chore(deps): Bump axios from 1.15.0 to 1.15.2 in /web (#55 )

Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.15.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.15.0...v1.15.2) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
fix: sync release manifest to v1.4.3 (was diverged at 0.8.0)
2026-07-29 16:37:43 +00:00 · 2026-05-05 07:22:00 +02:00 · 2026-05-05 07:21:34 +02:00 · 2026-05-05 06:44:04 +02:00 · 2026-05-04 22:32:05 +02:00 · 2026-05-04 22:32:02 +02:00
159 changed files with 14872 additions and 3151 deletions
@@ -14,7 +14,7 @@ jobs:
  security:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6

      - name: Run Bandit (Security Scan)
        uses: PyCQA/bandit-action@v1
@@ -25,9 +25,9 @@ jobs:
  test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6

-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
        with:
          python-version: "3.10"
          cache: "pip"
@@ -36,11 +36,11 @@ jobs:
    steps:
      # Checkout the repository to the GitHub Actions runner
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
      - name: Run Codacy Analysis CLI
-        uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
+        uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08
        env:
          JAVA_TOOL_OPTIONS: "-Dfile.encoding=UTF-8"
        with:
@@ -46,7 +46,7 @@ jobs:
    name: Validate Commit Messages
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -25,10 +25,10 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
      with:
        python-version: "3.10"

@@ -64,7 +64,7 @@ jobs:

    - name: Upload docs artifact
      if: github.ref == 'refs/heads/main'
-      uses: actions/upload-pages-artifact@v3
+      uses: actions/upload-pages-artifact@v5
      with:
        path: docs/_build/html

@@ -16,10 +16,10 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
      with:
        python-version: "3.10"

@@ -12,7 +12,8 @@ jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@v5
        with:
-          release-type: python
          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
@@ -19,9 +19,9 @@ jobs:
        python-version: ["3.10", "3.11"]

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6

-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"
@@ -49,9 +49,9 @@ jobs:
    name: Dependency Audit
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6

-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
        with:
          python-version: "3.10"
          cache: "pip"
@@ -19,10 +19,10 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6

    - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
      with:
        python-version: "3.10"

@@ -140,4 +140,4 @@ pickle_cache/
 RD-Agent_workspace_run*/
 AGENTS.md
 CLAUDE.md
-.claude/
+.claude/rdagent/components/coder/strategy_orchestrator.py
@@ -2,18 +2,44 @@
 # See https://pre-commit.com for more information

 repos:
-  # ── Integration Tests (MANDATORY - MUST PASS before commit) ──────
+  # ── Test Coverage Check: new modules must have tests ──────────────
  - repo: local
    hooks:
-      - id: integration-tests
-        name: Run Integration Tests (60 tests)
+      - id: check-test-coverage
+        name: Check new rdagent modules have tests
+        entry: python scripts/check_test_coverage.py
+        language: system
+        pass_filenames: false
+        always_run: true
+
+  # ── MyPy Ratchet: no new type errors allowed ────────────────────
+  - repo: local
+    hooks:
+      - id: mypy-ratchet
+        name: MyPy ratchet (no new type errors)
+        entry: python scripts/check_mypy_ratchet.py
+        language: system
+        pass_filenames: false
+        always_run: true
+
+  # ── Qlib Unit Tests (MANDATORY) ──────────────────────────────────
+  - repo: local
+    hooks:
+      - id: qlib-unit-tests
+        name: Qlib Unit Tests (~490 tests)
        entry: pytest
        language: system
        args:
-          - test/integration/test_all_features.py
+          - test/qlib/
+          - test/backtesting/
          - -v
          - --tb=short
-          - --no-cov  # Skip coverage for speed (run separately if needed)
+          - --cov=rdagent
+          - --cov-fail-under=33
+          - --cov-report=term
+          - --ignore=test/backtesting/test_ftmo_oos.py
+          - --ignore=test/backtesting/test_kronos_adapter.py
+          - --ignore=test/qlib/test_fin_quant_integration.py
        pass_filenames: false
        always_run: true

@@ -0,0 +1 @@
+{".": "1.4.3"}
@@ -1,5 +1,525 @@
 # Changelog

+## [0.8.0](https://github.com/TPTBusiness/Predix/compare/v1.4.2...v0.8.0) (2026-05-04)
+
+
+### Features
+
+* [AutoRL-Bench] Update DeepSearchQA split and translate task instructions to English ([#1368](https://github.com/TPTBusiness/Predix/issues/1368)) ([ffb9491](https://github.com/TPTBusiness/Predix/commit/ffb9491c4703290a5b292baa6328ae06bc520f9b))
+* Add 'predix evaluate' command to CLI ([4308c25](https://github.com/TPTBusiness/Predix/commit/4308c257e7c83ab8ec5ef0a719b040f936bad0b3))
+* Add 'predix top' command + explain factor evaluation results ([ac3334c](https://github.com/TPTBusiness/Predix/commit/ac3334c17d8dce48a5081e45d407ccadedfec713))
+* Add 6 new CLI commands - all scripts integrated with local LLM ([e0dd07a](https://github.com/TPTBusiness/Predix/commit/e0dd07aa99ce33c2fc050d3d40b4520f245adb90))
+* add a rag mcp in proposal ([#1267](https://github.com/TPTBusiness/Predix/issues/1267)) ([dc7b732](https://github.com/TPTBusiness/Predix/commit/dc7b732b2c428e3cca3373e839a0e724a844c79b))
+* add a web UI server ([#1345](https://github.com/TPTBusiness/Predix/issues/1345)) ([1439548](https://github.com/TPTBusiness/Predix/commit/14395488b9c7ea476022a32211ea46de9925cf11))
+* Add advanced ML models (Transformer, TCN, PatchTST, CNN+LSTM) ([44760f8](https://github.com/TPTBusiness/Predix/commit/44760f83c3d3d38033f5d94f4ba37dc0c25b7f59))
+* Add AI Strategy Builder (StrategyCoSTEER) - Closed Source ([089189d](https://github.com/TPTBusiness/Predix/commit/089189d8ec058edefd0b81c2689b54f5180b9052))
+* Add beautiful CLI welcome screen for GitHub README ([9e4a97d](https://github.com/TPTBusiness/Predix/commit/9e4a97d3d7e6d5328c4ffa39ce833591f10ab731))
+* Add CLI model selection (local vs OpenRouter) ([c37935a](https://github.com/TPTBusiness/Predix/commit/c37935aa8c108a6bca393bcda274cda148101456))
+* Add complete ML pipeline with graceful degradation (closed source) ([ed6b906](https://github.com/TPTBusiness/Predix/commit/ed6b906248ac3068a4f188d01bcde403e93abc0c))
+* add daily log rotation, llama health wait, factor auto-fixer, and README updates ([2238fed](https://github.com/TPTBusiness/Predix/commit/2238fed701bd8a6ab1da1d3614d1c6d501e1ecbc))
+* Add factor code and description to saved results ([b6b378d](https://github.com/TPTBusiness/Predix/commit/b6b378da8abf6f15be0c91e83508dc21d27b5b14))
+* Add GitHub infrastructure, CI/CD pipelines, and examples ([26bd87e](https://github.com/TPTBusiness/Predix/commit/26bd87ed0a13da7190c8481356574bb710d00772))
+* add improve_mode to MultiProcessEvolvingStrategy for selective task implementation ([#1273](https://github.com/TPTBusiness/Predix/issues/1273)) ([03f22dc](https://github.com/TPTBusiness/Predix/commit/03f22dc7c72a039ee6f1a0e8d0393f35117ec3e1))
+* Add improved local prompt with MultiIndex code examples (v3) ([a729eb7](https://github.com/TPTBusiness/Predix/commit/a729eb715353961f71e92ddb679406c3c30b83d3))
+* add Kronos CLI commands, expand tests, document in README ([24a51e4](https://github.com/TPTBusiness/Predix/commit/24a51e4322ef80d5f882697a930f1d1985aa5779))
+* add LLM-finetune scenario ([#1314](https://github.com/TPTBusiness/Predix/issues/1314)) ([6e19c9e](https://github.com/TPTBusiness/Predix/commit/6e19c9e632cf07059c19993f2d4fbc772fb3cf13))
+* add mask inference in debug mode ([#1154](https://github.com/TPTBusiness/Predix/issues/1154)) ([b4117cf](https://github.com/TPTBusiness/Predix/commit/b4117cf58a5618e1d9e92abb46e1c1dd98af5f13))
+* Add model loader system (same as prompts) ([b7e397b](https://github.com/TPTBusiness/Predix/commit/b7e397b6f271e2cab5312f597cfbcb9652472298))
+* add option to enable hyperparameter tuning only in first eval loop ([#1211](https://github.com/TPTBusiness/Predix/issues/1211)) ([f82de4a](https://github.com/TPTBusiness/Predix/commit/f82de4a380fa31a04a8494b196a743333aadf096))
+* Add P5 ML Training Pipeline with LightGBM and 46 tests ([c934276](https://github.com/TPTBusiness/Predix/commit/c9342761ff8ab9adef69b65eb4cd8f206327fc97))
+* Add parallel run system with API key distribution ([31fb7d5](https://github.com/TPTBusiness/Predix/commit/31fb7d56e3b6530091bef2c16e057a249caf4a93))
+* add previous runner loops to runner history ([#1142](https://github.com/TPTBusiness/Predix/issues/1142)) ([2426a1d](https://github.com/TPTBusiness/Predix/commit/2426a1dc6700cc208360944cead9214a3da04889))
+* add reasoning attribute to DSRunnerFeedback for enhanced evaluation context ([#1162](https://github.com/TPTBusiness/Predix/issues/1162)) ([bfa4525](https://github.com/TPTBusiness/Predix/commit/bfa452541c1422c02f77491e70927ce43f21810c))
+* Add RL Trading Agent system with 99 tests ([0c4cb7a](https://github.com/TPTBusiness/Predix/commit/0c4cb7ad0c9842dd8fb73454bf554e9bedaf72f5))
+* add runtime backtest verification (10 invariant checks in &lt;1ms) + 489 tests + README docs ([26db657](https://github.com/TPTBusiness/Predix/commit/26db65736431313bcdc27b6defde625db4133516))
+* add show_hard_limit option and update time limit handling in DataScience settings ([#1144](https://github.com/TPTBusiness/Predix/issues/1144)) ([8a3e42d](https://github.com/TPTBusiness/Predix/commit/8a3e42d7fe8c36324c7578ede661297f2af59a37))
+* Add simple factor evaluator with direct IC/Sharpe computation ([c7f23d0](https://github.com/TPTBusiness/Predix/commit/c7f23d026419060df3fcb3748740df8cc594bf39))
+* Add start_llama and start_loop CLI commands ([c1d1844](https://github.com/TPTBusiness/Predix/commit/c1d184442aac79ca69b1e366bff7311973459869))
+* add stdout into workspace for easier debugging ([#1236](https://github.com/TPTBusiness/Predix/issues/1236)) ([0daeb82](https://github.com/TPTBusiness/Predix/commit/0daeb82d6330e46edfeedc6b704b1a1c01d1a111))
+* add time ratio limit for hyperparameter tuning in Kaggle settin… ([#1135](https://github.com/TPTBusiness/Predix/issues/1135)) ([6a49981](https://github.com/TPTBusiness/Predix/commit/6a4998154d000d95d7a5ec7cfb5e59305d4cbd11))
+* Add Trading Protection System with 4 protections + comprehensive tests ([a9e0eff](https://github.com/TPTBusiness/Predix/commit/a9e0eff35d07c5b5223f64af343f8d2ece8d0053))
+* add user interaction in data science scenario ([#1251](https://github.com/TPTBusiness/Predix/issues/1251)) ([6e09dc6](https://github.com/TPTBusiness/Predix/commit/6e09dc6d692f3ae2fcc0ffddf620e8f3e8dc1bd9))
+* Auto-start dashboard for fin_quant ([3441604](https://github.com/TPTBusiness/Predix/commit/34416041c122b6a51ce94db1031f315c3639a4a5))
+* Auto-start dashboard for fin_quant ([52d2b89](https://github.com/TPTBusiness/Predix/commit/52d2b8914815fa97d6b53b7cc7e817828520817e))
+* **backtest:** add FTMO-realistic backtest mode with leverage, daily/total loss limits and realistic EUR/USD costs ([c5012e1](https://github.com/TPTBusiness/Predix/commit/c5012e1a1c7e5cff6c82bc42bd0ba34affb75c10))
+* **backtest:** add rolling walk-forward validation and Monte Carlo trade permutation test ([d284d3e](https://github.com/TPTBusiness/Predix/commit/d284d3e74610c5f8ed314fa870cfb7f28a7681d4))
+* **backtest:** add walk-forward OOS validation to backtest_signal_ftmo ([329841f](https://github.com/TPTBusiness/Predix/commit/329841f05a64ee9cdbaced2c4ec4de9436d3d42a))
+* Backtesting Engine + Risk Management + Results Database ([cce889a](https://github.com/TPTBusiness/Predix/commit/cce889a1b7ee58f0042bc6c8cf01f5631ad45fa7))
+* Backtesting Engine + Risk Management + Results DB ([86ef426](https://github.com/TPTBusiness/Predix/commit/86ef4269a350535871cb2f3f80d4d8e9e5c9258f))
+* **backtest:** use backtest_signal_ftmo in strategy orchestrator and optuna optimizer ([994080e](https://github.com/TPTBusiness/Predix/commit/994080ef36e572f688b1d3cc219170bb340fc175))
+* Beautiful CLI dashboard + corrected start command ([c2932cb](https://github.com/TPTBusiness/Predix/commit/c2932cb06904b041e1376d534309864d9d0e9122))
+* Centralize all prompts in prompts/ directory ([3ff1ef8](https://github.com/TPTBusiness/Predix/commit/3ff1ef8557ef41d96b48c43efc2fe5795869fed0))
+* CLI Commands for strategy generation (P4 complete) ([1f7ef1b](https://github.com/TPTBusiness/Predix/commit/1f7ef1b86f46153ff6e6cbde77e01c1ae08b905f))
+* Complete P6-P9 implementation (73 tests) ([6981e91](https://github.com/TPTBusiness/Predix/commit/6981e9141d1f1f0951647971c10c1b9db227134a))
+* continuous strategy generator (WF, MTF, stability, ML models, auto-ensemble) ([a206a31](https://github.com/TPTBusiness/Predix/commit/a206a31dbb831d6deed0492b73a9e246634fe074))
+* create Jupyter notebook pipeline file based on main.py file ([#1134](https://github.com/TPTBusiness/Predix/issues/1134)) ([f03b1b9](https://github.com/TPTBusiness/Predix/commit/f03b1b918d32ec5a0ace1443d9f22e0c0598b2fc))
+* Data Loader module with tests (P0 complete) ([af45cdf](https://github.com/TPTBusiness/Predix/commit/af45cdf074d7c3df02c535728ac55e69f214f1e3))
+* Diverse factor selection + improved prompt v3 ([ea47f75](https://github.com/TPTBusiness/Predix/commit/ea47f75eda41398699f376219ec2c883c9d67798))
+* enable finetune llm ([#1055](https://github.com/TPTBusiness/Predix/issues/1055)) ([35c209b](https://github.com/TPTBusiness/Predix/commit/35c209b09295d28d6d835c720fa1d300bdf43d13))
+* enable LLM‑based hypothesis selection with time‑aware prompt & colored logging ([#1122](https://github.com/TPTBusiness/Predix/issues/1122)) ([90dd2f7](https://github.com/TPTBusiness/Predix/commit/90dd2f7b9bf49f5e1620e9d2c2eedf6c21f3e839))
+* enable to inject diversity cross async multi-trace ([#1173](https://github.com/TPTBusiness/Predix/issues/1173)) ([b05a530](https://github.com/TPTBusiness/Predix/commit/b05a53012603c21847803e4709da10c5b868cab6))
+* enable walk-forward OOS validation by default in backtest_signal_ftmo ([8853f8e](https://github.com/TPTBusiness/Predix/commit/8853f8e8e14ddabe510cb0ca271092f965b5ea81))
+* enhance timeout handling in CoSTEER and DataScience scenarios ([#1150](https://github.com/TPTBusiness/Predix/issues/1150)) ([811d4e7](https://github.com/TPTBusiness/Predix/commit/811d4e7631dc83f228cd96a2a498803db46256a9))
+* enhance timeout management and knowledge base handling in CoSTEER components ([#1130](https://github.com/TPTBusiness/Predix/issues/1130)) ([305eff1](https://github.com/TPTBusiness/Predix/commit/305eff1c5e36f3da5e93dc165105f50ccb990e32))
+* EURUSD FX patches - prompts, factor spec, experiment settings ([b6cf687](https://github.com/TPTBusiness/Predix/commit/b6cf6874db995ea160457a1628a5691cbc8e5b97))
+* EURUSD model experiment setting + model simulator text patched ([9a17b25](https://github.com/TPTBusiness/Predix/commit/9a17b25d32729453a28dd36246be4c5fdbd3a667))
+* EURUSD Trading-Verbesserungen (Phase 2 & 3) ([05c4e1b](https://github.com/TPTBusiness/Predix/commit/05c4e1ba54b9259d6cc5f0af00a177d9295278a9))
+* EURUSD Trading-Verbesserungen implementiert (Phase 1) ([b95bbf5](https://github.com/TPTBusiness/Predix/commit/b95bbf5900a9e06194ab0e330b662e2b853006ea))
+* EURUSD walk-forward splits, bars terminology, README no $factor ([0eae7d0](https://github.com/TPTBusiness/Predix/commit/0eae7d0ababb422927dd0123118b97724d066ab0))
+* **factor-coder:** Add critical rules to prevent common factor implementation errors ([e5c5d34](https://github.com/TPTBusiness/Predix/commit/e5c5d34eb5d38dd4bd18e9cd06026ba0e5a43344))
+* fallback to acceptable results ([#1129](https://github.com/TPTBusiness/Predix/issues/1129)) ([7fc0916](https://github.com/TPTBusiness/Predix/commit/7fc09169bc5a779eeb650b799a43a36b44930a61))
+* Fast mode - CoSTEER goes to backtest after 1 iteration ([fc830a2](https://github.com/TPTBusiness/Predix/commit/fc830a23bd31a53dab188847b10bf60430d396a8))
+* **fin_quant:** auto-generate Kronos factor before loop start ([0daf7a8](https://github.com/TPTBusiness/Predix/commit/0daf7a8d2bdddd98a0c7d00959a39d4a38084a21))
+* Fix 1min data integration and centralize all prompts ([2e94a4c](https://github.com/TPTBusiness/Predix/commit/2e94a4ce72cd9d0a01eef38c40ce70db1d158bb2))
+* Fix realistic backtesting (Step 1+2) ([9b88ffb](https://github.com/TPTBusiness/Predix/commit/9b88ffbbd695d9486f25631ecf7f92457a23f6fc))
+* Full auto strategy generation in fin_quant loop ([6d2990d](https://github.com/TPTBusiness/Predix/commit/6d2990dfff103e0cb85c0edd092457333d00c19e))
+* Full system integration - RL + Protections + Backtesting + CLI ([60618d9](https://github.com/TPTBusiness/Predix/commit/60618d90f730470b7a9c57bf70c6f9fc45c36ad5))
+* FX feedback loop, EURUSD ticker examples, bars terminology ([781779a](https://github.com/TPTBusiness/Predix/commit/781779a1f8c853eb77253053e23bc10c46dcf402))
+* FX Multi-Agent Validator (TradingAgents-inspired) - Session/Macro/Bull-Bear/Trader ([cddfc53](https://github.com/TPTBusiness/Predix/commit/cddfc53ab07ca75b2364c30b9c2a794383633c2b))
+* improve fallback handling in CoSTEER and add GPU usage guidelin… ([#1165](https://github.com/TPTBusiness/Predix/issues/1165)) ([9c190e3](https://github.com/TPTBusiness/Predix/commit/9c190e3268b4515945dcf5531dbaa222e843ceef))
+* Improve predix portfolio command with robust error handling ([5051527](https://github.com/TPTBusiness/Predix/commit/505152793fe4a1629fa9ecdd8dc03ceb9bcd5db9))
+* Improved LLM prompt + Optuna integration (Step 3+5) ([f72b07c](https://github.com/TPTBusiness/Predix/commit/f72b07ca94acd2b004f4a5b99faa8bb9ca1c7c76))
+* init pydantic ai agent & context 7 mcp ([#1240](https://github.com/TPTBusiness/Predix/issues/1240)) ([5ba5e83](https://github.com/TPTBusiness/Predix/commit/5ba5e8356cbacb5e4bd9f24b26d6f9ac01784822))
+* Integrate critical features into fin_quant workflow (P0+P1) ([484377b](https://github.com/TPTBusiness/Predix/commit/484377bc6dbe3bb216b1ebebb54978db371971cb))
+* Integrate factor code/description saving into fin_quant process ([3b502e9](https://github.com/TPTBusiness/Predix/commit/3b502e9faeab4c7bbd185c9b107b7026b57330f0))
+* integrate Kronos-mini OHLCV foundation model (Option A + B) ([165c156](https://github.com/TPTBusiness/Predix/commit/165c15684c7efe3db7de80b67eb301384d926739))
+* Intelligent embedding chunking instead of truncation ([2d0584b](https://github.com/TPTBusiness/Predix/commit/2d0584b4cd7c1b3d9623acd6e141035d51f535fa))
+* **logging:** write complete LLM prompts and responses to daily JSONL log ([1f83410](https://github.com/TPTBusiness/Predix/commit/1f83410fdd7e242b6cf4eb3aac045d8e6e6b7c70))
+* **mcp:** cache with one-click toggle ([#1269](https://github.com/TPTBusiness/Predix/issues/1269)) ([4f493c8](https://github.com/TPTBusiness/Predix/commit/4f493c8d637dfda42f84af0dc08f8ecfc0501668))
+* mcts policy based on trace scheduler ([#1203](https://github.com/TPTBusiness/Predix/issues/1203)) ([ac6d8ed](https://github.com/TPTBusiness/Predix/commit/ac6d8edad4366b08b5caf75e9a5ee8da0061a078))
+* migrate to 1min EURUSD data (2020-2026) ([b39f2b7](https://github.com/TPTBusiness/Predix/commit/b39f2b7e46384c4fc56c1274c9120c470313262b))
+* ML Training Pipeline with 46 tests (P5 complete) ([8f2aa83](https://github.com/TPTBusiness/Predix/commit/8f2aa8341932327dba5e260645bcf96efd5ed548))
+* offline selector ([#1231](https://github.com/TPTBusiness/Predix/issues/1231)) ([d4c5399](https://github.com/TPTBusiness/Predix/commit/d4c539912abdb60e9d8950e7ea1186fd32bfeef3))
+* optimize strategy generator (cache OHLCV, min_sharpe 1.5, predix generate-strategies CLI) ([def3975](https://github.com/TPTBusiness/Predix/commit/def39755793b16920c877045dd6628cb6a9aa9e8))
+* **optimizer:** add max_positions parameter to Optuna search space ([f7b23b9](https://github.com/TPTBusiness/Predix/commit/f7b23b950f8f59b1b2efa66664ac2180ce136410))
+* Optuna Parameter Optimizer with 60 tests (P3 complete) ([5583bf8](https://github.com/TPTBusiness/Predix/commit/5583bf874ed36886fa0d24e3472b8062abbd0b86))
+* PDF performance reports for strategies (reportlab) ([b86e412](https://github.com/TPTBusiness/Predix/commit/b86e41209cd41e02de4ad3de3281b6558fdad059))
+* predix.py wrapper for dashboard support ([757c66c](https://github.com/TPTBusiness/Predix/commit/757c66cddb18254220db1d571d9b739380c57f44))
+* prob-based trace scheduler ([#1131](https://github.com/TPTBusiness/Predix/issues/1131)) ([7e15b5e](https://github.com/TPTBusiness/Predix/commit/7e15b5e2003628f40be12674a73197a956d86545))
+* Realistic backtesting with OHLCV data (P5 continued) ([1506439](https://github.com/TPTBusiness/Predix/commit/1506439a1950a2e87cd662dfeec9e8b5fa1baf20))
+* Realistic backtesting with OHLCV data and spread costs ([85a1e29](https://github.com/TPTBusiness/Predix/commit/85a1e2929acf0ea0f582a66f6261dd697f0260db))
+* Redirect RD-Agent workspace to results/ directory ([fd2def0](https://github.com/TPTBusiness/Predix/commit/fd2def052a02e0f818a7cc705bdc2caaee2f01d2))
+* refactor CoSTEER classes to use DSCoSTEER and update max seconds handling ([#1156](https://github.com/TPTBusiness/Predix/issues/1156)) ([c111966](https://github.com/TPTBusiness/Predix/commit/c111966d1975a4952c1266fb6d6af1c4f5fe83c1))
+* refine the logic of enabling hyperparameter tuning and add criteira ([#1175](https://github.com/TPTBusiness/Predix/issues/1175)) ([e77572f](https://github.com/TPTBusiness/Predix/commit/e77572fb5347e40506fb7b5b25dd861e5f9ebb2b))
+* **rl:** add AutoRL-Bench framework and benchmark integrations ([#1348](https://github.com/TPTBusiness/Predix/issues/1348)) ([7cd64a2](https://github.com/TPTBusiness/Predix/commit/7cd64a26fd84017042eb163e8eb4d3bd30c16de7))
+* Save all factor results to results/factors/ ([2abbec9](https://github.com/TPTBusiness/Predix/commit/2abbec9fde67f52bcf1f199e7d18f7d99f04805e))
+* Save factor results immediately after each evaluation ([72c5ec5](https://github.com/TPTBusiness/Predix/commit/72c5ec55f20964917fe9ed21a77f80e0394f61e8))
+* **scripts:** add full file logging to strategy generation and rebacktest scripts ([c629af5](https://github.com/TPTBusiness/Predix/commit/c629af5b19df26330a131f510154fb5543709a66))
+* show the summarized final difference between the final workspace and the base workspace ([#1281](https://github.com/TPTBusiness/Predix/issues/1281)) ([35a7ae5](https://github.com/TPTBusiness/Predix/commit/35a7ae5e1ff929b3ee3b77c04cb1f4a684a4b2d7))
+* **strategies:** make OOS validation mandatory in strategy generator ([0f4c7c4](https://github.com/TPTBusiness/Predix/commit/0f4c7c4f46d4fd2fb8ff7c4b1eea58538c7db1b3))
+* Strategy Generator working with local LLM (P0-P4) ([036edee](https://github.com/TPTBusiness/Predix/commit/036edeeb77d1a99a0a748a357038c6da3efdd5e7))
+* Strategy Orchestrator with 30 tests (P2 complete) ([9af5cdb](https://github.com/TPTBusiness/Predix/commit/9af5cdbde4996b05a98e59c5c577e487e2d535bd))
+* Strategy performance reports, CLI docs, and README update ([232e918](https://github.com/TPTBusiness/Predix/commit/232e918b48eabeed22e3b712048fb96089b99067))
+* Strategy Worker module with 41 tests (P1 complete) ([b8acf82](https://github.com/TPTBusiness/Predix/commit/b8acf82ed26ffd131ca32bf5272547ff11bd5eef))
+* **strategy:** Continuous optimization with Optuna parameter injection ([da90ae2](https://github.com/TPTBusiness/Predix/commit/da90ae271e46260910023f8a9e3798365b80b298))
+* streamline hyperparameter tuning checks and update evaluation g… ([#1167](https://github.com/TPTBusiness/Predix/issues/1167)) ([5866230](https://github.com/TPTBusiness/Predix/commit/586623084f5d59d88645e75ceab6d795ec497cab))
+* Support 25+ parallel runs with resource warnings ([7a4dd1a](https://github.com/TPTBusiness/Predix/commit/7a4dd1aa7454560d84993ee8827e005ee0795c37))
+* ui, support disable cache ([#1217](https://github.com/TPTBusiness/Predix/issues/1217)) ([70fd91c](https://github.com/TPTBusiness/Predix/commit/70fd91cd051b2006df876ef6aa47a616058af95f))
+* unified backtest engine, LLM error handling, strategy refactor ([1ddb114](https://github.com/TPTBusiness/Predix/commit/1ddb1142a2f21ed3a498292ac8f5af6bbc351e7c))
+* update README with latest paper acceptance to NeurIPS 2025 ([#1252](https://github.com/TPTBusiness/Predix/issues/1252)) ([12969b4](https://github.com/TPTBusiness/Predix/commit/12969b491eafab626ce71f7e530458dab6f43246))
+* zentrale data_config.yaml + apply_config.py für dynamische Datenkonfiguration ([b7c1e4d](https://github.com/TPTBusiness/Predix/commit/b7c1e4db8e29e960fe28393911d60fc0fd3ca413))
+
+
+### Bug Fixes
+
+* (to main) litellm's Timeout error is not picklable ([#1294](https://github.com/TPTBusiness/Predix/issues/1294)) ([315850e](https://github.com/TPTBusiness/Predix/commit/315850ea81761aa2478639ad32302d7a55f8181b))
+* 15 bug fixes across orchestrator, runner, backtest, and infrastructure ([5ec4516](https://github.com/TPTBusiness/Predix/commit/5ec4516ed7bdc44f2fd7d6e3ec9df0a88fc4fd10))
+* add a switch for ensemble_time_upper_bound and fix some bug in main ([#1226](https://github.com/TPTBusiness/Predix/issues/1226)) ([fc18942](https://github.com/TPTBusiness/Predix/commit/fc18942339b3ca59077ddc903f84b2d54193e5bc))
+* Add Bandit security scanning and fix critical vulnerabilities ([f47dcf1](https://github.com/TPTBusiness/Predix/commit/f47dcf1c58d33041bba2f705b270a7f9c4e7d572))
+* Add critical column name rules to factor generation prompt ([bf73725](https://github.com/TPTBusiness/Predix/commit/bf7372533e83da682f1ceefeddc70f142f8ccda2))
+* Add get_factor_count() to QuantTrace to prevent parallel run crashes ([a16db77](https://github.com/TPTBusiness/Predix/commit/a16db77def1ba7adb7bb6734629086a1b5a901cb))
+* add json format response fallback to prompt templates ([#1246](https://github.com/TPTBusiness/Predix/issues/1246)) ([694afd8](https://github.com/TPTBusiness/Predix/commit/694afd81331227d2be7f780f72023d00c0c9864e))
+* add metric in scores.csv and avoid reading sample_submission.csv ([#1152](https://github.com/TPTBusiness/Predix/issues/1152)) ([80c953d](https://github.com/TPTBusiness/Predix/commit/80c953d4053dff66d12e4cf400b069d0fac16cbd))
+* Add missing os import in factor_runner.py ([f201823](https://github.com/TPTBusiness/Predix/commit/f201823c44c724867163f3b2d3ecf49f384a8e35))
+* Add missing Panel import in predix evaluate command ([e21923b](https://github.com/TPTBusiness/Predix/commit/e21923bd13eac6236a2c25d550bae0b984575491))
+* add missing self parameter to instance methods in DSProposalV2ExpGen ([#1213](https://github.com/TPTBusiness/Predix/issues/1213)) ([c8bf617](https://github.com/TPTBusiness/Predix/commit/c8bf617aca57ea9c53d4a76d23806cb5ab5173ab))
+* add missing sys import and fix undefined acc_rate in factor eval ([34323f3](https://github.com/TPTBusiness/Predix/commit/34323f307da6924095efcdaef81f99b95e2820eb))
+* Add nosec comments for schema migration SQL in results_db.py ([3626b22](https://github.com/TPTBusiness/Predix/commit/3626b22482143466b0dec8b63ea0a4a36af06acf))
+* allow prev_out keys to be None in workspace cleanup assertion ([#1214](https://github.com/TPTBusiness/Predix/issues/1214)) ([f02dc5f](https://github.com/TPTBusiness/Predix/commit/f02dc5f47d5973673bcc314ada89933a5d807d21))
+* also catch ValueError in mean_variance for dimension mismatch ([daded85](https://github.com/TPTBusiness/Predix/commit/daded853b6370f0df6f83a6d1b3f04c0dd0757f0))
+* **auto-fixer:** add five new factor code fixes for groupby/apply errors ([d03bcf3](https://github.com/TPTBusiness/Predix/commit/d03bcf3505f1be696e7bddc40f33c4a97b3f7486))
+* **auto-fixer:** add four new factor code fixes for common runtime errors ([21ce0de](https://github.com/TPTBusiness/Predix/commit/21ce0def2dd8352a315e0688ebafc6d62cf0435e))
+* **auto-fixer:** add groupby([level=N,'date']) SyntaxError fix ([d58eba3](https://github.com/TPTBusiness/Predix/commit/d58eba364e6ea14513b64e6bc12256c72111669a))
+* **auto-fixer:** disable _fix_min_periods for intraday data ([665e490](https://github.com/TPTBusiness/Predix/commit/665e4903d8f6f3097a45d07060ab003ebea7f96b))
+* **auto-fixer:** fix chained groupby(level=N).groupby('date') pattern ([9869839](https://github.com/TPTBusiness/Predix/commit/9869839a2c676ddd83f4218e9ff5e50fb8d2d223))
+* **auto-fixer:** fix df.loc[instrument] DateParseError on MultiIndex frames ([87926dc](https://github.com/TPTBusiness/Predix/commit/87926dc41d795a3ab0670e585b99cc21dd09ae5f))
+* **auto-fixer:** fix df['instrument'] KeyError on MultiIndex frames ([63a348e](https://github.com/TPTBusiness/Predix/commit/63a348eb3ec20c209c2d060e086bc69019e92884))
+* **auto-fixer:** fix two assignment-target bugs in instrument column fixers ([a44eba9](https://github.com/TPTBusiness/Predix/commit/a44eba952e031e364050ee3d27a067d17fa01923))
+* **auto-fixer:** preserve date dimension in groupby(['instrument','date']) fix ([37a2f37](https://github.com/TPTBusiness/Predix/commit/37a2f37f74118a2707a6b128d55c45ddb89cc48a))
+* **auto-fixer:** remove ddof from rolling() args, not only from std()/var() ([daacbfd](https://github.com/TPTBusiness/Predix/commit/daacbfd141ae0da99c8c4cb01d5e500528eb7d80))
+* **auto-fixer:** replace zero \$volume with price-range proxy for FX data ([7fcec39](https://github.com/TPTBusiness/Predix/commit/7fcec39f1d8f0f7668435f51a1a9646abcd9c89f))
+* **auto-fixer:** strip spurious .reset_index() after .transform() calls ([c489616](https://github.com/TPTBusiness/Predix/commit/c489616d1a2fd71877a203d880e31281bc008cdf))
+* avoid triggering errors like "RuntimeError: dictionary changed s… ([#1285](https://github.com/TPTBusiness/Predix/issues/1285)) ([b180543](https://github.com/TPTBusiness/Predix/commit/b18054371c6ce08c6bc322a7b0de41b67fc60408))
+* **backtest:** replace broken MC permutation test with binomial win-rate test ([f284b7a](https://github.com/TPTBusiness/Predix/commit/f284b7a9751424201510c5938b4ebf6bd81842b6))
+* cancel tasks on resume and kill subprocesses on termination ([#1166](https://github.com/TPTBusiness/Predix/issues/1166)) ([0e3f4cf](https://github.com/TPTBusiness/Predix/commit/0e3f4cf08f08e27f9c483a5bbe069313d0d8014e))
+* change runner prompts ([#1223](https://github.com/TPTBusiness/Predix/issues/1223)) ([be3433f](https://github.com/TPTBusiness/Predix/commit/be3433f26b04054a482dfdc7cdd5c8c0a756a60c))
+* **ci:** fix closed-source asset check false positives in security workflow ([1473085](https://github.com/TPTBusiness/Predix/commit/14730856636735c17d704854e057fa6e1aea5940))
+* **ci:** lazy import logger in predix.py and cli.py to avoid ImportError in test env ([52d9ff0](https://github.com/TPTBusiness/Predix/commit/52d9ff0cd41d6fc6978e8af7f970cffd6a46f673))
+* **ci:** remove CodeQL workflow (conflicts with default setup), drop duplicate lint job ([ab73425](https://github.com/TPTBusiness/Predix/commit/ab734252f356ac97dea4f70477ebe2fdee30509c))
+* **ci:** remove env-print step to avoid leaking sensitive environment variables ([#1299](https://github.com/TPTBusiness/Predix/issues/1299)) ([c067ea6](https://github.com/TPTBusiness/Predix/commit/c067ea640030c67c549e3ca2dbad178f144e8b31))
+* **ci:** set JAVA_TOOL_OPTIONS UTF-8 in Codacy workflow ([a9c6ea9](https://github.com/TPTBusiness/Predix/commit/a9c6ea99c9ebae2794b1c3f4d1e9da1d4e41376a))
+* clear ws_ckp after extraction to reduce workspace object size ([#1137](https://github.com/TPTBusiness/Predix/issues/1137)) ([28ceb41](https://github.com/TPTBusiness/Predix/commit/28ceb41e1cdb603c4e0bd2fe7b72acef1b29ec47))
+* CLI dashboard in separate terminal window ([b72cca9](https://github.com/TPTBusiness/Predix/commit/b72cca98680bd8a87393bb4e5f7d17aae47ab5ed))
+* close log file handle, fix FTMO equity double-count, remove bare except ([4c76c85](https://github.com/TPTBusiness/Predix/commit/4c76c85b6509ddd7bbd5361f0823c5a41329591a))
+* **collect_info:** parse package names safely from requirements constraints ([#1313](https://github.com/TPTBusiness/Predix/issues/1313)) ([99a71bf](https://github.com/TPTBusiness/Predix/commit/99a71bf533211df743b5801f913de788259e64cb))
+* correct MaxDD to equity curve in strategy_builder; test: add 8 cross-validation tests for metric correctness ([7be98e8](https://github.com/TPTBusiness/Predix/commit/7be98e84c911c9ba08b444b33206553cbe60086d))
+* correct project root paths and subprocess handling in parallel runner and CLI ([1c35a22](https://github.com/TPTBusiness/Predix/commit/1c35a2277ff601553e4733a8e990217dc9d6f989))
+* correct Sharpe/MaxDD/WinRate in direct factor eval (was computing on raw factor, now on strategy returns) ([69122ee](https://github.com/TPTBusiness/Predix/commit/69122ee5c1819be6fababd701b88d0dbef993040))
+* **deps:** bump python-dotenv to &gt;=1.2.2 (CVE symlink overwrite) ([f69333b](https://github.com/TPTBusiness/Predix/commit/f69333b27b9356f09e6cc2748cb45845732335c3))
+* **deps:** pin aiohttp&gt;=3.13.4 to patch 4 CVEs ([a0b3b90](https://github.com/TPTBusiness/Predix/commit/a0b3b90bfdd1193f5b8be521f563d18ff17dd81c))
+* **deps:** relax aiohttp constraint to &gt;=3.13.4 for litellm compatibility ([d3978fe](https://github.com/TPTBusiness/Predix/commit/d3978fec1305d7503a37ff576fdf953f75e1cd1d))
+* Disable ANSI color codes when not running in TTY ([9db0e59](https://github.com/TPTBusiness/Predix/commit/9db0e590a4e94f538712cfec79f6cd470155050c))
+* Disable Flask debug mode by default (Security Alert [#2](https://github.com/TPTBusiness/Predix/issues/2)) ([48c177f](https://github.com/TPTBusiness/Predix/commit/48c177fbafce7b111646c14a5c2e6e414414930b))
+* Display litellm messages as info instead of warnings ([bd9d672](https://github.com/TPTBusiness/Predix/commit/bd9d672997aff80b5ad5c616b6486c11c2570b80))
+* **dockerfile:** install coreutils to resolve timeout command error ([#1260](https://github.com/TPTBusiness/Predix/issues/1260)) ([35580cb](https://github.com/TPTBusiness/Predix/commit/35580cbdf87347d5d6105b2a9b5ad1694b695820))
+* **docs:** update rdagent ui with correct params ([#1249](https://github.com/TPTBusiness/Predix/issues/1249)) ([3b9ad11](https://github.com/TPTBusiness/Predix/commit/3b9ad1145769862a24cc7533a1828f750f72170d))
+* Embedding Context Length Error ([6d6c5ab](https://github.com/TPTBusiness/Predix/commit/6d6c5abd4ac7252257f88e13e263ecb2497fde3b))
+* enable embedding truncation ([#1188](https://github.com/TPTBusiness/Predix/issues/1188)) ([880a6c7](https://github.com/TPTBusiness/Predix/commit/880a6c70c41024cb51f9fc4349ac7f1d2dbda434))
+* end-timestamp 23:45,  weg, SZ-beispiele weg ([6a9ccd5](https://github.com/TPTBusiness/Predix/commit/6a9ccd5ddbf95060a2847bd27bcdae762a46a19d))
+* enhance feedback handling in MultiProcessEvolvingStrategy for improved task evolution ([#1274](https://github.com/TPTBusiness/Predix/issues/1274)) ([afb575c](https://github.com/TPTBusiness/Predix/commit/afb575cc91114dbe41d8f582294dcc3692990695))
+* Ensure backtest results save to DB and JSON files ([ae7b35e](https://github.com/TPTBusiness/Predix/commit/ae7b35ea2e0c71c76e8e454f7845df461d65b99f))
+* evaluator erkennt 15min als valid (nicht daily) ([cf0f634](https://github.com/TPTBusiness/Predix/commit/cf0f634c17dce45400cc325ccd3ca45e769c15fd))
+* **factors:** detect and correct look-ahead bias in daily-constant factors ([dcad0d1](https://github.com/TPTBusiness/Predix/commit/dcad0d1f68608a4db3cfdabb75e66c22490643aa))
+* **factors:** extend look-ahead rules to session factors and add intraday-factor guidance ([8811dc0](https://github.com/TPTBusiness/Predix/commit/8811dc042a0a7a1ac385c7141ded9f56a434dced))
+* filter NaN in max(), remove redundant ternary, handle non-finite vbt results ([1acfe50](https://github.com/TPTBusiness/Predix/commit/1acfe508a9c327dce8eba7a2ad1f618052a3e8a5))
+* fix bug for hypo_select_with_llm when not support response_schema ([#1208](https://github.com/TPTBusiness/Predix/issues/1208)) ([d759ca9](https://github.com/TPTBusiness/Predix/commit/d759ca95e714a7a1476839a2a04bb652c0fbb863))
+* fix chat_max_tokens calculation method to show true input_max_tokens ([#1241](https://github.com/TPTBusiness/Predix/issues/1241)) ([7e99605](https://github.com/TPTBusiness/Predix/commit/7e996055f2c7fd37595573ebdb13aa57c425a6cc))
+* fix mcts ([#1270](https://github.com/TPTBusiness/Predix/issues/1270)) ([5003aff](https://github.com/TPTBusiness/Predix/commit/5003affb17505525336e6c30ba9c690b810c252b))
+* Fix parallel runner dashboard rendering error ([3e8c07e](https://github.com/TPTBusiness/Predix/commit/3e8c07e728076a951528c4eb5b429653a5c77d14))
+* fix some bugs in RD-Agent(Q) ([#1143](https://github.com/TPTBusiness/Predix/issues/1143)) ([7134a51](https://github.com/TPTBusiness/Predix/commit/7134a51afa71ab146b52987c194adace62f8b034))
+* fix type annotation, remove unused parameter, improve import_class errors ([1eb5849](https://github.com/TPTBusiness/Predix/commit/1eb5849dd44c5953f7198212a5ef0dbe8c8d4881))
+* Forward-fill daily factors to 1-min frequency ([20f4c21](https://github.com/TPTBusiness/Predix/commit/20f4c2140c397230fb56734b0e887b770db805ac))
+* generate.py nutzt rdagent4qlib env für Qlib-Datenzugriff ([b9007f7](https://github.com/TPTBusiness/Predix/commit/b9007f754ac682800aaf265c0f24c2028d387d84))
+* **graph:** using assignment expression to avoid repeated function call ([#1174](https://github.com/TPTBusiness/Predix/issues/1174)) ([b6fae75](https://github.com/TPTBusiness/Predix/commit/b6fae75cde256c9c8a84783dbd135a9bcca6ac8d))
+* Handle failed experiments in feedback step to prevent crashes ([979ef66](https://github.com/TPTBusiness/Predix/commit/979ef66dc612c7f589e097dcdc3a01b742b18970))
+* handle mixed str and dict types in code_list ([#1279](https://github.com/TPTBusiness/Predix/issues/1279)) ([32ecf92](https://github.com/TPTBusiness/Predix/commit/32ecf92afcf647f257b430c748cbe6bb5fa0fac4))
+* Handle negative/zero values in performance report charts ([f4a4c65](https://github.com/TPTBusiness/Predix/commit/f4a4c65ce9bc1c929526a20a852765b92709011c))
+* handle None output and conditional step dump in LoopBase execution ([#1212](https://github.com/TPTBusiness/Predix/issues/1212)) ([9de8d60](https://github.com/TPTBusiness/Predix/commit/9de8d6066994fcd7037fd03d9339b6590ab2fac9))
+* Handle Qlib Docker backtest failures gracefully (SECURITY FIX) ([59f4561](https://github.com/TPTBusiness/Predix/commit/59f45618229be08dba028dceda21433cc5d52b9f))
+* Handle timeout exceptions safely in predix_full_eval.py ([2738263](https://github.com/TPTBusiness/Predix/commit/27382635171482be2cee2e29d4793e63d14abce4))
+* handle ValueError in stdout shrinking and refactor shrink logic ([#1228](https://github.com/TPTBusiness/Predix/issues/1228)) ([6fc3877](https://github.com/TPTBusiness/Predix/commit/6fc3877a39baabbf26e0cc1cbd327b0f6e2e325e))
+* Harden _safe_resolve to fix CodeQL alert [#3](https://github.com/TPTBusiness/Predix/issues/3) ([0ed1a0a](https://github.com/TPTBusiness/Predix/commit/0ed1a0aa8faad6df36753a928f40a1cdbd606462))
+* Harden path validation in Job Summary UI to fix CodeQL alert [#17](https://github.com/TPTBusiness/Predix/issues/17) ([7fe15d4](https://github.com/TPTBusiness/Predix/commit/7fe15d46cb2a740b6ec0ee37d29acaf37476e8e6))
+* Harden path validation to fix CodeQL alert [#20](https://github.com/TPTBusiness/Predix/issues/20) ([59d06f6](https://github.com/TPTBusiness/Predix/commit/59d06f6588caadaa207bde1d135828c56169bff8))
+* ignore case when checking metric name ([#1160](https://github.com/TPTBusiness/Predix/issues/1160)) ([1b84f7b](https://github.com/TPTBusiness/Predix/commit/1b84f7b7546a9dee4f27e24e07c49fa8ee3a370d))
+* ignore RuntimeError for shared workspace double recovery ([#1140](https://github.com/TPTBusiness/Predix/issues/1140)) ([bd8a16d](https://github.com/TPTBusiness/Predix/commit/bd8a16d92f9176d835bbc27478f9259f0fe9a827))
+* Import pandas in predix portfolio_simple command ([2b6de06](https://github.com/TPTBusiness/Predix/commit/2b6de06a612c147c414bde3175b6f11af1762f4d))
+* Improve path traversal prevention with dedicated helper function ([50dc275](https://github.com/TPTBusiness/Predix/commit/50dc27566d886a4aea9ea56eaef2c08e794df770))
+* increase retry count in hypothesis_gen decorator to 10 ([#1230](https://github.com/TPTBusiness/Predix/issues/1230)) ([86ce4f1](https://github.com/TPTBusiness/Predix/commit/86ce4f135d649cfb12f2f88626cd31868cb447e7))
+* increase time default not controlled by LLM ([#1196](https://github.com/TPTBusiness/Predix/issues/1196)) ([e4bd647](https://github.com/TPTBusiness/Predix/commit/e4bd647d1b20cbaa26a00cf23c49bfbc0bc80477))
+* Initialize EnvController in QuantTrace.__init__ ([698a17e](https://github.com/TPTBusiness/Predix/commit/698a17ea61321c37c7fa0d69849a309d29474f80))
+* inject correct MultiIndex template into factor prompt ([49004db](https://github.com/TPTBusiness/Predix/commit/49004db027d699bacbb975f267daa95d1957ccd7))
+* inject MultiIndex warning into factor interface prompt (YAML valide) ([79e2915](https://github.com/TPTBusiness/Predix/commit/79e2915823801d3574920fa197cf9c57965f485f))
+* insert await asyncio.sleep(0) to yield control in loop ([#1186](https://github.com/TPTBusiness/Predix/issues/1186)) ([e0453e0](https://github.com/TPTBusiness/Predix/commit/e0453e0058e2a4ec74feb0b31883f45604a9bf0c))
+* jinja problem of enumerate ([#1216](https://github.com/TPTBusiness/Predix/issues/1216)) ([6725f15](https://github.com/TPTBusiness/Predix/commit/6725f15f30df30a3ce37024fded621354d8114a7))
