From c14800e0ff483b8508416fb24e5d9b379c1419b6 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Wed, 7 Oct 2026 02:09:13 +0800 Subject: [PATCH] docs: reorder architecture-role block, add SECURITY/CODE_OF_CONDUCT - Move the "QSL architecture role" field-list block in README.md and README.zh-CN.md to after the human-readable intro section, so readers hit the plain-language description before the structured metadata. Pure reordering; no factual content changed. - Add SECURITY.md and CODE_OF_CONDUCT.md (previously missing), tailored to this repo's actual scope as an artifact/snapshot pipeline rather than a trading execution platform. Co-Authored-By: Claude Sonnet 5 --- CODE_OF_CONDUCT.md | 16 ++++++++++++++++ README.md | 17 ++++++++--------- README.zh-CN.md | 17 ++++++++--------- SECURITY.md | 27 +++++++++++++++++++++++++++ 4 files changed, 59 insertions(+), 18 deletions(-) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 SECURITY.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..e4605e9 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,16 @@ +# Code of Conduct + +## Our Standards + +- Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions. +- Assume technical disagreement is about the work. Keep feedback specific to code, docs, data, evidence, reproducibility, or operational risk. +- Avoid harassment, insults, discriminatory language, personal attacks, and repeated off-topic comments. +- Do not pressure maintainers or contributors to disclose private account details, credentials, unpublished data, or personal information. + +## Project Scope + +This repository builds snapshot artifacts, manifests, and release evidence for A-share strategy research within QuantStrategyLab. Contributions should keep claims about data quality and artifact correctness conservative and verifiable, separate engineering evidence from investment decisions, and avoid presenting examples or outputs as investment advice. + +## Reporting and Enforcement + +Report conduct concerns to the maintainer on GitHub: `@Pigbibi`. Maintainers may edit or remove comments, close issues or pull requests, restrict participation, or take other reasonable steps to protect contributors and project integrity. diff --git a/README.md b/README.md index 957863f..d416623 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,5 @@ # CnEquitySnapshotPipelines - -## QSL architecture role - -- **Layer**: `pipeline`. -- **Responsibility**: A-share snapshot and evidence pipeline. -- **Owns**: validated factor snapshots, manifests, ranking previews, release evidence. -- **Consumes**: CnEquityStrategies metadata and upstream market inputs. -- **Must not**: place broker orders or decide live enablement alone. - [Chinese README](README.zh-CN.md) > Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only. @@ -19,6 +10,14 @@ This repository produces evidence and artifacts. It does not place broker orders, store broker credentials, or make a strategy live by itself. +## QSL architecture role + +- **Layer**: `pipeline`. +- **Responsibility**: A-share snapshot and evidence pipeline. +- **Owns**: validated factor snapshots, manifests, ranking previews, release evidence. +- **Consumes**: CnEquityStrategies metadata and upstream market inputs. +- **Must not**: place broker orders or decide live enablement alone. + ## Active snapshot profile | Profile | Display name | Contract | Builder | diff --git a/README.zh-CN.md b/README.zh-CN.md index 08e82f1..68a3b0f 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -1,14 +1,5 @@ # CnEquitySnapshotPipelines - -## QSL 架构角色 - -- **层级**：`快照/证据流水线`。 -- **职责**：A 股快照与证据流水线。 -- **事实源/归属**：已验证 factor snapshots、manifests、ranking previews、release evidence。 -- **消费对象**：CnEquityStrategies 元数据和上游市场输入。 -- **禁止事项**：下券商订单或单独决定 live enablement。 - [English README](README.md) > 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。 @@ -19,6 +10,14 @@ 本仓库只产出证据与 artifact，不下单，不保存券商凭据，也不能单独决定某个策略是否 live。 +## QSL 架构角色 + +- **层级**：`快照/证据流水线`。 +- **职责**：A 股快照与证据流水线。 +- **事实源/归属**：已验证 factor snapshots、manifests、ranking previews、release evidence。 +- **消费对象**：CnEquityStrategies 元数据和上游市场输入。 +- **禁止事项**：下券商订单或单独决定 live enablement。 + ## 当前 active snapshot profile | Profile | 名称 | 契约 | Builder | diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..8d0cbef --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security Policy + +Thanks for helping keep `CnEquitySnapshotPipelines` safe. + +This repository builds A-share factor-snapshot artifacts, manifests, and release evidence; it does not place broker orders or store broker credentials. Please do **not** open a public issue for vulnerabilities involving CI/CD secrets, data-source credentials, or issues that could let an attacker tamper with published artifacts or manifests consumed by downstream strategy repositories. + +## Reporting a Vulnerability + +- Contact the maintainer directly at GitHub: `@Pigbibi`. +- If private vulnerability reporting is enabled for this repository, prefer that channel. +- Include the repository name, affected commit or branch, environment details, and exact reproduction steps. + +## Secret and Credential Exposure + +If you suspect tokens, API keys, or other CI/CD secrets were exposed: + +1. Rotate the exposed secrets immediately. +2. Pause the affected scheduled workflow if the exposure could affect automated artifact publishing. +3. Share only the minimum evidence needed to reproduce the issue. + +## Artifact Integrity + +If you find a way to make this pipeline produce a snapshot, manifest, or ranking preview that misrepresents its inputs (for example, bypassing point-in-time safety or validation checks described in [`docs/artifact_contract.md`](docs/artifact_contract.md)), please report it the same way as a security issue, since downstream repositories consume these artifacts without re-deriving them. + +## Scope Notes + +Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors with a security report or patch.