P0-04/P0-08：workflow allowlist校准 + account-diagnosis 409 reason codes (#587)

* fix(qrs): P0-04 workflow allowlist校准 + P0-08 diagnosis 409 reason codes

- 校准 github_workflow_allowlist：保留 LB PAPER once；Schwab 改为 runtime-daily-sync；
  移除 IBKR/Binance 404；Firstrade 无 daily projection 不加入；omitted 表显式登记
- 文档明确 workflow success ≠ 成交；PAPER once ≠ live
- account-diagnosis 409 拆分为稳定 reason_code（身份冲突/缺来源/不可用等），
  不绕过验证；前端展示 reason_code

* fix(ci): regenerate catalog projection; keep getJson http_* message

- Rebuild runtime-catalog-projection/config.js sha after allowlist edit
- Preserve Error.message as http_${status} for overview history callers;
  diagnosis still reads reason_code/payload (P0-08)

Author: Pigbibi

docs/digest-workflow-allowlist.zh-CN.md

@@ -0,0 +1,33 @@
+# 日报 GitHub workflow allowlist 校准（P0-04）
+
+审计基准：2026-10-09 公开仓 raw/API 取证。
+
+## 语义边界（必读）
+
+- **workflow success ≠ 成交/订单事实。** allowlist 命中只贡献“当日可能有过一次运行投影/发布”的存在性辅助证据；`fill_count` / `order_count` 仍为 unknown，除非 `DIGEST_CANDIDATES` 提供已知计数。
+- **PAPER once ≠ live。** LongBridge `publish-runtime-daily-once.yml` 绑定 `longbridge-paper` Environment，是手动一次性 PAPER 投影，不得解读为 live 运行或正式成交。
+- **heartbeat-only 永不进入 allowlist。** `execution-report-heartbeat.yml` / `runtime-heartbeat.yml` 是监控心跳，不是业务日投影入口。
+- **业务证据优先候选管道。** 正式权益/持仓/信号/调仓应走 `DIGEST_CANDIDATES_*`；workflow 文件名仅作运维定位。
+
+## 2026-10-09 路径核对
+
+| platform_id | 原 allowlist | 公开仓结果 | 校准后 |
+| --- | --- | --- | --- |
+| longbridge | `publish-runtime-daily-once.yml` | 存在；name=`Publish PAPER Daily Runtime Once`；`workflow_dispatch`；PAPER | 保留；`evidence_role=paper_projection_once` |
+| schwab | `publish-runtime-daily-once.yml` | **404**；正式手动入口为 `runtime-daily-sync.yml`（`Schwab Runtime Daily Manual`） | 改为 `runtime-daily-sync.yml`；`evidence_role=manual_daily_projection` |
+| ibkr | `publish-runtime-daily-once.yml` | **404**；无 `runtime-daily-sync.yml` | 移入 omitted（`missing`） |
+| binance | `publish-runtime-daily-once.yml` | **404**；另有 facts/heartbeat，非 daily projection | 移入 omitted（`missing`） |
+| firstrade | （未列入） | 无 daily projection workflow；仅 heartbeat 等 | omitted（`no_daily_projection_workflow`）；不加入 allowlist |
+
+配置真源：`platform-config.json` → `notifications.quant_sentinel.daily_digest.aggregator.github_workflow_allowlist` 与 `github_workflow_allowlist_omitted`。
+
+## 验收
+
+```bash
+python3 -m unittest \
+  python.tests.test_daily_digest_aggregator.DailyDigestAggregatorTests.test_allowlist_loaded_from_platform_config \
+  python.tests.test_daily_digest_aggregator.DailyDigestAggregatorTests.test_allowlist_calibrated_paths_and_roles \
+  python.tests.test_runtime_settings.RuntimeSettingsTest.test_notification_route_is_runtime_reference_only -v
+```
+
+重新取证时冻结 SHA，不要把当时的 main 自动等同线上生产。

platform-config.json

@@ -119,32 +119,56 @@
               "platform_id": "longbridge",
               "repository": "QuantStrategyLab/LongBridgePlatform",
               "workflow": "publish-runtime-daily-once.yml",
-              "strategy_profile": "russell_top50_leader_rotation"
+              "strategy_profile": "russell_top50_leader_rotation",
+              "evidence_role": "paper_projection_once",
+              "path_status": "present",
+              "note_zh": "PAPER 环境手动一次性投影；workflow success 仅作存在性证据，不成交事实；≠ live。",
+              "note_en": "PAPER env manual one-shot projection; workflow success is existence-only, not fill facts; not live."
             },
             {
               "platform_id": "schwab",
               "repository": "QuantStrategyLab/CharlesSchwabPlatform",
-              "workflow": "publish-runtime-daily-once.yml",
-              "strategy_profile": "soxl_soxx_trend_income"
-            },
+              "workflow": "runtime-daily-sync.yml",
+              "strategy_profile": "soxl_soxx_trend_income",
+              "evidence_role": "manual_daily_projection",
+              "path_status": "present",
+              "note_zh": "正式入口为 runtime-daily-sync.yml（原 publish-runtime-daily-once.yml 404）；仍为存在性证据，counts 未知。",
+              "note_en": "Canonical entry is runtime-daily-sync.yml (publish-runtime-daily-once.yml 404); existence-only, counts unknown."
+            }
+          ],
+          "binance_alignment_note_zh": "Binance 历史 GH secret 名 TG_TOKEN 仍独立；对齐步骤：将 TG_TOKEN 换成与 quant-sentinel-telegram-bot-token 同一 bot，或改为 TELEGRAM_TOKEN_SECRET_NAME 模式。公开仓只记名称。",
+          "binance_alignment_note_en": "Binance still uses legacy GH secret name TG_TOKEN; align by pointing TG_TOKEN at the same bot as quant-sentinel-telegram-bot-token, or migrate to TELEGRAM_TOKEN_SECRET_NAME. Public repo records names only.",
+          "workflow_install_path": ".github/workflows/daily-digest-notify.yml",
+          "workflow_install_note_zh": "公开 OAuth 无 workflow scope 时，本仓以 docs/workflows/ 为真源文稿；具备 workflow 权限的维护者拷贝到 .github/workflows/ 后 schedule/dispatch 才会生效。",
+          "workflow_install_note_en": "When the pushing credential lacks the workflow OAuth scope, docs/workflows/ is the authored source; a maintainer with workflow scope must copy it to .github/workflows/ before schedule/dispatch runs.",
+          "github_workflow_allowlist_omitted": [
             {
               "platform_id": "ibkr",
               "repository": "QuantStrategyLab/InteractiveBrokersPlatform",
-              "workflow": "publish-runtime-daily-once.yml",
-              "strategy_profile": "soxl_soxx_trend_income"
+              "requested_workflow": "publish-runtime-daily-once.yml",
+              "path_status": "missing",
+              "reason_zh": "公开仓无 publish-runtime-daily-once.yml / runtime-daily-sync.yml；heartbeat 故意不进日报 allowlist。",
+              "reason_en": "No publish-runtime-daily-once.yml or runtime-daily-sync.yml in public tree; heartbeat intentionally omitted from digest allowlist."
             },
             {
               "platform_id": "binance",
               "repository": "QuantStrategyLab/BinancePlatform",
-              "workflow": "publish-runtime-daily-once.yml",
-              "strategy_profile": "crypto_equity_combo"
+              "requested_workflow": "publish-runtime-daily-once.yml",
+              "path_status": "missing",
+              "reason_zh": "公开仓无该文件；binance-account-facts / runtime-heartbeat 不是 runtime daily projection，不冒充成交证据。",
+              "reason_en": "File absent; binance-account-facts / runtime-heartbeat are not runtime daily projection and must not impersonate fill evidence."
+            },
+            {
+              "platform_id": "firstrade",
+              "repository": "QuantStrategyLab/FirstradePlatform",
+              "requested_workflow": null,
+              "path_status": "no_daily_projection_workflow",
+              "reason_zh": "公开仓无 daily projection workflow；仅有 execution-report-heartbeat，不加入 allowlist。",
+              "reason_en": "No daily projection workflow in public tree; only execution-report-heartbeat, not added to allowlist."
             }
           ],
-          "binance_alignment_note_zh": "Binance 历史 GH secret 名 TG_TOKEN 仍独立；对齐步骤：将 TG_TOKEN 换成与 quant-sentinel-telegram-bot-token 同一 bot，或改为 TELEGRAM_TOKEN_SECRET_NAME 模式。公开仓只记名称。",
-          "binance_alignment_note_en": "Binance still uses legacy GH secret name TG_TOKEN; align by pointing TG_TOKEN at the same bot as quant-sentinel-telegram-bot-token, or migrate to TELEGRAM_TOKEN_SECRET_NAME. Public repo records names only.",
-          "workflow_install_path": ".github/workflows/daily-digest-notify.yml",
-          "workflow_install_note_zh": "公开 OAuth 无 workflow scope 时，本仓以 docs/workflows/ 为真源文稿；具备 workflow 权限的维护者拷贝到 .github/workflows/ 后 schedule/dispatch 才会生效。",
-          "workflow_install_note_en": "When the pushing credential lacks the workflow OAuth scope, docs/workflows/ is the authored source; a maintainer with workflow scope must copy it to .github/workflows/ before schedule/dispatch runs."
+          "workflow_evidence_policy_zh": "github_workflow_allowlist 仅用于运维定位与存在性辅助证据。workflow success ≠ 成交/订单事实；PAPER once ≠ live；正式业务证据优先 DIGEST_CANDIDATES。heartbeat-only 永不进入 allowlist。",
+          "workflow_evidence_policy_en": "github_workflow_allowlist is ops locator + existence-only auxiliary evidence. workflow success ≠ fill/order facts; PAPER once ≠ live; prefer DIGEST_CANDIDATES for business evidence. Heartbeat-only never enters the allowlist."
         }
       }
     }

python/scripts/build_config.py

@@ -743,6 +743,56 @@ def validate_notification_references(config: dict, errors: list[str]) -> None:
                                                 f"github_workflow_allowlist[{index}].{field} "
                                                 "required"
                                             )
+                                    evidence_role = item.get("evidence_role")
+                                    if evidence_role is not None and not str(evidence_role).strip():
+                                        errors.append(
+                                            f"{path}.daily_digest.aggregator."
+                                            f"github_workflow_allowlist[{index}].evidence_role "
+                                            "must be non-empty when set"
+                                        )
+                                    path_status = item.get("path_status")
+                                    if path_status is not None and str(path_status).strip() not in {
+                                        "present",
+                                    }:
+                                        errors.append(
+                                            f"{path}.daily_digest.aggregator."
+                                            f"github_workflow_allowlist[{index}].path_status "
+                                            "must be 'present' when set (404 paths belong in "
+                                            "github_workflow_allowlist_omitted)"
+                                        )
+                        omitted = aggregator.get("github_workflow_allowlist_omitted")
+                        if omitted is not None:
+                            if not isinstance(omitted, list):
+                                errors.append(
+                                    f"{path}.daily_digest.aggregator."
+                                    "github_workflow_allowlist_omitted must be a list"
+                                )
+                            else:
+                                for index, item in enumerate(omitted):
+                                    if not isinstance(item, dict):
+                                        errors.append(
+                                            f"{path}.daily_digest.aggregator."
+                                            f"github_workflow_allowlist_omitted[{index}] "
+                                            "must be an object"
+                                        )
+                                        continue
+                                    if not str(item.get("platform_id") or "").strip():
+                                        errors.append(
+                                            f"{path}.daily_digest.aggregator."
+                                            f"github_workflow_allowlist_omitted[{index}]."
+                                            "platform_id required"
+                                        )
+                                    status = str(item.get("path_status") or "").strip()
+                                    if status not in {
+                                        "missing",
+                                        "no_daily_projection_workflow",
+                                    }:
+                                        errors.append(
+                                            f"{path}.daily_digest.aggregator."
+                                            f"github_workflow_allowlist_omitted[{index}]."
+                                            "path_status must be 'missing' or "
+                                            "'no_daily_projection_workflow'"
+                                        )
 
 
 def validate_runtime_authority_status(config: dict, errors: list[str]) -> None:

python/scripts/daily_digest_aggregator.py

@@ -196,26 +196,19 @@ def default_workflow_allowlist(config: Mapping[str, Any]) -> list[dict[str, str]
 
     platforms = config.get("platforms") or {}
     rows: list[dict[str, str]] = []
-    defaults: dict[str, tuple[str, str]] = {
+    # Fallback only when platform-config allowlist is absent.
+    # Keep in sync with calibrated present paths (P0-04); never list 404 stems.
+    defaults: dict[str, tuple[str, str, str]] = {
+        # workflow → strategy_profile → evidence_role
         "longbridge": (
             "publish-runtime-daily-once.yml",
             "russell_top50_leader_rotation",
+            "paper_projection_once",
         ),
         "schwab": (
-            "publish-runtime-daily-once.yml",
+            "runtime-daily-sync.yml",
             "soxl_soxx_trend_income",
-        ),
-        "ibkr": (
-            "publish-runtime-daily-once.yml",
-            "soxl_soxx_trend_income",
-        ),
-        "firstrade": (
-            "publish-runtime-daily-once.yml",
-            "unspecified",
-        ),
-        "binance": (
-            "publish-runtime-daily-once.yml",
-            "crypto_equity_combo",
+            "manual_daily_projection",
         ),
     }
     configured = (
@@ -239,17 +232,22 @@ def default_workflow_allowlist(config: Mapping[str, Any]) -> list[dict[str, str]
                 repo = str(platforms[platform_id].get("repository") or "").strip()
             if not repo:
                 continue
-            rows.append(
-                {
-                    "platform_id": platform_id,
-                    "repository": repo,
-                    "workflow": workflow,
-                    "strategy_profile": strategy or "unspecified",
-                }
-            )
+            row = {
+                "platform_id": platform_id,
+                "repository": repo,
+                "workflow": workflow,
+                "strategy_profile": strategy or "unspecified",
+            }
+            evidence_role = str(item.get("evidence_role") or "").strip()
+            if evidence_role:
+                row["evidence_role"] = evidence_role
+            path_status = str(item.get("path_status") or "").strip()
+            if path_status:
+                row["path_status"] = path_status
+            rows.append(row)
         return rows
 
-    for platform_id, (workflow, strategy) in defaults.items():
+    for platform_id, (workflow, strategy, evidence_role) in defaults.items():
         meta = platforms.get(platform_id) or {}
         repo = str(meta.get("repository") or "").strip()
         if not repo:
@@ -260,6 +258,8 @@ def default_workflow_allowlist(config: Mapping[str, Any]) -> list[dict[str, str]
                 "repository": repo,
                 "workflow": workflow,
                 "strategy_profile": strategy,
+                "evidence_role": evidence_role,
+                "path_status": "present",
             }
         )
     return rows
@@ -305,6 +305,7 @@ def collect_from_github_workflows(
         repository = entry["repository"]
         workflow = entry["workflow"]
         strategy = entry["strategy_profile"]
+        evidence_role = str(entry.get("evidence_role") or "").strip()
         owner_repo = repository.split("/", 1)
         if len(owner_repo) != 2:
             result.failures.append(
@@ -387,7 +388,10 @@ def collect_from_github_workflows(
             "order_count": None,
             "cycle_count": 1,
             "status": "ok",
-            "note": f"github_workflow:{workflow}",
+            "note": (
+                f"github_workflow:{workflow}"
+                + (f";evidence_role:{evidence_role}" if evidence_role else "")
+            ),
             "field_status": {
                 "fill_count": "counts_unknown",
                 "order_count": "counts_unknown",

python/tests/test_daily_digest_aggregator.py

@@ -184,6 +184,50 @@ def test_allowlist_loaded_from_platform_config(self):
         self.assertTrue(any(row["platform_id"] == "longbridge" for row in rows))
         self.assertTrue(all(row["repository"].startswith("QuantStrategyLab/") for row in rows))
 
+    def test_allowlist_calibrated_paths_and_roles(self):
+        config = aggregator.load_platform_config()
+        rows = aggregator.default_workflow_allowlist(config)
+        by_platform = {row["platform_id"]: row for row in rows}
+        self.assertEqual(set(by_platform), {"longbridge", "schwab"})
+        self.assertEqual(
+            by_platform["longbridge"]["workflow"], "publish-runtime-daily-once.yml"
+        )
+        self.assertEqual(
+            by_platform["longbridge"].get("evidence_role"), "paper_projection_once"
+        )
+        self.assertEqual(by_platform["schwab"]["workflow"], "runtime-daily-sync.yml")
+        self.assertEqual(
+            by_platform["schwab"].get("evidence_role"), "manual_daily_projection"
+        )
+        # 404 / heartbeat-only platforms stay out of the active allowlist.
+        for absent in ("ibkr", "binance", "firstrade"):
+            self.assertNotIn(absent, by_platform)
+        omitted = (
+            (config.get("notifications") or {})
+            .get("quant_sentinel", {})
+            .get("daily_digest", {})
+            .get("aggregator", {})
+            .get("github_workflow_allowlist_omitted")
+            or []
+        )
+        omitted_ids = {str(item.get("platform_id")) for item in omitted}
+        self.assertTrue({"ibkr", "binance", "firstrade"}.issubset(omitted_ids))
+
+    def test_allowlist_fallback_defaults_match_calibrated_paths(self):
+        config = {
+            "platforms": {
+                "longbridge": {"repository": "QuantStrategyLab/LongBridgePlatform"},
+                "schwab": {"repository": "QuantStrategyLab/CharlesSchwabPlatform"},
+                "ibkr": {"repository": "QuantStrategyLab/InteractiveBrokersPlatform"},
+            },
+            "notifications": {"quant_sentinel": {"daily_digest": {"aggregator": {}}}},
+        }
+        rows = aggregator.default_workflow_allowlist(config)
+        by_platform = {row["platform_id"]: row for row in rows}
+        self.assertEqual(set(by_platform), {"longbridge", "schwab"})
+        self.assertEqual(by_platform["schwab"]["workflow"], "runtime-daily-sync.yml")
+        self.assertNotIn("ibkr", by_platform)
+
     def test_sender_dry_run_does_not_require_secrets(self):
         code = sender.main(
             [

python/tests/test_runtime_settings.py

@@ -315,6 +315,23 @@ def test_notification_route_is_runtime_reference_only(self):
         self.assertEqual(aggregator["schema_version"], "qsl.daily_digest_aggregator.v1")
         self.assertEqual(aggregator["counts_policy"], "never_invent_fills_or_orders")
         self.assertTrue(aggregator["github_workflow_allowlist"])
+        allow_by_platform = {
+            row["platform_id"]: row for row in aggregator["github_workflow_allowlist"]
+        }
+        self.assertEqual(
+            allow_by_platform["longbridge"]["workflow"],
+            "publish-runtime-daily-once.yml",
+        )
+        self.assertEqual(
+            allow_by_platform["schwab"]["workflow"],
+            "runtime-daily-sync.yml",
+        )
+        self.assertNotIn("ibkr", allow_by_platform)
+        self.assertNotIn("binance", allow_by_platform)
+        omitted_ids = {
+            row["platform_id"] for row in aggregator.get("github_workflow_allowlist_omitted") or []
+        }
+        self.assertTrue({"ibkr", "binance", "firstrade"}.issubset(omitted_ids))
         self.assertEqual(
             sentinel["github_variable_contract"]["TELEGRAM_TOKEN_SECRET_NAME"],
             "quant-sentinel-telegram-bot-token",