+* kaggle competition metric direction ([#1195](https://github.com/TPTBusiness/Predix/issues/1195)) ([04878f9](https://github.com/TPTBusiness/Predix/commit/04878f9e703fee9caff9208ab23995586f165c95))
+* **kronos:** lazy torch import to fix CI ModuleNotFoundError ([9cd8ab5](https://github.com/TPTBusiness/Predix/commit/9cd8ab54656786cc04742695c9d2e650a1b124ae))
+* **kronos:** pass actual datetime Series to Kronos predictor timestamps ([7741408](https://github.com/TPTBusiness/Predix/commit/7741408c671b6fe943491b39d9fc5cac256b457e))
+* **kronos:** replace rdagent_logger with stdlib logging for CI compatibility ([1ee5ea7](https://github.com/TPTBusiness/Predix/commit/1ee5ea7792f9ea94ddd26a0828d9744d0e07baa6))
+* **loop:** compress old experiment history in proposal prompt to reduce context size ([bde37f0](https://github.com/TPTBusiness/Predix/commit/bde37f09d53a4f6582d071ed72d86491889bc573))
+* **loop:** prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages ([881ca81](https://github.com/TPTBusiness/Predix/commit/881ca819cea90d8a60865296e6f416aab69a18c9))
+* merge candidates ([#1254](https://github.com/TPTBusiness/Predix/issues/1254)) ([46aad78](https://github.com/TPTBusiness/Predix/commit/46aad789ef710d9603e2330788dc66849cb6cab3))
+* model/factor experiment filtering in Qlib proposals ([#1257](https://github.com/TPTBusiness/Predix/issues/1257)) ([9e34b4e](https://github.com/TPTBusiness/Predix/commit/9e34b4e855cbd709cd077f529950b8e1f5c01486))
+* move snapshot saving after step index update in loop execution ([#1206](https://github.com/TPTBusiness/Predix/issues/1206)) ([774346d](https://github.com/TPTBusiness/Predix/commit/774346d92e3d9faa858f935bb2651d0f1aa12a6c))
+* move task cancellation to finally block and fix subprocess kill typo ([#1234](https://github.com/TPTBusiness/Predix/issues/1234)) ([a984f69](https://github.com/TPTBusiness/Predix/commit/a984f69f681dda1c6c58f45e2505d7b0e8d75cf0))
+* **optuna:** fix inverted parameter range in Stage 2/3 when signal_bias is negative ([f0be842](https://github.com/TPTBusiness/Predix/commit/f0be842a6c03f56cb209d1f8a0c5a0d9fa3baebf))
+* Override webshop's Werkzeug dependency to fix CVE-2026-27199 ([3a5aa0b](https://github.com/TPTBusiness/Predix/commit/3a5aa0ba43fd644ad1944994f3cd3d49e7ab633c))
+* preserve null end_time when rendering dataset segments template ([#1326](https://github.com/TPTBusiness/Predix/issues/1326)) ([6196ba3](https://github.com/TPTBusiness/Predix/commit/6196ba31f2e43db4761eeb482c3301e2238bc4cf))
+* prevent calendar index overflow when signal data ends early ([#1324](https://github.com/TPTBusiness/Predix/issues/1324)) ([3dbd703](https://github.com/TPTBusiness/Predix/commit/3dbd7038280f21793246e5354f083ba472772a10))
+* prevent JSON content from being added multiple times during retries ([#1255](https://github.com/TPTBusiness/Predix/issues/1255)) ([31b19de](https://github.com/TPTBusiness/Predix/commit/31b19dee80c5006c72a0a9698834a04a3acd4af9))
+* Prevent path injection in FT Job Summary UI ([e4393fb](https://github.com/TPTBusiness/Predix/commit/e4393fb3b1e95fa53f7d8e972da35e994402def8))
+* Prevent path injection in RL Job Summary UI ([b3e8cb8](https://github.com/TPTBusiness/Predix/commit/b3e8cb8cfe5fe74c5b893c6d0e401375630ee750))
+* Prevent path traversal in autorl_bench server.py ([6634e6e](https://github.com/TPTBusiness/Predix/commit/6634e6e5c55c07f41d3a37731d59f6e11b35610e))
+* Prevent path traversal in get_job_options() app.py ([7da2e57](https://github.com/TPTBusiness/Predix/commit/7da2e5706c7d7da8ffee3f04b42f8d3378af26ad))
+* Prevent path traversal in RL UI app.py ([d2c1516](https://github.com/TPTBusiness/Predix/commit/d2c1516416dbda6109f6d42245263ce5373ce957))
+* Prevent path traversal in Streamlit UI app.py ([0d0fd34](https://github.com/TPTBusiness/Predix/commit/0d0fd34573c0695c34431a6e9eb7b5c10a3a91f9))
+* **qlib:** correct indentation in except blocks in quant_proposal and factor_runner ([8f67ab6](https://github.com/TPTBusiness/Predix/commit/8f67ab61299b7fb7063f5ac363705a6687ecaea1))
+* Refactor path validation to fix CodeQL alert [#16](https://github.com/TPTBusiness/Predix/issues/16) ([a417ebc](https://github.com/TPTBusiness/Predix/commit/a417ebc41db5ad24b89f53e5f3c3ff6e5339ae18))
+* refine DSCoSTEER_eval prompts ([#1157](https://github.com/TPTBusiness/Predix/issues/1157)) ([5594ab4](https://github.com/TPTBusiness/Predix/commit/5594ab418b46422e2f2e2edc08f0aadd0e95af04))
+* refine prompts and add additional package info ([#1179](https://github.com/TPTBusiness/Predix/issues/1179)) ([5353bd3](https://github.com/TPTBusiness/Predix/commit/5353bd31f25a98cba552145709af743cd4e83cf5))
+* refine task scheduling logic in MultiProcessEvolvingStrategy for… ([#1275](https://github.com/TPTBusiness/Predix/issues/1275)) ([27d38af](https://github.com/TPTBusiness/Predix/commit/27d38af7bd7e1fdb73e3617e94435abe7901dd21))
+* remove $factor from prompt, update example count to EURUSD ([3adc5bf](https://github.com/TPTBusiness/Predix/commit/3adc5bf75e6820328991aa5a5456e6f68ccf8fd7))
+* remove all Chinese stock references, replace with EURUSD 1min FX ([44eeb01](https://github.com/TPTBusiness/Predix/commit/44eeb01ec4f95271a084e9d285e00959926923f3))
+* Remove API key from test_benchmark_api.py config ([16e8631](https://github.com/TPTBusiness/Predix/commit/16e86310bdd8d2af1539063957edebde97f88110))
+* Remove API key logging from eurusd_llm.py ([3f510be](https://github.com/TPTBusiness/Predix/commit/3f510be9daddf0b241925f605898e2e1d3a18cb7))
+* Remove API key parameter from generate_api_config() ([e6eeac9](https://github.com/TPTBusiness/Predix/commit/e6eeac93614a9d97d119696802c7a08153c70f59))
+* Remove API key presence detection from logging ([12b45e5](https://github.com/TPTBusiness/Predix/commit/12b45e50f2d7d41881c3028b3f2213e7e7c573d8))
+* Remove clear-text storage of API key (CodeQL alert [#8](https://github.com/TPTBusiness/Predix/issues/8)) ([4842311](https://github.com/TPTBusiness/Predix/commit/4842311d9193d665c27311e7efc9637b9f3e0519))
+* Remove hardcoded credentials from test_benchmark_api.py ([2523ee2](https://github.com/TPTBusiness/Predix/commit/2523ee213e35c03175da9512619b46f6e9069f88))
+* remove unused imports in data science scenario module ([#1136](https://github.com/TPTBusiness/Predix/issues/1136)) ([fd6cd39](https://github.com/TPTBusiness/Predix/commit/fd6cd3950c4d0463f2d1ccab63fa48be4de41a58))
+* Rename loader.py to prompt_loader.py to fix module conflict ([06f0c34](https://github.com/TPTBusiness/Predix/commit/06f0c3427c665063513ae097068be71069a733b2))
+* replace hardcoded ChromeDriver path with webdriver-manager ([#1271](https://github.com/TPTBusiness/Predix/issues/1271)) ([e3d2443](https://github.com/TPTBusiness/Predix/commit/e3d24437cf7842623fe27fd9221e36a07457d7f7))
+* Resolve 88% empty backtest results + path fixes ([8d1c70e](https://github.com/TPTBusiness/Predix/commit/8d1c70e679721b90c024bc747d2544ce9c151adf))
+* resolve dead code, shell injection risk, mutable defaults, and other bugs ([4267315](https://github.com/TPTBusiness/Predix/commit/4267315783ccbdaa3472c5f7fd4728cf656556c1))
+* Resolve FORWARD_BARS NameError in backtest script ([ad7f5e1](https://github.com/TPTBusiness/Predix/commit/ad7f5e1388ad2149d0c32a5febfed0b77b05ef47))
+* Resolve security vulnerabilities (Dependabot + Code Scanning) ([2c96828](https://github.com/TPTBusiness/Predix/commit/2c9682800e4ea30361561affbb747e4f2cc763f6))
+* resolve unbound variable, logger shadowing, withdraw_loop edge case, and other bugs in main scripts ([2fd4bc3](https://github.com/TPTBusiness/Predix/commit/2fd4bc3741bafc6778008b3ecc49ba01207f22e1))
+* revert 2 commits ([#1239](https://github.com/TPTBusiness/Predix/issues/1239)) ([2201a47](https://github.com/TPTBusiness/Predix/commit/2201a4762343f2cc2deb3dff2b70baf99f102292))
+* revert to v10 setting ([#1220](https://github.com/TPTBusiness/Predix/issues/1220)) ([51f5bc9](https://github.com/TPTBusiness/Predix/commit/51f5bc9e117c6bfcb50c29355d5e73381d40b511))
+* **security:** nosec for B608/B701 false positives in UI and template code ([8b73952](https://github.com/TPTBusiness/Predix/commit/8b739528e5679cb49989be7e0edd7ac404b5d993))
+* **security:** Patch 5 CodeQL path injection and clear-text logging alerts ([#22](https://github.com/TPTBusiness/Predix/issues/22)-[#25](https://github.com/TPTBusiness/Predix/issues/25), [#9](https://github.com/TPTBusiness/Predix/issues/9)) ([5aed2cf](https://github.com/TPTBusiness/Predix/commit/5aed2cf58a4a39d515bc81e5fd6835a138198b82))
+* **security:** Patch 5 CodeQL path injection and weak hashing alerts ([#25](https://github.com/TPTBusiness/Predix/issues/25)-[#30](https://github.com/TPTBusiness/Predix/issues/30)) ([e188333](https://github.com/TPTBusiness/Predix/commit/e1883331f18e7265aeb13145abaca4b295a15f6e))
+* **security:** Patch path injection and stack trace exposure (CodeQL [#31](https://github.com/TPTBusiness/Predix/issues/31), [#27](https://github.com/TPTBusiness/Predix/issues/27)) ([2b0525f](https://github.com/TPTBusiness/Predix/commit/2b0525f9b7ef68ecc04bfddd558184f06640fb0b))
+* **security:** real fix for B110 (logging in factor_proposal.py [#746](https://github.com/TPTBusiness/Predix/issues/746)) ([61656af](https://github.com/TPTBusiness/Predix/commit/61656afda75e77686952d847aec443c28e17b6d6))
+* **security:** real fix for B110 (logging in factor_runner.py [#744](https://github.com/TPTBusiness/Predix/issues/744)) ([5ac64e6](https://github.com/TPTBusiness/Predix/commit/5ac64e60e4e3977364ffd5ad8704fdf0c46bad75))
+* **security:** real fix for B110 (logging in quant_proposal.py [#741](https://github.com/TPTBusiness/Predix/issues/741)) ([bcfeb32](https://github.com/TPTBusiness/Predix/commit/bcfeb32958953ba07e980dce5feaffe5d53963e8))
+* **security:** real fix for B110 (logging in quant_proposal.py [#741](https://github.com/TPTBusiness/Predix/issues/741)) ([d865c82](https://github.com/TPTBusiness/Predix/commit/d865c824c98820b26e3d64b8c193445effb19667))
+* **security:** real fix for B404/B603 (sys.executable in factor_runner.py [#745](https://github.com/TPTBusiness/Predix/issues/745)) ([7894b8e](https://github.com/TPTBusiness/Predix/commit/7894b8e6ed1cb580d8909403eb166a2b418b2dd0))
+* **security:** replace eval() with ast.literal_eval and add request timeouts (B307, B113) ([ffb24fd](https://github.com/TPTBusiness/Predix/commit/ffb24fd5de724455aa77846c3f98fae35bc80430))
+* **security:** replace eval() with ast.literal_eval in finetune validator (B307) ([8d53b81](https://github.com/TPTBusiness/Predix/commit/8d53b81633965fd0ae2bf32081dacc91b121b77d))
+* **security:** replace os.path.realpath with pathlib.resolve in safe_resolve_path to fix path-injection alerts ([0d7af52](https://github.com/TPTBusiness/Predix/commit/0d7af52a2d32f1dbcc366b9f395c43ad47ddabb2))
+* **security:** replace relative_to() with realpath+startswith for CodeQL sanitization ([d7e2018](https://github.com/TPTBusiness/Predix/commit/d7e2018a7232c59a40d6e740111572a0da0cd384))
+* **security:** replace remaining assert statements with proper error handling ([d4d5baf](https://github.com/TPTBusiness/Predix/commit/d4d5bafd1eb8330f75917170520408b48d38f8c2))
+* **security:** replace shell=True subprocess calls with list args (B602) ([30887ac](https://github.com/TPTBusiness/Predix/commit/30887ac244f77a5edabc11dda7805b9bb789667f))
+* **security:** replace shell=True subprocess calls with list args in env.py (B602) ([1a4f1cf](https://github.com/TPTBusiness/Predix/commit/1a4f1cf6044842939bc5e7ed853c437cab591a26))
+* **security:** resolve all 30 Bandit security alerts (B301, B614, B104) ([00f400f](https://github.com/TPTBusiness/Predix/commit/00f400fe2efda375884234cd381401583a65f456))
+* **security:** resolve CodeQL path-injection alerts in UI data loaders ([7caab95](https://github.com/TPTBusiness/Predix/commit/7caab9545bd929909f4c7cae02fbcc2cc3a9893a))
+* **security:** resolve CodeQL path-injection and clear-text-logging alerts ([8701b8b](https://github.com/TPTBusiness/Predix/commit/8701b8bd75f82ceb326da4f105609f4228961666))
+* **security:** Resolve GitHub Security Scan alerts ([5af7f19](https://github.com/TPTBusiness/Predix/commit/5af7f19bd1656078991752d298c0f3c953f7af2c))
+* **security:** resolve path-injection and add nosec for safe temp paths (B108, py/path-injection) ([4133fff](https://github.com/TPTBusiness/Predix/commit/4133fffa7d97bd38beb4b99aa7f3ab3039d78103))
+* **security:** resolve path-injection, B701, B101, B112 Bandit alerts ([e87d612](https://github.com/TPTBusiness/Predix/commit/e87d61257fa4bb401415b62ff88c7ad75085d89c))
+* **security:** revert broken read_pickle encoding arg in kaggle template (B301) ([e16460c](https://github.com/TPTBusiness/Predix/commit/e16460c7bc5329c9752cd12b20fcee978b5f232b))
+* **security:** Upgrade vllm and transformers to patch 4 CVEs ([85915b3](https://github.com/TPTBusiness/Predix/commit/85915b3a20e9ceae6dd854ef4c64a61590a36d84))
+* **security:** validate SQL identifiers in _add_column_if_not_exists (B608) ([c40795b](https://github.com/TPTBusiness/Predix/commit/c40795bcb0dab5ceff9b56ec019b9be6f9d10203))
+* **security:** whitelist-validate metric column in get_top_factors (B608) ([db51417](https://github.com/TPTBusiness/Predix/commit/db51417cd4337e3b8b76420c93b1bb1ed3271b13))
+* set requires_documentation_search to None to disable feature in eval ([#1245](https://github.com/TPTBusiness/Predix/issues/1245)) ([ee8c119](https://github.com/TPTBusiness/Predix/commit/ee8c119f31b72de1002e5ad5d30c56d0f4b6c9b9))
+* Skip already evaluated factors in predix_full_eval.py ([8375213](https://github.com/TPTBusiness/Predix/commit/8375213629551605b4c401aa1ce71ed8d9f1e4db))
+* skip Kronos factor on GPUs &lt; 20GB to avoid CUDA OOM (shared with llama-server) ([08fea7a](https://github.com/TPTBusiness/Predix/commit/08fea7a2809941d2b5f3feb5ba998dba132053bb))
+* skip res_ratio check if timer or res_time is None ([#1189](https://github.com/TPTBusiness/Predix/issues/1189)) ([dbe2142](https://github.com/TPTBusiness/Predix/commit/dbe214282e84f099512eeaf01925c7dee1b780a6))
+* **strategies:** guard against None IC in acceptance check, disable slow wf_rolling ([843cd9a](https://github.com/TPTBusiness/Predix/commit/843cd9ae017b05365e1bb353b9945e2fbce332dd))
+* **strategies:** handle None ic/sharpe/dd in rejected strategy log output ([0121c2c](https://github.com/TPTBusiness/Predix/commit/0121c2c1583b752622c69313e78ccbeedf6c8d1b))
+* **strategy:** Fix template variables, APIBackend import, and JSON extraction ([f0e813e](https://github.com/TPTBusiness/Predix/commit/f0e813ee48ae65e0ee78c27a8b971139dac5b552))
+* **strategy:** Re-evaluate Optuna-optimized strategies with full OHLCV backtest ([7da8bad](https://github.com/TPTBusiness/Predix/commit/7da8badbc1005bb1866631dc14daa815641b4271))
+* summary page bug ([#1219](https://github.com/TPTBusiness/Predix/issues/1219)) ([beab473](https://github.com/TPTBusiness/Predix/commit/beab473b40714fbd802ebb3b61c0dd3d3ba7d91a))
+* Switch to ThreadPoolExecutor for factor evaluation ([d0aa146](https://github.com/TPTBusiness/Predix/commit/d0aa1464ea1e3553e4b869c3429e5e394bcebda8))
+* Translate remaining German comment in eurusd_macro.py ([02b46d1](https://github.com/TPTBusiness/Predix/commit/02b46d1ffc3bfe87033714f71a9d22714a071f09))
+* ui bug ([#1192](https://github.com/TPTBusiness/Predix/issues/1192)) ([2f8261f](https://github.com/TPTBusiness/Predix/commit/2f8261f82bf25ad714eff22be2283c6e645b5314))
+* update fallback criterion ([#1210](https://github.com/TPTBusiness/Predix/issues/1210)) ([dbbe374](https://github.com/TPTBusiness/Predix/commit/dbbe374ac8b0cefcde9145a76b4cd5c0b40b3f92))
+* Update LICENSE badge link from main to master branch ([0dbace6](https://github.com/TPTBusiness/Predix/commit/0dbace6aa7aa1a7a250e45c96e71591edeed8f55))
+* update requirements.txt's streamlit ([#1133](https://github.com/TPTBusiness/Predix/issues/1133)) ([600d159](https://github.com/TPTBusiness/Predix/commit/600d159e86521cc0498df9df3756921e676e3332))
+* Update Werkzeug to 2.3.8 (latest secure 2.x version) ([d68a5ee](https://github.com/TPTBusiness/Predix/commit/d68a5ee47cba6f8d2ca0faba1ad89ba65f4fc94b))
+* update WF test for new default (wf_rolling=True) ([c906e00](https://github.com/TPTBusiness/Predix/commit/c906e00ac9731673f6386f8b3ce38f5d8e817992))
+* Use 96-bar forward returns in backtest (matching factor IC horizon) ([19c5b3d](https://github.com/TPTBusiness/Predix/commit/19c5b3d70633d5cc622328e57acd122120d47971))
+* Use num_api_keys instead of len(api_keys) for round-robin ([c91976e](https://github.com/TPTBusiness/Predix/commit/c91976e7968f54a065b4a5ee11228133b48db3e9))
+* weg, Timestamps mit Uhrzeit, kein SZ-Beispiel ([e9f6ac4](https://github.com/TPTBusiness/Predix/commit/e9f6ac48d97b1b57a0dde14562cd1b6f5d106edd))
+
+
+### Performance Improvements
+
+* **kronos:** batch GPU inference via predict_batch — 75x faster ([a93f940](https://github.com/TPTBusiness/Predix/commit/a93f940485eb92d747d5e6f966acb5c5e8d118c7))
+* **kronos:** batch GPU inference via predict_batch — 75x faster ([471b1f9](https://github.com/TPTBusiness/Predix/commit/471b1f9a4b22cfd2f473d28285a6c7390fe3d10c))
+
+
+### Documentation
+
+* Add ATTRIBUTION.md with clear usage guidelines ([c5bf3e4](https://github.com/TPTBusiness/Predix/commit/c5bf3e4e2b99074e54645328a399f8f6da0387ea))
+* Add CLI welcome screenshot to README ([4103ebe](https://github.com/TPTBusiness/Predix/commit/4103ebe1bfdc625af18711cf78ed19c808270227))
+* Add comprehensive CHANGELOG.md for v1.0.0 release ([569b72b](https://github.com/TPTBusiness/Predix/commit/569b72b2c9a154bf991d03ac078bf020ef1eab16))
+* Add comprehensive CLI help and update README with quick start ([8265462](https://github.com/TPTBusiness/Predix/commit/8265462cacb4e03c981ead1d6b6393a9070f729e))
+* Add comprehensive data setup guide to README ([ca30ed2](https://github.com/TPTBusiness/Predix/commit/ca30ed270ab36517604a9eb0f1ace0fdd58a917c))
+* Add comprehensive Git commit guidelines to QWEN.md ([d10d3a2](https://github.com/TPTBusiness/Predix/commit/d10d3a2c658bb77366baec13e922f0ed924b51d8))
+* Add conda requirement to README + fix predix CLI ([90e185a](https://github.com/TPTBusiness/Predix/commit/90e185a4986ff9a4838bd94cb7b4034fea573f87))
+* Add CRITICAL rule - NEVER commit closed-source/private assets ([a0ed4f7](https://github.com/TPTBusiness/Predix/commit/a0ed4f712ed4aa49eadaa5ced070c22f0146420a))
+* Add CRITICAL rule - NEVER commit trading strategies or JSON files ([cb0cb4c](https://github.com/TPTBusiness/Predix/commit/cb0cb4c1122b9aab23f2e2f4feb5b4a99ed05008))
+* add documentation for Data Science configurable options ([#1301](https://github.com/TPTBusiness/Predix/issues/1301)) ([d603d5a](https://github.com/TPTBusiness/Predix/commit/d603d5a5aa86e43cfc0ee3efedc5ab18919809f5))
+* add execution environment configuration guide (Docker vs Conda) ([#1288](https://github.com/TPTBusiness/Predix/issues/1288)) ([27ed3d1](https://github.com/TPTBusiness/Predix/commit/27ed3d1a75b15a5589af84d4f597a8484006e71e))
+* Add implementation summary ([649ed0c](https://github.com/TPTBusiness/Predix/commit/649ed0c3c0db823fb4fc984b9f6b6e7970d728ff))
+* Add live trading system documentation to QWEN.md ([49b15d9](https://github.com/TPTBusiness/Predix/commit/49b15d917828a3c1263da1785da5663c67d41b40))
+* Add Microsoft RD-Agent acknowledgment to README ([06c0b44](https://github.com/TPTBusiness/Predix/commit/06c0b44e4106a725a879932122d871041042ec2b))
+* Add professional badges to README header ([91d44dd](https://github.com/TPTBusiness/Predix/commit/91d44ddabd4b4cf82cb1e6f53c8f4547f52a50cb))
+* Add results/ directory README for storage documentation ([ba4e5d6](https://github.com/TPTBusiness/Predix/commit/ba4e5d6ece652e8c1c3b8a713a2e0ea2a0ab225c))
+* Add v2.0.0 release changelog ([c5e34ff](https://github.com/TPTBusiness/Predix/commit/c5e34ff7aaa2d30a159b05f4e6ecc853b8a4f79e))
+* Clean changelog of closed-source performance metrics ([7dc2ecd](https://github.com/TPTBusiness/Predix/commit/7dc2ecdc8dbf4ef0a2936ab1f1e0c0469ca95e9c))
+* Create changelog/ directory with v1.0.0.md release notes ([ddefcd4](https://github.com/TPTBusiness/Predix/commit/ddefcd420a9d98fc6548e14cfc94caffd2068963))
+* Final system completion - all 9 phases done ([ab541de](https://github.com/TPTBusiness/Predix/commit/ab541de9b3ca4cdf62f14f97d540460fc333fca9))
+* fix duplicate sections, add hardware requirements and data setup guide ([cc85cd4](https://github.com/TPTBusiness/Predix/commit/cc85cd482ac7169fbe98468539899a2ce561e70d))
+* improve README badges, fix llama-server flags, clean up structure ([7981a6a](https://github.com/TPTBusiness/Predix/commit/7981a6a4d1517950f4124a78642db3f15fde03ba))
+* Remove 'Inspired by' comments and add comprehensive Acknowledgments ([d5dc48a](https://github.com/TPTBusiness/Predix/commit/d5dc48a6bdd519d0ce159d21ca9bbc46b7996313))
+* Simplify README for git-clone-only installation ([a1e3bb9](https://github.com/TPTBusiness/Predix/commit/a1e3bb903c31cea3ea4c5e572bc639352e3215ae))
+* Translate all code comments to English ([cff6c2a](https://github.com/TPTBusiness/Predix/commit/cff6c2a55e0b465a3f30ab802f02e3b4583025bc))
+* Translate data_config.yaml to English ([b5221b7](https://github.com/TPTBusiness/Predix/commit/b5221b761f51bcf2b7b14c7bdfabfa2e9629a3b0))
+* Translate server.py comments to English ([7fd7592](https://github.com/TPTBusiness/Predix/commit/7fd75922f89d6358c1ce48fd886ffbca10537531))
+* Translate server.py docstring to English ([d5acaa0](https://github.com/TPTBusiness/Predix/commit/d5acaa0c036913776eef6bb01083cce2942dc16c))
+* update configuration docs ([#1155](https://github.com/TPTBusiness/Predix/issues/1155)) ([56ed919](https://github.com/TPTBusiness/Predix/commit/56ed919b2e44f4398ac304a4f6cdf099dd382096))
+* update license section from MIT to AGPL-3.0 ([ff441a4](https://github.com/TPTBusiness/Predix/commit/ff441a49fe0b45c31b1702b8bd22d5c8edd37abb))
+* Update QWEN.md with complete 5-phase architecture and results ([66e1798](https://github.com/TPTBusiness/Predix/commit/66e17981fd9241d9ee6f50be05142ee201b761a8))
+* Update QWEN.md with detailed Git history correction guide ([a972772](https://github.com/TPTBusiness/Predix/commit/a97277298d3d5f122905d7e02b58568224b86b40))
+* Update QWEN.md with implementation guide ([23af142](https://github.com/TPTBusiness/Predix/commit/23af142af0b127600c61ba3623f3538abf1c881c))
+* Update SECURITY.md and CONTRIBUTING.md ([e40f659](https://github.com/TPTBusiness/Predix/commit/e40f6594441e195041ccb58072483fe8704eac4c))
+* Update TODO.md with v1.0.0 completed items and future roadmap ([2d3ca5b](https://github.com/TPTBusiness/Predix/commit/2d3ca5bec66e81b37ce7bf4086f24556f6cad134))
+
+
+### Miscellaneous Chores
+
+* release 0.8.0 ([8c15238](https://github.com/TPTBusiness/Predix/commit/8c1523802c3c0237eae27ebef3e155af2cddd05e))
+
+## [1.4.2](https://github.com/TPTBusiness/Predix/compare/v1.4.1...v1.4.2) (2026-05-03)
+
+
+### Bug Fixes
+
+* add missing sys import and fix undefined acc_rate in factor eval ([c45f990](https://github.com/TPTBusiness/Predix/commit/c45f9908ee321400f0a19c57f1482e4cd1394a50))
+
+## [1.4.1](https://github.com/TPTBusiness/Predix/compare/v1.4.0...v1.4.1) (2026-05-03)
+
+
+### Bug Fixes
+
+* 15 bug fixes across orchestrator, runner, backtest, and infrastructure ([163687d](https://github.com/TPTBusiness/Predix/commit/163687d7e1c278a085d7052a3f958a3edb501e77))
+* also catch ValueError in mean_variance for dimension mismatch ([ed73b72](https://github.com/TPTBusiness/Predix/commit/ed73b7253f7dc6459ee30dd81a1ce1194e46e9af))
+* close log file handle, fix FTMO equity double-count, remove bare except ([76219a5](https://github.com/TPTBusiness/Predix/commit/76219a53efddaafc2b8bd48a0f76c1d4325e6ea5))
+* correct project root paths and subprocess handling in parallel runner and CLI ([9735e3a](https://github.com/TPTBusiness/Predix/commit/9735e3a4d8f01e7b16fb9b185a002396a915cea4))
+* filter NaN in max(), remove redundant ternary, handle non-finite vbt results ([f89fbb3](https://github.com/TPTBusiness/Predix/commit/f89fbb3421faf6ccdc8e68a911fd9db2c166120f))
+* fix type annotation, remove unused parameter, improve import_class errors ([8b6ab73](https://github.com/TPTBusiness/Predix/commit/8b6ab735c05629bf6b76ddc2fd8b15617600cad7))
+* resolve dead code, shell injection risk, mutable defaults, and other bugs ([afff262](https://github.com/TPTBusiness/Predix/commit/afff26287f7c4df7ddfde4e816d280fe845e11eb))
+* resolve unbound variable, logger shadowing, withdraw_loop edge case, and other bugs in main scripts ([748cf9b](https://github.com/TPTBusiness/Predix/commit/748cf9b214a3e8447f1289fc4cf1e92ad6cc2f1a))
+
+## [1.4.0](https://github.com/TPTBusiness/Predix/compare/v1.3.11...v1.4.0) (2026-05-01)
+
+
+### Features
+
+* **optimizer:** add max_positions parameter to Optuna search space ([fdb4be3](https://github.com/TPTBusiness/Predix/commit/fdb4be3b3ebd93325e7821f4251148424184a40d))
+
+## [1.3.11](https://github.com/TPTBusiness/Predix/compare/v1.3.10...v1.3.11) (2026-05-01)
+
+
+### Bug Fixes
+
+* **ci:** lazy import logger in predix.py and cli.py to avoid ImportError in test env ([60763e8](https://github.com/TPTBusiness/Predix/commit/60763e8eae34f41865ba8e5e65bdfde13b564b4b))
+
+## [1.3.10](https://github.com/TPTBusiness/Predix/compare/v1.3.9...v1.3.10) (2026-05-01)
+
+
+### Bug Fixes
+
+* **security:** replace remaining assert statements with proper error handling ([928533d](https://github.com/TPTBusiness/Predix/commit/928533d9a81bd5062f07458fbf94d3c7fe347775))
+
+## [1.3.9](https://github.com/TPTBusiness/Predix/compare/v1.3.8...v1.3.9) (2026-05-01)
+
+
+### Bug Fixes
+
+* **security:** resolve path-injection, B701, B101, B112 Bandit alerts ([20b89a0](https://github.com/TPTBusiness/Predix/commit/20b89a061843b39836e975f158404e8e2d4627cd))
+
+## [1.3.8](https://github.com/TPTBusiness/Predix/compare/v1.3.7...v1.3.8) (2026-04-30)
+
+
+### Bug Fixes
+
+* **deps:** relax aiohttp constraint to &gt;=3.13.4 for litellm compatibility ([34ab192](https://github.com/TPTBusiness/Predix/commit/34ab1923a887089eb36e5cbad6cb8df16f0333ca))
+* **qlib:** correct indentation in except blocks in quant_proposal and factor_runner ([8143451](https://github.com/TPTBusiness/Predix/commit/8143451e8c0ead01c4d86d19669268c7bfb15fac))
+* **security:** replace eval() with ast.literal_eval in finetune validator (B307) ([0508caf](https://github.com/TPTBusiness/Predix/commit/0508caf9140d210b823fefefa28ee535ec85a0ae))
+* **security:** replace shell=True subprocess calls with list args in env.py (B602) ([2012d5a](https://github.com/TPTBusiness/Predix/commit/2012d5ae4e77cc2f1ab9a48beaaac5a74695d083))
+* **security:** resolve path-injection and add nosec for safe temp paths (B108, py/path-injection) ([6727480](https://github.com/TPTBusiness/Predix/commit/67274803bd1d14e5d1df9a063f46b2edb8501a2b))
+
+## [1.3.7](https://github.com/TPTBusiness/Predix/compare/v1.3.6...v1.3.7) (2026-04-30)
+
+
+### Bug Fixes
+
+* **security:** nosec for B608/B701 false positives in UI and template code ([5eb5d7e](https://github.com/TPTBusiness/Predix/commit/5eb5d7e8fdbe90e0dced83fef4e09f5a33e96b2b))
+* **security:** replace eval() with ast.literal_eval and add request timeouts (B307, B113) ([3301ada](https://github.com/TPTBusiness/Predix/commit/3301ada697ca7d3afa1a188d2a76a87ae98b4529))
+* **security:** replace shell=True subprocess calls with list args (B602) ([13c08f4](https://github.com/TPTBusiness/Predix/commit/13c08f4ce6813eb7c314087921ec8c0f40074bd7))
+
+## [1.3.6](https://github.com/TPTBusiness/Predix/compare/v1.3.5...v1.3.6) (2026-04-30)
+
+
+### Bug Fixes
+
+* **security:** real fix for B110 (logging in factor_proposal.py [#746](https://github.com/TPTBusiness/Predix/issues/746)) ([16624e0](https://github.com/TPTBusiness/Predix/commit/16624e0bd966ae4d24c4a3eb42bbc31c11da3136))
+* **security:** real fix for B110 (logging in factor_runner.py [#744](https://github.com/TPTBusiness/Predix/issues/744)) ([88cf0fb](https://github.com/TPTBusiness/Predix/commit/88cf0fb8828b11c97f2f3ae2881a4900b020c6f0))
+* **security:** real fix for B110 (logging in quant_proposal.py [#741](https://github.com/TPTBusiness/Predix/issues/741)) ([7cf2a64](https://github.com/TPTBusiness/Predix/commit/7cf2a644f553b054bd4b0607ea51e5372e68d90a))
+* **security:** real fix for B110 (logging in quant_proposal.py [#741](https://github.com/TPTBusiness/Predix/issues/741)) ([ef985f8](https://github.com/TPTBusiness/Predix/commit/ef985f86035d8dca707c60137e6508349a0c4ae6))
+* **security:** real fix for B404/B603 (sys.executable in factor_runner.py [#745](https://github.com/TPTBusiness/Predix/issues/745)) ([819655a](https://github.com/TPTBusiness/Predix/commit/819655aaa3efa76596d60501d0e8ca365df3e5e2))
+* **security:** revert broken read_pickle encoding arg in kaggle template (B301) ([3574907](https://github.com/TPTBusiness/Predix/commit/35749073c91e69f63ddaad61dae3f2b799327e63))
+* **security:** validate SQL identifiers in _add_column_if_not_exists (B608) ([e10dfa2](https://github.com/TPTBusiness/Predix/commit/e10dfa2576038e911f83595d3b466c261bc0cd54))
+* **security:** whitelist-validate metric column in get_top_factors (B608) ([e50519f](https://github.com/TPTBusiness/Predix/commit/e50519fe066e68aec2f19b83df4f643c3c22053d))
+
+## [1.3.5](https://github.com/TPTBusiness/Predix/compare/v1.3.4...v1.3.5) (2026-04-27)
+
+
+### Bug Fixes
+
+* **auto-fixer:** add five new factor code fixes for groupby/apply errors ([449c8fd](https://github.com/TPTBusiness/Predix/commit/449c8fd70a327e604dcca122e4a134f0cca918e4))
+* **auto-fixer:** add four new factor code fixes for common runtime errors ([40484f6](https://github.com/TPTBusiness/Predix/commit/40484f6d300425da481f1edd325da4acbc06ec7d))
+* **auto-fixer:** add groupby([level=N,'date']) SyntaxError fix ([ca77c00](https://github.com/TPTBusiness/Predix/commit/ca77c005bea4abdd8854c1de2b0e8d03b7742161))
+* **auto-fixer:** disable _fix_min_periods for intraday data ([77b0740](https://github.com/TPTBusiness/Predix/commit/77b0740f059349df7e769a378af728aa33b2070e))
+* **auto-fixer:** fix chained groupby(level=N).groupby('date') pattern ([7d5fe32](https://github.com/TPTBusiness/Predix/commit/7d5fe32b31a19ce8b04bd8f5a430720fdb748f7a))
+* **auto-fixer:** fix df.loc[instrument] DateParseError on MultiIndex frames ([b7860ea](https://github.com/TPTBusiness/Predix/commit/b7860eafc0ad26384947ce0510ecf4e9f3425807))
+* **auto-fixer:** fix df['instrument'] KeyError on MultiIndex frames ([aad6bd1](https://github.com/TPTBusiness/Predix/commit/aad6bd1c7c720b3d486e0cf248337f32394773b1))
+* **auto-fixer:** fix two assignment-target bugs in instrument column fixers ([421eedf](https://github.com/TPTBusiness/Predix/commit/421eedffed4b883c24397dc5581c019a3985277f))
+* **auto-fixer:** preserve date dimension in groupby(['instrument','date']) fix ([b58fdd8](https://github.com/TPTBusiness/Predix/commit/b58fdd8be43720b5d4363e0f8de9a01591d4d2dc))
+* **auto-fixer:** remove ddof from rolling() args, not only from std()/var() ([b0fc328](https://github.com/TPTBusiness/Predix/commit/b0fc328d0d4a041c65d8eeb32cb3f2bb86568406))
+* **auto-fixer:** strip spurious .reset_index() after .transform() calls ([8708aae](https://github.com/TPTBusiness/Predix/commit/8708aae6e08728cda1875c775a76dc92e43576f3))
+* **loop:** prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages ([5ec4ad1](https://github.com/TPTBusiness/Predix/commit/5ec4ad1b96b5b99ef42bea7bb828cb1ef709a688))
+
+## [1.3.4](https://github.com/TPTBusiness/Predix/compare/v1.3.3...v1.3.4) (2026-04-27)
+
+
+### Bug Fixes
+
+* **auto-fixer:** add five new factor code fixes for groupby/apply errors ([449c8fd](https://github.com/TPTBusiness/Predix/commit/449c8fd70a327e604dcca122e4a134f0cca918e4))
+* **auto-fixer:** add four new factor code fixes for common runtime errors ([40484f6](https://github.com/TPTBusiness/Predix/commit/40484f6d300425da481f1edd325da4acbc06ec7d))
+* **auto-fixer:** add groupby([level=N,'date']) SyntaxError fix ([ca77c00](https://github.com/TPTBusiness/Predix/commit/ca77c005bea4abdd8854c1de2b0e8d03b7742161))
+* **auto-fixer:** disable _fix_min_periods for intraday data ([77b0740](https://github.com/TPTBusiness/Predix/commit/77b0740f059349df7e769a378af728aa33b2070e))
+* **auto-fixer:** fix chained groupby(level=N).groupby('date') pattern ([7d5fe32](https://github.com/TPTBusiness/Predix/commit/7d5fe32b31a19ce8b04bd8f5a430720fdb748f7a))
+* **auto-fixer:** fix df.loc[instrument] DateParseError on MultiIndex frames ([b7860ea](https://github.com/TPTBusiness/Predix/commit/b7860eafc0ad26384947ce0510ecf4e9f3425807))
+* **auto-fixer:** fix df['instrument'] KeyError on MultiIndex frames ([aad6bd1](https://github.com/TPTBusiness/Predix/commit/aad6bd1c7c720b3d486e0cf248337f32394773b1))
+* **auto-fixer:** preserve date dimension in groupby(['instrument','date']) fix ([b58fdd8](https://github.com/TPTBusiness/Predix/commit/b58fdd8be43720b5d4363e0f8de9a01591d4d2dc))
+* **auto-fixer:** remove ddof from rolling() args, not only from std()/var() ([b0fc328](https://github.com/TPTBusiness/Predix/commit/b0fc328d0d4a041c65d8eeb32cb3f2bb86568406))
+* **backtest:** replace broken MC permutation test with binomial win-rate test ([c38d894](https://github.com/TPTBusiness/Predix/commit/c38d89478f586825bfca5715a96ca70ccd8791a3))
+* **factors:** detect and correct look-ahead bias in daily-constant factors ([eb490a4](https://github.com/TPTBusiness/Predix/commit/eb490a461b66cbd815ae53ac5205115754712432))
+* **factors:** extend look-ahead rules to session factors and add intraday-factor guidance ([c24c100](https://github.com/TPTBusiness/Predix/commit/c24c100442d6487686c0578de0b32d240fcbf215))
+* **loop:** compress old experiment history in proposal prompt to reduce context size ([4bf90a9](https://github.com/TPTBusiness/Predix/commit/4bf90a905ba8b2aba2a818191c19998088cccaaf))
+* **loop:** prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages ([5ec4ad1](https://github.com/TPTBusiness/Predix/commit/5ec4ad1b96b5b99ef42bea7bb828cb1ef709a688))
+
+## [1.3.3](https://github.com/TPTBusiness/Predix/compare/v1.3.2...v1.3.3) (2026-04-25)
+
+
+### Bug Fixes
+
+* **backtest:** replace broken MC permutation test with binomial win-rate test ([c38d894](https://github.com/TPTBusiness/Predix/commit/c38d89478f586825bfca5715a96ca70ccd8791a3))
+* **factors:** detect and correct look-ahead bias in daily-constant factors ([eb490a4](https://github.com/TPTBusiness/Predix/commit/eb490a461b66cbd815ae53ac5205115754712432))
+* **factors:** extend look-ahead rules to session factors and add intraday-factor guidance ([c24c100](https://github.com/TPTBusiness/Predix/commit/c24c100442d6487686c0578de0b32d240fcbf215))
+* **loop:** compress old experiment history in proposal prompt to reduce context size ([4bf90a9](https://github.com/TPTBusiness/Predix/commit/4bf90a905ba8b2aba2a818191c19998088cccaaf))
+* **strategies:** guard against None IC in acceptance check, disable slow wf_rolling ([2197f52](https://github.com/TPTBusiness/Predix/commit/2197f52150a50ef38d9e70991d7e48c8c30caec4))
+* **strategies:** handle None ic/sharpe/dd in rejected strategy log output ([ad2ad3a](https://github.com/TPTBusiness/Predix/commit/ad2ad3ab3360ea75ed3bbc90c12098b9c5cc0114))
+
+## [1.3.2](https://github.com/TPTBusiness/Predix/compare/v1.3.1...v1.3.2) (2026-04-23)
+
+
+### Bug Fixes
+
+* **strategies:** guard against None IC in acceptance check, disable slow wf_rolling ([2197f52](https://github.com/TPTBusiness/Predix/commit/2197f52150a50ef38d9e70991d7e48c8c30caec4))
+* **strategies:** handle None ic/sharpe/dd in rejected strategy log output ([ad2ad3a](https://github.com/TPTBusiness/Predix/commit/ad2ad3ab3360ea75ed3bbc90c12098b9c5cc0114))
+
+## [1.3.1](https://github.com/TPTBusiness/Predix/compare/v1.3.0...v1.3.1) (2026-04-21)
+
+
+### Bug Fixes
+
+* **deps:** bump python-dotenv to &gt;=1.2.2 (CVE symlink overwrite) ([126ae7d](https://github.com/TPTBusiness/Predix/commit/126ae7d5fb556b677d09d10221862a0d648d697a))
+
+## [1.3.0](https://github.com/TPTBusiness/Predix/compare/v1.2.2...v1.3.0) (2026-04-21)
+
+
+### Features
+
+* **backtest:** add rolling walk-forward validation and Monte Carlo trade permutation test ([637a94c](https://github.com/TPTBusiness/Predix/commit/637a94c1d987da763869f4f9b73372a3f37d873c))
+
+
+### Bug Fixes
+
+* **security:** resolve all 30 Bandit security alerts (B301, B614, B104) ([ce5983d](https://github.com/TPTBusiness/Predix/commit/ce5983d9d59c4c34341fb1ec749e44bbcfc4a1c4))
+
+## [1.2.2](https://github.com/TPTBusiness/Predix/compare/v1.2.1...v1.2.2) (2026-04-19)
+
+
+### Documentation
+
+* **claude:** auto-merge release-please PR after every push ([f500917](https://github.com/TPTBusiness/Predix/commit/f500917b699ee78dc676e84e01574d49bdc8e796))
+
 ## [2.2.0](https://github.com/TPTBusiness/Predix/compare/v2.1.0...v2.2.0) (2026-04-18)


@@ -1,21 +1,662 @@
-MIT License
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007

-Copyright (c) 2025 Predix Team
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.

-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+                            Preamble

-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.

-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+
+    Copyright (C) {{ year }}  {{ organization }}
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<http://www.gnu.org/licenses/>.
@@ -84,6 +84,8 @@ rdagent predix

 Predix is optimized for **1-minute EUR/USD FX data** (2020–2026) and uses Qlib as the underlying backtesting engine.

+> **Backtest Verification**: Every backtest result is automatically verified at runtime against mathematical invariants (MaxDD ∈ [-1,0], WinRate ∈ [0,1], Sharpe finite, sign consistency, etc.). 479 unit tests + 10 ground-truth validation tests ensure ~99% metric correctness. See [Backtest Integrity](#backtest-integrity).
+
 ## Acknowledgments

 This project draws inspiration from various open-source projects in the AI trading and multi-agent systems space. We thank all the authors for their innovative work that helped shape our understanding of these patterns.
@@ -515,16 +517,15 @@ Core dependencies (see [`requirements.txt`](requirements.txt) for full list):

 ## License

-This project is licensed under the **MIT License** – see the [`LICENSE`](LICENSE) file for details.
+This project is licensed under the **GNU Affero General Public License v3.0 (AGPL-3.0)**.

-### Attribution Requirements
+Key points of AGPL-3.0:
+- You may use, modify, and distribute this software freely
+- If you distribute modified versions, you MUST publish your changes under the same AGPL-3.0 license
+- If you run this software as a network service (e.g., trading API), you MUST make the complete source code available to users
+- Includes patent protection and anti-tivoization clauses

-If you use this code or concepts in your project, you **must**:
-1. Include the MIT License text
-2. Keep the copyright notice: "Copyright (c) 2025 Predix Team"
-3. Provide attribution to the original project
-
-See [`ATTRIBUTION.md`](ATTRIBUTION.md) for detailed guidelines and examples.
+See the full license text in [`LICENSE`](LICENSE) or at <https://www.gnu.org/licenses/agpl-3.0.en.html>.

 ---

@@ -565,6 +566,32 @@ If you use Predix in your research, please cite the underlying framework:

 ---

+## Backtest Integrity
+
+Every backtest result is automatically verified at runtime against 10 mathematical invariants.  
+The verifier runs in **<1ms** and catches corrupted/missing/flipped metrics before they enter the factor database.
+
+### Runtime checks (every backtest)
+| Check | Constraint |
+|-------|-----------|
+| Max Drawdown | `-1.0 ≤ mdd ≤ 0.0` |
+| Win Rate | `0.0 ≤ wr ≤ 1.0` |
+| Sharpe Ratio | `sharpe` must be finite |
+| Total Return | `total_return` must be finite |
+| Trade Count | `n_trades ≥ 0` |
+| Sign consistency | `sign(sharpe) == sign(annual_return)` |
+| Status | Must be `success` or `failed` |
+
+### Test suite (CI + pre-commit)
+```bash
+pytest test/qlib/ -q        # 479 tests, 0 failures
+pytest test/backtesting/ -q # backtest engine tests
+```
+
+**Coverage**: IC linear invariance, forward-return alignment, cross-implementation validation, ground-truth hand-computed scenarios, look-ahead bias detection, edge cases (all-NaN, constant, zero-variance), Monte Carlo p-value, walk-forward rolling, buy-and-hold equality.
+
+---
+
 ## Disclaimer

 Predix is provided "as is" for **research and educational purposes only**. It is **not** intended for:
@@ -13,11 +13,19 @@ import sys
 from pathlib import Path

 from dotenv import load_dotenv
+
 load_dotenv(Path(__file__).parent / ".env")

 import typer
 from rich.console import Console

+try:
+    from rdagent.utils.env import logger
+except ImportError:
+    import logging
+
+    logger = logging.getLogger(__name__)
+
 app = typer.Typer(help="Predix - AI Quantitative Trading Agent")
 console = Console()

@@ -107,7 +115,7 @@ def _ensure_kronos_factor_in_pool(con) -> None:
        color = "green" if abs(ic) > 0.01 else "yellow"
        con.print(
            f"  [bold {color}]Kronos Factor ready:[/bold {color}] IC={ic:.4f}, "
-            f"Hit-Rate={hit_rate:.1%} — added to strategy pool"
+            f"Hit-Rate={hit_rate:.1%} — added to strategy pool",
        )

    except Exception as e:
@@ -194,9 +202,9 @@ def quant(
        predix health - Check system health and configuration
    """
    import subprocess
+    import sys
    import threading
    import time
-    import sys

    # ---- Parallel Run Isolation ----
    # When run_id > 0, isolate all outputs (logs, results, workspace)
@@ -219,10 +227,9 @@ def quant(
        console.print(f"   [dim]Log: {log_file}[/dim]")
        console.print(f"   [dim]Results: results/runs/run{run_id}/[/dim]")
        console.print(f"   [dim]Workspace: {workspace_dir.name}/[/dim]")
-    else:
-        # Single run mode: default log file
-        if log_file is None:
-            log_file = "fin_quant.log"
+    # Single run mode: default log file
+    elif log_file is None:
+        log_file = "fin_quant.log"

    # ---- Log File Setup (daily-rotated) ----
    from datetime import datetime as _dt
@@ -230,10 +237,14 @@ def quant(
    _daily_dir = Path(__file__).parent / "logs" / _today
    _daily_dir.mkdir(parents=True, exist_ok=True)

+    _log_f = None
+    _orig_stdout = sys.stdout
+    _orig_stderr = sys.stderr
+
    if log_file.lower() != "none":
        log_path = _daily_dir / log_file
        # Open log file for appending (raw stdout/stderr capture)
-        log_f = open(log_path, "a", encoding="utf-8")
+        _log_f = open(log_path, "a", encoding="utf-8")

        # Redirect stdout and stderr to both console and log file
        class TeeWriter:
@@ -245,18 +256,18 @@ def quant(
                    try:
                        s.write(data)
                        s.flush()
-                    except:
+                    except Exception:
                        pass

            def flush(self):
                for s in self._streams:
                    try:
                        s.flush()
-                    except:
+                    except Exception:
                        pass

-        sys.stdout = TeeWriter(sys.__stdout__, log_f)
-        sys.stderr = TeeWriter(sys.__stderr__, log_f)
+        sys.stdout = TeeWriter(_orig_stdout, _log_f)
+        sys.stderr = TeeWriter(_orig_stderr, _log_f)

        console.print(f"\n[dim]📝 Logging to: logs/{_today}/{log_file}[/dim]")
    else:
@@ -269,7 +280,7 @@ def quant(
        if not api_key:
            console.print("\n[bold red]❌ OPENROUTER_API_KEY not set in .env[/bold red]")
            console.print("[yellow]Add your API key to .env:[/yellow]")
-            console.print('  OPENROUTER_API_KEY=sk-or-your-key-here')
+            console.print("  OPENROUTER_API_KEY=sk-or-your-key-here")
            raise typer.Exit(code=1)

        # Setup both API keys for load balancing
@@ -282,7 +293,7 @@ def quant(
            os.environ["LITELLM_PARALLEL_CALLS"] = "2"
            console.print(f"\n[bold blue]🌐 Using OpenRouter (2 API Keys):[/bold blue] [cyan]{os.environ['CHAT_MODEL']}[/cyan]")
            console.print(f"   [dim]Keys: {api_key[:15]}*** + {api_key_2[:15]}***[/dim]")
-            console.print(f"   [dim]Parallel: 2 concurrent requests[/dim]")
+            console.print("   [dim]Parallel: 2 concurrent requests[/dim]")
        else:
            os.environ["OPENAI_API_KEY"] = api_key
            console.print(f"\n[bold blue]🌐 Using OpenRouter:[/bold blue] [cyan]{os.environ['CHAT_MODEL']}[/cyan]")
@@ -300,7 +311,7 @@ def quant(
    # ---- Dashboards ----
    if dashboard:
        def start_web_dashboard():
-            console.print(f"\n[bold green]🚀 Web Dashboard: http://localhost:5000[/bold green]")
+            console.print("\n[bold green]🚀 Web Dashboard: http://localhost:5000[/bold green]")
            subprocess.run(
                ["python", "web/dashboard_api.py"],
                cwd=str(Path(__file__).parent),
@@ -318,14 +329,21 @@ def quant(
        threading.Thread(target=start_cli_dash, daemon=True).start()
        time.sleep(1)

-    # ---- Kronos Factor: auto-generate if not in pool ----
-    _ensure_kronos_factor_in_pool(console)
+    # ---- Kronos Factor: skip if GPU unavailable (CUDA OOM with llama-server) ----
+    try:
+        import torch
+        if torch.cuda.is_available() and torch.cuda.get_device_properties(0).total_memory > 20 * 1024**3:
+            _ensure_kronos_factor_in_pool(console)
+        else:
+            console.print("[dim]Kronos Factor skipped — GPU < 20GB or CUDA unavailable[/dim]")
+    except Exception:
+        console.print("[dim]Kronos Factor skipped — torch not available[/dim]")

    # ---- Start fin_quant ----
    from rdagent.app.qlib_rd_loop.quant import main as fin_quant
    from rdagent.log.daily_log import session as _daily_session

-    console.print(f"\n[bold cyan]📊 Starting EURUSD Trading Loop...[/bold cyan]\n")
+    console.print("\n[bold cyan]📊 Starting EURUSD Trading Loop...[/bold cyan]\n")

    _ctx = {"model": model}
    if run_id:
@@ -335,11 +353,17 @@ def quant(
    if step_n:
        _ctx["steps"] = step_n

-    with _daily_session("fin_quant", **_ctx):
-        fin_quant(
-            step_n=step_n,
-            loop_n=loop_n,
-        )
+    try:
+        with _daily_session("fin_quant", **_ctx):
+            fin_quant(
+                step_n=step_n,
+                loop_n=loop_n,
+            )
+    finally:
+        if _log_f is not None:
+            sys.stdout = _orig_stdout
+            sys.stderr = _orig_stderr
+            _log_f.close()


@app.command()
@@ -408,8 +432,8 @@ def evaluate(
        predix portfolio - Select a diversified portfolio of uncorrelated factors
        predix quant - Generate new factors via LLM trading loop
    """
-    from rich.panel import Panel
    from rdagent.log.daily_log import session as _daily_session
+    from rich.panel import Panel

    console.print(Panel(
        "[bold cyan]📊 Predix Factor Evaluator[/bold cyan]\n"
@@ -489,11 +513,12 @@ def top(
        predix portfolio - Select diversified portfolio from top factors
        predix build-strategies - Combine factors into trading strategies
    """
-    import json
    import glob as glob_module
+    import json
+
    import numpy as np
-    from rich.table import Table
    from rich.panel import Panel
+    from rich.table import Table

    factors_dir = Path(__file__).parent / "results" / "factors"
    if not factors_dir.exists():
@@ -510,6 +535,7 @@ def top(
            if data.get("status") == "success" and data.get("ic") is not None:
                results.append(data)
        except Exception:
+            logger.warning("Failed to load factor file %s", f, exc_info=True)
            continue

    if not results:
@@ -557,9 +583,11 @@ def top(

    console.print(table)

-    # Summary
-    valid_ic = [r.get("ic") for r in results if r.get("ic") is not None]
-    valid_sharpe = [r.get("sharpe") for r in results if r.get("sharpe") is not None]
+    # Summary — filter None, NaN, and non-numeric values
+    valid_ic = [v for v in (r.get("ic") for r in results)
+                if isinstance(v, (int, float)) and v is not None and not np.isnan(v)]
+    valid_sharpe = [v for v in (r.get("sharpe") for r in results)
+                    if isinstance(v, (int, float)) and v is not None and not np.isnan(v)]
    # Filter extreme outliers for average
    valid_sharpe_filtered = [s for s in valid_sharpe if abs(s or 0) < 1e6]

@@ -634,16 +662,16 @@ def portfolio(
        predix top - View top factors before portfolio selection
        predix build-strategies - Build strategies from selected factors
    """
-    import json
    import glob as glob_module
+    import json
+    import shutil
    import subprocess
    import tempfile
-    import shutil
-    import numpy as np
+
    import pandas as pd
-    from rich.table import Table
    from rich.panel import Panel
-    from rich.progress import Progress, SpinnerColumn, TextColumn, BarColumn, TaskProgressColumn, TimeElapsedColumn
+    from rich.progress import BarColumn, Progress, SpinnerColumn, TaskProgressColumn, TextColumn, TimeElapsedColumn
+    from rich.table import Table

    factors_dir = Path(__file__).parent / "results" / "factors"
    if not factors_dir.exists():
@@ -659,6 +687,7 @@ def portfolio(
            if data.get("status") == "success" and data.get("ic") is not None:
                results.append(data)
        except Exception:
+            logger.warning("Failed to load factor file %s", f, exc_info=True)
            continue

    if not results:
@@ -674,12 +703,12 @@ def portfolio(
    # 2. Evaluate candidates to get time-series values for correlation
    # We need to run the factor code to get the series of values.
    # We do this sequentially to avoid OOM.
-    
+
    # Locate data file
    data_file = Path(__file__).parent / "git_ignore_folder" / "factor_implementation_source_data" / "intraday_pv.h5"
    if not data_file.exists():
        data_file = Path(__file__).parent / "git_ignore_folder" / "factor_implementation_source_data_debug" / "intraday_pv.h5"
-    
+
    if not data_file.exists():
        console.print("[red]Source data file (intraday_pv.h5) not found.[/red]")
        return
@@ -696,11 +725,11 @@ def portfolio(
        console=console,
    ) as progress:
        task = progress.add_task(f"Computing values for {len(candidates)} factors...", total=len(candidates))
-        
+
        for cand in candidates:
            fname = cand.get("factor_name", "unknown")
            fcode = cand.get("factor_code", "")
-            
+
            if not fcode:
                errors.append((fname, "No code in JSON"))
                progress.advance(task)
@@ -716,10 +745,10 @@ def portfolio(
                    # If symlink fails, copy the file
                    import shutil
                    shutil.copy(str(data_file), str(tmp_path / "intraday_pv.h5"))
-                
+
                # Write code
                (tmp_path / "factor.py").write_text(fcode)
-                
+
                try:
                    # Run factor
                    result = subprocess.run(
@@ -727,16 +756,16 @@ def portfolio(
                        cwd=tmp_path,
                        capture_output=True,
                        text=True,
-                        timeout=120 # 2 min timeout per factor
+                        timeout=120, # 2 min timeout per factor
                    )
-                    
+
                    # Read result
                    res_file = tmp_path / "result.h5"
                    if res_file.exists():
                        df = pd.read_hdf(str(res_file), key="data")
                        # Get the series (first column)
                        series = df.iloc[:, 0]
-                        
+
                        # Count non-NaN values
                        non_nan = series.count()
                        if non_nan < 1000:
@@ -756,7 +785,7 @@ def portfolio(
                except Exception as e:
                    errors.append((fname, str(e)[:100]))
                    progress.update(task, description=f"{fname} ❌ (Error)")
-            
+
            progress.advance(task)

    # Show summary of errors
@@ -770,7 +799,7 @@ def portfolio(
    if len(factor_series) < 3:
        console.print("[red]Not enough valid factor series to build portfolio (need at least 3).[/red]")
        console.print("[yellow]Tip: Factors might be producing mostly NaN values or failing execution.[/yellow]")
-        
+
        # Fallback: Show top factors by IC without diversification
        console.print("\n[dim]Showing top factors by IC instead:[/dim]")
        table = Table(
@@ -788,50 +817,49 @@ def portfolio(
                str(i),
                cand.get("factor_name", "unknown")[:38],
                f"{cand.get('ic', 0):.6f}",
-                f"{cand.get('sharpe', 0):.4f}" if cand.get('sharpe') else "N/A",
+                f"{cand.get('sharpe', 0):.4f}" if cand.get("sharpe") else "N/A",
            )
-        
+
        console.print(table)
        return

    # 3. Build Correlation Matrix
    console.print(f"\n[dim]Building correlation matrix from {len(factor_series)} factors...[/dim]")
-    
+
    # Align indices and drop NaN
    combined = pd.DataFrame(factor_series).dropna()
-    
+
    if combined.empty or len(combined) < 100:
        console.print("[red]Not enough valid overlapping data to compute correlation.[/red]")
        console.print("[dim]This means the factors produce values at different times or have too many NaN values.[/dim]")
        return

    corr_matrix = combined.corr().fillna(0)
-    ic_map = {cand['factor_name']: cand.get('ic', 0) for cand in candidates}
+    ic_map = {cand["factor_name"]: cand.get("ic", 0) for cand in candidates}

    # 4. Greedy Selection
    selected = []
    remaining = list(corr_matrix.columns)
-    
+
    # Sort remaining by IC to prioritize high IC factors
    remaining.sort(key=lambda x: abs(ic_map.get(x, 0)), reverse=True)

    for factor in remaining:
        if len(selected) >= target:
            break
-        
+
        # If it's the first one, just take it
        if not selected:
            selected.append(factor)
            continue
-        
+
        # Check correlation with already selected
        # We want max(|corr|) < max_corr
        max_c = 0
        for sel in selected:
            c = abs(corr_matrix.loc[factor, sel])
-            if c > max_c:
-                max_c = c
-        
+            max_c = max(max_c, c)
+
        if max_c < max_corr:
            selected.append(factor)

@@ -849,23 +877,23 @@ def portfolio(

    for i, fname in enumerate(selected, 1):
        # Find original data for display
-        data = next((c for c in candidates if c['factor_name'] == fname), {})
-        ic = data.get('ic')
-        sharpe = data.get('sharpe')
-        
+        data = next((c for c in candidates if c["factor_name"] == fname), {})
+        ic = data.get("ic")
+        sharpe = data.get("sharpe")
+
        # Calculate max corr with other selected factors
        max_c_val = 0
        for s in selected:
            if s != fname:
                val = abs(corr_matrix.loc[fname, s])
-                if val > max_c_val: max_c_val = val
+                max_c_val = max(max_c_val, val)

        table.add_row(
            str(i),
            fname[:38],
            f"{ic:.6f}" if ic is not None else "N/A",
            f"{sharpe:.4f}" if sharpe is not None else "N/A",
-            f"{max_c_val:.4f}" if max_c_val > 0 else "-"
+            f"{max_c_val:.4f}" if max_c_val > 0 else "-",
        )

    console.print(table)
@@ -875,20 +903,20 @@ def portfolio(
        "selected_factors": selected,
        "max_correlation": max_corr,
        "pool_size": top,
-        "timestamp": pd.Timestamp.now().isoformat()
+        "timestamp": pd.Timestamp.now().isoformat(),
    }
-    
+
    out_dir = Path(__file__).parent / "results" / "portfolio"
    out_dir.mkdir(parents=True, exist_ok=True)
    out_file = out_dir / "selected_factors.json"
-    
+
    with open(out_file, "w") as f:
        json.dump(portfolio_data, f, indent=2)
-    
+
    console.print(Panel(
        f"[bold]Portfolio saved to results/portfolio/selected_factors.json[/bold]\n"
        f"Selected {len(selected)} unique factors from {top} candidates.",
-        border_style="green"
+        border_style="green",
    ))


@@ -934,13 +962,12 @@ def portfolio_simple(
        predix top - View top factors before portfolio selection
        predix build-strategies - Build strategies from selected factors
    """
-    import json
    import glob as glob_module
-    import re
-    import numpy as np
+    import json
+
    import pandas as pd
-    from rich.table import Table
    from rich.panel import Panel
+    from rich.table import Table

    factors_dir = Path(__file__).parent / "results" / "factors"
    if not factors_dir.exists():
@@ -956,6 +983,7 @@ def portfolio_simple(
            if data.get("status") == "success" and data.get("ic") is not None:
                results.append(data)
        except Exception:
+            logger.warning("Failed to load factor file %s", f, exc_info=True)
            continue

    if not results:
@@ -983,14 +1011,14 @@ def portfolio_simple(
    for cand in candidates:
        fname = cand.get("factor_name", "").lower()
        assigned = False
-        
+
        # Check each category's keywords
        for cat, keywords in categories.items():
            if any(kw in fname for kw in keywords):
                categorized[cat].append(cand)
                assigned = True
                break
-        
+
        if not assigned:
            categorized["other"].append(cand)

@@ -1001,7 +1029,7 @@ def portfolio_simple(
            best = categorized[cat][0]  # Already sorted by IC
            selected.append({
                "factor": best,
-                "category": cat.capitalize() if cat != "other" else "Other"
+                "category": cat.capitalize() if cat != "other" else "Other",
            })

    # 5. Display Results
@@ -1024,7 +1052,7 @@ def portfolio_simple(
            cand.get("factor_name", "unknown")[:38],
            cat,
            f"{cand.get('ic', 0):.6f}",
-            f"{cand.get('sharpe', 0):.4f}" if cand.get('sharpe') else "N/A",
+            f"{cand.get('sharpe', 0):.4f}" if cand.get("sharpe") else "N/A",
        )

    console.print(table)
@@ -1034,7 +1062,7 @@ def portfolio_simple(
        "selected_factors": [item["factor"]["factor_name"] for item in selected],
        "categories": {item["category"]: item["factor"]["factor_name"] for item in selected},
        "method": "simple_keyword_categorization",
-        "timestamp": str(pd.Timestamp.now().isoformat())
+        "timestamp": str(pd.Timestamp.now().isoformat()),
    }

    out_dir = Path(__file__).parent / "results" / "portfolio"
@@ -1047,7 +1075,7 @@ def portfolio_simple(
    console.print(Panel(
        f"[bold]Simple Portfolio saved to results/portfolio/portfolio_simple.json[/bold]\n"
        f"Selected {len(selected)} factors across {len([c for c in categorized if categorized[c]])} categories.",
-        border_style="green"
+        border_style="green",
    ))


@@ -1110,12 +1138,10 @@ def build_strategies(
        predix portfolio - Select diversified factors before combining
        predix top - View top factors before building strategies
    """
-    import pandas as pd
    import numpy as np
-    from rich.table import Table
-    from rich.panel import Panel
-
    from rdagent.scenarios.qlib.developer.strategy_builder import StrategyBuilder
+    from rich.panel import Panel
+    from rich.table import Table

    console.print(Panel(
        "[bold cyan]🏗️  Predix Strategy Builder[/bold cyan]\n"
@@ -1271,9 +1297,10 @@ def build_strategies_ai(
        predix quant - Generate new alpha factors via LLM trading loop
        predix evaluate - Evaluate factors before strategy building
    """
-    from rich.panel import Panel
    from pathlib import Path

+    from rich.panel import Panel
+
    console.print(Panel(
        "[bold cyan]🧠 StrategyCoSTEER - AI Strategy Builder[/bold cyan]\n"
        "Generating trading strategies from existing factors\n"
@@ -1299,7 +1326,7 @@ def build_strategies_ai(
    # Setup LLM environment (same as quant command)
    api_key = os.getenv("OPENROUTER_API_KEY") or os.getenv("OPENAI_API_KEY", "")
    api_key_2 = os.getenv("OPENROUTER_API_KEY_2", "")
-    
+
    if api_key and not api_key.startswith("sk-or-"):
        # OPENROUTER_API_KEY not set, try to use what we have
        api_key = os.getenv("OPENROUTER_API_KEY", api_key)
@@ -1326,8 +1353,8 @@ def build_strategies_ai(
        return

    # Load evaluated factors
-    import json
    import glob as glob_module
+    import json

    factors = []
    for f in glob_module.glob(str(factors_dir / "*.json")):
@@ -1337,6 +1364,7 @@ def build_strategies_ai(
            if data.get("status") == "success" and data.get("ic") is not None:
                factors.append(data)
        except Exception:
+            logger.warning("Failed to load factor file %s", f, exc_info=True)
            continue

    if len(factors) < 10:
@@ -1410,15 +1438,15 @@ def build_strategies_ai(

            for i, r in enumerate(results, 1):
                # Monthly return: use real backtest if available, else estimate
-                rb = r.get('real_backtest', {})
-                if isinstance(rb, dict) and rb.get('status') == 'success':
-                    monthly_pct = rb.get('monthly_return_pct', r.get('monthly_return_pct', 0))
-                    n_trades = rb.get('n_trades', '-')
-                    real_ic = rb.get('ic', 0)
+                rb = r.get("real_backtest", {})
+                if isinstance(rb, dict) and rb.get("status") == "success":
+                    monthly_pct = rb.get("monthly_return_pct", r.get("monthly_return_pct", 0))
+                    n_trades = rb.get("n_trades", "-")
+                    real_ic = rb.get("ic", 0)
                else:
-                    monthly_pct = r.get('monthly_return_pct', r.get('real_monthly_return', 0))
-                    n_trades = '-'
-                    real_ic = rb.get('ic', 0) if isinstance(rb, dict) else 0
+                    monthly_pct = r.get("monthly_return_pct", r.get("real_monthly_return", 0))
+                    n_trades = "-"
+                    real_ic = rb.get("ic", 0) if isinstance(rb, dict) else 0

                table.add_row(
                    str(i),
@@ -1446,6 +1474,90 @@ def build_strategies_ai(
        console.print(traceback.format_exc())


+@app.command()
+def generate_strategies(
+    count: int = typer.Option(10, "--count", "-n", help="Number of strategies to generate"),
+    workers: int = typer.Option(2, "--workers", "-w", help="Parallel workers"),
+    style: str = typer.Option("swing", "--style", "-s", help="Trading style: daytrading or swing"),
+    optuna: bool = typer.Option(True, "--optuna/--no-optuna", help="Enable Optuna optimization"),
+    optuna_trials: int = typer.Option(30, "--optuna-trials", help="Number of Optuna trials per strategy"),
+    top_factors: int = typer.Option(20, "--top-factors", help="Number of top factors to consider"),
+    min_sharpe: float = typer.Option(1.5, "--min-sharpe", help="Minimum Sharpe for acceptance"),
+    max_drawdown: float = typer.Option(-0.30, "--max-dd", help="Maximum drawdown allowed"),
+    min_win_rate: float = typer.Option(0.40, "--min-winrate", help="Minimum win rate for acceptance"),
+):
+    """
+    Generate trading strategies from top factors using LLM + Optuna optimization.
+
+    Loads top evaluated factors, uses LLM to generate strategy code,
+    evaluates with real EUR/USD OHLCV backtest (2.26M 1min bars),
+    and optimizes hyperparameters with Optuna (3-stage: 10→15→5 trials).
+
+    Uses the verified backtest engine (Sharpe on strategy returns,
+    MaxDD on equity curve, WinRate on trade P&L) with runtime verification.
+
+    Examples:
+        $ predix generate-strategies                    # 10 strategies, Optuna, swing
+        $ predix generate-strategies -n 20 -w 4         # 20 strategies, 4 workers
+        $ predix generate-strategies --min-sharpe 3.0   # Stricter acceptance
+        $ predix generate-strategies -s daytrading      # Day trading style
+        $ predix generate-strategies --no-optuna        # Skip optimization
+    """
+    from rich.console import Console as RichConsole
+    from rich.table import Table as RichTable
+
+    console.print(f"\n[bold cyan]{'='*60}[/bold cyan]")
+    console.print("[bold cyan]  Predix Strategy Generator[/bold cyan]")
+    console.print(f"[bold cyan]{'='*60}[/bold cyan]")
+    console.print(f"  Strategies: [cyan]{count}[/cyan]  Workers: [cyan]{workers}[/cyan]  Style: [cyan]{style}[/cyan]")
+    console.print(f"  Optuna: {'[green]Yes[/green]' if optuna else '[yellow]No[/yellow]'} (trials={optuna_trials})  Factors: [cyan]{top_factors}[/cyan]")
+    console.print(f"  Accept: Sharpe≥[green]{min_sharpe}[/green]  DD≥[green]{max_drawdown}[/green]  WR≥[green]{min_win_rate}[/green]")
+    console.print(f"[bold cyan]{'='*60}[/bold cyan]\n")
+
+    try:
+        from rdagent.scenarios.qlib.local.strategy_orchestrator import StrategyOrchestrator
+
+        orchestrator = StrategyOrchestrator(
+            top_factors=top_factors,
+            trading_style=style,
+            min_sharpe=min_sharpe,
+            max_drawdown=max_drawdown,
+            min_win_rate=min_win_rate,
+            use_optuna=optuna,
+            optuna_trials=optuna_trials,
+            continuous_optimization=optuna,
+        )
+
+        results = orchestrator.generate_strategies(count=count, workers=workers)
+
+        accepted = [r for r in results if r.get("status") == "success"]
+        rejected = len(results) - len(accepted)
+
+        console.print(f"\n[bold green]✓ {len(accepted)} accepted[/bold green]  [yellow]{rejected} rejected[/yellow]")
+
+        if accepted:
+            accepted.sort(key=lambda r: r.get("sharpe_ratio", 0), reverse=True)
+            table = RichTable(title="Top Generated Strategies", show_header=True, header_style="bold cyan")
+            table.add_column("#", width=4)
+            table.add_column("Strategy", width=30)
+            table.add_column("Sharpe", width=8, justify="right")
+            table.add_column("MaxDD", width=8, justify="right")
+            table.add_column("WinRate", width=8, justify="right")
+            table.add_column("Trades", width=7, justify="right")
+            for i, r in enumerate(accepted[:10], 1):
+                table.add_row(
+                    str(i), r.get("strategy_name", "?")[:28],
+                    f"{r.get('sharpe_ratio', 0):.2f}", f"{r.get('max_drawdown', 0):.1%}",
+                    f"{r.get('win_rate', 0):.1%}", str(r.get('num_trades', '?')),
+                )
+            console.print(table)
+
+    except ImportError as e:
+        console.print(f"[yellow]Strategy generator not available: {e}[/yellow]")
+    except Exception as e:
+        console.print(f"[bold red]❌ {e}[/bold red]")
+
+
@app.command()
 def health():
    """Check system health and configuration status.
@@ -1511,7 +1623,7 @@ def status():
    # Process check
    result = subprocess.run(
        ["pgrep", "-f", "fin_quant"],
-        capture_output=True, text=True
+        capture_output=True, text=True,
    )
    if result.returncode == 0:
        console.print("[bold green]✅ Trading Loop: RUNNING[/bold green]")
@@ -1529,7 +1641,7 @@ def status():
        factors = c.fetchone()[0]
        conn.close()

-        console.print(f"\n📊 Results:")
+        console.print("\n📊 Results:")
        console.print(f"  Backtest runs: {runs}")
        console.print(f"  Factors: {factors}")

@@ -1552,6 +1664,7 @@ def _load_strategies():
            try:
                raw = json.loads(p.read_text())
            except Exception:
+                logger.warning("Failed to load strategy file %s", p, exc_info=True)
                continue
            if not isinstance(raw, dict):
                continue
@@ -1605,6 +1718,7 @@ def best(
        $ predix best -n 50 --export /tmp/top.json
    """
    import json
+
    from rich.table import Table

    items = _load_strategies()
@@ -1721,7 +1835,7 @@ def kronos_factor(
        console.print("Run data conversion first — see README Data Setup section.")
        raise typer.Exit(1)

-    console.print(f"[bold]Kronos Factor Generator[/bold]")
+    console.print("[bold]Kronos Factor Generator[/bold]")
    console.print(f"  Context: [cyan]{context}[/cyan] bars  |  Pred: [cyan]{pred}[/cyan] bars  |  Device: [cyan]{_device}[/cyan]")

    from rdagent.components.coder.kronos_adapter import build_kronos_factor
@@ -1804,7 +1918,7 @@ def kronos_eval(
        console.print(f"[red]ERROR: Data not found at {data_path}[/red]")
        raise typer.Exit(1)

-    console.print(f"[bold]Kronos Model Evaluator[/bold] (alongside LightGBM)")
+    console.print("[bold]Kronos Model Evaluator[/bold] (alongside LightGBM)")
    console.print(f"  Context: [cyan]{context}[/cyan] bars  |  Pred: [cyan]{pred}[/cyan] bars  |  Device: [cyan]{_device}[/cyan]")
    console.print("  Running evaluation...")

