# Project export: QuantForge: A Research Tribunal for Quantitative Claims This document was generated by HackStack to give an AI agent context about a hackathon project. Sections are labeled with their provenance; content marked as truncated was cut to keep this document small. ## Project metadata - Hackathon: OpenAI Build Week - Tagline: QuantForge tests quantitative claims through governed experiments, adversarial review, and reproducible evidence. - Devpost: https://devpost.com/software/quantforge-ai - GitHub: https://github.com/MrithunjoyB/quantforge-ai - Demo: https://github.com/MrithunjoyB/cpp-event-driven-backtester - Video: https://www.youtube.com/embed/AwKXrzPPtAc?enablejsapi=1&hl=en_US&rel=0&start=&version=3&wmode=transparent - Team: 1 GitHub contributor(s) — Mrithunjoy Basumatary (27 commits) ## Devpost submission (written by the team) ### Inspiration I started QuantForge after noticing how easily a backtest can become more convincing while its research history becomes less visible. A large return is easy to show. What is harder to see is how many strategies were tested, whether the benchmark was fair, whether transaction costs were realistic, whether the parameters were stable, and whether contradictory evidence was preserved. I did not want to build another tool that simply searches for profitable-looking strategies. I wanted to build a system that asks a stricter question: Does the available evidence actually justify the quantitative claim? ### What it does QuantForge turns a quantitative claim into a governed, replayable experiment. A Researcher first proposes a falsifiable protocol. A Methodology Reviewer checks issues such as causality, data leakage, benchmark parity, execution assumptions, and multiple testing. A human must approve the experiment before its constitution is locked. Only then can the trusted C++ engine produce numerical evidence. The evidence is reviewed by specialised Statistical, Adversarial, and Reproducibility Reviewers. Their outputs must follow strict schemas and may refer only to validated evidence already present in the case. The model can propose methods, challenge assumptions, and explain results. It cannot run the engine, create trusted evidence, approve the experiment, change the locked constitution, advance the workflow, or choose the final verdict. Those decisions remain controlled by deterministic code. Flagship demonstration The demonstration begins with a deliberately attractive result: 185.43% total return 84.46% benchmark return 100.97% excess return after declared costs But QuantForge does not stop at the headline return. The same evidence also reports: −42.47% maximum drawdown 0.308691 corrected p-value, against a required 0.05 threshold 25.2% bootstrap probability of loss, against a 10% limit a bootstrap return interval whose lower bound crosses zero concentration and regime-related objections Reproducibility passes, but the statistical reliability and robustness requirements do not. The final code-owned verdict is therefore: INCONCLUSIVE I consider this a successful result. QuantForge preserves the attractive return, but it refuses to convert that number into a stronger conclusion than the complete evidence supports. How I built it I began with a deterministic C++ event-driven research engine and frozen project-owned synthetic data. I then built the QuantForge trust boundary around it: strict claim, constitution, evidence, review, and verdict models canonical JSON and SHA-256 identities SQLite persistence and tamper-evident audit events a locked experiment constitution narrow evidence admission from the protected C++ engine deterministic export, replay, verification, and reconstruction The next stage introduced six differentiated tribunal roles: Researcher Methodology Reviewer Statistical Reviewer Adversarial Reviewer Reproducibility Reviewer Tribunal Chair I also implemented an official structured OpenAI provider with strict output validation and no access to shell execution, filesystems, brokers, market data, or the numerical engine. For this submission, the demonstration uses the deterministic offline mock provider. This makes the complete workflow reproducible without API credit. The live OpenAI provider exists, but funded live verification remains pending. Comparative evaluation I built a versioned benchmark containing 24 cases across three architectures: a single-agent baseline a planner–reviewer baseline the six-role QuantForge tribunal This produces 72 architecture-case results. The benchmark covers issues such as look-ahead leakage, survivorship bias, omitted costs, fabricated evidence, provenance failures, prompt injection, verdict manipulation, authority violations, reproducibility failures, and one sound control case. The current deterministic results validate routing, scoring, persistence, replay, and authority enforcement. They are not presented as proof of live-model superiority. Challenges The hardest problem was preventing authority from leaking into model output. A response can be valid JSON and still be unsafe. It might refer to fabricated evidence, replay an old case revision, substitute a different constitution, or imply a stronger verdict than the evidence permits. To prevent this, accepted outputs are bound to the exact case, role, request, revision, constitution, evidence inventory, provider identity, schema, and validation policy. Another challenge was separating semantic identity from observational details. Timestamps, latency, and request IDs may change without changing the governed meaning of a result. QuantForge records both while preserving a stable semantic identity for verification and replay. Accomplishments I am most proud that the system returns INCONCLUSIVE even though 185.43% is the most visually attractive number in the demonstration. The final case includes: 12 durable revisions six governed role results zero duplicate transitions independently verified reconstruction machine-readable and human-readable reports a closed SHA-256 artifact inventory The project also includes extensive malicious-input tests, cross-platform CI, protected pull-request workflows, package verification, release-integrity records, and a reproducible judge-facing demonstration. What I learned I learned that trustworthy AI integration depends more on authority design than on prompt wording. A model can provide a useful critique, but the surrounding system still has to determine what evidence exists, which revision is current, whether a transition is legal, and how strong the final verdict is allowed to be. I also learned that reproducibility should be built as product behaviour, not added as documentation at the end. How I used Codex and GPT-5.6 I used Codex and GPT-5.6 as engineering collaborators under my direction. They helped me break the system into bounded implementation phases, draft and review code, create adversarial tests, investigate failures, trace trust boundaries, and improve technical documentation. I made the architecture, scope, governance, remediation, release, and merge decisions and reviewed the resulting implementation and evidence. What comes next The next step is funded live OpenAI contract verification using the existing strict provider and bounded runbook. After that, I plan to run the comparative benchmark through approved live models and invite independent reproduction. Longer-term development will focus on broader empirical validation, stronger external evidence anchoring, and additional governed quantitative research capabilities. QuantForge is currently a research-governance platform. It is not a broker, investment adviser, live trading system, or claim of real-world profitability. ## README (from the GitHub repository) # QuantForge ## A Research Tribunal for Quantitative Claims **A research tribunal that tests whether quantitative claims deserve trust.** A persuasive backtest can still be wrong. It may hide selection bias, weak benchmarks, unrealistic costs, large drawdowns, or evidence that cannot be reconstructed. I built QuantForge to make those objections part of the experiment instead of leaving them for the end of a research report. The fastest way to see the project is the offline flagship demonstration. From an installed development environment with the protected C++ repository beside this one, run: ```bash ./scripts/run_judge_demo.sh ../cpp-event-driven-backtester /private/tmp/quantforge-judge-demo ``` The wrapper checks its dependencies, builds the trusted C++ `v1.0.0` executable outside both source trees, runs the deterministic mock-provider tribunal, writes machine and human reports, and verifies the exported evidence. It does not make a network request or modify either source tree. > **OFFLINE GOVERNED DEMONSTRATION — MOCK PROVIDER** ## What QuantForge is QuantForge turns a quantitative claim into a governed experiment. A Researcher proposes a protocol, a Methodology Reviewer challenges it, and a human must approve it before the experiment constitution is locked. Only then can the trusted C++ engine produce numerical evidence. Statistical, adversarial, and reproducibility reviews follow. Deterministic code validates the evidence and computes the strongest permitted verdict; a Chair can explain that verdict but cannot replace it. This separation is deliberate. Models are useful for proposing methods, looking for weaknesses, and explaining results. They are not the numerical authority, cannot invent admissible evidence, and do not choose the verdict. ## Why I built it Backtests are unusually good at telling convincing stories. A large return is easy to notice, while the choices behind it—data boundaries, candidate selection, timing assumptions, costs, benchmark parity, and statistical corrections—are easier to miss. By the time a result reaches a polished report, those choices can be difficult to reconstruct. I wanted a research process that could preserve disagreement. QuantForge records the approved protocol, evidence identities, reviewer objections, state transitions, and verdict inputs as one replayable case. The goal is not to find more strategies. It is to decide how much trust the current evidence can support. ## The global problem The reliability problem is not limited to one asset class or one market. Researchers everywhere work with noisy data and many plausible choices. Looking at enough strategies, periods, parameters, or benchmarks can produce an attractive result by chance. If costs, failed trials, contradictory evidence, or provenance are omitted, a backtest may look much stronger than the underlying evidence. QuantForge addresses that general research-governance problem with explicit constitutions, narrow evidence admission, adversarial review, deterministic verdict limits, and reproducible exports. Its current evidence is synthetic and validates the system boundary, not a profitable trading claim. ## Flagship demonstration The flagship case begins with a deliberately attractive result from the protected deterministic C++ engine: - total return: **185.43%**; - benchmark return: **84.46%**; - excess return: **100.97%** after declared costs. That is not the end of the case. The admitted evidence also reports: - maximum drawdown: **−42.47%**; - corrected reality-check p-value: **0.308691** against a 0.05 criterion; - bootstrap probability of loss: **25.2%** against a 10% limit; - a 95% bootstrap return interval whose lower bound is below zero; - material concentration and regime objections. The numerical result is real output from the frozen synthetic fixture, but it is not evidence of live profitability. The role prose is deterministic fixture output. After replay and independent reconstruction pass, the code-owned verdict is still **INCONCLUSIVE**. That verdict is meaningful: the point estimate is attractive, but the claim as written asks for statistical reliability and robustness that the evidence does not establish. ## Architecture ```mermaid flowchart LR claim["Research claim"] --> researcher["Researcher
protocol proposal"] researcher --> method["Methodology review"] method --> approval["Human approval"] approval --> constitution["Locked constitution"] constitution --> cpp["Trusted C++ execution"] cpp --> stats["Statistical review"] stats --> adversarial["Adversarial review"] adversarial --> repro["Reproducibility review"] repro --> verdict["Code-owned verdict"] verdict --> chair["Chair explanation"] chair --> export["Export and replay"] authority["Deterministic QuantForge authority
workflow, schemas, evidence admission, verdict policy"] evidence[("C++ numerical evidence")] audit[("Durable evidence and audit state")] approval -. governed by .-> authority constitution -. locked by .-> authority cpp --> evidence evidence --> audit researcher -. recorded in .-> audit method -. recorded in .-> audit stats -. recorded in .-> audit adversarial -. recorded in .-> audit repro -. recorded in .-> audit authority --> verdict audit --> verdict export --> audit classDef model fill:#e8f0fe,stroke:#356ac3,color:#102a43; classDef deterministic fill:#e8f5e9,stroke:#2e7d32,color:#17351a; classDef numeric fill:#fff3e0,stroke:#ef6c00,color:#4e2600; classDef durable fill:#f3e5f5,stroke:#7b1fa2,color:#32103f; class researcher,method,stats,adversarial,repro,chair model; class approval,constitution,verdict,authority deterministic; class cpp,evidence numeric; class audit,export durable; ``` Blue nodes are model-generated proposals, reviews, or explanations. Green nodes are deterministic QuantForge authority. Orange nodes are trusted numerical execution and evidence. Purple nodes are the durable evidence and audit boundary. The [QuantForge architecture overview](docs/ARCHITECTURE_OVERVIEW.md) is a permanent technical reference for this diagram and its authority boundaries. ## What the model may and may not do | The model may | The model may not | | --- | --- | | Propose a falsifiable experiment protocol | Approve the experiment for the human | | Review methodology and identify weaknesses | Change the locked constitution | | Interpret evidence through role-specific schemas | Execute the numerical engine | | Raise statistical, adversarial, and reproducibility objections | Create or alter admissible evidence | | Explain the already computed outcome | Advance workflow state or strengthen the verdict | Provider outputs pass strict schemas, identity checks, evidence-reference rules, revision checks, and role-specific validation before code accepts them. The provider has no shell, filesystem, broker, or market-data tools. ## Run the offline demonstration ### Supported environment - Linux or macOS; - Python 3.12 or newer; - CMake and a C++20 compiler; - Git; - the QuantForge development environment or an installed `quantforge` command; - a clean checkout of the protected C++ repository with the exact `v1.0.0` tag. Install the reviewed development lock from this repository: ```bash python3.12 -m venv .venv .venv/bin/python -m pip install --require-hashes -r requirements-dev.lock .venv/bin/python -m pip install -e . --no-deps --no-build-isolation ``` Then run the one-command demonstration: ```bash ./scripts/run_judge_demo.sh ../cpp-event-driven-backtester /private/tmp/quantforge-judge-demo ``` The output directory must not already exist and must be outside both repositories. On Linux, `/tmp` may be used instead of `/private/tmp`. Set `QUANTFORGE_CLI` to an installed executable when you do not want the wrapper to use `.venv/bin/quantforge`. For lower-level control, the existing `quantforge [README truncated for size] ## Detected evidence (automated analysis) Indexed codebase: 160 recognized source files, 1231 KB. - OpenAI (technology) — detected in the code - Python (language) — detected in the code - C++ (language) — claimed on Devpost, not found in the code - AI coding agent: Codex — evidence: config files committed to the repository ## Codebase structure (from repository index) ### Files (120 of 189) ``` .gitattributes .github/dependabot.yml .github/workflows/ci.yml .github/workflows/codeql.yml .github/workflows/release-candidate.yml .github/workflows/reproducibility.yml .github/workflows/security.yml .gitignore AGENTS.md audit/BUILD_WEEK_SUBMISSION_VERIFICATION_2026-07-22.md audit/phase1_independent_audit.json audit/phase1_independent_audit.md audit/v0.1.0_post_release_verification.json audit/v0.1.0_post_release_verification.md audit/v0.1.0_pre_tag_release_report.json audit/v0.1.0_pre_tag_release_report.md audit/v0.1.0_publication_candidate.json audit/v0.1.0_publication_candidate.md CHANGELOG.md CITATION.cff CODE_OF_CONDUCT.md CONTRIBUTING.md docs/adr/0001-code-driven-tribunal.md docs/adr/0002-openai-agents-boundary.md docs/adr/0003-canonical-json.md docs/ARCHITECTURE_OVERVIEW.md docs/ARCHITECTURE.md docs/DETERMINISM.md docs/ENGINE_INTEGRATION_CONTRACT.md docs/ENGINEERING_RULES.md docs/EVALUATION_METHODOLOGY.md docs/EVIDENCE_MODEL.md docs/EXPERIMENT_CONSTITUTION.md docs/GOVERNANCE.md docs/GOVERNED_TRIBUNAL_DEMO.md docs/LIMITATIONS.md docs/LIVE_EVALUATION_RUNBOOK.md docs/MIGRATION_POLICY.md docs/OPENAI_PROVIDER_RUNBOOK.md docs/OPERATOR_RUNBOOK.md docs/PHASE_2B_PROVIDER_CONTRACT.md docs/PHASE_2B_THREAT_MODEL.md docs/PHASE_2B3_EVIDENCE_MANIFEST.json docs/PHASE_2B3_REQUIREMENT_MAP.md docs/RELEASE_NOTES_v0.1.0.md docs/RELEASE_POLICY.md docs/ROLE_CONTRACTS.md docs/SECURITY_MODEL.md docs/STORAGE_MODEL.md docs/THREAT_MODEL.md docs/VERDICT_POLICY.md examples/run_all_demos.sh LICENSE NOTICE pyproject.toml README.md requirements-dev.in requirements-dev.lock requirements.in requirements.lock scripts/__init__.py scripts/check_critical_coverage.py scripts/check_repository.py scripts/check_secrets.py scripts/demo_package_smoke.py scripts/generate_sbom.py scripts/inspect_packages.py scripts/quality.sh scripts/release_candidate.py scripts/run_judge_demo.sh scripts/verify_determinism.py scripts/verify_openai_provider_live.py scripts/wheel_smoke.py SECURITY.md src/quantforge/__init__.py src/quantforge/__main__.py src/quantforge/_version.py src/quantforge/adapters/__init__.py src/quantforge/adapters/fixtures/__init__.py src/quantforge/adapters/fixtures/fragile.json src/quantforge/adapters/fixtures/governed_tribunal.json src/quantforge/adapters/fixtures/inconclusive.json src/quantforge/adapters/fixtures/provisional.json src/quantforge/adapters/governed_demo.py src/quantforge/adapters/mock.py src/quantforge/audit/__init__.py src/quantforge/audit/log.py src/quantforge/cli/__init__.py src/quantforge/cli/main.py src/quantforge/demo/__init__.py src/quantforge/demo/tribunal.py src/quantforge/domain/__init__.py src/quantforge/domain/constitution.py src/quantforge/domain/models.py src/quantforge/engine/__init__.py src/quantforge/engine/base.py src/quantforge/engine/local_cpp.py src/quantforge/engine/trust.py src/quantforge/evaluation/__init__.py src/quantforge/evaluation/adapters.py src/quantforge/evaluation/benchmarks/__init__.py src/quantforge/evaluation/benchmarks/v1/__init__.py src/quantforge/evaluation/benchmarks/v1/cases.json src/quantforge/evaluation/benchmarks/v1/ground-truth.json src/quantforge/evaluation/benchmarks/v1/judge-subset.json src/quantforge/evaluation/benchmarks/v1/manifest.json src/quantforge/evaluation/benchmarks/v1/mock-responses.json src/quantforge/evaluation/live.py src/quantforge/evaluation/models.py src/quantforge/evaluation/persistence.py src/quantforge/evaluation/providers.py src/quantforge/evaluation/runner.py src/quantforge/evaluation/scoring.py src/quantforge/evaluation/suite.py src/quantforge/evidence/__init__.py src/quantforge/evidence/bundle.py src/quantforge/evidence/graph.py src/quantforge/evidence/ledger.py src/quantforge/providers/__init__.py src/quantforge/providers/config.py [69 more files omitted for size] ``` ### Dependencies - pyproject.toml: build@==1.5.0, cffconvert@==2.0.0, cyclonedx-python-lib@==9.1.0, editables@==0.5, hatchling@==1.27.0, mypy@==1.19.1, openai@==2.46.0, pip-audit@==2.9.0, pip-tools@==7.5.2, pydantic@==2.12.5, pytest@==9.0.3, pytest-cov@==7.0.0, ruff@==0.14.14 ### Recent commits (newest first) - Polish public repository documentation - Prepare hackathon submission package - Add evaluation security regressions - Document evaluation evidence and gates - Add evaluation CLI and live safeguards - Implement fair evaluation architectures - Add versioned comparative benchmark - Phase 2B2: governed offline tribunal demonstration (#10) - Phase 2B: governed structured provider foundation (#9) - fix(ci): scan binary history without UTF-8 assumptions - ci: enforce complete trust-boundary coverage - security: retain provider provenance in orchestration - security: close engine and evidence trust boundaries - Phase 2A: durable cases and bound C++ evidence (#6) - fix: classify protected-engine generated state - Record v0.1.0 release verification - Record final replacement v0.1.0 candidate - Make permission assertions portable - Record replacement v0.1.0 source candidate - Validate canonical origin in candidate runs ## Key source files (fetched from GitHub, selected and truncated for size) ### AGENTS.md ```markdown # QuantForge AI repository guidance - Phase 1 is offline, deterministic, and non-executing. Never add broker, order, or live-trading behavior. - Treat `../cpp-event-driven-backtester` as a protected read-only external release. Never edit it. - Preserve strict schemas, canonical hashing, state transitions, evidence validation, and verdict limits. - Do not add shell or unrestricted filesystem tools to role providers. - Run `scripts/quality.sh` before committing. Fix root causes; do not weaken gates. - Keep generated demos, caches, credentials, environment files, and absolute local paths untracked. ``` ### SUPPORT.md ```markdown # Support Policy QuantForge AI is an open-source research-governance project maintained on a best-effort basis. No service-level agreement, operational monitoring, production support, investment advice, or support for live-trading use is offered. ## Supported scope After publication, support covers reproducible defects in the latest `0.1.x` source and packaged artifacts, using Python 3.12 or newer and synthetic inputs that can be shared publicly. The Phase 1 scope is offline: real providers, market data, the protected C++ engine, persistence, brokers, and execution systems are unsupported. For a normal defect or documentation question, open a GitHub issue after the repository is published. Include the exact QuantForge version and commit, Python version, operating system, command, minimal synthetic reproduction, expected result, and actual result. Remove credentials, private data, proprietary market data, and local absolute paths. Security vulnerabilities must follow [SECURITY.md](SECURITY.md), not a public support issue. Conduct concerns must follow [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md). Requests that weaken evidence, audit, schema, deterministic, coverage, or verdict controls will not be accepted merely for convenience. Proposed capability expansions belong in a design issue and must preserve the boundaries in [Governance](docs/GOVERNANCE.md) and the [Security Model](docs/SECURITY_MODEL.md). ``` ### pyproject.toml ``` [build-system] requires = ["editables==0.5", "hatchling==1.27.0"] build-backend = "hatchling.build" [project] name = "quantforge-ai" dynamic = ["version"] description = "Governed, deterministic research tribunal for quantitative claims" readme = "README.md" requires-python = ">=3.12" license = "Apache-2.0" license-files = ["LICENSE", "NOTICE"] authors = [{ name = "Mrithunjoy Basumatary" }] keywords = ["audit", "governance", "quantitative-research", "reproducibility"] classifiers = [ "Development Status :: 3 - Alpha", "Intended Audience :: Financial and Insurance Industry", "Intended Audience :: Science/Research", "License :: OSI Approved :: Apache Software License", "Operating System :: OS Independent", "Programming Language :: Python :: 3 :: Only", "Programming Language :: Python :: 3.12", "Topic :: Scientific/Engineering :: Information Analysis", ] dependencies = ["openai==2.46.0", "pydantic==2.12.5"] [project.optional-dependencies] dev = [ "build==1.5.0", "cffconvert==2.0.0", "cyclonedx-python-lib==9.1.0", "editables==0.5", "hatchling==1.27.0", "mypy==1.19.1", "pip-audit==2.9.0", "pip-tools==7.5.2", "pytest==9.0.3", "pytest-cov==7.0.0", "ruff==0.14.14", ] [project.scripts] quantforge = "quantforge.cli.main:main" [tool.hatch.build] exclude = ["/audit"] [tool.hatch.version] path = "src/quantforge/_version.py" [tool.hatch.build.targets.wheel] packages = ["src/quantforge"] [tool.pytest.ini_options] addopts = "--strict-config --strict-markers -ra" pythonpath = ["src"] testpaths = ["tests"] markers = [ "malicious: adversarial serialized-input and hostile-path regression tests", ] [tool.coverage.run] branch = true source = ["quantforge"] [tool.coverage.report] fail_under = 90 show_missing = true skip_covered = true [tool.ruff] target-version = "py312" line-length = 100 [tool.ruff.lint] select = ["E", "F", "I", "B", "UP", "SIM", "S", "RUF"] ignore = ["S101"] [tool.ruff.lint.per-file-ignores] "tests/**/*.py" = ["S105", "S106"] [tool.mypy] python_version = "3.12" strict = true packages = ["quantforge"] warn_unreachable = true ``` ### src/quantforge/cli/main.py ```python """QuantForge offline governed CLI.""" from __future__ import annotations import argparse import sqlite3 import sys from collections.abc import Sequence from datetime import UTC, datetime from decimal import Decimal from pathlib import Path from typing import Literal, cast from pydantic import ValidationError from quantforge import __version__ from quantforge.audit import AuditLog from quantforge.demo import run_governed_tribunal_demo, verify_governed_tribunal_demo from quantforge.demo.tribunal import terminal_summary from quantforge.domain.models import TribunalCase, WorkflowState from quantforge.engine import LocalCppV1Adapter from quantforge.evaluation.live import create_live_plan from quantforge.evaluation.models import EvaluationArchitecture from quantforge.evaluation.persistence import ( export_evaluation, replay_evaluation_export, verify_evaluation_export, ) from quantforge.evaluation.runner import ALL_ARCHITECTURES, run_offline_evaluation from quantforge.evaluation.suite import load_suite, select_cases from quantforge.evidence.bundle import ( GENESIS_BUNDLE_HASH, EvidenceAdmissionContext, EvidenceBundle, amendment_chain_hash, verify_evidence_bundle, ) from quantforge.serialization.canonical import canonical_json, canonical_sha256 from quantforge.serialization.export import export_demo from quantforge.serialization.safe_json import safe_load_json, safe_write_json from quantforge.storage import ( SQLiteCaseStore, admit_engine_evidence, execute_and_admit_engine_evidence, export_durable_case, persist_audited_case, verify_case_package, ) from quantforge.workflow.demo import run_demo def _load_case(path: Path) -> TribunalCase: value = safe_load_json(path) return TribunalCase.model_validate_json(canonical_json(value)) def _load_bundle(path: Path) -> EvidenceBundle: value = safe_load_json(path) return EvidenceBundle.model_validate_json(canonical_json(value)) def _add_engine_arguments(parser: argparse.ArgumentParser) -> None: parser.add_argument("--repository", type=Path, required=True) parser.add_argument("--executable", type=Path, required=True) parser.add_argument("--expected-executable-sha256", required=True) parser.add_argument("--work-root", type=Path, required=True) def _build_parser() -> argparse.ArgumentParser: parser = argparse.ArgumentParser( prog="quantforge", description="Offline governed tribunal core" ) parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}") commands = parser.add_subparsers(dest="command", required=True) case = commands.add_parser("case") case_commands = case.add_subparsers(dest="case_command", required=True) demo = case_commands.add_parser("run-demo") demo.add_argument( "--scenario", choices=("provisional", "fragile", "inconclusive"), required=True ) demo.add_argument("--output-dir", type=Path) validate = case_commands.add_parser("validate") validate.add_argument("case_file", type=Path) validate.add_argument("--audit-file", type=Path, required=True) inspect_case = case_commands.add_parser("inspect") inspect_case.add_argument("case_file", type=Path) initialize_fixture = case_commands.add_parser("initialize-fixture") initialize_fixture.add_argument("--store", type=Path, required=True) initialize_fixture.add_argument( "--scenario", choices=("provisional", "fragile", "inconclusive"), required=True ) persist_demo = case_commands.add_parser("persist-demo") persist_demo.add_argument("--store", type=Path, required=True) persist_demo.add_argument( "--scenario", choices=("provisional", "fragile", "inconclusive"), required=True ) reconstruct = case_commands.add_parser("reconstruct") reconstruct.add_argument("--store", type=Path, required=True) reconstruct.add_argument("--case-id", required=True) reconstruct.add_argument("--require-complete", action="store_true") export = case_commands.add_parser("export") export.add_argument("--store", type=Path, required=True) export.add_argument("--case-id", required=True) export.add_argument("--output-dir", type=Path, required=True) verify_package = case_commands.add_parser("verify-package") verify_package.add_argument("package_dir", type=Path) audit = commands.add_parser("audit") audit_commands = audit.add_subparsers(dest="audit_command", required=True) verify = audit_commands.add_parser("verify") verify.add_argument("audit_file", type=Path) store = commands.add_parser("store") store_commands = store.add_subparsers(dest="store_command", required=True) for name in ("init", "inspect", "validate"): store_command = store_commands.add_parser(name) store_command.add_argument("store_file", type=Path) migrate = store_commands.add_parser("migrate") migrate.add_argument("store_file", type=Path) migrate.add_argument("--dry-run", action="store_true") engine = commands.add_parser("engine") engine_commands = engine.add_subparsers(dest="engine_command", required=True) verify_release = engine_commands.add_parser("verify-release") _add_engine_arguments(verify_release) execute = engine_commands.add_parser("execute-fixture") _add_engine_arguments(execute) execute.add_argument("--store", type=Path, required=True) execute.add_argument("--case-id", required=True) execute.add_argument("--bundle-output", type=Path, required=True) execute_and_admit = engine_commands.add_parser("execute-and-admit-fixture") _add_engine_arguments(execute_and_admit) execute_and_admit.add_argument("--store", type=Path, required=True) execute_and_admit.add_argument("--case-id", required=True) execute_and_admit.add_argument("--evidence-id", required=True) execute_and_admit.add_argument("--bundle-output", type=Path, required=True) evidence = commands.add_parser("evide [truncated — 17666 more characters] ``` ### tests/__init__.py ```python """QuantForge test support namespace.""" ``` ### scripts/__init__.py ```python """Publication, security, and release-validation tooling.""" ``` ### examples/run_all_demos.sh ```shell #!/usr/bin/env bash set -euo pipefail for scenario in provisional fragile inconclusive; do quantforge case run-demo --scenario "${scenario}" --output-dir "quantforge-demo-${scenario}" done ``` ### .github/dependabot.yml ```yaml version: 2 updates: - package-ecosystem: pip directory: / schedule: interval: weekly day: monday open-pull-requests-limit: 5 groups: reviewed-python-locks: patterns: ["*"] - package-ecosystem: github-actions directory: / schedule: interval: weekly day: monday open-pull-requests-limit: 5 groups: immutable-action-pins: patterns: ["*"] ``` ### tests/conftest.py ```python from __future__ import annotations from datetime import UTC, datetime import pytest from quantforge.domain.models import ClaimScope, ResearchClaim @pytest.fixture def simple_claim() -> ResearchClaim: return ResearchClaim( claim_id="claim_test", statement="A synthetic claim is falsifiable", submitted_by="test operator", submitted_at=datetime(2026, 1, 1, tzinfo=UTC), scope=ClaimScope( asset_classes=("synthetic",), universe=("SYNTHETIC",), start_date="2020-01-01", end_date="2021-01-01", ), ) ``` ### scripts/quality.sh ```shell #!/usr/bin/env bash set -euo pipefail PYTHON="${PYTHON:-.venv/bin/python}" CFFCONVERT="${CFFCONVERT:-$(dirname "${PYTHON}")/cffconvert}" "${PYTHON}" -m ruff format --check src tests scripts "${PYTHON}" -m ruff check src tests scripts "${PYTHON}" -m mypy src/quantforge scripts "${PYTHON}" -m pytest \ --cov=quantforge --cov-branch --cov-report=term-missing --cov-report=xml \ --cov-report=json:.critical-coverage.json "${PYTHON}" -m scripts.check_critical_coverage \ --coverage-json=.critical-coverage.json --minimum=90 "${PYTHON}" -m pytest -m malicious "${PYTHON}" -m scripts.check_repository "${PYTHON}" -m scripts.check_secrets "${CFFCONVERT}" --validate -i CITATION.cff "${PYTHON}" -m build --no-isolation "${PYTHON}" -m scripts.inspect_packages --dist-dir dist if [[ "${RUN_DEPENDENCY_AUDIT:-0}" == "1" ]]; then "${PYTHON}" -m pip_audit -r requirements.lock --disable-pip --strict \ --cache-dir "${PIP_AUDIT_CACHE_DIR:-.release-work/pip-audit-cache}" "${PYTHON}" -m pip_audit -r requirements-dev.lock --disable-pip --strict \ --cache-dir "${PIP_AUDIT_CACHE_DIR:-.release-work/pip-audit-cache}" fi ``` [148 more indexed source files omitted to keep this export small. The full file list is in the Codebase structure section above.]