gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 15:37:44 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,366 Commits 21 Branches 34 Tags
58a7ece3a9fc51e6f22cfe7f6c463101bc48e976
Commit Graph

1366 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
TPTBusiness 58a7ece3a9 fix(security): replace os.path.realpath with pathlib.resolve in safe_resolve_path to fix path-injection alerts 2026-05-04 18:05:09 +02:00
TPTBusiness 02083409e0 test: add 23 open-source tests (CLI, backtest edge cases, core utils, protections, env, log) — 540 total 2026-05-03 23:13:55 +02:00
TPTBusiness 33f6daf1d2 feat: continuous strategy generator (WF, MTF, stability, ML models, auto-ensemble) 2026-05-03 22:42:29 +02:00
TPTBusiness 1827c50344 feat: optimize strategy generator (cache OHLCV, min_sharpe 1.5, predix generate-strategies CLI) 2026-05-03 21:58:07 +02:00
TPTBusiness 06a5d5d92d refactor: move strategy_orchestrator and optuna_optimizer to closed-source (local/) 2026-05-03 21:38:09 +02:00
TPTBusiness 7696a3aaa6 docs: update license section from MIT to AGPL-3.0 2026-05-03 21:20:41 +02:00
TPTBusiness 6d37f8956f feat: add runtime backtest verification (10 invariant checks in <1ms) + 489 tests + README docs 2026-05-03 14:00:49 +02:00
TPTBusiness 020bc11742 test: add 8 cross-implementation validation tests (IC/Sharpe/MaxDD cross-check, buy-and-hold equality, IC invariance) — closes 5% gap, 477 total 2026-05-03 13:53:43 +02:00
TPTBusiness 0f7eb908b4 test: add 10 ground-truth verification tests (hand-computed metrics, mathematical invariants, trend directions) — 469 total 2026-05-03 13:47:35 +02:00
TPTBusiness 4d8b389b47 test: add 13 final tests (walk-forward, dedup, e2e, edge-cases, cross-check, legacy-vs-new) — 459 total, 0 failures 2026-05-03 13:37:33 +02:00
TPTBusiness 72b9a735c9 test: add 28 deep-detail tests (look-ahead shift, alignment, safe_float, trade_pnl, MC p-value) — 446 total, 0 failures 2026-05-03 12:35:39 +02:00
TPTBusiness ce4a5b7b4f fix: correct MaxDD to equity curve in strategy_builder; test: add 8 cross-validation tests for metric correctness 2026-05-03 12:28:09 +02:00
TPTBusiness 037f7ba7d2 fix: correct Sharpe/MaxDD/WinRate in direct factor eval (was computing on raw factor, now on strategy returns) 2026-05-03 12:17:27 +02:00
TPTBusiness e31963713b test: add 31 tests for remaining modules (log, loader, doc_reader, scripts, fx_validator) — 410 total, 0 failures 2026-05-03 12:00:54 +02:00
TPTBusiness dc2a1a41f4 test: add 16 tests for eurusd, rl env, and all 379 tests now pass (0 failures) 2026-05-03 11:39:24 +02:00
TPTBusiness c3ff9d5e63 chore: update pre-commit test count to ~360 2026-05-03 11:32:11 +02:00
TPTBusiness 1a530440c1 test: add 42 tests for remaining modules (conf, kb, interactor, fmt, llm_utils, graph) 2026-05-03 11:31:28 +02:00
TPTBusiness b803d9fab5 chore: update pre-commit test count to ~315 2026-05-03 11:25:11 +02:00
TPTBusiness 13dbf27457 test: add 28 tests for LLM components, RL indicators, and model evaluators 2026-05-03 11:24:28 +02:00
TPTBusiness 49ebc19fd0 test: add 39 tests for fx_config, utils, predix_full_eval, exceptions, and log 2026-05-03 11:18:27 +02:00
TPTBusiness 58eb551898 test: add 4 tests for QuantTrace and QlibQuantHypothesis 2026-05-03 11:14:33 +02:00
TPTBusiness 2e18b7c104 test: add 24 tests for factor/model scenarios and experiments 2026-05-03 11:12:23 +02:00
TPTBusiness 28743eb043 test: add 33 tests for app config, strategy builder, and quant scenario 2026-05-03 11:09:55 +02:00
TPTBusiness f6f5531427 test: expand pre-commit to run qlib+backtesting unit tests (160+ tests) 2026-05-03 11:05:39 +02:00
github-actions[bot] bd9362e2f3 chore(master): release 1.4.2 (#48) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-03 11:02:32 +02:00
TPTBusiness a4d4266295 test: add 129 tests for critical untested code (core, CoSTEER, factor_coder, model_coder, qlib pipeline) 2026-05-03 10:59:24 +02:00
TPTBusiness 8f2ed4185f fix: add missing sys import and fix undefined acc_rate in factor eval 2026-05-03 10:19:59 +02:00
github-actions[bot] 7f24af6f05 chore(master): release 1.4.1 (#47) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-03 09:39:56 +02:00
TPTBusiness aba88dd090 fix: 15 bug fixes across orchestrator, runner, backtest, and infrastructure 
Critical:
- strategy_orchestrator: fix IndentationError that prevented import (line 764)
- factor_runner: fix literal 'sys.executable' string → variable (line 966)