@@ -1819,12 +1933,12 @@ def kronos_eval(
        batch_size=batch_size,
    )

-    console.print(f"\n[bold]Kronos-mini Results[/bold]")
+    console.print("\n[bold]Kronos-mini Results[/bold]")
    console.print(f"  Predictions: [cyan]{metrics['n_predictions']}[/cyan]")
    console.print(f"  IC (mean):   [{'green' if metrics['IC_mean'] > 0.02 else 'yellow'}]{metrics['IC_mean']:.4f}[/]")
    console.print(f"  IC IR:       [{'green' if metrics['IC_IR'] > 0.5 else 'yellow'}]{metrics['IC_IR']:.4f}[/]  (>0.5 = strong signal)")
    console.print(f"  Hit Rate:    [{'green' if metrics['hit_rate'] > 0.52 else 'yellow'}]{metrics['hit_rate']:.2%}[/]  (>50% = directionally useful)")
-    console.print(f"\n[dim]Reference: LightGBM baseline IC typically 0.01–0.05 on 1-min EUR/USD[/dim]")
+    console.print("\n[dim]Reference: LightGBM baseline IC typically 0.01–0.05 on 1-min EUR/USD[/dim]")

    import json as _json
    out_dir = Path("results/kronos")
@@ -68,7 +68,7 @@ ignore_missing_imports = true
 module = "llama"

 [tool.pytest.ini_options]
-addopts = "-l -s --durations=0"
+addopts = "-l -s --durations=0 -m 'not slow'"
 log_cli = true
 log_cli_level = "info"
 log_date_format = "%Y-%m-%d %H:%M:%S"
@@ -21,11 +21,17 @@ load_dotenv(".env")

 import subprocess
 from importlib.resources import path as rpath
-from typing import Dict, Optional
+from typing import Annotated

 import typer
 from rich.console import Console
-from typing_extensions import Annotated
+
+try:
+    from rdagent.utils.env import logger
+except ImportError:
+    import logging
+
+    logger = logging.getLogger(__name__)

 from rdagent.app.data_science.loop import main as data_science
 from rdagent.app.finetune.llm.loop import main as llm_finetune
@@ -139,10 +145,10 @@ def ds_user_interact(port=19900):

@app.command(name="fin_factor")
 def fin_factor_cli(
-    path: Optional[str] = None,
-    step_n: Optional[int] = None,
-    loop_n: Optional[int] = None,
-    all_duration: Optional[str] = None,
+    path: str | None = None,
+    step_n: int | None = None,
+    loop_n: int | None = None,
+    all_duration: str | None = None,
    checkout: CheckoutOption = True,
 ):
    fin_factor(path=path, step_n=step_n, loop_n=loop_n, all_duration=all_duration, checkout=checkout)
@@ -150,10 +156,10 @@ def fin_factor_cli(

@app.command(name="fin_model")
 def fin_model_cli(
-    path: Optional[str] = None,
-    step_n: Optional[int] = None,
-    loop_n: Optional[int] = None,
-    all_duration: Optional[str] = None,
+    path: str | None = None,
+    step_n: int | None = None,
+    loop_n: int | None = None,
+    all_duration: str | None = None,
    checkout: CheckoutOption = True,
 ):
    fin_model(path=path, step_n=step_n, loop_n=loop_n, all_duration=all_duration, checkout=checkout)
@@ -161,10 +167,10 @@ def fin_model_cli(

@app.command(name="fin_quant")
 def fin_quant_cli(
-    path: Optional[str] = None,
-    step_n: Optional[int] = None,
-    loop_n: Optional[int] = None,
-    all_duration: Optional[str] = None,
+    path: str | None = None,
+    step_n: int | None = None,
+    loop_n: int | None = None,
+    all_duration: str | None = None,
    checkout: CheckoutOption = True,
    with_dashboard: bool = typer.Option(False, "--with-dashboard/-d", help="Start web dashboard automatically"),
    with_cli_dashboard: bool = typer.Option(False, "--cli-dashboard/-c", help="Show beautiful CLI dashboard"),
@@ -224,7 +230,7 @@ def fin_quant_cli(
        if not api_key:
            console.print("\n[bold red]❌ OPENROUTER_API_KEY not set in .env[/bold red]")
            console.print("[yellow]Add your API key to .env and retry:[/yellow]")
-            console.print('  OPENROUTER_API_KEY=sk-or-your-key-here')
+            console.print("  OPENROUTER_API_KEY=sk-or-your-key-here")
            raise typer.Exit(code=1)

        os.environ["OPENAI_API_KEY"] = api_key
@@ -243,8 +249,8 @@ def fin_quant_cli(
        console.print(f"   [dim]Base URL: {os.environ['OPENAI_API_BASE']}[/dim]")

        # Wait until the llama.cpp server is fully loaded before starting the pipeline
-        import urllib.request
        import urllib.error
+        import urllib.request

        base_url = os.environ["OPENAI_API_BASE"].removesuffix("/v1").rstrip("/")
        health_url = f"{base_url}/health"
@@ -278,7 +284,7 @@ def fin_quant_cli(
            subprocess.run(
                ["python", "web/dashboard_api.py"],
                cwd=str(Path(__file__).parent.parent.parent),
-                env={**os.environ, "FLASK_ENV": "development"}
+                env={**os.environ, "FLASK_ENV": "development"},
            )

        dashboard_thread = threading.Thread(target=start_web_dashboard, daemon=True)
@@ -320,9 +326,9 @@ def fin_quant_cli(

@app.command(name="fin_factor_report")
 def fin_factor_report_cli(
-    report_folder: Optional[str] = None,
-    path: Optional[str] = None,
-    all_duration: Optional[str] = None,
+    report_folder: str | None = None,
+    path: str | None = None,
+    all_duration: str | None = None,
    checkout: CheckoutOption = True,
 ):
    fin_factor_report(report_folder=report_folder, path=path, all_duration=all_duration, checkout=checkout)
@@ -335,12 +341,12 @@ def general_model_cli(report_file_path: str):

@app.command(name="data_science")
 def data_science_cli(
-    path: Optional[str] = None,
+    path: str | None = None,
    checkout: CheckoutOption = True,
-    step_n: Optional[int] = None,
-    loop_n: Optional[int] = None,
-    timeout: Optional[str] = None,
-    competition: Optional[str] = None,
+    step_n: int | None = None,
+    loop_n: int | None = None,
+    timeout: str | None = None,
+    competition: str | None = None,
 ):
    data_science(
        path=path,
@@ -354,16 +360,16 @@ def data_science_cli(

@app.command(name="llm_finetune")
 def llm_finetune_cli(
-    path: Optional[str] = None,
+    path: str | None = None,
    checkout: CheckoutOption = True,
-    benchmark: Optional[str] = None,
-    benchmark_description: Optional[str] = None,
-    dataset: Optional[str] = None,
-    base_model: Optional[str] = None,
-    upper_data_size_limit: Optional[int] = None,
-    step_n: Optional[int] = None,
-    loop_n: Optional[int] = None,
-    timeout: Optional[str] = None,
+    benchmark: str | None = None,
+    benchmark_description: str | None = None,
+    dataset: str | None = None,
+    base_model: str | None = None,
+    upper_data_size_limit: int | None = None,
+    step_n: int | None = None,
+    loop_n: int | None = None,
+    timeout: str | None = None,
 ):
    llm_finetune(
        path=path,
@@ -429,6 +435,7 @@ def rl_trading_cli(
        rdagent rl_trading --mode backtest --no-with-protections
    """
    from pathlib import Path
+
    import yaml

    console = Console()
@@ -440,18 +447,18 @@ def rl_trading_cli(
        with open(config_path) as f:
            config = yaml.safe_load(f) or {}

-    console.print(f"\n[bold blue]🤖 RL Trading Agent[/bold blue]")
+    console.print("\n[bold blue]🤖 RL Trading Agent[/bold blue]")
    console.print(f"Mode: [cyan]{mode}[/cyan]")
    console.print(f"Algorithm: [cyan]{algorithm.upper()}[/cyan]")
    console.print(f"Protections: {'[green]Enabled[/green]' if with_protections else '[red]Disabled[/red]'}")

    try:
-        from rdagent.components.coder.rl import RLTradingAgent, RLCosteer, TradingEnv
+        from rdagent.components.coder.rl import RLCosteer, RLTradingAgent, TradingEnv
    except ImportError as e:
-        console.print(f"[bold red]Error: RL components not available.[/bold red]")
+        console.print("[bold red]Error: RL components not available.[/bold red]")
        console.print(f"Details: {e}")
-        console.print(f"\n[yellow]Install RL dependencies:[/yellow]")
-        console.print(f"  pip install stable-baselines3 gymnasium")
+        console.print("\n[yellow]Install RL dependencies:[/yellow]")
+        console.print("  pip install stable-baselines3 gymnasium")
        raise typer.Exit(code=1)

    if mode == "train":
@@ -467,8 +474,8 @@ def rl_trading_cli(
            console.print("[dim]Loading market data...[/dim]")
            # TODO: Load actual data from config
            # For now, create mock environment
-            import numpy as np
            import gymnasium as gym
+            import numpy as np

            # Create simple mock environment for demonstration
            class MockTradingEnv(gym.Env):
@@ -504,7 +511,7 @@ def rl_trading_cli(
            model_path_out.parent.mkdir(parents=True, exist_ok=True)
            agent.save(model_path_out)

-            console.print(f"\n[bold green]✅ Training complete![/bold green]")
+            console.print("\n[bold green]✅ Training complete![/bold green]")
            console.print(f"Model saved to: [cyan]{model_path_out}[/cyan]")
            console.print(f"Algorithm: {result['algorithm']}")
            console.print(f"Timesteps: {result['total_timesteps']:,}")
@@ -530,9 +537,9 @@ def rl_trading_cli(
                agent = RLTradingAgent(algorithm=algorithm.upper())

            # Run backtest
-            from rdagent.components.backtesting import FactorBacktester
-            import pandas as pd
            import numpy as np
+            import pandas as pd
+            from rdagent.components.backtesting import FactorBacktester

            backtester = FactorBacktester()

@@ -541,8 +548,8 @@ def rl_trading_cli(
            n_steps = 500
            mock_prices = pd.Series(100 + np.cumsum(np.random.randn(n_steps) * 0.5))
            mock_indicators = pd.DataFrame({
-                'rsi': np.random.uniform(30, 70, n_steps),
-                'macd': np.random.randn(n_steps) * 0.1,
+                "rsi": np.random.uniform(30, 70, n_steps),
+                "macd": np.random.randn(n_steps) * 0.1,
            })

            console.print("[yellow]Running backtest...[/yellow]")
@@ -553,7 +560,7 @@ def rl_trading_cli(
                enable_protections=with_protections,
            )

-            console.print(f"\n[bold green]✅ Backtest complete![/bold green]")
+            console.print("\n[bold green]✅ Backtest complete![/bold green]")
            console.print(f"  Final Equity: [green]${metrics.get('final_equity', 0):,.2f}[/green]")
            console.print(f"  Sharpe Ratio: {metrics.get('sharpe_ratio', 0):.3f}")
            console.print(f"  Max Drawdown: {metrics.get('max_drawdown', 0):.2%}")
@@ -610,6 +617,9 @@ def generate_strategies_cli(
    top_factors: int = typer.Option(20, "--top-factors", help="Number of top factors to consider"),
    continuous: bool = typer.Option(True, "--continuous/--single-pass", help="Optimize ALL strategies including rejected ones"),
    max_iterations: int = typer.Option(1, "--max-iterations", "-i", help="Number of generation-optimization cycles (1 = single pass, >1 = continuous)"),
+    min_sharpe: float = typer.Option(1.5, "--min-sharpe", help="Minimum Sharpe ratio for acceptance"),
+    max_drawdown: float = typer.Option(-0.30, "--max-dd", help="Maximum drawdown allowed"),
+    min_win_rate: float = typer.Option(0.40, "--min-winrate", help="Minimum win rate for acceptance"),
 ):
    """
    Generate trading strategies from evaluated factors.
@@ -627,7 +637,7 @@ def generate_strategies_cli(
        rdagent generate_strategies -n 3 -i 10 --optuna-trials 50  # Deep optimization
    """
    from rich.console import Console
-    from rich.progress import Progress, SpinnerColumn, TextColumn, BarColumn, TimeRemainingColumn
+    from rich.progress import BarColumn, Progress, SpinnerColumn, TextColumn, TimeRemainingColumn
    from rich.table import Table

    console = Console()
@@ -646,7 +656,7 @@ def generate_strategies_cli(
        raise typer.Exit(code=1)

    console.print(f"\n[bold blue]{'='*60}[/bold blue]")
-    console.print(f"[bold blue]  PREDIX Strategy Generator[/bold blue]")
+    console.print("[bold blue]  PREDIX Strategy Generator[/bold blue]")
    console.print(f"[bold blue]{'='*60}[/bold blue]")
    console.print(f"  Strategies:  [cyan]{count}[/cyan]")
    console.print(f"  Workers:     [cyan]{workers}[/cyan]")
@@ -673,12 +683,12 @@ def generate_strategies_cli(
    _slog = _dlog.setup("strategies", **_strat_ctx)

    try:
-        from rdagent.components.coder.strategy_orchestrator import StrategyOrchestrator
        import pandas as pd
+        from rdagent.scenarios.qlib.local.strategy_orchestrator import StrategyOrchestrator

        all_results = []
        best_strategy = None
-        best_sharpe = float('-inf')
+        best_sharpe = float("-inf")

        # CONTINUOUS OPTIMIZATION LOOP
        for iteration in range(1, max_iterations + 1):
@@ -691,6 +701,9 @@ def generate_strategies_cli(
            orchestrator = StrategyOrchestrator(
                top_factors=top_factors,
                trading_style=style,
+                min_sharpe=min_sharpe,
+                max_drawdown=max_drawdown,
+                min_win_rate=min_win_rate,
                use_optuna=optuna,
                optuna_trials=optuna_trials,
                continuous_optimization=continuous,
@@ -727,7 +740,7 @@ def generate_strategies_cli(

            # Track best strategy
            for r in results:
-                sharpe = r.get("sharpe_ratio", float('-inf'))
+                sharpe = r.get("sharpe_ratio", float("-inf"))
                if sharpe > best_sharpe:
                    best_sharpe = sharpe
                    best_strategy = r
@@ -747,7 +760,7 @@ def generate_strategies_cli(
        rejected = [r for r in results if r.get("status") == "rejected"]

        console.print(f"\n[bold green]{'='*60}[/bold green]")
-        console.print(f"[bold green]  Strategy Generation Summary[/bold green]")
+        console.print("[bold green]  Strategy Generation Summary[/bold green]")
        console.print(f"[bold green]{'='*60}[/bold green]")

        table = Table(show_header=True, header_style="bold magenta", show_lines=True)
@@ -776,7 +789,7 @@ def generate_strategies_cli(
        # Show best strategy details
        if best_strategy:
            console.print(f"\n[bold gold1]{'='*60}[/bold gold1]")
-            console.print(f"[bold gold1]  BEST STRATEGY[/bold gold1]")
+            console.print("[bold gold1]  BEST STRATEGY[/bold gold1]")
            console.print(f"[bold gold1]{'='*60}[/bold gold1]")
            console.print(f"  Name:        [cyan]{best_strategy.get('strategy_name', 'Unknown')}[/cyan]")
            console.print(f"  Sharpe:      [green]{best_strategy.get('sharpe_ratio', 0):.4f}[/green]")
@@ -784,13 +797,13 @@ def generate_strategies_cli(
            console.print(f"  Max DD:      [yellow]{best_strategy.get('max_drawdown', 0):.2%}[/yellow]")
            console.print(f"  Win Rate:    [cyan]{best_strategy.get('win_rate', 0):.2%}[/cyan]")
            if best_strategy.get("best_params"):
-                console.print(f"\n  [bold]Optimized Parameters:[/bold]")
+                console.print("\n  [bold]Optimized Parameters:[/bold]")
                for param, val in best_strategy["best_params"].items():
                    console.print(f"    {param}: [cyan]{val}[/cyan]")
            console.print(f"[bold gold1]{'='*60}[/bold gold1]")

        if accepted:
-            console.print(f"\n[bold]Accepted Strategies:[/bold]")
+            console.print("\n[bold]Accepted Strategies:[/bold]")
            acc_table = Table(show_header=True, header_style="bold cyan")
            acc_table.add_column("#", width=4)
            acc_table.add_column("Strategy", width=30)
@@ -813,13 +826,13 @@ def generate_strategies_cli(
                )
            console.print(acc_table)

-        console.print(f"\n[bold green]Strategies saved to:[/bold green] [cyan]results/strategies_new/[/cyan]")
+        console.print("\n[bold green]Strategies saved to:[/bold green] [cyan]results/strategies_new/[/cyan]")
        console.print(f"[bold blue]{'='*60}[/bold blue]\n")
        _slog.success(f"Generated {len(all_results)} strategies ({len([r for r in all_results if r.get('status')=='accepted'])} accepted)")

    except ImportError as e:
        _slog.error(f"Strategy components not available: {e}")
-        console.print(f"[bold red]Error: Strategy components not available.[/bold red]")
+        console.print("[bold red]Error: Strategy components not available.[/bold red]")
        console.print(f"Details: {e}")
        raise typer.Exit(code=1)
    except Exception as e:
@@ -855,17 +868,18 @@ def optimize_portfolio_cli(
        raise typer.Exit(code=1)

    console.print(f"\n[bold blue]{'='*60}[/bold blue]")
-    console.print(f"[bold blue]  PREDIX Portfolio Optimizer[/bold blue]")
+    console.print("[bold blue]  PREDIX Portfolio Optimizer[/bold blue]")
    console.print(f"[bold blue]{'='*60}[/bold blue]")
    console.print(f"  Top N:    [cyan]{top_n}[/cyan]")
    console.print(f"  Method:   [cyan]{method}[/cyan]")
    console.print(f"[bold blue]{'='*60}[/bold blue]\n")

    try:
-        from rdagent.components.backtesting.risk_management import PortfolioOptimizer
        import json
        from pathlib import Path

+        from rdagent.components.backtesting.risk_management import PortfolioOptimizer
+
        project_root = Path(__file__).parent.parent.parent
        strategies_dir = project_root / "results" / "strategies_new"

@@ -882,6 +896,7 @@ def optimize_portfolio_cli(
                if data.get("status") == "accepted":
                    strategies.append(data)
            except Exception:
+                logger.warning("Failed to load strategy file %s", f, exc_info=True)
                continue

        if not strategies:
@@ -1001,14 +1016,15 @@ def strategies_report_cli(
        rdagent strategies_report -s path/to/strategy.json  # Single strategy
        rdagent strategies_report -o custom/reports/      # Custom output dir
    """
+    from pathlib import Path
+
    from rich.console import Console
    from rich.progress import Progress, SpinnerColumn, TextColumn
-    from pathlib import Path

    console = Console()

    console.print(f"\n[bold blue]{'='*60}[/bold blue]")
-    console.print(f"[bold blue]  PREDIX Strategy Report Generator[/bold blue]")
+    console.print("[bold blue]  PREDIX Strategy Report Generator[/bold blue]")
    console.print(f"[bold blue]{'='*60}[/bold blue]\n")

    project_root = Path(__file__).parent.parent.parent
@@ -1060,20 +1076,20 @@ def strategies_report_cli(
                progress.update(task, completed=1)

    console.print(f"\n[bold green]{'='*60}[/bold green]")
-    console.print(f"[bold green]  Report Generation Complete[/bold green]")
+    console.print("[bold green]  Report Generation Complete[/bold green]")
    console.print(f"[bold green]{'='*60}[/bold green]")
    console.print(f"  Reports generated: [cyan]{reports_generated}/{len(strategy_files)}[/cyan]")
    console.print(f"  Output directory:  [cyan]{output_dir_path}[/cyan]")
    console.print(f"[bold green]{'='*60}[/bold green]\n")


-def _generate_single_strategy_report(strategy_file: Path, output_dir: Path) -> Dict:
+def _generate_single_strategy_report(strategy_file: Path, output_dir: Path) -> dict:
    """Generate a report for a single strategy."""
    import json
+
    import matplotlib
    matplotlib.use("Agg")  # Non-interactive backend
    import matplotlib.pyplot as plt
-    import seaborn as sns

    with open(strategy_file, encoding="utf-8") as f:
        strategy = json.load(f)
@@ -1148,7 +1164,7 @@ if __name__ == "__main__":
@app.command(name="start_llama")
 def start_llama_cli(
    model: str = typer.Option(
-        None, "--model", "-m", help="Path to model file"
+        None, "--model", "-m", help="Path to model file",
    ),
    port: int = typer.Option(8081, "--port", "-p", help="Server port"),
    gpu_layers: int = typer.Option(30, "--gpu-layers", "-g", help="GPU layers"),
@@ -1170,8 +1186,6 @@ def start_llama_cli(
      rdagent start_llama --gpu-layers 40 --ctx-size 4096
      rdagent start_llama --reasoning
    """
-    import subprocess
-    import sys
    import os

    model_path = model or os.getenv(
@@ -1208,7 +1222,7 @@ def start_llama_cli(
    if not reasoning:
        cmd.extend(["--reasoning", "off"])

-    print(f"🚀 Starting llama.cpp server...")
+    print("🚀 Starting llama.cpp server...")
    print(f"   Model: {Path(model_path).name}")
    print(f"   Port: {port}")
    print(f"   GPU Layers: {gpu_layers}")
@@ -1241,17 +1255,16 @@ def start_loop_cli(
      rdagent start_loop
      rdagent start_loop --target 5 --max-wait 3600
    """
-    import subprocess
-    import signal
-    import sys
    import os
-    from datetime import datetime
+    import signal
+    import subprocess
    import time
+    from datetime import datetime

-    script_dir = str(Path(__file__).parent.parent.parent.parent)
-    generator = f"python {script_dir}/scripts/predix_smart_strategy_gen.py"
+    script_dir = str(Path(__file__).parent.parent.parent)
+    generator = [sys.executable, f"{script_dir}/scripts/predix_smart_strategy_gen.py"]
    logfile = f"{script_dir}/results/logs/generator_loop.log"
-    pidfile = "/tmp/predix_loop.pid"
+    pidfile = "/tmp/predix_loop.pid"  # nosec B108 — administrative PID file, single-process daemon

    os.makedirs(f"{script_dir}/results/logs", exist_ok=True)

@@ -1262,12 +1275,19 @@ def start_loop_cli(
        with open(logfile, "a") as f:
            f.write(line + "\n")

+    child_proc = None  # track current child PID for targeted cleanup
+
    def cleanup(signum=None, frame=None):
        log("Received termination signal. Cleaning up...")
-        try:
-            subprocess.run(["pkill", "-f", "predix_smart_strategy_gen.py"], capture_output=True)
-        except Exception:
-            pass
+        if child_proc is not None:
+            try:
+                child_proc.terminate()
+                child_proc.wait(timeout=10)
+            except Exception:
+                try:
+                    child_proc.kill()
+                except Exception:
+                    pass
        try:
            os.remove(pidfile)
        except FileNotFoundError:
@@ -1313,26 +1333,32 @@ def start_loop_cli(
        strat_count = len(list(strat_dir.glob("*.json"))) if strat_dir.exists() else 0
        log(f"📁 Existing strategies: {strat_count}")

-        # Kill stale processes
-        try:
-            subprocess.run(["pkill", "-9", "-f", "predix_smart_strategy_gen.py"], capture_output=True)
-        except Exception:
-            pass
-        time.sleep(2)
+        # Kill stale child from previous iteration
+        if child_proc is not None:
+            try:
+                child_proc.terminate()
+                child_proc.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                child_proc.kill()
+                child_proc.wait()
+            except Exception:
+                pass
+            child_proc = None
+            time.sleep(2)

        # Start generator
        log("🤖 Starting generator...")
-        proc = subprocess.Popen(
-            generator.split(),
+        child_proc = subprocess.Popen(
+            generator,
            cwd=script_dir,
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
        )
-        log(f"   PID: {proc.pid}")
+        log(f"   PID: {child_proc.pid}")

        # Monitor progress
        elapsed = 0
-        while proc.poll() is None:
+        while child_proc.poll() is None:
            time.sleep(30)
            elapsed += 30

@@ -1341,11 +1367,12 @@ def start_loop_cli(

            if elapsed >= max_wait:
                log(f"   ⏰ Timeout after {elapsed}s. Killing...")
-                proc.kill()
+                child_proc.kill()
                break

        # Check results
-        exit_code = proc.wait()
+        exit_code = child_proc.wait()
+        child_proc = None
        if exit_code == 0:
            log("✅ Generator completed successfully")
        elif exit_code == -9:
@@ -1386,24 +1413,24 @@ def parallel_cli(
      rdagent parallel -n 10 -k 2
    """
    import subprocess
-    import sys
    from pathlib import Path
+
    from rdagent.log import daily_log as _dlog

-    project_root = Path(__file__).parent.parent.parent.parent
+    project_root = Path(__file__).parent.parent.parent
    script = project_root / "scripts" / "predix_parallel.py"

    if not script.exists():
        typer.echo(f"❌ Script not found: {script}")
        raise typer.Exit(code=1)

-    cmd = [sys.executable, str(script), "--runs", str(runs), "--api-keys", str(api_keys), "-m", "local"]
+    cmd = [sys.executable, str(script), "--runs", str(runs), "--api-keys", str(api_keys)]

    _plog = _dlog.setup("parallel", runs=runs, api_keys=api_keys, model="local")
    typer.echo(f"🚀 Starting {runs} parallel runs...")
    typer.echo(f"   Script: {script}")
    typer.echo(f"   API Keys: {api_keys}")
-    typer.echo(f"   Model: local (llama.cpp)")
+    typer.echo("   Model: local (llama.cpp)")

    try:
        result = subprocess.run(cmd, cwd=str(project_root))
@@ -1437,11 +1464,11 @@ def eval_all_cli(
      rdagent eval_all -n 500 -p 8
    """
    import subprocess
-    import sys
    from pathlib import Path
+
    from rdagent.log import daily_log as _dlog

-    project_root = Path(__file__).parent.parent.parent.parent
+    project_root = Path(__file__).parent.parent.parent
    script = project_root / "scripts" / "predix_full_eval.py"

    if not script.exists():
@@ -1492,10 +1519,9 @@ def batch_backtest_cli(
      rdagent batch_backtest --all
    """
    import subprocess
-    import sys
    from pathlib import Path

-    project_root = Path(__file__).parent.parent.parent.parent
+    project_root = Path(__file__).parent.parent.parent
    script = project_root / "scripts" / "predix_batch_backtest.py"

    if not script.exists():
@@ -1545,10 +1571,9 @@ def simple_eval_cli(
      rdagent simple_eval --all
    """
    import subprocess
-    import sys
    from pathlib import Path

-    project_root = Path(__file__).parent.parent.parent.parent
+    project_root = Path(__file__).parent.parent.parent
    script = project_root / "scripts" / "predix_simple_eval.py"

    if not script.exists():
@@ -1578,7 +1603,7 @@ def simple_eval_cli(
@app.command(name="rebacktest")
 def rebacktest_cli(
    strategies_dir: str = typer.Option(
-        None, "--strategies-dir", "-d", help="Directory containing strategy JSON files"
+        None, "--strategies-dir", "-d", help="Directory containing strategy JSON files",
    ),
 ):
    """
@@ -1592,10 +1617,9 @@ def rebacktest_cli(
      rdagent rebacktest -d results/strategies_new/
    """
    import subprocess
-    import sys
    from pathlib import Path

-    project_root = Path(__file__).parent.parent.parent.parent
+    project_root = Path(__file__).parent.parent.parent
    script = project_root / "scripts" / "predix_rebacktest_strategies.py"

    if not script.exists():
@@ -1620,10 +1644,10 @@ def rebacktest_cli(
@app.command(name="report")
 def report_cli(
    strategy_path: str = typer.Option(
-        None, "--strategy", "-s", help="Path to single strategy JSON (default: all strategies)"
+        None, "--strategy", "-s", help="Path to single strategy JSON (default: all strategies)",
    ),
    output: str = typer.Option(
-        None, "--output", "-o", help="Output directory (default: results/strategy_reports/)"
+        None, "--output", "-o", help="Output directory (default: results/strategy_reports/)",
    ),
 ):
    """
@@ -1646,10 +1670,9 @@ def report_cli(
      rdagent report -o custom/reports/
    """
    import subprocess
-    import sys
    from pathlib import Path

-    project_root = Path(__file__).parent.parent.parent.parent
+    project_root = Path(__file__).parent.parent.parent
    script = project_root / "scripts" / "predix_strategy_report.py"

    if not script.exists():
@@ -201,6 +201,5 @@ class DataScienceBasePropSetting(KaggleBasePropSetting):
 DS_RD_SETTING = DataScienceBasePropSetting()

 # enable_cross_trace_diversity and llm_select_hypothesis should not be true at the same time
-assert not (
-    DS_RD_SETTING.enable_cross_trace_diversity and DS_RD_SETTING.llm_select_hypothesis
-), "enable_cross_trace_diversity and llm_select_hypothesis cannot be true at the same time"
+if DS_RD_SETTING.enable_cross_trace_diversity and DS_RD_SETTING.llm_select_hypothesis:
+    raise ValueError("enable_cross_trace_diversity and llm_select_hypothesis cannot be true at the same time")
@@ -58,18 +58,18 @@ def main(

    if user_target_scenario:
        FT_RD_SETTING.user_target_scenario = user_target_scenario
-    assert (
-        FT_RD_SETTING.user_target_scenario is None
-    ), "user_target_scenario is not yet supported, please specify via benchmark and benchmark_description"
+    if FT_RD_SETTING.user_target_scenario is not None:
+        raise ValueError("user_target_scenario is not yet supported, please specify via benchmark and benchmark_description")
    if upper_data_size_limit:
        FT_RD_SETTING.upper_data_size_limit = upper_data_size_limit
        logger.info(f"Set upper_data_size_limit to {FT_RD_SETTING.upper_data_size_limit}")
    if benchmark and benchmark_description:
        FT_RD_SETTING.target_benchmark = benchmark
        FT_RD_SETTING.benchmark_description = benchmark_description
-    assert FT_RD_SETTING.user_target_scenario or (
-        FT_RD_SETTING.target_benchmark and FT_RD_SETTING.benchmark_description
-    ), "Either user_target_scenario or target_benchmark must be specified for LLM fine-tuning."
+    if not (
+        FT_RD_SETTING.user_target_scenario or (FT_RD_SETTING.target_benchmark and FT_RD_SETTING.benchmark_description)
+    ):
+        raise ValueError("Either user_target_scenario or target_benchmark must be specified for LLM fine-tuning.")

    # Update configuration with provided parameters
    if dataset:
@@ -82,9 +82,8 @@ def main(
    model_target = FT_RD_SETTING.base_model if FT_RD_SETTING.base_model else "auto selected model"

    # Temporary assertion until auto-selection is implemented
-    assert (
-        FT_RD_SETTING.base_model is not None
-    ), "Base model auto selection not yet supported, please specify via --base-model"
+    if FT_RD_SETTING.base_model is None:
+        raise ValueError("Base model auto selection not yet supported, please specify via --base-model")

    logger.info(f"Starting LLM fine-tuning on dataset='{data_set_target}' with model='{model_target}'")

@@ -24,46 +24,12 @@ from rdagent.app.finetune.llm.ui.ft_summary import render_job_summary

 DEFAULT_LOG_BASE = "log/"

+from rdagent.core.utils import safe_resolve_path
+

 def validate_path_within_cwd(user_path: Path) -> Path:
-    """
-    Validate that a user-provided path is within the current working directory.
-
-    Security: This function prevents path traversal attacks by:
-    1. Resolving the path to its absolute canonical form
-    2. Verifying it's within the CWD boundary using a normalized common prefix
-    3. Rejecting paths outside the boundary with ValueError
-
-    Parameters
-    ----------
-    user_path : Path
-        User-provided path to validate
-
-    Returns
-    -------
-    Path
-        Resolved absolute path if valid
-
-    Raises
-    ------
-    ValueError
-        If path is outside the current working directory
-    """
    safe_root = Path.cwd().resolve()
-    # Expand any user home reference and resolve without requiring the path to exist.
-    resolved_path = user_path.expanduser().resolve(strict=False)
-
-    # Ensure the resolved path is absolute and remains within the safe root.
-    safe_root_str = str(safe_root)
-    resolved_str = str(resolved_path)
-    common = os.path.commonpath([safe_root_str, resolved_str])
-    if common != safe_root_str:
-        raise ValueError("Path is outside the allowed project directory")
-
-    # This will raise ValueError if resolved_path is not within safe_root
-    resolved_path.relative_to(safe_root)
-
-    return resolved_path
+    return safe_resolve_path(user_path, safe_root)


 def get_job_options(base_path: Path, safe_root: Path | None = None) -> list[str]:
@@ -141,19 +107,14 @@ def main():
            st.header("Job")
            base_folder = st.text_input("Base Folder", value=default_log, key="base_folder_input")

-            # Normalize and validate the base folder against the configured log root
-            root_real = os.path.realpath(str(Path(default_log).expanduser()))
-            folder_real = os.path.realpath(str(Path(base_folder).expanduser()))
-            if folder_real == root_real or folder_real.startswith(root_real + os.sep):
-                base_path = Path(folder_real)
-                safe_root = Path(root_real)
-            else:
+            safe_root = Path(default_log).expanduser().resolve()
+            try:
+                base_path = safe_resolve_path(Path(base_folder), safe_root)
+            except ValueError:
                st.error("Invalid base folder: must be within the configured log directory.")
-                safe_root = Path(root_real)
                base_path = safe_root

-            # base_path is validated against safe_root – nosec B614
-            job_options = get_job_options(base_path, safe_root)  # nosec B614 – validated above
+            job_options = get_job_options(base_path, safe_root)
            if job_options:
                selected_job = st.selectbox("Select Job", job_options, key="job_select")
                if selected_job.startswith("."):
@@ -13,6 +13,7 @@ from typing import Any
 import streamlit as st

 from rdagent.app.finetune.llm.ui.config import EVALUATOR_CONFIG, EventType
+from rdagent.core.utils import safe_resolve_path
 from rdagent.log.storage import FileStorage


@@ -89,11 +90,10 @@ def extract_stage(tag: str) -> str:
 def get_valid_sessions(log_folder: Path, safe_root: Path | None = None) -> list[str]:
    """Get list of valid session directories, optionally validating against a safe root."""
    if safe_root is not None:
-        root_real = os.path.realpath(str(safe_root.expanduser()))
-        folder_real = os.path.realpath(str(log_folder.expanduser()))
-        if not (folder_real == root_real or folder_real.startswith(root_real + os.sep)):
+        try:
+            log_folder = safe_resolve_path(log_folder, safe_root)
+        except ValueError:
            return []
-        log_folder = Path(folder_real)

    if not log_folder.exists():
        return []
@@ -373,13 +373,11 @@ def parse_event(tag: str, content: Any, timestamp: datetime) -> Event | None:
@st.cache_data(ttl=300, hash_funcs={Path: str})
 def load_ft_session(log_path: Path, safe_root: Path | None = None) -> Session:
    """Load events into hierarchical session structure, optionally validating against safe root."""
-    # Validate path is within safe_root if provided
    if safe_root is not None:
-        root_real = os.path.realpath(str(safe_root.expanduser()))
-        path_real = os.path.realpath(str(log_path.expanduser()))
-        if not (path_real == root_real or path_real.startswith(root_real + os.sep)):
+        try:
+            log_path = safe_resolve_path(log_path, safe_root)
+        except ValueError:
            return Session()
-        log_path = Path(path_real)

    session = Session()
    storage = FileStorage(log_path)
@@ -4,10 +4,9 @@ Factor workflow with session control

 import asyncio
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any

 import fire
-
 from rdagent.app.qlib_rd_loop.conf import FACTOR_PROP_SETTING
 from rdagent.components.workflow.rd_loop import RDLoop
 from rdagent.core.exception import CoderError, FactorEmptyError
@@ -21,20 +20,20 @@ class FactorRDLoop(RDLoop):
    def running(self, prev_out: dict[str, Any]):
        exp = self.runner.develop(prev_out["coding"])
        if exp is None:
-            logger.error(f"Factor extraction failed.")
+            logger.error("Factor extraction failed.")
            raise FactorEmptyError("Factor extraction failed.")
        logger.log_object(exp, tag="runner result")
        return exp


 def main(
-    path: Optional[str] = None,
-    step_n: Optional[int] = None,
-    loop_n: Optional[int] = None,
+    path: str | None = None,
+    step_n: int | None = None,
+    loop_n: int | None = None,
    all_duration: str | None = None,
    checkout: bool = True,
-    checkout_path: Optional[str] = None,
-    base_features_path: Optional[str] = None,
+    checkout_path: str | None = None,
+    base_features_path: str | None = None,
    **kwargs,
 ):
    """
@@ -47,7 +46,7 @@ def main(
        dotenv run -- python rdagent/app/qlib_rd_loop/factor.py $LOG_PATH/__session__/1/0_propose  --step_n 1   # `step_n` is a optional paramter

    """
-    if not checkout_path is None:
+    if checkout_path is not None:
        checkout = Path(checkout_path)

    if path is None:
@@ -1,10 +1,9 @@
 import asyncio
 import json
 from pathlib import Path
-from typing import Any, Dict, Tuple
+from typing import Any

 import fire
-
 from rdagent.app.qlib_rd_loop.conf import FACTOR_FROM_REPORT_PROP_SETTING
 from rdagent.app.qlib_rd_loop.factor import FactorRDLoop
 from rdagent.components.document_reader.document_reader import (
@@ -12,7 +11,7 @@ from rdagent.components.document_reader.document_reader import (
    load_and_process_pdfs_by_langchain,
 )
 from rdagent.core.conf import RD_AGENT_SETTINGS
-from rdagent.core.proposal import Hypothesis, HypothesisFeedback
+from rdagent.core.proposal import Hypothesis
 from rdagent.log import rdagent_logger as logger
 from rdagent.oai.llm_utils import APIBackend
 from rdagent.scenarios.qlib.experiment.factor_experiment import QlibFactorExperiment
@@ -36,14 +35,14 @@ def generate_hypothesis(factor_result: dict, report_content: str) -> str:
    """
    system_prompt = T(".prompts:hypothesis_generation.system").r()
    user_prompt = T(".prompts:hypothesis_generation.user").r(
-        factor_descriptions=json.dumps(factor_result), report_content=report_content
+        factor_descriptions=json.dumps(factor_result), report_content=report_content,
    )

    response = APIBackend().build_messages_and_create_chat_completion(
        user_prompt=user_prompt,
        system_prompt=system_prompt,
        json_mode=True,
-        json_target_type=Dict[str, str],
+        json_target_type=dict[str, str],
    )

    response_json = json.loads(response)
@@ -99,7 +98,7 @@ class FactorReportLoop(FactorRDLoop, metaclass=LoopMeta):
        super().__init__(PROP_SETTING=FACTOR_FROM_REPORT_PROP_SETTING)
        if report_folder is None:
            self.judge_pdf_data_items = json.load(
-                open(FACTOR_FROM_REPORT_PROP_SETTING.report_result_json_file_path, "r")
+                open(FACTOR_FROM_REPORT_PROP_SETTING.report_result_json_file_path),
            )
        else:
            self.judge_pdf_data_items = [i for i in Path(report_folder).rglob("*.pdf")]
@@ -118,7 +117,7 @@ class FactorReportLoop(FactorRDLoop, metaclass=LoopMeta):
                if exp is None:
                    self.shift_report += 1
                    self.loop_n -= 1
-                    if self.loop_n < 0:  # NOTE: on every step, we self.loop_n -= 1 at first.
+                    if self.loop_n < 0:  # loop_n is decremented above when reports are empty; prevents infinite skipping
                        raise self.LoopTerminationError("Reach stop criterion and stop loop")
                    continue
                exp.based_experiments = [QlibFactorExperiment(sub_tasks=[], hypothesis=exp.hypothesis)] + [
@@ -8,7 +8,6 @@ from pathlib import Path
 from typing import Any

 import fire
-
 from rdagent.app.qlib_rd_loop.conf import QUANT_PROP_SETTING
 from rdagent.components.workflow.conf import BasePropSetting
 from rdagent.components.workflow.rd_loop import RDLoop
@@ -44,11 +43,11 @@ class QuantRDLoop(RDLoop):
        logger.log_object(self.hypothesis_gen, tag="quant hypothesis generator")

        self.factor_hypothesis2experiment: Hypothesis2Experiment = import_class(
-            PROP_SETTING.factor_hypothesis2experiment
+            PROP_SETTING.factor_hypothesis2experiment,
        )()
        logger.log_object(self.factor_hypothesis2experiment, tag="factor hypothesis2experiment")
        self.model_hypothesis2experiment: Hypothesis2Experiment = import_class(
-            PROP_SETTING.model_hypothesis2experiment
+            PROP_SETTING.model_hypothesis2experiment,
        )()
        logger.log_object(self.model_hypothesis2experiment, tag="model hypothesis2experiment")

@@ -78,7 +77,8 @@ class QuantRDLoop(RDLoop):
        while True:
            if self.get_unfinished_loop_cnt(self.loop_idx) < RD_AGENT_SETTINGS.get_max_parallel():
                hypo = self._propose()
-                assert hypo.action in ["factor", "model"]
+                if hypo.action not in ["factor", "model"]:
+                    raise ValueError(f"hypo.action must be 'factor' or 'model', got {hypo.action!r}")
                if hypo.action == "factor":
                    exp = self.factor_hypothesis2experiment.convert(hypo, self.trace)
                else:
@@ -132,7 +132,6 @@ class QuantRDLoop(RDLoop):
        """
        import json
        from datetime import datetime
-        from pathlib import Path

        try:
            project_root = Path(__file__).parent.parent.parent.parent
@@ -195,11 +194,11 @@ class QuantRDLoop(RDLoop):
        if prev_out["direct_exp_gen"]["propose"].action == "factor":
            exp = self.factor_runner.develop(prev_out["coding"])
            if exp is None:
-                logger.error(f"Factor extraction failed.")
+                logger.error("Factor extraction failed.")
                raise FactorEmptyError("Factor extraction failed.")

            # Increment factor count for tracking
-            if hasattr(self, 'trace') and hasattr(self.trace, 'increment_factor_count'):
+            if hasattr(self, "trace") and hasattr(self.trace, "increment_factor_count"):
                self.trace.increment_factor_count()

            # Handle failed experiments gracefully (don't break the loop)
@@ -210,7 +209,7 @@ class QuantRDLoop(RDLoop):
                    factor_name = getattr(exp.hypothesis, "hypothesis", "unknown")
                logger.warning(
                    f"Factor '{factor_name}' failed evaluation: {reason}. "
-                    f"Continuing with next factor."
+                    f"Continuing with next factor.",
                )
                # Return exp anyway - loop will continue
        elif prev_out["direct_exp_gen"]["propose"].action == "model":
@@ -219,7 +218,7 @@ class QuantRDLoop(RDLoop):
        return exp

    def feedback(self, prev_out: dict[str, Any]):
-        e = prev_out.get(self.EXCEPTION_KEY, None)
+        e = prev_out.get(self.EXCEPTION_KEY)
        if e is not None:
            feedback = HypothesisFeedback(
                observations=str(e),
@@ -245,11 +244,10 @@ class QuantRDLoop(RDLoop):
                    reason=reason,
                    decision=False,
                )
-            else:
-                if prev_out["direct_exp_gen"]["propose"].action == "factor":
-                    feedback = self.factor_summarizer.generate_feedback(prev_out["running"], self.trace)
-                elif prev_out["direct_exp_gen"]["propose"].action == "model":
-                    feedback = self.model_summarizer.generate_feedback(prev_out["running"], self.trace)
+            elif prev_out["direct_exp_gen"]["propose"].action == "factor":
+                feedback = self.factor_summarizer.generate_feedback(prev_out["running"], self.trace)
+            elif prev_out["direct_exp_gen"]["propose"].action == "model":
+                feedback = self.model_summarizer.generate_feedback(prev_out["running"], self.trace)

            # NOTE: DB save is handled by factor_runner.py _save_result_to_database()
            # which runs immediately after Docker execution. No duplicate save needed here.
@@ -258,20 +256,20 @@ class QuantRDLoop(RDLoop):
        factor_count = self.trace.get_factor_count()

        # Check for auto-strategies trigger
-        auto_strategies = getattr(self, '_auto_strategies', False)
-        auto_threshold = getattr(self, '_auto_strategies_threshold', 500)
+        auto_strategies = getattr(self, "_auto_strategies", False)
+        auto_threshold = getattr(self, "_auto_strategies_threshold", 500)

        if auto_strategies and factor_count > 0 and factor_count % auto_threshold == 0:
            logger.info(
                f"Auto-strategy trigger: {factor_count} factors evaluated. "
-                f"Suggesting strategy generation now..."
+                f"Suggesting strategy generation now...",
            )
            self._build_strategies_with_ai()
        elif factor_count > 0 and factor_count % 50 == 0 and not auto_strategies:
            # Standard periodic suggestion (every 50 factors)
            logger.info(
                f"Periodic check: {factor_count} factors evaluated. "
-                f"Consider running 'rdagent generate_strategies' for AI strategy generation."
+                f"Consider running 'rdagent generate_strategies' for AI strategy generation.",
            )

        feedback = self._interact_feedback(feedback)
@@ -292,10 +290,11 @@ class QuantRDLoop(RDLoop):
        - Optuna hyperparameter optimization
        """
        try:
-            from rdagent.components.coder.strategy_orchestrator import StrategyOrchestrator
            from pathlib import Path
+
            import yaml
-            
+            from rdagent.scenarios.qlib.local.strategy_orchestrator import StrategyOrchestrator
+
            # Load improved prompt
            project_root = Path(__file__).parent.parent.parent.parent
            prompt_path = project_root / "prompts" / "strategy_generation_v2.yaml"
@@ -322,6 +321,7 @@ class QuantRDLoop(RDLoop):
                    if data.get("status") == "success" and data.get("ic") is not None:
                        factors.append(data)
                except Exception:
+                    logger.warning("Failed to load factor file %s", f, exc_info=True)
                    continue

            if len(factors) < 10:
@@ -334,44 +334,47 @@ class QuantRDLoop(RDLoop):

            logger.info(f"StrategyOrchestrator: Building strategies from {len(top_factors)} top factors...")
            logger.info(f"  - Using improved prompt: {improved_prompt is not None}")
-            logger.info(f"  - Optuna optimization: enabled (20 trials)")
-            logger.info(f"  - Real OHLCV backtest: enabled")
+            logger.info("  - Optuna optimization: enabled (20 trials)")
+            logger.info("  - Real OHLCV backtest: enabled")

            # Initialize orchestrator with Optuna
            orchestrator = StrategyOrchestrator(
                top_factors=20,
-                trading_style='swing',
-                min_sharpe=0.5,
+                trading_style="swing",
+                min_sharpe=1.5,
                max_drawdown=-0.20,
                min_win_rate=0.40,
                use_optuna=True,
                optuna_trials=20,
            )
-            
+
            # Override with improved prompt if available
            if improved_prompt:
-                orchestrator.strategy_prompt = improved_prompt.get('strategy_generation', {})
+                orchestrator.strategy_prompt = improved_prompt.get("strategy_generation", {})

