{ "schema_version": "1.0", "standard_id": "quant-os-production-80-v1", "name": "Quant OS 80-point controlled-production standard", "as_of": "2026-07-30", "maximum_score": 100, "qualification_threshold": 80, "claim_boundary": "Passing is an engineering qualification for limited personal-account production. It is not an investment-return claim, institutional licence or legal opinion.", "evidence_tiers": { "E0": { "rank": 0, "name": "assertion_or_document_only" }, "E1": { "rank": 1, "name": "deterministic_local_test_or_synthetic" }, "E2": { "rank": 2, "name": "authorized_real_data_frozen_oos_or_external_authority" }, "E3": { "rank": 3, "name": "production_operational_control_or_real_platform_shadow" }, "E4": { "rank": 4, "name": "controlled_live_observation" } }, "qualification": { "baseline_60_gates": 10, "minimum_shadow_trading_days": 60, "minimum_canary_trading_days": 10, "pre_canary_threshold": 77, "pre_canary_exempt_hard_gates": [ "D6-CANARY" ], "maximum_open_p0": 0, "maximum_open_p1": 0, "score_cap_without_baseline_60": 59, "score_cap_without_canary": 79, "all_hard_gates_required": true, "all_domain_floors_required": true, "broker_programmatic_confirmation_required": true, "real_qmt_observation_required": true, "trusted_pre_canary_authorization_required": true, "trusted_promotion_attestation_required": true }, "baseline_prerequisite": { "profile_path": "profiles/baseline-60/profile.json", "profile_id": "quant-os-baseline-60", "trusted_attestation_required": true, "minimum_evidence_tier": "E3", "claim_control_id": "BASELINE_60", "claim_evidence_type": "baseline60_qualification_attestation" }, "attestation_policy": { "claim_schema": "quant-os-evidence-claim/1.0", "standard_binding": "canonical_json_sha256", "assessment_binding": "canonical_json_sha256", "issuer_registry_required": true, "production_trust_registry": "external_runtime_configuration_required", "repository_self_issuance_allowed": false, "pre_canary": { "control_id": "PRE_CANARY_AUTHORIZATION", "evidence_type": "pre_canary_authorization_attestation", "minimum_evidence_tier": "E3", "required_authorization_fields": [ "authorization_id", "authorized_at", "expires_on", "account_scope_id", "strategy_ids", "maximum_capital_cny", "maximum_gross_notional_cny", "maximum_symbols", "symbol_allowlist", "flow_limits", "stop_conditions", "no_automatic_scale_up" ], "required_stop_conditions": [ "any_risk_data_rule_or_reconciliation_breach", "authorization_expired", "operator_kill_switch" ] }, "canary_observation": { "control_id": "D6-CANARY", "evidence_type": "controlled_live_canary_observation", "minimum_evidence_tier": "E4", "required_link_fields": [ "pre_canary_authorization_claim_id", "pre_canary_authorization_sha256", "canary_started_on", "canary_ended_on", "trading_days_observed" ], "required_observation_fields": [ "maximum_capital_cny_observed", "maximum_gross_notional_cny_observed", "symbols_observed", "maximum_submission_and_cancel_requests_per_second_observed", "maximum_submission_and_cancel_requests_per_day_observed", "automatic_scale_up_observed", "breach_events", "stop_events" ] }, "promotion": { "control_id": "QUALIFICATION", "evidence_type": "production80_promotion_attestation", "minimum_evidence_tier": "E4" } }, "operating_defaults": { "declared_market_scope": { "included": [ "SSE", "SZSE" ], "excluded_fail_closed": [ "BSE" ], "expansion_policy": "requires_effective_dated_rule_pack_and_regression_evidence_before_enablement" }, "rule_pack_contract": { "required_fields": [ "published_at", "effective_at", "implementation_status", "suspended_at", "resumed_at", "source_url", "source_sha256" ], "implementation_status_values": [ "effective", "suspended", "partially_suspended", "repealed" ], "unknown_or_suspended_behavior": "fail_closed" }, "flow_limits": { "maximum_submission_and_cancel_requests_per_second": 10, "maximum_submission_and_cancel_requests_per_day": 1000, "aggregation_scope": "per_account_and_actual_control_group", "message_count_semantics": "all_order_submission_attempts_plus_all_cancel_requests_emitted_by_quant_os", "cancellation_rate": { "review_threshold": 0.3, "numerator": "strategy_initiated_cancel_requests", "denominator": "accepted_order_submissions", "window": "trading_day_per_account_and_actual_control_group", "rejected_submissions": "excluded_from_denominator", "partial_fill_then_cancel": "included_in_numerator", "exchange_automatic_cancel": "excluded_from_numerator", "zero_denominator": "zero_rate" }, "semantics": "internal_conservative_default_not_regulatory_safe_harbor" } }, "domains": [ { "id": "D1", "name": "Data and point-in-time truth", "weight": 15, "minimum_score_ratio": 0.6, "controls": [ { "id": "D1-PIT", "name": "Production PIT dataset is complete, immutable and replayable", "weight": 4, "hard_gate": true, "minimum_evidence_tier": "E2", "acceptance": "The declared universe has effective-dated security master, membership, ST, suspension, limits, corporate actions, announcement availability and fail-closed completeness tests." }, { "id": "D1-OPS", "name": "Data licence, lineage, freshness and recovery are operational", "weight": 5, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Every source has a permitted-use record, immutable lineage, freshness SLO, quality alarms, backfill and restore evidence." }, { "id": "D1-REDUNDANCY", "name": "Critical inputs have independent validation or a tested fallback", "weight": 6, "hard_gate": false, "minimum_evidence_tier": "E3", "acceptance": "A second source or independent control total detects material provider drift and the fallback path is rehearsed." } ] }, { "id": "D2", "name": "Research and model governance", "weight": 15, "minimum_score_ratio": 0.6, "controls": [ { "id": "D2-OOS", "name": "Frozen real-data walk-forward and OOS evidence is valid", "weight": 4, "hard_gate": true, "minimum_evidence_tier": "E2", "acceptance": "Purge and embargo, untouched test data, A-share constraints, dated fees, impact, capacity and pre-registered mandate thresholds are all frozen and reproducible." }, { "id": "D2-MODEL", "name": "Model, feature and release identities are governed", "weight": 5, "hard_gate": true, "minimum_evidence_tier": "E2", "acceptance": "Registry records dataset, feature schema, code, config, training cutoff, model hash, owner, approval, rollback and expiry." }, { "id": "D2-CHALLENGER", "name": "Champion, challenger, drift and experiment selection are controlled", "weight": 6, "hard_gate": false, "minimum_evidence_tier": "E3", "acceptance": "Selection policy is pre-registered; drift and degradation alerts can demote or roll back without touching a hidden test set." } ] }, { "id": "D3", "name": "Cross-engine consistency", "weight": 10, "minimum_score_ratio": 0.6, "controls": [ { "id": "D3-LAYERS", "name": "Local, JoinQuant and QMT share frozen L1-L5 identities; Qlib follows its declared comparison scope", "weight": 6, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Local, JoinQuant and QMT strict peers produce identical signals and post-risk target weights under one dual-clock and versioned rule contract. Qlib compares L1/L2 only unless the same frozen model and portfolio implementation are explicitly exported; an unrelated Alpha158 workflow is never claimed as an L3/L4 peer." }, { "id": "D3-DIFF", "name": "Order and fill differences are completely explained", "weight": 4, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Multi-period difference ledgers account for price source, lot, fee, limit, fill and broker-state effects with zero unexplained residual." } ] }, { "id": "D4", "name": "Execution and independent risk", "weight": 15, "minimum_score_ratio": 0.6, "controls": [ { "id": "D4-RISK", "name": "Independent pre-trade risk fails closed", "weight": 3, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "No strategy can bypass cash, sellable, permission, price, quantity, duplicate-order, concentration, turnover, loss and kill-switch checks." }, { "id": "D4-RULES", "name": "Effective-dated SSE/SZSE rule packs are current; BSE remains fail-closed", "weight": 4, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "The declared scope is SSE and SZSE; BSE is explicitly excluded and fails closed until its own rule pack is qualified. Every market, board and security-type rule records publication, effective, suspension, resumption and repeal state plus source hash. Regressions cover the 2026-07-06 rules and SSE provisions that remain suspended; unknown, expired or suspended behavior blocks submission." }, { "id": "D4-OMS", "name": "Order lifecycle is idempotent and restart-safe", "weight": 3, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "New, accepted, partial, rejected, cancelled and duplicate callbacks reconcile across disconnect, retry, restart and session rollover." }, { "id": "D4-TCA", "name": "Real fills drive TCA and capacity feedback", "weight": 5, "hard_gate": false, "minimum_evidence_tier": "E4", "acceptance": "Arrival, implementation shortfall, spread, impact and participation are measured against actual fills and feed governed limit changes." } ] }, { "id": "D5", "name": "Real QMT and broker truth", "weight": 15, "minimum_score_ratio": 0.6, "controls": [ { "id": "D5-QMT", "name": "Authorized QMT account contracts are observed end to end", "weight": 5, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Read-only, simulation and explicitly enabled mutation phases cover query fields, callbacks, reject, partial fill, cancel, reconnect and cross-day recovery." }, { "id": "D5-RECON", "name": "Cash, positions, sellable, orders and fills reconcile daily", "weight": 5, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Every trading day has 100% identity reconciliation and zero unexplained difference; a difference or stale snapshot blocks new risk." }, { "id": "D5-EVIDENCE", "name": "Broker facts and callbacks have authenticated replay evidence", "weight": 2, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Append-only envelopes bind run, account pseudonym, source time, sequence, data, model, config, code, order and callback identities." }, { "id": "D5-FALLBACK", "name": "Manual broker fallback and operator handoff are rehearsed", "weight": 3, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "The owner can freeze automation, inspect broker truth and complete or cancel risk safely without hidden automation." } ] }, { "id": "D6", "name": "Operations, disaster recovery and audit", "weight": 15, "minimum_score_ratio": 0.6, "controls": [ { "id": "D6-SHADOW", "name": "The frozen candidate completes 60 trading days of shadow", "weight": 4, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "The same core strategy, risk and adapter release runs for at least 60 trading days with zero open P0/P1 and daily reconciliation; a material change resets the clock." }, { "id": "D6-CANARY", "name": "Limited capital canary completes at least 10 trading days", "weight": 3, "hard_gate": true, "minimum_evidence_tier": "E4", "acceptance": "Capital, gross notional, symbols, account, strategy and submission/cancel flow remain within the cited pre-canary authorization; there is no automatic scale-up, and every risk, data, rule or reconciliation breach is linked to a fail-closed stop event." }, { "id": "D6-DR", "name": "Failure recovery meets RPO and RTO targets", "weight": 5, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Order and fill RPO is zero, trading-window RTO is at most 15 minutes, and network, crash, stale market, corrupt state and duplicate-message drills pass." }, { "id": "D6-RELEASE", "name": "Build, promotion, rollback and audit are reproducible", "weight": 3, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "A clean build emits signed manifests and dependency inventory; promotion is approved, atomic, observable and rollback-tested." } ] }, { "id": "D7", "name": "Compliance and security", "weight": 15, "minimum_score_ratio": 0.6, "controls": [ { "id": "D7-SCOPE", "name": "Account and business scope remains personal proprietary", "weight": 3, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "A private attestation is bound to broker KYC or account-ownership evidence and an access review. Third-party money, accepting a mandate to decide or execute trades for another person, providing paid investment advice to others, or sharing trade-control authority blocks this profile and triggers a documented legal/compliance applicability review. Purchasing or reading third-party research does not by itself constitute a third-party trading mandate." }, { "id": "D7-REPORT", "name": "Broker programmatic-trading report matches the deployed release", "weight": 4, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "The broker has confirmed first reporting and the deployed strategy, software version, developer, capital, leverage and declared rates match the reported facts; material changes are registered before activation." }, { "id": "D7-FLOW", "name": "Abnormal-trading and conservative flow controls are enforced", "weight": 3, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Per account and actual-control account group, monitoring covers order-submission attempts, cancel requests, one-second cancellation, price impact, trade share, self-trade and reverse trade. The versioned daily-baseline policy counts every Quant OS submission attempt plus cancel request and permits no more than 10 such messages per second or 1000 per trading day. A strategy-initiated cancel-request count divided by accepted order submissions at or above 30% triggers review; rejected submissions are excluded from that denominator, partial-fill-then-cancel is included in the numerator, and exchange automatic cancellation is excluded. Stricter broker or exchange limits prevail and no internal limit claims regulatory safety." }, { "id": "D7-SECURITY", "name": "Secrets, access, personal data and supply chain are controlled", "weight": 2, "hard_gate": true, "minimum_evidence_tier": "E3", "acceptance": "Credentials remain in an approved secret store, access is least-privilege and revocable, logs are redacted, dependencies are inventoried, and Colab/public artifacts contain no account facts." }, { "id": "D7-REGULATED", "name": "A future regulated-mode rule calendar is maintained", "weight": 3, "hard_gate": false, "minimum_evidence_tier": "E2", "acceptance": "An effective-dated calendar records official URLs, publication and effective dates, retrieval date, content hash and review cadence. External capital or clients always block PERSONAL_PROPRIETARY and trigger a documented legal/compliance applicability determination; private-fund, disclosure, retention or licensed-operation obligations are activated only when that determination finds them applicable." } ] } ] }