a/notebooks/quant_os_colab.ipynb
+++ b/notebooks/quant_os_colab.ipynb
@@ -45,8 +45,9 @@
         "import shutil\n",
         "import subprocess\n",
         "import sys\n",
+        "import tempfile\n",
         "\n",
-        "REPO_URL = \"https://git.gomars.fun/boat/quants-strategies.git\"\n",
+        "REPO_URL = \"https://git.gomars.fun/boat/quant-os.git\"\n",
         "REPO_BRANCH = \"master\"\n",
         "\n",
         "def run(command, *, env=None):\n",
@@ -54,19 +55,23 @@
         "    subprocess.run(command, check=True, env=env)\n",
         "\n",
         "cwd = Path.cwd().resolve()\n",
-        "if cwd.name == \"quant-os\" and (cwd / \"pyproject.toml\").is_file():\n",
+        "if (cwd / \"pyproject.toml\").is_file() and (cwd / \"src\" / \"quant60\").is_dir():\n",
         "    project = cwd\n",
         "elif (cwd / \"quant-os\" / \"pyproject.toml\").is_file():\n",
         "    project = cwd / \"quant-os\"\n",
         "else:\n",
-        "    checkout = Path(\"/content/quants-strategies\")\n",
+        "    checkout = Path(\"/content/quant-os\")\n",
         "    if not checkout.exists():\n",
         "        run([\"git\", \"clone\", \"--depth\", \"1\", \"--branch\", REPO_BRANCH, REPO_URL, str(checkout)])\n",
-        "    project = checkout / \"quant-os\"\n",
+        "    project = checkout\n",
         "\n",
         "if not (project / \"pyproject.toml\").is_file():\n",
         "    raise RuntimeError(f\"Quant OS project not found at {project}\")\n",
         "os.chdir(project)\n",
+        "cache_root = Path(tempfile.gettempdir()) / \"quant-os-notebook-cache\"\n",
+        "cache_root.mkdir(parents=True, exist_ok=True)\n",
+        "os.environ.setdefault(\"MPLCONFIGDIR\", str(cache_root / \"matplotlib\"))\n",
+        "os.environ.setdefault(\"XDG_CACHE_HOME\", str(cache_root / \"xdg\"))\n",
         "print({\"project\": str(project), \"python\": sys.version})"
       ]
     },
@@ -114,7 +119,11 @@
     {
       "cell_type": "code",
       "execution_count": null,
-      "metadata": {},
+      "metadata": {
+        "tags": [
+          "optional"
+        ]
+      },
       "outputs": [],
       "source": [
         "equity = json.loads(Path(\"artifacts/colab-smoke/equity.json\").read_text(encoding=\"utf-8\"))\n",
diff --git a/ops/README.md b/ops/README.md
new file mode 100644
index 0000000..6606ed3
--- /dev/null
+++ b/ops/README.md
@@ -0,0 +1,59 @@
+# Quant OS public status operations
+
+The repository is the source of truth for the public status page. A deployment
+contains exactly:
+
+```text
+/srv/www/quant-os/
+  releases/<git-sha>/
+    index.html
+    status-data.js
+  status -> releases/<git-sha>
+```
+
+Deployment invariants:
+
+1. run `python3 tools/build_public_status.py --check` and the full local suite;
+2. deploy from a clean, pushed commit and name the release with that full SHA;
+3. acquire the web-root deployment lock and copy into a same-filesystem
+   `.incoming-<sha>` directory;
+4. require exactly two regular, non-symlink payload files and compare local and
+   staged SHA-256 for both;
+5. atomically rename the verified incoming directory to the immutable release;
+6. create a temporary relative symlink and activate it with one atomic rename;
+7. install [`nginx/quant-os-static.conf`](nginx/quant-os-static.conf), run
+   `nginx -t`, then reload;
+8. verify the canonical page, generated JavaScript, cache header and all legacy
+   redirects from a public client;
+9. keep the previous release for rollback.
+
+The server-side deploy and activation are executable and fail closed:
+
+```bash
+ops/deploy_static_status.sh <full-git-sha> <staged-status-dir>
+ops/activate_static_status.sh <previous-full-git-sha>
+```
+
+The first command rejects a symlinked source root, symlink payloads,
+directories and any third source entry,
+holds `.status-deploy.lock` across staging and activation, verifies both
+SHA-256 values, atomically promotes `.incoming-<sha>`, and refuses to overwrite
+an existing release. Promoted payload files and their release directory are
+owner read-only. The second command is the rollback/activation primitive;
+when called directly it takes the same lock and switches only a relative
+symlink. A stale lock or incoming directory means a prior process may have
+crashed: inspect it and confirm no deploy is running before removing it.
+
+Nginx is deliberately two-stage:
+
+1. include `nginx/quant-os-static.conf` in the existing HTTPS server block,
+   run `nginx -t`, reload, and verify `/quant-os/status/`;
+2. only then include `nginx/quant-os-legacy-redirects-302.conf`, preserving the
+   existing broad `/quants-strategies/` route for other projects;
+3. after an observation period and a separate production change, replace the
+   302 include with `quant-os-legacy-redirects-308.conf`.
+
+Rollback only changes the `status` symlink to the previously verified release
+and reloads no application state. The page is a static, redacted build-time
+snapshot; it must never contain credentials, local paths, market data, account
+identifiers, positions or fills.
diff --git a/ops/activate_static_status.sh b/ops/activate_static_status.sh
new file mode 100755
index 0000000..5bf4c40
--- /dev/null
+++ b/ops/activate_static_status.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -lt 1 || "$#" -gt 2 ]]; then
+  echo "usage: $0 <40-char-git-sha> [web-root]" >&2
+  exit 2
+fi
+
+release_sha="$1"
+web_root="${2:-/srv/www/quant-os}"
+
+if [[ ! "${release_sha}" =~ ^[0-9a-f]{40}$ ]]; then
+  echo "release SHA must be a 40-character lowercase Git SHA" >&2
+  exit 2
+fi
+if [[ "${web_root}" != /* || "${web_root}" == "/" ]]; then
+  echo "web root must be an explicit absolute non-root path" >&2
+  exit 2
+fi
+if [[ ! -d "${web_root}" ]]; then
+  echo "web root does not exist: ${web_root}" >&2
+  exit 1
+fi
+
+lock_dir="${web_root}/.status-deploy.lock"
+lock_acquired=false
+next_link=""
+next_link_created=false
+
+cleanup() {
+  exit_status="$?"
+  if [[ "${next_link_created}" == "true" && -L "${next_link}" ]]; then
+    rm -f "${next_link}"
+  fi
+  if [[ "${lock_acquired}" == "true" ]]; then
+    rmdir "${lock_dir}" 2>/dev/null || true
+  fi
+  exit "${exit_status}"
+}
+trap cleanup EXIT HUP INT TERM
+
+if [[ "${QUANT_OS_STATUS_DEPLOY_LOCK_HELD:-0}" == "1" ]]; then
+  if [[ ! -d "${lock_dir}" || -L "${lock_dir}" ]]; then
+    echo "caller asserted a deployment lock that is not held" >&2
+    exit 1
+  fi
+else
+  if ! mkdir "${lock_dir}" 2>/dev/null; then
+    echo "another status deployment or activation holds ${lock_dir}" >&2
+    exit 1
+  fi
+  lock_acquired=true
+fi
+
+release_dir="${web_root}/releases/${release_sha}"
+if [[ ! -d "${release_dir}" || -L "${release_dir}" ]]; then
+  echo "release must be a regular directory: ${release_dir}" >&2
+  exit 1
+fi
+release_entries=()
+while IFS= read -r -d '' entry; do
+  release_entries+=("${entry}")
+done < <(find "${release_dir}" -mindepth 1 -maxdepth 1 -print0 2>/dev/null)
+if [[ "${#release_entries[@]}" != "2" ]]; then
+  echo "release must contain exactly index.html and status-data.js" >&2
+  exit 1
+fi
+for required in index.html status-data.js; do
+  if [[ ! -f "${release_dir}/${required}" || -L "${release_dir}/${required}" ]]; then
+    echo "release must contain a regular non-symlink ${required}" >&2
+    exit 1
+  fi
+done
+for entry in "${release_entries[@]}"; do
+  case "$(basename "${entry}")" in
+    index.html|status-data.js)
+      ;;
+    *)
+      echo "unexpected release entry: $(basename "${entry}")" >&2
+      exit 1
+      ;;
+  esac
+done
+
+next_link="${web_root}/.status-next-${release_sha}"
+if [[ -e "${next_link}" || -L "${next_link}" ]]; then
+  echo "temporary activation link already exists: ${next_link}" >&2
+  exit 1
+fi
+
+ln -s "releases/${release_sha}" "${next_link}"
+next_link_created=true
+if [[ -e "${web_root}/status" && ! -L "${web_root}/status" ]]; then
+  echo "active status path exists and is not a symlink" >&2
+  exit 1
+fi
+if mv --version >/dev/null 2>&1; then
+  mv -Tf "${next_link}" "${web_root}/status"
+else
+  mv -fh "${next_link}" "${web_root}/status"
+fi
+next_link_created=false
+
+active_target="$(readlink "${web_root}/status")"
+if [[ "${active_target}" != "releases/${release_sha}" ]]; then
+  echo "active release verification failed" >&2
+  exit 1
+fi
+echo "activated ${release_sha}"
diff --git a/ops/deploy_static_status.sh b/ops/deploy_static_status.sh
new file mode 100755
index 0000000..3c7a7e6
--- /dev/null
+++ b/ops/deploy_static_status.sh
@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -lt 2 || "$#" -gt 3 ]]; then
+  echo "usage: $0 <40-char-git-sha> <source-dir> [web-root]" >&2
+  exit 2
+fi
+
+release_sha="$1"
+source_dir="$2"
+web_root="${3:-/srv/www/quant-os}"
+
+if [[ ! "${release_sha}" =~ ^[0-9a-f]{40}$ ]]; then
+  echo "release SHA must be a 40-character lowercase Git SHA" >&2
+  exit 2
+fi
+if [[ ! -d "${source_dir}" ]]; then
+  echo "source directory does not exist" >&2
+  exit 2
+fi
+if [[ -L "${source_dir}" ]]; then
+  echo "source directory must not be a symlink" >&2
+  exit 2
+fi
+if [[ "${web_root}" != /* || "${web_root}" == "/" ]]; then
+  echo "web root must be an explicit absolute non-root path" >&2
+  exit 2
+fi
+
+source_entries=()
+while IFS= read -r -d '' entry; do
+  source_entries+=("${entry}")
+done < <(find "${source_dir}" -mindepth 1 -maxdepth 1 -print0)
+if [[ "${#source_entries[@]}" != "2" ]]; then
+  echo "source must contain exactly index.html and status-data.js" >&2
+  exit 1
+fi
+for required in index.html status-data.js; do
+  if [[ ! -f "${source_dir}/${required}" || -L "${source_dir}/${required}" ]]; then
+    echo "source must contain a regular non-symlink ${required}" >&2
+    exit 1
+  fi
+done
+for entry in "${source_entries[@]}"; do
+  case "$(basename "${entry}")" in
+    index.html|status-data.js)
+      ;;
+    *)
+      echo "unexpected source entry: $(basename "${entry}")" >&2
+      exit 1
+      ;;
+  esac
+  if [[ ! -f "${entry}" || -L "${entry}" ]]; then
+    echo "source entries must be regular non-symlink files" >&2
+    exit 1
+  fi
+done
+
+release_dir="${web_root}/releases/${release_sha}"
+incoming_dir="${web_root}/.incoming-${release_sha}"
+lock_dir="${web_root}/.status-deploy.lock"
+incoming_created=false
+lock_acquired=false
+
+cleanup() {
+  exit_status="$?"
+  if [[ "${incoming_created}" == "true" ]]; then
+    chmod 0755 "${incoming_dir}" 2>/dev/null || true
+    rm -f \
+      "${incoming_dir}/index.html" \
+      "${incoming_dir}/status-data.js"
+    rmdir "${incoming_dir}" 2>/dev/null || true
+  fi
+  if [[ "${lock_acquired}" == "true" ]]; then
+    rmdir "${lock_dir}" 2>/dev/null || true
+  fi
+  exit "${exit_status}"
+}
+trap cleanup EXIT HUP INT TERM
+
+install -d -m 0755 "${web_root}"
+if ! mkdir "${lock_dir}" 2>/dev/null; then
+  echo "another status deployment or activation holds ${lock_dir}" >&2
+  exit 1
+fi
+lock_acquired=true
+
+if [[ -L "${web_root}/releases" ]]; then
+  echo "releases directory must not be a symlink" >&2
+  exit 1
+fi
+install -d -m 0755 "${web_root}/releases"
+if [[ -L "${web_root}/releases" ]]; then
+  echo "releases directory must not be a symlink" >&2
+  exit 1
+fi
+if [[ -e "${release_dir}" || -L "${release_dir}" ]]; then
+  echo "refusing to overwrite existing release: ${release_dir}" >&2
+  exit 1
+fi
+if [[ -e "${incoming_dir}" || -L "${incoming_dir}" ]]; then
+  echo "stale incoming path must be inspected and removed: ${incoming_dir}" >&2
+  exit 1
+fi
+install -d -m 0755 "${incoming_dir}"
+incoming_created=true
+install -m 0644 "${source_dir}/index.html" "${incoming_dir}/index.html"
+install -m 0644 \
+  "${source_dir}/status-data.js" \
+  "${incoming_dir}/status-data.js"
+
+hash_command=()
+if command -v sha256sum >/dev/null 2>&1; then
+  hash_command=(sha256sum)
+elif command -v shasum >/dev/null 2>&1; then
+  hash_command=(shasum -a 256)
+else
+  echo "sha256sum or shasum is required" >&2
+  exit 1
+fi
+
+for required in index.html status-data.js; do
+  source_hash="$("${hash_command[@]}" "${source_dir}/${required}" | awk '{print $1}')"
+  incoming_hash="$("${hash_command[@]}" "${incoming_dir}/${required}" | awk '{print $1}')"
+  if [[ "${source_hash}" != "${incoming_hash}" ]]; then
+    echo "release hash mismatch: ${required}" >&2
+    exit 1
+  fi
+  echo "${required} ${incoming_hash}"
+done
+
+incoming_entries=()
+while IFS= read -r -d '' entry; do
+  incoming_entries+=("${entry}")
+done < <(find "${incoming_dir}" -mindepth 1 -maxdepth 1 -print0)
+if [[ "${#incoming_entries[@]}" != "2" ]]; then
+  echo "incoming release must contain exactly two files" >&2
+  exit 1
+fi
+for required in index.html status-data.js; do
+  if [[ ! -f "${incoming_dir}/${required}" || -L "${incoming_dir}/${required}" ]]; then
+    echo "incoming release is not a regular immutable payload: ${required}" >&2
+    exit 1
+  fi
+done
+chmod 0444 \
+  "${incoming_dir}/index.html" \
+  "${incoming_dir}/status-data.js"
+
+if mv --version >/dev/null 2>&1; then
+  mv -T "${incoming_dir}" "${release_dir}"
+else
+  if [[ -e "${release_dir}" || -L "${release_dir}" ]]; then
+    echo "refusing to overwrite concurrently created release" >&2
+    exit 1
+  fi
+  mv "${incoming_dir}" "${release_dir}"
+fi
+incoming_created=false
+chmod 0555 "${release_dir}"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+export QUANT_OS_STATUS_DEPLOY_LOCK_HELD=1
+"${script_dir}/activate_static_status.sh" "${release_sha}" "${web_root}"
diff --git a/ops/nginx/quant-os-legacy-redirects-302.conf b/ops/nginx/quant-os-legacy-redirects-302.conf
new file mode 100644
index 0000000..edbe26f
--- /dev/null
+++ b/ops/nginx/quant-os-legacy-redirects-302.conf
@@ -0,0 +1,26 @@
+# Temporary compatibility redirects. Install only after the new canonical
+# route has passed public verification. Keep these as 302 during observation.
+
+location = /quants-strategies/quant-os {
+    return 302 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/ {
+    return 302 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status {
+    return 302 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status/ {
+    return 302 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status/index.html {
+    return 302 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status/status-data.js {
+    return 302 https://$host/quant-os/status/status-data.js;
+}
diff --git a/ops/nginx/quant-os-legacy-redirects-308.conf b/ops/nginx/quant-os-legacy-redirects-308.conf
new file mode 100644
index 0000000..9c22a4d
--- /dev/null
+++ b/ops/nginx/quant-os-legacy-redirects-308.conf
@@ -0,0 +1,26 @@
+# Stable compatibility redirects. Replace the temporary 302 include with this
+# file only after an observation period and an explicit production change.
+
+location = /quants-strategies/quant-os {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/ {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status/ {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status/index.html {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quants-strategies/quant-os/status/status-data.js {
+    return 308 https://$host/quant-os/status/status-data.js;
+}
diff --git a/ops/nginx/quant-os-static.conf b/ops/nginx/quant-os-static.conf
new file mode 100644
index 0000000..58cffe8
--- /dev/null
+++ b/ops/nginx/quant-os-static.conf
@@ -0,0 +1,29 @@
+# Quant OS public status routes.
+#
+# This snippet belongs inside the gomars.fun HTTPS server block. The release
+# payload is published under /srv/www/quant-os/releases/<git-sha>/ and the
+# /srv/www/quant-os/status symlink is switched atomically after verification.
+
+location = /quant-os {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quant-os/ {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quant-os/status {
+    return 308 https://$host/quant-os/status/;
+}
+
+location = /quant-os/status/index.html {
+    return 308 https://$host/quant-os/status/;
+}
+
+location ^~ /quant-os/status/ {
+    root /srv/www;
+    index index.html;
+    try_files $uri $uri/ =404;
+    add_header Cache-Control "no-cache" always;
+    add_header X-Content-Type-Options "nosniff" always;
+}
diff --git a/profiles/README.md b/profiles/README.md
new file mode 100644
index 0000000..6139827
--- /dev/null
+++ b/profiles/README.md
@@ -0,0 +1,13 @@
+# Quant OS maturity profiles
+
+`baseline-60` and `production-80` are evidence profiles. They are not package
+names and they do not change the trading strategy.
+
+- `baseline-60`: the existing G1–G10 research-to-shadow baseline.
+- `production-80`: the limited-production standard and fail-closed evaluator.
+
+The score is never inferred from source-file count. A control earns points only
+when its required evidence tier, immutable file hash, frozen subject and
+canonical standard/profile hash are present and a verifier returns provenance.
+The repository has no production issuer registry; test verification can never
+emit a production qualification.
diff --git a/profiles/baseline-60/profile.json b/profiles/baseline-60/profile.json
new file mode 100644
index 0000000..88e8aa9
--- /dev/null
+++ b/profiles/baseline-60/profile.json
@@ -0,0 +1,30 @@
+{
+  "schema_version": "1.0",
+  "profile_id": "quant-os-baseline-60",
+  "claim": "RESEARCH_TO_SHADOW_BASELINE",
+  "source_of_truth": "gate_scorecard.json",
+  "required_gates": [
+    "G1",
+    "G2",
+    "G3",
+    "G4",
+    "G5",
+    "G6",
+    "G7",
+    "G8",
+    "G9",
+    "G10"
+  ],
+  "all_gates_required": true,
+  "minimum_score": 60,
+  "minimum_shadow_trading_days": 20,
+  "trusted_verification_required": true,
+  "verification_claim": {
+    "schema": "quant-os-evidence-claim/1.0",
+    "control_id": "BASELINE_60",
+    "evidence_type": "baseline60_qualification_attestation",
+    "minimum_evidence_tier": "E3",
+    "profile_binding": "canonical_json_sha256"
+  },
+  "capital_authority": "NONE"
+}
diff --git a/profiles/production-80/current-assessment.json b/profiles/production-80/current-assessment.json
new file mode 100644
index 0000000..72b3f6d
--- /dev/null
+++ b/profiles/production-80/current-assessment.json
@@ -0,0 +1,185 @@
+{
+  "schema_version": "1.0",
+  "standard_id": "quant-os-production-80-v1",
+  "standard_canonical_sha256": "44fc6c168ade4c6de15569214d88b96ce47b22b4120b10c80eb6f212fad5e662",
+  "assessed_as_of": "2026-07-30",
+  "claim": "CURRENT_CANDIDATE_IS_NOT_80",
+  "subject": {
+    "candidate_id": "UNASSIGNED",
+    "release_sha256": null,
+    "model_sha256": null,
+    "dataset_sha256": null,
+    "account_scope_id": null,
+    "material_change_epoch": null
+  },
+  "pre_canary_attestation": null,
+  "qualification_attestation": null,
+  "baseline_60": {
+    "all_gates_passed": false,
+    "gates_passed": 0,
+    "gates_total": 10,
+    "profile_id": "quant-os-baseline-60",
+    "profile_canonical_sha256": "34adf09a824299ddb07c17f56751527ddf96ff5e494e792be0c65da4f8acdeb3",
+    "verification": null
+  },
+  "observations": {
+    "real_qmt_observed": false,
+    "broker_programmatic_confirmation": false,
+    "shadow_trading_days": 0,
+    "canary_trading_days": 0,
+    "open_p0": null,
+    "open_p1": null
+  },
+  "controls": [
+    {
+      "id": "D1-PIT",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No authorized complete production PIT dataset has reached the frozen Ridge path."
+    },
+    {
+      "id": "D1-OPS",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No production freshness SLO, entitlement record and restore history."
+    },
+    {
+      "id": "D1-REDUNDANCY",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No independent production source or rehearsed fallback."
+    },
+    {
+      "id": "D2-OOS",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "The connected Ridge candidate still uses synthetic research data."
+    },
+    {
+      "id": "D2-MODEL",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "ModelBundle exists, but production ownership, expiry, approval and rollback evidence do not."
+    },
+    {
+      "id": "D2-CHALLENGER",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No real-data champion/challenger or production drift history."
+    },
+    {
+      "id": "D3-LAYERS",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No real-data local/JoinQuant/QMT L1-L5 strict-peer identity; Qlib has only a separate declared-scope research fixture."
+    },
+    {
+      "id": "D3-DIFF",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "Mock parity and one JoinQuant execution smoke do not close a real QMT difference ledger."
+    },
+    {
+      "id": "D4-RISK",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "Risk components exist, but there is no independent real-broker fail-closed service evidence."
+    },
+    {
+      "id": "D4-RULES",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "The effective-dated 2026-07-06 SSE/SZSE rule packs are not implemented; BSE remains explicitly excluded and fail-closed."
+    },
+    {
+      "id": "D4-OMS",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No real QMT callback, reconnect and restart lifecycle evidence."
+    },
+    {
+      "id": "D4-TCA",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No controlled-live fills or governed TCA feedback."
+    },
+    {
+      "id": "D5-QMT",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "QMT has fake-contract and syntax evidence only."
+    },
+    {
+      "id": "D5-RECON",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No real daily broker reconciliation series."
+    },
+    {
+      "id": "D5-EVIDENCE",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "Local HMAC evidence is not broker attestation or real callback history."
+    },
+    {
+      "id": "D5-FALLBACK",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No real-account manual handoff drill."
+    },
+    {
+      "id": "D6-SHADOW",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "Zero of the required 60 real QMT shadow trading days are recorded."
+    },
+    {
+      "id": "D6-CANARY",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No limited-capital canary is authorized or observed."
+    },
+    {
+      "id": "D6-DR",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No measured RPO/RTO and broker failure-drill evidence."
+    },
+    {
+      "id": "D6-RELEASE",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "Independent CI, signed release inventory and rollback drill are not yet complete."
+    },
+    {
+      "id": "D7-SCOPE",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "The intended personal scope is documented but has no private attestation reference."
+    },
+    {
+      "id": "D7-REPORT",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No broker programmatic-trading confirmation exists yet."
+    },
+    {
+      "id": "D7-FLOW",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "No real-account abnormal-trading monitoring history."
+    },
+    {
+      "id": "D7-SECURITY",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "Repository secret hygiene exists, but production access, rotation and supply-chain evidence do not."
+    },
+    {
+      "id": "D7-REGULATED",
+      "status": "not_passed",
+      "evidence": [],
+      "note": "The regulated-mode activation calendar is documentation-only."
+    }
+  ]
+}
diff --git a/profiles/production-80/standard.json b/profiles/production-80/standard.json
new file mode 100644
index 0000000..269fe56
--- /dev/null
+++ b/profiles/production-80/standard.json
@@ -0,0 +1,422 @@
+{
+  "schema_version": "1.0",
+  "standard_id": "quant-os-production-80-v1",
+  "name": "Quant OS 80-point controlled-production standard",
+  "as_of": "2026-07-30",
+  "maximum_score": 100,
+  "qualification_threshold": 80,
+  "claim_boundary": "Passing is an engineering qualification for limited personal-account production. It is not an investment-return claim, institutional licence or legal opinion.",
+  "evidence_tiers": {
+    "E0": {
+      "rank": 0,
+      "name": "assertion_or_document_only"
+    },
+    "E1": {
+      "rank": 1,
+      "name": "deterministic_local_test_or_synthetic"
+    },
+    "E2": {
+      "rank": 2,
+      "name": "authorized_real_data_frozen_oos_or_external_authority"
+    },
+    "E3": {
+      "rank": 3,
+      "name": "production_operational_control_or_real_platform_shadow"
+    },
+    "E4": {
+      "rank": 4,
+      "name": "controlled_live_observation"
+    }
+  },
+  "qualification": {
+    "baseline_60_gates": 10,
+    "minimum_shadow_trading_days": 60,
+    "minimum_canary_trading_days": 10,
+    "pre_canary_threshold": 77,
+    "pre_canary_exempt_hard_gates": [
+      "D6-CANARY"
+    ],
+    "maximum_open_p0": 0,
+    "maximum_open_p1": 0,
+    "score_cap_without_baseline_60": 59,
+    "score_cap_without_canary": 79,
+    "all_hard_gates_required": true,
+    "all_domain_floors_required": true,
+    "broker_programmatic_confirmation_required": true,
+    "real_qmt_observation_required": true,
+    "trusted_pre_canary_authorization_required": true,
+    "trusted_promotion_attestation_required": true
+  },
+  "baseline_prerequisite": {
+    "profile_path": "profiles/baseline-60/profile.json",
+    "profile_id": "quant-os-baseline-60",
+    "trusted_attestation_required": true,
+    "minimum_evidence_tier": "E3",
+    "claim_control_id": "BASELINE_60",
+    "claim_evidence_type": "baseline60_qualification_attestation"
+  },
+  "attestation_policy": {
+    "claim_schema": "quant-os-evidence-claim/1.0",
+    "standard_binding": "canonical_json_sha256",
+    "assessment_binding": "canonical_json_sha256",
+    "issuer_registry_required": true,
+    "production_trust_registry": "external_runtime_configuration_required",
+    "repository_self_issuance_allowed": false,
+    "pre_canary": {
+      "control_id": "PRE_CANARY_AUTHORIZATION",
+      "evidence_type": "pre_canary_authorization_attestation",
+      "minimum_evidence_tier": "E3",
+      "required_authorization_fields": [
+        "authorization_id",
+        "authorized_at",
+        "expires_on",
+        "account_scope_id",
+        "strategy_ids",
+        "maximum_capital_cny",
+        "maximum_gross_notional_cny",
+        "maximum_symbols",
+        "symbol_allowlist",
+        "flow_limits",
+        "stop_conditions",
+        "no_automatic_scale_up"
+      ],
+      "required_stop_conditions": [
+        "any_risk_data_rule_or_reconciliation_breach",
+        "authorization_expired",
+        "operator_kill_switch"
+      ]
+    },
+    "canary_observation": {
+      "control_id": "D6-CANARY",
+      "evidence_type": "controlled_live_canary_observation",
+      "minimum_evidence_tier": "E4",
+      "required_link_fields": [
+        "pre_canary_authorization_claim_id",
+        "pre_canary_authorization_sha256",
+        "canary_started_on",
+        "canary_ended_on",
+        "trading_days_observed"
+      ],
+      "required_observation_fields": [
+        "maximum_capital_cny_observed",
+        "maximum_gross_notional_cny_observed",
+        "symbols_observed",
+        "maximum_submission_and_cancel_requests_per_second_observed",
+        "maximum_submission_and_cancel_requests_per_day_observed",
+        "automatic_scale_up_observed",
+        "breach_events",
+        "stop_events"
+      ]
+    },
+    "promotion": {
+      "control_id": "QUALIFICATION",
+      "evidence_type": "production80_promotion_attestation",
+      "minimum_evidence_tier": "E4"
+    }
+  },
+  "operating_defaults": {
+    "declared_market_scope": {
+      "included": [
+        "SSE",
+        "SZSE"
+      ],
+      "excluded_fail_closed": [
+        "BSE"
+      ],
+      "expansion_policy": "requires_effective_dated_rule_pack_and_regression_evidence_before_enablement"
+    },
+    "rule_pack_contract": {
+      "required_fields": [
+        "published_at",
+        "effective_at",
+        "implementation_status",
+        "suspended_at",
+        "resumed_at",
+        "source_url",
+        "source_sha256"
+      ],
+      "implementation_status_values": [
+        "effective",
+        "suspended",
+        "partially_suspended",
+        "repealed"
+      ],
+      "unknown_or_suspended_behavior": "fail_closed"
+    },
+    "flow_limits": {
+      "maximum_submission_and_cancel_requests_per_second": 10,
+      "maximum_submission_and_cancel_requests_per_day": 1000,
+      "aggregation_scope": "per_account_and_actual_control_group",
+      "message_count_semantics": "all_order_submission_attempts_plus_all_cancel_requests_emitted_by_quant_os",
+      "cancellation_rate": {
+        "review_threshold": 0.3,
+        "numerator": "strategy_initiated_cancel_requests",
+        "denominator": "accepted_order_submissions",
+        "window": "trading_day_per_account_and_actual_control_group",
+        "rejected_submissions": "excluded_from_denominator",
+        "partial_fill_then_cancel": "included_in_numerator",
+        "exchange_automatic_cancel": "excluded_from_numerator",
+        "zero_denominator": "zero_rate"
+      },
+      "semantics": "internal_conservative_default_not_regulatory_safe_harbor"
+    }
+  },
+  "domains": [
+    {
+      "id": "D1",
+      "name": "Data and point-in-time truth",
+      "weight": 15,
+      "minimum_score_ratio": 0.6,
+      "controls": [
+        {
+          "id": "D1-PIT",
+          "name": "Production PIT dataset is complete, immutable and replayable",
+          "weight": 4,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E2",
+          "acceptance": "The declared universe has effective-dated security master, membership, ST, suspension, limits, corporate actions, announcement availability and fail-closed completeness tests."
