[Pigbibi]

AI assistance

ChatGPT (GPT-6 Astra Pro) prepared this change. Acceptance uses automated
checks, independent AI review of the exact candidate tree, and repository risk
classification. This PR remains a draft stacked on #300.

What changed

The research extra already declares pandas>=3.1.0, while the shared project
lock selected Pandas 3.0.5 and recorded a stale >=3.0.5 research edge. The
existing QPK reference check did not detect that inconsistency.

This change commits the lock produced by uv 0.13.4 with
uv lock --upgrade-package pandas==3.1.0, adds regression checks for declared
requirements and selected versions, and updates ADR 0002. The temporary
candidate-generation workflow is replaced by strict lock validation and frozen
research installation on Python 3.11 and 3.12.

The resolved package change is Pandas 3.0.5 to 3.1.0, including its generated
source and wheel metadata. Its dependency edges and registry source are
unchanged. NumPy versions 2.4.6 and 2.5.3, the complete QPK record at
c7646a7168b3dafa763ef7751a182d23e8de7790, and all other package records are
unchanged. The root research edge now matches the existing declaration.

The resolver also updates the lock format revision from 3 to 5 and normalizes
ordering of the same resolution markers and root dependency metadata. The
committed lock preserves the generated bytes. The repository had no prior uv
tool pin; validation uses uv 0.13.4 and makes no compatibility claim for older
resolver versions.

There is one shared uv.lock, so Pandas 3.1.0 applies to both normal frozen
project sync and research sync. Runtime wheel NumPy/Pandas requirements remain
unbounded. The QPK source pin, downstream consumer pins, and the Binance
Pandas 3.0.3/NumPy 2.4.6 installation constraints remain unchanged. Runtime
source, trading logic, accounts, risk controls, secrets, IAM, schedules and
production configuration are unchanged.

How verified

• The same recurrence-test file fails on the stale base with three passing
  cases and two expected failures, then passes all five cases with the
  generated lock. Existing metadata checks are preserved.
• CI resolver run 41210695109
  succeeded. The generated lock was recovered from 23 numbered public log
  chunks, checked against the declared 67,857-byte length and SHA-256
  918fe5cf3c9c6fffedfef6d09b3830967bf54a122873b557e36e097967ba650a,
  and matched the original artifact candidate hash. The native artifact is
  retained. Its documented local materialization failed, so the follow-up
  diagnostic exposed only the same public lock bytes in the job log.
• Full TOML comparison confirms the narrow package, root-edge and lock-format
  changes described above. The other 92 base files and their Git modes match
  fix: Declare numeric runtime dependencies for normal installs #300 exactly.
• Local documentation checks report no blockers and one existing README
  outline advisory; all 36 documentation-check tests pass. Workflow YAML,
  embedded Python and diff whitespace checks pass.
• Independent AI review checked the implementation tree
  206277736a750bfa58c25285a8f9b53f90f13505 and the subsequent workflow-context
  correction in final tree 6cfb18ea6a1a320819860f83fb471b8ce41dd4dd.
  The reviewer independently decoded the generated lock, checked the complete
  four-file change and 92 unchanged base entries, and ran all five metadata
  cases successfully with zero network attempts. The follow-up review verified
  the exact environment-scope correction and all 95 unchanged files.
• The final workflow runs uv lock --check, verifies the committed lock remains
  unchanged, performs uv sync --frozen --extra research --no-editable and
  checks installed dependency consistency. An isolated entrypoint probe
  verifies NumPy/Pandas versions, the exact QPK Git source, installed module
  origins and absence of import-time network attempts.
• On final commit 454b97d9a82b4d1c910015331d4a23251a67cdc3,
  repository CI
  passed: 270 tests and 195 subtests, Ruff, QPK reference consistency,
  dependency checks, sdist/wheel build, actionlint and all three normal-wheel
  profiles. The Binance-constrained wheel still installs Pandas 3.0.3.
• Both frozen research jobs
  passed with Pandas 3.1.0: NumPy 2.4.6 on Python 3.11 and NumPy 2.5.3 on
  Python 3.12. Both verified the unchanged QPK commit, module origins inside
  their fresh environments, and zero import-time network attempts. The lock
  checks succeeded without changing the committed file.
• Documentation
  and engineering checks,
  including commit-message validation and Gitleaks, passed. The actual CI
  checkout 5a05bde613aac049974d5a93ed27dcd92894fdf8 has the same tree as
  the independently reviewed PR head.

The first final candidate failed actionlint because runner.temp was placed
in job-level env, where that context is unavailable. Commit
454b97d9a82b4d1c910015331d4a23251a67cdc3 moved the identical environment
setting into the two consuming steps. Independent review confirmed that the
commands, assertions, paths and dependency files were unchanged; fresh
actionlint and both frozen-install jobs then passed. The earlier failure is
retained in the PR history.

Governance status

All ten code and static-check jobs passed on the reviewed head. The
trusted PR risk gate
and PR-template status also pass after a separate owner-approved label event
was recorded on the PR. This task did not apply that label. The earlier failed
governance runs remain in history; no gate or assertion was changed to obtain
the current result.

This PR remains a draft stacked on #300. Its successful commit-message check
covers its own PR range and does not resolve #300's historical commitlint
failure. No merge, deployment, or live operation has been performed.

Rollback

Revert this lock, its recurrence checks, the strict validation workflow and the
corresponding ADR reconciliation together through a reviewed change. This
restores the previous research-lock mismatch while preserving #300's runtime
dependency declarations. Runtime-declaration adoption and any production
consumer change remain separate operations.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e9393fb6-a20e-49f1-b090-72a12dc84aff

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn