Pigbibi · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -1,12 +1,5 @@
 # Code of Conduct
 
-## 中文摘要
-
-- 用途：本文档说明 QuantStrategyLab 仓库中的讨论、issue、pull request 和 review 行为规范。
-- 主要覆盖：`Our Standards`、`Project Scope`、`Reporting and Enforcement`。
-- 阅读顺序：参与讨论或提交 PR 前先确认沟通边界；发现不当行为时联系维护者。
-- 风险提示：涉及投资、交易、密钥或实盘系统的讨论必须保持克制、可复现和证据导向。
-
 ## Our Standards
 
 - Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions.

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,13 +1,5 @@
 # Contributing
 
-
-## 中文摘要
-
-- 用途：本文档围绕 `Contributing`，用于理解 `SchwabTokenAutoRefresher` 的配置、运行、部署、研究或验收边界。
-- 主要覆盖：`Ground Rules`、`Branching and Pull Requests`、`Local Verification`。
-- 阅读顺序：先确认边界、输入输出和权限要求，再执行文档里的命令、CI、dry-run、发布或切换步骤。
-- 风险提示：涉及实盘、密钥、权限、Cloud Run、交易所或券商 API 的变更，必须先在测试环境或 dry-run 验证；不要只凭示例直接修改生产。
-- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
 Thanks for contributing to `SchwabTokenAutoRefresher`.
 
 ## Ground Rules
@@ -16,6 +8,7 @@ Thanks for contributing to `SchwabTokenAutoRefresher`.
 - Keep refactors separate from behavior changes.
 - Add or update tests when changing runtime behavior.
 - Do not use deployment or scheduled workflows as a substitute for local verification.
+- Changes touching live trading, credentials, permissions, Cloud Run, or exchange/broker APIs must be verified in a test environment or dry run first; do not edit production based on the examples alone.
 
 ## Branching and Pull Requests
 

diff --git a/README.md b/README.md
@@ -1,23 +1,10 @@
 # SchwabTokenAutoRefresher
 
-
-## QSL architecture role
-
-- **Layer**: `platform-tooling`.
-- **Responsibility**: Schwab OAuth token refresh automation utility.
-- **Owns**: token refresh flow and Secret Manager sync behavior.
-- **Consumes**: Schwab auth endpoints, Google Secret Manager, CharlesSchwabPlatform.
-- **Must not**: decide strategy eligibility or log sensitive token values.
-
 [Chinese README](README.zh-CN.md)
 
-> Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only.
-
-## What this repository is
+SchwabTokenAutoRefresher is a QuantStrategyLab credential automation utility. It runs the Schwab OAuth token refresh flow on a schedule and syncs the refreshed credentials to Google Cloud Secret Manager, so other platform services always have a valid token without manual renewal. It supports the system but does not decide which strategy should go live: strategy eligibility stays with the strategy and snapshot repositories, and broker execution stays with the platform repositories.
 
-SchwabTokenAutoRefresher is a QuantStrategyLab credential automation utility. It automates Schwab OAuth token refresh and syncs refreshed credentials to Google Cloud Secret Manager.
-
-It supports the system but does not decide which strategy should be live. Strategy eligibility remains in the strategy and snapshot repositories; broker execution remains in the platform repositories.
+> Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only.
 
 ## Design boundary
 
@@ -41,6 +28,14 @@ npm ci
 
 - No separate `docs/` directory yet; start with this README and the workflow files.
 
+## QSL architecture role
+
+- **Layer**: `platform-tooling`.
+- **Responsibility**: Schwab OAuth token refresh automation utility.
+- **Owns**: token refresh flow and Secret Manager sync behavior.
+- **Consumes**: Schwab auth endpoints, Google Secret Manager, CharlesSchwabPlatform.
+- **Must not**: decide strategy eligibility or log sensitive token values.
+
 ## QSL Compatibility Metadata
 
 - Added `qsl.toml` to participate in the compatibility matrix with `tier = "platform-tooling"`, `ring = 4`, and `compat.bundle = "2026.07.0"`.

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -1,23 +1,10 @@
 # SchwabTokenAutoRefresher
 
-
-## QSL 架构角色
-
-- **层级**：`平台工具`。
-- **职责**：Schwab OAuth token refresh 自动化工具。
-- **事实源/归属**：token refresh flow 和 Secret Manager sync 行为。
-- **消费对象**：Schwab auth endpoints、Google Secret Manager、CharlesSchwabPlatform。
-- **禁止事项**：决定策略 eligibility 或记录敏感 token 值。
-
 [English README](README.md)
 
-> 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。
-
-## 这个仓库是什么
+SchwabTokenAutoRefresher 是 QuantStrategyLab 的凭据自动化工具，按计划刷新 Schwab OAuth token，并把刷新后的凭据同步到 Google Cloud Secret Manager，让其他平台服务随时能拿到有效凭据，不需要人工续期。它支撑系统运行，但不决定哪个策略应该 live：策略资格由策略仓和 snapshot 仓负责，券商执行由平台仓负责。
 
-SchwabTokenAutoRefresher 是 QuantStrategyLab 的凭据自动化工具。自动刷新 Schwab OAuth token，并把刷新后的凭据同步到 Google Cloud Secret Manager。
-
-它支撑系统运行，但不决定哪个策略应该 live。策略资格由策略仓和 snapshot 仓负责；券商执行由平台仓负责。
+> 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。
 
 ## 设计边界
 
@@ -41,6 +28,14 @@ npm ci
 
 - 暂无独立 `docs/` 目录；请先阅读本 README 和 workflow 文件。
 
+## QSL 架构角色
+
+- **层级**：`平台工具`。
+- **职责**：Schwab OAuth token refresh 自动化工具。
+- **事实源/归属**：token refresh flow 和 Secret Manager sync 行为。
+- **消费对象**：Schwab auth endpoints、Google Secret Manager、CharlesSchwabPlatform。
+- **禁止事项**：决定策略 eligibility 或记录敏感 token 值。
+
 ## 社区和安全
 
 - 贡献前请阅读 [CONTRIBUTING.md](CONTRIBUTING.md)，确认 PR 范围、本地校验和文档要求。

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,13 +1,5 @@
 # Security Policy
 
-
-## 中文摘要
-
-- 用途：本文档围绕 `Security Policy`，用于理解 `SchwabTokenAutoRefresher` 的配置、运行、部署、研究或验收边界。
-- 主要覆盖：`Reporting a Vulnerability`、`Secret and Credential Exposure`、`Scope Notes`。
-- 阅读顺序：先确认边界、输入输出和权限要求，再执行文档里的命令、CI、dry-run、发布或切换步骤。
-- 风险提示：涉及实盘、密钥、权限、Cloud Run、交易所或券商 API 的变更，必须先在测试环境或 dry-run 验证；不要只凭示例直接修改生产。
-- 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
 Thanks for helping keep `SchwabTokenAutoRefresher` safe.
 
 This repository is part of a automation utility. Please do **not** open a public issue for vulnerabilities involving credentials, broker access, cloud resources, order execution, or secret material.