+        },
+        {
+          "id": "D1-OPS",
+          "name": "Data licence, lineage, freshness and recovery are operational",
+          "weight": 5,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Every source has a permitted-use record, immutable lineage, freshness SLO, quality alarms, backfill and restore evidence."
+        },
+        {
+          "id": "D1-REDUNDANCY",
+          "name": "Critical inputs have independent validation or a tested fallback",
+          "weight": 6,
+          "hard_gate": false,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "A second source or independent control total detects material provider drift and the fallback path is rehearsed."
+        }
+      ]
+    },
+    {
+      "id": "D2",
+      "name": "Research and model governance",
+      "weight": 15,
+      "minimum_score_ratio": 0.6,
+      "controls": [
+        {
+          "id": "D2-OOS",
+          "name": "Frozen real-data walk-forward and OOS evidence is valid",
+          "weight": 4,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E2",
+          "acceptance": "Purge and embargo, untouched test data, A-share constraints, dated fees, impact, capacity and pre-registered mandate thresholds are all frozen and reproducible."
+        },
+        {
+          "id": "D2-MODEL",
+          "name": "Model, feature and release identities are governed",
+          "weight": 5,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E2",
+          "acceptance": "Registry records dataset, feature schema, code, config, training cutoff, model hash, owner, approval, rollback and expiry."
+        },
+        {
+          "id": "D2-CHALLENGER",
+          "name": "Champion, challenger, drift and experiment selection are controlled",
+          "weight": 6,
+          "hard_gate": false,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Selection policy is pre-registered; drift and degradation alerts can demote or roll back without touching a hidden test set."
+        }
+      ]
+    },
+    {
+      "id": "D3",
+      "name": "Cross-engine consistency",
+      "weight": 10,
+      "minimum_score_ratio": 0.6,
+      "controls": [
+        {
+          "id": "D3-LAYERS",
+          "name": "Local, JoinQuant and QMT share frozen L1-L5 identities; Qlib follows its declared comparison scope",
+          "weight": 6,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Local, JoinQuant and QMT strict peers produce identical signals and post-risk target weights under one dual-clock and versioned rule contract. Qlib compares L1/L2 only unless the same frozen model and portfolio implementation are explicitly exported; an unrelated Alpha158 workflow is never claimed as an L3/L4 peer."
+        },
+        {
+          "id": "D3-DIFF",
+          "name": "Order and fill differences are completely explained",
+          "weight": 4,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Multi-period difference ledgers account for price source, lot, fee, limit, fill and broker-state effects with zero unexplained residual."
+        }
+      ]
+    },
+    {
+      "id": "D4",
+      "name": "Execution and independent risk",
+      "weight": 15,
+      "minimum_score_ratio": 0.6,
+      "controls": [
+        {
+          "id": "D4-RISK",
+          "name": "Independent pre-trade risk fails closed",
+          "weight": 3,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "No strategy can bypass cash, sellable, permission, price, quantity, duplicate-order, concentration, turnover, loss and kill-switch checks."
+        },
+        {
+          "id": "D4-RULES",
+          "name": "Effective-dated SSE/SZSE rule packs are current; BSE remains fail-closed",
+          "weight": 4,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "The declared scope is SSE and SZSE; BSE is explicitly excluded and fails closed until its own rule pack is qualified. Every market, board and security-type rule records publication, effective, suspension, resumption and repeal state plus source hash. Regressions cover the 2026-07-06 rules and SSE provisions that remain suspended; unknown, expired or suspended behavior blocks submission."
+        },
+        {
+          "id": "D4-OMS",
+          "name": "Order lifecycle is idempotent and restart-safe",
+          "weight": 3,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "New, accepted, partial, rejected, cancelled and duplicate callbacks reconcile across disconnect, retry, restart and session rollover."
+        },
+        {
+          "id": "D4-TCA",
+          "name": "Real fills drive TCA and capacity feedback",
+          "weight": 5,
+          "hard_gate": false,
+          "minimum_evidence_tier": "E4",
+          "acceptance": "Arrival, implementation shortfall, spread, impact and participation are measured against actual fills and feed governed limit changes."
+        }
+      ]
+    },
+    {
+      "id": "D5",
+      "name": "Real QMT and broker truth",
+      "weight": 15,
+      "minimum_score_ratio": 0.6,
+      "controls": [
+        {
+          "id": "D5-QMT",
+          "name": "Authorized QMT account contracts are observed end to end",
+          "weight": 5,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Read-only, simulation and explicitly enabled mutation phases cover query fields, callbacks, reject, partial fill, cancel, reconnect and cross-day recovery."
+        },
+        {
+          "id": "D5-RECON",
+          "name": "Cash, positions, sellable, orders and fills reconcile daily",
+          "weight": 5,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Every trading day has 100% identity reconciliation and zero unexplained difference; a difference or stale snapshot blocks new risk."
+        },
+        {
+          "id": "D5-EVIDENCE",
+          "name": "Broker facts and callbacks have authenticated replay evidence",
+          "weight": 2,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Append-only envelopes bind run, account pseudonym, source time, sequence, data, model, config, code, order and callback identities."
+        },
+        {
+          "id": "D5-FALLBACK",
+          "name": "Manual broker fallback and operator handoff are rehearsed",
+          "weight": 3,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "The owner can freeze automation, inspect broker truth and complete or cancel risk safely without hidden automation."
+        }
+      ]
+    },
+    {
+      "id": "D6",
+      "name": "Operations, disaster recovery and audit",
+      "weight": 15,
+      "minimum_score_ratio": 0.6,
+      "controls": [
+        {
+          "id": "D6-SHADOW",
+          "name": "The frozen candidate completes 60 trading days of shadow",
+          "weight": 4,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "The same core strategy, risk and adapter release runs for at least 60 trading days with zero open P0/P1 and daily reconciliation; a material change resets the clock."
+        },
+        {
+          "id": "D6-CANARY",
+          "name": "Limited capital canary completes at least 10 trading days",
+          "weight": 3,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E4",
+          "acceptance": "Capital, gross notional, symbols, account, strategy and submission/cancel flow remain within the cited pre-canary authorization; there is no automatic scale-up, and every risk, data, rule or reconciliation breach is linked to a fail-closed stop event."
+        },
+        {
+          "id": "D6-DR",
+          "name": "Failure recovery meets RPO and RTO targets",
+          "weight": 5,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Order and fill RPO is zero, trading-window RTO is at most 15 minutes, and network, crash, stale market, corrupt state and duplicate-message drills pass."
+        },
+        {
+          "id": "D6-RELEASE",
+          "name": "Build, promotion, rollback and audit are reproducible",
+          "weight": 3,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "A clean build emits signed manifests and dependency inventory; promotion is approved, atomic, observable and rollback-tested."
+        }
+      ]
+    },
+    {
+      "id": "D7",
+      "name": "Compliance and security",
+      "weight": 15,
+      "minimum_score_ratio": 0.6,
+      "controls": [
+        {
+          "id": "D7-SCOPE",
+          "name": "Account and business scope remains personal proprietary",
+          "weight": 3,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "A private attestation is bound to broker KYC or account-ownership evidence and an access review. Third-party money, accepting a mandate to decide or execute trades for another person, providing paid investment advice to others, or sharing trade-control authority blocks this profile and triggers a documented legal/compliance applicability review. Purchasing or reading third-party research does not by itself constitute a third-party trading mandate."
+        },
+        {
+          "id": "D7-REPORT",
+          "name": "Broker programmatic-trading report matches the deployed release",
+          "weight": 4,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "The broker has confirmed first reporting and the deployed strategy, software version, developer, capital, leverage and declared rates match the reported facts; material changes are registered before activation."
+        },
+        {
+          "id": "D7-FLOW",
+          "name": "Abnormal-trading and conservative flow controls are enforced",
+          "weight": 3,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Per account and actual-control account group, monitoring covers order-submission attempts, cancel requests, one-second cancellation, price impact, trade share, self-trade and reverse trade. The versioned daily-baseline policy counts every Quant OS submission attempt plus cancel request and permits no more than 10 such messages per second or 1000 per trading day. A strategy-initiated cancel-request count divided by accepted order submissions at or above 30% triggers review; rejected submissions are excluded from that denominator, partial-fill-then-cancel is included in the numerator, and exchange automatic cancellation is excluded. Stricter broker or exchange limits prevail and no internal limit claims regulatory safety."
+        },
+        {
+          "id": "D7-SECURITY",
+          "name": "Secrets, access, personal data and supply chain are controlled",
+          "weight": 2,
+          "hard_gate": true,
+          "minimum_evidence_tier": "E3",
+          "acceptance": "Credentials remain in an approved secret store, access is least-privilege and revocable, logs are redacted, dependencies are inventoried, and Colab/public artifacts contain no account facts."
+        },
+        {
+          "id": "D7-REGULATED",
+          "name": "A future regulated-mode rule calendar is maintained",
+          "weight": 3,
+          "hard_gate": false,
+          "minimum_evidence_tier": "E2",
+          "acceptance": "An effective-dated calendar records official URLs, publication and effective dates, retrieval date, content hash and review cadence. External capital or clients always block PERSONAL_PROPRIETARY and trigger a documented legal/compliance applicability determination; private-fund, disclosure, retention or licensed-operation obligations are activated only when that determination finds them applicable."
+        }
+      ]
+    }
+  ]
+}
diff --git a/pyproject.toml b/pyproject.toml
index 3f96904..c106e53 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,13 +3,14 @@ requires = ["setuptools>=68"]
 build-backend = "setuptools.build_meta"
 
 [project]
-name = "quant60"
-version = "0.1.0"
-description = "Portable, auditable A-share quantitative trading baseline"
+name = "quant-os"
+version = "0.2.0"
+description = "Evidence-driven A-share research, backtest and controlled-production operating system"
 requires-python = ">=3.10"
 dependencies = []
 
 [project.scripts]
+quant-os = "quant_os.cli:main"
 quant60 = "quant60.cli:main"
 
 [tool.setuptools]
diff --git a/runbooks/PLATFORM_DEPLOYMENT.md b/runbooks/PLATFORM_DEPLOYMENT.md
index 3ad5aa7..f2c2585 100644
--- a/runbooks/PLATFORM_DEPLOYMENT.md
+++ b/runbooks/PLATFORM_DEPLOYMENT.md
@@ -3,9 +3,10 @@
 从仓库中的 `quant-os` 项目根目录运行命令。本文没有任何命令会启用真实订单。
 Quant OS 是项目名；`quant60` 是第一版 A 股 Baseline 内核和 CLI namespace。
 
-当前结论是 `NOT_BASELINE_60`。最近一次标准库套件为 211 tests、OK、
-3 个可选路径 skip。CPython 3.12 + `pyqlib==0.9.7` 的 native momentum
-和 Alpha158/LightGBM/Recorder fixture 已真实跑通；JoinQuant、QMT 与 broker
+当前结论是 `NOT_BASELINE_60`。最近一次完整套件的精确计数以
+`gate_scorecard.json` 和 CI 运行记录为准，测试通过只属于本地/fixture
+证据。CPython 3.12 + `pyqlib==0.9.7` 的 native momentum 和
+Alpha158/LightGBM/Recorder fixture 已真实跑通；JoinQuant、QMT 与 broker
 中，JoinQuant 已有一次 2024 全年真实 hosted smoke，QMT 与 broker 尚无
 真实运行证据；聚宽仍缺完整导出与同输入 peer。
 
@@ -435,7 +436,8 @@ QMT 账号还要先探测官方 query API 在“失败”与“空列表”时
 terminal/xtquant build 记录以及 `XtTrade.traded_amount` 对
 `price × quantity` 的真实容差探针。当前 amount 是被认证的 informational
 fact，不参与 target/delta。之后还需脱敏 callback replay、restart recovery、
-完整对账、至少 20 trading days shadow 和 G10。当前 `.BJ` mutation 不支持。
+完整对账和 G10；Baseline 60 至少需要 20 trading days shadow，Production 80
+当前要求同一冻结候选至少 60 trading days。当前 `.BJ` mutation 不支持。
 
 ## 8. Qlib 0.9.7 research
 
@@ -527,8 +529,9 @@ real_platform_pass = false
 gate_credit = []
 ```
 
-因此 mock parity 不计 G9。真实 G9 仍要求真实 JoinQuant/QMT export、同输入
-的 L1—L5 difference report 和至少 20 trading days QMT/broker shadow。
+因此 mock parity 不计 G9。Baseline 60 的真实 G9 仍要求真实 JoinQuant/QMT
+export、同输入的 L1—L5 difference report 和至少 20 trading days QMT/broker
+shadow；Production 80 当前要求同一冻结候选至少 60 trading days。
 
 ## 10. Evidence checklist
 
diff --git a/runtimes/README.md b/runtimes/README.md
new file mode 100644
index 0000000..1c93c5b
--- /dev/null
+++ b/runtimes/README.md
@@ -0,0 +1,12 @@
+# Proprietary runtime boundaries
+
+These directories document deployment boundaries. They do not vendor platform
+SDKs or credentials.
+
+- `portable36`: generated dependency-free consumer for hosted Python 3.6.
+- `joinquant`: JoinQuant upload/runtime contract.
+- `qmt_builtin`: QMT built-in strategy runtime.
+- `colab`: notebook runtime and data-upload boundary.
+
+Current executable compatibility files remain under `platforms/`, `dist/` and
+`notebooks/` until their golden-vector migrations complete.
diff --git a/runtimes/colab/README.md b/runtimes/colab/README.md
new file mode 100644
index 0000000..f31a2d1
--- /dev/null
+++ b/runtimes/colab/README.md
@@ -0,0 +1,5 @@
+# Colab runtime
+
+The canonical notebook remains `notebooks/quant_os_colab.ipynb`. Colab may
+receive only data whose licence permits the use and which contains no broker
+credential, account, holding, fill or other sensitive account fact.
diff --git a/runtimes/joinquant/README.md b/runtimes/joinquant/README.md
new file mode 100644
index 0000000..cd8af14
--- /dev/null
+++ b/runtimes/joinquant/README.md
@@ -0,0 +1,5 @@
+# JoinQuant runtime
+
+The hosted file is a thin execution consumer. Current source and generated
+artifacts remain at `platforms/joinquant_strategy.py` and
+`dist/joinquant_strategy.py` during compatibility migration.
diff --git a/runtimes/portable36/README.md b/runtimes/portable36/README.md
new file mode 100644
index 0000000..e8bb222
--- /dev/null
+++ b/runtimes/portable36/README.md
@@ -0,0 +1,5 @@
+# portable36
+
+Target boundary for the generated Python 3.6-compatible TargetPackage consumer.
+It may consume versioned schemas and golden vectors, but cannot import the
+modern local core or calculate Alpha.
diff --git a/runtimes/qmt_builtin/README.md b/runtimes/qmt_builtin/README.md
new file mode 100644
index 0000000..3627e10
--- /dev/null
+++ b/runtimes/qmt_builtin/README.md
@@ -0,0 +1,4 @@
+# QMT built-in runtime
+
+The built-in runtime remains backtest-only until real QMT contract, callback,
+restart, reconciliation and broker programmatic-trading evidence pass.
diff --git a/scripts/validate_all.sh b/scripts/validate_all.sh
index f9895f1..ea5426a 100755
--- a/scripts/validate_all.sh
+++ b/scripts/validate_all.sh
@@ -8,6 +8,9 @@ python_bin="${PYTHON_BIN:-python3}"
 
 "${python_bin}" -c \
   'import sys; assert sys.version_info >= (3, 10), sys.version'
+PYTHONPATH=src:. "${python_bin}" -m quant_os architecture check
+PYTHONPATH=src:. "${python_bin}" -m quant_os standard validate
+PYTHONPATH=src:. "${python_bin}" -m quant_os standard evaluate
 PYTHONPATH=src:. "${python_bin}" -m unittest discover -s tests -p '*.py' -q
 "${python_bin}" tools/bundle_platforms.py
 PYTHONPATH=src:. "${python_bin}" -m quant60 smoke \
@@ -26,6 +29,8 @@ PYTHONPATH=src:. "${python_bin}" tools/export_mock_parity.py \
   verify \
   artifacts/mock-parity/report.json
 PYTHONPATH=src:. "${python_bin}" tools/capability_probe.py
+PYTHONPATH=src:. "${python_bin}" -m quant_os doctor
+"${python_bin}" tools/check_tracked_secrets.py
 "${python_bin}" tools/build_public_status.py --check
 "${python_bin}" tools/run_colab_notebook.py notebooks/quant_os_colab.ipynb
 "${python_bin}" tools/run_colab_notebook.py \
diff --git a/src/quant_os/__init__.py b/src/quant_os/__init__.py
new file mode 100644
index 0000000..95541eb
--- /dev/null
+++ b/src/quant_os/__init__.py
@@ -0,0 +1,7 @@
+"""Long-lived product namespace for Quant OS.
+
+`quant60` remains the compatibility namespace for the first baseline protocol.
+Maturity scores belong to profiles, not to the package name.
+"""
+
+__version__ = "0.2.0"
diff --git a/src/quant_os/__main__.py b/src/quant_os/__main__.py
new file mode 100644
index 0000000..a049ad7
--- /dev/null
+++ b/src/quant_os/__main__.py
@@ -0,0 +1,5 @@
+from .cli import main
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/src/quant_os/adapters/__init__.py b/src/quant_os/adapters/__init__.py
new file mode 100644
index 0000000..47d053f
--- /dev/null
+++ b/src/quant_os/adapters/__init__.py
@@ -0,0 +1,6 @@
+"""Concrete provider, research-engine, platform and broker port adapters.
+
+The existing top-level `adapters/` modules are the compatibility
+implementations. They move here only after golden-vector equivalence is
+established.
+"""
diff --git a/src/quant_os/application/__init__.py b/src/quant_os/application/__init__.py
new file mode 100644
index 0000000..bb0a0ad
--- /dev/null
+++ b/src/quant_os/application/__init__.py
@@ -0,0 +1 @@
+"""Use cases that compose domain ports without importing concrete SDKs."""
diff --git a/src/quant_os/architecture.py b/src/quant_os/architecture.py
new file mode 100644
index 0000000..23ec241
--- /dev/null
+++ b/src/quant_os/architecture.py
@@ -0,0 +1,268 @@
+"""Machine-checkable dependency rules for the new Quant OS namespace."""
+
+from __future__ import annotations
+
+import ast
+from pathlib import Path
+from typing import Dict, Iterable, List, Mapping, Set
+
+
+LAYER_DEPENDENCIES: Mapping[str, Set[str]] = {
+    "foundation": {"foundation"},
+    "contracts": {"foundation", "contracts"},
+    "ports": {"foundation", "contracts", "ports"},
+    "data": {"foundation", "contracts", "ports", "data"},
+    "research": {"foundation", "contracts", "ports", "research"},
+    "portfolio": {"foundation", "contracts", "ports", "portfolio"},
+    "execution": {"foundation", "contracts", "ports", "execution"},
+    "application": {
+        "foundation",
+        "contracts",
+        "ports",
+        "data",
+        "research",
+        "portfolio",
+        "execution",
+        "application",
+    },
+    "evidence": {"foundation", "contracts", "ports", "evidence"},
+    "adapters": {
+        "foundation",
+        "contracts",
+        "ports",
+        "adapters",
+    },
+    "control": {
+        "foundation",
+        "contracts",
+        "ports",
+        "application",
+        "evidence",
+        "control",
+    },
+    "composition": {
+        "foundation",
+        "contracts",
+        "ports",
+        "data",
+        "research",
+        "portfolio",
+        "execution",
+        "application",
+        "evidence",
+        "adapters",
+        "control",
+        "composition",
+    },
+}
+
+PLANES: Mapping[str, tuple[str, ...]] = {
+    "data": ("data", "research", "portfolio", "execution"),
+    "control": ("application", "control"),
+    "evidence": ("evidence",),
+    "boundary": ("contracts", "ports", "adapters"),
+    "foundation": ("foundation",),
+    "composition": ("composition",),
+}
+
+VENDOR_MODULES = frozenset({"jqdatasdk", "qlib", "xtquant"})
+LEGACY_FIRST_PARTY_MODULES = frozenset(
+    {"quant60", "adapters", "platforms", "tools"}
+)
+LEGACY_COMPATIBILITY_LAYERS = frozenset({"composition"})
+ROOT_MODULE_LAYERS: Mapping[str, str] = {
+    "__init__": "foundation",
+    "__main__": "composition",
+    "architecture": "control",
+    "cli": "composition",
+}
+
+
+def _imports(
+    tree: ast.AST,
+    *,
+    current_layer: str,
+    root_module: bool,
+) -> Iterable[tuple[str, str]]:
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            for alias in node.names:
+                parts = alias.name.split(".")
+                if len(parts) >= 2 and parts[0] == "quant_os":
+                    yield ("quant_os_layer", parts[1])
+                yield ("module", parts[0])
+        elif isinstance(node, ast.ImportFrom):
+            module = node.module or ""
+            parts = module.split(".") if module else []
+            if node.level >= 2:
+                if parts:
+                    yield ("quant_os_layer", parts[0])
+                else:
+                    for alias in node.names:
+                        yield ("quant_os_layer", alias.name.split(".")[0])
+            elif node.level == 1:
+                if root_module and parts and parts[0] in LAYER_DEPENDENCIES:
+                    yield ("quant_os_layer", parts[0])
+                elif root_module and parts and parts[0] in ROOT_MODULE_LAYERS:
+                    yield ("quant_os_layer", ROOT_MODULE_LAYERS[parts[0]])
+                elif root_module and not parts:
+                    for alias in node.names:
+                        imported = alias.name.split(".")[0]
+                        if imported in LAYER_DEPENDENCIES:
+                            yield ("quant_os_layer", imported)
+                else:
+                    yield ("quant_os_layer", current_layer)
+            elif parts and parts[0] == "quant_os":
+                if len(parts) >= 2:
+                    yield ("quant_os_layer", parts[1])
+                else:
+                    for alias in node.names:
+                        yield ("quant_os_layer", alias.name.split(".")[0])
+            if parts:
+                yield ("module", parts[0])
+
+
+def _check_python_file(
+    *,
+    path: Path,
+    root: Path,
+    layer: str,
+    allowed: Set[str],
+) -> List[Dict[str, object]]:
+    violations: List[Dict[str, object]] = []
+    try:
+        tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    except (OSError, SyntaxError) as exc:
+        return [
+            {
+                "layer": layer,
+                "path": path.relative_to(root).as_posix(),
+                "reason": f"cannot_parse:{type(exc).__name__}",
+            }
+        ]
+    imports = set(
+        _imports(
+            tree,
+            current_layer=layer,
+            root_module=path.parent == root,
+        )
+    )
+    for kind, imported in sorted(imports):
+        if (
+            kind == "quant_os_layer"
+            and imported in LAYER_DEPENDENCIES
+            and imported not in allowed
+        ):
+            violations.append(
+                {
+                    "layer": layer,
+                    "path": path.relative_to(root).as_posix(),
+                    "reason": "forbidden_dependency",
+                    "imports": imported,
+                    "allowed": sorted(allowed),
+                }
+            )
+        if kind == "module" and imported in VENDOR_MODULES and layer != "adapters":
+            violations.append(
+                {
+                    "layer": layer,
+                    "path": path.relative_to(root).as_posix(),
+                    "reason": "vendor_sdk_outside_adapter",
+                    "imports": imported,
+                }
+            )
+        if (
+            kind == "module"
+            and imported in LEGACY_FIRST_PARTY_MODULES
+            and layer not in LEGACY_COMPATIBILITY_LAYERS
+        ):
+            violations.append(
+                {
+                    "layer": layer,
+                    "path": path.relative_to(root).as_posix(),
+                    "reason": "legacy_dependency_escape",
+                    "imports": imported,
+                    "allowed_layers": sorted(
+                        LEGACY_COMPATIBILITY_LAYERS
+                    ),
+                }
+            )
+    return violations
+
+
+def validate_architecture(package_root: str | Path) -> Dict[str, object]:
+    """Return violations without importing project modules.
+
+    The legacy `quant60` namespace is intentionally outside this check. New
+    code must enter through these boundaries; the compatibility kernel will be
+    migrated one vertical slice at a time.
+    """
+
+    root = Path(package_root)
+    violations: List[Dict[str, object]] = []
+    checked_files = 0
+    for child in sorted(root.iterdir()) if root.is_dir() else []:
+        if (
+            child.is_dir()
+            and child.name not in LAYER_DEPENDENCIES
+            and child.name != "__pycache__"
+            and any(child.rglob("*.py"))
+        ):
+            violations.append(
+                {
+                    "layer": child.name,
+                    "path": child.relative_to(root).as_posix(),
+                    "reason": "unregistered_layer_package",
+                }
+            )
+    for layer, allowed in sorted(LAYER_DEPENDENCIES.items()):
+        layer_root = root / layer
+        if not layer_root.is_dir():
+            violations.append(
+                {
+                    "layer": layer,
+                    "path": layer_root.as_posix(),
+                    "reason": "missing_layer_package",
+                }
+            )
+            continue
+        for path in sorted(layer_root.rglob("*.py")):
+            checked_files += 1
+            violations.extend(
+                _check_python_file(
+                    path=path,
+                    root=root,
+                    layer=layer,
+                    allowed=allowed,
+                )
+            )
+    for path in sorted(root.glob("*.py")):
+        root_layer = ROOT_MODULE_LAYERS.get(path.stem)
+        if root_layer is None:
+            violations.append(
+                {
+                    "layer": "root",
+                    "path": path.relative_to(root).as_posix(),
+                    "reason": "unregistered_root_module",
+                }
+            )
+            continue
+        checked_files += 1
+        violations.extend(
+            _check_python_file(
+                path=path,
+                root=root,
+                layer=root_layer,
+                allowed=set(LAYER_DEPENDENCIES[root_layer]),
+            )
+        )
+    return {
+        "ok": not violations,
+        "scope": "new_namespace_only",
+        "package_root": "src/quant_os",
+        "migration_state": "transitioning_from_quant60_legacy",
+        "checked_files": checked_files,
+        "layers": sorted(LAYER_DEPENDENCIES),
+        "planes": {name: list(layers) for name, layers in PLANES.items()},
+        "violations": violations,
+    }
diff --git a/src/quant_os/cli.py b/src/quant_os/cli.py
new file mode 100644
index 0000000..e957354
--- /dev/null
+++ b/src/quant_os/cli.py
@@ -0,0 +1,224 @@
+"""Stable Quant OS CLI with `quant60` kept as a compatibility protocol."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import Any, Dict, Sequence
+
+from quant60.cli import main as legacy_main
+
+from . import __version__
+from .architecture import validate_architecture
+from .evidence import evaluate_assessment, load_json_object, validate_standard
+
+
+LEGACY_COMMANDS = frozenset(
+    {
+        "validate-config",
+        "smoke",
+        "backtest",
+        "verify-ledger",
+        "verify-manifest",
+        "research-smoke",
+        "verify-research-manifest",
+        "snapshot-decision",
+        "snapshot-backtest",
+        "verify-snapshot-decision",
+        "preflight",
+    }
+)
+
+
+def _looks_like_project_root(path: Path) -> bool:
+    return (
+        (path / "pyproject.toml").is_file()
+        and (path / "profiles/production-80/standard.json").is_file()
+        and (path / "src/quant_os").is_dir()
+    )
+
+
+def _project_root(explicit: str | Path | None = None) -> Path:
+    if explicit is not None:
+        candidate = Path(explicit).expanduser().resolve()
+        if not _looks_like_project_root(candidate):
+            raise FileNotFoundError(
+                f"not a Quant OS checkout: {candidate}"
+            )
+        return candidate
+    candidates = [Path.cwd().resolve()]
+    candidates.extend(Path.cwd().resolve().parents)
+    source_checkout = Path(__file__).resolve().parents[2]
+    candidates.append(source_checkout)
+    seen = set()
+    for candidate in candidates:
+        if candidate in seen:
+            continue
+        seen.add(candidate)
+        if _looks_like_project_root(candidate):
+            return candidate
+    raise FileNotFoundError(
+        "Quant OS checkout not found; run inside the repository or pass "
+        "--project-root"
+    )
+
+
+def _profile_paths(project_root: Path) -> tuple[Path, Path]:
+    root = project_root / "profiles" / "production-80"
+    return root / "standard.json", root / "current-assessment.json"
+
+
+def _emit(payload: Dict[str, Any]) -> None:
+    print(
+        json.dumps(
+            payload,
+            ensure_ascii=False,
+            indent=2,
+            sort_keys=True,
+            allow_nan=False,
+        )
+    )
+
+
+def _doctor(project: Path) -> Dict[str, Any]:
+    profile_path, assessment_path = _profile_paths(project)
+    architecture = validate_architecture(project / "src" / "quant_os")
+    standard = load_json_object(profile_path)
+    assessment = load_json_object(assessment_path)
+    profile = validate_standard(standard)
+    evaluation = evaluate_assessment(
+        standard,
+        assessment,
+        repository_root=project,
+    )
+    required_paths = {
+        "baseline_config": project / "configs" / "baseline.json",
+        "joinquant_bundle": project / "dist" / "joinquant_strategy.py",
+        "qmt_bundle": project / "dist" / "qmt_builtin_strategy.py",
+        "colab_notebook": project / "notebooks" / "quant_os_colab.ipynb",
+        "baseline_60_scorecard": project / "gate_scorecard.json",
+    }
+    legacy_roots = (
+        project / "src" / "quant60",
+        project / "adapters",
+        project / "platforms",
+        project / "tools",
+    )
+    legacy_python_files = sum(
+        1
+        for root in legacy_roots
+        if root.is_dir()
+        for _path in root.rglob("*.py")
+    )
+    return {
+        "ok": bool(architecture["ok"]) and all(
+            path.is_file() for path in required_paths.values()
+        ),
+        "product": "Quant OS",
+        "version": __version__,
+        "architecture": architecture,
+        "migration": {
+            "state": "transitioning",
+            "checked_scope": "src/quant_os",
+            "legacy_python_files_outside_checker": legacy_python_files,
+            "legacy_roots": [
+                path.relative_to(project).as_posix()
+                for path in legacy_roots
+                if path.is_dir()
+            ],
+        },
+        "profile": profile,
+        "current_maturity": {
+            "state": evaluation["qualification_state"],
+            "effective_score": evaluation["effective_score"],
+            "maximum_score": evaluation["maximum_score"],
+            "baseline_60_passed": evaluation["baseline_60_passed"],
+            "qualified": evaluation["qualified"],
+            "standard_canonical_sha256": evaluation[
+                "standard_canonical_sha256"
+            ],
+            "production_trust_registry_available": evaluation[
+                "production_trust_registry_available"
+            ],
+            "verification_environment": evaluation[
+                "verification_environment"
+            ],
+        },
+        "compatibility": {
+            "quant60_cli": True,
+            "quant60_import": True,
+            "writer_protocol": "V1",
+        },
+        "required_paths": {
+            name: {"available": path.is_file(), "path": path.relative_to(project).as_posix()}
+            for name, path in required_paths.items()
+        },
+    }
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="quant-os", description=__doc__)
+    parser.add_argument("--version", action="version", version=__version__)
+    parser.add_argument(
+        "--project-root",
+        help="path to a Quant OS repository checkout",
+    )
+    subparsers = parser.add_subparsers(dest="command", required=True)
+    subparsers.add_parser(
+        "doctor",
+        help="validate project boundaries, profiles and local entrypoint files",
+    )
+    architecture = subparsers.add_parser(
+        "architecture", help="check new-namespace dependency boundaries"
+    )
+    architecture.add_argument("action", choices=("check",))
+    standard = subparsers.add_parser(
+        "standard", help="validate or evaluate a maturity profile"
+    )
+    standard.add_argument("action", choices=("validate", "evaluate"))
+    standard.add_argument("--profile")
+    standard.add_argument("--assessment")
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    if arguments and arguments[0] in LEGACY_COMMANDS:
+        return legacy_main(arguments)
+    args = _build_parser().parse_args(arguments)
+    try:
+        project = _project_root(args.project_root)
+        if args.command == "doctor":
+            payload = _doctor(project)
+        elif args.command == "architecture":
+            payload = validate_architecture(project / "src" / "quant_os")
+        elif args.command == "standard":
+            default_profile, default_assessment = _profile_paths(project)
+            profile = load_json_object(args.profile or default_profile)
+            if args.action == "validate":
+                payload = validate_standard(profile)
+            else:
+                payload = evaluate_assessment(
+                    profile,
+                    load_json_object(args.assessment or default_assessment),
+                    repository_root=project,
+                )
+        else:
+            raise ValueError(f"unsupported command {args.command}")
+    except Exception as exc:
+        _emit(
+            {
+                "ok": False,
+                "error": type(exc).__name__,
+                "message": str(exc),
+            }
+        )
+        return 2
+    _emit(payload)
+    return 0 if payload.get("ok") else 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/src/quant_os/composition/__init__.py b/src/quant_os/composition/__init__.py
new file mode 100644
index 0000000..482157b
--- /dev/null
+++ b/src/quant_os/composition/__init__.py
@@ -0,0 +1,5 @@
+"""Composition root for wiring application use cases to runtime adapters.
+
+Only this layer may depend on both application/control modules and adapters.
+Vendor SDK imports still belong inside adapter implementations.
+"""
diff --git a/src/quant_os/contracts/__init__.py b/src/quant_os/contracts/__init__.py
new file mode 100644
index 0000000..0927013
--- /dev/null
+++ b/src/quant_os/contracts/__init__.py
@@ -0,0 +1 @@
+"""Versioned DTOs, schemas and migrations; no provider or broker SDK imports."""
diff --git a/src/quant_os/control/__init__.py b/src/quant_os/control/__init__.py
new file mode 100644
index 0000000..5d7906e
--- /dev/null
+++ b/src/quant_os/control/__init__.py
@@ -0,0 +1 @@
+"""Run specifications, orchestration and release policy."""
diff --git a/src/quant_os/data/__init__.py b/src/quant_os/data/__init__.py
new file mode 100644
index 0000000..0b07939
--- /dev/null
+++ b/src/quant_os/data/__init__.py
@@ -0,0 +1 @@
+"""Canonical point-in-time datasets, immutable snapshots and quality checks."""
diff --git a/src/quant_os/evidence/__init__.py b/src/quant_os/evidence/__init__.py
new file mode 100644
index 0000000..e47f1b4
--- /dev/null
+++ b/src/quant_os/evidence/__init__.py
@@ -0,0 +1,15 @@
+"""Evidence manifests, claims, parity and maturity evaluation."""
+
+from .maturity import (
+    MaturityStandardError,
+    evaluate_assessment,
+    load_json_object,
+    validate_standard,
+)
+
+__all__ = [
+    "MaturityStandardError",
+    "evaluate_assessment",
+    "load_json_object",
+    "validate_standard",
+]
diff --git a/src/quant_os/evidence/maturity.py b/src/quant_os/evidence/maturity.py
new file mode 100644
index 0000000..39c2536
--- /dev/null
+++ b/src/quant_os/evidence/maturity.py
@@ -0,0 +1,1760 @@
+"""Fail-closed evaluator for evidence-backed Quant OS maturity profiles."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import re
+from copy import deepcopy
+from datetime import date
+from pathlib import Path
+from typing import Any, Callable, Dict, List, Mapping, Sequence, Tuple
+
+
+SHA256_PATTERN = re.compile(r"^[0-9a-f]{64}$")
+CONTROL_STATUSES = frozenset({"passed", "not_passed"})
+EVIDENCE_CLAIM_SCHEMA = "quant-os-evidence-claim/1.0"
+TrustedEvidenceVerifier = Callable[
+    [Mapping[str, Any], Mapping[str, Any], Path],
+    Mapping[str, Any],
+]
+PRODUCTION_TRUST_REGISTRY_AVAILABLE = False
+
+
+class MaturityStandardError(ValueError):
+    """Raised when a standard or assessment cannot support a safe claim."""
+
+
+def _canonical_sha256(value: Mapping[str, Any]) -> str:
+    canonical = json.dumps(
+        value,
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+        allow_nan=False,
+    ).encode("utf-8")
+    return hashlib.sha256(canonical).hexdigest()
+
+
+def load_json_object(path: str | Path) -> Dict[str, Any]:
+    source = Path(path)
+    try:
+        payload = json.loads(source.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise MaturityStandardError(f"cannot load JSON object {source}: {exc}") from exc
+    if not isinstance(payload, dict):
+        raise MaturityStandardError(f"{source} must contain one JSON object")
+    return payload
+
+
+def _safe_relative_path(value: Any, *, label: str) -> str:
+    text = str(value)
+    path = Path(text)
+    if not text or path.is_absolute() or ".." in path.parts or "\\" in text:
+        raise MaturityStandardError(f"{label} must be a safe repository-relative path")
+    return path.as_posix()
+
+
+def _as_int(value: Any, *, label: str, minimum: int = 0) -> int:
+    if isinstance(value, bool) or not isinstance(value, int) or value < minimum:
+        raise MaturityStandardError(f"{label} must be an integer >= {minimum}")
+    return value
+
+
+def _standard_index(
+    standard: Mapping[str, Any],
+) -> Tuple[Dict[str, Dict[str, Any]], Dict[str, Dict[str, Any]]]:
+    domains = standard.get("domains")
+    if not isinstance(domains, list) or not domains:
+        raise MaturityStandardError("standard domains must be a non-empty array")
+    domain_index: Dict[str, Dict[str, Any]] = {}
+    control_index: Dict[str, Dict[str, Any]] = {}
+    total_weight = 0
+    for raw_domain in domains:
+        if not isinstance(raw_domain, dict):
+            raise MaturityStandardError("every domain must be an object")
+        domain_id = str(raw_domain.get("id", ""))
+        if not domain_id or domain_id in domain_index:
+            raise MaturityStandardError(f"duplicate or empty domain id: {domain_id!r}")
+        weight = _as_int(
+            raw_domain.get("weight"), label=f"{domain_id}.weight", minimum=1
+        )
+        minimum_ratio = raw_domain.get("minimum_score_ratio")
+        if (
+            isinstance(minimum_ratio, bool)
+            or not isinstance(minimum_ratio, (int, float))
+            or not 0 <= float(minimum_ratio) <= 1
+        ):
+            raise MaturityStandardError(
+                f"{domain_id}.minimum_score_ratio must be between 0 and 1"
+            )
+        controls = raw_domain.get("controls")
+        if not isinstance(controls, list) or not controls:
+            raise MaturityStandardError(f"{domain_id}.controls must be non-empty")
+        control_weight = 0
+        normalized_controls: List[Dict[str, Any]] = []
+        for raw_control in controls:
+            if not isinstance(raw_control, dict):
+                raise MaturityStandardError(f"{domain_id} control must be an object")
+            control_id = str(raw_control.get("id", ""))
+            if not control_id or control_id in control_index:
+                raise MaturityStandardError(
+                    f"duplicate or empty control id: {control_id!r}"
+                )
+            item_weight = _as_int(
+                raw_control.get("weight"),
+                label=f"{control_id}.weight",
+                minimum=1,
+            )
+            if not isinstance(raw_control.get("hard_gate"), bool):
+                raise MaturityStandardError(f"{control_id}.hard_gate must be boolean")
+            minimum_tier = str(raw_control.get("minimum_evidence_tier", ""))
+            evidence_tiers = standard.get("evidence_tiers", {})
+            if minimum_tier not in evidence_tiers:
+                raise MaturityStandardError(
+                    f"{control_id} has unknown evidence tier {minimum_tier!r}"
+                )
+            normalized = dict(raw_control)
+            normalized["domain_id"] = domain_id
+            normalized_controls.append(normalized)
+            control_index[control_id] = normalized
+            control_weight += item_weight
+        if control_weight != weight:
+            raise MaturityStandardError(
+                f"{domain_id} controls weigh {control_weight}, expected {weight}"
+            )
+        normalized_domain = dict(raw_domain)
+        normalized_domain["controls"] = normalized_controls
+        domain_index[domain_id] = normalized_domain
+        total_weight += weight
+    maximum = _as_int(
+        standard.get("maximum_score"), label="maximum_score", minimum=1
+    )
+    if total_weight != maximum:
+        raise MaturityStandardError(
+            f"domain weights total {total_weight}, expected {maximum}"
+        )
+    return domain_index, control_index
+
+
+def validate_standard(standard: Mapping[str, Any]) -> Dict[str, Any]:
+    if str(standard.get("schema_version")) != "1.0":
+        raise MaturityStandardError("unsupported maturity standard schema_version")
+    standard_id = str(standard.get("standard_id", ""))
+    if not standard_id:
+        raise MaturityStandardError("standard_id is required")
+    maximum = _as_int(
+        standard.get("maximum_score"), label="maximum_score", minimum=1
+    )
+    threshold = _as_int(
+        standard.get("qualification_threshold"),
+        label="qualification_threshold",
+        minimum=1,
+    )
+    if threshold > maximum:
+        raise MaturityStandardError("qualification_threshold exceeds maximum_score")
+    tiers = standard.get("evidence_tiers")
+    if not isinstance(tiers, dict) or not tiers:
+        raise MaturityStandardError("evidence_tiers must be a non-empty object")
+    tier_values: List[int] = []
+    for tier, raw in tiers.items():
+        if not isinstance(raw, dict):
+            raise MaturityStandardError(f"evidence tier {tier} must be an object")
+        tier_values.append(
+            _as_int(raw.get("rank"), label=f"evidence_tiers.{tier}.rank")
+        )
+    if len(set(tier_values)) != len(tier_values):
+        raise MaturityStandardError("evidence tier ranks must be unique")
+    qualification = standard.get("qualification")
+    if not isinstance(qualification, dict):
+        raise MaturityStandardError("qualification must be an object")
+    required_integer_fields = (
+        "baseline_60_gates",
+        "minimum_shadow_trading_days",
+        "minimum_canary_trading_days",
+        "pre_canary_threshold",
+        "maximum_open_p0",
+        "maximum_open_p1",
+        "score_cap_without_baseline_60",
+        "score_cap_without_canary",
+    )
+    for field in required_integer_fields:
+        _as_int(qualification.get(field), label=f"qualification.{field}")
+    for field in (
+        "all_hard_gates_required",
+        "all_domain_floors_required",
+        "broker_programmatic_confirmation_required",
+        "real_qmt_observation_required",
+        "trusted_pre_canary_authorization_required",
+        "trusted_promotion_attestation_required",
+    ):
+        if qualification.get(field) is not True:
+            raise MaturityStandardError(
+                f"qualification.{field} must be true"
+            )
+    if int(qualification["score_cap_without_baseline_60"]) >= threshold:
+        raise MaturityStandardError(
+            "score_cap_without_baseline_60 must remain below qualification"
+        )
+    if int(qualification["score_cap_without_canary"]) >= threshold:
+        raise MaturityStandardError(
+            "score_cap_without_canary must remain below qualification"
+        )
+    domains, controls = _standard_index(standard)
+    hard_gate_weight = sum(
+        int(control["weight"])
+        for control in controls.values()
+        if bool(control["hard_gate"])
+    )
+    if hard_gate_weight != threshold:
+        raise MaturityStandardError(
+            "hard-gate weights must exactly equal qualification_threshold"
+        )
+    exempt_hard_gates = qualification.get("pre_canary_exempt_hard_gates")
+    if (
+        not isinstance(exempt_hard_gates, list)
+        or not exempt_hard_gates
+        or any(
+            not isinstance(control_id, str)
+            or control_id not in controls
+            or not bool(controls[control_id]["hard_gate"])
+            for control_id in exempt_hard_gates
+        )
+        or len(set(exempt_hard_gates)) != len(exempt_hard_gates)
+    ):
+        raise MaturityStandardError(
+            "qualification.pre_canary_exempt_hard_gates must name "
+            "unique hard gates"
+        )
+    pre_canary_threshold = int(qualification["pre_canary_threshold"])
+    exempt_weight = sum(
+        int(controls[control_id]["weight"])
+        for control_id in exempt_hard_gates
+    )
+    if hard_gate_weight - exempt_weight != pre_canary_threshold:
+        raise MaturityStandardError(
+            "pre_canary_threshold must equal hard-gate weight minus "
+            "the declared canary exemptions"
+        )
+    if pre_canary_threshold >= threshold:
+        raise MaturityStandardError(
+            "pre_canary_threshold must be below qualification_threshold"
+        )
+
+    baseline_prerequisite = standard.get("baseline_prerequisite")
+    if not isinstance(baseline_prerequisite, dict):
+        raise MaturityStandardError(
+            "baseline_prerequisite must be an object"
+        )
+    for field in (
+        "profile_path",
+        "profile_id",
+        "minimum_evidence_tier",
+        "claim_control_id",
+        "claim_evidence_type",
+    ):
+        if (
+            not isinstance(baseline_prerequisite.get(field), str)
+            or not baseline_prerequisite[field]
+        ):
+            raise MaturityStandardError(
+                f"baseline_prerequisite.{field} is required"
+            )
+    _safe_relative_path(
+        baseline_prerequisite["profile_path"],
+        label="baseline_prerequisite.profile_path",
+    )
+    if baseline_prerequisite.get("trusted_attestation_required") is not True:
+        raise MaturityStandardError(
+            "baseline_prerequisite.trusted_attestation_required must be true"
+        )
+    if baseline_prerequisite["minimum_evidence_tier"] not in tiers:
+        raise MaturityStandardError(
+            "baseline_prerequisite has an unknown evidence tier"
+        )
+
+    attestation_policy = standard.get("attestation_policy")
+    if not isinstance(attestation_policy, dict):
+        raise MaturityStandardError("attestation_policy must be an object")
+    fixed_policy_values = {
+        "claim_schema": EVIDENCE_CLAIM_SCHEMA,
+        "standard_binding": "canonical_json_sha256",
+        "assessment_binding": "canonical_json_sha256",
+        "production_trust_registry": (
+            "external_runtime_configuration_required"
+        ),
+    }
+    for field, expected in fixed_policy_values.items():
+        if attestation_policy.get(field) != expected:
+            raise MaturityStandardError(
+                f"attestation_policy.{field} must be {expected!r}"
+            )
+    if attestation_policy.get("issuer_registry_required") is not True:
+        raise MaturityStandardError(
+            "attestation_policy.issuer_registry_required must be true"
+        )
+    if attestation_policy.get("repository_self_issuance_allowed") is not False:
+        raise MaturityStandardError(
+            "repository self-issuance must remain disabled"
+        )
+    for section, expected_control, expected_tier in (
+        ("pre_canary", "PRE_CANARY_AUTHORIZATION", "E3"),
+        ("canary_observation", "D6-CANARY", "E4"),
+        ("promotion", "QUALIFICATION", "E4"),
+    ):
+        policy = attestation_policy.get(section)
+        if not isinstance(policy, dict):
+            raise MaturityStandardError(
+                f"attestation_policy.{section} must be an object"
+            )
+        if policy.get("control_id") != expected_control:
+            raise MaturityStandardError(
+                f"attestation_policy.{section}.control_id is invalid"
+            )
+        if policy.get("minimum_evidence_tier") != expected_tier:
+            raise MaturityStandardError(
+                f"attestation_policy.{section} tier is invalid"
+            )
+        if (
+            not isinstance(policy.get("evidence_type"), str)
+            or not policy["evidence_type"]
+        ):
+            raise MaturityStandardError(
+                f"attestation_policy.{section}.evidence_type is required"
+            )
+    for section, field in (
+        ("pre_canary", "required_authorization_fields"),
+        ("canary_observation", "required_link_fields"),
+        ("canary_observation", "required_observation_fields"),
+    ):
+        values = attestation_policy[section].get(field)
+        if (
+            not isinstance(values, list)
+            or not values
+            or any(not isinstance(item, str) or not item for item in values)
+            or len(set(values)) != len(values)
+        ):
+            raise MaturityStandardError(
+                f"attestation_policy.{section}.{field} must be unique strings"
+            )
+    if set(
+        attestation_policy["canary_observation"][
+            "required_observation_fields"
+        ]
+    ) != {
+        "maximum_capital_cny_observed",
+        "maximum_gross_notional_cny_observed",
+        "symbols_observed",
+        "maximum_submission_and_cancel_requests_per_second_observed",
+        "maximum_submission_and_cancel_requests_per_day_observed",
+        "automatic_scale_up_observed",
+        "breach_events",
+        "stop_events",
+    }:
+        raise MaturityStandardError(
+            "canary observation must carry actual cap and stop evidence"
+        )
+    if set(
+        attestation_policy["pre_canary"].get(
+            "required_stop_conditions", []
+        )
+    ) != {
+        "any_risk_data_rule_or_reconciliation_breach",
+        "authorization_expired",
+        "operator_kill_switch",
+    }:
+        raise MaturityStandardError(
+            "pre-canary authorization must carry mandatory stop conditions"
+        )
+
+    operating_defaults = standard.get("operating_defaults")
+    if not isinstance(operating_defaults, dict):
+        raise MaturityStandardError("operating_defaults must be an object")
+    flow_limits = operating_defaults.get("flow_limits")
+    if not isinstance(flow_limits, dict):
+        raise MaturityStandardError(
+            "operating_defaults.flow_limits must be an object"
+        )
+    _as_int(
+        flow_limits.get(
+            "maximum_submission_and_cancel_requests_per_second"
+        ),
+        label=(
+            "operating_defaults.flow_limits."
+            "maximum_submission_and_cancel_requests_per_second"
+        ),
+        minimum=1,
+    )
+    _as_int(
+        flow_limits.get(
+            "maximum_submission_and_cancel_requests_per_day"
+        ),
+        label=(
+            "operating_defaults.flow_limits."
+            "maximum_submission_and_cancel_requests_per_day"
+        ),
+        minimum=1,
+    )
+    if (
+        flow_limits.get("aggregation_scope")
+        != "per_account_and_actual_control_group"
+        or flow_limits.get("message_count_semantics")
+        != (
+            "all_order_submission_attempts_plus_all_cancel_requests_"
+            "emitted_by_quant_os"
+        )
+    ):
+        raise MaturityStandardError(
+            "flow limits must define account-group message semantics"
+        )
+    cancellation_rate = flow_limits.get("cancellation_rate")
+    if not isinstance(cancellation_rate, dict):
+        raise MaturityStandardError(
+            "operating_defaults.flow_limits.cancellation_rate "
+            "must be an object"
+        )
+    cancellation_threshold = cancellation_rate.get("review_threshold")
+    if (
+        isinstance(cancellation_threshold, bool)
+        or not isinstance(cancellation_threshold, (int, float))
+        or not 0 < float(cancellation_threshold) <= 1
+    ):
+        raise MaturityStandardError(
+            "operating_defaults.flow_limits."
+            "cancellation_rate.review_threshold must be in (0, 1]"
+        )
+    cancellation_semantics = {
+        "numerator": "strategy_initiated_cancel_requests",
+        "denominator": "accepted_order_submissions",
+        "window": "trading_day_per_account_and_actual_control_group",
+        "rejected_submissions": "excluded_from_denominator",
+        "partial_fill_then_cancel": "included_in_numerator",
+        "exchange_automatic_cancel": "excluded_from_numerator",
+        "zero_denominator": "zero_rate",
+    }
+    for field, expected in cancellation_semantics.items():
+        if cancellation_rate.get(field) != expected:
+            raise MaturityStandardError(
+                f"cancellation_rate.{field} must be {expected!r}"
+            )
+    if (
+        flow_limits.get("semantics")
+        != "internal_conservative_default_not_regulatory_safe_harbor"
+    ):
+        raise MaturityStandardError(
+            "flow-limit semantics must deny regulatory-safe-harbor claims"
+        )
+    market_scope = operating_defaults.get("declared_market_scope")
+    if (
+        not isinstance(market_scope, dict)
+        or market_scope.get("included") != ["SSE", "SZSE"]
+        or market_scope.get("excluded_fail_closed") != ["BSE"]
+        or market_scope.get("expansion_policy")
+        != (
+            "requires_effective_dated_rule_pack_and_regression_evidence_"
+            "before_enablement"
+        )
+    ):
+        raise MaturityStandardError(
+            "declared market scope must include SSE/SZSE and fail closed BSE"
+        )
+    rule_contract = operating_defaults.get("rule_pack_contract")
+    required_rule_fields = {
+        "published_at",
+        "effective_at",
+        "implementation_status",
+        "suspended_at",
+        "resumed_at",
+        "source_url",
+        "source_sha256",
+    }
+    if (
+        not isinstance(rule_contract, dict)
+        or set(rule_contract.get("required_fields", []))
+        != required_rule_fields
+        or set(rule_contract.get("implementation_status_values", []))
+        != {"effective", "suspended", "partially_suspended", "repealed"}
+        or rule_contract.get("unknown_or_suspended_behavior")
+        != "fail_closed"
+    ):
+        raise MaturityStandardError(
+            "rule_pack_contract must model effective and suspended states"
+        )
+    return {
+        "ok": True,
+        "standard_id": standard_id,
+        "maximum_score": maximum,
+        "qualification_threshold": threshold,
+        "domain_count": len(domains),
+        "control_count": len(controls),
+        "hard_gate_count": sum(
+            bool(control["hard_gate"]) for control in controls.values()
+        ),
+        "hard_gate_weight_total": hard_gate_weight,
+        "domain_weight_total": sum(
+            int(domain["weight"]) for domain in domains.values()
+        ),
+        "standard_canonical_sha256": _canonical_sha256(standard),
+        "production_trust_registry_available": (
+            PRODUCTION_TRUST_REGISTRY_AVAILABLE
+        ),
+    }
+
+
+def _normalize_verification_decision(
+    raw: Any,
+    *,
+    control_id: str,
+) -> Dict[str, str]:
+    if not isinstance(raw, Mapping) or raw.get("trusted") is not True:
+        raise MaturityStandardError(
+            f"{control_id} evidence attestation is not trusted"
+        )
+    required_strings = (
+        "trust_environment",
+        "verifier_id",
+        "issuer_id",
+        "key_fingerprint_sha256",
+        "policy_version",
+    )
+    for field in required_strings:
+        if not isinstance(raw.get(field), str) or not raw[field]:
+            raise MaturityStandardError(
+                f"{control_id} verifier decision requires {field}"
+            )
+    environment = str(raw["trust_environment"])
+    if environment not in {"test", "production"}:
+        raise MaturityStandardError(
+            f"{control_id} verifier trust_environment is invalid"
+        )
+    fingerprint = str(raw["key_fingerprint_sha256"])
+    if not SHA256_PATTERN.fullmatch(fingerprint):
+        raise MaturityStandardError(
+            f"{control_id} verifier key fingerprint is invalid"
+        )
+    if environment == "production" and not PRODUCTION_TRUST_REGISTRY_AVAILABLE:
+        raise MaturityStandardError(
+            "production verifier registry is not implemented; "
+            "the repository cannot self-issue a production qualification"
+        )
+    return {
+        "trust_environment": environment,
+        "verifier_id": str(raw["verifier_id"]),
+        "issuer_id": str(raw["issuer_id"]),
+        "key_fingerprint_sha256": fingerprint,
+        "policy_version": str(raw["policy_version"]),
+    }
+
+
+def _verify_evidence(
+    evidence: Sequence[Any],
+    *,
+    control: Mapping[str, Any],
+    tier_ranks: Mapping[str, int],
+    repository_root: Path | None,
+    subject: Mapping[str, Any],
+    standard_id: str,
+    standard_canonical_sha256: str,
+    trusted_verifier: TrustedEvidenceVerifier | None,
+) -> List[Dict[str, Any]]:
+    if not evidence:
+        raise MaturityStandardError(
+            f"{control['id']} cannot pass without immutable evidence"
+        )
+    minimum = tier_ranks[str(control["minimum_evidence_tier"])]
+    verified: List[Dict[str, Any]] = []
+    for index, raw in enumerate(evidence):
+        if not isinstance(raw, dict):
+            raise MaturityStandardError(f"{control['id']} evidence {index} is invalid")
+        path = _safe_relative_path(
+            raw.get("path"), label=f"{control['id']}.evidence[{index}].path"
+        )
+        tier = str(raw.get("tier", ""))
+        if tier not in tier_ranks or tier_ranks[tier] < minimum:
+            raise MaturityStandardError(
+                f"{control['id']} evidence tier {tier!r} is below "
+                f"{control['minimum_evidence_tier']}"
+            )
+        digest = str(raw.get("sha256", ""))
+        if not SHA256_PATTERN.fullmatch(digest):
+            raise MaturityStandardError(
+                f"{control['id']} evidence {path} has invalid sha256"
+            )
+        if repository_root is not None:
+            source = repository_root / path
+            if not source.is_file():
+                raise MaturityStandardError(
+                    f"{control['id']} evidence file is missing: {path}"
+                )
+            actual = hashlib.sha256(source.read_bytes()).hexdigest()
+            if actual != digest:
+                raise MaturityStandardError(
+                    f"{control['id']} evidence hash drift: {path}"
+                )
+        else:
+            raise MaturityStandardError(
+                f"{control['id']} evidence requires a repository_root"
+            )
+        try:
+            claim = json.loads(source.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim is not valid JSON: {path}"
+            ) from exc
+        if not isinstance(claim, dict):
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim must be an object: {path}"
+            )
+        if claim.get("schema_version") != EVIDENCE_CLAIM_SCHEMA:
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim has unsupported schema: {path}"
+            )
+        if claim.get("control_id") != control["id"]:
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim is bound to another control"
+            )
+        if claim.get("tier") != tier:
+            raise MaturityStandardError(
+                f"{control['id']} evidence link and claim tier differ"
+            )
+        if claim.get("subject") != subject:
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim subject mismatch"
+            )
+        if (
+            claim.get("standard_id") != standard_id
+            or claim.get("standard_canonical_sha256")
+            != standard_canonical_sha256
+        ):
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim standard binding mismatch"
+            )
+        for field in ("claim_id", "evidence_type", "authority_class"):
+            if not isinstance(claim.get(field), str) or not claim[field].strip():
+                raise MaturityStandardError(
+                    f"{control['id']} evidence claim requires {field}"
+                )
+        try:
+            date.fromisoformat(str(claim.get("observed_as_of", "")))
+        except ValueError as exc:
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim observed_as_of is invalid"
+            ) from exc
+        source_hashes = claim.get("source_hashes")
+        if (
+            not isinstance(source_hashes, list)
+            or not source_hashes
+            or any(
+                not isinstance(item, str)
+                or not SHA256_PATTERN.fullmatch(item)
+                for item in source_hashes
+            )
+        ):
+            raise MaturityStandardError(
+                f"{control['id']} evidence claim requires source_hashes"
+            )
+        if trusted_verifier is None:
+            raise MaturityStandardError(
+                f"{control['id']} requires a trusted evidence verifier"
+            )
+        decision = _normalize_verification_decision(
+            trusted_verifier(claim, control, source),
+            control_id=str(control["id"]),
+        )
+        verified.append(
+            {
+                "path": path,
+                "tier": tier,
+                "sha256": digest,
+                "claim_id": str(claim["claim_id"]),
+                "evidence_type": str(claim["evidence_type"]),
+                "authority_class": str(claim["authority_class"]),
+                "observed_as_of": str(claim["observed_as_of"]),
+                "verification": decision,
+            }
+        )
+    return verified
+
+
+def _known_nonnegative_int(value: Any) -> bool:
+    return (
+        not isinstance(value, bool)
+        and isinstance(value, int)
+        and value >= 0
+    )
+
+
+def _assessment_subject(assessment: Mapping[str, Any]) -> Dict[str, Any]:
+    raw = assessment.get("subject")
+    if not isinstance(raw, dict):
+        raise MaturityStandardError("assessment subject must be an object")
+    expected = {
+        "candidate_id",
+        "release_sha256",
+        "model_sha256",
+        "dataset_sha256",
+        "account_scope_id",
+        "material_change_epoch",
+    }
+    if set(raw) != expected:
+        raise MaturityStandardError(
+            "assessment subject fields must exactly match the standard identity"
+        )
+    candidate_id = raw.get("candidate_id")
+    if not isinstance(candidate_id, str) or not candidate_id:
+        raise MaturityStandardError("assessment subject candidate_id is required")
+    for field in ("release_sha256", "model_sha256", "dataset_sha256"):
+        value = raw.get(field)
+        if value is not None and (
+            not isinstance(value, str) or not SHA256_PATTERN.fullmatch(value)
+        ):
+            raise MaturityStandardError(
+                f"assessment subject {field} must be null or sha256"
+            )
+    account_scope_id = raw.get("account_scope_id")
+    if account_scope_id is not None and (
+        not isinstance(account_scope_id, str) or not account_scope_id
+    ):
+        raise MaturityStandardError(
+            "assessment subject account_scope_id must be null or pseudonymous id"
+        )
+    epoch = raw.get("material_change_epoch")
+    if epoch is not None:
+        _as_int(epoch, label="assessment subject material_change_epoch")
+    return dict(raw)
+
+
+def _subject_is_frozen(subject: Mapping[str, Any]) -> bool:
+    return (
+        subject.get("candidate_id") != "UNASSIGNED"
+        and all(
+            isinstance(subject.get(field), str)
+            and SHA256_PATTERN.fullmatch(str(subject[field]))
+            for field in ("release_sha256", "model_sha256", "dataset_sha256")
+        )
+        and isinstance(subject.get("account_scope_id"), str)
+        and bool(subject.get("account_scope_id"))
+        and _known_nonnegative_int(subject.get("material_change_epoch"))
+    )
+
+
+def _pre_canary_projection_digest(
+    assessment: Mapping[str, Any],
+) -> str:
+    payload = {
+        "schema_version": assessment.get("schema_version"),
+        "standard_id": assessment.get("standard_id"),
+        "standard_canonical_sha256": assessment.get(
+            "standard_canonical_sha256"
+        ),
+        "subject": deepcopy(assessment.get("subject")),
+        "baseline_60": deepcopy(assessment.get("baseline_60")),
+        "observations": deepcopy(assessment.get("observations")),
+        "controls": [],
+    }
+    observations = payload["observations"]
+    if isinstance(observations, dict):
+        observations["canary_trading_days"] = 0
+    raw_controls = assessment.get("controls")
+    if not isinstance(raw_controls, list):
+        raise MaturityStandardError(
+            "assessment controls must exist for pre-canary projection"
+        )
+    for raw in raw_controls:
+        if not isinstance(raw, dict):
+            raise MaturityStandardError(
+                "assessment control is invalid in pre-canary projection"
+            )
+        projected = {
+            "id": raw.get("id"),
+            "status": raw.get("status"),
+            "evidence": deepcopy(raw.get("evidence", [])),
+        }
+        if raw.get("id") == "D6-CANARY":
+            projected["status"] = "not_passed"
+            projected["evidence"] = []
+        payload["controls"].append(projected)
+    payload["controls"] = sorted(
+        payload["controls"], key=lambda item: str(item["id"])
+    )
+    return _canonical_sha256(payload)
+
+
+def _final_assessment_digest(assessment: Mapping[str, Any]) -> str:
+    payload = deepcopy(dict(assessment))
+    payload.pop("qualification_attestation", None)
+    return _canonical_sha256(payload)
+
+
+def _verify_assessment_attestation(
+    *,
+    assessment: Mapping[str, Any],
+    field: str,
+    control_id: str,
+    evidence_type: str,
+    minimum_evidence_tier: str,
+    expected_assessment_sha256: str,
+    tier_ranks: Mapping[str, int],
+    repository_root: Path | None,
+    subject: Mapping[str, Any],
+    standard_id: str,
+    standard_canonical_sha256: str,
+    trusted_verifier: TrustedEvidenceVerifier | None,
+) -> Dict[str, Any] | None:
+    attestation = assessment.get(field)
+    if attestation is None:
+        return None
+    verified = _verify_evidence(
+        [attestation],
+        control={
+            "id": control_id,
+            "minimum_evidence_tier": minimum_evidence_tier,
+        },
+        tier_ranks=tier_ranks,
+        repository_root=repository_root,
+        subject=subject,
+        standard_id=standard_id,
+        standard_canonical_sha256=standard_canonical_sha256,
+        trusted_verifier=trusted_verifier,
+    )
+    if repository_root is None:
+        raise MaturityStandardError(
+            f"{control_id} attestation requires repository_root"
+        )
+    claim_path = repository_root / verified[0]["path"]
+    claim = json.loads(claim_path.read_text(encoding="utf-8"))
+    if (
+        claim.get("evidence_type") != evidence_type
+        or claim.get("assessment_sha256")
+        != expected_assessment_sha256
+    ):
+        raise MaturityStandardError(
+            f"{control_id} attestation does not bind this assessment"
+        )
+    return {
+        **verified[0],
+        "claim": claim,
+    }
+
+
+def _verify_baseline_prerequisite(
+    *,
+    standard: Mapping[str, Any],
+    assessment: Mapping[str, Any],
+    tier_ranks: Mapping[str, int],
+    repository_root: Path | None,
+    subject: Mapping[str, Any],
+    standard_canonical_sha256: str,
+    trusted_verifier: TrustedEvidenceVerifier | None,
+) -> Tuple[bool, Dict[str, Any] | None, str]:
+    baseline = assessment.get("baseline_60")
+    if not isinstance(baseline, dict):
+        raise MaturityStandardError(
+            "assessment baseline_60 must be an object"
+        )
+    policy = standard["baseline_prerequisite"]
+    if repository_root is None:
+        raise MaturityStandardError(
+            "baseline prerequisite requires repository_root"
+        )
+    profile_path = repository_root / _safe_relative_path(
+        policy["profile_path"],
+        label="baseline_prerequisite.profile_path",
+    )
+    profile = load_json_object(profile_path)
+    profile_sha256 = _canonical_sha256(profile)
+    if (
+        profile.get("profile_id") != policy["profile_id"]
+        or profile.get("all_gates_required") is not True
+        or profile.get("trusted_verification_required") is not True
+        or profile.get("capital_authority") != "NONE"
+    ):
+        raise MaturityStandardError(
+            "baseline profile does not satisfy the production prerequisite"
+        )
+    if (
+        baseline.get("profile_id") != policy["profile_id"]
