Pigbibi · Oct 6, 2026 · Oct 6, 2026
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -1,12 +1,5 @@
 # Code of Conduct
 
-## 中文摘要
-
-- 用途：本文档说明 QuantStrategyLab 仓库中的讨论、issue、pull request 和 review 行为规范。
-- 主要覆盖：`Our Standards`、`Project Scope`、`Reporting and Enforcement`。
-- 阅读顺序：参与讨论或提交 PR 前先确认沟通边界；发现不当行为时联系维护者。
-- 风险提示：涉及投资、交易、密钥或实盘系统的讨论必须保持克制、可复现和证据导向。
-
 ## Our Standards
 
 - Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions.

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,13 +1,5 @@
 # Contributing
 
-
-## 中文摘要
-
-- 用途：本文档围绕 `Contributing`，用于理解 `IBKRGatewayManager` 的配置、运行、部署、研究或验收边界。
-- 主要覆盖：`Ground Rules`、`Branching and Pull Requests`、`Local Verification`。
-- 阅读顺序：先确认边界、输入输出和权限要求，再执行文档里的命令、CI、dry-run、发布或切换步骤。
-- 风险提示：涉及实盘、密钥、权限、Cloud Run、交易所或券商 API 的变更，必须先在测试环境或 dry-run 验证；不要只凭示例直接修改生产。
-- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
 Thanks for contributing to `IBKRGatewayManager`.
 
 ## Ground Rules
@@ -16,6 +8,7 @@ Thanks for contributing to `IBKRGatewayManager`.
 - Keep refactors separate from behavior changes.
 - Add or update tests when changing runtime behavior.
 - Do not use deployment or scheduled workflows as a substitute for local verification.
+- Changes that touch live trading, secrets, permissions, Cloud Run, or an exchange/broker API must be verified in a test environment or dry run first; do not edit production from an example alone.
 
 ## Branching and Pull Requests
 

diff --git a/README.md b/README.md
@@ -1,13 +1,6 @@
 # IBKRGatewayManager
 
-
-## QSL architecture role
-
-- **Layer**: `runtime-ops`.
-- **Responsibility**: IBKR gateway VM lifecycle and 2FA operations utility.
-- **Owns**: gateway deployment, remote sync, Docker rollout, watcher setup.
-- **Consumes**: InteractiveBrokersPlatform operational requirements.
-- **Must not**: decide strategy eligibility or submit trading orders.
+IBKRGatewayManager keeps an Interactive Brokers Gateway VM running for the QuantStrategyLab trading system. It handles the VM's deployment, remote sync, Docker rollout, and the 2FA watcher that keeps the Gateway logged in without an operator clicking through dialogs by hand. The InteractiveBrokersPlatform repository depends on this gateway being up and authenticated, but this repository never decides which strategy trades or submits an order itself.
 
 [Chinese README](README.zh-CN.md)
 
@@ -27,6 +20,14 @@ It supports the system but does not decide which strategy should be live. Strate
 - Document changes that affect multiple platforms or strategy packages.
 - A compact, generic Gateway dialog never causes a click-through. If the API is unavailable, the watcher may perform one bounded container restart without acknowledging the dialog; an unresolved dialog still fails closed for operator review.
 
+## QSL architecture role
+
+- **Layer**: `runtime-ops`.
+- **Responsibility**: IBKR gateway VM lifecycle and 2FA operations utility.
+- **Owns**: gateway deployment, remote sync, Docker rollout, watcher setup.
+- **Consumes**: InteractiveBrokersPlatform operational requirements.
+- **Must not**: decide strategy eligibility or submit trading orders.
+
 ## Gateway target configuration
 
 Deployment workflows require the repository-level Actions variable `IB_GATEWAY_TARGETS_JSON`. It is a JSON object keyed by a non-sensitive target label (or a list whose entries include `name`). Every target supplies its own GCP project, Workload Identity provider, service account, VM location, and deployment settings. The repository has no default gateway or cloud account.

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -1,13 +1,6 @@
 # IBKRGatewayManager
 
-
-## QSL 架构角色
-
-- **层级**：`运行时运维`。
-- **职责**：IBKR gateway VM 生命周期与 2FA 运维工具。
-- **事实源/归属**：gateway 部署、remote sync、Docker rollout、watcher setup。
-- **消费对象**：InteractiveBrokersPlatform 的运维需求。
-- **禁止事项**：决定策略 eligibility 或提交交易订单。
+IBKRGatewayManager 负责让 QuantStrategyLab 交易系统所依赖的 Interactive Brokers Gateway VM 持续在线。它管理这台 VM 的部署、远端同步、Docker 发布，以及让 Gateway 保持登录状态的 2FA watcher，省去运维人员手动点击验证弹窗。InteractiveBrokersPlatform 仓库依赖这个 Gateway 保持在线且已认证，但本仓库本身从不决定哪个策略交易、也不会提交订单。
 
 [English README](README.md)
 
@@ -27,6 +20,14 @@ IBKRGatewayManager 是 QuantStrategyLab 的IBKR Gateway 运维工具。管理 IB
 - 会影响多个平台或策略包的改动，需要在文档中说明。
 - 遇到小型、通用的 Gateway 弹窗时，系统绝不自动点击确认。若 API 不可用，watcher 最多只会做一次不点击弹窗的容器重启；弹窗仍存在则继续失败关闭，交由人工审阅。
 
+## QSL 架构角色
+
+- **层级**：`运行时运维`。
+- **职责**：IBKR gateway VM 生命周期与 2FA 运维工具。
+- **事实源/归属**：gateway 部署、remote sync、Docker rollout、watcher setup。
+- **消费对象**：InteractiveBrokersPlatform 的运维需求。
+- **禁止事项**：决定策略 eligibility 或提交交易订单。
+
 ## Gateway 目标配置
 
 部署 workflow 必须使用仓库级 Actions variable `IB_GATEWAY_TARGETS_JSON`。它是以非敏感目标标签为 key 的 JSON object（或每项包含 `name` 的 list）。每个目标自行提供 GCP project、Workload Identity provider、service account、VM 位置和部署参数；仓库中没有默认 gateway 或云账号。

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,13 +1,5 @@
 # Security Policy
 
-
-## 中文摘要
-
-- 用途：本文档围绕 `Security Policy`，用于理解 `IBKRGatewayManager` 的配置、运行、部署、研究或验收边界。
-- 主要覆盖：`Reporting a Vulnerability`、`Secret and Credential Exposure`、`Scope Notes`。
-- 阅读顺序：先确认边界、输入输出和权限要求，再执行文档里的命令、CI、dry-run、发布或切换步骤。
-- 风险提示：涉及实盘、密钥、权限、Cloud Run、交易所或券商 API 的变更，必须先在测试环境或 dry-run 验证；不要只凭示例直接修改生产。
-- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
 Thanks for helping keep `IBKRGatewayManager` safe.
 
 This repository is part of a deployment and infrastructure repo. Please do **not** open a public issue for vulnerabilities involving credentials, broker access, cloud resources, order execution, or secret material.