1789 lines
69 KiB
Python
1789 lines
69 KiB
Python
#!/usr/bin/env python3
|
||
"""Build the deterministic, deliberately non-secret Quant OS public status data."""
|
||
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import hashlib
|
||
import json
|
||
import os
|
||
import re
|
||
import sys
|
||
from datetime import datetime, timezone
|
||
from pathlib import Path
|
||
from typing import Any, Dict, Iterable, List, Mapping, Sequence, Tuple
|
||
|
||
|
||
PROJECT = Path(__file__).resolve().parents[1]
|
||
DEFAULT_OUTPUT = PROJECT / "status" / "status-data.js"
|
||
GLOBAL_NAME = "QUANT_OS_PUBLIC_STATUS"
|
||
SCHEMA_VERSION = 2
|
||
PRODUCTION_80_STANDARD_PATH = "profiles/production-80/standard.json"
|
||
PRODUCTION_80_ASSESSMENT_PATH = (
|
||
"profiles/production-80/current-assessment.json"
|
||
)
|
||
BASELINE_60_PROFILE_PATH = "profiles/baseline-60/profile.json"
|
||
REACHABILITY_PATH = (
|
||
"releases/quant60-research-candidate-v1/reachability.json"
|
||
)
|
||
JOINQUANT_TARGET_PACKAGE_RUN_PATH = (
|
||
"evidence/joinquant/TP-20240311-795dcfba/"
|
||
"2457a7c39a276e09e0fabf99e28978e1/run.json"
|
||
)
|
||
JOINQUANT_TARGET_PACKAGE_DOC_PATH = (
|
||
"docs/JOINQUANT_TARGET_PACKAGE_EVIDENCE_2026-07-26.md"
|
||
)
|
||
JOINQUANT_TARGET_PACKAGE_RUN_ID = "2457a7c39a276e09e0fabf99e28978e1"
|
||
JOINQUANT_TARGET_PACKAGE_OBSERVED_AT = "2026-07-26T08:50:15Z"
|
||
JOINQUANT_TARGET_PACKAGE_BUNDLE_SHA256 = (
|
||
"0586930ddc483f4489f09b562f4d4232b458b703e6a1194af809b707211be8c4"
|
||
)
|
||
|
||
SOURCE_PATHS: Tuple[str, ...] = (
|
||
"gate_scorecard.json",
|
||
BASELINE_60_PROFILE_PATH,
|
||
PRODUCTION_80_STANDARD_PATH,
|
||
PRODUCTION_80_ASSESSMENT_PATH,
|
||
"dist/bundle_manifest.json",
|
||
REACHABILITY_PATH,
|
||
JOINQUANT_TARGET_PACKAGE_RUN_PATH,
|
||
"configs/baseline.json",
|
||
"README.md",
|
||
"docs/ARCHITECTURE.md",
|
||
"docs/architecture/ARCHITECTURE_80.md",
|
||
"docs/AUDIT_2026-07-25.md",
|
||
"docs/standards/QUANT_OS_80_STANDARD.md",
|
||
"docs/standards/BASELINE_60_VS_PRODUCTION_80.md",
|
||
"docs/getting-started/GETTING_STARTED_80.md",
|
||
"docs/PLATFORM_MATRIX.md",
|
||
"docs/CROSS_ENGINE_CONSISTENCY.md",
|
||
"docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md",
|
||
JOINQUANT_TARGET_PACKAGE_DOC_PATH,
|
||
"docs/TUSHARE_LOCAL_DATA.md",
|
||
"MIGRATION.md",
|
||
"ops/README.md",
|
||
"ops/activate_static_status.sh",
|
||
"ops/deploy_static_status.sh",
|
||
"ops/nginx/quant-os-static.conf",
|
||
"ops/nginx/quant-os-legacy-redirects-302.conf",
|
||
"ops/nginx/quant-os-legacy-redirects-308.conf",
|
||
"runbooks/PLATFORM_DEPLOYMENT.md",
|
||
"tools/build_release_reachability.py",
|
||
"tools/build_public_status.py",
|
||
"tools/check_tracked_secrets.py",
|
||
"tools/inventory_local_assets.py",
|
||
)
|
||
|
||
ALLOWED_PROGRESS_STATUSES = frozenset(
|
||
{"implemented", "tested", "real_runtime", "blocked"}
|
||
)
|
||
FORBIDDEN_PUBLIC_CLAIMS = frozenset({"RELEASE_VERIFIED", "LIVE_READY"})
|
||
SENSITIVE_KEY_PARTS = (
|
||
"password",
|
||
"passwd",
|
||
"secret",
|
||
"token",
|
||
"cookie",
|
||
"credential",
|
||
"account_id",
|
||
"userdata_path",
|
||
"api_key",
|
||
"private_key",
|
||
)
|
||
ABSOLUTE_PATH_PATTERN = re.compile(
|
||
r"(?:(?<=^)|(?<=[\s\"'=:(]))"
|
||
r"(?:/(?:Users|home|root|private|var|tmp)/|[A-Za-z]:[\\/])"
|
||
)
|
||
|
||
|
||
class PublicStatusError(ValueError):
|
||
"""Raised when a source cannot support a safe public claim."""
|
||
|
||
|
||
def _sha256_bytes(data: bytes) -> str:
|
||
return hashlib.sha256(data).hexdigest()
|
||
|
||
|
||
def _canonical_json(value: Any) -> bytes:
|
||
return (
|
||
json.dumps(
|
||
value,
|
||
ensure_ascii=False,
|
||
sort_keys=True,
|
||
separators=(",", ":"),
|
||
)
|
||
+ "\n"
|
||
).encode("utf-8")
|
||
|
||
|
||
def _load_json(path: Path) -> Dict[str, Any]:
|
||
try:
|
||
value = json.loads(path.read_text(encoding="utf-8"))
|
||
except (OSError, json.JSONDecodeError) as exc:
|
||
raise PublicStatusError(f"cannot load required JSON source {path.name}: {exc}")
|
||
if not isinstance(value, dict):
|
||
raise PublicStatusError(f"{path.name} must contain one JSON object")
|
||
return value
|
||
|
||
|
||
def _safe_repo_path(value: Any, *, label: str) -> str:
|
||
path = str(value)
|
||
candidate = Path(path)
|
||
if (
|
||
not path
|
||
or candidate.is_absolute()
|
||
or ".." in candidate.parts
|
||
or "\\" in path
|
||
or ABSOLUTE_PATH_PATTERN.search(path)
|
||
):
|
||
raise PublicStatusError(f"{label} is not a safe repository-relative path")
|
||
return candidate.as_posix()
|
||
|
||
|
||
def _strip_markdown(value: str) -> str:
|
||
value = re.sub(r"\[([^\]]+)\]\([^)]+\)", r"\1", value)
|
||
value = re.sub(r"`([^`]*)`", r"\1", value)
|
||
value = re.sub(r"\*\*([^*]+)\*\*", r"\1", value)
|
||
return " ".join(value.split())
|
||
|
||
|
||
def _parse_markdown_table(markdown: str, heading: str) -> List[List[str]]:
|
||
lines = markdown.splitlines()
|
||
try:
|
||
header_index = next(
|
||
index for index, line in enumerate(lines) if line.strip() == heading
|
||
)
|
||
except StopIteration as exc:
|
||
raise PublicStatusError(f"required Markdown table is missing: {heading}") from exc
|
||
|
||
if header_index + 1 >= len(lines):
|
||
raise PublicStatusError(f"Markdown table has no separator: {heading}")
|
||
|
||
separator = lines[header_index + 1].strip()
|
||
if not separator.startswith("|") or "---" not in separator:
|
||
raise PublicStatusError(f"Markdown table has an invalid separator: {heading}")
|
||
|
||
rows: List[List[str]] = []
|
||
for line in lines[header_index + 2 :]:
|
||
stripped = line.strip()
|
||
if not stripped.startswith("|"):
|
||
break
|
||
cells = [_strip_markdown(cell.strip()) for cell in stripped.strip("|").split("|")]
|
||
rows.append(cells)
|
||
if not rows:
|
||
raise PublicStatusError(f"Markdown table has no data rows: {heading}")
|
||
return rows
|
||
|
||
|
||
def _slug(value: str) -> str:
|
||
slug = re.sub(r"[^a-z0-9]+", "-", value.lower()).strip("-")
|
||
if not slug:
|
||
raise PublicStatusError(f"cannot derive public id from {value!r}")
|
||
return slug
|
||
|
||
|
||
def _resolve_generated_at(
|
||
*, explicit: str | None, source_date_epoch: str | None, audit_as_of: str
|
||
) -> Tuple[str, str]:
|
||
if explicit:
|
||
raw = explicit
|
||
source = "argument"
|
||
elif source_date_epoch is not None:
|
||
try:
|
||
epoch = int(source_date_epoch)
|
||
except ValueError as exc:
|
||
raise PublicStatusError("SOURCE_DATE_EPOCH must be an integer") from exc
|
||
if epoch < 0:
|
||
raise PublicStatusError("SOURCE_DATE_EPOCH must not be negative")
|
||
return (
|
||
datetime.fromtimestamp(epoch, timezone.utc)
|
||
.replace(microsecond=0)
|
||
.isoformat()
|
||
.replace("+00:00", "Z"),
|
||
"source_date_epoch",
|
||
)
|
||
else:
|
||
raw = f"{audit_as_of}T00:00:00Z"
|
||
source = "audit_as_of"
|
||
|
||
try:
|
||
parsed = datetime.fromisoformat(raw.replace("Z", "+00:00"))
|
||
except ValueError as exc:
|
||
raise PublicStatusError(
|
||
"--generated-at must be an ISO-8601 timestamp with a timezone"
|
||
) from exc
|
||
if parsed.tzinfo is None:
|
||
raise PublicStatusError("--generated-at must include a timezone")
|
||
normalized = (
|
||
parsed.astimezone(timezone.utc)
|
||
.replace(microsecond=0)
|
||
.isoformat()
|
||
.replace("+00:00", "Z")
|
||
)
|
||
return normalized, source
|
||
|
||
|
||
def _verify_file_hash(project: Path, relative_path: str, expected: str) -> None:
|
||
path = project / _safe_repo_path(relative_path, label="bundle path")
|
||
if not path.is_file():
|
||
raise PublicStatusError(f"bundle source is missing: {relative_path}")
|
||
actual = _sha256_bytes(path.read_bytes())
|
||
if actual != expected:
|
||
raise PublicStatusError(
|
||
f"bundle manifest drift for {relative_path}: expected {expected}, got {actual}"
|
||
)
|
||
|
||
|
||
def _validate_bundle_manifest(
|
||
project: Path, manifest: Mapping[str, Any]
|
||
) -> List[Dict[str, Any]]:
|
||
baseline_path = _safe_repo_path(
|
||
manifest.get("baseline_config"), label="baseline_config"
|
||
)
|
||
baseline_sha = str(manifest.get("baseline_config_sha256", ""))
|
||
_verify_file_hash(project, baseline_path, baseline_sha)
|
||
|
||
core_sha = str(manifest.get("portable_core_sha256", ""))
|
||
artifacts = manifest.get("artifacts")
|
||
if not isinstance(artifacts, dict) or not artifacts:
|
||
raise PublicStatusError("bundle manifest artifacts must be a non-empty object")
|
||
|
||
public_artifacts: List[Dict[str, Any]] = []
|
||
for artifact_id, raw in sorted(artifacts.items()):
|
||
if not isinstance(raw, dict):
|
||
raise PublicStatusError(f"bundle artifact {artifact_id} must be an object")
|
||
core = _safe_repo_path(raw.get("core"), label=f"{artifact_id}.core")
|
||
wrapper = _safe_repo_path(raw.get("wrapper"), label=f"{artifact_id}.wrapper")
|
||
output = _safe_repo_path(raw.get("output"), label=f"{artifact_id}.output")
|
||
core_artifact_sha = str(raw.get("core_sha256", ""))
|
||
wrapper_sha = str(raw.get("wrapper_sha256", ""))
|
||
output_sha = str(raw.get("output_sha256", ""))
|
||
config_sha = str(raw.get("effective_config_sha256", ""))
|
||
for path, digest in (
|
||
(core, core_artifact_sha),
|
||
(wrapper, wrapper_sha),
|
||
(output, output_sha),
|
||
):
|
||
_verify_file_hash(project, path, digest)
|
||
if core_artifact_sha != core_sha:
|
||
raise PublicStatusError(
|
||
f"{artifact_id} portable core hash differs from bundle manifest"
|
||
)
|
||
public_artifacts.append(
|
||
{
|
||
"id": str(artifact_id),
|
||
"core": core,
|
||
"coreSha256": core_artifact_sha,
|
||
"effectiveConfigSha256": config_sha,
|
||
"output": output,
|
||
"outputSha256": output_sha,
|
||
"wrapper": wrapper,
|
||
"wrapperSha256": wrapper_sha,
|
||
"integrity": "manifest_hashes_match_repository",
|
||
}
|
||
)
|
||
return public_artifacts
|
||
|
||
|
||
def _validate_reachability_manifest(
|
||
project: Path, manifest: Mapping[str, Any]
|
||
) -> Dict[str, Any]:
|
||
source_root = project / "src"
|
||
inserted = str(source_root) not in sys.path
|
||
if inserted:
|
||
sys.path.insert(0, str(source_root))
|
||
try:
|
||
from quant60.release_reachability import ( # pylint: disable=import-outside-toplevel
|
||
ReleaseReachabilityError,
|
||
validate_release_reachability,
|
||
)
|
||
|
||
try:
|
||
manifest = validate_release_reachability(
|
||
manifest,
|
||
repository_root=project,
|
||
expected_release_id="quant60-research-candidate-v1",
|
||
)
|
||
except ReleaseReachabilityError as exc:
|
||
raise PublicStatusError(
|
||
f"release reachability manifest failed canonical verification: {exc}"
|
||
) from exc
|
||
finally:
|
||
if inserted:
|
||
sys.path.remove(str(source_root))
|
||
|
||
expected_layers = {"universe", "alpha", "portfolio", "risk", "execution"}
|
||
expected_capabilities = {
|
||
"implemented",
|
||
"unit_tested",
|
||
"local_entrypoint_reachable",
|
||
"jq_entrypoint_reachable",
|
||
"qmt_entrypoint_reachable",
|
||
"real_platform_observed",
|
||
}
|
||
declared_sha = str(manifest.get("manifest_sha256", ""))
|
||
body = {
|
||
key: value
|
||
for key, value in manifest.items()
|
||
if key != "manifest_sha256"
|
||
}
|
||
body_bytes = json.dumps(
|
||
body,
|
||
ensure_ascii=False,
|
||
sort_keys=True,
|
||
separators=(",", ":"),
|
||
).encode("utf-8")
|
||
actual_sha = _sha256_bytes(body_bytes)
|
||
if not re.fullmatch(r"[0-9a-f]{64}", declared_sha) or declared_sha != actual_sha:
|
||
raise PublicStatusError("release reachability manifest self-hash is invalid")
|
||
|
||
layers = manifest.get("layers")
|
||
if not isinstance(layers, dict) or set(layers) != expected_layers:
|
||
raise PublicStatusError(
|
||
"release reachability manifest must contain the canonical five layers"
|
||
)
|
||
calculated_summary: Dict[str, bool] = {}
|
||
real_platforms: set[str] = set()
|
||
real_platform_observed_layers: set[str] = set()
|
||
for capability in sorted(expected_capabilities):
|
||
statuses: List[bool] = []
|
||
for layer in sorted(expected_layers):
|
||
claims = layers[layer]
|
||
if not isinstance(claims, dict) or set(claims) != expected_capabilities:
|
||
raise PublicStatusError(
|
||
f"release reachability claims are incomplete for {layer}"
|
||
)
|
||
claim = claims[capability]
|
||
if not isinstance(claim, dict) or not isinstance(
|
||
claim.get("status"), bool
|
||
):
|
||
raise PublicStatusError(
|
||
f"release reachability status is invalid for {layer}.{capability}"
|
||
)
|
||
artifacts = claim.get("artifacts")
|
||
if not isinstance(artifacts, list):
|
||
raise PublicStatusError(
|
||
f"release reachability artifacts are invalid for {layer}.{capability}"
|
||
)
|
||
status = claim["status"]
|
||
if status != bool(artifacts):
|
||
raise PublicStatusError(
|
||
f"release reachability evidence/status mismatch for "
|
||
f"{layer}.{capability}"
|
||
)
|
||
for index, artifact in enumerate(artifacts):
|
||
if not isinstance(artifact, dict):
|
||
raise PublicStatusError(
|
||
f"release reachability artifact is invalid for "
|
||
f"{layer}.{capability}[{index}]"
|
||
)
|
||
path = _safe_repo_path(
|
||
artifact.get("path"),
|
||
label=f"{layer}.{capability}[{index}].path",
|
||
)
|
||
_verify_file_hash(project, path, str(artifact.get("sha256", "")))
|
||
if capability == "real_platform_observed":
|
||
real_platforms.add(str(artifact.get("platform", "")))
|
||
real_platform_observed_layers.add(layer)
|
||
statuses.append(status)
|
||
calculated_summary[f"all_layers_{capability}"] = all(statuses)
|
||
|
||
summary = manifest.get("summary")
|
||
if not isinstance(summary, dict) or summary != calculated_summary:
|
||
raise PublicStatusError(
|
||
"release reachability summary does not match per-layer claims"
|
||
)
|
||
if (
|
||
real_platforms != {"joinquant"}
|
||
or real_platform_observed_layers != {"execution"}
|
||
or calculated_summary["all_layers_real_platform_observed"]
|
||
):
|
||
raise PublicStatusError(
|
||
"current release may claim only JoinQuant execution observation"
|
||
)
|
||
release_id = str(manifest.get("release_id", ""))
|
||
if release_id != "quant60-research-candidate-v1":
|
||
raise PublicStatusError("unexpected release reachability release_id")
|
||
return {
|
||
"releaseId": release_id,
|
||
"manifest": REACHABILITY_PATH,
|
||
"manifestSha256": declared_sha,
|
||
"summary": calculated_summary,
|
||
"realPlatformsObserved": sorted(
|
||
platform for platform in real_platforms if platform
|
||
),
|
||
"realPlatformObservedLayers": sorted(real_platform_observed_layers),
|
||
}
|
||
|
||
|
||
def _validate_joinquant_target_package_run(
|
||
project: Path,
|
||
run: Mapping[str, Any],
|
||
) -> Dict[str, Any]:
|
||
"""Validate the narrow, redacted hosted execution observation."""
|
||
|
||
if run.get("record_type") != "joinquant_target_package_execution_smoke":
|
||
raise PublicStatusError("unexpected JoinQuant TargetPackage run type")
|
||
if run.get("platform") != "joinquant" or run.get("status") != "completed":
|
||
raise PublicStatusError("JoinQuant TargetPackage run is not completed")
|
||
if (
|
||
run.get("platform_evidence_class") != "real_platform_runtime"
|
||
or run.get("input_evidence_class") != "synthetic-research"
|
||
or run.get("performance_claim") is not False
|
||
):
|
||
raise PublicStatusError(
|
||
"JoinQuant TargetPackage evidence classes are unsafe"
|
||
)
|
||
if run.get("run_id") != JOINQUANT_TARGET_PACKAGE_RUN_ID:
|
||
raise PublicStatusError("unexpected JoinQuant TargetPackage run identity")
|
||
if run.get("observed_at") != JOINQUANT_TARGET_PACKAGE_OBSERVED_AT:
|
||
raise PublicStatusError("unexpected JoinQuant TargetPackage observation time")
|
||
|
||
backtest = run.get("backtest")
|
||
if not isinstance(backtest, dict):
|
||
raise PublicStatusError("JoinQuant TargetPackage backtest must be an object")
|
||
expected_url = (
|
||
"https://www.joinquant.com/algorithm/backtest/detail?backtestId="
|
||
+ JOINQUANT_TARGET_PACKAGE_RUN_ID
|
||
)
|
||
expected_backtest = {
|
||
"id": JOINQUANT_TARGET_PACKAGE_RUN_ID,
|
||
"url": expected_url,
|
||
"start_date": "2024-03-11",
|
||
"end_date": "2024-03-13",
|
||
"initial_capital_cny": 1_000_000,
|
||
"frequency": "day",
|
||
"python": "Python3",
|
||
"benchmark": "000905.XSHG",
|
||
"timezone": "Asia/Shanghai",
|
||
}
|
||
if backtest != expected_backtest:
|
||
raise PublicStatusError("JoinQuant TargetPackage settings drifted")
|
||
|
||
identity = run.get("artifact_identity")
|
||
if not isinstance(identity, dict):
|
||
raise PublicStatusError("JoinQuant TargetPackage identity must be an object")
|
||
expected_identity = {
|
||
"bundle_sha256": JOINQUANT_TARGET_PACKAGE_BUNDLE_SHA256,
|
||
"browser_snapshot_sha256": JOINQUANT_TARGET_PACKAGE_BUNDLE_SHA256,
|
||
"exact_browser_match": True,
|
||
"bundle_manifest_sha256": (
|
||
"91f4b4dc0bdd0d9f99b3466c830600e2678be78dd991d4499a4154bffec8597a"
|
||
),
|
||
"portable_core_sha256": (
|
||
"f9de9f18e4008bb0fc80edb0b21cae6ea06a61828d89e9b7c11057f98225fc19"
|
||
),
|
||
"wrapper_sha256": (
|
||
"0c672b64665b7c1d4409ba288b00d1608e976800af3a4f9a6467767ce4def592"
|
||
),
|
||
}
|
||
if identity != expected_identity:
|
||
raise PublicStatusError("JoinQuant TargetPackage artifact identity drifted")
|
||
|
||
target_package = run.get("target_package")
|
||
if not isinstance(target_package, dict):
|
||
raise PublicStatusError("JoinQuant TargetPackage identity is missing")
|
||
if (
|
||
target_package.get("package_id") != "TP-20240311-795dcfba"
|
||
or target_package.get("evidence_class") != "synthetic-research"
|
||
or target_package.get("package_sha256")
|
||
!= "baa15c8156aa6cb54d3775d0cd562613a9d0a4f15b0c39f2a60e0f8b8c6f1f3a"
|
||
or target_package.get("tape_sha256")
|
||
!= "5383c376951637b8d4b1ca42fc6db80347abda74c0181c0f70d6c411fb97ea64"
|
||
):
|
||
raise PublicStatusError("JoinQuant TargetPackage lineage drifted")
|
||
|
||
sessions = run.get("session_observations")
|
||
if not isinstance(sessions, list) or [
|
||
(item.get("date"), item.get("event"), item.get("orders"), item.get("fills"))
|
||
for item in sessions
|
||
if isinstance(item, dict)
|
||
] != [
|
||
("2024-03-11", "TARGET_PACKAGE_NOOP", 0, 0),
|
||
("2024-03-12", "TARGET_PACKAGE_HIT", 3, 3),
|
||
("2024-03-13", "TARGET_PACKAGE_NOOP", 0, 0),
|
||
]:
|
||
raise PublicStatusError("JoinQuant TargetPackage session evidence drifted")
|
||
if run.get("counts") != {
|
||
"orders": 3,
|
||
"fills": 3,
|
||
"skipped_orders": 0,
|
||
}:
|
||
raise PublicStatusError("JoinQuant TargetPackage order/fill counts drifted")
|
||
|
||
boundary = run.get("claim_boundary")
|
||
if not isinstance(boundary, dict):
|
||
raise PublicStatusError("JoinQuant TargetPackage claim boundary is missing")
|
||
required_false = (
|
||
"upstream_layers_real_platform_observed",
|
||
"authorized_real_data_oos_observed",
|
||
"qmt_peer_observed",
|
||
"same_input_cross_engine_parity_observed",
|
||
"all_five_layers_real_platform_observed",
|
||
"g9_passed",
|
||
"baseline_60_passed",
|
||
"release_verified",
|
||
"investment_value_claim",
|
||
)
|
||
if boundary.get("real_platform_observed_layers") != ["execution"] or any(
|
||
boundary.get(field) is not False for field in required_false
|
||
):
|
||
raise PublicStatusError(
|
||
"JoinQuant TargetPackage run overclaims its evidence boundary"
|
||
)
|
||
performance = run.get("performance")
|
||
if (
|
||
not isinstance(performance, dict)
|
||
or performance.get("investment_value_claim") is not False
|
||
or performance.get("scope") != "three-session execution wiring smoke only"
|
||
):
|
||
raise PublicStatusError(
|
||
"JoinQuant TargetPackage performance boundary is unsafe"
|
||
)
|
||
|
||
path = _safe_repo_path(
|
||
JOINQUANT_TARGET_PACKAGE_RUN_PATH,
|
||
label="JoinQuant TargetPackage run",
|
||
)
|
||
if not (project / path).is_file():
|
||
raise PublicStatusError("tracked JoinQuant TargetPackage run is missing")
|
||
return {
|
||
"runId": JOINQUANT_TARGET_PACKAGE_RUN_ID,
|
||
"observedAt": JOINQUANT_TARGET_PACKAGE_OBSERVED_AT,
|
||
"marketDataFrom": backtest["start_date"],
|
||
"marketDataThrough": backtest["end_date"],
|
||
"bundleSha256": identity["bundle_sha256"],
|
||
"packageId": target_package["package_id"],
|
||
"evidenceClass": target_package["evidence_class"],
|
||
"orders": 3,
|
||
"fills": 3,
|
||
"observedLayers": ["execution"],
|
||
"allFiveLayersObserved": False,
|
||
"qmtPeerObserved": False,
|
||
"g9Passed": False,
|
||
"baseline60Passed": False,
|
||
"investmentValueClaim": False,
|
||
}
|
||
|
||
|
||
def _extract_test_summary(facts: Sequence[Any]) -> Tuple[int | None, int | None]:
|
||
for fact in facts:
|
||
text = str(fact)
|
||
match = re.search(
|
||
r"completed\s+(\d+)\s+tests.*?(\d+)\s+optional-runtime skips",
|
||
text,
|
||
flags=re.IGNORECASE,
|
||
)
|
||
if match:
|
||
return int(match.group(1)), int(match.group(2))
|
||
return None, None
|
||
|
||
|
||
def _platform_status(name: str) -> str:
|
||
mapping = {
|
||
"Local synthetic execution": "tested",
|
||
"Local synthetic research": "tested",
|
||
"JQData ingestion": "tested",
|
||
"Snapshot local backtest": "tested",
|
||
"Snapshot decision": "tested",
|
||
"Colab": "tested",
|
||
"JoinQuant local harness": "tested",
|
||
"JoinQuant hosted bundle": "real_runtime",
|
||
"QMT local harness": "tested",
|
||
"QMT built-in bundle": "implemented",
|
||
"qmttools runner": "implemented",
|
||
"XtTrader read-only shadow": "tested",
|
||
"Qlib native momentum": "real_runtime",
|
||
"Qlib Alpha158/LightGBM": "real_runtime",
|
||
"Tushare local → Qlib": "real_runtime",
|
||
"Mock parity exporter": "tested",
|
||
}
|
||
try:
|
||
return mapping[name]
|
||
except KeyError as exc:
|
||
raise PublicStatusError(
|
||
f"PLATFORM_MATRIX has an unmapped capability row: {name}"
|
||
) from exc
|
||
|
||
|
||
def _platform_evidence_links(name: str) -> List[str]:
|
||
links = ["platform-matrix"]
|
||
if "JoinQuant" in name:
|
||
links.extend(
|
||
(
|
||
"joinquant-hosted-evidence",
|
||
"joinquant-target-package-evidence",
|
||
"joinquant-target-package-run",
|
||
)
|
||
)
|
||
if "Qlib" in name or "Tushare" in name:
|
||
links.append("tushare-data")
|
||
if "QMT" in name or "XtTrader" in name:
|
||
links.append("platform-deployment")
|
||
return list(dict.fromkeys(links))
|
||
|
||
|
||
def _build_platforms(platform_markdown: str) -> List[Dict[str, Any]]:
|
||
rows = _parse_markdown_table(
|
||
platform_markdown,
|
||
"| Path | Intended use | Runtime / prerequisite | Current verified fact | Missing release evidence |",
|
||
)
|
||
platforms: List[Dict[str, Any]] = []
|
||
for row in rows:
|
||
if len(row) != 5:
|
||
raise PublicStatusError(
|
||
"PLATFORM_MATRIX capability rows must have exactly five columns"
|
||
)
|
||
name, intended_use, prerequisite, verified_fact, missing = row
|
||
status = _platform_status(name)
|
||
if status not in ALLOWED_PROGRESS_STATUSES:
|
||
raise PublicStatusError(f"unsafe platform status for {name}: {status}")
|
||
platforms.append(
|
||
{
|
||
"id": _slug(name.replace("→", " to ")),
|
||