+        or baseline.get("profile_canonical_sha256") != profile_sha256
+    ):
+        raise MaturityStandardError(
+            "assessment baseline profile binding mismatch"
+        )
+    required_gates = int(standard["qualification"]["baseline_60_gates"])
+    declared_pass = (
+        baseline.get("all_gates_passed") is True
+        and baseline.get("gates_passed") == required_gates
+        and baseline.get("gates_total") == required_gates
+    )
+    verification = baseline.get("verification")
+    if not declared_pass:
+        if verification is not None:
+            raise MaturityStandardError(
+                "negative baseline assessment cannot carry a positive "
+                "verification"
+            )
+        return False, None, profile_sha256
+    verified = _verify_evidence(
+        [verification],
+        control={
+            "id": policy["claim_control_id"],
+            "minimum_evidence_tier": policy["minimum_evidence_tier"],
+        },
+        tier_ranks=tier_ranks,
+        repository_root=repository_root,
+        subject=subject,
+        standard_id=str(standard["standard_id"]),
+        standard_canonical_sha256=standard_canonical_sha256,
+        trusted_verifier=trusted_verifier,
+    )[0]
+    claim = load_json_object(repository_root / verified["path"])
+    if (
+        claim.get("evidence_type") != policy["claim_evidence_type"]
+        or claim.get("baseline_profile_id") != policy["profile_id"]
+        or claim.get("baseline_profile_canonical_sha256")
+        != profile_sha256
+        or claim.get("gates_passed") != required_gates
+        or claim.get("gates_total") != required_gates
+        or not isinstance(claim.get("score"), (int, float))
+        or isinstance(claim.get("score"), bool)
+        or float(claim["score"]) < float(profile.get("minimum_score", 60))
+    ):
+        raise MaturityStandardError(
+            "baseline qualification attestation is incomplete"
+        )
+    return True, {**verified, "claim": claim}, profile_sha256
+
+
+def _positive_number(value: Any) -> bool:
+    return (
+        not isinstance(value, bool)
+        and isinstance(value, (int, float))
+        and math.isfinite(float(value))
+        and float(value) > 0
+    )
+
+
+def _nonnegative_number(value: Any) -> bool:
+    return (
+        not isinstance(value, bool)
+        and isinstance(value, (int, float))
+        and math.isfinite(float(value))
+        and float(value) >= 0
+    )
+
+
+def _validate_pre_canary_authorization(
+    record: Mapping[str, Any],
+    *,
+    standard: Mapping[str, Any],
+    subject: Mapping[str, Any],
+    assessed_as_of: date,
+) -> Dict[str, Any]:
+    claim = record["claim"]
+    policy = standard["attestation_policy"]["pre_canary"]
+    missing = [
+        field
+        for field in policy["required_authorization_fields"]
+        if field not in claim
+    ]
+    if missing:
+        raise MaturityStandardError(
+            f"pre-canary authorization is missing fields: {missing}"
+        )
+    if (
+        claim.get("authorization_id") != claim.get("claim_id")
+        or claim.get("account_scope_id") != subject.get("account_scope_id")
+        or claim.get("no_automatic_scale_up") is not True
+    ):
+        raise MaturityStandardError(
+            "pre-canary authorization identity or scale-up policy is invalid"
+        )
+    try:
+        authorized_at = date.fromisoformat(str(claim["authorized_at"]))
+        expires_on = date.fromisoformat(str(claim["expires_on"]))
+        observed_as_of = date.fromisoformat(
+            str(claim["observed_as_of"])
+        )
+    except ValueError as exc:
+        raise MaturityStandardError(
+            "pre-canary authorization dates are invalid"
+        ) from exc
+    if authorized_at != observed_as_of or expires_on <= authorized_at:
+        raise MaturityStandardError(
+            "pre-canary authorization chronology is invalid"
+        )
+    if assessed_as_of < authorized_at:
+        validity_status = "not_yet_effective"
+    elif assessed_as_of > expires_on:
+        validity_status = "expired"
+    else:
+        validity_status = "valid"
+    strategy_ids = claim.get("strategy_ids")
+    if (
+        not isinstance(strategy_ids, list)
+        or not strategy_ids
+        or any(not isinstance(item, str) or not item for item in strategy_ids)
+        or subject.get("candidate_id") not in strategy_ids
+    ):
+        raise MaturityStandardError(
+            "pre-canary authorization strategy_ids are invalid"
+        )
+    maximum_capital = claim.get("maximum_capital_cny")
+    maximum_gross = claim.get("maximum_gross_notional_cny")
+    if (
+        not _positive_number(maximum_capital)
+        or not _positive_number(maximum_gross)
+        or float(maximum_gross) > float(maximum_capital)
+    ):
+        raise MaturityStandardError(
+            "pre-canary capital caps are invalid"
+        )
+    maximum_symbols = claim.get("maximum_symbols")
+    symbol_allowlist = claim.get("symbol_allowlist")
+    if (
+        not _known_nonnegative_int(maximum_symbols)
+        or maximum_symbols < 1
+        or not isinstance(symbol_allowlist, list)
+        or not symbol_allowlist
+        or len(symbol_allowlist) > maximum_symbols
+        or any(
+            not isinstance(symbol, str) or not symbol
+            for symbol in symbol_allowlist
+        )
+    ):
+        raise MaturityStandardError(
+            "pre-canary symbol caps are invalid"
+        )
+    authorization_flow = claim.get("flow_limits")
+    default_flow = standard["operating_defaults"]["flow_limits"]
+    if not isinstance(authorization_flow, dict):
+        raise MaturityStandardError(
+            "pre-canary flow_limits must be an object"
+        )
+    for field in (
+        "maximum_submission_and_cancel_requests_per_second",
+        "maximum_submission_and_cancel_requests_per_day",
+    ):
+        value = authorization_flow.get(field)
+        if (
+            not _known_nonnegative_int(value)
+            or value < 1
+            or value > int(default_flow[field])
+        ):
+            raise MaturityStandardError(
+                f"pre-canary flow limit {field} exceeds policy"
+            )
+    stop_conditions = claim.get("stop_conditions")
+    required_stops = set(policy["required_stop_conditions"])
+    if (
+        not isinstance(stop_conditions, list)
+        or not required_stops.issubset(set(stop_conditions))
+    ):
+        raise MaturityStandardError(
+            "pre-canary authorization lacks mandatory stop conditions"
+        )
+    return {
+        "authorization_id": str(claim["authorization_id"]),
+        "claim_id": str(claim["claim_id"]),
+        "claim_sha256": str(record["sha256"]),
+        "authorized_at": authorized_at.isoformat(),
+        "expires_on": expires_on.isoformat(),
+        "valid_as_of": assessed_as_of.isoformat(),
+        "valid_as_of_assessment": validity_status == "valid",
+        "validity_status": validity_status,
+        "trust_environment": record["verification"][
+            "trust_environment"
+        ],
+        "verifier_id": record["verification"]["verifier_id"],
+        "issuer_id": record["verification"]["issuer_id"],
+        "policy_version": record["verification"]["policy_version"],
+    }
+
+
+def _verify_canary_authorization_chain(
+    *,
+    assessment: Mapping[str, Any],
+    canary_evidence: Sequence[Mapping[str, Any]],
+    pre_canary_record: Mapping[str, Any],
+    pre_canary_metadata: Mapping[str, Any],
+    standard: Mapping[str, Any],
+    repository_root: Path | None,
+) -> Dict[str, Any] | None:
+    canary_control = next(
+        item
+        for item in assessment["controls"]
+        if item.get("id") == "D6-CANARY"
+    )
+    if canary_control.get("status") != "passed":
+        return None
+    if repository_root is None:
+        raise MaturityStandardError(
+            "canary authorization chain requires repository_root"
+        )
+    policy = standard["attestation_policy"]["canary_observation"]
+    matching: List[Tuple[Mapping[str, Any], Mapping[str, Any]]] = []
+    for evidence in canary_evidence:
+        claim = load_json_object(repository_root / evidence["path"])
+        if claim.get("evidence_type") == policy["evidence_type"]:
+            matching.append((evidence, claim))
+    if not matching:
+        raise MaturityStandardError(
+            "D6-CANARY requires a controlled-live canary claim"
+        )
+    observations = assessment["observations"]
+    observed_days = observations.get("canary_trading_days")
+    minimum_days = standard["qualification"][
+        "minimum_canary_trading_days"
+    ]
+    for evidence, claim in matching:
+        missing = [
+            field
+            for field in (
+                policy["required_link_fields"]
+                + policy["required_observation_fields"]
+            )
+            if field not in claim
+        ]
+        if missing:
+            raise MaturityStandardError(
+                f"canary claim is missing authorization links: {missing}"
+            )
+        if (
+            claim.get("pre_canary_authorization_claim_id")
+            != pre_canary_record["claim_id"]
+            or claim.get("pre_canary_authorization_sha256")
+            != pre_canary_record["sha256"]
+        ):
+            raise MaturityStandardError(
+                "canary claim does not reference the verified authorization"
+            )
+        try:
+            started = date.fromisoformat(str(claim["canary_started_on"]))
+            ended = date.fromisoformat(str(claim["canary_ended_on"]))
+            authorized = date.fromisoformat(
+                str(pre_canary_metadata["authorized_at"])
+            )
+            expires = date.fromisoformat(
+                str(pre_canary_metadata["expires_on"])
+            )
+        except ValueError as exc:
+            raise MaturityStandardError(
+                "canary observation dates are invalid"
+            ) from exc
+        if not authorized < started <= ended <= expires:
+            raise MaturityStandardError(
+                "canary observation is outside the authorization window"
+            )
+        claim_days = claim.get("trading_days_observed")
+        if (
+            not _known_nonnegative_int(claim_days)
+            or claim_days < minimum_days
+            or claim_days != observed_days
+        ):
+            raise MaturityStandardError(
+                "canary observation day count is invalid"
+            )
+        authorization_claim = pre_canary_record["claim"]
+        capital_observed = claim.get("maximum_capital_cny_observed")
+        gross_observed = claim.get(
+            "maximum_gross_notional_cny_observed"
+        )
+        if (
+            not _nonnegative_number(capital_observed)
+            or not _nonnegative_number(gross_observed)
+            or float(capital_observed)
+            > float(authorization_claim["maximum_capital_cny"])
+            or float(gross_observed)
+            > float(authorization_claim["maximum_gross_notional_cny"])
+        ):
+            raise MaturityStandardError(
+                "canary observation exceeds authorized capital caps"
+            )
+        symbols_observed = claim.get("symbols_observed")
+        symbol_allowlist = authorization_claim["symbol_allowlist"]
+        if (
+            not isinstance(symbols_observed, list)
+            or any(
+                not isinstance(symbol, str) or not symbol
+                for symbol in symbols_observed
+            )
+            or len(set(symbols_observed)) != len(symbols_observed)
+            or len(symbols_observed)
+            > int(authorization_claim["maximum_symbols"])
+            or not set(symbols_observed).issubset(set(symbol_allowlist))
+        ):
+            raise MaturityStandardError(
+                "canary observation exceeds authorized symbol caps"
+            )
+        authorization_flow = authorization_claim["flow_limits"]
+        for field in (
+            "maximum_submission_and_cancel_requests_per_second",
+            "maximum_submission_and_cancel_requests_per_day",
+        ):
+            observed_field = f"{field}_observed"
+            observed_value = claim.get(observed_field)
+            if (
+                not _known_nonnegative_int(observed_value)
+                or observed_value > int(authorization_flow[field])
+            ):
+                raise MaturityStandardError(
+                    "canary observation exceeds authorized flow caps"
+                )
+        if claim.get("automatic_scale_up_observed") is not False:
+            raise MaturityStandardError(
+                "canary observation reports automatic scale-up"
+            )
+        breach_events = claim.get("breach_events")
+        stop_events = claim.get("stop_events")
+        if not isinstance(breach_events, list) or not isinstance(
+            stop_events, list
+        ):
+            raise MaturityStandardError(
+                "canary breach and stop events must be arrays"
+            )
+        stop_index: Dict[str, Dict[str, Any]] = {}
+        authorized_stop_conditions = set(
+            authorization_claim["stop_conditions"]
+        )
+        for event in stop_events:
+            if not isinstance(event, dict):
+                raise MaturityStandardError(
+                    "canary stop event must be an object"
+                )
+            stop_event_id = event.get("stop_event_id")
+            condition = event.get("condition")
+            if (
+                not isinstance(stop_event_id, str)
+                or not stop_event_id
+                or stop_event_id in stop_index
+                or condition not in authorized_stop_conditions
+                or event.get("trading_stopped") is not True
+                or event.get("automatic_resume") is not False
+            ):
+                raise MaturityStandardError(
+                    "canary stop event is invalid"
+                )
+            try:
+                triggered_on = date.fromisoformat(
+                    str(event.get("triggered_on", ""))
+                )
+            except ValueError as exc:
+                raise MaturityStandardError(
+                    "canary stop event date is invalid"
+                ) from exc
+            if not started <= triggered_on <= ended:
+                raise MaturityStandardError(
+                    "canary stop event is outside the observation window"
+                )
+            stop_index[stop_event_id] = {
+                **event,
+                "triggered_on_date": triggered_on,
+            }
+        breach_ids: set[str] = set()
+        for event in breach_events:
+            if not isinstance(event, dict):
+                raise MaturityStandardError(
+                    "canary breach event must be an object"
+                )
+            breach_id = event.get("breach_id")
+            condition = event.get("condition")
+            stop_event_id = event.get("stop_event_id")
+            if (
+                not isinstance(breach_id, str)
+                or not breach_id
+                or breach_id in breach_ids
+                or condition
+                != "any_risk_data_rule_or_reconciliation_breach"
+                or not isinstance(stop_event_id, str)
+                or stop_event_id not in stop_index
+                or stop_index[stop_event_id]["condition"] != condition
+            ):
+                raise MaturityStandardError(
+                    "canary breach is not linked to an authorized stop"
+                )
+            try:
+                observed_on = date.fromisoformat(
+                    str(event.get("observed_on", ""))
+                )
+            except ValueError as exc:
+                raise MaturityStandardError(
+                    "canary breach event date is invalid"
+                ) from exc
+            if (
+                not started <= observed_on <= ended
+                or stop_index[stop_event_id]["triggered_on_date"]
+                < observed_on
+            ):
+                raise MaturityStandardError(
+                    "canary breach/stop chronology is invalid"
+                )
+            breach_ids.add(breach_id)
+        return {
+            "claim_id": str(claim["claim_id"]),
+            "claim_sha256": str(evidence["sha256"]),
+            "started_on": started.isoformat(),
+            "ended_on": ended.isoformat(),
+            "trading_days_observed": int(claim_days),
+            "maximum_capital_cny_observed": float(capital_observed),
+            "maximum_gross_notional_cny_observed": float(
+                gross_observed
+            ),
+            "symbols_observed": list(symbols_observed),
+            "maximum_submission_and_cancel_requests_per_second_observed": (
+                int(
+                    claim[
+                        "maximum_submission_and_cancel_requests_per_second_observed"
+                    ]
+                )
+            ),
+            "maximum_submission_and_cancel_requests_per_day_observed": (
+                int(
+                    claim[
+                        "maximum_submission_and_cancel_requests_per_day_observed"
+                    ]
+                )
+            ),
+            "breach_event_count": len(breach_events),
+            "stop_event_count": len(stop_events),
+            "pre_canary_authorization_claim_id": str(
+                pre_canary_record["claim_id"]
+            ),
+        }
+    return None
+
+
+def evaluate_assessment(
+    standard: Mapping[str, Any],
+    assessment: Mapping[str, Any],
+    *,
+    repository_root: str | Path | None = None,
+    trusted_evidence_verifier: TrustedEvidenceVerifier | None = None,
+) -> Dict[str, Any]:
+    """Evaluate an assessment without turning partial evidence into a pass."""
+
+    summary = validate_standard(standard)
+    if str(assessment.get("schema_version")) != "1.0":
+        raise MaturityStandardError("unsupported maturity assessment schema_version")
+    if str(assessment.get("standard_id")) != summary["standard_id"]:
+        raise MaturityStandardError("assessment standard_id does not match profile")
+    try:
+        assessed_as_of = date.fromisoformat(
+            str(assessment.get("assessed_as_of", ""))
+        )
+    except ValueError as exc:
+        raise MaturityStandardError(
+            "assessment assessed_as_of must be an ISO date"
+        ) from exc
+    standard_canonical_sha256 = summary[
+        "standard_canonical_sha256"
+    ]
+    if (
+        assessment.get("standard_canonical_sha256")
+        != standard_canonical_sha256
+    ):
+        raise MaturityStandardError(
+            "assessment standard canonical hash does not match profile"
+        )
+    subject = _assessment_subject(assessment)
+    domains, controls = _standard_index(standard)
+    raw_assessments = assessment.get("controls")
+    if not isinstance(raw_assessments, list):
+        raise MaturityStandardError("assessment controls must be an array")
+    assessed: Dict[str, Dict[str, Any]] = {}
+    for raw in raw_assessments:
+        if not isinstance(raw, dict):
+            raise MaturityStandardError("every assessed control must be an object")
+        control_id = str(raw.get("id", ""))
+        if not control_id or control_id in assessed:
+            raise MaturityStandardError(
+                f"duplicate or empty assessed control id: {control_id!r}"
+            )
+        status = str(raw.get("status", ""))
+        if status not in CONTROL_STATUSES:
+            raise MaturityStandardError(
+                f"{control_id} has unsupported status {status!r}"
+            )
+        assessed[control_id] = dict(raw)
+    if set(assessed) != set(controls):
+        missing = sorted(set(controls) - set(assessed))
+        extra = sorted(set(assessed) - set(controls))
+        raise MaturityStandardError(
+            f"assessment control set mismatch; missing={missing}, extra={extra}"
+        )
+
+    tiers = {
+        name: int(raw["rank"])
+        for name, raw in standard["evidence_tiers"].items()
+    }
+    root = Path(repository_root).resolve() if repository_root is not None else None
+    score = 0
+    hard_failures: List[str] = []
+    evaluated_controls: List[Dict[str, Any]] = []
+    verification_environments: set[str] = set()
+    domain_scores = {domain_id: 0 for domain_id in domains}
+    for control_id, control in controls.items():
+        result = assessed[control_id]
+        passed = result["status"] == "passed"
+        verified_evidence: List[Dict[str, Any]] = []
+        if passed:
+            verified_evidence = _verify_evidence(
+                result.get("evidence", []),
+                control=control,
+                tier_ranks=tiers,
+                repository_root=root,
+                subject=subject,
+                standard_id=summary["standard_id"],
+                standard_canonical_sha256=standard_canonical_sha256,
+                trusted_verifier=trusted_evidence_verifier,
+            )
+            verification_environments.update(
+                item["verification"]["trust_environment"]
+                for item in verified_evidence
+            )
+            weight = int(control["weight"])
+            score += weight
+            domain_scores[str(control["domain_id"])] += weight
+        elif bool(control["hard_gate"]):
+            hard_failures.append(control_id)
+        evaluated_controls.append(
+            {
+                "id": control_id,
+                "domain_id": str(control["domain_id"]),
+                "name": str(control["name"]),
+                "weight": int(control["weight"]),
+                "hard_gate": bool(control["hard_gate"]),
+                "status": str(result["status"]),
+                "minimum_evidence_tier": str(control["minimum_evidence_tier"]),
+                "evidence": verified_evidence,
+                "note": str(result.get("note", "")),
+            }
+        )
+
+    qualification = standard["qualification"]
+    observations = assessment.get("observations")
+    if not isinstance(observations, dict):
+        raise MaturityStandardError(
+            "assessment observations must be an object"
+        )
+    (
+        baseline_passed,
+        baseline_attestation,
+        baseline_profile_sha256,
+    ) = _verify_baseline_prerequisite(
+        standard=standard,
+        assessment=assessment,
+        tier_ranks=tiers,
+        repository_root=root,
+        subject=subject,
+        standard_canonical_sha256=standard_canonical_sha256,
+        trusted_verifier=trusted_evidence_verifier,
+    )
+    if baseline_attestation is not None:
+        verification_environments.add(
+            baseline_attestation["verification"]["trust_environment"]
+        )
+    shadow_days = observations.get("shadow_trading_days")
+    canary_days = observations.get("canary_trading_days")
+    open_p0 = observations.get("open_p0")
+    open_p1 = observations.get("open_p1")
+    prerequisite_results = {
+        "baseline_60_all_gates": baseline_passed,
+        "real_qmt_observed": observations.get("real_qmt_observed") is True,
+        "broker_programmatic_confirmation": (
+            observations.get("broker_programmatic_confirmation") is True
+        ),
+        "shadow_trading_days": (
+            _known_nonnegative_int(shadow_days)
+            and shadow_days >= qualification["minimum_shadow_trading_days"]
+        ),
+        "canary_trading_days": (
+            _known_nonnegative_int(canary_days)
+            and canary_days >= qualification["minimum_canary_trading_days"]
+        ),
+        "open_p0_within_limit": (
+            _known_nonnegative_int(open_p0)
+            and open_p0 <= qualification["maximum_open_p0"]
+        ),
+        "open_p1_within_limit": (
+            _known_nonnegative_int(open_p1)
+            and open_p1 <= qualification["maximum_open_p1"]
+        ),
+    }
+    domain_results: List[Dict[str, Any]] = []
+    domain_floor_failures: List[str] = []
+    for domain_id, domain in domains.items():
+        minimum = math.ceil(
+            int(domain["weight"]) * float(domain["minimum_score_ratio"])
+        )
+        actual = domain_scores[domain_id]
+        floor_passed = actual >= minimum
+        if not floor_passed:
+            domain_floor_failures.append(domain_id)
+        domain_results.append(
+            {
+                "id": domain_id,
+                "name": str(domain["name"]),
+                "score": actual,
+                "weight": int(domain["weight"]),
+                "minimum_score": minimum,
+                "floor_passed": floor_passed,
+            }
+        )
+
+    effective_score = score
+    caps: List[Dict[str, Any]] = []
+    if not baseline_passed:
+        cap = int(qualification["score_cap_without_baseline_60"])
+        effective_score = min(effective_score, cap)
+        caps.append({"reason": "baseline_60_not_passed", "maximum": cap})
+    if not prerequisite_results["canary_trading_days"]:
+        cap = int(qualification["score_cap_without_canary"])
+        effective_score = min(effective_score, cap)
+        caps.append({"reason": "canary_not_observed", "maximum": cap})
+
+    base_full_structurally_eligible = (
+        effective_score >= int(standard["qualification_threshold"])
+        and not hard_failures
+        and not domain_floor_failures
+        and all(prerequisite_results.values())
+        and _subject_is_frozen(subject)
+    )
+    pre_canary_exemptions = set(
+        qualification["pre_canary_exempt_hard_gates"]
+    )
+    pre_canary_prerequisites = {
+        key: value
+        for key, value in prerequisite_results.items()
+        if key != "canary_trading_days"
+    }
+    pre_canary_structurally_eligible = (
+        score >= int(qualification["pre_canary_threshold"])
+        and set(hard_failures) == pre_canary_exemptions
+        and not domain_floor_failures
+        and all(pre_canary_prerequisites.values())
+        and _subject_is_frozen(subject)
+    )
+    attestation_policy = standard["attestation_policy"]
+    pre_canary_record: Dict[str, Any] | None = None
+    pre_canary_metadata: Dict[str, Any] | None = None
+    if (
+        pre_canary_structurally_eligible
+        or base_full_structurally_eligible
+    ):
+        pre_policy = attestation_policy["pre_canary"]
+        pre_canary_record = _verify_assessment_attestation(
+            assessment=assessment,
+            field="pre_canary_attestation",
+            control_id=pre_policy["control_id"],
+            evidence_type=pre_policy["evidence_type"],
+            minimum_evidence_tier=pre_policy[
+                "minimum_evidence_tier"
+            ],
+            expected_assessment_sha256=(
+                _pre_canary_projection_digest(assessment)
+            ),
+            tier_ranks=tiers,
+            repository_root=root,
+            subject=subject,
+            standard_id=summary["standard_id"],
+            standard_canonical_sha256=standard_canonical_sha256,
+            trusted_verifier=trusted_evidence_verifier,
+        )
+        if pre_canary_record is not None:
+            verification_environments.add(
+                pre_canary_record["verification"]["trust_environment"]
+            )
+            pre_canary_metadata = _validate_pre_canary_authorization(
+                pre_canary_record,
+                standard=standard,
+                subject=subject,
+                assessed_as_of=assessed_as_of,
+            )
+
+    canary_evidence = next(
+        control["evidence"]
+        for control in evaluated_controls
+        if control["id"] == "D6-CANARY"
+    )
+    canary_chain: Dict[str, Any] | None = None
+    if (
+        base_full_structurally_eligible
+        and pre_canary_record is not None
+        and pre_canary_metadata is not None
+    ):
+        canary_chain = _verify_canary_authorization_chain(
+            assessment=assessment,
+            canary_evidence=canary_evidence,
+            pre_canary_record=pre_canary_record,
+            pre_canary_metadata=pre_canary_metadata,
+            standard=standard,
+            repository_root=root,
+        )
+    full_structurally_eligible = (
+        base_full_structurally_eligible
+        and canary_chain is not None
+    )
+
+    final_attestation_record: Dict[str, Any] | None = None
+    if full_structurally_eligible:
+        promotion_policy = attestation_policy["promotion"]
+        final_attestation_record = _verify_assessment_attestation(
+            assessment=assessment,
+            field="qualification_attestation",
+            control_id=promotion_policy["control_id"],
+            evidence_type=promotion_policy["evidence_type"],
+            minimum_evidence_tier=promotion_policy[
+                "minimum_evidence_tier"
+            ],
+            expected_assessment_sha256=_final_assessment_digest(
+                assessment
+            ),
+            tier_ranks=tiers,
+            repository_root=root,
+            subject=subject,
+            standard_id=summary["standard_id"],
+            standard_canonical_sha256=standard_canonical_sha256,
+            trusted_verifier=trusted_evidence_verifier,
+        )
+        if final_attestation_record is not None:
+            verification_environments.add(
+                final_attestation_record["verification"][
+                    "trust_environment"
+                ]
+            )
+
+    if len(verification_environments) > 1:
+        raise MaturityStandardError(
+            "assessment mixes test and production verification decisions"
+        )
+    verification_environment = (
+        next(iter(verification_environments))
+        if verification_environments
+        else "none"
+    )
+    pre_canary_attestation_verified = pre_canary_record is not None
+    final_attestation_verified = final_attestation_record is not None
+    pre_canary_valid_as_of_assessment = (
+        pre_canary_metadata is not None
+        and pre_canary_metadata["valid_as_of_assessment"] is True
+    )
+    production_trust_verified = (
+        verification_environment == "production"
+        and PRODUCTION_TRUST_REGISTRY_AVAILABLE
+    )
+    trusted_attestation_verified = (
+        final_attestation_verified and production_trust_verified
+    )
+    pre_canary_authorized = (
+        pre_canary_attestation_verified
+        and production_trust_verified
+        and (
+            pre_canary_structurally_eligible
+            or base_full_structurally_eligible
+        )
+    )
+    qualified = (
+        full_structurally_eligible
+        and trusted_attestation_verified
+        and pre_canary_authorized
+    )
+    canary_days_value = observations.get("canary_trading_days")
+    canary_running = (
+        pre_canary_authorized
+        and pre_canary_valid_as_of_assessment
+        and pre_canary_structurally_eligible
+        and _known_nonnegative_int(canary_days_value)
+        and 0 < canary_days_value
+        < qualification["minimum_canary_trading_days"]
+    )
+    if qualified:
+        qualification_state = "LIMITED_LIVE_VERIFIED"
+    elif (
+        full_structurally_eligible
+        and final_attestation_verified
+        and verification_environment == "test"
+    ):
+        qualification_state = "TEST_ONLY_STRUCTURAL_PASS"
+    elif full_structurally_eligible:
+        qualification_state = "PENDING_PRODUCTION_ATTESTATION"
+    elif base_full_structurally_eligible:
+        qualification_state = "PENDING_PRE_CANARY_HISTORY"
+    elif canary_running:
+        qualification_state = "CANARY_RUNNING"
+    elif pre_canary_authorized and pre_canary_valid_as_of_assessment:
+        qualification_state = "PRE_CANARY_AUTHORIZED"
+    elif (
+        pre_canary_authorized
+        and pre_canary_structurally_eligible
+        and pre_canary_metadata is not None
+        and pre_canary_metadata["validity_status"] == "expired"
+    ):
+        qualification_state = "PRE_CANARY_AUTHORIZATION_EXPIRED"
+    elif (
+        pre_canary_structurally_eligible
+        and pre_canary_attestation_verified
+        and pre_canary_metadata is not None
+        and pre_canary_metadata["validity_status"] == "expired"
+        and verification_environment == "test"
+    ):
+        qualification_state = "TEST_ONLY_PRE_CANARY_EXPIRED"
+    elif (
+        pre_canary_structurally_eligible
+        and pre_canary_attestation_verified
+        and verification_environment == "test"
+    ):
+        qualification_state = "TEST_ONLY_PRE_CANARY_PASS"
+    elif pre_canary_structurally_eligible:
+        qualification_state = "PENDING_PRE_CANARY_ATTESTATION"
+    else:
+        qualification_state = "BLOCKED_FROM_LIMITED_LIVE"
+    return {
+        "ok": True,
+        "standard_id": summary["standard_id"],
+        "standard_canonical_sha256": standard_canonical_sha256,
+        "baseline_profile_canonical_sha256": (
+            baseline_profile_sha256
+        ),
+        "assessed_as_of": str(assessment.get("assessed_as_of", "")),
+        "raw_score": score,
+        "effective_score": effective_score,
+        "maximum_score": int(standard["maximum_score"]),
+        "qualification_threshold": int(standard["qualification_threshold"]),
+        "qualified": qualified,
+        "qualification_state": qualification_state,
+        "structurally_eligible": full_structurally_eligible,
+        "trusted_attestation_verified": trusted_attestation_verified,
+        "final_attestation_verified": final_attestation_verified,
+        "production_trust_registry_available": (
+            PRODUCTION_TRUST_REGISTRY_AVAILABLE
+        ),
+        "verification_environment": verification_environment,
+        "test_only": verification_environment == "test",
+        "pre_canary_structurally_eligible": (
+            pre_canary_structurally_eligible
+        ),
+        "pre_canary_attestation_verified": (
+            pre_canary_attestation_verified
+        ),
+        "pre_canary_authorized": pre_canary_authorized,
+        "pre_canary_authorization": pre_canary_metadata,
+        "pre_canary_authorization_valid_as_of_assessment": (
+            pre_canary_valid_as_of_assessment
+        ),
+        "canary_authorization_chain_verified": (
+            canary_chain is not None
+        ),
+        "canary_observation": canary_chain,
+        "canary_running": canary_running,
+        "subject": subject,
+        "baseline_60_passed": baseline_passed,
+        "baseline_60_attestation_verified": (
+            baseline_attestation is not None
+        ),
+        "hard_gate_failures": sorted(hard_failures),
+        "domain_floor_failures": sorted(domain_floor_failures),
+        "prerequisites": prerequisite_results,
+        "score_caps": caps,
+        "domains": domain_results,
+        "controls": evaluated_controls,
+    }
diff --git a/src/quant_os/execution/__init__.py b/src/quant_os/execution/__init__.py
new file mode 100644
index 0000000..7525d60
--- /dev/null
+++ b/src/quant_os/execution/__init__.py
@@ -0,0 +1 @@
+"""Execution intents, OMS state, reconciliation and fail-closed kill switches."""
diff --git a/src/quant_os/foundation/__init__.py b/src/quant_os/foundation/__init__.py
new file mode 100644
index 0000000..0b51ebd
--- /dev/null
+++ b/src/quant_os/foundation/__init__.py
@@ -0,0 +1 @@
+"""Pure IDs, clocks, symbols, money and other dependency-free primitives."""
diff --git a/src/quant_os/portfolio/__init__.py b/src/quant_os/portfolio/__init__.py
new file mode 100644
index 0000000..5fc6b0d
--- /dev/null
+++ b/src/quant_os/portfolio/__init__.py
@@ -0,0 +1 @@
+"""Risk, cost, capacity, optimization and post-risk target weights."""
diff --git a/src/quant_os/ports/__init__.py b/src/quant_os/ports/__init__.py
new file mode 100644
index 0000000..c417848
--- /dev/null
+++ b/src/quant_os/ports/__init__.py
@@ -0,0 +1,5 @@
+"""Inward-facing ports implemented by external adapters."""
+
+from .broker import EvidenceSinkPort, ReadBrokerPort, TradeBrokerPort
+
+__all__ = ["EvidenceSinkPort", "ReadBrokerPort", "TradeBrokerPort"]
diff --git a/src/quant_os/ports/broker.py b/src/quant_os/ports/broker.py
new file mode 100644
index 0000000..234c426
--- /dev/null
+++ b/src/quant_os/ports/broker.py
@@ -0,0 +1,38 @@
+"""Broker and evidence ports with read and mutation authority kept separate."""
+
+from __future__ import annotations
+
+from typing import Any, Mapping, Protocol, Sequence
+
+
+class ReadBrokerPort(Protocol):
+    """Read-only broker facts. Implementations must not expose mutation here."""
+
+    def query_asset(self) -> Mapping[str, Any]:
+        ...
+
+    def query_positions(self) -> Sequence[Mapping[str, Any]]:
+        ...
+
+    def query_orders(self) -> Sequence[Mapping[str, Any]]:
+        ...
+
+    def query_trades(self) -> Sequence[Mapping[str, Any]]:
+        ...
+
+
+class TradeBrokerPort(Protocol):
+    """Explicit mutation boundary enabled only by a promoted release policy."""
+
+    def submit_order(self, intent: Mapping[str, Any]) -> Mapping[str, Any]:
+        ...
+
+    def cancel_order(self, broker_order_id: str) -> Mapping[str, Any]:
+        ...
+
+
+class EvidenceSinkPort(Protocol):
+    """Append immutable facts without granting decision or trading authority."""
+
+    def append(self, envelope: Mapping[str, Any]) -> str:
+        ...
diff --git a/src/quant_os/research/__init__.py b/src/quant_os/research/__init__.py
new file mode 100644
index 0000000..2444643
--- /dev/null
+++ b/src/quant_os/research/__init__.py
@@ -0,0 +1 @@
+"""Features, splits, models and evaluation; this layer never knows a broker."""
diff --git a/status/index.html b/status/index.html
index ac8be95..53357a8 100644
--- a/status/index.html
+++ b/status/index.html
@@ -1457,7 +1457,7 @@
       <div class="masthead__brand">
         <p class="eyebrow">Release control / public snapshot</p>
         <h1 class="brand-title" id="page-title">Quant OS</h1>
-        <p class="brand-subtitle">个人 A 股研究到执行的证据审计台</p>
+        <p class="brand-subtitle">个人沪深 A 股研究到执行的证据审计台</p>
       </div>
       <div class="masthead__claim">
         <div class="claim-line">
@@ -1479,15 +1479,15 @@
 
     <div class="safety-banner" role="note" aria-label="资金安全边界">
       <svg class="icon" aria-hidden="true"><use href="#icon-shield-alert"></use></svg>
-      <p><strong>可运行框架 ≠ 可投入资金。</strong> 本页只呈现构建时证据快照，不是实时服务健康监控，也不构成投资收益声明。</p>
+      <p><strong>可运行框架 ≠ 可投入资金。</strong> 本页只呈现构建时证据快照，不是实时服务健康监控，也不构成投资收益声明。<span id="market-scope-copy">当前交易执行范围仅覆盖沪深；北交所尚未接入，所有北交所委托必须 fail closed。</span></p>
       <span class="snapshot-label">LIVE READY = FALSE</span>
     </div>
 
     <section class="metrics" aria-label="核心状态指标">
       <div class="metric">
-        <span class="metric__label">Delivery score</span>
-        <strong class="metric__value" id="metric-score">NOT SCORED</strong>
-        <span class="metric__note">不把文章估分冒充系统得分</span>
+        <span class="metric__label">Production 80</span>
+        <strong class="metric__value" id="metric-score">0 / 100</strong>
+        <span class="metric__note">证据得分；Hard Gate 不可补偿</span>
       </div>
       <div class="metric">
         <span class="metric__label">Gate evidence</span>
@@ -1513,9 +1513,10 @@
         <a href="#layers"><span class="rail__index">01</span><span>系统分层</span></a>
         <a href="#models"><span class="rail__index">02</span><span>模型边界</span></a>
         <a href="#platforms"><span class="rail__index">03</span><span>平台接入</span></a>
-        <a href="#gates"><span class="rail__index">04</span><span>G1–G10</span></a>
-        <a href="#bundles"><span class="rail__index">05</span><span>发布包</span></a>
-        <a href="#provenance"><span class="rail__index">06</span><span>证据来源</span></a>
+        <a href="#maturity80"><span class="rail__index">04</span><span>80 分标准</span></a>
+        <a href="#gates"><span class="rail__index">05</span><span>G1–G10</span></a>
+        <a href="#bundles"><span class="rail__index">06</span><span>发布包</span></a>
+        <a href="#provenance"><span class="rail__index">07</span><span>证据来源</span></a>
       </nav>
 
       <main class="main-content" id="main-content" tabindex="-1">
@@ -1626,9 +1627,48 @@
           </div>
         </section>
 
-        <section class="audit-section" id="gates" aria-labelledby="gates-title">
+        <section class="audit-section" id="maturity80" aria-labelledby="maturity80-title">
           <div class="section-header">
             <span class="section-code">SEC.04</span>
+            <div>
+              <h2 class="section-title" id="maturity80-title">Production 80 · 受限生产标准</h2>
+              <p class="section-intro">80 分以 Baseline 60 全门通过为前置，并要求真实 QMT、60 个交易日 shadow、10 个交易日受限资金 canary、持续对账、恢复演练和券商程序化交易确认。</p>
+            </div>
+          </div>
+          <div class="overview-board">
+            <div class="overview-copy">
+              <h3>当前 80 分判定</h3>
+              <p><strong id="maturity80-score">0 / 100 · BLOCKED</strong></p>
+              <p id="maturity80-policy">等待 machine profile。缺失数据时不得获得分数。</p>
+            </div>
+            <div class="evidence-summary">
+              <h3>不可补偿前置</h3>
+              <ul class="runtime-list" id="maturity80-prerequisites">
+                <li>等待状态数据</li>
+              </ul>
+            </div>
+          </div>
+          <div class="matrix-wrap">
+            <table class="bundle-table">
+              <caption class="visually-hidden">Quant OS 80 分七个维度的已验证得分和最低分</caption>
+              <thead>
+                <tr>
+                  <th scope="col">Domain</th>
+                  <th scope="col">Verified</th>
+                  <th scope="col">Weight</th>
+                  <th scope="col">Required floor</th>
+                  <th scope="col">Status</th>
+                </tr>
+              </thead>
+              <tbody id="maturity80-domain-body"></tbody>
+            </table>
+          </div>
+          <div class="gate-stack" id="maturity80-control-list"></div>
+        </section>
+
+        <section class="audit-section" id="gates" aria-labelledby="gates-title">
+          <div class="section-header">
+            <span class="section-code">SEC.05</span>
             <div>
               <h2 class="section-title" id="gates-title">Baseline 60 · G1–G10</h2>
               <p class="section-intro">Gate 是发布闸门，不是代码清单。展开每项查看验收定义和缺失证据；当前 10 项均未通过。</p>
@@ -1639,7 +1679,7 @@
 
         <section class="audit-section" id="bundles" aria-labelledby="bundles-title">
           <div class="section-header">
-            <span class="section-code">SEC.05</span>
+            <span class="section-code">SEC.06</span>
             <div>
               <h2 class="section-title" id="bundles-title">跨平台发布包完整性</h2>
               <p class="section-intro">构建器核对共享核心、wrapper、配置与生成单文件的 SHA-256。哈希一致只证明代码发布包完整，不证明目标平台通过。</p>
@@ -1664,7 +1704,7 @@
 
         <section class="audit-section" id="provenance" aria-labelledby="provenance-title">
           <div class="section-header">
-            <span class="section-code">SEC.06</span>
+            <span class="section-code">SEC.07</span>
             <div>
               <h2 class="section-title" id="provenance-title">证据来源与快照血缘</h2>
               <p class="section-intro">所有公开字段由仓库中的权威记录生成并脱敏。链接指向私有 Gitea 源码，访问时可能要求登录。</p>
@@ -1738,7 +1778,7 @@
 
     <footer class="page-footer">
       <p>本页是公开、脱敏的构建时快照。未发布本地行情、运行 artifacts、券商状态或可复用凭据。任何实盘决策必须回到 G1–G10 的发布级证据。</p>
-      <a href="https://git.gomars.fun/boat/quants-strategies/src/branch/master/quant-os" target="_blank" rel="noopener noreferrer">
+      <a href="https://git.gomars.fun/boat/quant-os/src/branch/master" target="_blank" rel="noopener noreferrer">
         源码（需登录）
         <svg class="icon" aria-hidden="true"><use href="#icon-external"></use></svg>
       </a>
@@ -1759,7 +1799,7 @@
     (() => {
       "use strict";
 
-      const repoBase = "https://git.gomars.fun/boat/quants-strategies/src/branch/master/quant-os/";
+      const repoBase = "https://git.gomars.fun/boat/quant-os/src/branch/master/";
       const statusLabels = {
         implemented: { label: "已实现", tone: "implemented" },
         tested: { label: "合同验证", tone: "tested" },
@@ -1830,13 +1870,14 @@
       const renderHeader = (data) => {
         const claim = data.claim || {};
         const summary = data.summary || {};
+        const maturity80 = data.maturity80 || {};
         byId("claim-status").textContent = claim.status || "NOT_BASELINE_60";
         byId("claim-gates").textContent = `${claim.gatesPassed ?? 0} / ${claim.gatesTotal ?? 10} GATES`;
         byId("claim-reason").textContent = claim.reason || "缺少发布级证据。";
         byId("overview-reason").textContent = claim.reason || "缺少发布级证据。";
-        byId("metric-score").textContent = claim.score == null
-          ? String(claim.scoreStatus || "not_scored").replaceAll("_", " ").toUpperCase()
-          : String(claim.score);
+        byId("market-scope-copy").textContent = data.marketScope?.statement ||
+          "当前交易执行范围仅覆盖沪深；北交所尚未接入，所有北交所委托必须 fail closed。";
+        byId("metric-score").textContent = `${maturity80.effectiveScore ?? 0} / ${maturity80.maximumScore ?? 100}`;
         byId("metric-gates").textContent = `${claim.gatesPassed ?? 0} / ${claim.gatesTotal ?? 10}`;
         byId("metric-tests").textContent = summary.testsRecorded == null ? "—" : String(summary.testsRecorded);
         byId("metric-tests-note").textContent = summary.optionalSkipsRecorded == null
@@ -1853,6 +1894,63 @@
           : "<li>无真实运行证据记录</li>";
       };
 
+      const renderMaturity80 = (data) => {
+        const maturity = data.maturity80 || {};
+        byId("maturity80-score").textContent =
+          `${maturity.effectiveScore ?? 0} / ${maturity.maximumScore ?? 100} · ${maturity.state || "BLOCKED"}`;
+        byId("maturity80-policy").textContent = maturity.evidencePolicy ||
+          "缺少 hash-linked evidence 时不得计分。";
+        const prerequisiteLabels = {
+          baseline_60_all_gates: "Baseline 60 · G1–G10 全通过",
+          real_qmt_observed: "真实 QMT 已观察",
+          broker_programmatic_confirmation: "券商程序化交易确认",
+          shadow_trading_days: "同一候选 60 个交易日 shadow",
+          canary_trading_days: "受限资金 10 个交易日 canary",
+          open_p0_within_limit: "未关闭 P0 = 0",
+          open_p1_within_limit: "未关闭 P1 = 0"
+        };
+        const prerequisites = maturity.prerequisites || {};
+        const prerequisiteRows = Object.entries(prerequisiteLabels)
+          .map(([key, label]) => `<li>${escapeHtml(label)} · ${prerequisites[key] === true ? "PASS" : "BLOCKED"}</li>`)
+        prerequisiteRows.push(
+          `<li>Pre-canary 授权记录已核验 · ${maturity.preCanaryAuthorizationVerified === true ? "PASS" : "BLOCKED"}</li>`,
+          `<li>Canary 证据反向绑定授权 · ${maturity.canaryAuthorizationChainVerified === true ? "PASS" : "BLOCKED"}</li>`,
+          `<li>最终 promotion 可信 attestation · ${maturity.trustedAttestationVerified === true ? "PASS" : "BLOCKED"}</li>`
+        );
+        byId("maturity80-prerequisites").innerHTML = prerequisiteRows.join("");
+        const domains = Array.isArray(maturity.domains) ? maturity.domains : [];
+        byId("maturity80-domain-body").innerHTML = domains.map((domain) => `
+          <tr>
+            <td><strong>${escapeHtml(domain.id)} · ${escapeHtml(domain.name)}</strong></td>
+            <td>${escapeHtml(domain.score)}</td>
+            <td>${escapeHtml(domain.weight)}</td>
+            <td>${escapeHtml(domain.minimumScore)}</td>
+            <td>${statusTag(domain.floorPassed ? "tested" : "blocked")}</td>
+          </tr>
+        `).join("");
+        const controls = Array.isArray(maturity.controls) ? maturity.controls : [];
+        byId("maturity80-control-list").innerHTML = controls.map((control) => `
+          <details class="gate-item">
+            <summary>
+              <span class="gate-id">${escapeHtml(control.id)}</span>
+              <span class="gate-name">${escapeHtml(control.name)}</span>
+              <span class="gate-acceptance">${control.hardGate ? "HARD GATE" : "SCORED CONTROL"} · ${escapeHtml(control.weight)} points · min ${escapeHtml(control.minimumEvidenceTier)}</span>
+              ${statusTag(control.status)}
+            </summary>
+            <div class="gate-detail">
+              <div>
+                <h4>Current gap</h4>
+                <p>${escapeHtml(control.note || "No qualifying evidence recorded.")}</p>
+              </div>
+              <div>
+                <h4>Evidence rule</h4>
+                <p>只有绑定同一候选身份、达到最低 tier、SHA-256 可重算且通过可信 verifier 的 claim 才能通过。</p>
+              </div>
+            </div>
+          </details>
+        `).join("");
+      };
+
       const renderLayers = (data) => {
         const layers = Array.isArray(data.layers) ? data.layers : [];
         byId("layer-list").innerHTML = layers.map((layer, index) => `
@@ -2071,15 +2169,66 @@
 
       const validatePublicData = (data) => {
         if (!data || typeof data !== "object") throw new Error("missing public status object");
-        if (data.claim?.status !== "NOT_BASELINE_60") throw new Error("unsafe claim status");
-        if (data.claim?.releaseVerified !== false || data.claim?.liveReady !== false) {
-          throw new Error("unsafe release claim");
+        const claim = data.claim || {};
+        if (!["NOT_BASELINE_60", "BASELINE_60_VERIFIED"].includes(claim.status)) {
+          throw new Error("unsupported claim status");
         }
-        if (data.claim?.gatesPassed !== 0 || data.claim?.gatesTotal !== 10) {
-          throw new Error("unexpected gate score");
+        if (!Array.isArray(data.gates) || data.gates.length !== claim.gatesTotal) {
+          throw new Error("gate set mismatch");
         }
-        if (!Array.isArray(data.gates) || data.gates.some((gate) => gate.status !== "not_passed")) {
-          throw new Error("all gates must remain explicitly not_passed");
+        if (data.gates.some((gate) => !["passed", "not_passed"].includes(gate.status))) {
+          throw new Error("unsupported gate status");
+        }
+        const gatesPassed = data.gates.filter((gate) => gate.status === "passed").length;
+        if (gatesPassed !== claim.gatesPassed) throw new Error("gate count mismatch");
+        const baselineVerified = claim.status === "BASELINE_60_VERIFIED";
+        if (baselineVerified !== Boolean(claim.releaseVerified)) {
+          throw new Error("baseline release claim mismatch");
+        }
+        if (baselineVerified && gatesPassed !== claim.gatesTotal) {
+          throw new Error("baseline claim requires every gate");
+        }
+        const maturity = data.maturity80 || {};
+        const marketScope = data.marketScope || {};
+        if (
+          JSON.stringify(marketScope.included) !== JSON.stringify(["SSE", "SZSE"])
+          || JSON.stringify(marketScope.excludedFailClosed) !== JSON.stringify(["BSE"])
+          || marketScope.bseTradingEnabled !== false
+        ) {
+          throw new Error("unsafe or ambiguous market scope");
+        }
+        if (Boolean(maturity.baseline60Passed) !== baselineVerified) {
+          throw new Error("60/80 assessment mismatch");
+        }
+        if (Boolean(maturity.qualified) !== Boolean(claim.liveReady)) {
+          throw new Error("limited-live claim mismatch");
+        }
+        if (maturity.qualified && (
+          maturity.state !== "LIMITED_LIVE_VERIFIED"
+          || !maturity.trustedAttestationVerified
+          || !maturity.preCanaryAuthorized
+          || !maturity.canaryAuthorizationChainVerified
+        )) {
+          throw new Error("unattested production-80 claim");
+        }
+        if (
+          ["PRE_CANARY_AUTHORIZED", "CANARY_RUNNING"].includes(maturity.state)
+          && !maturity.preCanaryAuthorized
+        ) {
+          throw new Error("current canary state lacks authorization");
+        }
+        if (maturity.preCanaryAuthorized
+          && !maturity.preCanaryAuthorizationVerified) {
+          throw new Error("unattested pre-canary authorization");
+        }
+        if (
+          String(maturity.state || "").startsWith("TEST_ONLY_")
+          && (!maturity.testOnly || maturity.qualified)
+        ) {
+          throw new Error("test-only assessment overclaim");
+        }
+        if (!baselineVerified && maturity.effectiveScore > 59) {
+          throw new Error("production-80 score violates baseline-60 cap");
         }
       };
 
@@ -2095,6 +2244,7 @@
           renderLayers(data);
           renderModels(data);
           renderPlatforms();
+          renderMaturity80(data);
           renderGates(data);
           renderBundles(data);
           renderActions(data);
diff --git a/status/status-data.js b/status/status-data.js
index 88ee135..5bea331 100644
--- a/status/status-data.js
+++ b/status/status-data.js
@@ -1,6 +1,6 @@
 // Generated by tools/build_public_status.py; do not edit by hand.
