From 029f522f7ac69bf46210caad7ed9dc0f6bb53b6a Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Wed, 7 Oct 2026 00:58:12 +0800 Subject: [PATCH 1/2] docs: rewrite governance templates into human-readable prose MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the machine-generated "QSL architecture role" block at the top of the README and the near-identical "中文摘要" boilerplate in CONTRIBUTING.md/SECURITY.md with natural-language text, so the docs read like something a maintainer wrote rather than a template fill-in. Co-Authored-By: Claude Sonnet 5 --- CONTRIBUTING.md | 9 +-------- README.md | 25 ++++++++++--------------- README.zh-CN.md | 25 ++++++++++--------------- SECURITY.md | 8 -------- 4 files changed, 21 insertions(+), 46 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c25cea7..6952262 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,13 +1,5 @@ # Contributing - -## 中文摘要 - -- 用途：本文档围绕 `Contributing`，用于理解 `SchwabTokenAutoRefresher` 的配置、运行、部署、研究或验收边界。 -- 主要覆盖：`Ground Rules`、`Branching and Pull Requests`、`Local Verification`。 -- 阅读顺序：先确认边界、输入输出和权限要求，再执行文档里的命令、CI、dry-run、发布或切换步骤。 -- 风险提示：涉及实盘、密钥、权限、Cloud Run、交易所或券商 API 的变更，必须先在测试环境或 dry-run 验证；不要只凭示例直接修改生产。 -- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。 Thanks for contributing to `SchwabTokenAutoRefresher`. ## Ground Rules @@ -16,6 +8,7 @@ Thanks for contributing to `SchwabTokenAutoRefresher`. - Keep refactors separate from behavior changes. - Add or update tests when changing runtime behavior. - Do not use deployment or scheduled workflows as a substitute for local verification. +- Changes touching live trading, credentials, permissions, Cloud Run, or exchange/broker APIs must be verified in a test environment or dry run first; do not edit production based on the examples alone. ## Branching and Pull Requests diff --git a/README.md b/README.md index d83beca..43c1a06 100644 --- a/README.md +++ b/README.md @@ -1,23 +1,10 @@ # SchwabTokenAutoRefresher - -## QSL architecture role - -- **Layer**: `platform-tooling`. -- **Responsibility**: Schwab OAuth token refresh automation utility. -- **Owns**: token refresh flow and Secret Manager sync behavior. -- **Consumes**: Schwab auth endpoints, Google Secret Manager, CharlesSchwabPlatform. -- **Must not**: decide strategy eligibility or log sensitive token values. - [Chinese README](README.zh-CN.md) -> Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only. - -## What this repository is +SchwabTokenAutoRefresher is a QuantStrategyLab credential automation utility. It runs the Schwab OAuth token refresh flow on a schedule and syncs the refreshed credentials to Google Cloud Secret Manager, so other platform services always have a valid token without manual renewal. It supports the system but does not decide which strategy should go live: strategy eligibility stays with the strategy and snapshot repositories, and broker execution stays with the platform repositories. -SchwabTokenAutoRefresher is a QuantStrategyLab credential automation utility. It automates Schwab OAuth token refresh and syncs refreshed credentials to Google Cloud Secret Manager. - -It supports the system but does not decide which strategy should be live. Strategy eligibility remains in the strategy and snapshot repositories; broker execution remains in the platform repositories. +> Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only. ## Design boundary @@ -41,6 +28,14 @@ npm ci - No separate `docs/` directory yet; start with this README and the workflow files. +## QSL architecture role + +- **Layer**: `platform-tooling`. +- **Responsibility**: Schwab OAuth token refresh automation utility. +- **Owns**: token refresh flow and Secret Manager sync behavior. +- **Consumes**: Schwab auth endpoints, Google Secret Manager, CharlesSchwabPlatform. +- **Must not**: decide strategy eligibility or log sensitive token values. + ## QSL Compatibility Metadata - Added `qsl.toml` to participate in the compatibility matrix with `tier = "platform-tooling"`, `ring = 4`, and `compat.bundle = "2026.07.0"`. diff --git a/README.zh-CN.md b/README.zh-CN.md index f6fff04..944bac2 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -1,23 +1,10 @@ # SchwabTokenAutoRefresher - -## QSL 架构角色 - -- **层级**：`平台工具`。 -- **职责**：Schwab OAuth token refresh 自动化工具。 -- **事实源/归属**：token refresh flow 和 Secret Manager sync 行为。 -- **消费对象**：Schwab auth endpoints、Google Secret Manager、CharlesSchwabPlatform。 -- **禁止事项**：决定策略 eligibility 或记录敏感 token 值。 - [English README](README.md) -> 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。 - -## 这个仓库是什么 +SchwabTokenAutoRefresher 是 QuantStrategyLab 的凭据自动化工具，按计划刷新 Schwab OAuth token，并把刷新后的凭据同步到 Google Cloud Secret Manager，让其他平台服务随时能拿到有效凭据，不需要人工续期。它支撑系统运行，但不决定哪个策略应该 live：策略资格由策略仓和 snapshot 仓负责，券商执行由平台仓负责。 -SchwabTokenAutoRefresher 是 QuantStrategyLab 的凭据自动化工具。自动刷新 Schwab OAuth token，并把刷新后的凭据同步到 Google Cloud Secret Manager。 - -它支撑系统运行，但不决定哪个策略应该 live。策略资格由策略仓和 snapshot 仓负责；券商执行由平台仓负责。 +> 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。 ## 设计边界 @@ -41,6 +28,14 @@ npm ci - 暂无独立 `docs/` 目录；请先阅读本 README 和 workflow 文件。 +## QSL 架构角色 + +- **层级**：`平台工具`。 +- **职责**：Schwab OAuth token refresh 自动化工具。 +- **事实源/归属**：token refresh flow 和 Secret Manager sync 行为。 +- **消费对象**：Schwab auth endpoints、Google Secret Manager、CharlesSchwabPlatform。 +- **禁止事项**：决定策略 eligibility 或记录敏感 token 值。 + ## 社区和安全 - 贡献前请阅读 [CONTRIBUTING.md](CONTRIBUTING.md)，确认 PR 范围、本地校验和文档要求。 diff --git a/SECURITY.md b/SECURITY.md index b9f7070..61c7ad0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,13 +1,5 @@ # Security Policy - -## 中文摘要 - -- 用途：本文档围绕 `Security Policy`，用于理解 `SchwabTokenAutoRefresher` 的配置、运行、部署、研究或验收边界。 -- 主要覆盖：`Reporting a Vulnerability`、`Secret and Credential Exposure`、`Scope Notes`。 -- 阅读顺序：先确认边界、输入输出和权限要求，再执行文档里的命令、CI、dry-run、发布或切换步骤。 -- 风险提示：涉及实盘、密钥、权限、Cloud Run、交易所或券商 API 的变更，必须先在测试环境或 dry-run 验证；不要只凭示例直接修改生产。 -- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。 Thanks for helping keep `SchwabTokenAutoRefresher` safe. This repository is part of a automation utility. Please do **not** open a public issue for vulnerabilities involving credentials, broker access, cloud resources, order execution, or secret material. From d18cd5087a8fb7550d2bb06f3782d95d0ddea20c Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Wed, 7 Oct 2026 01:06:37 +0800 Subject: [PATCH 2/2] docs: remove templated summary from CODE_OF_CONDUCT.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop the same mechanically-generated "## 中文摘要" block already removed from CONTRIBUTING.md/SECURITY.md. Its risk note (be conservative/reproducible/evidence-oriented about investing, trading, credentials, and live systems) is already covered by the existing "Our Standards" and "Project Scope" sections, so nothing needed to be folded into the body. Co-Authored-By: Claude Sonnet 5 --- CODE_OF_CONDUCT.md | 7 ------- 1 file changed, 7 deletions(-) diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index dc87ca6..74debd3 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -1,12 +1,5 @@ # Code of Conduct -## 中文摘要 - -- 用途：本文档说明 QuantStrategyLab 仓库中的讨论、issue、pull request 和 review 行为规范。 -- 主要覆盖：`Our Standards`、`Project Scope`、`Reporting and Enforcement`。 -- 阅读顺序：参与讨论或提交 PR 前先确认沟通边界；发现不当行为时联系维护者。 -- 风险提示：涉及投资、交易、密钥或实盘系统的讨论必须保持克制、可复现和证据导向。 - ## Our Standards - Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions.