Merge main into rebuild/console-holdings-panel to refresh required checks

Author: Pigbibi

.github/workflows/daily-digest-notify.yml

@@ -38,6 +38,14 @@ on:
         required: false
         type: string
         default: ""
+      layout:
+        description: "Message layout. v1 = current production; sections_v2 = NOTIFY-04 four-section report (try with dry_run first)."
+        required: false
+        type: choice
+        default: v1
+        options:
+          - v1
+          - sections_v2
       include_github_evidence:
         description: "Query allowlisted platform workflow conclusions (counts stay unknown unless candidates supply them)."
         required: true
@@ -79,6 +87,12 @@ jobs:
       DIGEST_CANDIDATES_JSON: ${{ secrets.DIGEST_CANDIDATES_JSON }}
       # Optional path override (Environment variable); relative to workspace.
       DIGEST_CANDIDATES_PATH_VAR: ${{ vars.DIGEST_CANDIDATES_PATH || '' }}
+      # NOTIFY-04 B2: producer store (unset = disabled). Production value:
+      #   gs://qsl-runtime-logs-shared/digest-candidates  (reader SA: prefix-conditioned objectViewer)
+      # Layout: <uri>/<platform_id>/<business_day>/<target>.json
+      DIGEST_CANDIDATES_GCS_URI: ${{ vars.DIGEST_CANDIDATES_GCS_URI || '' }}
+      DIGEST_CANDIDATES_READER_WIF_PROVIDER: ${{ vars.DIGEST_CANDIDATES_READER_WIF_PROVIDER || vars.DIGEST_GCP_WORKLOAD_IDENTITY_PROVIDER || 'projects/252919773759/locations/global/workloadIdentityPools/github-actions/providers/github-main' }}
+      DIGEST_CANDIDATES_READER_SERVICE_ACCOUNT: ${{ vars.DIGEST_CANDIDATES_READER_SERVICE_ACCOUNT || vars.DIGEST_GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT || 'qsl-artifact-evidence@longbridgequant.iam.gserviceaccount.com' }}
       # GCP project that hosts a sentinel bot-token replica (LongBridge path).
       GCP_PROJECT_ID: ${{ vars.DIGEST_GCP_PROJECT_ID || 'longbridgequant' }}
       GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ vars.DIGEST_GCP_WORKLOAD_IDENTITY_PROVIDER || 'projects/252919773759/locations/global/workloadIdentityPools/github-actions/providers/github-main' }}
@@ -98,6 +112,7 @@ jobs:
           INPUT_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
           INPUT_BUSINESS_DAY: ${{ inputs.business_day || '' }}
           INPUT_LOCALE: ${{ inputs.locale || '' }}
+          INPUT_LAYOUT: ${{ inputs.layout || 'v1' }}
           INPUT_INCLUDE_GITHUB: ${{ github.event_name != 'workflow_dispatch' && true || inputs.include_github_evidence }}
         run: |
           set -euo pipefail
@@ -113,6 +128,15 @@ jobs:
           fi
           echo "business_day=$INPUT_BUSINESS_DAY" >> "$GITHUB_OUTPUT"
           echo "locale=$INPUT_LOCALE" >> "$GITHUB_OUTPUT"
+          # Scheduled runs stay on v1 until the NOTIFY-04 switch-over is approved.
+          if [[ "${{ github.event_name }}" == "schedule" ]]; then
+            echo "layout=v1" >> "$GITHUB_OUTPUT"
+          else
+            case "$INPUT_LAYOUT" in
+              sections_v2) echo "layout=sections_v2" >> "$GITHUB_OUTPUT" ;;
+              *) echo "layout=v1" >> "$GITHUB_OUTPUT" ;;
+            esac
+          fi
           if [[ "$INPUT_INCLUDE_GITHUB" == "true" ]]; then
             echo "include_github=true" >> "$GITHUB_OUTPUT"
           else
@@ -152,6 +176,50 @@ jobs:
             echo "Wire steps: docs/digest-candidates-wiring.zh-CN.md"
           fi
 
+      - name: Authenticate to Google Cloud for producer candidates (optional)
+        id: candidates_gcp_auth
+        if: ${{ env.DIGEST_CANDIDATES_GCS_URI != '' }}
+        continue-on-error: true
+        uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ env.DIGEST_CANDIDATES_READER_WIF_PROVIDER }}
+          service_account: ${{ env.DIGEST_CANDIDATES_READER_SERVICE_ACCOUNT }}
+
+      - name: Set up gcloud for producer candidates (optional)
+        if: ${{ steps.candidates_gcp_auth.outcome == 'success' }}
+        uses: google-github-actions/setup-gcloud@v3
+
+      - name: Fetch producer candidates from private store (optional)
+        if: ${{ env.DIGEST_CANDIDATES_GCS_URI != '' }}
+        env:
+          INPUT_BUSINESS_DAY: ${{ steps.opts.outputs.business_day }}
+          AUTH_OUTCOME: ${{ steps.candidates_gcp_auth.outcome }}
+        run: |
+          set -euo pipefail
+          # Never echo row contents (may carry equity); counts only.
+          if [[ "$AUTH_OUTCOME" != "success" ]]; then
+            echo "Producer candidates store configured but authentication failed; continuing without it." >&2
+            echo "::warning::digest candidates store auth failed"
+            exit 0
+          fi
+          day="${INPUT_BUSINESS_DAY:-$(TZ=America/New_York date +%F)}"
+          fetched="data/input/daily-digest/fetched"
+          mkdir -p "$fetched"
+          uri="${DIGEST_CANDIDATES_GCS_URI%/}"
+          found=0
+          while IFS= read -r object; do
+            [[ "$object" == *"/${day}/"*.json ]] || continue
+            rel="${object#"${uri}/"}"
+            mkdir -p "$fetched/$(dirname "$rel")"
+            gcloud storage cp "$object" "$fetched/$rel" --no-user-output-enabled
+            found=$((found + 1))
+          done < <(gcloud storage ls "${uri}/*/${day}/*.json" 2>/dev/null || true)
+          echo "Producer candidate files for ${day}: ${found}"
+          base="${DIGEST_CANDIDATES_PATH:-}"
+          out="data/input/daily-digest/candidates-merged.json"
+          python3 python/scripts/merge_digest_candidates.py ${base:+--base "$base"} --input-dir "$fetched" --output "$out"
+          echo "DIGEST_CANDIDATES_PATH=$out" >> "$GITHUB_ENV"
+
       - name: Authenticate to Google Cloud for sentinel secret (optional)
         id: gcp_auth
         if: ${{ env.TELEGRAM_TOKEN == '' && env.TELEGRAM_TOKEN_SECRET_NAME != '' && steps.opts.outputs.dry_run != 'true' }}
@@ -177,6 +245,7 @@ jobs:
           args=(
             python3 python/scripts/send_daily_digest_telegram.py
             --write-receipt data/output/daily-digest/receipt.json
+            --layout "${{ steps.opts.outputs.layout }}"
           )
           if [[ -n "${{ steps.opts.outputs.locale }}" ]]; then
             args+=(--locale "${{ steps.opts.outputs.locale }}")
@@ -211,6 +280,10 @@ jobs:
           print(f"- status: `{receipt.get('status')}`")
           print(f"- business_day: `{receipt.get('business_day')}`")
           print(f"- locale: `{receipt.get('locale')}`")
+          print(f"- layout: `{receipt.get('layout')}`")
+          window = receipt.get("window") or {}
+          if window:
+              print(f"- window (Asia/Shanghai): `{window.get('start_local')}` → `{window.get('end_local')}`")
           print(f"- evidence_status: `{receipt.get('evidence_status')}`")
           print(f"- run_count: `{receipt.get('run_count')}`")
           print(f"- total_fills: `{receipt.get('total_fills')}`")
@@ -228,6 +301,7 @@ jobs:
               print(f"  - github_sources_matched: `{coverage.get('github_sources_matched')}`")
               print(f"  - has_source_failures: `{coverage.get('has_source_failures')}`")
               print(f"  - is_complete_for_verified_idle: `{coverage.get('is_complete_for_verified_idle')}`")
+              print(f"  - stale_candidates_count: `{coverage.get('stale_candidates_count')}`")
           failures = receipt.get("failures") or coverage.get("github_failures") or []
           if failures:
               print("- failures:")

.github/workflows/digest-store-permission-check.yml

@@ -0,0 +1,38 @@
+name: Digest Store Permission Check
+
+# NOTIFY-04 B2 (read-only): probe whether this repo's GitHub identity can write /
+# read the shared digest-candidate prefix in gs://qsl-runtime-logs-shared, and
+# whether the bucket is private. Uses testIamPermissions / metadata reads only;
+# never creates, overwrites or deletes objects. Prints booleans and HTTP codes.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      GCP_PROJECT_ID: longbridgequant
+      GCP_WORKLOAD_IDENTITY_PROVIDER: projects/252919773759/locations/global/workloadIdentityPools/github-actions/providers/github-main
+      GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: qsl-artifact-evidence@longbridgequant.iam.gserviceaccount.com
+      DIGEST_STORE_BUCKET: qsl-runtime-logs-shared
+      DIGEST_STORE_PREFIX: digest-candidates/
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}
+
+      - name: Set up gcloud
+        uses: google-github-actions/setup-gcloud@v3
+
+      - name: Probe digest store permissions (read-only)
+        run: python3 python/scripts/digest_store_permission_check.py

docs/digest-candidates-wiring.zh-CN.md

@@ -42,6 +42,7 @@ GitHub workflow 成功结论只是**存在性**辅助证据；成交/订单数
 
 - 聚合键为 `(platform_id, strategy_profile, opaque_account_uid|unknown, target_id|unknown)`；同策略多账户必须带身份，禁止仅用平台+策略合并。
 - `actually_ran` 必须显式布尔；缺省不再默认 `true`。
+- **NOTIFY-04 新鲜度**：每行必须带 `business_day`（America/New_York 交易日，ISO 日期），或者带 `as_of`（ISO 时间戳，按纽约日历日换算；无时区按 UTC）。和本次日报业务日不一致、缺失或无法解析的行一律丢弃，不渲染金额/持仓；日报末尾加一段「⚠️ 数据未更新，已略去：· 平台 / 策略（数据业务日 …）」，receipt 写 `stale_candidates[]`（只含平台、策略、日期、原因码）和 `source_coverage.stale_candidates_count`。有丢弃行时不判定「已验证无运行」。
 - 新 stub / 存在性证据：`fill_count`/`order_count` 用 `null` + `field_status.counts_unknown` 或 `reason_code=github_workflow_existence_only`。
 - 旧生产者若仍给 `int 0` 且无 `field_status`，按「已验证零成交」兼容。
 - 权益/持仓/信号/调仓字段可选；有则渲染，无则省略；中央不编造。
@@ -106,6 +107,16 @@ python3 python/scripts/send_daily_digest_telegram.py \
 - receipt：`total_fills=null`（`total_fills_status=unknown`），非 0
 - 渲染文案含「成交数未知」/「成交 未知」；**不**出现「无成交」「链路正常」
 
