[Pigbibi]

Problem and reproduced baseline

A clean normal-wheel installation of Crypto succeeds, but importing its public
entrypoints fails because the retained QPK monitoring import requires undeclared
Pandas and NumPy dependencies. Existing CI installs those packages separately.

Diagnostic PR #299
reproduced the gap from unchanged main commit
ec0b330081213f56c3ff98164ec00ba26c10dfc9:

Environment	Observed baseline
Python 3.11	Normal wheel install and pip check pass; entrypoint import fails with missing Pandas; NumPy and Pandas are both absent.
Python 3.12	The same result, with installed origins under the fresh virtual environment and the exact unchanged QPK commit.

The diagnostic PR is now closed without merging; its logs remain the baseline
record. The baseline JSON explicitly reports runtime_import_succeeded: false.
The diagnostic check being green means that the failure was measured; it is not
a successful runtime-import check. The new gate in this proposal only accepts
a successful import.

Proposed change

• Declare numpy and pandas as normal runtime dependencies. Do not add new
  numeric bounds or copy the stricter research constraints into consumers.
• Keep QPK pinned to c7646a7168b3dafa763ef7751a182d23e8de7790.
• Add five lines to the root lock metadata, reusing existing resolved nodes.
  Every locked package version, artifact, source revision and research edge is
  unchanged; the lock was not regenerated.
• Add strict normal-wheel CI on Python 3.11 and 3.12, plus Python 3.11 with the
  existing Binance NumPy 2.4.6 / Pandas 3.0.3 constraints.
• Update ADR 0002 with the reproduction, decision and adoption limits.
• Update the two packaging contract tests to require the new normal dependency
  list and preserve the exact existing research-extra requirements.

The new jobs build a normal wheel, install only it and its declared dependencies
with pip into a fresh virtual environment, run pip check, and probe the public
entrypoint with python -I outside the checkout. They reject editable or
external module origins, QPK pin mismatches, missing metadata/imports and
network attempts. No research extras, manual numeric-package installation or
source-path overlays are used. The baseline acceptance mode is absent.

The previous CI jobs, triggers and permissions remain byte-for-byte intact.
No runtime source, package version, production consumer pin or live configuration
changes. This proposal targets main independently of the diagnostic draft.

Verification before publication

• Ten offline verifier tests pass, including strict failure and provenance cases.
• Baseline and candidate wheels contain the same 26 archive members; only
  METADATA and RECORD differ. The dependency list adds exactly NumPy/Pandas;
  every runtime payload and all other metadata are identical.
• All resolved lock package records compare identically; QPK pin checks pass.
• Python and shell syntax, diff whitespace and documentation checks pass.
  The documentation checker reports one existing README outline advisory.
• An independent review agent verified the original seven-file proposal and
  the two-file metadata-test follow-up, including exact tree/blob identity,
  dependency scope and strict import behavior. Its ten verifier tests, three
  negative CLI checks and follow-up run of thirteen targeted tests passed.
  No blocking findings remained.
• The reviewed candidate and the final CI-tested tree match; completed results
  are recorded below.

The local normal-install attempt failed while fetching QPK through an
unreachable configured proxy. It was classified as an environment failure;
the baseline reproduction above comes from completed normal-install CI.

CI history

The first test job
reported 265 passed and 2 failed, with 195 subtests passed. The failures were
the old metadata assertions that required QPK alone and kept numeric packages
research-only. All three strict normal-wheel installations passed on that head.

The follow-up updates those two contract expectations to the explicitly requested
runtime declaration. The normal list must now equal [numpy, pandas, QPK_URL],
and the research list must retain numpy>=2.4.6 and pandas>=3.1.0. All other
assertions, runtime code, dependency versions and workflow gates remain unchanged.
No test was skipped or disabled. The first failed run remains recorded; the
corrected head passed the fresh complete run recorded below.

Independent review and CI

Reviewed head: 8144c4e95844e38bc73b5cfec8ae4b5a3edf530e. All nine changed-file blobs match the independent
reviews. Published tree bd47ca416fdb27e4f86824a5f483b4a2014e4da8 exactly matches the reviewed tree. CI checked
out synthetic merge 2f1314b06be77b41d3c0a098ab4fed53bf7a1eb0 with the same tree; no PR was merged.

Check	Result	Evidence
Full tests and package validation	267 passed, 195 passing subtests, 83% coverage; no reported test skips. Ruff, whitespace, dependency check, shared-pin checks, sdist and wheel build passed.	Test job
Normal wheel, Python 3.11	NumPy 2.4.6 / Pandas 3.1.0; install, pip check, strict import passed.	Install job
Normal wheel, Python 3.12	NumPy 2.5.4 / Pandas 3.1.0; install, pip check, strict import passed.	Install job
Binance numeric constraints, Python 3.11	NumPy 2.4.6 / Pandas 3.0.3; install, pip check, strict import passed.	Install job
Workflow lint	Passed.	Actionlint
Documentation	36 checker tests passed; 0 blockers, 1 advisory on the unchanged README.	Documentation job

All three installation probes verified QPK at c7646a7168b3dafa763ef7751a182d23e8de7790, loaded Crypto/QPK/NumPy/
Pandas from their fresh virtual environment, and reported no guarded socket or
DNS attempts during the import. They import the public entrypoint without
running a strategy. The Binance case verifies this installation/import boundary;
it does not claim complete consumer runtime compatibility.

Remaining constraint and adoption

The research project requirement already says pandas>=3.1.0, while its lock
metadata says >=3.0.5 and locks 3.0.5. This proposal preserves and documents
that pre-existing inconsistency. The QPK reference checker does not certify
research lock reproducibility. Reconciliation belongs in a separate review;
this PR neither upgrades the lock nor relaxes the research requirement.

The Binance-constrained smoke test proves installation and public-import
compatibility, not complete consumer runtime acceptance. Broader optional
imports, real monitoring storage and deployed consumers are outside this check.

The owner has approved adoption of this dependency declaration. Integration remains subject to the required automated checks and independent AI review. The current commitlint failure and organization-level fix are being checked separately; no failing check will be bypassed. The shared project research-lock reconciliation is separately authorized and tracked in #303.

This PR currently remains a draft. Deployment is outside this change. If adopted and reverted, restore the previous consumer package/lock state through a reviewed revert; that also restores the documented normal-install gap.

AI assistance

ChatGPT (GPT-6 Astra Pro) used separate implementation and independent AI review agents for the packaging change and verification. Review relies on automated checks, independent AI review and risk classification; it does not require a human code reviewer. Owner approval remains required for live trading, deployment, account changes, risk controls and keys/secrets. The adoption approval above records the owner's current instruction, without replacing any required CI result.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 87e6a5be-6347-4a57-9fe8-d2716841c5e5

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn