From 867671f199b56addd9c466d40af5012f25d78d7e Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Wed, 7 Oct 2026 02:09:39 +0800 Subject: [PATCH] docs: move QSL architecture role block after intro, add governance files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both README.md and README.zh-CN.md had the "QSL architecture role" / "QSL 架构角色" field-list block positioned before the human-readable "What this repository is" intro section. Move it to come after that section instead, so the plain-language description leads. Pure reordering, no content changes. Also add SECURITY.md and CODE_OF_CONDUCT.md, which were missing from this repo. Content is tailored to what this repository actually does (A-share strategy-library package, no broker credentials or order execution), using BinancePlatform's merged files as a style reference only. Confirmed via `gh api repos/QuantStrategyLab/CnEquityStrategies/private-vulnerability-reporting` that private vulnerability reporting is not enabled, so SECURITY.md does not claim that channel exists. Co-Authored-By: Claude Sonnet 5 --- CODE_OF_CONDUCT.md | 16 ++++++++++++++++ README.md | 17 ++++++++--------- README.zh-CN.md | 17 ++++++++--------- SECURITY.md | 23 +++++++++++++++++++++++ 4 files changed, 55 insertions(+), 18 deletions(-) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 SECURITY.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..dba4e7b --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,16 @@ +# Code of Conduct + +## Our Standards + +- Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions. +- Assume technical disagreement is about the work. Keep feedback specific to code, docs, data, evidence, reproducibility, or operational risk. +- Avoid harassment, insults, discriminatory language, personal attacks, and repeated off-topic comments. +- Do not pressure maintainers or contributors to disclose private account details, credentials, trading records, unpublished data, or personal information. + +## Project Scope + +`CnEquityStrategies` is a strategy-library repository: it holds A-share strategy implementations, manifests, and catalog metadata that downstream platform repositories consume. Contributions should keep research and backtest claims conservative and verifiable, separate research evidence from live-trading decisions, and avoid presenting examples as investment advice. Broker credentials, order execution, and other live-system concerns belong to the consuming platform repositories; discussions that touch them should stay measured, reproducible, and evidence-based rather than speculative. + +## Reporting and Enforcement + +Report conduct concerns to the maintainer on GitHub: `@Pigbibi`. Maintainers may edit or remove comments, close issues or pull requests, restrict participation, or take other reasonable steps to protect contributors and project integrity. diff --git a/README.md b/README.md index 0cd80eb..07861bc 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,5 @@ # CnEquityStrategies - -## QSL architecture role - -- **Layer**: `strategy-library`. -- **Responsibility**: A-share strategy implementation package. -- **Owns**: runtime-enabled strategy code, manifests, catalog metadata. -- **Consumes**: QuantPlatformKit and validated snapshot artifacts. -- **Must not**: connect to brokers or deploy live services. - [Chinese README](README.zh-CN.md) > Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only. @@ -19,6 +10,14 @@ This repository is a strategy layer, not a broker or deployment layer. It does not store broker credentials, submit orders by itself, publish snapshot artifacts, or decide whether a profile is safe for live trading without external evidence. +## QSL architecture role + +- **Layer**: `strategy-library`. +- **Responsibility**: A-share strategy implementation package. +- **Owns**: runtime-enabled strategy code, manifests, catalog metadata. +- **Consumes**: QuantPlatformKit and validated snapshot artifacts. +- **Must not**: connect to brokers or deploy live services. + ## Current runtime surface ### Direct runtime strategies diff --git a/README.zh-CN.md b/README.zh-CN.md index cd5430e..7ca364f 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -1,14 +1,5 @@ # CnEquityStrategies - -## QSL 架构角色 - -- **层级**：`策略库`。 -- **职责**：A 股策略实现包。 -- **事实源/归属**：runtime-enabled 策略代码、manifests、catalog metadata。 -- **消费对象**：QuantPlatformKit 和已验证快照 artifacts。 -- **禁止事项**：连接券商或部署 live 服务。 - [English README](README.md) > 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。 @@ -19,6 +10,14 @@ 这是策略层，不是券商或部署层。本仓库不保存券商凭据，不自行下单，不发布 snapshot artifact，也不能在缺少外部证据的情况下决定某个 profile 是否适合 live。 +## QSL 架构角色 + +- **层级**：`策略库`。 +- **职责**：A 股策略实现包。 +- **事实源/归属**：runtime-enabled 策略代码、manifests、catalog metadata。 +- **消费对象**：QuantPlatformKit 和已验证快照 artifacts。 +- **禁止事项**：连接券商或部署 live 服务。 + ## 当前 runtime 面 ### 普通 runtime 策略 diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..a7c3913 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +# Security Policy + +Thanks for helping keep `CnEquityStrategies` safe. + +This repository is an A-share strategy-library package: it owns strategy implementations, manifests, and catalog metadata for downstream platform repositories. It does not store broker credentials, submit orders, or connect to brokers itself. Please do not open a public issue for a vulnerability; report it privately instead. + +## Reporting a Vulnerability + +- Contact the maintainer directly at GitHub: `@Pigbibi`. +- Private vulnerability reporting is not currently enabled for this repository, so please report by direct contact rather than through GitHub's advisory flow. +- Include the repository name, affected commit or branch, environment details, and exact reproduction steps. + +## Secret and Credential Exposure + +This repository should never contain broker credentials, account identifiers, or private order data. If you find any committed secrets, tokens, or other sensitive material: + +1. Report it privately rather than filing a public issue. +2. Note the exact file and commit so it can be purged, and rotated if it corresponds to a live credential. +3. Share only the minimum evidence needed to reproduce the issue. + +## Scope Notes + +Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors with a security report or patch.