feat(qsl): converge taxonomy and bundle governance

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Pigbibi

.github/codex_auto_merge_policy.json

@@ -44,6 +44,7 @@
     ],
     "timeout_minutes": 20,
     "max_diff_lines": 2400,
-    "block_on_review_failure": false
+    "auto_converge_after": 0,
+    "block_on_review_failure": true
   }
 }

.github/workflows/codex_pr_review.yml

@@ -19,7 +19,9 @@ jobs:
     uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main
     with:
       caller_concurrency_key: pr-${{ github.event.pull_request.number || github.run_id }}
-      allow_unconfigured_backend: true
+      allow_unconfigured_backend: false
+      api_fallback_enabled: "false"
+      direct_api_primary_enabled: "false"
     secrets: inherit
     permissions:
       contents: read

.github/workflows/manual-strategy-switch.yml

@@ -129,6 +129,9 @@ on:
         type: string
         default: sync-cloud-run-env.yml
 
+permissions:
+  contents: read
+
 concurrency:
   group: runtime-strategy-switch-${{ inputs.platform }}-${{ inputs.target_name }}
   cancel-in-progress: false

README.md

@@ -44,7 +44,7 @@ This repository is the central manifest source for QSL compatibility checks.
 - `scripts/check_qsl_compat.py`: validate a repo's QSL compliance in `pyproject.toml`/`uv.lock` against central bundle.
 - `python/scripts/qslctl.py`: unified QSL version-control CLI for repo checks, workspace checks, ring reports/plans, and matrix generation.
 - `scripts/render_qsl_dependency_graph.py`: render dependency graph for review.
-- `compat/bundles/2026.07.2.toml`: current compatibility bundle baseline (CalVer).
+- `compat/bundles/2026.07.3.toml`: current compatibility bundle baseline (CalVer).
 - `compat/repo-tiers.toml`: repo tier and upgrade ring policy notes.
 - [QSL compatibility docs](docs/qsl_compat_upgrade.md)
 

compat/bundles/2026.07.3.toml

@@ -0,0 +1,12 @@
+name = "2026.07.3"
+description = "QSL compatibility bundle after runtime QPK pin convergence"
+created_at = "2026-07-10"
+
+[repos]
+QuantPlatformKit = "69a0256934d081b5ef309a885384b9eb9f62cf90"
+UsEquityStrategies = "17ddb86c72d44b2c7b78ba7a10d8f71b21180166"
+HkEquityStrategies = "b6a8ac2ad3c8110b5ea74fb059c8206388d63bcd"
+CnEquityStrategies = "12c0cd4801060fcb2f9452ffd9a7f48df446ddd0"
+CryptoStrategies = "ef78312d7653095f585c4f75d45bf765bedc2751"
+QuantStrategyPlugins = "1f3a27b8fd83d71b583f4f5160a748e95fbefaa1"
+MarketSignalSources = "bda8ab10b80a646e4b579ef4c0d5dfe90776e908"

docs/qsl_compat_upgrade.md

@@ -5,7 +5,7 @@ This repository defines the QSL central compatibility manifest and its upgrade p
 ## 文件结构
 
 - `compat/bundles/*.toml`
-  - 每个 bundle 用 Calendar Version 命名（当前：`2026.07.2`）。
+  - 每个 bundle 用 Calendar Version 命名（当前：`2026.07.3`）。
   - 记录 QSL 管控的固定内部仓库提交。
 - `compat/repo-tiers.toml`
   - 记录仓库层级（`core/strategy-lib/pipeline/runtime/ops`）与升级 ring 规则。
@@ -26,8 +26,8 @@ This repository defines the QSL central compatibility manifest and its upgrade p
 
 ```toml
 [qsl]
-bundle = "2026.07.2"   # 选择要对齐的 central bundle
-compat = "2026.07.2"   # 兼容检查入口（与 bundle 相同）
+bundle = "2026.07.3"   # 选择要对齐的 central bundle
+compat = "2026.07.3"   # 兼容检查入口（与 bundle 相同）
 tier = "ops/tooling"
 upgrade_ring = "ring_e"
 allow_legacy = false     # 需要临时兼容时可先放开
@@ -53,7 +53,7 @@ python scripts/render_qsl_dependency_graph.py --repo-root . --format md
 
 ## 当前中心兼容基线
 
-- Bundle: `2026.07.2`
+- Bundle: `2026.07.3`
 - QPK: `37c81901160c5b31127a27dba1c63944933fb6bf`
 - UsEquityStrategies: `17ddb86c72d44b2c7b78ba7a10d8f71b21180166`
 - HkEquityStrategies: `b6a8ac2ad3c8110b5ea74fb059c8206388d63bcd`

python/scripts/qslctl.py

@@ -187,6 +187,14 @@ def _status_bucket(result: RepoCheckResult) -> str:
 
 
 def _issue_kind(message: str) -> str:
+    if message.startswith("invalid qsl.tier "):
+        return "invalid qsl.tier"
+    if message.startswith("invalid qsl.upgrade_ring "):
+        return "invalid qsl.upgrade_ring"
+    if message.startswith("tier/ring mismatch "):
+        return "tier/ring mismatch"
+    if message.startswith("forbidden dependency direction "):
+        return "forbidden dependency direction"
     if message.startswith("bundle pin mismatch for "):
         return "bundle pin mismatch"
     if message.startswith("forbidden short/invalid ref "):
@@ -197,6 +205,10 @@ def _issue_kind(message: str) -> str:
         return "legacy dependency files detected"
     if message.startswith("unmanaged qsl dependency "):
         return "unmanaged qsl dependency"
+    if message.startswith("non-canonical qsl.tier "):
+        return "non-canonical qsl.tier"
+    if message.startswith("non-canonical qsl.upgrade_ring "):
+        return "non-canonical qsl.upgrade_ring"
     return "other"
 
 

python/tests/test_qsl_compat_checker.py

@@ -30,9 +30,42 @@ def _write_bundle(self, compat_root: Path, bundle_name: str, repos: dict[str, st
             block.append(f'{repo} = "{ref}"')
         bundle_path.write_text("\n".join(block) + "\n", encoding="utf-8")
 
+    def _write_repo_tiers(self, compat_root: Path) -> None:
+        path = compat_root / "compat" / "repo-tiers.toml"
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(
+            "[tiers]\n"
+            'core = { name = "core" }\n'
+            'strategy_lib = { name = "strategy-lib" }\n'
+            'pipeline = { name = "pipeline" }\n'
+            'runtime = { name = "runtime" }\n'
+            'ops = { name = "ops/tooling" }\n'
+            "\n[upgrade_rings]\n"
+            'ring_a = "core"\n'
+            'ring_b = "strategy-lib"\n'
+            'ring_c = "pipeline"\n'
+            'ring_d = "runtime"\n'
+            'ring_e = "ops/tooling"\n'
+            "\n[upgrade_rules]\n"
+            "allow_drift = [\n"
+            '  "ops/tooling:runtime",\n'
+            '  "ops/tooling:pipeline",\n'
+            '  "ops/tooling:strategy-lib",\n'
+            '  "ops/tooling:core",\n'
+            '  "runtime:pipeline",\n'
+            '  "runtime:strategy-lib",\n'
+            '  "runtime:core",\n'
+            '  "pipeline:strategy-lib",\n'
+            '  "pipeline:core",\n'
+            '  "strategy-lib:core",\n'
+            "]\n",
+            encoding="utf-8",
+        )
+
     def test_root_compat_bundle_and_ring_schema(self):
         with tempfile.TemporaryDirectory() as workspace:
             compat_root = Path(workspace)
+            self._write_repo_tiers(compat_root)
             self._write_bundle(
                 compat_root,
                 "2026.07.2",
@@ -63,6 +96,7 @@ def test_root_compat_bundle_and_ring_schema(self):
     def test_not_enforced_bundle_reports_warning_for_short_sha_and_mismatch_but_main_stays_issue(self):
         with tempfile.TemporaryDirectory() as workspace:
             compat_root = Path(workspace)