 window.QUANT_OS_PUBLIC_STATUS = {
-  "auditAsOf": "2026-07-26",
+  "auditAsOf": "2026-07-30",
   "bundles": {
     "artifacts": [
       {
@@ -116,8 +116,8 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "authorized JQData market snapshot, licence/lineage record and a frozen provider-data candidate tape",
       "authorized real-data multi-period JoinQuant TargetPackage run plus same-input local/JoinQuant layer-by-layer reconciliation",
       "real QMT TargetPackage built-in and qmttools backtest exports",
-      "real QMT historical-ST positive control, terminal/xtquant build record, broker query contract and trade-amount semantic probes, callback/restart and at least 20 trading days of shadow evidence",
-      "continuous reconciliation, recovery drills and broker compliance confirmation"
+      "real QMT historical-ST positive control, terminal/xtquant build record, broker query contract and trade-amount semantic probes, and callback/restart evidence; Baseline 60 requires at least 20 trading days of shadow, while the current Production 80 gap requires at least 60 trading days for the same frozen candidate",
+      "continuous reconciliation, recovery drills and broker programmatic-trading report/verification confirmation"
     ],
     "internal": [
       "The authorized provider-data path has not yet been connected end to end to the frozen Ridge ModelBundle, calibrated risk/cost inputs, five-layer Baseline candidate and TargetPackage tape; the current connected candidate remains synthetic.",
@@ -203,11 +203,17 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "kind": "runbook",
       "label": "Platform deployment runbook",
       "path": "runbooks/PLATFORM_DEPLOYMENT.md"
+    },
+    {
+      "id": "public-status-deployment",
+      "kind": "runbook",
+      "label": "Atomic public status deployment",
+      "path": "ops/README.md"
     }
   ],
   "freshness": [
     {
-      "asOf": "2026-07-26",
+      "asOf": "2026-07-30",
       "evidenceLinks": [
         "scorecard",
         "audit"
@@ -216,7 +222,7 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "label": "项目证据审计",
       "semantics": "证据盘点日期；不是部署时间，也不是行情截止日。",
       "status": "recorded",
-      "value": "2026-07-26"
+      "value": "2026-07-30"
     },
     {
       "evidenceLinks": [
@@ -292,7 +298,7 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "label": "QMT / broker 真实运行",
       "lastRealRuntimeAt": null,
       "productionReady": false,
-      "semantics": "QMT 只有 bundle/harness，XtTrader 只有 fake-broker 只读合同；尚无真实运行或 20 日影子证据。",
+      "semantics": "QMT 只有 bundle/harness，XtTrader 只有 fake-broker 只读合同；尚无真实运行或影子证据。Baseline 60 至少需要 20 个交易日，Production 80 当前缺口为同一冻结候选至少 60 个交易日。",
       "status": "blocked",
       "value": "N/A"
     }
@@ -486,13 +492,13 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "limitations": [
         "真实平台跨引擎 manifest",
         "逐层 signal/target/order 差异",
-        "QMT 至少 20 个交易日影子记录"
+        "Baseline 60 所需的 QMT 至少 20 个交易日影子记录；Production 80 另要求同一冻结候选至少 60 个交易日"
       ],
       "name": "跨引擎一致性",
       "requiredEvidence": [
         "真实平台跨引擎 manifest",
         "逐层 signal/target/order 差异",
-        "QMT 至少 20 个交易日影子记录"
+        "Baseline 60 所需的 QMT 至少 20 个交易日影子记录；Production 80 另要求同一冻结候选至少 60 个交易日"
       ],
       "status": "not_passed"
     },
@@ -519,7 +525,7 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "status": "not_passed"
     }
   ],
-  "generatedAt": "2026-07-26T00:00:00Z",
+  "generatedAt": "2026-07-30T00:00:00Z",
   "generatedAtSource": "audit_as_of",
   "layers": [
     {
@@ -646,7 +652,7 @@ window.QUANT_OS_PUBLIC_STATUS = {
       ],
       "id": "broker-oms",
       "limitations": [
-        "无真实券商 attestation、回调/重启证明和 20 个交易日影子记录；没有实盘下单入口。"
+        "无真实券商 attestation、回调/重启证明和影子记录；Baseline 60 至少需要 20 个交易日，Production 80 当前缺口为同一冻结候选至少 60 个交易日；没有实盘下单入口。"
       ],
       "name": "券商、订单与影子盘",
       "releaseVerified": false,
@@ -673,6 +679,412 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "status": "blocked"
     }
   ],
+  "marketScope": {
+    "bseTradingEnabled": false,
+    "excludedFailClosed": [
+      "BSE"
+    ],
+    "executionScopeLabel": "沪深（上交所、深交所）",
+    "included": [
+      "SSE",
+      "SZSE"
+    ],
+    "statement": "当前交易执行范围仅覆盖沪深；北交所尚未接入，所有北交所委托必须 fail closed。"
+  },
+  "maturity80": {
+    "assessedAsOf": "2026-07-30",
+    "baseline60AttestationVerified": false,
+    "baseline60Passed": false,
+    "baselineProfileCanonicalSha256": "34adf09a824299ddb07c17f56751527ddf96ff5e494e792be0c65da4f8acdeb3",
+    "canaryAuthorizationChainVerified": false,
+    "canaryObservation": null,
+    "canaryRunning": false,
+    "controls": [
+      {
+        "domainId": "D1",
+        "hardGate": true,
+        "id": "D1-PIT",
+        "minimumEvidenceTier": "E2",
+        "name": "Production PIT dataset is complete, immutable and replayable",
+        "note": "No authorized complete production PIT dataset has reached the frozen Ridge path.",
+        "status": "not_passed",
+        "weight": 4
+      },
+      {
+        "domainId": "D1",
+        "hardGate": true,
+        "id": "D1-OPS",
+        "minimumEvidenceTier": "E3",
+        "name": "Data licence, lineage, freshness and recovery are operational",
+        "note": "No production freshness SLO, entitlement record and restore history.",
+        "status": "not_passed",
+        "weight": 5
+      },
+      {
+        "domainId": "D1",
+        "hardGate": false,
+        "id": "D1-REDUNDANCY",
+        "minimumEvidenceTier": "E3",
+        "name": "Critical inputs have independent validation or a tested fallback",
+        "note": "No independent production source or rehearsed fallback.",
+        "status": "not_passed",
+        "weight": 6
+      },
+      {
+        "domainId": "D2",
+        "hardGate": true,
+        "id": "D2-OOS",
+        "minimumEvidenceTier": "E2",
+        "name": "Frozen real-data walk-forward and OOS evidence is valid",
+        "note": "The connected Ridge candidate still uses synthetic research data.",
+        "status": "not_passed",
+        "weight": 4
+      },
+      {
+        "domainId": "D2",
+        "hardGate": true,
+        "id": "D2-MODEL",
+        "minimumEvidenceTier": "E2",
+        "name": "Model, feature and release identities are governed",
+        "note": "ModelBundle exists, but production ownership, expiry, approval and rollback evidence do not.",
+        "status": "not_passed",
+        "weight": 5
+      },
+      {
+        "domainId": "D2",
+        "hardGate": false,
+        "id": "D2-CHALLENGER",
+        "minimumEvidenceTier": "E3",
+        "name": "Champion, challenger, drift and experiment selection are controlled",
+        "note": "No real-data champion/challenger or production drift history.",
+        "status": "not_passed",
+        "weight": 6
+      },
+      {
+        "domainId": "D3",
+        "hardGate": true,
+        "id": "D3-LAYERS",
+        "minimumEvidenceTier": "E3",
+        "name": "Local, JoinQuant and QMT share frozen L1-L5 identities; Qlib follows its declared comparison scope",
+        "note": "No real-data local/JoinQuant/QMT L1-L5 strict-peer identity; Qlib has only a separate declared-scope research fixture.",
+        "status": "not_passed",
+        "weight": 6
+      },
+      {
+        "domainId": "D3",
+        "hardGate": true,
+        "id": "D3-DIFF",
+        "minimumEvidenceTier": "E3",
+        "name": "Order and fill differences are completely explained",
+        "note": "Mock parity and one JoinQuant execution smoke do not close a real QMT difference ledger.",
+        "status": "not_passed",
+        "weight": 4
+      },
+      {
+        "domainId": "D4",
+        "hardGate": true,
+        "id": "D4-RISK",
+        "minimumEvidenceTier": "E3",
+        "name": "Independent pre-trade risk fails closed",
+        "note": "Risk components exist, but there is no independent real-broker fail-closed service evidence.",
+        "status": "not_passed",
+        "weight": 3
+      },
+      {
+        "domainId": "D4",
+        "hardGate": true,
+        "id": "D4-RULES",
+        "minimumEvidenceTier": "E3",
+        "name": "Effective-dated SSE/SZSE rule packs are current; BSE remains fail-closed",
+        "note": "The effective-dated 2026-07-06 SSE/SZSE rule packs are not implemented; BSE remains explicitly excluded and fail-closed.",
+        "status": "not_passed",
+        "weight": 4
+      },
+      {
+        "domainId": "D4",
+        "hardGate": true,
+        "id": "D4-OMS",
+        "minimumEvidenceTier": "E3",
+        "name": "Order lifecycle is idempotent and restart-safe",
+        "note": "No real QMT callback, reconnect and restart lifecycle evidence.",
+        "status": "not_passed",
+        "weight": 3
+      },
+      {
+        "domainId": "D4",
+        "hardGate": false,
+        "id": "D4-TCA",
+        "minimumEvidenceTier": "E4",
+        "name": "Real fills drive TCA and capacity feedback",
+        "note": "No controlled-live fills or governed TCA feedback.",
+        "status": "not_passed",
+        "weight": 5
+      },
+      {
+        "domainId": "D5",
+        "hardGate": true,
+        "id": "D5-QMT",
+        "minimumEvidenceTier": "E3",
+        "name": "Authorized QMT account contracts are observed end to end",
+        "note": "QMT has fake-contract and syntax evidence only.",
+        "status": "not_passed",
+        "weight": 5
+      },
+      {
+        "domainId": "D5",
+        "hardGate": true,
+        "id": "D5-RECON",
+        "minimumEvidenceTier": "E3",
+        "name": "Cash, positions, sellable, orders and fills reconcile daily",
+        "note": "No real daily broker reconciliation series.",
+        "status": "not_passed",
+        "weight": 5
+      },
+      {
+        "domainId": "D5",
+        "hardGate": true,
+        "id": "D5-EVIDENCE",
+        "minimumEvidenceTier": "E3",
+        "name": "Broker facts and callbacks have authenticated replay evidence",
+        "note": "Local HMAC evidence is not broker attestation or real callback history.",
+        "status": "not_passed",
+        "weight": 2
+      },
+      {
+        "domainId": "D5",
+        "hardGate": true,
+        "id": "D5-FALLBACK",
+        "minimumEvidenceTier": "E3",
+        "name": "Manual broker fallback and operator handoff are rehearsed",
+        "note": "No real-account manual handoff drill.",
+        "status": "not_passed",
+        "weight": 3
+      },
+      {
+        "domainId": "D6",
+        "hardGate": true,
+        "id": "D6-SHADOW",
+        "minimumEvidenceTier": "E3",
+        "name": "The frozen candidate completes 60 trading days of shadow",
+        "note": "Zero of the required 60 real QMT shadow trading days are recorded.",
+        "status": "not_passed",
+        "weight": 4
+      },
+      {
+        "domainId": "D6",
+        "hardGate": true,
+        "id": "D6-CANARY",
+        "minimumEvidenceTier": "E4",
+        "name": "Limited capital canary completes at least 10 trading days",
+        "note": "No limited-capital canary is authorized or observed.",
+        "status": "not_passed",
+        "weight": 3
+      },
+      {
+        "domainId": "D6",
+        "hardGate": true,
+        "id": "D6-DR",
+        "minimumEvidenceTier": "E3",
+        "name": "Failure recovery meets RPO and RTO targets",
+        "note": "No measured RPO/RTO and broker failure-drill evidence.",
+        "status": "not_passed",
+        "weight": 5
+      },
+      {
+        "domainId": "D6",
+        "hardGate": true,
+        "id": "D6-RELEASE",
+        "minimumEvidenceTier": "E3",
+        "name": "Build, promotion, rollback and audit are reproducible",
+        "note": "Independent CI, signed release inventory and rollback drill are not yet complete.",
+        "status": "not_passed",
+        "weight": 3
+      },
+      {
+        "domainId": "D7",
+        "hardGate": true,
+        "id": "D7-SCOPE",
+        "minimumEvidenceTier": "E3",
+        "name": "Account and business scope remains personal proprietary",
+        "note": "The intended personal scope is documented but has no private attestation reference.",
+        "status": "not_passed",
+        "weight": 3
+      },
+      {
+        "domainId": "D7",
+        "hardGate": true,
+        "id": "D7-REPORT",
+        "minimumEvidenceTier": "E3",
+        "name": "Broker programmatic-trading report matches the deployed release",
+        "note": "No broker programmatic-trading confirmation exists yet.",
+        "status": "not_passed",
+        "weight": 4
+      },
+      {
+        "domainId": "D7",
+        "hardGate": true,
+        "id": "D7-FLOW",
+        "minimumEvidenceTier": "E3",
+        "name": "Abnormal-trading and conservative flow controls are enforced",
+        "note": "No real-account abnormal-trading monitoring history.",
+        "status": "not_passed",
+        "weight": 3
+      },
+      {
+        "domainId": "D7",
+        "hardGate": true,
+        "id": "D7-SECURITY",
+        "minimumEvidenceTier": "E3",
+        "name": "Secrets, access, personal data and supply chain are controlled",
+        "note": "Repository secret hygiene exists, but production access, rotation and supply-chain evidence do not.",
+        "status": "not_passed",
+        "weight": 2
+      },
+      {
+        "domainId": "D7",
+        "hardGate": false,
+        "id": "D7-REGULATED",
+        "minimumEvidenceTier": "E2",
+        "name": "A future regulated-mode rule calendar is maintained",
+        "note": "The regulated-mode activation calendar is documentation-only.",
+        "status": "not_passed",
+        "weight": 3
+      }
+    ],
+    "controlsPassed": 0,
+    "controlsTotal": 25,
+    "domainFloorFailures": [
+      "D1",
+      "D2",
+      "D3",
+      "D4",
+      "D5",
+      "D6",
+      "D7"
+    ],
+    "domains": [
+      {
+        "floorPassed": false,
+        "id": "D1",
+        "minimumScore": 9,
+        "name": "Data and point-in-time truth",
+        "score": 0,
+        "weight": 15
+      },
+      {
+        "floorPassed": false,
+        "id": "D2",
+        "minimumScore": 9,
+        "name": "Research and model governance",
+        "score": 0,
+        "weight": 15
+      },
+      {
+        "floorPassed": false,
+        "id": "D3",
+        "minimumScore": 6,
+        "name": "Cross-engine consistency",
+        "score": 0,
+        "weight": 10
+      },
+      {
+        "floorPassed": false,
+        "id": "D4",
+        "minimumScore": 9,
+        "name": "Execution and independent risk",
+        "score": 0,
+        "weight": 15
+      },
+      {
+        "floorPassed": false,
+        "id": "D5",
+        "minimumScore": 9,
+        "name": "Real QMT and broker truth",
+        "score": 0,
+        "weight": 15
+      },
+      {
+        "floorPassed": false,
+        "id": "D6",
+        "minimumScore": 9,
+        "name": "Operations, disaster recovery and audit",
+        "score": 0,
+        "weight": 15
+      },
+      {
+        "floorPassed": false,
+        "id": "D7",
+        "minimumScore": 9,
+        "name": "Compliance and security",
+        "score": 0,
+        "weight": 15
+      }
+    ],
+    "effectiveScore": 0,
+    "evidencePolicy": "Only subject-bound evidence claims verified by a configured trust provider, at or above each control's minimum tier, earn points. The current repository has no production trust provider and therefore cannot self-issue a positive qualification.",
+    "finalAttestationVerified": false,
+    "hardGateFailures": [
+      "D1-OPS",
+      "D1-PIT",
+      "D2-MODEL",
+      "D2-OOS",
+      "D3-DIFF",
+      "D3-LAYERS",
+      "D4-OMS",
+      "D4-RISK",
+      "D4-RULES",
+      "D5-EVIDENCE",
+      "D5-FALLBACK",
+      "D5-QMT",
+      "D5-RECON",
+      "D6-CANARY",
+      "D6-DR",
+      "D6-RELEASE",
+      "D6-SHADOW",
+      "D7-FLOW",
+      "D7-REPORT",
+      "D7-SCOPE",
+      "D7-SECURITY"
+    ],
+    "hardGatesPassed": 0,
+    "hardGatesTotal": 21,
+    "maximumScore": 100,
+    "preCanaryAttestationVerified": false,
+    "preCanaryAuthorization": null,
+    "preCanaryAuthorizationVerified": false,
+    "preCanaryAuthorized": false,
+    "preCanaryStructurallyEligible": false,
+    "prerequisites": {
+      "baseline_60_all_gates": false,
+      "broker_programmatic_confirmation": false,
+      "canary_trading_days": false,
+      "open_p0_within_limit": false,
+      "open_p1_within_limit": false,
+      "real_qmt_observed": false,
+      "shadow_trading_days": false
+    },
+    "productionTrustRegistryAvailable": false,
+    "qualificationThreshold": 80,
+    "qualified": false,
+    "rawScore": 0,
+    "scoreCaps": [
+      {
+        "maximum": 59,
+        "reason": "baseline_60_not_passed"
+      },
+      {
+        "maximum": 79,
+        "reason": "canary_not_observed"
+      }
+    ],
+    "standardCanonicalSha256": "44fc6c168ade4c6de15569214d88b96ce47b22b4120b10c80eb6f212fad5e662",
+    "standardId": "quant-os-production-80-v1",
+    "state": "BLOCKED_FROM_LIMITED_LIVE",
+    "structurallyEligible": false,
+    "testOnly": false,
+    "trustedAttestationVerified": false,
+    "verificationEnvironment": "none"
+  },
   "models": [
     {
       "claim": "共享 symbol normalization、momentum、target weight/quantity 与 order-delta 计算；2024 JoinQuant hosted run 只证明这一 smoke 路径。",
@@ -777,8 +1189,8 @@ window.QUANT_OS_PUBLIC_STATUS = {
         "G9"
       ],
       "priority": 5,
-      "title": "完成 QMT 券商合同探针与至少 20 日影子盘",
-      "why": "real QMT historical-ST positive control, terminal/xtquant build record, broker query contract and trade-amount semantic probes, callback/restart and at least 20 trading days of shadow evidence"
+      "title": "完成 QMT 券商合同探针与 Production 80 的 60 日影子盘（Baseline 60 门槛 20 日）",
+      "why": "real QMT historical-ST positive control, terminal/xtquant build record, broker query contract and trade-amount semantic probes, and callback/restart evidence; Baseline 60 requires at least 20 trading days of shadow, while the current Production 80 gap requires at least 60 trading days for the same frozen candidate"
     },
     {
       "gateIds": [
@@ -786,8 +1198,8 @@ window.QUANT_OS_PUBLIC_STATUS = {
         "G10"
       ],
       "priority": 6,
-      "title": "完成连续对账、恢复演练与券商合规确认",
-      "why": "continuous reconciliation, recovery drills and broker compliance confirmation"
+      "title": "完成连续对账、恢复演练与券商程序化交易报告/核查确认",
+      "why": "continuous reconciliation, recovery drills and broker programmatic-trading report/verification confirmation"
     }
   ],
   "platforms": [
@@ -984,7 +1396,7 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "id": "xttrader-read-only-shadow",
       "intendedUse": "账户绑定 target-diff 与 broker observation",
       "limitations": [
-        "HMAC 不是 broker attestation；仍缺官方 query 失败/空结果合同、callback/restart、20 日真实 shadow；not live-ready"
+        "HMAC 不是 broker attestation；仍缺官方 query 失败/空结果合同及 callback/restart；Baseline 60 至少 20 个交易日，Production 80 当前缺口为同一冻结候选至少 60 个交易日；not live-ready"
       ],
       "liveReady": false,
       "name": "XtTrader read-only shadow",
@@ -1063,16 +1475,30 @@ window.QUANT_OS_PUBLIC_STATUS = {
   "provenance": {
     "baselineConfig": "configs/baseline.json",
     "bundleManifest": "dist/bundle_manifest.json",
-    "payloadSha256": "76aad7a50088b9949b9c2549a4da568d14c6bc2ff4acc7df6419989637386bc3",
+    "payloadSha256": "9aae5da8e1d92fd28cfd7d6bef50774c4981b2baac1728ccd3153729234a88f0",
     "payloadSha256Semantics": "SHA-256 of canonical payload before payloadSha256 is added.",
     "platformMatrix": "docs/PLATFORM_MATRIX.md",
+    "production80Assessment": "profiles/production-80/current-assessment.json",
+    "production80Standard": "profiles/production-80/standard.json",
     "releaseReachability": "releases/quant60-research-candidate-v1/reachability.json",
     "scorecard": "gate_scorecard.json",
-    "sourceSetSha256": "e1b8bb8827c6c051a73872f2b0ac46f18dcf705fb50768eb98090bbbe08f863c",
+    "sourceSetSha256": "6d906cde8df07f8fae2f2faf05679a476ceae8f5173533b3b67beecc710b2f61",
     "sources": [
       {
         "path": "gate_scorecard.json",
-        "sha256": "db9ed17d1b56452f973db23461e8298b4f43f319b04be373adb383133500c2b6"
+        "sha256": "2cc29f8d3670cd2e1e90ebe10a7d4d5a1ab9fc6a6b08612df2bbad485cd19655"
+      },
+      {
+        "path": "profiles/baseline-60/profile.json",
+        "sha256": "fbfb71356bd6a711510dd6ef0d84a4f76c47cc8244e90120142fa6bf36780fb9"
+      },
+      {
+        "path": "profiles/production-80/standard.json",
+        "sha256": "60ca7de08b337b75ca7ed53b7c01b6a7c3d621d788e60a15f26f2adaf2844064"
+      },
+      {
+        "path": "profiles/production-80/current-assessment.json",
+        "sha256": "f6439d548c4bf176dfcd734ade2e3343b2673e9e11f8233d7c642d4ee3436369"
       },
       {
         "path": "dist/bundle_manifest.json",
@@ -1092,27 +1518,43 @@ window.QUANT_OS_PUBLIC_STATUS = {
       },
       {
         "path": "README.md",
-        "sha256": "d5593bdc4e535502ba817636053dc8ac38f8594be6f9e61f0fe2d11cf883a985"
+        "sha256": "0bf0562ae9247a88a5b0248f66b9b314d7ab0ea435bc8f8e5efa78f7d2f785bb"
       },
       {
         "path": "docs/ARCHITECTURE.md",
-        "sha256": "93b1981168084f40c6d127dc534ff2e60eb4cd0703c8ef446c6df58b351dfbaa"
+        "sha256": "8aae46f1b371651ac6f72905b7bcb3d72fdfda2a793e5505ab890352921c3219"
+      },
+      {
+        "path": "docs/architecture/ARCHITECTURE_80.md",
+        "sha256": "bb57df9d7eb5858741dde282ae0853a5e4ec9f4f4eb290bdb5954228fcb8956a"
       },
       {
         "path": "docs/AUDIT_2026-07-25.md",
         "sha256": "c070b49dfc2805c338400697369d886a6dc47b53af4a1834d0dfd383431e74d0"
       },
+      {
+        "path": "docs/standards/QUANT_OS_80_STANDARD.md",
+        "sha256": "90dc9e7f1c5be17f5e6672598aac4afca3d26cf0099ae794c1be85bdafd0b65b"
+      },
+      {
+        "path": "docs/standards/BASELINE_60_VS_PRODUCTION_80.md",
+        "sha256": "c99e858dc186c100ff9d9cd673b1644bdcb81fecd6fe945166bdd7966b9cfe8a"
+      },
+      {
+        "path": "docs/getting-started/GETTING_STARTED_80.md",
+        "sha256": "5c18a558bd2f9e1640144a1729309bf38ada3185188c985476bd609b28c4479e"
+      },
       {
         "path": "docs/PLATFORM_MATRIX.md",
-        "sha256": "4880b17e54257b794398bf734d80ea40d1180e52845762987443a9c61d562a23"
+        "sha256": "9c7952b019c92efd1055488b58838045ee30979ccc84008cd1218fab2a6d6717"
       },
       {
         "path": "docs/CROSS_ENGINE_CONSISTENCY.md",
-        "sha256": "358e4798bf853a96cb288ac379f916938415b86e86dbe4fa0e3fb4a86a612b6f"
+        "sha256": "bdb493e84201f51c5b91bacf8c894858b0c2dbceaaf0522c68d42d040ed45057"
       },
       {
         "path": "docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md",
-        "sha256": "03df249829b3ad9b4fe33c5d93afbd842561458f4ff2fe10e80e4432934eb2d2"
+        "sha256": "71d017a7e009331413f378fc847203d19eaa1c24317f364e9dcebe645df3d13b"
       },
       {
         "path": "docs/JOINQUANT_TARGET_PACKAGE_EVIDENCE_2026-07-26.md",
@@ -1120,11 +1562,39 @@ window.QUANT_OS_PUBLIC_STATUS = {
       },
       {
         "path": "docs/TUSHARE_LOCAL_DATA.md",
-        "sha256": "fd6cfe6cf45dbdd82e6aa88e80b119e05a888c560b79907370c6e023b5e00e82"
+        "sha256": "611b120ba59b59b443b5cd9237356c509f2f2699063784a4685506e88a95adea"
+      },
+      {
+        "path": "MIGRATION.md",
+        "sha256": "1d86ef7d854dc7c2eed80d2c5e5de0ee30bf87035be9be27a2eb8cb098277a5c"
+      },
+      {
+        "path": "ops/README.md",
+        "sha256": "eda75a106ea961faa22ada2c95c503ee2a5437030e238d065d7f112550dcac0d"
+      },
+      {
+        "path": "ops/activate_static_status.sh",
+        "sha256": "26e026da5ab13d228696de4a1d9a811bc80e2adf3220859b868129852655a93f"
+      },
+      {
+        "path": "ops/deploy_static_status.sh",
+        "sha256": "2b86edbd76e42832aba661d98cbadfc34607fb626d36324f7933e89c66a89c6e"
+      },
+      {
+        "path": "ops/nginx/quant-os-static.conf",
+        "sha256": "10b1c338c22caa0d4c4f68c1213d6c297a367995601dece7dd19df561b0c002e"
+      },
+      {
+        "path": "ops/nginx/quant-os-legacy-redirects-302.conf",
+        "sha256": "5206a0ed69ee01b8596fb3c5be9fdab713c14a512968c0cd24839e65495508a4"
+      },
+      {
+        "path": "ops/nginx/quant-os-legacy-redirects-308.conf",
+        "sha256": "ce8fc27e36b1c07dad445d76199b31a0113b42d759db8af7a60a3442548d4f94"
       },
       {
         "path": "runbooks/PLATFORM_DEPLOYMENT.md",
-        "sha256": "f6bb1eda335c0d05f96d39b4d4167ee623fe6cffeef75015ba7985638fa8f635"
+        "sha256": "001bc09f6865c6ee90fbbc2363b94bed7a282d039790af024457a5b1390b9840"
       },
       {
         "path": "tools/build_release_reachability.py",
@@ -1132,11 +1602,19 @@ window.QUANT_OS_PUBLIC_STATUS = {
       },
       {
         "path": "tools/build_public_status.py",
-        "sha256": "38347c2238a38fc603703c7265fd1ca54480b3f3f8c453cde9f21056f207a4ec"
+        "sha256": "ec24dd12a6383ab1210a475c6f982b911f6ce45a7c205b9474bb2bb70665bc2a"
+      },
+      {
+        "path": "tools/check_tracked_secrets.py",
+        "sha256": "359eddb5fb009d3790bd81ce9c939ceb9aea7868fde4ccbc22ffe01099c62304"
+      },
+      {
+        "path": "tools/inventory_local_assets.py",
+        "sha256": "f52a89b2e42d0f3aed7e3c79e0110c37cab779794f550658116e07b9e338160b"
       }
     ]
   },
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "summary": {
     "allFiveLayersRealPlatformObserved": false,
     "candidateRealPlatformObservationScope": "target_package_execution_consumer_only",
@@ -1153,7 +1631,7 @@ window.QUANT_OS_PUBLIC_STATUS = {
       "Tushare completed-partition Qlib momentum smoke"
     ],
     "testEvidenceQualifier": "Scorecard-recorded run; tests do not prove real-platform or broker gates.",
-    "testsRecorded": 285
+    "testsRecorded": 315
   },
   "system": "Quant OS / quant60 baseline kernel"
 };
diff --git a/tests/test_project_scaffold.py b/tests/test_project_scaffold.py
index 72525ad..7143fe5 100644
--- a/tests/test_project_scaffold.py
+++ b/tests/test_project_scaffold.py
@@ -1,6 +1,9 @@
 import json
+import os
+import stat
 import subprocess
 import sys
+import tempfile
 import unittest
 from pathlib import Path
 
@@ -23,26 +26,355 @@ class ProjectScaffoldTests(unittest.TestCase):
         )
         payload = json.loads(result.stdout.strip().splitlines()[-1])
         self.assertTrue(payload["ok"])
-        self.assertGreaterEqual(payload["code_cells"], 5)
+        self.assertGreaterEqual(payload["code_cells"], 4)
         self.assertFalse(payload["executed"])
+        optional_result = subprocess.run(
+            [
+                sys.executable,
+                "tools/run_colab_notebook.py",
+                "notebooks/quant_os_colab.ipynb",
+                "--include-optional",
+            ],
+            cwd=PROJECT,
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+        optional_payload = json.loads(
+            optional_result.stdout.strip().splitlines()[-1]
+        )
+        self.assertTrue(optional_payload["optional_included"])
+        self.assertGreater(
+            optional_payload["code_cells"],
+            payload["code_cells"],
+        )
 
     def test_secret_files_are_ignored(self):
         ignore = (PROJECT / ".gitignore").read_text(encoding="utf-8")
-        for entry in (".env", "secrets/", "credentials/", "userdata_mini/"):
+        for entry in (
+            ".env",
+            "secrets/",
+            "credentials/",
+            "userdata_mini/",
+            "data/",
+            "build/",
+        ):
             self.assertIn(entry, ignore)
 
+    def test_tracked_secret_scan_passes(self):
+        result = subprocess.run(
+            [sys.executable, "tools/check_tracked_secrets.py"],
+            cwd=PROJECT,
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("tracked secret scan: OK", result.stdout)
+
     def test_claude_project_contract_exists(self):
         content = (PROJECT / "CLAUDE.md").read_text(encoding="utf-8")
         self.assertIn("executable source of truth for Quant OS", content)
         self.assertIn("make local", content)
 
-    def test_gitea_workflow_is_at_monorepo_root(self):
-        workflow = PROJECT.parent / ".gitea/workflows/quant-os-ci.yml"
+    def test_gitea_workflow_is_at_independent_repo_root(self):
+        workflow = PROJECT / ".gitea/workflows/ci.yml"
         self.assertTrue(workflow.is_file())
         content = workflow.read_text(encoding="utf-8")
-        self.assertIn("working-directory: quant-os", content)
         self.assertIn("bash scripts/validate_all.sh", content)
-        self.assertFalse((PROJECT / ".gitea/workflows/ci.yml").exists())
+        self.assertNotIn("working-directory: quant-os", content)
+        self.assertNotIn('"quant-os/**"', content)
+        self.assertIn(r"\.env(\.[^/]+)?", content)
+        self.assertIn(r"\.env\.example", content)
+
+    def test_long_lived_product_namespace_is_installable(self):
+        pyproject = (PROJECT / "pyproject.toml").read_text(encoding="utf-8")
+        self.assertIn('name = "quant-os"', pyproject)
+        self.assertIn('quant-os = "quant_os.cli:main"', pyproject)
+        self.assertIn('quant60 = "quant60.cli:main"', pyproject)
+        self.assertTrue((PROJECT / "src/quant_os/__init__.py").is_file())
+
+    def test_cli_can_resolve_an_explicit_checkout_from_elsewhere(self):
+        environment = {**os.environ, "PYTHONPATH": str(PROJECT / "src")}
+        with tempfile.TemporaryDirectory() as temporary:
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    "-m",
+                    "quant_os",
+                    "--project-root",
+                    str(PROJECT),
+                    "doctor",
+                ],
+                cwd=temporary,
+                env=environment,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        payload = json.loads(result.stdout)
+        self.assertTrue(payload["ok"])
+        self.assertEqual(
+            payload["architecture"]["scope"],
+            "new_namespace_only",
+        )
+        self.assertGreater(
+            payload["migration"]["legacy_python_files_outside_checker"],
+            0,
+        )
+
+    def test_nginx_source_of_truth_has_atomic_release_routes(self):
+        config = (
+            PROJECT / "ops/nginx/quant-os-static.conf"
+        ).read_text(encoding="utf-8")
+        self.assertIn("location ^~ /quant-os/status/", config)
+        self.assertIn("root /srv/www;", config)
+        self.assertIn(
+            "https://$host/quant-os/status/",
+            config,
+        )
+        self.assertNotIn("/quants-strategies/", config)
+        self.assertNotIn(":8443", config)
+        temporary = (
+            PROJECT
+            / "ops/nginx/quant-os-legacy-redirects-302.conf"
+        ).read_text(encoding="utf-8")
+        stable = (
+            PROJECT
+            / "ops/nginx/quant-os-legacy-redirects-308.conf"
+        ).read_text(encoding="utf-8")
+        self.assertIn(
+            "location = /quants-strategies/quant-os/status",
+            temporary,
+        )
+        self.assertIn("return 302 ", temporary)
+        self.assertNotIn("return 308 ", temporary)
+        self.assertIn("return 308 ", stable)
+
+    def test_static_status_deployer_is_atomic_and_non_overwriting(self):
+        sha = "a" * 40
+        with tempfile.TemporaryDirectory() as temporary:
+            web_root = Path(temporary) / "web"
+            result = subprocess.run(
+                [
+                    "bash",
+                    "ops/deploy_static_status.sh",
+                    sha,
+                    "status",
+                    str(web_root),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual(
+                (web_root / "status").readlink(),
+                Path("releases") / sha,
+            )
+            release = web_root / "releases" / sha
+            self.assertEqual(
+                {path.name for path in release.iterdir()},
+                {"index.html", "status-data.js"},
+            )
+            self.assertFalse(release.stat().st_mode & stat.S_IWUSR)
+            self.assertFalse(
+                release.joinpath("index.html").stat().st_mode & stat.S_IWUSR
+            )
+            self.assertFalse(web_root.joinpath(f".incoming-{sha}").exists())
+            self.assertFalse(web_root.joinpath(".status-deploy.lock").exists())
+            second_sha = "b" * 40
+            switched = subprocess.run(
+                [
+                    "bash",
+                    "ops/deploy_static_status.sh",
+                    second_sha,
+                    "status",
+                    str(web_root),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertEqual(switched.returncode, 0, switched.stderr)
+            self.assertEqual(
+                (web_root / "status").readlink(),
+                Path("releases") / second_sha,
+            )
+            second = subprocess.run(
+                [
+                    "bash",
+                    "ops/deploy_static_status.sh",
+                    second_sha,
+                    "status",
+                    str(web_root),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertNotEqual(second.returncode, 0)
+            self.assertIn("refusing to overwrite", second.stderr)
+
+    def test_static_status_deployer_rejects_non_regular_or_extra_source(self):
+        cases = ("symlink", "extra-directory")
+        for case in cases:
+            with self.subTest(case=case):
+                temporary_context = tempfile.TemporaryDirectory()
+                self.addCleanup(temporary_context.cleanup)
+                temporary = temporary_context.name
+                root = Path(temporary)
+                source = root / "source"
+                source.mkdir()
+                source.joinpath("status-data.js").write_text(
+                    "window.STATUS = {};\n",
+                    encoding="utf-8",
+                )
+                if case == "symlink":
+                    source.joinpath("index.html").symlink_to(
+                        PROJECT / "status/index.html"
+                    )
+                else:
+                    source.joinpath("index.html").write_text(
+                        "<!doctype html>\n",
+                        encoding="utf-8",
+                    )
+                    source.joinpath("extra").mkdir()
+                web_root = root / "web"
+                result = subprocess.run(
+                    [
+                        "bash",
+                        "ops/deploy_static_status.sh",
+                        "c" * 40,
+                        str(source),
+                        str(web_root),
+                    ],
+                    cwd=PROJECT,
+                    check=False,
+                    capture_output=True,
+                    text=True,
+                )
+                self.assertNotEqual(result.returncode, 0)
+                self.assertFalse(web_root.joinpath("releases").exists())
+
+    def test_static_status_deploy_and_activation_share_concurrency_lock(self):
+        sha = "d" * 40
+        with tempfile.TemporaryDirectory() as temporary:
+            web_root = Path(temporary) / "web"
+            web_root.mkdir()
+            web_root.joinpath(".status-deploy.lock").mkdir()
+            deploy = subprocess.run(
+                [
+                    "bash",
+                    "ops/deploy_static_status.sh",
+                    sha,
+                    "status",
+                    str(web_root),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertNotEqual(deploy.returncode, 0)
+            self.assertIn("another status deployment", deploy.stderr)
+
+            release = web_root / "releases" / sha
+            release.mkdir(parents=True)
+            for name in ("index.html", "status-data.js"):
+                release.joinpath(name).write_text(name, encoding="utf-8")
+            activate = subprocess.run(
+                [
+                    "bash",
+                    "ops/activate_static_status.sh",
+                    sha,
+                    str(web_root),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertNotEqual(activate.returncode, 0)
+            self.assertIn("another status deployment", activate.stderr)
+            self.assertFalse(web_root.joinpath("status").exists())
+
+    def test_static_status_activation_rejects_extra_release_entry(self):
+        sha = "e" * 40
+        with tempfile.TemporaryDirectory() as temporary:
+            web_root = Path(temporary) / "web"
+            release = web_root / "releases" / sha
+            release.mkdir(parents=True)
+            for name in ("index.html", "status-data.js"):
+                release.joinpath(name).write_text(name, encoding="utf-8")
+            release.joinpath("extra").mkdir()
+            result = subprocess.run(
+                [
+                    "bash",
+                    "ops/activate_static_status.sh",
+                    sha,
+                    str(web_root),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn("exactly index.html and status-data.js", result.stderr)
+            self.assertFalse(web_root.joinpath("status").exists())
+            self.assertFalse(web_root.joinpath(".status-deploy.lock").exists())
+
+    def test_local_asset_inventory_is_deterministic_and_path_safe(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            (root / "data").mkdir()
+            (root / "artifacts").mkdir()
+            (root / "data" / "one.bin").write_bytes(b"one")
+            (root / "artifacts" / "two.json").write_text(
+                "{}\n",
+                encoding="utf-8",
+            )
+            first = root / "first.json"
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    str(PROJECT / "tools/inventory_local_assets.py"),
+                    str(root),
+                    "--output",
+                    str(first),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertEqual(result.returncode, 0, result.stderr)
+            payload = json.loads(first.read_text(encoding="utf-8"))
+            self.assertEqual(
+                [entry["path"] for entry in payload["entries"]],
+                ["data/one.bin", "artifacts/two.json"],
+            )
+            encoded = json.dumps(payload)
+            self.assertNotIn(str(root), encoded)
+            compare = subprocess.run(
+                [
+                    sys.executable,
+                    str(PROJECT / "tools/inventory_local_assets.py"),
+                    str(root),
+                    "--compare",
+                    str(first),
+                ],
+                cwd=PROJECT,
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+            self.assertEqual(compare.returncode, 0, compare.stderr)
 
 
 if __name__ == "__main__":
diff --git a/tests/test_public_status.py b/tests/test_public_status.py
index eb0333c..77c8eb5 100644
--- a/tests/test_public_status.py
+++ b/tests/test_public_status.py
@@ -54,6 +54,28 @@ class PublicStatusTests(unittest.TestCase):
         self.assertEqual(payload["claim"]["gatesPassed"], 0)
         self.assertEqual(payload["claim"]["gatesTotal"], 10)
         self.assertTrue(all(gate["status"] == "not_passed" for gate in payload["gates"]))
+        self.assertEqual(payload["schemaVersion"], 2)
+        self.assertFalse(payload["maturity80"]["qualified"])
+        self.assertFalse(payload["maturity80"]["baseline60Passed"])
+        self.assertEqual(payload["maturity80"]["effectiveScore"], 0)
+        self.assertFalse(payload["maturity80"]["preCanaryAuthorized"])
+        self.assertFalse(
+            payload["maturity80"]["preCanaryAuthorizationVerified"]
+        )
+        self.assertFalse(
+            payload["maturity80"]["canaryAuthorizationChainVerified"]
+        )
+        self.assertFalse(
+            payload["maturity80"]["trustedAttestationVerified"]
+        )
+        self.assertEqual(payload["marketScope"]["included"], ["SSE", "SZSE"])
+        self.assertEqual(
+            payload["marketScope"]["excludedFailClosed"],
+            ["BSE"],
+        )
+        self.assertFalse(payload["marketScope"]["bseTradingEnabled"])
+        self.assertIn("北交所", payload["marketScope"]["statement"])
+        self.assertIn("fail closed", payload["marketScope"]["statement"])
 
     def test_public_payload_is_deliberately_non_secret_and_non_local(self):
         payload = _read_payload()
@@ -84,8 +106,23 @@ class PublicStatusTests(unittest.TestCase):
         self.assertIn("NOT_BASELINE_60", page)
         self.assertIn("0 / 10", page)
         self.assertIn("validatePublicData", page)
+        self.assertIn("current canary state lacks authorization", page)
+        self.assertNotIn("all gates must remain", page)
+        self.assertIn('id="maturity80"', page)
+        self.assertIn("renderMaturity80", page)
+        self.assertIn('id="market-scope-copy"', page)
+        self.assertIn("个人沪深 A 股", page)
+        self.assertIn("北交所", page)
         self.assertIn("platform.limitations", page)
         self.assertNotIn("platform.missingReleaseEvidence", page)
+        self.assertIn(
+            "https://git.gomars.fun/boat/quant-os/src/branch/master/",
+            page,
+        )
+        self.assertNotIn(
+            "quants-strategies/src/branch/master/quant-os",
+            page,
+        )
         self.assertNotRegex(
             page,
             re.compile(
@@ -98,6 +135,37 @@ class PublicStatusTests(unittest.TestCase):
         for tag in re.findall(r"<a\\b[^>]*target=\"_blank\"[^>]*>", page):
             self.assertIn('rel="noopener noreferrer"', tag)
 
+    def test_production80_is_machine_evaluated_and_fail_closed(self):
+        payload = _read_payload()
+        maturity = payload["maturity80"]
+        self.assertEqual(maturity["standardId"], "quant-os-production-80-v1")
+        self.assertEqual(maturity["maximumScore"], 100)
+        self.assertEqual(maturity["qualificationThreshold"], 80)
+        self.assertEqual((maturity["rawScore"], maturity["effectiveScore"]), (0, 0))
+        self.assertEqual(
+            maturity["state"],
+            "BLOCKED_FROM_LIMITED_LIVE",
+        )
+        self.assertFalse(maturity["qualified"])
+        self.assertEqual(maturity["controlsPassed"], 0)
+        self.assertEqual(maturity["controlsTotal"], 25)
+        self.assertGreater(maturity["hardGatesTotal"], 0)
+        self.assertEqual(len(maturity["domains"]), 7)
+        self.assertTrue(
+            all(not domain["floorPassed"] for domain in maturity["domains"])
+        )
+        self.assertTrue(
+            all(value is False for value in maturity["prerequisites"].values())
+        )
+        self.assertEqual(
+            payload["provenance"]["production80Standard"],
+            "profiles/production-80/standard.json",
+        )
+        self.assertEqual(
+            payload["provenance"]["production80Assessment"],
+            "profiles/production-80/current-assessment.json",
+        )
+
     def test_models_and_platforms_preserve_evidence_boundaries(self):
         payload = _read_payload()
         models = {model["id"]: model for model in payload["models"]}
@@ -124,6 +192,11 @@ class PublicStatusTests(unittest.TestCase):
         self.assertEqual(platforms["QMT built-in bundle"]["status"], "implemented")
         self.assertFalse(platforms["XtTrader read-only shadow"]["liveReady"])
         self.assertIn("fake", platforms["XtTrader read-only shadow"]["claim"].lower())
+        shadow_limit = platforms["XtTrader read-only shadow"]["limitations"][0]
+        self.assertIn("Baseline 60", shadow_limit)
+        self.assertIn("20", shadow_limit)
+        self.assertIn("Production 80", shadow_limit)
+        self.assertIn("60", shadow_limit)
 
     def test_candidate_records_only_real_joinquant_execution_observation(self):
         payload = _read_payload()
@@ -301,7 +374,7 @@ class PublicStatusTests(unittest.TestCase):
     def test_freshness_uses_daily_bars_not_the_later_trade_calendar(self):
         payload = _read_payload()
         freshness = {item["id"]: item for item in payload["freshness"]}
-        self.assertEqual(freshness["project-audit"]["value"], "2026-07-26")
+        self.assertEqual(freshness["project-audit"]["value"], "2026-07-30")
         self.assertEqual(
             freshness["joinquant-hosted-market-window"]["marketDataThrough"],
             "2024-12-31",
@@ -399,7 +472,7 @@ class PublicStatusTests(unittest.TestCase):
         scorecard = {
             "claim_policy": {
                 "baseline_threshold": 60,
-                "current_claim": "BASELINE_60",
+                "current_claim": "BASELINE_60_VERIFIED",
             },
             "current_delivery": {"score": 59},
             "gates": [{"id": "G1", "status": "not_passed"}],
diff --git a/tests/test_quant_os_maturity.py b/tests/test_quant_os_maturity.py
new file mode 100644
index 0000000..9ecccb6
--- /dev/null
+++ b/tests/test_quant_os_maturity.py
@@ -0,0 +1,954 @@
+import copy
+import hashlib
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+
+PROJECT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(PROJECT / "src"))
+
+from quant_os.architecture import validate_architecture
+from quant_os.evidence.maturity import (
+    MaturityStandardError,
+    _final_assessment_digest,
+    _pre_canary_projection_digest,
+    evaluate_assessment,
+    load_json_object,
+    validate_standard,
+)
+
+
+PROFILE = PROJECT / "profiles/production-80/standard.json"
+ASSESSMENT = PROJECT / "profiles/production-80/current-assessment.json"
+
+
+class QuantOsMaturityTests(unittest.TestCase):
+    def setUp(self):
+        self.standard = load_json_object(PROFILE)
+        self.assessment = load_json_object(ASSESSMENT)
+
+    @staticmethod
+    def _frozen_subject():
+        return {
+            "candidate_id": "candidate-test-v1",
+            "release_sha256": "1" * 64,
+            "model_sha256": "2" * 64,
+            "dataset_sha256": "3" * 64,
+            "account_scope_id": "broker-account-pseudonym",
+            "material_change_epoch": 0,
+        }
+
+    @staticmethod
+    def _trusted_test_verifier(claim, control, source):
+        trusted = (
+            claim.get("attestation")
+            == {"method": "unit-test-trust-boundary"}
+            and source.is_file()
+            and claim.get("control_id") == control["id"]
+        )
+        return {
+            "trusted": trusted,
+            "trust_environment": "test",
+            "verifier_id": "unit-test-verifier",
+            "issuer_id": "unit-test-issuer",
+            "key_fingerprint_sha256": "9" * 64,
+            "policy_version": "unit-test-policy-v1",
+        }
+
+    def _write_claim(
+        self,
+        root,
+        *,
+        control_id,
+        tier,
+        subject,
+        evidence_type="control_acceptance_evidence",
+        assessment_sha256=None,
+        observed_as_of="2026-06-30",
+        extra=None,
+    ):
+        claims = root / "claims"
+        claims.mkdir(exist_ok=True)
+        claim = {
+            "schema_version": "quant-os-evidence-claim/1.0",
+            "claim_id": f"claim-{control_id.lower()}",
+            "control_id": control_id,
+            "tier": tier,
+            "subject": subject,
+            "standard_id": self.standard["standard_id"],
+            "standard_canonical_sha256": self.assessment[
+                "standard_canonical_sha256"
+            ],
+            "evidence_type": evidence_type,
+            "authority_class": "unit_test_only",
+            "observed_as_of": observed_as_of,
+            "source_hashes": ["4" * 64],
+            "attestation": {"method": "unit-test-trust-boundary"},
+        }
+        if assessment_sha256 is not None:
+            claim["assessment_sha256"] = assessment_sha256
+        if extra is not None:
+            claim.update(extra)
+        path = claims / f"{control_id.lower()}.json"
+        path.write_text(
+            json.dumps(claim, sort_keys=True),
+            encoding="utf-8",
+        )
+        return {
+            "path": path.relative_to(root).as_posix(),
+            "tier": tier,
+            "sha256": hashlib.sha256(path.read_bytes()).hexdigest(),
+        }
+
+    def _prepare_qualified_assessment(
+        self,
+        root,
+        passing_controls,
+        *,
+        canary_days=10,
+        attestation_kind="qualification",
+    ):
+        assessment = copy.deepcopy(self.assessment)
+        subject = self._frozen_subject()
+        assessment["subject"] = subject
+        baseline_profile = load_json_object(
+            PROJECT / "profiles/baseline-60/profile.json"
+        )
+        baseline_root = root / "profiles" / "baseline-60"
+        baseline_root.mkdir(parents=True)
+        (baseline_root / "profile.json").write_text(
+            json.dumps(baseline_profile, sort_keys=True),
+            encoding="utf-8",
+        )
+        baseline_verification = self._write_claim(
+            root,
+            control_id="BASELINE_60",
+            tier="E3",
+            subject=subject,
+            evidence_type="baseline60_qualification_attestation",
+            extra={
+                "baseline_profile_id": "quant-os-baseline-60",
+                "baseline_profile_canonical_sha256": self.assessment[
+                    "baseline_60"
+                ]["profile_canonical_sha256"],
+                "gates_passed": 10,
+                "gates_total": 10,
+                "score": 60,
+            },
+        )
+        assessment["baseline_60"] = {
+            "all_gates_passed": True,
+            "gates_passed": 10,
+            "gates_total": 10,
+            "profile_id": "quant-os-baseline-60",
+            "profile_canonical_sha256": self.assessment["baseline_60"][
+                "profile_canonical_sha256"
+            ],
+            "verification": baseline_verification,
+        }
+        assessment["observations"] = {
+            "real_qmt_observed": True,
+            "broker_programmatic_confirmation": True,
+            "shadow_trading_days": 60,
+            "canary_trading_days": canary_days,
+            "open_p0": 0,
+            "open_p1": 0,
+        }
+        for control in assessment["controls"]:
+            if (
+                control["id"] in passing_controls
+                and control["id"] != "D6-CANARY"
+            ):
+                standard_control = next(
+                    item
+                    for domain in self.standard["domains"]
+                    for item in domain["controls"]
+                    if item["id"] == control["id"]
+                )
+                control["status"] = "passed"
+                control["evidence"] = [
+                    self._write_claim(
+                        root,
+                        control_id=control["id"],
+                        tier=standard_control["minimum_evidence_tier"],
+                        subject=subject,
+                    )
+                ]
+        if attestation_kind not in {"qualification", "pre_canary"}:
+            raise AssertionError(f"unknown attestation kind {attestation_kind}")
+        assessment["pre_canary_attestation"] = self._write_claim(
+            root,
+            control_id="PRE_CANARY_AUTHORIZATION",
+            tier="E3",
+            subject=subject,
+            evidence_type="pre_canary_authorization_attestation",
+            assessment_sha256=_pre_canary_projection_digest(assessment),
+            observed_as_of="2026-07-01",
+            extra={
+                "authorization_id": (
+                    "claim-pre_canary_authorization"
+                ),
+                "authorized_at": "2026-07-01",
+                "expires_on": "2026-08-31",
+                "account_scope_id": subject["account_scope_id"],
+                "strategy_ids": [subject["candidate_id"]],
+                "maximum_capital_cny": 100000,
+                "maximum_gross_notional_cny": 80000,
+                "maximum_symbols": 2,
+                "symbol_allowlist": [
+                    "000001.XSHE",
+                    "600000.XSHG",
+                ],
+                "flow_limits": {
+                    "maximum_submission_and_cancel_requests_per_second": 2,
+                    "maximum_submission_and_cancel_requests_per_day": 50,
+                },
+                "stop_conditions": [
+                    "any_risk_data_rule_or_reconciliation_breach",
+                    "authorization_expired",
+                    "operator_kill_switch",
+                ],
+                "no_automatic_scale_up": True,
+            },
+        )
+        if "D6-CANARY" in passing_controls:
+            canary_control = next(
+                control
+                for control in assessment["controls"]
+                if control["id"] == "D6-CANARY"
+            )
+            canary_control["status"] = "passed"
+            canary_control["evidence"] = [
+                self._write_claim(
+                    root,
+                    control_id="D6-CANARY",
+                    tier="E4",
+                    subject=subject,
+                    evidence_type="controlled_live_canary_observation",
+                    observed_as_of="2026-07-15",
+                    extra={
+                        "pre_canary_authorization_claim_id": (
+                            "claim-pre_canary_authorization"
+                        ),
+                        "pre_canary_authorization_sha256": assessment[
+                            "pre_canary_attestation"
+                        ]["sha256"],
+                        "canary_started_on": "2026-07-02",
+                        "canary_ended_on": "2026-07-15",
+                        "trading_days_observed": canary_days,
+                        "maximum_capital_cny_observed": 75000,
+                        "maximum_gross_notional_cny_observed": 60000,
+                        "symbols_observed": [
+                            "000001.XSHE",
+                            "600000.XSHG",
+                        ],
+                        "maximum_submission_and_cancel_requests_per_second_observed": 2,
+                        "maximum_submission_and_cancel_requests_per_day_observed": 40,
+                        "automatic_scale_up_observed": False,
+                        "breach_events": [],
+                        "stop_events": [],
+                    },
+                )
+            ]
+        if attestation_kind == "qualification":
+            assessment["qualification_attestation"] = self._write_claim(
+                root,
+                control_id="QUALIFICATION",
+                tier="E4",
+                subject=subject,
+                evidence_type="production80_promotion_attestation",
+                assessment_sha256=_final_assessment_digest(assessment),
+                observed_as_of="2026-07-16",
+            )
+        return assessment
+
+    def test_profile_is_exactly_weighted_and_current_claim_is_blocked(self):
+        summary = validate_standard(self.standard)
+        self.assertEqual(summary["maximum_score"], 100)
+        self.assertEqual(summary["domain_weight_total"], 100)
+        self.assertEqual(summary["qualification_threshold"], 80)
+        self.assertEqual(summary["domain_count"], 7)
+        self.assertEqual(summary["hard_gate_count"], 21)
+        self.assertEqual(summary["hard_gate_weight_total"], 80)
+        result = evaluate_assessment(
+            self.standard,
+            self.assessment,
+            repository_root=PROJECT,
+        )
+        self.assertEqual(result["raw_score"], 0)
+        self.assertEqual(result["effective_score"], 0)
+        self.assertFalse(result["baseline_60_passed"])
+        self.assertFalse(result["qualified"])
+        self.assertEqual(
+            result["qualification_state"],
+            "BLOCKED_FROM_LIMITED_LIVE",
+        )
+        self.assertTrue(result["hard_gate_failures"])
+        self.assertEqual(
+            set(result["domain_floor_failures"]),
+            {f"D{index}" for index in range(1, 8)},
+        )
+
+    def test_a_pass_without_hashed_evidence_is_rejected(self):
+        assessment = copy.deepcopy(self.assessment)
+        assessment["controls"][0]["status"] = "passed"
+        with self.assertRaisesRegex(
+            MaturityStandardError,
+            "without immutable evidence",
+        ):
+            evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=PROJECT,
+            )
+
+    def test_all_controls_form_a_test_only_structural_path(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            passing_controls = {
+                control["id"]
+                for domain in self.standard["domains"]
+                for control in domain["controls"]
+            }
+            assessment = self._prepare_qualified_assessment(
+                root,
+                passing_controls,
+            )
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertEqual(result["effective_score"], 100)
+        self.assertFalse(result["qualified"])
+        self.assertTrue(result["structurally_eligible"])
+        self.assertTrue(result["final_attestation_verified"])
+        self.assertFalse(result["trusted_attestation_verified"])
+        self.assertTrue(result["test_only"])
+        self.assertTrue(result["canary_authorization_chain_verified"])
+        self.assertEqual(
+            result["qualification_state"],
+            "TEST_ONLY_STRUCTURAL_PASS",
+        )
+
+    def test_exactly_eighty_points_is_a_structural_path_only(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertEqual(result["raw_score"], 80)
+        self.assertEqual(result["effective_score"], 80)
+        self.assertFalse(result["qualified"])
+        self.assertEqual(
+            result["qualification_state"],
+            "TEST_ONLY_STRUCTURAL_PASS",
+        )
+
+    def test_structural_score_cannot_self_attest_without_trusted_verifier(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            with self.assertRaisesRegex(
+                MaturityStandardError,
+                "trusted evidence verifier",
+            ):
+                evaluate_assessment(
+                    self.standard,
+                    assessment,
+                    repository_root=root,
+                )
+
+    def test_pre_canary_requires_a_separate_trusted_authorization(self):
+        pre_canary_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"] and control["id"] != "D6-CANARY"
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                pre_canary_controls,
+                canary_days=0,
+                attestation_kind="pre_canary",
+            )
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertEqual(result["raw_score"], 77)
+        self.assertFalse(result["qualified"])
+        self.assertFalse(result["pre_canary_authorized"])
+        self.assertTrue(result["pre_canary_attestation_verified"])
+        self.assertEqual(
+            result["pre_canary_authorization"]["claim_id"],
+            "claim-pre_canary_authorization",
+        )
+        self.assertEqual(
+            result["qualification_state"],
+            "TEST_ONLY_PRE_CANARY_PASS",
+        )
+
+    def test_pre_canary_authorization_survives_running_day_updates(self):
+        pre_canary_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"] and control["id"] != "D6-CANARY"
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                pre_canary_controls,
+                canary_days=0,
+                attestation_kind="pre_canary",
+            )
+            assessment["observations"]["canary_trading_days"] = 5
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertTrue(result["pre_canary_attestation_verified"])
+        self.assertEqual(
+            result["qualification_state"],
+            "TEST_ONLY_PRE_CANARY_PASS",
+        )
+
+    def test_expired_pre_canary_authorization_cannot_open_or_continue_canary(self):
+        pre_canary_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"] and control["id"] != "D6-CANARY"
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                pre_canary_controls,
+                canary_days=0,
+                attestation_kind="pre_canary",
+            )
+            assessment["assessed_as_of"] = "2026-09-01"
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertFalse(
+            result["pre_canary_authorization_valid_as_of_assessment"]
+        )
+        self.assertEqual(
+            result["pre_canary_authorization"]["validity_status"],
+            "expired",
+        )
+        self.assertFalse(result["canary_running"])
+        self.assertEqual(
+            result["qualification_state"],
+            "TEST_ONLY_PRE_CANARY_EXPIRED",
+        )
+
+    def test_completed_canary_chain_survives_authorization_expiry(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            assessment["assessed_as_of"] = "2026-09-01"
+            final_link = assessment["qualification_attestation"]
+            final_path = root / final_link["path"]
+            final_claim = json.loads(final_path.read_text(encoding="utf-8"))
+            final_claim["assessment_sha256"] = _final_assessment_digest(
+                assessment
+            )
+            final_path.write_text(
+                json.dumps(final_claim, sort_keys=True),
+                encoding="utf-8",
+            )
+            final_link["sha256"] = hashlib.sha256(
+                final_path.read_bytes()
+            ).hexdigest()
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertFalse(
+            result["pre_canary_authorization_valid_as_of_assessment"]
+        )
+        self.assertTrue(result["canary_authorization_chain_verified"])
+        self.assertTrue(result["structurally_eligible"])
+        self.assertEqual(
+            result["qualification_state"],
+            "TEST_ONLY_STRUCTURAL_PASS",
+        )
+
+    def test_canary_observation_must_stay_within_authorized_hard_caps(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        mutations = (
+            (
+                "capital",
+                {"maximum_capital_cny_observed": 100001},
+                "authorized capital caps",
+            ),
+            (
+                "gross_notional",
+                {"maximum_gross_notional_cny_observed": 80001},
+                "authorized capital caps",
+            ),
+            (
+                "symbol",
+                {"symbols_observed": ["300001.XSHE"]},
+                "authorized symbol caps",
+            ),
+            (
+                "flow",
+                {
+                    "maximum_submission_and_cancel_requests_per_second_observed": 3
+                },
+                "authorized flow caps",
+            ),
+            (
+                "automatic_scale_up",
+                {"automatic_scale_up_observed": True},
+                "automatic scale-up",
+            ),
+        )
+        for name, mutation, expected in mutations:
+            with self.subTest(name=name), tempfile.TemporaryDirectory() as temporary:
+                root = Path(temporary)
+                assessment = self._prepare_qualified_assessment(
+                    root,
+                    hard_controls,
+                )
+                canary = next(
+                    control
+                    for control in assessment["controls"]
+                    if control["id"] == "D6-CANARY"
+                )
+                evidence = canary["evidence"][0]
+                path = root / evidence["path"]
+                claim = json.loads(path.read_text(encoding="utf-8"))
+                claim.update(mutation)
+                path.write_text(
+                    json.dumps(claim, sort_keys=True),
+                    encoding="utf-8",
+                )
+                evidence["sha256"] = hashlib.sha256(
+                    path.read_bytes()
+                ).hexdigest()
+                with self.assertRaisesRegex(
+                    MaturityStandardError,
+                    expected,
+                ):
+                    evaluate_assessment(
+                        self.standard,
+                        assessment,
+                        repository_root=root,
+                        trusted_evidence_verifier=(
+                            self._trusted_test_verifier
+                        ),
+                    )
+
+    def test_canary_breach_must_link_to_fail_closed_stop_event(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            canary = next(
+                control
+                for control in assessment["controls"]
+                if control["id"] == "D6-CANARY"
+            )
+            evidence = canary["evidence"][0]
+            path = root / evidence["path"]
+            claim = json.loads(path.read_text(encoding="utf-8"))
+            claim["breach_events"] = [
+                {
+                    "breach_id": "breach-1",
+                    "condition": (
+                        "any_risk_data_rule_or_reconciliation_breach"
+                    ),
+                    "observed_on": "2026-07-08",
+                    "stop_event_id": "missing-stop",
+                }
+            ]
+            path.write_text(
+                json.dumps(claim, sort_keys=True),
+                encoding="utf-8",
+            )
+            evidence["sha256"] = hashlib.sha256(
+                path.read_bytes()
+            ).hexdigest()
+            with self.assertRaisesRegex(
+                MaturityStandardError,
+                "not linked to an authorized stop",
+            ):
+                evaluate_assessment(
+                    self.standard,
+                    assessment,
+                    repository_root=root,
+                    trusted_evidence_verifier=self._trusted_test_verifier,
+                )
+
+    def test_canary_breach_with_fail_closed_stop_event_is_accepted(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            canary = next(
+                control
+                for control in assessment["controls"]
+                if control["id"] == "D6-CANARY"
+            )
+            evidence = canary["evidence"][0]
+            path = root / evidence["path"]
+            claim = json.loads(path.read_text(encoding="utf-8"))
+            claim["breach_events"] = [
+                {
+                    "breach_id": "breach-1",
+                    "condition": (
+                        "any_risk_data_rule_or_reconciliation_breach"
+                    ),
+                    "observed_on": "2026-07-08",
+                    "stop_event_id": "stop-1",
+                }
+            ]
+            claim["stop_events"] = [
+                {
+                    "stop_event_id": "stop-1",
+                    "condition": (
+                        "any_risk_data_rule_or_reconciliation_breach"
+                    ),
+                    "triggered_on": "2026-07-08",
+                    "trading_stopped": True,
+                    "automatic_resume": False,
+                }
+            ]
+            path.write_text(
+                json.dumps(claim, sort_keys=True),
+                encoding="utf-8",
+            )
+            evidence["sha256"] = hashlib.sha256(
+                path.read_bytes()
+            ).hexdigest()
+            final_link = assessment["qualification_attestation"]
+            final_path = root / final_link["path"]
+            final_claim = json.loads(final_path.read_text(encoding="utf-8"))
+            final_claim["assessment_sha256"] = _final_assessment_digest(
+                assessment
+            )
+            final_path.write_text(
+                json.dumps(final_claim, sort_keys=True),
+                encoding="utf-8",
+            )
+            final_link["sha256"] = hashlib.sha256(
+                final_path.read_bytes()
+            ).hexdigest()
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertTrue(result["canary_authorization_chain_verified"])
+        self.assertEqual(
+            result["canary_observation"]["breach_event_count"],
+            1,
+        )
+        self.assertEqual(
+            result["canary_observation"]["stop_event_count"],
+            1,
+        )
+        self.assertEqual(
+            result["qualification_state"],
+            "TEST_ONLY_STRUCTURAL_PASS",
+        )
+
+    def test_final_path_cannot_skip_pre_canary_history(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            assessment["pre_canary_attestation"] = None
+            result = evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=root,
+                trusted_evidence_verifier=self._trusted_test_verifier,
+            )
+        self.assertFalse(result["qualified"])
+        self.assertFalse(result["canary_authorization_chain_verified"])
+        self.assertEqual(
+            result["qualification_state"],
+            "PENDING_PRE_CANARY_HISTORY",
+        )
+
+    def test_canary_claim_must_reference_pre_authorization_hash(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            canary = next(
+                control
+                for control in assessment["controls"]
+                if control["id"] == "D6-CANARY"
+            )
+            evidence = canary["evidence"][0]
+            path = root / evidence["path"]
+            claim = json.loads(path.read_text(encoding="utf-8"))
+            claim["pre_canary_authorization_sha256"] = "8" * 64
+            path.write_text(json.dumps(claim, sort_keys=True), encoding="utf-8")
+            evidence["sha256"] = hashlib.sha256(path.read_bytes()).hexdigest()
+            with self.assertRaisesRegex(
+                MaturityStandardError,
+                "does not reference the verified authorization",
+            ):
+                evaluate_assessment(
+                    self.standard,
+                    assessment,
+                    repository_root=root,
+                    trusted_evidence_verifier=self._trusted_test_verifier,
+                )
+
+    def test_standard_hash_drift_rejects_old_assessment(self):
+        standard = copy.deepcopy(self.standard)
+        standard["domains"][0]["controls"][0]["acceptance"] += " changed"
+        with self.assertRaisesRegex(
+            MaturityStandardError,
+            "canonical hash does not match",
+        ):
+            evaluate_assessment(
+                standard,
+                self.assessment,
+                repository_root=PROJECT,
+            )
+
+    def test_boolean_verifier_cannot_issue_a_qualification(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            with self.assertRaisesRegex(
+                MaturityStandardError,
+                "attestation is not trusted",
+            ):
+                evaluate_assessment(
+                    self.standard,
+                    assessment,
+                    repository_root=root,
+                    trusted_evidence_verifier=lambda *_args: True,
+                )
+
+    def test_repository_cannot_accept_a_fake_production_registry(self):
+        hard_controls = {
+            control["id"]
+            for domain in self.standard["domains"]
+            for control in domain["controls"]
+            if control["hard_gate"]
+        }
+
+        def fake_production_verifier(*_args):
+            return {
+                "trusted": True,
+                "trust_environment": "production",
+                "verifier_id": "forged-local-verifier",
+                "issuer_id": "forged-local-issuer",
+                "key_fingerprint_sha256": "7" * 64,
+                "policy_version": "forged-v1",
+            }
+
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            assessment = self._prepare_qualified_assessment(
+                root,
+                hard_controls,
+            )
+            with self.assertRaisesRegex(
+                MaturityStandardError,
+                "production verifier registry is not implemented",
+            ):
+                evaluate_assessment(
+                    self.standard,
+                    assessment,
+                    repository_root=root,
+                    trusted_evidence_verifier=fake_production_verifier,
+                )
+
+    def test_hard_gates_cannot_make_the_published_threshold_unattainable(self):
+        standard = copy.deepcopy(self.standard)
+        soft_control = next(
+            control
+            for domain in standard["domains"]
+            for control in domain["controls"]
+            if control["id"] == "D1-REDUNDANCY"
+        )
+        soft_control["hard_gate"] = True
+        with self.assertRaisesRegex(
+            MaturityStandardError,
+            "hard-gate weights must exactly equal",
+        ):
+            validate_standard(standard)
+
+    def test_hash_drift_is_rejected(self):
+        assessment = copy.deepcopy(self.assessment)
+        assessment["controls"][0]["status"] = "passed"
+        assessment["controls"][0]["evidence"] = [
+            {
+                "path": "profiles/production-80/standard.json",
+                "tier": "E4",
+                "sha256": "0" * 64,
+            }
+        ]
+        with self.assertRaisesRegex(MaturityStandardError, "hash drift"):
+            evaluate_assessment(
+                self.standard,
+                assessment,
+                repository_root=PROJECT,
+            )
+
+    def test_architecture_is_valid_and_forbidden_import_is_detected(self):
+        current = validate_architecture(PROJECT / "src/quant_os")
+        self.assertTrue(current["ok"], current["violations"])
+        self.assertEqual(current["scope"], "new_namespace_only")
+        self.assertEqual(current["package_root"], "src/quant_os")
+        self.assertEqual(
+            current["migration_state"],
+            "transitioning_from_quant60_legacy",
+        )
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            for layer in current["layers"]:
+                (root / layer).mkdir()
+                (root / layer / "__init__.py").write_text("", encoding="utf-8")
+            (root / "research" / "bad.py").write_text(
+                "from quant_os.execution import submit\n",
+                encoding="utf-8",
+            )
+            (root / "research" / "bad_relative.py").write_text(
+                "from ..execution import submit\n",
+                encoding="utf-8",
+            )
+            (root / "research" / "bad_from_root.py").write_text(
+                "from quant_os import execution\n",
+                encoding="utf-8",
+            )
+            (root / "control" / "bad_vendor.py").write_text(
+                "from xtquant import xttrader\n",
+                encoding="utf-8",
+            )
+            (root / "research" / "bad_legacy.py").write_text(
+                "from quant60.experiment import run\n"
+                "from adapters.jqdata_local import load\n"
+                "from platforms.qlib_runner import main\n",
+                encoding="utf-8",
+            )
+            (root / "architecture.py").write_text(
+                "from .research import train\n",
+                encoding="utf-8",
+            )
+            (root / "bad_root.py").write_text("", encoding="utf-8")
+            (root / "unregistered").mkdir()
+            (root / "unregistered" / "__init__.py").write_text(
+                "",
+                encoding="utf-8",
+            )
+            invalid = validate_architecture(root)
+        self.assertFalse(invalid["ok"])
+        reasons = [item["reason"] for item in invalid["violations"]]
+        self.assertEqual(reasons.count("forbidden_dependency"), 4)
+        self.assertIn("vendor_sdk_outside_adapter", reasons)
+        self.assertIn("legacy_dependency_escape", reasons)
+        self.assertIn("unregistered_layer_package", reasons)
+        self.assertIn("unregistered_root_module", reasons)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/build_public_status.py b/tools/build_public_status.py
index 7da12de..2e8c277 100644
--- a/tools/build_public_status.py
+++ b/tools/build_public_status.py
@@ -17,7 +17,12 @@ from typing import Any, Dict, Iterable, List, Mapping, Sequence, Tuple
 PROJECT = Path(__file__).resolve().parents[1]
 DEFAULT_OUTPUT = PROJECT / "status" / "status-data.js"
 GLOBAL_NAME = "QUANT_OS_PUBLIC_STATUS"
-SCHEMA_VERSION = 1
+SCHEMA_VERSION = 2
+PRODUCTION_80_STANDARD_PATH = "profiles/production-80/standard.json"
+PRODUCTION_80_ASSESSMENT_PATH = (
+    "profiles/production-80/current-assessment.json"
+)
+BASELINE_60_PROFILE_PATH = "profiles/baseline-60/profile.json"
 REACHABILITY_PATH = (
     "releases/quant60-research-candidate-v1/reachability.json"
 )
@@ -36,21 +41,37 @@ JOINQUANT_TARGET_PACKAGE_BUNDLE_SHA256 = (
 
 SOURCE_PATHS: Tuple[str, ...] = (
     "gate_scorecard.json",
+    BASELINE_60_PROFILE_PATH,
+    PRODUCTION_80_STANDARD_PATH,
+    PRODUCTION_80_ASSESSMENT_PATH,
     "dist/bundle_manifest.json",
     REACHABILITY_PATH,
     JOINQUANT_TARGET_PACKAGE_RUN_PATH,
     "configs/baseline.json",
     "README.md",
     "docs/ARCHITECTURE.md",
+    "docs/architecture/ARCHITECTURE_80.md",
     "docs/AUDIT_2026-07-25.md",
+    "docs/standards/QUANT_OS_80_STANDARD.md",
+    "docs/standards/BASELINE_60_VS_PRODUCTION_80.md",
+    "docs/getting-started/GETTING_STARTED_80.md",
     "docs/PLATFORM_MATRIX.md",
     "docs/CROSS_ENGINE_CONSISTENCY.md",
     "docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md",
     JOINQUANT_TARGET_PACKAGE_DOC_PATH,
     "docs/TUSHARE_LOCAL_DATA.md",
+    "MIGRATION.md",
+    "ops/README.md",
+    "ops/activate_static_status.sh",
+    "ops/deploy_static_status.sh",
+    "ops/nginx/quant-os-static.conf",
+    "ops/nginx/quant-os-legacy-redirects-302.conf",
+    "ops/nginx/quant-os-legacy-redirects-308.conf",
     "runbooks/PLATFORM_DEPLOYMENT.md",
     "tools/build_release_reachability.py",
     "tools/build_public_status.py",
+    "tools/check_tracked_secrets.py",
+    "tools/inventory_local_assets.py",
 )
 
 ALLOWED_PROGRESS_STATUSES = frozenset(
@@ -704,6 +725,12 @@ def _build_evidence(project: Path) -> List[Dict[str, Any]]:
             "runbooks/PLATFORM_DEPLOYMENT.md",
             "runbook",
         ),
+        (
+            "public-status-deployment",
+            "Atomic public status deployment",
+            "ops/README.md",
+            "runbook",
+        ),
     )
     result: List[Dict[str, Any]] = []
     for evidence_id, label, raw_path, kind in records:
@@ -721,7 +748,38 @@ def _build_evidence(project: Path) -> List[Dict[str, Any]]:
     return result
 
 
-def _build_layers() -> List[Dict[str, Any]]:
+def _build_market_scope(standard: Mapping[str, Any]) -> Dict[str, Any]:
+    operating_defaults = standard.get("operating_defaults")
+    if not isinstance(operating_defaults, dict):
+        raise PublicStatusError("production-80 operating_defaults must be an object")
+    declared_scope = operating_defaults.get("declared_market_scope")
+    if not isinstance(declared_scope, dict):
+        raise PublicStatusError(
+            "production-80 declared_market_scope must be an object"
+        )
+    included = declared_scope.get("included")
+    excluded = declared_scope.get("excluded_fail_closed")
+    if included != ["SSE", "SZSE"] or excluded != ["BSE"]:
+        raise PublicStatusError(
+            "public market scope must explicitly include SSE/SZSE and fail-close BSE"
+        )
+    return {
+        "included": list(included),
+        "excludedFailClosed": list(excluded),
+        "executionScopeLabel": "沪深（上交所、深交所）",
+        "bseTradingEnabled": False,
+        "statement": (
+            "当前交易执行范围仅覆盖沪深；北交所尚未接入，"
+            "所有北交所委托必须 fail closed。"
+        ),
+    }
+
+
+def _build_layers(
+    *,
+    baseline_shadow_days: int,
+    production_shadow_days: int,
+) -> List[Dict[str, Any]]:
     return [
         {
             "id": "data",
@@ -840,7 +898,10 @@ def _build_layers() -> List[Dict[str, Any]]:
                 "authenticated evidence envelope and exact replay",
             ],
             "limitations": [
-                "无真实券商 attestation、回调/重启证明和 20 个交易日影子记录；没有实盘下单入口。"
+                "无真实券商 attestation、回调/重启证明和影子记录；"
+                f"Baseline 60 至少需要 {baseline_shadow_days} 个交易日，"
+                f"Production 80 当前缺口为同一冻结候选至少 {production_shadow_days} "
+                "个交易日；没有实盘下单入口。"
             ],
             "evidenceLinks": ["architecture", "platform-matrix", "scorecard"],
             "releaseVerified": False,
@@ -917,7 +978,12 @@ def _build_models() -> List[Dict[str, Any]]:
     ]
 
 
-def _build_next_actions(scorecard: Mapping[str, Any]) -> List[Dict[str, Any]]:
+def _build_next_actions(
+    scorecard: Mapping[str, Any],
+    *,
+    baseline_shadow_days: int,
+    production_shadow_days: int,
+) -> List[Dict[str, Any]]:
     delivery = scorecard.get("current_delivery", {})
     if not isinstance(delivery, dict):
         raise PublicStatusError("scorecard current_delivery must be an object")
@@ -958,13 +1024,17 @@ def _build_next_actions(scorecard: Mapping[str, Any]) -> List[Dict[str, Any]]:
         },
         {
             "priority": 5,
-            "title": "完成 QMT 券商合同探针与至少 20 日影子盘",
+            "title": (
+                "完成 QMT 券商合同探针与 "
+                f"Production 80 的 {production_shadow_days} 日影子盘"
+                f"（Baseline 60 门槛 {baseline_shadow_days} 日）"
+            ),
             "why": str(missing[3]),
             "gateIds": ["G6", "G8", "G9"],
         },
         {
             "priority": 6,
-            "title": "完成连续对账、恢复演练与券商合规确认",
+            "title": "完成连续对账、恢复演练与券商程序化交易报告/核查确认",
             "why": str(missing[4]),
             "gateIds": ["G8", "G10"],
         },
@@ -977,6 +1047,8 @@ def _build_freshness(
     joinquant_markdown: str,
     joinquant_target_package_run: Mapping[str, Any],
     tushare_markdown: str,
+    baseline_shadow_days: int,
+    production_shadow_days: int,
 ) -> List[Dict[str, Any]]:
     period_match = re.search(
         r"(?m)^-\s+Period:\s+"
@@ -1123,7 +1195,12 @@ def _build_freshness(
             "lastRealRuntimeAt": None,
             "value": "N/A",
             "productionReady": False,
-            "semantics": "QMT 只有 bundle/harness，XtTrader 只有 fake-broker 只读合同；尚无真实运行或 20 日影子证据。",
+            "semantics": (
+                "QMT 只有 bundle/harness，XtTrader 只有 fake-broker 只读合同；"
+                f"尚无真实运行或影子证据。Baseline 60 至少需要 "
+                f"{baseline_shadow_days} 个交易日，Production 80 当前缺口为同一"
+                f"冻结候选至少 {production_shadow_days} 个交易日。"
+            ),
             "evidenceLinks": ["platform-matrix", "platform-deployment", "scorecard"],
         },
     ]
@@ -1136,21 +1213,21 @@ def _validate_claim(scorecard: Mapping[str, Any]) -> None:
     claim = str(policy.get("current_claim", ""))
     if claim in FORBIDDEN_PUBLIC_CLAIMS:
         raise PublicStatusError(f"unsafe public release claim: {claim}")
+    if claim not in {"NOT_BASELINE_60", "BASELINE_60_VERIFIED"}:
+        raise PublicStatusError(f"unsupported baseline claim: {claim}")
+    if claim == "BASELINE_60_VERIFIED":
+        raise PublicStatusError(
+            "positive Baseline-60 publication is disabled until the "
+            "production issuer registry and signed baseline evaluator result "
+            "are implemented"
+        )
 
     gates = scorecard.get("gates")
     if not isinstance(gates, list) or not gates:
         raise PublicStatusError("scorecard gates must be a non-empty list")
     passed = sum(gate.get("status") == "passed" for gate in gates if isinstance(gate, dict))
-    threshold = int(policy.get("baseline_threshold", 60))
-    delivery = scorecard.get("current_delivery", {})
-    score = delivery.get("score") if isinstance(delivery, dict) else None
     all_passed = passed == len(gates)
 
-    if claim != "NOT_BASELINE_60":
-        if not all_passed or not isinstance(score, (int, float)) or score < threshold:
-            raise PublicStatusError(
-                "a baseline claim requires every gate passed and a threshold score"
-            )
     if claim == "NOT_BASELINE_60" and all_passed:
         raise PublicStatusError(
             "scorecard is internally inconsistent: every gate passed but claim is negative"
@@ -1187,6 +1264,135 @@ def _validate_public_payload(payload: Mapping[str, Any]) -> None:
                     )
 
 
+def _build_maturity80(
+    project: Path,
+    standard: Mapping[str, Any],
+    assessment: Mapping[str, Any],
+) -> Dict[str, Any]:
+    source_root = project / "src"
+    inserted = str(source_root) not in sys.path
+    if inserted:
+        sys.path.insert(0, str(source_root))
+    try:
+        from quant_os.evidence import (  # pylint: disable=import-outside-toplevel
+            MaturityStandardError,
+            evaluate_assessment,
+        )
+
+        try:
+            evaluation = evaluate_assessment(
+                standard,
+                assessment,
+                repository_root=project,
+            )
+        except MaturityStandardError as exc:
+            raise PublicStatusError(
+                f"production-80 assessment failed canonical verification: {exc}"
+            ) from exc
+    finally:
+        if inserted:
+            sys.path.remove(str(source_root))
+
+    controls = evaluation["controls"]
+    return {
+        "standardId": evaluation["standard_id"],
+        "standardCanonicalSha256": evaluation[
+            "standard_canonical_sha256"
+        ],
+        "baselineProfileCanonicalSha256": evaluation[
+            "baseline_profile_canonical_sha256"
+        ],
+        "assessedAsOf": evaluation["assessed_as_of"],
+        "rawScore": evaluation["raw_score"],
+        "effectiveScore": evaluation["effective_score"],
+        "maximumScore": evaluation["maximum_score"],
+        "qualificationThreshold": evaluation["qualification_threshold"],
+        "qualified": evaluation["qualified"],
+        "state": evaluation["qualification_state"],
+        "baseline60Passed": evaluation["baseline_60_passed"],
+        "structurallyEligible": evaluation["structurally_eligible"],
+        "trustedAttestationVerified": evaluation[
+            "trusted_attestation_verified"
+        ],
+        "finalAttestationVerified": evaluation[
+            "final_attestation_verified"
+        ],
+        "productionTrustRegistryAvailable": evaluation[
+            "production_trust_registry_available"
+        ],
+        "verificationEnvironment": evaluation[
+            "verification_environment"
+        ],
+        "testOnly": evaluation["test_only"],
+        "preCanaryStructurallyEligible": evaluation[
+            "pre_canary_structurally_eligible"
+        ],
+        "preCanaryAttestationVerified": evaluation[
+            "pre_canary_attestation_verified"
+        ],
+        "preCanaryAuthorized": evaluation["pre_canary_authorized"],
+        "preCanaryAuthorizationVerified": evaluation[
+            "pre_canary_attestation_verified"
+        ],
+        "preCanaryAuthorization": evaluation[
+            "pre_canary_authorization"
+        ],
+        "canaryAuthorizationChainVerified": evaluation[
+            "canary_authorization_chain_verified"
+        ],
+        "canaryObservation": evaluation["canary_observation"],
+        "canaryRunning": evaluation["canary_running"],
+        "baseline60AttestationVerified": evaluation[
+            "baseline_60_attestation_verified"
+        ],
+        "hardGateFailures": evaluation["hard_gate_failures"],
+        "domainFloorFailures": evaluation["domain_floor_failures"],
+        "prerequisites": evaluation["prerequisites"],
+        "scoreCaps": evaluation["score_caps"],
+        "domains": [
+            {
+                "id": domain["id"],
+                "name": domain["name"],
+                "score": domain["score"],
+                "weight": domain["weight"],
+                "minimumScore": domain["minimum_score"],
+                "floorPassed": domain["floor_passed"],
+            }
+            for domain in evaluation["domains"]
+        ],
+        "controls": [
+            {
+                "id": control["id"],
+                "domainId": control["domain_id"],
+                "name": control["name"],
+                "weight": control["weight"],
+                "hardGate": control["hard_gate"],
+                "status": control["status"],
+                "minimumEvidenceTier": control["minimum_evidence_tier"],
+                "note": control["note"],
+            }
+            for control in controls
+        ],
+        "controlsPassed": sum(
+            control["status"] == "passed" for control in controls
+        ),
+        "controlsTotal": len(controls),
+        "hardGatesPassed": (
+            sum(
+                control["hard_gate"] and control["status"] == "passed"
+                for control in controls
+            )
+        ),
+        "hardGatesTotal": sum(control["hard_gate"] for control in controls),
+        "evidencePolicy": (
+            "Only subject-bound evidence claims verified by a configured "
+            "trust provider, at or above each control's minimum tier, earn "
+            "points. The current repository has no production trust provider "
+            "and therefore cannot self-issue a positive qualification."
+        ),
+    }
+
+
 def build_public_status(
     project: Path,
     *,
@@ -1195,6 +1401,13 @@ def build_public_status(
 ) -> Dict[str, Any]:
     project = project.resolve()
     scorecard = _load_json(project / "gate_scorecard.json")
+    production_80_standard = _load_json(
+        project / PRODUCTION_80_STANDARD_PATH
+    )
+    production_80_assessment = _load_json(
+        project / PRODUCTION_80_ASSESSMENT_PATH
+    )
+    baseline_60_profile = _load_json(project / BASELINE_60_PROFILE_PATH)
     manifest = _load_json(project / "dist" / "bundle_manifest.json")
     reachability_manifest = _load_json(project / REACHABILITY_PATH)
     joinquant_target_package_run_raw = _load_json(
@@ -1212,6 +1425,23 @@ def build_public_status(
     )
 
     _validate_claim(scorecard)
+    try:
+        baseline_shadow_days = int(
+            baseline_60_profile["minimum_shadow_trading_days"]
+        )
+        production_shadow_days = int(
+            production_80_standard["qualification"][
+                "minimum_shadow_trading_days"
+            ]
+        )
+    except (KeyError, TypeError, ValueError) as exc:
+        raise PublicStatusError(
+            "baseline-60 and production-80 shadow requirements must be integers"
+        ) from exc
+    if baseline_shadow_days <= 0 or production_shadow_days <= baseline_shadow_days:
+        raise PublicStatusError(
+            "production-80 shadow requirement must exceed the positive baseline-60 requirement"
+        )
     audit_as_of = str(scorecard.get("audit_as_of", ""))
     try:
         datetime.strptime(audit_as_of, "%Y-%m-%d")
@@ -1271,6 +1501,11 @@ def build_public_status(
         project,
         joinquant_target_package_run_raw,
     )
+    maturity80 = _build_maturity80(
+        project,
+        production_80_standard,
+        production_80_assessment,
+    )
     source_records: List[Dict[str, str]] = []
     for relative in SOURCE_PATHS:
         safe_path = _safe_repo_path(relative, label="provenance source")
@@ -1284,6 +1519,16 @@ def build_public_status(
 
     claim_policy = scorecard["claim_policy"]
     delivery = scorecard["current_delivery"]
+    baseline_verified = (
+        claim_policy["current_claim"] == "BASELINE_60_VERIFIED"
+        and passed == len(gates)
+        and isinstance(delivery.get("score"), (int, float))
+        and delivery["score"] >= claim_policy["baseline_threshold"]
+    )
+    if bool(maturity80["baseline60Passed"]) != baseline_verified:
+        raise PublicStatusError(
+            "Baseline-60 scorecard and production-80 assessment disagree"
+        )
     internal_delivery_gaps = delivery.get("internal_delivery_gaps", [])
     external_evidence_missing = delivery.get("external_evidence_missing", [])
     if not isinstance(internal_delivery_gaps, list) or len(internal_delivery_gaps) < 3:
@@ -1312,9 +1557,11 @@ def build_public_status(
             "score": delivery.get("score"),
             "scoreStatus": str(delivery.get("status")),
             "reason": str(delivery.get("reason")),
-            "releaseVerified": False,
-            "liveReady": False,
+            "releaseVerified": baseline_verified,
+            "liveReady": bool(maturity80["qualified"]),
         },
+        "marketScope": _build_market_scope(production_80_standard),
+        "maturity80": maturity80,
         "summary": {
             "testsRecorded": test_count,
             "optionalSkipsRecorded": optional_skips,
@@ -1338,7 +1585,7 @@ def build_public_status(
                 "Tushare completed-partition Qlib momentum smoke",
             ],
             "gateCoverageLabel": f"{passed}/{len(gates)} passed",
-            "productionReady": False,
+            "productionReady": bool(maturity80["qualified"]),
             "investmentValueClaim": False,
         },
         "candidateBoundary": {
@@ -1373,7 +1620,10 @@ def build_public_status(
             "internal": [str(item) for item in internal_delivery_gaps],
             "externalEvidence": [str(item) for item in external_evidence_missing],
         },
-        "layers": _build_layers(),
+        "layers": _build_layers(
+            baseline_shadow_days=baseline_shadow_days,
+            production_shadow_days=production_shadow_days,
+        ),
         "models": _build_models(),
         "platforms": _build_platforms(platform_markdown),
         "freshness": _build_freshness(
@@ -1381,6 +1631,8 @@ def build_public_status(
             joinquant_markdown=joinquant_markdown,
             joinquant_target_package_run=joinquant_target_package_run,
             tushare_markdown=tushare_markdown,
+            baseline_shadow_days=baseline_shadow_days,
+            production_shadow_days=production_shadow_days,
         ),
         "gates": gates,
         "bundles": {
@@ -1409,9 +1661,15 @@ def build_public_status(
             },
         },
         "evidence": _build_evidence(project),
-        "nextActions": _build_next_actions(scorecard),
+        "nextActions": _build_next_actions(
+            scorecard,
+            baseline_shadow_days=baseline_shadow_days,
+            production_shadow_days=production_shadow_days,
+        ),
         "provenance": {
             "scorecard": "gate_scorecard.json",
+            "production80Standard": PRODUCTION_80_STANDARD_PATH,
+            "production80Assessment": PRODUCTION_80_ASSESSMENT_PATH,
             "bundleManifest": "dist/bundle_manifest.json",
             "releaseReachability": REACHABILITY_PATH,
             "platformMatrix": "docs/PLATFORM_MATRIX.md",
diff --git a/tools/check_tracked_secrets.py b/tools/check_tracked_secrets.py
new file mode 100644
index 0000000..280689e
--- /dev/null
+++ b/tools/check_tracked_secrets.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""Reject obvious reusable credentials without printing their values."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+PROJECT = Path(__file__).resolve().parents[1]
+PATTERNS = (
+    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
+    re.compile(r"\b(?:ghp|github_pat|glpat|gitea)_[A-Za-z0-9_-]{16,}\b"),
+    re.compile(r"https?://[^/\s:@]+:[^/\s@]{8,}@"),
+    re.compile(
+        r"(?i)\b(?:password|passwd|api[_-]?key|access[_-]?token|secret)"
+        r"\s*[:=]\s*[\"'][A-Za-z0-9+/=_-]{12,}[\"']"
+    ),
+)
+
+
+def tracked_files() -> list[Path]:
+    result = subprocess.run(
+        ["git", "ls-files", "-z"],
+        cwd=PROJECT,
+        check=True,
+        capture_output=True,
+    )
+    return [
+        PROJECT / item.decode("utf-8")
+        for item in result.stdout.split(b"\0")
+        if item
+    ]
+
+
+def main() -> int:
+    findings: list[tuple[str, int, int]] = []
+    for path in tracked_files():
+        try:
+            text = path.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            continue
+        for line_number, line in enumerate(text.splitlines(), start=1):
+            for pattern_number, pattern in enumerate(PATTERNS, start=1):
+                if pattern.search(line):
+                    findings.append(
+                        (
+                            path.relative_to(PROJECT).as_posix(),
+                            line_number,
+                            pattern_number,
+                        )
+                    )
+    if findings:
+        for path, line_number, pattern_number in findings:
+            print(
+                f"credential-like content: {path}:{line_number} "
+                f"(rule {pattern_number})",
+                file=sys.stderr,
+            )
+        return 1
+    print("tracked secret scan: OK")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/inventory_local_assets.py b/tools/inventory_local_assets.py
new file mode 100644
index 0000000..66a7c34
--- /dev/null
+++ b/tools/inventory_local_assets.py
@@ -0,0 +1,139 @@
+#!/usr/bin/env python3
+"""Build a deterministic, content-hashed inventory of ignored local assets."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+
+DEFAULT_INCLUDES = ("data", "artifacts", "mlruns")
+
+
+def _sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as handle:
+        for chunk in iter(lambda: handle.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def build_inventory(root: Path, includes: tuple[str, ...]) -> dict:
+    root = root.resolve()
+    entries: list[dict] = []
+    summaries: dict[str, dict] = {}
+    for include in includes:
+        relative = Path(include)
+        if (
+            relative.is_absolute()
+            or ".." in relative.parts
+            or len(relative.parts) != 1
+        ):
+            raise ValueError(f"unsafe include: {include}")
+        directory = root / relative
+        file_count = 0
+        total_bytes = 0
+        if directory.exists() and not directory.is_dir():
+            raise ValueError(f"include is not a directory: {include}")
+        if directory.is_dir():
+            for path in sorted(directory.rglob("*")):
+                if path.is_symlink():
+                    raise ValueError(
+                        f"symlink is not allowed in inventory: "
+                        f"{path.relative_to(root)}"
+                    )
+                if not path.is_file():
+                    continue
+                size = path.stat().st_size
+                entries.append(
+                    {
+                        "path": path.relative_to(root).as_posix(),
+                        "size": size,
+                        "sha256": _sha256(path),
+                    }
+                )
+                file_count += 1
+                total_bytes += size
+        summaries[include] = {
+            "available": directory.is_dir(),
+            "files": file_count,
+            "bytes": total_bytes,
+        }
+    body = {
+        "schema_version": "quant-os-local-assets-inventory/1.0",
+        "includes": list(includes),
+        "summaries": summaries,
+        "entries": entries,
+    }
+    body["inventory_sha256"] = hashlib.sha256(
+        json.dumps(
+            body,
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+            allow_nan=False,
+        ).encode("utf-8")
+    ).hexdigest()
+    return body
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("root", type=Path)
+    parser.add_argument(
+        "--include",
+        action="append",
+        dest="includes",
+        help="one top-level ignored directory; repeat as needed",
+    )
+    parser.add_argument("--output", type=Path)
+    parser.add_argument("--compare", type=Path)
+    args = parser.parse_args()
+    includes = tuple(args.includes or DEFAULT_INCLUDES)
+    try:
+        inventory = build_inventory(args.root, includes)
+    except (OSError, ValueError) as exc:
+        print(f"inventory failed: {exc}", file=sys.stderr)
+        return 2
+    encoded = (
+        json.dumps(
+            inventory,
+            ensure_ascii=False,
+            sort_keys=True,
+            indent=2,
+            allow_nan=False,
+        )
+        + "\n"
+    )
+    if args.compare is not None:
+        try:
+            expected = json.loads(args.compare.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as exc:
+            print(f"cannot read comparison inventory: {exc}", file=sys.stderr)
+            return 2
+        if inventory != expected:
+            print("local asset inventory differs", file=sys.stderr)
+            return 1
+    if args.output is None:
+        print(encoded, end="")
+    else:
+        args.output.write_text(encoded, encoding="utf-8")
+        print(
+            json.dumps(
+                {
+                    "ok": True,
+                    "files": len(inventory["entries"]),
+                    "inventory_sha256": inventory["inventory_sha256"],
+                    "output": args.output.name,
+                },
+                sort_keys=True,
+            )
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())