High (path bugs causing wrong directories):
- backtest_engine: fix results_path depth (3→4 .parent hops)
- results_db: fix factors_dir/failed_dir depth (3→4 .parent hops)
- factor_runner: eliminate run_id variable shadowing (parallel_run_id/db_run_id)
- model_runner: fix DB connection leak on add_backtest exception
- optuna_optimizer: fix imported logger shadowed by module-level reassignment

Medium:
- env: handle non-UTF-8 Docker build output with errors='replace'
- env: guard conda env list parsing against empty lines
- factor_runner: add check=False + stderr logging for full-data subprocess
- strategy_orchestrator: log exec() exceptions at ERROR level with traceback
- strategy_orchestrator: warn on unreplaced {{template}} variables in prompts

Low:
- factor_runner: guard IC_max.index access against scalar (AttributeError)
- predix_parallel: close log file handle on Popen failure
- predix_rebacktest_strategies: replace 4 bare except: with except Exception:
 2026-05-03 09:37:00 +02:00
TPTBusiness 28766c932e test: add regression tests for background task path and env bugs 
- Verify parallel runner project_root is repo root, not scripts/
- Verify .env loading from correct path
- Verify API key distribution (single key, multi-key comma-separated)
- Verify CLI project_root depth (3 .parent hops, not 4)
- Verify start_loop uses sys.executable and child_proc, not pkill
- Verify parallel_cli does not hardcode model=local
- Verify all referenced scripts exist at resolved paths
 2026-05-03 08:57:56 +02:00
TPTBusiness 574e9d6c08 fix: correct project root paths and subprocess handling in parallel runner and CLI 
- predix_parallel.py: fix project_root from scripts/ to repo root (parent.parent)
- predix_parallel.py: fix .env loading path and API key distribution logic
- cli.py: fix project_root depth from 4 to 3 .parent hops (7 locations)
- cli.py start_loop: use sys.executable instead of hardcoded python
- cli.py start_loop: replace broad pkill with targeted child process management
- cli.py parallel: remove hardcoded model=local
 2026-05-03 08:49:18 +02:00
TPTBusiness ce76da912a fix: also catch ValueError in mean_variance for dimension mismatch 2026-05-03 00:39:22 +02:00
TPTBusiness 02ac3f7aae test: add direct unit tests for _apply_riskmgmt_mask, safe_resolve_path, import_class, and _add_column_if_not_exists 2026-05-03 00:35:57 +02:00
TPTBusiness 39b49b1724 fix: filter NaN in max(), remove redundant ternary, handle non-finite vbt results 2026-05-03 00:25:58 +02:00
TPTBusiness f1eb66cc8f fix: fix type annotation, remove unused parameter, improve import_class errors 2026-05-03 00:22:16 +02:00
TPTBusiness ca003cd0f2 fix: close log file handle, fix RiskMgmt equity double-count, remove bare except 2026-05-03 00:17:02 +02:00
TPTBusiness 4eeb724ac5 fix: resolve dead code, shell injection risk, mutable defaults, and other bugs 
- strategy_orchestrator.py: remove unreachable dead 'if not factor_values' after early return
- strategy_orchestrator.py: eliminate duplicate OHLVC load in evaluate_strategy
- env.py: escape single-quotes in Docker entry to prevent shell injection (CWE-78)
- env.py: replace mutable default args with None pattern in DockerEnv subclasses
- factor_runner.py: move pandarallel.initialize() from import-time to lazy init
 2026-05-02 23:21:38 +02:00
TPTBusiness 6c3bdb6ec1 fix: resolve unbound variable, logger shadowing, withdraw_loop edge case, and other bugs in main scripts 
- quant.py: guard against empty orch_factors, move strategy_name before try block
- quant_proposal.py: fix __init__ return type Tuple[dict,bool] -> None
- strategy_orchestrator.py: remove dead rdagent_logger import shadowed by getLogger
- factor.py: replace unusual 'not x is None' with idiomatic 'x is not None'
- workflow/loop.py: withdraw_loop(0) raises RuntimeError instead of looking for folder -1
- workflow/tracking.py: replace crash-prone AssertionError with logger.warning + skip
- factor_from_report.py: fix misleading comment about loop_n/step_n dual use
 2026-05-02 22:56:29 +02:00
github-actions[bot] 82633d328a chore(master): release 1.4.0 (#46) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-01 15:59:06 +02:00
TPTBusiness c5d919f581 feat(optimizer): add max_positions parameter to Optuna search space 
Add max_positions (1-5) as an optimizable hyperparameter across all
three Optuna search stages (coarse, fine, very fine). The parameter
scales effective position size as min(position_size_pct × max_positions,
1.0), allowing the optimizer to discover pyramiding strategies.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-01 15:58:01 +02:00
github-actions[bot] 44ed82283d chore(master): release 1.3.11 (#45) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-01 13:58:55 +02:00
TPTBusiness 87610d660f fix(ci): lazy import logger in predix.py and cli.py to avoid ImportError in test env 
Wrapped  in try/except
ImportError with standard logging fallback. The rdagent.log
module chain fails when predix.py is imported as a module
in the CI test environment (kronos CLI tests).
 2026-05-01 13:58:16 +02:00
github-actions[bot] c0516d60f9 chore(master): release 1.3.10 (#44) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-01 13:50:38 +02:00
TPTBusiness a43c443c2e fix(security): replace remaining assert statements with proper error handling 
Replaced 53 assert statements across 22 files with proper
if/raise patterns (TypeError, ValueError, AssertionError)
to resolve Bandit B101 alerts.
 2026-05-01 13:49:58 +02:00
github-actions[bot] 9e58c64805 chore(master): release 1.3.9 (#43) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-05-01 13:43:52 +02:00
TPTBusiness 732361bb90 fix(security): resolve path-injection, B701, B101, B112 Bandit alerts 
- Path injection (B614): centralized safe_resolve_path in core/utils.py,
  refactored 6 UI modules to use it with safe_root validation
- B701: added explicit autoescape=select_autoescape() to Jinja2
  Environment() calls in 3 files
- B101: replaced assert statements with proper if/raise patterns in
  12+ files (partial)
- B112: added logger.warning() to bare except:continue blocks in
  5 files
 2026-05-01 13:42:59 +02:00
github-actions[bot] dff6262871 chore(master): release 1.3.8 (#42) 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-04-30 20:01:29 +02:00
TPTBusiness 23b2518c74 fix(security): resolve path-injection and add nosec for safe temp paths (B108, py/path-injection) 
- ds_trace.py: resolve() user-provided save path and use Path.name for filenames
  to prevent directory traversal in the local workspace save UI
- rl/finetune UI data_loaders: nosec B614 where paths are already validated
  against safe_root via realpath() before use
- Temp paths (/tmp/sample, /tmp/full, /tmp/mock/*, /tmp/predix_loop.pid,
  /tmp/autorl_output): nosec B108 — fixed Docker volume mount points or
  single-process admin files, not user-writable attack surface

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-30 19:26:38 +02:00
TPTBusiness d83c020637 fix(security): replace shell=True subprocess calls with list args in env.py (B602) 
Converted conda commands in _update_bin_path, _sync_conda_cache_with_real_envs,
_prepare_conda_env, and FTCondaEnv.prepare() to list args. Replaced pipe-based
grep with pure Python parsing. LocalEnv.Popen retains shell=True with nosec
since entry is an internal command string set by LocalEnvConf, not user input.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-30 19:26:29 +02:00
TPTBusiness 48843682d0 fix(security): replace eval() with ast.literal_eval in finetune validator (B307) 
eval() on trainer stdout output replaced with ast.literal_eval() which only
parses Python literals and cannot execute arbitrary code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-30 19:26:23 +02:00