[Pigbibi]

Problem and change

QPK has runtime/release and candidate-decision primitives but no composite, non-executing contract for a once-confirmed account, amount and activation scope. Add an immutable setup-intent envelope with a packaged strict schema, exact digest/revision binding, finite human-decision validity and a pure, allowlisted projection using injected current version/epoch evidence.

Routine cycles reference the same current confirmed revision without per-trade confirmation. Material scope changes require a confirmed successor. Missing, stale, revoked, superseded or mismatched evidence blocks reliance on intent. Both execution/live authority flags are always false; Paper counts or caller-reported pass cannot qualify authentic evidence. Disabled control and explicit environment use the existing target/control/release validators.

Update the existing runtime contract and documentation index with the interface and written QRS adoption requirements. No QRS code, executor, persistence, notifications, budgets, production switches, dependencies or pins change.

Verification

• 50 focused synthetic contract tests pass.
• Full suite passes with the actual source HEAD supplied through <PROJECT_ID>_SHA and TZ=UTC: 3717 passed, 2 skipped, 1277 subtests passed.
• Repository Ruff passes; documentation check has zero blocking findings and one existing README advisory.
• Initial local suite reproduced four existing environment-dependent failures on the clean base: missing CI source revision and a local/UTC date boundary. The affected 39 tests pass with the stated environment.
• Baseline source cannot import the new contract; adverse cases pass after implementation. The generated wheel includes both the module and schema.

Limits and risk

This is an additive intent contract, not execution authorization, authenticated owner consent or runtime adoption. Authentic Paper/risk/reconciliation/alert qualification and activation readback remain unproved and visible as blockers. QRS must adopt the reviewed pin and implement authenticated durable Decisions/CAS/idempotency separately. Account/amount/scope approval and protected application decisions remain with their owners. No live trading, Kelly or stop-loss switch is changed.

AI assistance

OpenAI Codex (launcher configuration: gpt-6.1-sol, medium).

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4b0507f6-6e2a-4215-af97-a486b90921c2

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Pigbibi]

Post-merge re-review: QuantPlatformKit #771 (R2) — FINDINGS (P2 x2)

• Reviewed head SHA: 2d49ffc730a3d0c25519de016ef8953fcac83fba
• Squash commit SHA: eaa0eab991e31305faa23cc8c13da2bbefa7d711
• Marker state on that head: none on this head
• Method: read-only, full squash diff (<merge>^1..<merge>) read in full; PR head tree == squash tree (empty git diff <head> <merge>). Offline/in-memory only; no hosted CI, deploy, Secret or IAM inspection.

Findings

• P2 src/quant_platform_kit/common/automation_setup.py:111 (_label at :75-78) and schemas/automation-setup-intent.v1.schema.json:64, :68: the letter-first, no-dot label validator rejects valid existing release_id (dotted) and digit-leading strategy_revision, so SetupIntent cannot bind real releases. Tests use dot-free alphabetic placeholders. No production caller yet.
• P2 pyproject.toml:24: new dev dependency rfc3339-validator is not in the unchanged uv.lock; tests/test_automation_setup_contract.py:13 asserts the date-time checker at import, so a frozen-lock dev env cannot collect the new tests. CI installs it explicitly.
• P0/P1: none.

Scope / limits

Touches workflows and pyproject; new non-executing setup contract (R2). 7 files, +1131/-1. Production switch state was not inspected.

Post-merge re-review. Not an approval; no review marker is issued retroactively.