"name": name,
|
||
"status": status,
|
||
"claim": verified_fact,
|
||
"intendedUse": intended_use,
|
||
"prerequisite": prerequisite,
|
||
"limitations": [missing],
|
||
"evidenceLinks": _platform_evidence_links(name),
|
||
"releaseVerified": False,
|
||
"liveReady": False,
|
||
}
|
||
)
|
||
return platforms
|
||
|
||
|
||
def _build_evidence(project: Path) -> List[Dict[str, Any]]:
|
||
records = (
|
||
("scorecard", "Gate scorecard", "gate_scorecard.json", "machine_record"),
|
||
(
|
||
"bundle-manifest",
|
||
"Portable bundle manifest",
|
||
"dist/bundle_manifest.json",
|
||
"machine_record",
|
||
),
|
||
(
|
||
"release-reachability",
|
||
"Five-layer release reachability manifest",
|
||
REACHABILITY_PATH,
|
||
"machine_record",
|
||
),
|
||
("readme", "Quant OS verification guide", "README.md", "documentation"),
|
||
(
|
||
"architecture",
|
||
"Architecture and trust boundaries",
|
||
"docs/ARCHITECTURE.md",
|
||
"documentation",
|
||
),
|
||
(
|
||
"audit",
|
||
"Baseline 60 reassessment",
|
||
"docs/AUDIT_2026-07-25.md",
|
||
"audit",
|
||
),
|
||
(
|
||
"platform-matrix",
|
||
"Platform capability matrix",
|
||
"docs/PLATFORM_MATRIX.md",
|
||
"audit",
|
||
),
|
||
(
|
||
"cross-engine",
|
||
"Cross-engine consistency contract",
|
||
"docs/CROSS_ENGINE_CONSISTENCY.md",
|
||
"documentation",
|
||
),
|
||
(
|
||
"joinquant-hosted-evidence",
|
||
"JoinQuant hosted momentum smoke boundary",
|
||
"docs/JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md",
|
||
"runtime_evidence",
|
||
),
|
||
(
|
||
"joinquant-target-package-evidence",
|
||
"JoinQuant TargetPackage execution evidence boundary",
|
||
JOINQUANT_TARGET_PACKAGE_DOC_PATH,
|
||
"runtime_evidence",
|
||
),
|
||
(
|
||
"joinquant-target-package-run",
|
||
"Redacted JoinQuant TargetPackage hosted run",
|
||
JOINQUANT_TARGET_PACKAGE_RUN_PATH,
|
||
"machine_record",
|
||
),
|
||
(
|
||
"tushare-data",
|
||
"Tushare inventory and Qlib bridge record",
|
||
"docs/TUSHARE_LOCAL_DATA.md",
|
||
"runtime_evidence",
|
||
),
|
||
(
|
||
"platform-deployment",
|
||
"Platform deployment runbook",
|
||
"runbooks/PLATFORM_DEPLOYMENT.md",
|
||
"runbook",
|
||
),
|
||
(
|
||
"public-status-deployment",
|
||
"Atomic public status deployment",
|
||
"ops/README.md",
|
||
"runbook",
|
||
),
|
||
)
|
||
result: List[Dict[str, Any]] = []
|
||
for evidence_id, label, raw_path, kind in records:
|
||
path = _safe_repo_path(raw_path, label=f"evidence {evidence_id}")
|
||
if not (project / path).is_file():
|
||
raise PublicStatusError(f"required public evidence is missing: {path}")
|
||
result.append(
|
||
{
|
||
"id": evidence_id,
|
||
"label": label,
|
||
"path": path,
|
||
"kind": kind,
|
||
}
|
||
)
|
||
return result
|
||
|
||
|
||
def _build_market_scope(standard: Mapping[str, Any]) -> Dict[str, Any]:
|
||
operating_defaults = standard.get("operating_defaults")
|
||
if not isinstance(operating_defaults, dict):
|
||
raise PublicStatusError("production-80 operating_defaults must be an object")
|
||
declared_scope = operating_defaults.get("declared_market_scope")
|
||
if not isinstance(declared_scope, dict):
|
||
raise PublicStatusError(
|
||
"production-80 declared_market_scope must be an object"
|
||
)
|
||
included = declared_scope.get("included")
|
||
excluded = declared_scope.get("excluded_fail_closed")
|
||
if included != ["SSE", "SZSE"] or excluded != ["BSE"]:
|
||
raise PublicStatusError(
|
||
"public market scope must explicitly include SSE/SZSE and fail-close BSE"
|
||
)
|
||
return {
|
||
"included": list(included),
|
||
"excludedFailClosed": list(excluded),
|
||
"executionScopeLabel": "沪深（上交所、深交所）",
|
||
"bseTradingEnabled": False,
|
||
"statement": (
|
||
"当前交易执行范围仅覆盖沪深；北交所尚未接入，"
|
||
"所有北交所委托必须 fail closed。"
|
||
),
|
||
}
|
||
|
||
|
||
def _build_layers(
|
||
*,
|
||
baseline_shadow_days: int,
|
||
production_shadow_days: int,
|
||
) -> List[Dict[str, Any]]:
|
||
return [
|
||
{
|
||
"id": "data",
|
||
"name": "数据与时点",
|
||
"status": "tested",
|
||
"claim": "不可变快照、PIT 字段合同和 Tushare→Qlib 技术链路已有本地合同/运行证据；这些 provider-data 路径尚未接成当前 Ridge 五层候选。",
|
||
"capabilities": [
|
||
"JQData raw/factor/limits/paused/PIT membership/ST snapshot",
|
||
"Tushare completed-Parquet inventory and immutable Qlib provider",
|
||
"semantic manifest and data-version verification",
|
||
],
|
||
"limitations": [
|
||
"尚无授权 JQData 真实快照与许可 lineage；Tushare 镜像仅部分完成且缺生产关键字段；当前五层候选仍使用 synthetic 数据。"
|
||
],
|
||
"evidenceLinks": ["architecture", "tushare-data", "scorecard"],
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "research",
|
||
"name": "研究与模型",
|
||
"status": "real_runtime",
|
||
"claim": "synthetic 五层研究入口能冻结 train-only Ridge ModelBundle、逐层 trace 与 TargetPackageV1；Qlib momentum 和 Alpha158/LightGBM fixture 是另外的受限研究 smoke。",
|
||
"capabilities": [
|
||
"train-only preprocessing, purged walk-forward and deterministic Ridge",
|
||
"replayable frozen ModelBundle and synthetic TargetPackageV1",
|
||
"Qlib native momentum",
|
||
"Qlib Alpha158, LightGBM and Recorder workflow",
|
||
],
|
||
"limitations": [
|
||
"候选和 Qlib fixture 均是 synthetic；尚无授权长样本 OOS、真实数据校准、平台候选观察或投资价值证据。"
|
||
],
|
||
"evidenceLinks": [
|
||
"architecture",
|
||
"platform-matrix",
|
||
"release-reachability",
|
||
"scorecard",
|
||
],
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "signal-portfolio",
|
||
"name": "信号、组合与事前风险",
|
||
"status": "tested",
|
||
"claim": "当前 synthetic 主链把 Ridge Alpha、显式成本、60 日对角 realized variance、deterministic optimizer 和 post-risk gate 接成可重放 TargetPackage。",
|
||
"capabilities": [
|
||
"explicit fee/spread/square-root-impact cost forecast",
|
||
"diagonal realized-variance risk input and deterministic constrained target",
|
||
"single-name, industry, gross, capacity and turnover constraints",
|
||
"post-risk weights with hash-linked lineage",
|
||
],
|
||
"limitations": [
|
||
"factor_risk.py 与 optional CVXPY solver 未被当前主链选择；风险、冲击和容量尚未用授权真实数据校准，G4/G5 均未通过。"
|
||
],
|
||
"evidenceLinks": [
|
||
"architecture",
|
||
"release-reachability",
|
||
"scorecard",
|
||
],
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "backtest",
|
||
"name": "回测与跨引擎",
|
||
"status": "real_runtime",
|
||
"claim": "本地 synthetic 五层候选、平台 harness 和一次真实 JoinQuant TargetPackage execution smoke 已运行；QMT 尚无真实 peer run。",
|
||
"capabilities": [
|
||
"local event and snapshot backtests",
|
||
"fail-closed JoinQuant TargetPackage single-file consumer",
|
||
"fail-closed QMT built-in TargetPackage backtest consumer",
|
||
"Qlib research runners",
|
||
],
|
||
"limitations": [
|
||
"聚宽只观察到一个 synthetic-research TargetPackage 的消费、账户/开盘价绑定和三笔成交；无真实长样本 OOS、QMT peer 或逐层真实数据 parity，G9 未通过。"
|
||
],
|
||
"evidenceLinks": [
|
||
"platform-matrix",
|
||
"joinquant-target-package-evidence",
|
||
"joinquant-target-package-run",
|
||
"cross-engine",
|
||
"release-reachability",
|
||
"scorecard",
|
||
],
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "platforms",
|
||
"name": "平台适配",
|
||
"status": "real_runtime",
|
||
"claim": "Local、Colab、JoinQuant、QMT、Qlib 有入口；JoinQuant 已真实观察 synthetic-research TargetPackage 的 execution consumer，QMT 候选仍未实跑。",
|
||
"capabilities": [
|
||
"local and Colab zero-account smoke",
|
||
"JQData snapshot entrypoint",
|
||
"JoinQuant momentum or explicit TargetPackage upload bundle",
|
||
"QMT built-in TargetPackage and qmttools entrypoints",
|
||
],
|
||
"limitations": [
|
||
"JoinQuant 没有重跑上游四层；JQData 授权真实候选、QMT 客户端/数据权限、QMT peer 导出与逐层真实数据 parity 仍是外部前置条件。"
|
||
],
|
||
"evidenceLinks": [
|
||
"platform-matrix",
|
||
"joinquant-target-package-evidence",
|
||
"joinquant-target-package-run",
|
||
"platform-deployment",
|
||
"release-reachability",
|
||
],
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "broker-oms",
|
||
"name": "券商、订单与影子盘",
|
||
"status": "blocked",
|
||
"claim": "XtTrader operator 入口严格只读；HMAC 账户绑定和 semantic replay 已有 fake-broker 合同测试。",
|
||
"capabilities": [
|
||
"read-only broker observation and broker snapshot",
|
||
"account-bound target-diff shadow plan",
|
||
"authenticated evidence envelope and exact replay",
|
||
],
|
||
"limitations": [
|
||
"无真实券商 attestation、回调/重启证明和影子记录；"
|
||
f"Baseline 60 至少需要 {baseline_shadow_days} 个交易日，"
|
||
f"Production 80 当前缺口为同一冻结候选至少 {production_shadow_days} "
|
||
"个交易日；没有实盘下单入口。"
|
||
],
|
||
"evidenceLinks": ["architecture", "platform-matrix", "scorecard"],
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "operations",
|
||
"name": "证据、对账与合规",
|
||
"status": "blocked",
|
||
"claim": "版本化 schema、manifest、hash-chain、runbook 与 fail-closed 验证器已实现。",
|
||
"capabilities": [
|
||
"versioned exchange schemas and manifest verification",
|
||
"ledger replay and reconciliation contracts",
|
||
"security, deployment and incident runbooks",
|
||
],
|
||
"limitations": [
|
||
"缺连续真实对账、恢复演练、kill switch 演练及券商程序化交易书面确认。"
|
||
],
|
||
"evidenceLinks": ["architecture", "scorecard", "platform-deployment"],
|
||
"releaseVerified": False,
|
||
},
|
||
]
|
||
|
||
|
||
def _build_models() -> List[Dict[str, Any]]:
|
||
return [
|
||
{
|
||
"id": "portable-momentum-v1",
|
||
"name": "portable-momentum-v1",
|
||
"role": "平台连通性 smoke 策略",
|
||
"status": "real_runtime",
|
||
"claim": "共享 symbol normalization、momentum、target weight/quantity 与 order-delta 计算；2024 JoinQuant hosted run 只证明这一 smoke 路径。",
|
||
"limitations": [
|
||
"不是 Ridge/TargetPackage Baseline 候选；旧 hosted run 不得用于候选或 G9 计分。"
|
||
],
|
||
"evidenceLinks": [
|
||
"architecture",
|
||
"bundle-manifest",
|
||
"joinquant-hosted-evidence",
|
||
],
|
||
"investmentValueClaim": False,
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "ridge-challenger",
|
||
"name": "Deterministic Ridge",
|
||
"role": "synthetic 五层 Baseline 研究候选",
|
||
"status": "tested",
|
||
"claim": "train-only 预处理、系数、截距、训练截止和 lineage 可冻结为可重放 ModelBundle；其 synthetic TargetPackageV1 已被真实 JoinQuant execution consumer 消费并成交。",
|
||
"limitations": [
|
||
"JoinQuant 只观察执行边界，未重跑上游四层；无授权真实 OOS、真实校准、QMT peer 或投资价值证据。"
|
||
],
|
||
"evidenceLinks": [
|
||
"architecture",
|
||
"platform-matrix",
|
||
"joinquant-target-package-evidence",
|
||
"joinquant-target-package-run",
|
||
],
|
||
"investmentValueClaim": False,
|
||
"releaseVerified": False,
|
||
},
|
||
{
|
||
"id": "alpha158-lightgbm",
|
||
"name": "Alpha158 + LightGBM",
|
||
"role": "Qlib 研究候选",
|
||
"status": "real_runtime",
|
||
"claim": "pyqlib 0.9.7 的 fit、Recorder 和 portfolio workflow 已在真实本地运行时完成。",
|
||
"limitations": [
|
||
"数据仅为两只 synthetic 股票 fixture；表现没有投资意义，尚无冻结部署模型。"
|
||
],
|
||
"evidenceLinks": ["architecture", "platform-matrix"],
|
||
"investmentValueClaim": False,
|
||
"releaseVerified": False,
|
||
},
|
||
]
|
||
|
||
|
||
def _build_next_actions(
|
||
scorecard: Mapping[str, Any],
|
||
*,
|
||
baseline_shadow_days: int,
|
||
production_shadow_days: int,
|
||
) -> List[Dict[str, Any]]:
|
||
delivery = scorecard.get("current_delivery", {})
|
||
if not isinstance(delivery, dict):
|
||
raise PublicStatusError("scorecard current_delivery must be an object")
|
||
internal = delivery.get("internal_delivery_gaps", [])
|
||
missing = delivery.get("external_evidence_missing", [])
|
||
if not isinstance(internal, list) or len(internal) < 3:
|
||
raise PublicStatusError(
|
||
"scorecard must list the internal delivery gaps blocking Baseline"
|
||
)
|
||
if not isinstance(missing, list) or len(missing) < 5:
|
||
raise PublicStatusError(
|
||
"scorecard must list the external evidence blocking release"
|
||
)
|
||
return [
|
||
{
|
||
"priority": 1,
|
||
"title": "接通真实数据五层候选",
|
||
"why": f"{internal[0]} External prerequisite: {missing[0]}",
|
||
"gateIds": ["G1", "G2", "G3", "G5", "G7"],
|
||
},
|
||
{
|
||
"priority": 2,
|
||
"title": "冻结主链风险、优化与执行选择",
|
||
"why": str(internal[1]),
|
||
"gateIds": ["G3", "G5", "G7", "G9"],
|
||
},
|
||
{
|
||
"priority": 3,
|
||
"title": "扩展 JoinQuant 多期对账与逐层 parity",
|
||
"why": f"{internal[2]} Required evidence: {missing[1]}",
|
||
"gateIds": ["G3", "G7", "G9"],
|
||
},
|
||
{
|
||
"priority": 4,
|
||
"title": "运行真实 QMT TargetPackage 候选",
|
||
"why": str(missing[2]),
|
||
"gateIds": ["G6", "G8", "G9"],
|
||
},
|
||
{
|
||
"priority": 5,
|
||
"title": (
|
||
"完成 QMT 券商合同探针与 "
|
||
f"Production 80 的 {production_shadow_days} 日影子盘"
|
||
f"（Baseline 60 门槛 {baseline_shadow_days} 日）"
|
||
),
|
||
"why": str(missing[3]),
|
||
"gateIds": ["G6", "G8", "G9"],
|
||
},
|
||
{
|
||
"priority": 6,
|
||
"title": "完成连续对账、恢复演练与券商程序化交易报告/核查确认",
|
||
"why": str(missing[4]),
|
||
"gateIds": ["G8", "G10"],
|
||
},
|
||
]
|
||
|
||
|
||
def _build_freshness(
|
||
*,
|
||
scorecard: Mapping[str, Any],
|
||
joinquant_markdown: str,
|
||
joinquant_target_package_run: Mapping[str, Any],
|
||
tushare_markdown: str,
|
||
baseline_shadow_days: int,
|
||
production_shadow_days: int,
|
||
) -> List[Dict[str, Any]]:
|
||
period_match = re.search(
|
||
r"(?m)^-\s+Period:\s+"
|
||
r"(\d{4}-\d{2}-\d{2})\s+through\s+(\d{4}-\d{2}-\d{2})\s*$",
|
||
joinquant_markdown,
|
||
)
|
||
if period_match is None:
|
||
raise PublicStatusError(
|
||
"JoinQuant evidence must declare its hosted market-data period"
|
||
)
|
||
joinquant_start, joinquant_end = period_match.groups()
|
||
|
||
daily_match = re.search(
|
||
r"(?m)^\|\s*`daily`\s*\|\s*([\d,]+)\s*\|\s*([\d,]+)\s*\|\s*"
|
||
r"(\d{4}-\d{2}-\d{2})[—-](\d{4}-\d{2}-\d{2})",
|
||
tushare_markdown,
|
||
)
|
||
plan_match = re.search(
|
||
r"`daily`\s*原计划覆盖.*?共\s*(\d+)\s*个月；当前完成\s*"
|
||
r"(\d+)\s*个月，约\s*([\d.]+)%",
|
||
tushare_markdown,
|
||
flags=re.DOTALL,
|
||
)
|
||
ready_match = re.search(
|
||
r"(?m)^production_ready\s*=\s*(true|false)\s*$",
|
||
tushare_markdown,
|
||
)
|
||
if daily_match is None or plan_match is None or ready_match is None:
|
||
raise PublicStatusError(
|
||
"Tushare evidence must declare daily coverage and production readiness"
|
||
)
|
||
(
|
||
daily_partitions_text,
|
||
daily_rows_text,
|
||
tushare_start,
|
||
tushare_end,
|
||
) = daily_match.groups()
|
||
planned_months_text, completed_months_text, percentage_text = plan_match.groups()
|
||
completed_partitions = int(daily_partitions_text.replace(",", ""))
|
||
completed_months = int(completed_months_text)
|
||
planned_months = int(planned_months_text)
|
||
if completed_partitions != completed_months:
|
||
raise PublicStatusError(
|
||
"Tushare daily partition count differs from completed-month statement"
|
||
)
|
||
calculated_ratio = completed_months / planned_months
|
||
recorded_percentage = float(percentage_text)
|
||
if abs(calculated_ratio * 100.0 - recorded_percentage) > 0.1:
|
||
raise PublicStatusError(
|
||
"Tushare recorded coverage percentage does not match month counts"
|
||
)
|
||
production_ready = ready_match.group(1) == "true"
|
||
if production_ready:
|
||
raise PublicStatusError(
|
||
"partial Tushare source must not be publicized as production ready"
|
||
)
|
||
|
||
audit_as_of = str(scorecard.get("audit_as_of"))
|
||
return [
|
||
{
|
||
"id": "project-audit",
|
||
"label": "项目证据审计",
|
||
"status": "recorded",
|
||
"asOf": audit_as_of,
|
||
"value": audit_as_of,
|
||
"semantics": "证据盘点日期；不是部署时间，也不是行情截止日。",
|
||
"evidenceLinks": ["scorecard", "audit"],
|
||
},
|
||
{
|
||
"id": "joinquant-hosted-market-window",
|
||
"label": "JoinQuant hosted momentum smoke 行情区间",
|
||
"status": "runtime_smoke",
|
||
"marketDataFrom": joinquant_start,
|
||
"marketDataThrough": joinquant_end,
|
||
"value": f"{joinquant_start} — {joinquant_end}",
|
||
"productionReady": False,
|
||
"semantics": "旧 momentum hosted runtime smoke 的回测区间；不是 TargetPackage 候选或同输入跨引擎证据。",
|
||
"evidenceLinks": ["joinquant-hosted-evidence", "scorecard"],
|
||
},
|
||
{
|
||
"id": "joinquant-target-package-execution-smoke",
|
||
"label": "JoinQuant TargetPackage execution smoke",
|
||
"status": "runtime_smoke",
|
||
"observedAt": str(joinquant_target_package_run["observedAt"]),
|
||
"marketDataFrom": str(
|
||
joinquant_target_package_run["marketDataFrom"]
|
||
),
|
||
"marketDataThrough": str(
|
||
joinquant_target_package_run["marketDataThrough"]
|
||
),
|
||
"value": (
|
||
f"{joinquant_target_package_run['marketDataFrom']} — "
|
||
f"{joinquant_target_package_run['marketDataThrough']}; "
|
||
"3 orders / 3 fills"
|
||
),
|
||
"productionReady": False,
|
||
"investmentValueClaim": False,
|
||
"semantics": (
|
||
"真实平台只观察 synthetic-research TargetPackage 的 execution "
|
||
"consumer；不代表上游四层真实平台执行、长样本 OOS 或 G9。"
|
||
),
|
||
"evidenceLinks": [
|
||
"joinquant-target-package-evidence",
|
||
"joinquant-target-package-run",
|
||
"release-reachability",
|
||
"scorecard",
|
||
],
|
||
},
|
||
{
|
||
"id": "tushare-daily-market-data",
|
||
"label": "Tushare daily 行情覆盖",