+            self._write_repo_tiers(compat_root)
             self._write_bundle(
                 compat_root,
                 "2026.07.2",
@@ -103,6 +137,7 @@ def test_not_enforced_bundle_reports_warning_for_short_sha_and_mismatch_but_main
     def test_live_constraint_files_allow_full_sha_drift_from_bundle(self):
         with tempfile.TemporaryDirectory() as workspace:
             compat_root = Path(workspace)
+            self._write_repo_tiers(compat_root)
             self._write_bundle(
                 compat_root,
                 "2026.07.2",
@@ -111,7 +146,7 @@ def test_live_constraint_files_allow_full_sha_drift_from_bundle(self):
             repo_root = self._make_repo_root(
                 qsl_toml=(
                     'tier = "core"\n'
-                    "ring = 0\n"
+                    'upgrade_ring = "ring_a"\n'
                     "allow_legacy = true\n"
                     "[compat]\n"
                     'bundle = "2026.07.2"\n'
@@ -135,6 +170,7 @@ def test_live_constraint_files_allow_full_sha_drift_from_bundle(self):
     def test_live_constraint_files_still_block_short_refs(self):
         with tempfile.TemporaryDirectory() as workspace:
             compat_root = Path(workspace)
+            self._write_repo_tiers(compat_root)
             self._write_bundle(
                 compat_root,
                 "2026.07.2",
@@ -143,7 +179,7 @@ def test_live_constraint_files_still_block_short_refs(self):
             repo_root = self._make_repo_root(
                 qsl_toml=(
                     'tier = "core"\n'
-                    "ring = 0\n"
+                    'upgrade_ring = "ring_a"\n'
                     "allow_legacy = true\n"
                     "[compat]\n"
                     'bundle = "2026.07.2"\n'
@@ -167,6 +203,7 @@ def test_live_constraint_files_still_block_short_refs(self):
     def test_not_enforced_bundle_exception_metadata_notes(self):
         with tempfile.TemporaryDirectory() as workspace:
             compat_root = Path(workspace)
+            self._write_repo_tiers(compat_root)
             self._write_bundle(
                 compat_root,
                 "2026.07.2",
@@ -175,7 +212,7 @@ def test_not_enforced_bundle_exception_metadata_notes(self):
             repo_root = self._make_repo_root(
                 qsl_toml=(
                     'tier = "pipeline"\n'
-                    "ring = 2\n"
+                    'upgrade_ring = "ring_c"\n'
                     'owner = "pipeline-team"\n'
                     'expires_at = "2099-12-31"\n'
                     'next_action = "remove transition pin drift"\n'
@@ -198,6 +235,7 @@ def test_not_enforced_bundle_exception_metadata_notes(self):
     def test_legacy_reason_suppresses_allowed_legacy_warning(self):
         with tempfile.TemporaryDirectory() as workspace:
             compat_root = Path(workspace)
+            self._write_repo_tiers(compat_root)
             self._write_bundle(
                 compat_root,
                 "2026.07.2",
@@ -206,7 +244,7 @@ def test_legacy_reason_suppresses_allowed_legacy_warning(self):
             repo_root = self._make_repo_root(
                 qsl_toml=(
                     'tier = "pipeline"\n'
-                    "ring = 2\n"
+                    'upgrade_ring = "ring_c"\n'
                     "allow_legacy = true\n"
                     'legacy_reason = "runtime deployment compatibility"\n'
                     'owner = "runtime-team"\n'
@@ -232,6 +270,104 @@ def test_legacy_reason_suppresses_allowed_legacy_warning(self):
             self.assertIn("bundle pin mismatch", warnings[0])
             self.assertIn("legacy_reason=runtime deployment compatibility", notes)
 
+    def test_non_canonical_tier_and_ring_emit_warnings(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            compat_root = Path(workspace)
+            self._write_repo_tiers(compat_root)
+            self._write_bundle(
+                compat_root,
+                "2026.07.2",
+                {"QuantPlatformKit": "37c81901160c5b31127a27dba1c63944933fb6bf"},
+            )
+            repo_root = self._make_repo_root(
+                qsl_toml=(
+                    'tier = "strategy-library"\n'
+                    "ring = 1\n"
+                    "[compat]\n"
+                    'bundle = "2026.07.2"\n'
+                ),
+                pyproject=(
+                    'dependencies = ["quant-platform-kit @ '
+                    'git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@37c81901160c5b31127a27dba1c63944933fb6bf"]\n'
+                ),
+            )
+
+            ok, issues, warnings, _notes = check_qsl_compat._check(repo_root=repo_root, compat_root=compat_root)
+
+            self.assertTrue(ok)
+            self.assertEqual(issues, [])
+            self.assertTrue(any("non-canonical qsl.tier 'strategy-library'" in item for item in warnings))
+            self.assertTrue(any("non-canonical qsl.upgrade_ring '1'" in item for item in warnings))
+
+    def test_runtime_platform_alias_maps_to_runtime_without_direction_error(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            root = Path(workspace)
+            compat_root = root / "QuantRuntimeSettings"
+            self._write_repo_tiers(compat_root)
+            self._write_bundle(
+                compat_root,
+                "2026.07.2",
+                {"QuantPlatformKit": "37c81901160c5b31127a27dba1c63944933fb6bf"},
+            )
+            (root / "QuantPlatformKit").mkdir(parents=True, exist_ok=True)
+            (root / "QuantPlatformKit" / "qsl.toml").write_text(
+                'tier = "core"\nupgrade_ring = "ring_a"\n[compat]\nbundle = "2026.07.2"\n',
+                encoding="utf-8",
+            )
+            repo_root = self._make_repo_root(
+                qsl_toml=(
+                    'tier = "runtime-platform"\n'
+                    "ring = 3\n"
+                    "[compat]\n"
+                    'bundle = "2026.07.2"\n'
+                ),
+                pyproject=(
+                    'dependencies = ["quant-platform-kit @ '
+                    'git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@37c81901160c5b31127a27dba1c63944933fb6bf"]\n'
+                ),
+            )
+
+            ok, issues, warnings, _notes = check_qsl_compat._check(repo_root=repo_root, compat_root=compat_root)
+
+            self.assertTrue(ok)
+            self.assertEqual(issues, [])
+            self.assertTrue(any("non-canonical qsl.tier 'runtime-platform'" in item for item in warnings))
+            self.assertTrue(any("non-canonical qsl.upgrade_ring '3'" in item for item in warnings))
+
+    def test_forbidden_dependency_direction_is_reported(self):
+        with tempfile.TemporaryDirectory() as workspace:
+            root = Path(workspace)
+            compat_root = root / "QuantRuntimeSettings"
+            self._write_repo_tiers(compat_root)
+            self._write_bundle(
+                compat_root,
+                "2026.07.2",
+                {"UsEquityStrategies": "17ddb86c72d44b2c7b78ba7a10d8f71b21180166"},
+            )
+            (root / "UsEquityStrategies").mkdir(parents=True, exist_ok=True)
+            (root / "UsEquityStrategies" / "qsl.toml").write_text(
+                'tier = "strategy-lib"\nupgrade_ring = "ring_b"\n[compat]\nbundle = "2026.07.2"\n',
+                encoding="utf-8",
+            )
+            repo_root = self._make_repo_root(
+                qsl_toml=(
+                    'tier = "core"\n'
+                    'upgrade_ring = "ring_a"\n'
+                    "[compat]\n"
+                    'bundle = "2026.07.2"\n'
+                ),
+                pyproject=(
+                    'dependencies = ["us-equity-strategies @ '
+                    'git+https://github.com/QuantStrategyLab/UsEquityStrategies.git@17ddb86c72d44b2c7b78ba7a10d8f71b21180166"]\n'
+                ),
+            )
+
+            ok, issues, warnings, _notes = check_qsl_compat._check(repo_root=repo_root, compat_root=compat_root)
+
+            self.assertFalse(ok)
+            self.assertEqual(warnings, [])
+            self.assertTrue(any("forbidden dependency direction" in item for item in issues))
+
 
 if __name__ == "__main__":
     unittest.main()