+### 私有存储自动接线（NOTIFY-04 B2，默认关闭）
+
+- 生产者（Schwab `digest-candidates-daily.yml`、IBKR `execution-report-heartbeat.yml` 定时）每天生成候选，只有设置了仓库变量 `DIGEST_CANDIDATES_GCS_URI` 才会上传到 `<uri>/<platform_id>/<business_day>/<target>.json`；没设就是 dry-run，文件只留在 runner 临时目录。
+- 中央日报设置了同名 Environment 变量才去读取：先用 `DIGEST_CANDIDATES_READER_*` 的 WIF 认证，再把 `<uri>/*/<business_day>/*.json` 和旧 secret（如果还有）用 `merge_digest_candidates.py` 合并（日志只打印条数）。过期行仍由 B0 规则丢弃。
+- 存储位置：复用现有的共享 bucket，前缀为 `gs://qsl-runtime-logs-shared/digest-candidates/`（不新建 bucket，不做 Cloud Scheduler 准点触发，继续用 GitHub Actions cron）。
+- 2026-10-11 只读探测（各仓库的 `Digest Store Permission Check`）：Schwab 和 IBKR 的部署 SA 对该 bucket 只能 get/list，**不能 create**；QRS 读取 SA `qsl-artifact-evidence@longbridgequant` **不能 get/list**；匿名 list 返回 401。
+- 2026-10-11 owner 已加好 3 条带前缀条件的 IAM。生产者仓库的变量值为 `DIGEST_CANDIDATES_GCS_URI=gs://qsl-runtime-logs-shared/digest-candidates`。QRS 的同名变量**暂不设置**：一旦设置，日报内容会改变（B7）。
+- （原计划）需要 owner 一次性加带前缀条件的 IAM：生产者在 `digest-candidates/<platform>/` 下给 objectUser；读取者给 objectViewer，条件为对象前缀或 `objectListPrefix` 前缀。完成后先设生产者仓库的变量，日报仓库的变量最后设，因为它会改变日报内容（B7，需要批准）。全部核对通过之后，才删除 `DIGEST_CANDIDATES_JSON`。
+- 不用 Actions artifact 中转：这几个仓库都是公开仓库，artifact 任何登录用户都能下载，而候选数据可能带有账户权益。
+
 ### 生产注入（人闸）
 
 写入 Environment `runtime-strategy-switch` 的 secret `DIGEST_CANDIDATES_JSON`（或由私有前置步骤写出文件后设 `DIGEST_CANDIDATES_PATH`），再对 `daily-digest-notify.yml` 做 **dry-run** `workflow_dispatch`。改生产 Environment / 关 dry-run 需人工确认；本任务与自动化**不得**直接改生产 Environment。

docs/notifications-quant-sentinel.zh-CN.md

@@ -54,6 +54,13 @@ Chat 目标仍只通过运行时注入：`QSL_GLOBAL_TELEGRAM_CHAT_ID`（首选
 - **观察字段（有证据才写，禁止编造）**：`strategy_label`、`equity`、`holdings[]`（symbol/value/qty）、`signal_summary`、`rebalance_kind` / `rebalance_conclusion`、可选 `tips` / `account_hint`。每个观察块标题前缀 `[account]`：`account_hint`（人类可读）→ `{platform_id} {account_scope|execution_mode}`（如 `schwab live` / `ibkr live` / `firstrade paper`）→ 短 `opaque_account_uid` → `target_id`（末位）。GitHub workflow 成功结论只证明「跑过」，不填金额/持仓。
 - **不改交易/风控判定**；纯聚合展示。金额与账户标识不得写入公开 CI 日志。
 
+### NOTIFY-04 四段式日报（sections_v2，试运行中）
+
+- 版式：`--layout sections_v2` / env `DIGEST_LAYOUT` / workflow_dispatch 输入 `layout`。**定时运行固定 `v1`**，切换需要单独批准（NOTIFY-04 B7）。
+- 窗口：纽约交易日 `B` 的日报标为上海 `B+1`，覆盖 `[B 06:00, B+1 06:00)` Asia/Shanghai（= `[B-1 22:00, B 22:00)` UTC）；receipt 写 `window{start_local,end_local,start_utc,end_utc,report_date}`。
+- 顺序：⚠️ 待处理（异常行、过期候选、证据未知）→ 📈 美股日策略（纽约周末写「休市」，工作日无证据写「本窗口无运行证据」）→ 💰 定投（`us_dca_month_end` 和加密 `*_dca`；只在有运行时出现）→ 🪙 加密小时策略（只在有运行时出现）→ 🧾 覆盖。
+- 分段：候选行的 `section`（`us_daily` / `dca` / `crypto_intraday`）优先；没有就按 `platform-config.json` 的 domain / scheduler_profile 推断。Binance 小时策略里的 BTC 定投腿要等生产者单独出一行 `section=dca`（B3）。
+
 ### 调度（合同默认）
 
 - 时区：`Asia/Shanghai`