Package boundaries

The public modules separate pure contracts and policy, shared host/file-secret runtime support, research data and engines, paper-only adapters, performance publication, and the optional legacy service example. Runtime I/O does not live in core. A package may not import a higher-level runner or website to use a lower-level contract. The V13.5 options-wheel runtime and long-only equity plugin runner build as separate images.

Strategy contract

EquityStrategyContextV1 binds strategy and configuration identity, completed observations with availability time and feed identity, the decision session and information cutoff, reconciled account state, and the recorded input manifest. EquityTargetV1 returns a bounded long-only allocation, explicit cash remainder, reason codes, next state, and a stable decision identity. No broker client or credentials enter plugin code.

Evidence contract

Versioned strategy and study manifests record source revision, parameters, data and feature manifest hashes, evaluation periods, capital, execution delay, costs, distributions, settlement assumptions, metrics, qualification status, and redistribution limits. Reproduction states distinguish original-environment verification from portable parity and missing-data or runtime blockers.

The static site uses site/publication-rights.json as an explicit study allowlist. The current approval is limited to four owner-authored aggregate backtest summaries. CI and Pages inspect the built site before deployment and reject unapproved routes, all study downloads, and data manifests marked nonredistributable. Historical source data stays private; removing a file from the latest commit does not remove it from older Git commits.

Optional TypeSafe System One judgments belong in explicit research-data preparation when a study has a concrete text input. Source hashes, availability timestamps, question/version, model identity, raw output and usage are frozen with the feature dataset. Backtests use validated, point-in-time outputs offline; missing evaluations stay explicit. The numerical SMA example uses no model features, and TypeSafe never enters a paper/live execution, sizing or trading gate.

Publication contract

PublicPerformanceSnapshotV1 is built from an allowlist. It omits account and order identifiers, secrets, raw responses, hostnames, private paths, and arbitrary broker metadata. It keeps paper and live feeds separate. A and O use the permanent v1 compatibility projection for the existing V13.5 tracker; B owns a separate live snapshot and dashboard.

The owner’s A GET-only exporter runs on Vultr and writes immutable, allowlisted captures to durable storage with a latest-valid pointer and idempotent capture slots. Repository Pages workflows fetch only sanitized snapshots over a restricted SSH command; they never receive Alpaca credentials. O keeps its existing Pages URL and renderer, now reading the permanent compatibility projection from A. O’s existing Cloudflare Worker continues to dispatch O’s workflow, while A uses its own repository-scoped Worker and dispatch credential. Both refresh paths reuse the same durable capture slots and deploy serially within their own repositories. Retrieval failure leaves each published page intact. B’s live T08 feed remains separate from A/O paper data.

Deployment and state

Paper and live images contain only their runtime dependency closure. The owner’s V13.5 image is published by immutable digest and state is preserved across the image cutover. T08 live delivery stays private and disabled by default. Static site refreshes retrieve validated stored snapshots; they do not capture broker data during a documentation build.