[Pigbibi]

AI assistance

Prepared with Grok Bot (an AI assistant). It wrote the script, tests, workflow and docs and ran the
local checks listed below; a human must review before merge.

What changed

Moves the monthly Firstrade fee-rate review (tracking issue #497, earlier bump in #498) into a
scheduled workflow, .github/workflows/fee-schedule-check.yml, so it does not depend on a chat
reminder. Triggers: cron 17 2 22 * * (22nd, 02:17 UTC) and workflow_dispatch. It also runs the
read-only check job on pull requests that touch the workflow or the script.

• scripts/check_fee_schedule.py check (stdlib only, plus pdftotext) compares the repo schedule with:
  • SEC Section 31 advisory index and latest advisory, plus the SEC pages of SR-FINRA-2026-020 and
    SR-FINRA-2026-021 (a mention of a suspension is a difference);
  • FINRA fee adjustment schedule (SR-FINRA-2024-019, 2024-2026), the FINRA rule filing listing (any TAF
    filing not in REVIEWED_FINRA_FILINGS is a difference), and the SR-FINRA-2026-020 / -021 PDFs
    (2026-2031 rates and the pause window).
  • Any fetch or parse failure is error, never a pass. Only hosts sec.gov and finra.org over https
    are fetched, including after redirects.
• All match: job bump moves verified_through to the end of next month, the "checked" date in the
  module docstring, the test review pin and the doc mentions (same pattern as chore(fees): extend fee schedule verified_through to 2026-12-01 #498), runs the tests and
  opens a pull request. It fails closed if a pin is not found exactly as expected. Never merges.
• Rates changed, a new TAF filing, a suspension, or an error: job notify opens or comments on one
  issue ("Firstrade fee schedule check needs attention") with the report and source URLs. Rates are
  never edited and no bump PR is opened.
• Least privilege: top-level permissions: {}; check has contents: read; bump has
  contents: write and pull-requests: write; notify has issues: write. Only GITHUB_TOKEN, no
  new secrets. Checkout is pinned to the SHA used by ci.yml, concurrency group, 10 minute timeouts.
• Tests: tests/test_check_fee_schedule.py with trimmed saved pages in tests/fixtures/fee_schedule_check/
  (no network). tests/test_statement_reconciliation.py now has one VERIFIED_THROUGH constant instead
  of four hard-coded dates, so the bump rewrites a single line.
• Docs: docs/statement-reconciliation.md and the zh-CN sibling describe the workflow.

Refs #497 (recurring review; intentionally not closed).

How verified

• python scripts/check_fee_schedule.py check against the live sites on 2026-11-01: status unchanged
  for all 7 comparisons. sec.gov answers 403 unless the User-Agent carries a contact address and no URL
  or github.com, so the script sends QuantStrategyLab-fee-check/1.0 <contact>.
• pytest tests/test_check_fee_schedule.py tests/test_statement_reconciliation.py: 62 passed. Repeated
  after dry-running bump on a throwaway copy for 2026-11-22 and 2027-01-22: still 62 passed.
• ruff@0.15.20 check --exclude external . (the locked version): passed. actionlint: passed.
  python scripts/test_style.py: 36 passed. scripts/check_style.py --phase 2: 0 blocking (one
  existing README advisory).
• Not run locally: the full test suite (project dependencies are not installed here; CI runs it), and
  the scheduled jobs themselves. The check job runs on this pull request, which shows that the GitHub
  runners can reach sec.gov and finra.org.

Why

Issue #497 asks for a monthly review. A scheduled workflow is a durable, auditable place for a fixed
job and gives a PR or an issue each month.

Risk

Tier: high (.github/workflows/*, so the risk gate needs owner-approved). No runtime or trading
path changes; verified_through is unchanged in this PR. Operational notes:

• The repository setting "Allow GitHub Actions to create and approve pull requests" is currently off
  (can_approve_pull_request_reviews: false). I did not change it. Until it is enabled by a
  maintainer, bump pushes the branch and the notify issue carries a compare link instead.
• Pull requests opened with GITHUB_TOKEN do not start CI: close and reopen to run it.
• Optional variable FEE_CHECK_CONTACT (monitored address for the sec.gov User-Agent); a placeholder
  is used when unset and worked in testing.
• The parser depends on the current page layouts and the pdftotext -layout output of the named FINRA
  filings. The rule filing listing check sees the latest 25 filings.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4ae94d8f-bffb-40c7-8175-fa8f33de5d80

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn