fix: keep private source integration in private CI

.github/workflows/ci.yml

@@ -31,36 +31,3 @@ jobs:
       - uses: actions/checkout@v6
       - name: Validate workflows
         uses: docker://rhysd/actionlint:1.7.12
-  admitted-service:
-    if: vars.AI_SERVICE_CI_READY == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-      - name: Require approved shared source revision
-        env:
-          APPROVED_SHARED_SHA: ${{ vars.AI_SERVICE_SHARED_SOURCE_SHA }}
-          APPROVED_QPK_SHA: ${{ vars.AI_SERVICE_QPK_SOURCE_SHA }}
-        run: python -c 'import os,re; assert re.fullmatch("[0-9a-f]{40}", os.environ["APPROVED_SHARED_SHA"]); assert re.fullmatch("[0-9a-f]{40}", os.environ["APPROVED_QPK_SHA"])'
-      - uses: actions/checkout@v6
-        with:
-          repository: Pigbibi/AIGateway
-          ssh-key: ${{ secrets.PERSONAL_AI_SERVICE_READ_KEY }}
-          ref: ${{ vars.AI_SERVICE_SHARED_SOURCE_SHA }}
-          path: shared-source
-          persist-credentials: false
-      - uses: actions/setup-python@v6
-        with:
-          python-version: '3.12'
-      - uses: actions/checkout@v6
-        with:
-          repository: QuantStrategyLab/QuantPlatformKit
-          ref: ${{ vars.AI_SERVICE_QPK_SOURCE_SHA }}
-          path: qpk-source
-          persist-credentials: false
-      - name: Validate admitted identities with approved shared service
-        run: |
-          python -m pip install pytest pandas ./shared-source ./qpk-source .
-          python -m pip check
-          PYTHONPATH=ops/quant-monitor python -m pytest -q tests ops/quant-monitor/tests/test_monitor_fail_closed.py

docs/upgrade-v2/QUANT.zh-CN.md

@@ -31,3 +31,7 @@ CN 的本地研究入口已迁入 CnEquityStrategies，保留保护政策、来
 Quant v2.0.2 的准确源码为 `8e771462fd14e4552d6add55b2920f6bd20dc0ee`，共享核心为 `8b36ee8137c8cfa3900f9120066990c71ab23246`。Dot 的 scopes 只有 tasks:read、tasks:work、events:subscribe，不包含 submit、仓库写入、交易或部署。
 
 本轮两个公开合成任务回传 completed，revision=1、output={"sum":12}；由人工在 Dot 聊天中给定真实任务 ID 触发，不能代替自动事件验收。Webhook 获 2xx 时两个监控的 last_run_time 仍为空。自动调度、追加材料/取消的原生验收、Grok Routine 和真实业务资格仍待验证。原生模型不能从 webhook 接口确认，因此未声称使用指定 Astra 模型。
+
+## 2.0.3 公共 CI 边界
+
+公共 CI 不再检出 private 核心或使用其只读 deploy key，只构建 wrapper 和检查工作流。共享服务与 Quant 集成移到 private AIGateway 的 quant-integration.yml，以人工批准的准确 Quant/QPK SHA 验证。核心依赖固定为 personal-ai-service 2.0.3。旧 deploy key 尚未回收，新的公共工作流不消费它。

pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "quant-ai-service"
-version = "2.0.2"
+version = "2.0.3"
 description = "Quant project identity policies for the shared AI task service"
 requires-python = ">=3.10"
-dependencies = ["personal-ai-service==2.0.2"]
+dependencies = ["personal-ai-service==2.0.3"]
 
 [project.scripts]
 quant-ai-service = "quant_ai_service.server:main"