|
||
"status": "partial",
|
||
"marketDataFrom": tushare_start,
|
||
"marketDataThrough": tushare_end,
|
||
"completedPartitions": completed_partitions,
|
||
"plannedPartitions": planned_months,
|
||
"completedRows": int(daily_rows_text.replace(",", "")),
|
||
"completionRatio": round(calculated_ratio, 6),
|
||
"completionLabel": (
|
||
f"{completed_partitions}/{planned_months}（约 {recorded_percentage:g}%）"
|
||
),
|
||
"value": (
|
||
f"{completed_partitions}/{planned_months}（约 {recorded_percentage:g}%），"
|
||
f"行情截至 {tushare_end}"
|
||
),
|
||
"productionReady": production_ready,
|
||
"semantics": "marketDataThrough 仅取自 daily 行情分区；绝不使用覆盖更晚的 trade_cal 日期。",
|
||
"evidenceLinks": ["tushare-data", "scorecard"],
|
||
},
|
||
{
|
||
"id": "jqdata-real-snapshot",
|
||
"label": "JQData 授权真实快照",
|
||
"status": "blocked",
|
||
"marketDataThrough": None,
|
||
"value": "N/A",
|
||
"productionReady": False,
|
||
"semantics": "只有 fake-provider 合同测试；尚无授权账号生成并保存的真实快照。",
|
||
"evidenceLinks": ["platform-matrix", "scorecard"],
|
||
},
|
||
{
|
||
"id": "qmt-broker-real-runtime",
|
||
"label": "QMT / broker 真实运行",
|
||
"status": "blocked",
|
||
"lastRealRuntimeAt": None,
|
||
"value": "N/A",
|
||
"productionReady": False,
|
||
"semantics": (
|
||
"QMT 只有 bundle/harness，XtTrader 只有 fake-broker 只读合同；"
|
||
f"尚无真实运行或影子证据。Baseline 60 至少需要 "
|
||
f"{baseline_shadow_days} 个交易日，Production 80 当前缺口为同一"
|
||
f"冻结候选至少 {production_shadow_days} 个交易日。"
|
||
),
|
||
"evidenceLinks": ["platform-matrix", "platform-deployment", "scorecard"],
|
||
},
|
||
]
|
||
|
||
|
||
def _validate_claim(scorecard: Mapping[str, Any]) -> None:
|
||
policy = scorecard.get("claim_policy")
|
||
if not isinstance(policy, dict):
|
||
raise PublicStatusError("scorecard claim_policy must be an object")
|
||
claim = str(policy.get("current_claim", ""))
|
||
if claim in FORBIDDEN_PUBLIC_CLAIMS:
|
||
raise PublicStatusError(f"unsafe public release claim: {claim}")
|
||
if claim not in {"NOT_BASELINE_60", "BASELINE_60_VERIFIED"}:
|
||
raise PublicStatusError(f"unsupported baseline claim: {claim}")
|
||
if claim == "BASELINE_60_VERIFIED":
|
||
raise PublicStatusError(
|
||
"positive Baseline-60 publication is disabled until the "
|
||
"production issuer registry and signed baseline evaluator result "
|
||
"are implemented"
|
||
)
|
||
|
||
gates = scorecard.get("gates")
|
||
if not isinstance(gates, list) or not gates:
|
||
raise PublicStatusError("scorecard gates must be a non-empty list")
|
||
passed = sum(gate.get("status") == "passed" for gate in gates if isinstance(gate, dict))
|
||
all_passed = passed == len(gates)
|
||
|
||
if claim == "NOT_BASELINE_60" and all_passed:
|
||
raise PublicStatusError(
|
||
"scorecard is internally inconsistent: every gate passed but claim is negative"
|
||
)
|
||
|
||
|
||
def _walk_public_values(value: Any, path: str = "$") -> Iterable[Tuple[str, Any]]:
|
||
yield path, value
|
||
if isinstance(value, dict):
|
||
for key, child in value.items():
|
||
yield from _walk_public_values(child, f"{path}.{key}")
|
||
elif isinstance(value, list):
|
||
for index, child in enumerate(value):
|
||
yield from _walk_public_values(child, f"{path}[{index}]")
|
||
|
||
|
||
def _validate_public_payload(payload: Mapping[str, Any]) -> None:
|
||
encoded = json.dumps(payload, ensure_ascii=False, sort_keys=True)
|
||
absolute_match = ABSOLUTE_PATH_PATTERN.search(encoded)
|
||
if absolute_match:
|
||
raise PublicStatusError(
|
||
f"public payload contains an absolute local path near {absolute_match.group(0)!r}"
|
||
)
|
||
for claim in FORBIDDEN_PUBLIC_CLAIMS:
|
||
if claim in encoded:
|
||
raise PublicStatusError(f"public payload contains forbidden claim {claim}")
|
||
for path, value in _walk_public_values(payload):
|
||
if isinstance(value, dict):
|
||
for key in value:
|
||
lowered = str(key).lower()
|
||
if any(part in lowered for part in SENSITIVE_KEY_PARTS):
|
||
raise PublicStatusError(
|
||
f"public payload contains a sensitive field at {path}.{key}"
|
||
)
|
||
|
||
|
||
def _build_maturity80(
|
||
project: Path,
|
||
standard: Mapping[str, Any],
|
||
assessment: Mapping[str, Any],
|
||
) -> Dict[str, Any]:
|
||
source_root = project / "src"
|
||
inserted = str(source_root) not in sys.path
|
||
if inserted:
|
||
sys.path.insert(0, str(source_root))
|
||
try:
|
||
from quant_os.evidence import ( # pylint: disable=import-outside-toplevel
|
||
MaturityStandardError,
|
||
evaluate_assessment,
|
||
)
|
||
|
||
try:
|
||
evaluation = evaluate_assessment(
|
||
standard,
|
||
assessment,
|
||
repository_root=project,
|
||
)
|
||
except MaturityStandardError as exc:
|
||
raise PublicStatusError(
|
||
f"production-80 assessment failed canonical verification: {exc}"
|
||
) from exc
|
||
finally:
|
||
if inserted:
|
||
sys.path.remove(str(source_root))
|
||
|
||
controls = evaluation["controls"]
|
||
return {
|
||
"standardId": evaluation["standard_id"],
|
||
"standardCanonicalSha256": evaluation[
|
||
"standard_canonical_sha256"
|
||
],
|
||
"baselineProfileCanonicalSha256": evaluation[
|
||
"baseline_profile_canonical_sha256"
|
||
],
|
||
"assessedAsOf": evaluation["assessed_as_of"],
|
||
"rawScore": evaluation["raw_score"],
|
||
"effectiveScore": evaluation["effective_score"],
|
||
"maximumScore": evaluation["maximum_score"],
|
||
"qualificationThreshold": evaluation["qualification_threshold"],
|
||
"qualified": evaluation["qualified"],
|
||
"state": evaluation["qualification_state"],
|
||
"baseline60Passed": evaluation["baseline_60_passed"],
|
||
"structurallyEligible": evaluation["structurally_eligible"],
|
||
"trustedAttestationVerified": evaluation[
|
||
"trusted_attestation_verified"
|
||
],
|
||
"finalAttestationVerified": evaluation[
|
||
"final_attestation_verified"
|
||
],
|
||
"productionTrustRegistryAvailable": evaluation[
|
||
"production_trust_registry_available"
|
||
],
|
||
"verificationEnvironment": evaluation[
|
||
"verification_environment"
|
||
],
|
||
"testOnly": evaluation["test_only"],
|
||
"preCanaryStructurallyEligible": evaluation[
|
||
"pre_canary_structurally_eligible"
|
||
],
|
||
"preCanaryAttestationVerified": evaluation[
|
||
"pre_canary_attestation_verified"
|
||
],
|
||
"preCanaryAuthorized": evaluation["pre_canary_authorized"],
|
||
"preCanaryAuthorizationVerified": evaluation[
|
||
"pre_canary_attestation_verified"
|
||
],
|
||
"preCanaryAuthorization": evaluation[
|
||
"pre_canary_authorization"
|
||
],
|
||
"canaryAuthorizationChainVerified": evaluation[
|
||
"canary_authorization_chain_verified"
|
||
],
|
||
"canaryObservation": evaluation["canary_observation"],
|
||
"canaryRunning": evaluation["canary_running"],
|
||
"baseline60AttestationVerified": evaluation[
|
||
"baseline_60_attestation_verified"
|
||
],
|
||
"hardGateFailures": evaluation["hard_gate_failures"],
|
||
"domainFloorFailures": evaluation["domain_floor_failures"],
|
||
"prerequisites": evaluation["prerequisites"],
|
||
"scoreCaps": evaluation["score_caps"],
|
||
"domains": [
|
||
{
|
||
"id": domain["id"],
|
||
"name": domain["name"],
|
||
"score": domain["score"],
|
||
"weight": domain["weight"],
|
||
"minimumScore": domain["minimum_score"],
|
||
"floorPassed": domain["floor_passed"],
|
||
}
|
||
for domain in evaluation["domains"]
|
||
],
|
||
"controls": [
|
||
{
|
||
"id": control["id"],
|
||
"domainId": control["domain_id"],
|
||
"name": control["name"],
|
||
"weight": control["weight"],
|
||
"hardGate": control["hard_gate"],
|
||
"status": control["status"],
|
||
"minimumEvidenceTier": control["minimum_evidence_tier"],
|
||
"note": control["note"],
|
||
}
|
||
for control in controls
|
||
],
|
||
"controlsPassed": sum(
|
||
control["status"] == "passed" for control in controls
|
||
),
|
||
"controlsTotal": len(controls),
|
||
"hardGatesPassed": (
|
||
sum(
|
||
control["hard_gate"] and control["status"] == "passed"
|
||
for control in controls
|
||
)
|
||
),
|
||
"hardGatesTotal": sum(control["hard_gate"] for control in controls),
|
||
"evidencePolicy": (
|
||
"Only subject-bound evidence claims verified by a configured "
|
||
"trust provider, at or above each control's minimum tier, earn "
|
||
"points. The current repository has no production trust provider "
|
||
"and therefore cannot self-issue a positive qualification."
|
||
),
|
||
}
|
||
|
||
|
||
def build_public_status(
|
||
project: Path,
|
||
*,
|
||
generated_at: str | None = None,
|
||
source_date_epoch: str | None = None,
|
||
) -> Dict[str, Any]:
|
||
project = project.resolve()
|
||
scorecard = _load_json(project / "gate_scorecard.json")
|
||
production_80_standard = _load_json(
|
||
project / PRODUCTION_80_STANDARD_PATH
|
||
)
|
||
production_80_assessment = _load_json(
|
||
project / PRODUCTION_80_ASSESSMENT_PATH
|
||
)
|
||
baseline_60_profile = _load_json(project / BASELINE_60_PROFILE_PATH)
|
||
manifest = _load_json(project / "dist" / "bundle_manifest.json")
|
||
reachability_manifest = _load_json(project / REACHABILITY_PATH)
|
||
joinquant_target_package_run_raw = _load_json(
|
||
project / JOINQUANT_TARGET_PACKAGE_RUN_PATH
|
||
)
|
||
baseline = _load_json(project / "configs" / "baseline.json")
|
||
platform_markdown = (project / "docs" / "PLATFORM_MATRIX.md").read_text(
|
||
encoding="utf-8"
|
||
)
|
||
joinquant_markdown = (
|
||
project / "docs" / "JOINQUANT_HOSTED_EVIDENCE_2026-07-26.md"
|
||
).read_text(encoding="utf-8")
|
||
tushare_markdown = (project / "docs" / "TUSHARE_LOCAL_DATA.md").read_text(
|
||
encoding="utf-8"
|
||
)
|
||
|
||
_validate_claim(scorecard)
|
||
try:
|
||
baseline_shadow_days = int(
|
||
baseline_60_profile["minimum_shadow_trading_days"]
|
||
)
|
||
production_shadow_days = int(
|
||
production_80_standard["qualification"][
|
||
"minimum_shadow_trading_days"
|
||
]
|
||
)
|
||
except (KeyError, TypeError, ValueError) as exc:
|
||
raise PublicStatusError(
|
||
"baseline-60 and production-80 shadow requirements must be integers"
|
||
) from exc
|
||
if baseline_shadow_days <= 0 or production_shadow_days <= baseline_shadow_days:
|
||
raise PublicStatusError(
|
||
"production-80 shadow requirement must exceed the positive baseline-60 requirement"
|
||
)
|
||
audit_as_of = str(scorecard.get("audit_as_of", ""))
|
||
try:
|
||
datetime.strptime(audit_as_of, "%Y-%m-%d")
|
||
except ValueError as exc:
|
||
raise PublicStatusError("scorecard audit_as_of must be YYYY-MM-DD") from exc
|
||
generated_at_value, generated_at_source = _resolve_generated_at(
|
||
explicit=generated_at,
|
||
source_date_epoch=source_date_epoch,
|
||
audit_as_of=audit_as_of,
|
||
)
|
||
|
||
gates_raw = scorecard["gates"]
|
||
gates: List[Dict[str, Any]] = []
|
||
for raw_gate in gates_raw:
|
||
if not isinstance(raw_gate, dict):
|
||
raise PublicStatusError("every gate must be an object")
|
||
evidence = raw_gate.get("evidence", [])
|
||
required = raw_gate.get("required_evidence", [])
|
||
if not isinstance(evidence, list) or not isinstance(required, list):
|
||
raise PublicStatusError("gate evidence fields must be arrays")
|
||
status = str(raw_gate.get("status", ""))
|
||
if status not in {"not_passed", "passed"}:
|
||
raise PublicStatusError(f"unsupported gate status: {status}")
|
||
if status == "passed" and not evidence:
|
||
raise PublicStatusError(
|
||
f"{raw_gate.get('id')} cannot be publicized as passed without evidence"
|
||
)
|
||
gates.append(
|
||
{
|
||
"id": str(raw_gate.get("id")),
|
||
"name": str(raw_gate.get("name")),
|
||
"status": status,
|
||
"claim": "已通过并有 scorecard 证据。" if status == "passed" else "未通过；不得计分。",
|
||
"acceptance": str(raw_gate.get("acceptance")),
|
||
"requiredEvidence": [str(item) for item in required],
|
||
"evidence": [str(item) for item in evidence],
|
||
"limitations": [str(item) for item in required]
|
||
if status != "passed"
|
||
else [],
|
||
"evidenceLinks": ["scorecard", "audit"],
|
||
}
|
||
)
|
||
|
||
passed = sum(gate["status"] == "passed" for gate in gates)
|
||
facts = scorecard.get("current_delivery", {}).get(
|
||
"verified_supporting_facts", []
|
||
)
|
||
if not isinstance(facts, list):
|
||
raise PublicStatusError("verified_supporting_facts must be an array")
|
||
test_count, optional_skips = _extract_test_summary(facts)
|
||
|
||
artifacts = _validate_bundle_manifest(project, manifest)
|
||
reachability = _validate_reachability_manifest(
|
||
project, reachability_manifest
|
||
)
|
||
joinquant_target_package_run = _validate_joinquant_target_package_run(
|
||
project,
|
||
joinquant_target_package_run_raw,
|
||
)
|
||
maturity80 = _build_maturity80(
|
||
project,
|
||
production_80_standard,
|
||
production_80_assessment,
|
||
)
|
||
source_records: List[Dict[str, str]] = []
|
||
for relative in SOURCE_PATHS:
|
||
safe_path = _safe_repo_path(relative, label="provenance source")
|
||
source_path = project / safe_path
|
||
if not source_path.is_file():
|
||
raise PublicStatusError(f"required provenance source is missing: {safe_path}")
|
||
source_records.append(
|
||
{"path": safe_path, "sha256": _sha256_bytes(source_path.read_bytes())}
|
||
)
|
||
source_set_sha = _sha256_bytes(_canonical_json(source_records))
|
||
|
||
claim_policy = scorecard["claim_policy"]
|
||
delivery = scorecard["current_delivery"]
|
||
baseline_verified = (
|
||
claim_policy["current_claim"] == "BASELINE_60_VERIFIED"
|
||
and passed == len(gates)
|
||
and isinstance(delivery.get("score"), (int, float))
|
||
and delivery["score"] >= claim_policy["baseline_threshold"]
|
||
)
|
||
if bool(maturity80["baseline60Passed"]) != baseline_verified:
|
||
raise PublicStatusError(
|
||
"Baseline-60 scorecard and production-80 assessment disagree"
|
||
)
|
||
internal_delivery_gaps = delivery.get("internal_delivery_gaps", [])
|
||
external_evidence_missing = delivery.get("external_evidence_missing", [])
|
||
if not isinstance(internal_delivery_gaps, list) or len(internal_delivery_gaps) < 3:
|
||
raise PublicStatusError(
|
||
"scorecard must list the internal delivery gaps blocking Baseline"
|
||
)
|
||
if (
|
||
not isinstance(external_evidence_missing, list)
|
||
or len(external_evidence_missing) < 5
|
||
):
|
||
raise PublicStatusError(
|
||
"scorecard must list the external evidence blocking release"
|
||
)
|
||
payload: Dict[str, Any] = {
|
||
"schemaVersion": SCHEMA_VERSION,
|
||
"generatedAt": generated_at_value,
|
||
"generatedAtSource": generated_at_source,
|
||
"auditAsOf": audit_as_of,
|
||
"system": str(scorecard.get("system", "Quant OS")),
|
||
"claim": {
|
||
"status": str(claim_policy["current_claim"]),
|
||
"baselineThreshold": int(claim_policy["baseline_threshold"]),
|
||
"allGatesRequired": bool(claim_policy["all_gates_required"]),
|
||
"gatesPassed": passed,
|
||
"gatesTotal": len(gates),
|
||
"score": delivery.get("score"),
|
||
"scoreStatus": str(delivery.get("status")),
|
||
"reason": str(delivery.get("reason")),
|
||
"releaseVerified": baseline_verified,
|
||
"liveReady": bool(maturity80["qualified"]),
|
||
},
|
||
"marketScope": _build_market_scope(production_80_standard),
|
||
"maturity80": maturity80,
|
||
"summary": {
|
||
"testsRecorded": test_count,
|
||
"optionalSkipsRecorded": optional_skips,
|
||
"testEvidenceQualifier": "Scorecard-recorded run; tests do not prove real-platform or broker gates.",
|
||
"candidateRealPlatformObserved": bool(
|
||
reachability["realPlatformsObserved"]
|
||
),
|
||
"candidateRealPlatformObservationScope": (
|
||
"target_package_execution_consumer_only"
|
||
),
|
||
"allFiveLayersRealPlatformObserved": bool(
|
||
reachability["summary"][
|
||
"all_layers_real_platform_observed"
|
||
]
|
||
),
|
||
"realRuntimeSmokes": [
|
||
"JoinQuant TargetPackage execution consumer: one synthetic-research package, 3 orders / 3 fills (not Baseline/G9 evidence)",
|
||
"JoinQuant portable_momentum_smoke hosted daily backtest (not Baseline/TargetPackage evidence)",
|
||
"Qlib native momentum fixture",
|
||
"Qlib Alpha158 + LightGBM fixture",
|
||
"Tushare completed-partition Qlib momentum smoke",
|
||
],
|
||
"gateCoverageLabel": f"{passed}/{len(gates)} passed",
|
||
"productionReady": bool(maturity80["qualified"]),
|
||
"investmentValueClaim": False,
|
||
},
|
||
"candidateBoundary": {
|
||
"decisionMode": "target_package",
|
||
"localEvidenceClass": "synthetic_research",
|
||
"connectedRiskModel": "60-session diagonal realized variance",
|
||
"connectedOptimizer": "deterministic constrained optimizer",
|
||
"connectedExecution": "reference one-shot quantity/order-delta planner",
|
||
"realJoinQuantObserved": (
|
||
"joinquant" in reachability["realPlatformsObserved"]
|
||
),
|
||
"realQmtObserved": (
|
||
"qmt" in reachability["realPlatformsObserved"]
|
||
),
|
||
"realPlatformObservedLayers": reachability[
|
||
"realPlatformObservedLayers"
|
||
],
|
||
"allFiveLayersRealPlatformObserved": bool(
|
||
reachability["summary"][
|
||
"all_layers_real_platform_observed"
|
||
]
|
||
),
|
||
"joinQuantTargetPackageRun": joinquant_target_package_run,
|
||
"joinQuantTargetPackageCountsAsBaseline": False,
|
||
"joinQuantTargetPackageCountsAsG9": False,
|
||
"historicalJoinQuantMode": "portable_momentum_smoke",
|
||
"historicalJoinQuantCountsAsBaseline": False,
|
||
"reachability": reachability,
|
||
"releaseVerified": False,
|
||
},
|
||
"deliveryGaps": {
|
||
"internal": [str(item) for item in internal_delivery_gaps],
|
||
"externalEvidence": [str(item) for item in external_evidence_missing],
|
||
},
|
||
"layers": _build_layers(
|
||
baseline_shadow_days=baseline_shadow_days,
|
||
production_shadow_days=production_shadow_days,
|
||
),
|
||
"models": _build_models(),
|
||
"platforms": _build_platforms(platform_markdown),
|
||
"freshness": _build_freshness(
|
||
scorecard=scorecard,
|
||
joinquant_markdown=joinquant_markdown,
|
||
joinquant_target_package_run=joinquant_target_package_run,
|
||
tushare_markdown=tushare_markdown,
|
||
baseline_shadow_days=baseline_shadow_days,
|
||
production_shadow_days=production_shadow_days,
|
||
),
|
||
"gates": gates,
|
||
"bundles": {
|
||
"schemaVersion": int(manifest.get("schema_version")),
|
||
"baselineConfig": _safe_repo_path(
|
||
manifest.get("baseline_config"), label="baseline_config"
|
||
),
|
||
"baselineConfigSha256": str(manifest.get("baseline_config_sha256")),
|
||
"portableCoreSha256": str(manifest.get("portable_core_sha256")),
|
||
"artifacts": artifacts,
|
||
"baselineParameters": {
|
||
"benchmark": str(baseline["universe"]["index_symbol"]),
|
||
"universeMode": str(baseline["universe"]["mode"]),
|
||
"lookback": int(baseline["strategy"]["lookback"]),
|
||
"topN": int(baseline["strategy"]["top_n"]),
|
||
"maxWeight": float(baseline["strategy"]["max_weight"]),
|
||
"grossTarget": float(baseline["strategy"]["gross_target"]),
|
||
"cashBuffer": float(baseline["strategy"]["cash_buffer"]),
|
||
"participationRate": float(
|
||
baseline["execution"]["participation_rate"]
|
||
),
|
||
"slippageBps": float(baseline["execution"]["slippage_bps"]),
|
||
"rebalanceSchedule": str(
|
||
baseline["strategy"]["rebalance_schedule"]
|
||
),
|
||
},
|
||
},
|
||
"evidence": _build_evidence(project),
|
||
"nextActions": _build_next_actions(
|
||
scorecard,
|
||
baseline_shadow_days=baseline_shadow_days,
|
||
production_shadow_days=production_shadow_days,
|
||
),
|
||
"provenance": {
|
||
"scorecard": "gate_scorecard.json",
|
||
"production80Standard": PRODUCTION_80_STANDARD_PATH,
|
||
"production80Assessment": PRODUCTION_80_ASSESSMENT_PATH,
|
||
"bundleManifest": "dist/bundle_manifest.json",
|
||
"releaseReachability": REACHABILITY_PATH,
|
||
"platformMatrix": "docs/PLATFORM_MATRIX.md",
|
||
"baselineConfig": "configs/baseline.json",
|
||
"sourceSetSha256": source_set_sha,
|
||
"sources": source_records,
|
||
"payloadSha256Semantics": "SHA-256 of canonical payload before payloadSha256 is added.",
|
||
},
|
||
}
|
||
payload_sha = _sha256_bytes(_canonical_json(payload))
|
||
payload["provenance"]["payloadSha256"] = payload_sha
|
||
_validate_public_payload(payload)
|
||
return payload
|
||
|
||
|
||
def render_javascript(payload: Mapping[str, Any]) -> bytes:
|
||
json_text = json.dumps(
|
||
payload,
|
||
ensure_ascii=False,
|
||
indent=2,
|
||
sort_keys=True,
|
||
)
|
||
json_text = (
|
||
json_text.replace("<", "\\u003c")
|
||
.replace(">", "\\u003e")
|
||
.replace("&", "\\u0026")
|
||
.replace("\u2028", "\\u2028")
|
||
.replace("\u2029", "\\u2029")
|
||
)
|
||
return (
|
||
"// Generated by tools/build_public_status.py; do not edit by hand.\n"
|
||
f"window.{GLOBAL_NAME} = {json_text};\n"
|
||
).encode("utf-8")
|
||
|
||
|
||
def _build_parser() -> argparse.ArgumentParser:
|
||
parser = argparse.ArgumentParser(
|
||
description="Build the deterministic public Quant OS status data."
|
||
)
|
||
parser.add_argument(
|
||
"--generated-at",
|
||
help=(
|
||
"ISO-8601 build timestamp. Defaults to SOURCE_DATE_EPOCH, then the "
|
||
"scorecard audit date for reproducible local builds."
|
||
),
|
||
)
|
||
parser.add_argument(
|
||
"--output",
|
||
type=Path,
|
||
default=DEFAULT_OUTPUT,
|
||
help="Output JavaScript path.",
|
||
)
|
||
parser.add_argument(
|
||
"--check",
|
||
action="store_true",
|
||
help="Fail if the output is missing or differs from the generated bytes.",
|
||
)
|
||
return parser
|
||
|
||
|
||
def main(argv: Sequence[str] | None = None) -> int:
|
||
args = _build_parser().parse_args(argv)
|
||
try:
|
||
payload = build_public_status(
|
||
PROJECT,
|
||
generated_at=args.generated_at,
|
||
source_date_epoch=os.environ.get("SOURCE_DATE_EPOCH"),
|
||
)
|
||
expected = render_javascript(payload)
|
||
output = args.output.resolve()
|
||
if args.check:
|
||
if not output.is_file():
|
||
print(f"public status data is missing: {output}", file=sys.stderr)
|
||
return 1
|
||
actual = output.read_bytes()
|
||
if actual != expected:
|
||
print(
|
||
"public status data drift detected; run "
|
||
"python3 tools/build_public_status.py",
|
||
file=sys.stderr,
|
||
)
|
||
return 1
|
||
print(
|
||
json.dumps(
|
||
{
|
||
"ok": True,
|
||
"mode": "check",
|
||
"output": output.name,
|
||
"payload_sha256": payload["provenance"]["payloadSha256"],
|
||
},
|
||
sort_keys=True,
|
||
)
|
||
)
|
||
return 0
|
||
|
||
output.parent.mkdir(parents=True, exist_ok=True)
|
||
output.write_bytes(expected)
|
||
print(
|
||
json.dumps(
|
||
{
|
||
"ok": True,
|
||
"mode": "write",
|
||
"output": output.name,
|
||
"payload_sha256": payload["provenance"]["payloadSha256"],
|
||
},
|
||
sort_keys=True,
|
||
)
|
||
)
|
||
return 0
|
||
except (OSError, KeyError, TypeError, PublicStatusError) as exc:
|
||
print(f"public status build failed: {exc}", file=sys.stderr)
|
||
return 2
|
||
|
||
|
||
if __name__ == "__main__":
|
||
raise SystemExit(main())
|