            # Generate 3 strategies per cycle
            n_strategies = 3
            logger.info(f"Generating {n_strategies} strategies...")
-            
+
            # Load top factors for generation
            orch_factors = orchestrator.load_top_factors()
-            
+            if len(orch_factors) < 2:
+                logger.warning(f"Not enough factors for strategy generation (need >= 2, got {len(orch_factors)}). Skipping.")
+                return
+
            for i in range(n_strategies):
+                strategy_name = f"auto_gen_v{i+1}"
                try:
                    # Select random factor combination
                    import random
                    n_factors = random.randint(2, min(5, len(orch_factors)))
                    factor_subset = random.sample(orch_factors, n_factors)
-                    
-                    strategy_name = f"auto_gen_v{i+1}"
+
                    code = orchestrator.generate_strategy_code(factor_subset, strategy_name)
-                    
+
                    if code:
                        result = orchestrator.evaluate_strategy(code, strategy_name, factor_subset)
-                        
+
                        if result.get("status") == "accepted":
                            logger.info(f"✅ Strategy {strategy_name} accepted!")
                            logger.info(f"   Sharpe: {result.get('sharpe_ratio', 0):.2f}")
@@ -429,7 +432,7 @@ def main(
        quant_loop._auto_strategies = True
        quant_loop._auto_strategies_threshold = auto_strategies_threshold
        logger.info(
-            f"Auto-strategies enabled. Will trigger after {auto_strategies_threshold} factors."
+            f"Auto-strategies enabled. Will trigger after {auto_strategies_threshold} factors.",
        )
    else:
        quant_loop._auto_strategies = False
@@ -16,55 +16,26 @@ from rdagent.app.rl.ui.components import render_session, render_summary
 from rdagent.app.rl.ui.config import ALWAYS_VISIBLE_TYPES, OPTIONAL_TYPES
 from rdagent.app.rl.ui.data_loader import get_summary, get_valid_sessions, load_session
 from rdagent.app.rl.ui.rl_summary import render_job_summary
+from rdagent.core.utils import safe_resolve_path

 DEFAULT_LOG_BASE = "log/"


 def _safe_resolve(user_input: str | None, safe_root: Path) -> Path:
-    """
-    Resolve user path relative to safe_root; raise ValueError if it escapes.
-
-    Security: This function prevents path traversal attacks by:
-    1. Rejecting null bytes in user input
-    2. Rejecting Windows drive letters (C:\, D:\, etc.)
-    3. Rejecting absolute paths
-    4. Normalizing path to remove .. traversal attempts
-    5. Validating resolved path is within safe_root using a realpath-based check
-
-    All user-provided paths are validated before filesystem access.
-    """
-    # Treat the provided safe_root as trusted and canonicalize it once.
    safe_root = safe_root.expanduser().resolve()
-
-    # Empty input maps to the safe root directory.
    if not user_input:
        return safe_root
-
-    # Security check 1: Reject null bytes (path truncation attack)
    if "\x00" in user_input:
        raise ValueError("Invalid path: contains null byte")
-
    try:
-        # Security check 2: Normalize path to resolve .. and . components
        normalized = os.path.normpath(user_input.strip())
-
-        # Security check 3: Reject Windows drive letters (C:\, D:\, etc.)
        drive, _ = os.path.splitdrive(normalized)
        if drive:
            raise ValueError("Absolute paths with drive letters are not allowed")
-
-        # Security check 4: Reject absolute paths (/, //server/share, etc.)
        if os.path.isabs(normalized):
            raise ValueError("Absolute paths are not allowed")
-
-        # Security check 5: Build candidate path under safe_root and fully resolve it.
-        joined = os.path.join(str(safe_root), normalized)
-        resolved_candidate = os.path.realpath(joined)
-
-        # Security check 6: Validate candidate is within safe_root (prevent path traversal)
-        candidate_path = Path(resolved_candidate)
-        # Reconstruct from trusted safe_root so the returned path is root-derived.
-        return safe_root / candidate_path.relative_to(safe_root)
+        joined = safe_root / normalized
+        return safe_resolve_path(joined, safe_root)
    except (OSError, ValueError) as exc:
        raise ValueError(f"Invalid path outside of allowed root: {user_input}") from exc

@@ -82,7 +53,7 @@ def get_job_options(base_path: Path, safe_root: Path | None = None) -> list[str]

    # Security fix: Validate base_path to prevent path traversal
    try:
-        base_path_resolved = base_path.expanduser().resolve()
+        base_path_resolved = base_path.expanduser().resolve()  # nosec B614 — validated against safe_root below via relative_to()

        if safe_root is not None:
            safe_root_resolved = safe_root.expanduser().resolve()
@@ -203,8 +174,7 @@ def main():
        except ValueError as e:
            st.warning(str(e))
            return
-        # job_path is validated by _safe_resolve() above
-        if job_path.exists():  # nosec B614 – path validated by _safe_resolve
+        if job_path.exists():
            render_job_summary(job_path, safe_root, is_root=is_root_job)
        else:
            st.warning(f"Job folder not found: {job_folder}")
@@ -15,6 +15,7 @@ from typing import Any
 import streamlit as st

 from rdagent.app.rl.ui.config import EventType
+from rdagent.core.utils import safe_resolve_path
 from rdagent.log.storage import FileStorage


@@ -76,11 +77,10 @@ def extract_stage(tag: str) -> str:
 def get_valid_sessions(log_folder: Path, safe_root: Path | None = None) -> list[str]:
    """Get list of valid session directories, optionally validating against a safe root."""
    if safe_root is not None:
-        root_real = os.path.realpath(str(safe_root.expanduser()))
-        folder_real = os.path.realpath(str(log_folder.expanduser()))
-        if not (folder_real == root_real or folder_real.startswith(root_real + os.sep)):
+        try:
+            log_folder = safe_resolve_path(log_folder, safe_root)
+        except ValueError:
            return []
-        log_folder = Path(folder_real)

    if not log_folder.exists():
        return []
@@ -245,13 +245,11 @@ def parse_event(tag: str, content: Any, timestamp: datetime) -> Event | None:
@st.cache_data(ttl=300, hash_funcs={Path: str})
 def load_session(log_path: Path, safe_root: Path | None = None) -> Session:
    """Load events into hierarchical session structure, optionally validating against safe root."""
-    # Validate path is within safe_root if provided
    if safe_root is not None:
-        root_real = os.path.realpath(str(safe_root.expanduser()))
-        path_real = os.path.realpath(str(log_path.expanduser()))
-        if not (path_real == root_real or path_real.startswith(root_real + os.sep)):
+        try:
+            log_path = safe_resolve_path(log_path, safe_root)
+        except ValueError:
            return Session()
-        log_path = Path(path_real)

    session = Session()

@@ -9,6 +9,8 @@ from pathlib import Path
 import pandas as pd
 import streamlit as st

+from rdagent.core.utils import safe_resolve_path
+

 def is_valid_task(task_path: Path) -> bool:
    """Check if directory is a valid RL task (has __session__ subdirectory)"""
@@ -62,14 +64,10 @@ def get_loop_status(task_path: Path, loop_id: int) -> tuple[str, bool | None]:


 def _validate_job_path(job_path: Path, safe_root: Path) -> Path:
-    """Resolve and validate that job_path stays within safe_root."""
-    resolved_root = safe_root.expanduser().resolve()
-    resolved_job = job_path.expanduser().resolve()
    try:
-        # Reconstruct from trusted root so the returned path is root-derived.
-        return resolved_root / resolved_job.relative_to(resolved_root)
+        return safe_resolve_path(job_path, safe_root)
    except ValueError:
-        raise ValueError(f"Job path is outside allowed root {resolved_root}")
+        raise ValueError(f"Job path is outside allowed root {safe_root}")


 def get_max_loops(job_path: Path, safe_root: Path | None = None) -> int:
@@ -54,11 +54,11 @@ def rdagent_info():
    current_version = importlib.metadata.version("rdagent")
    logger.info(f"RD-Agent version: {current_version}")
    api_url = f"https://api.github.com/repos/microsoft/RD-Agent/contents/requirements.txt?ref=main"
-    response = requests.get(api_url)
+    response = requests.get(api_url, timeout=30)
    if response.status_code == 200:
        files = response.json()
        file_url = files["download_url"]
-        file_response = requests.get(file_url)
+        file_response = requests.get(file_url, timeout=30)
        if file_response.status_code == 200:
            all_file_contents = file_response.text.split("\n")
        else:
@@ -5,13 +5,29 @@ from .risk_management import CorrelationAnalyzer, PortfolioOptimizer, AdvancedRi
 from .vbt_backtest import (
    DEFAULT_BARS_PER_YEAR,
    DEFAULT_TXN_COST_BPS,
+    FTMO_INITIAL_CAPITAL,
+    FTMO_MAX_DAILY_LOSS,
+    FTMO_MAX_TOTAL_LOSS,
+    FTMO_MAX_LEVERAGE,
+    FTMO_RISK_PER_TRADE,
+    OOS_START_DEFAULT,
+    WF_IS_YEARS,
+    WF_OOS_YEARS,
+    WF_STEP_YEARS,
    backtest_from_forward_returns,
    backtest_signal,
+    backtest_signal_ftmo,
+    monte_carlo_trade_pvalue,
+    walk_forward_rolling,
 )

 __all__ = [
    'BacktestMetrics', 'FactorBacktester', 'ResultsDatabase',
    'CorrelationAnalyzer', 'PortfolioOptimizer', 'AdvancedRiskManager',
-    'backtest_signal', 'backtest_from_forward_returns',
+    'backtest_signal', 'backtest_signal_ftmo', 'backtest_from_forward_returns',
+    'monte_carlo_trade_pvalue', 'walk_forward_rolling',
    'DEFAULT_BARS_PER_YEAR', 'DEFAULT_TXN_COST_BPS',
+    'FTMO_INITIAL_CAPITAL', 'FTMO_MAX_DAILY_LOSS', 'FTMO_MAX_TOTAL_LOSS',
+    'FTMO_MAX_LEVERAGE', 'FTMO_RISK_PER_TRADE', 'OOS_START_DEFAULT',
+    'WF_IS_YEARS', 'WF_OOS_YEARS', 'WF_STEP_YEARS',
 ]
@@ -72,7 +72,7 @@ class BacktestMetrics:
 class FactorBacktester:
    def __init__(self):
        self.metrics = BacktestMetrics()
-        self.results_path = Path(__file__).parent.parent.parent / "results" / "backtests"
+        self.results_path = Path(__file__).parent.parent.parent.parent / "results" / "backtests"
        self.results_path.mkdir(parents=True, exist_ok=True)

    def run_backtest(
@@ -222,7 +222,7 @@ class FactorBacktester:

            # Calculate return for this step
            if step > 0:
-                prev_price = float(price_values[step - 1]) if step > 0 else current_price
+                prev_price = float(price_values[step - 1])
                if prev_price > 0:
                    step_return = (current_price - prev_price) / prev_price * position
                    returns_history.append(step_return)
@@ -71,6 +71,9 @@ class ResultsDatabase:

        self.conn.commit()

+    _ALLOWED_TABLES = frozenset({"factors", "backtest_runs", "loop_results"})
+    _ALLOWED_COL_TYPES = frozenset({"REAL", "TEXT", "INTEGER", "BLOB"})
+
    def _add_column_if_not_exists(self, table: str, column: str, col_type: str) -> None:
        """
        Add a column to a table if it doesn't already exist.
@@ -78,20 +81,24 @@ class ResultsDatabase:
        Parameters
        ----------
        table : str
-            Table name
+            Table name (must be in _ALLOWED_TABLES)
        column : str
-            Column name to add
+            Column name to add (alphanumeric + underscore only)
        col_type : str
-            SQL column type (e.g., 'REAL', 'TEXT')
+            SQL column type (must be in _ALLOWED_COL_TYPES)
        """
+        if table not in self._ALLOWED_TABLES:
+            raise ValueError(f"Unknown table: {table!r}")
+        if not column.replace("_", "").isalnum():
+            raise ValueError(f"Invalid column name: {column!r}")
+        if col_type not in self._ALLOWED_COL_TYPES:
+            raise ValueError(f"Invalid column type: {col_type!r}")
+
        c = self.conn.cursor()
-        try:
-            # Try to query the column - if it fails, it doesn't exist
-            # nosec B608: Internal schema migration, column names are controlled
-            c.execute(f"SELECT {column} FROM {table} LIMIT 1")  # nosec B608
-        except sqlite3.OperationalError:
-            # Column doesn't exist, add it
-            c.execute(f"ALTER TABLE {table} ADD COLUMN {column} {col_type}")  # nosec B608
+        c.execute("SELECT name FROM pragma_table_info(?)", (table,))
+        existing = {row[0] for row in c.fetchall()}
+        if column not in existing:
+            c.execute(f"ALTER TABLE {table} ADD COLUMN {column} {col_type}")
    
    def add_factor(self, name: str, type: str = "unknown") -> int:
        c = self.conn.cursor()
@@ -159,7 +166,7 @@ class ResultsDatabase:
        self.conn.commit()
        return c.lastrowid
    
-    def add_loop(self, loop_idx: int, success: int, fail: int, best_ic: float = None, status: str = "completed") -> int:
+    def add_loop(self, loop_idx: int, success: int, fail: int, best_ic: float | None = None, status: str = "completed") -> int:
        c = self.conn.cursor()
        rate = success / (success + fail) if (success + fail) > 0 else 0
        c.execute("""INSERT INTO loop_results (loop_index, factors_success, factors_fail, success_rate, best_ic, status)
@@ -183,16 +190,18 @@ class ResultsDatabase:
        pd.DataFrame
            DataFrame with factor names and metrics
        """
-        # Map shorthand to full column name
+        _ALLOWED_METRICS = frozenset({
+            'sharpe', 'ic', 'annual_return', 'max_drawdown',
+            'win_rate', 'information_ratio', 'volatility',
+        })
        metric_map = {
-            'sharpe': 'sharpe',
-            'ic': 'ic',
-            'return': 'annual_return',
-            'drawdown': 'max_drawdown',
-            'win_rate': 'win_rate',
+            'sharpe': 'sharpe', 'ic': 'ic', 'return': 'annual_return',
+            'drawdown': 'max_drawdown', 'win_rate': 'win_rate',
            'information_ratio': 'information_ratio',
        }
        col = metric_map.get(metric, metric)
+        if col not in _ALLOWED_METRICS:
+            raise ValueError(f"Unknown metric: {metric!r}")

        return pd.read_sql_query(
            f"""SELECT factor_name, ic, sharpe, annual_return, max_drawdown,
@@ -201,7 +210,7 @@ class ResultsDatabase:
                JOIN factors ON factor_id = factors.id
                WHERE {col} IS NOT NULL
                ORDER BY {col} DESC
-                LIMIT ?""",
+                LIMIT ?""",  # nosec B608 — col is validated against _ALLOWED_METRICS above
            self.conn,
            params=[limit]
        )
@@ -321,13 +330,13 @@ class ResultsDatabase:
        worst_drawdown = all_results['max_drawdown'].min() if total_runs > 0 and all_results['max_drawdown'].notna().any() else None

        # Scan factors directory for JSON files
-        factors_dir = Path(__file__).parent.parent.parent / "results" / "factors"
+        factors_dir = Path(__file__).parent.parent.parent.parent / "results" / "factors"
        json_factor_files = 0
        if factors_dir.exists():
            json_factor_files = len(list(factors_dir.glob("*.json")))

        # Scan failed runs
-        failed_dir = Path(__file__).parent.parent.parent / "results" / "failed_runs"
+        failed_dir = Path(__file__).parent.parent.parent.parent / "results" / "failed_runs"
        failed_runs_file = failed_dir / "failed_runs.json"
        failed_runs_count = 0
        failed_runs_data = []
@@ -1,21 +1,19 @@
 """
 Predix Risk Management - Korrelation, Portfolio-Optimierung
 """
+
 import numpy as np
 import pandas as pd
-from pathlib import Path
-from typing import Dict, List, Optional
-from datetime import datetime
-import json
+

 class CorrelationAnalyzer:
    def __init__(self, lookback: int = 60):
        self.lookback = lookback
-    
+
    def calculate_matrix(self, returns: pd.DataFrame) -> pd.DataFrame:
        return returns.dropna().corr()
-    
-    def find_uncorrelated(self, corr: pd.DataFrame, threshold: float = 0.3) -> List[str]:
+
+    def find_uncorrelated(self, corr: pd.DataFrame, threshold: float = 0.3) -> list[str]:
        result = []
        for f in corr.columns:
            others = [x for x in corr.columns if x != f]
@@ -28,9 +26,9 @@ class PortfolioOptimizer:
        try:
            w = np.linalg.inv(cov.values) @ exp_ret.values
            return w / np.sum(w)
-        except:
+        except (np.linalg.LinAlgError, ValueError):
            return np.ones(len(exp_ret)) / len(exp_ret)
-    
+
    def risk_parity(self, cov: pd.DataFrame, max_iter: int = 100) -> np.ndarray:
        n = cov.shape[0]
        w = np.ones(n) / n
@@ -53,36 +51,36 @@ class AdvancedRiskManager:
        self.max_dd = max_dd
        self.corr_analyzer = CorrelationAnalyzer()
        self.optimizer = PortfolioOptimizer()
-    
-    def check_limits(self, weights: np.ndarray, vol: float, dd: float) -> Dict[str, bool]:
+
+    def check_limits(self, weights: np.ndarray, vol: float, dd: float) -> dict[str, bool]:
        return {
-            'position_limit': np.max(np.abs(weights)) <= self.max_pos,
-            'leverage_limit': np.sum(np.abs(weights)) <= self.max_lev,
-            'drawdown_limit': abs(dd) <= self.max_dd,
+            "position_limit": np.max(np.abs(weights)) <= self.max_pos,
+            "leverage_limit": np.sum(np.abs(weights)) <= self.max_lev,
+            "drawdown_limit": abs(dd) <= self.max_dd,
        }

 if __name__ == "__main__":
    print("=== Risk Test ===")
    np.random.seed(42)
-    n, names = 252, ['Mom', 'MeanRev', 'Vol', 'Volu', 'ML']
+    n, names = 252, ["Mom", "MeanRev", "Vol", "Volu", "ML"]
    ret = pd.DataFrame(np.random.randn(n, 5), columns=names)
-    
+
    corr = CorrelationAnalyzer().calculate_matrix(ret)
    print("Korrelationsmatrix:")
    print(corr.round(2))
-    
+
    opt = PortfolioOptimizer()
    exp_ret = pd.Series([0.1, 0.08, 0.06, 0.07, 0.12], index=names)
    cov = ret.cov() * 252
-    
+
    mv = opt.mean_variance(exp_ret, cov)
    print("\nMean-Variance:")
    for n, w in zip(names, mv): print(f"  {n}: {w:.2%}")
-    
+
    rp = opt.risk_parity(cov)
    print("\nRisk Parity:")
    for n, w in zip(names, rp): print(f"  {n}: {w:.2%}")
-    
+
    rm = AdvancedRiskManager()
    checks = rm.check_limits(mv, 0.15, -0.08)
    print(f"\nLimits OK: {all(checks.values())}")
@@ -3,8 +3,8 @@ Unified, verifiable backtesting engine.

 Single entry point (`backtest_signal`) used by:
  - scripts/predix_gen_strategies_real_bt.py
-  - rdagent/components/coder/strategy_orchestrator.py
-  - rdagent/components/coder/optuna_optimizer.py
+  - rdagent/scenarios/qlib/local/strategy_orchestrator.py
+  - rdagent/scenarios/qlib/local/optuna_optimizer.py
  - rdagent/components/backtesting/backtest_engine.py

 Design goals
@@ -19,7 +19,7 @@ Design goals
 """
 from __future__ import annotations

-from typing import Any, Dict, Optional
+from typing import Any

 import numpy as np
 import pandas as pd
@@ -32,10 +32,22 @@ except ImportError:
    VBT_AVAILABLE = False


-DEFAULT_TXN_COST_BPS = 1.5
+# 2.35 pip realistic EUR/USD cost: 1.5 spread + 0.5 slippage + 0.35 commission
+# At EUR/USD ≈ 1.10:  2.35 pip * (0.0001/1.10) ≈ 2.14 bps of notional.
+DEFAULT_TXN_COST_BPS = 2.14
 DEFAULT_BARS_PER_YEAR = 252 * 1440  # 252 trading days * 1440 min/day = 362,880
 EXTREME_BAR_THRESHOLD = 0.05  # |ret| > 5% on a single 1-min bar → suspicious

+# FTMO 100k account rules (enforced in backtest_signal when ftmo=True)
+FTMO_INITIAL_CAPITAL   = 100_000.0
+FTMO_MAX_DAILY_LOSS    = 0.05   # 5%  of initial → block new trades rest of day
+FTMO_MAX_TOTAL_LOSS    = 0.10   # 10% of initial → simulation ends
+# Risk-based position sizing: 0.5% equity risk per trade, 10-pip stop, max 1:30 leverage
+FTMO_RISK_PER_TRADE    = 0.005
+FTMO_STOP_PIPS         = 10
+FTMO_PIP               = 0.0001
+FTMO_MAX_LEVERAGE      = 30
+

 def _compute_trade_pnl(position: pd.Series, strategy_returns: pd.Series) -> pd.Series:
    """
@@ -55,9 +67,8 @@ def _cross_check_with_vbt(
    close: pd.Series,
    position: pd.Series,
    txn_cost: float,
-    manual_total_return: float,
    freq: str,
-) -> Optional[float]:
+) -> float | None:
    """Run a vectorbt simulation and return its total_return for comparison."""
    if not VBT_AVAILABLE:
        return None
@@ -72,7 +83,8 @@ def _cross_check_with_vbt(
            init_cash=10_000.0,
            freq=freq,
        )
-        return float(pf.total_return())
+        tr = float(pf.total_return())
+        return tr if np.isfinite(tr) else None
    except Exception:
        return None

@@ -83,9 +95,9 @@ def backtest_signal(
    txn_cost_bps: float = DEFAULT_TXN_COST_BPS,
    freq: str = "1min",
    bars_per_year: int = DEFAULT_BARS_PER_YEAR,
-    forward_returns: Optional[pd.Series] = None,
+    forward_returns: pd.Series | None = None,
    cross_check: bool = False,
-) -> Dict[str, Any]:
+) -> dict[str, Any]:
    """
    Run a single-asset backtest from a position signal.

@@ -192,7 +204,7 @@ def backtest_signal(
    calmar = ann_return_arith / abs(max_dd) if max_dd < 0 else 0.0

    trade_pnl = _compute_trade_pnl(position, strategy_returns)
-    n_trades = int(len(trade_pnl))
+    n_trades = len(trade_pnl)
    n_position_changes = int((position.diff().fillna(0) != 0).sum())

    if n_trades > 0:
@@ -204,7 +216,7 @@ def backtest_signal(
        win_rate = 0.0
        profit_factor = 0.0

-    ic: Optional[float] = None
+    ic: float | None = None
    if forward_returns is not None:
        fwd = pd.to_numeric(forward_returns, errors="coerce")
        common = signal.index.intersection(fwd.dropna().index)
@@ -215,7 +227,7 @@ def backtest_signal(
                ic_val = float(s.corr(f))
                ic = ic_val if np.isfinite(ic_val) else None

-    result: Dict[str, Any] = {
+    result: dict[str, Any] = {
        "status": "success",
        "sharpe": sharpe,
        "sortino": sortino,
@@ -232,7 +244,7 @@ def backtest_signal(
        "volatility": volatility,
        "n_trades": n_trades,
        "n_position_changes": n_position_changes,
-        "n_bars": int(len(strategy_returns)),
+        "n_bars": len(strategy_returns),
        "n_months": float(n_months),
        "signal_long": int((signal > 0).sum()),
        "signal_short": int((signal < 0).sum()),
@@ -252,10 +264,340 @@ def backtest_signal(
            close=close,
            position=position,
            txn_cost=txn_cost,
-            manual_total_return=total_return,
            freq=freq,
        )

+    from rdagent.components.backtesting.verify import verify_and_log
+
+    verify_and_log(result, factor_name="backtest_signal")
+
+    return result
+
+
+def _apply_ftmo_mask(
+    signal: pd.Series,
+    close: pd.Series,
+    leverage: float,
+    txn_cost_bps: float,
+) -> tuple[pd.Series, dict]:
+    """
+    Apply FTMO daily/total loss rules to a signal series.
+
+    Returns a masked signal (positions zeroed after each limit breach) and
+    a dict of FTMO compliance metrics.
+    """
+    txn_cost = txn_cost_bps / 10_000.0
+    position = signal.shift(1).fillna(0) * leverage
+    bar_ret  = close.pct_change().fillna(0)
+
+    equity   = FTMO_INITIAL_CAPITAL
+    peak_day = FTMO_INITIAL_CAPITAL
+    masked   = signal.copy()
+
+    daily_breaches = 0
+    total_breached = False
+    total_breach_ts: pd.Timestamp | None = None
+    current_day    = None
+    day_start_eq   = FTMO_INITIAL_CAPITAL
+
+    pos_prev = 0.0
+    for ts, sig_i in signal.items():
+        day = ts.date() if hasattr(ts, "date") else ts
+
+        if day != current_day:
+            current_day  = day
+            day_start_eq = equity
+
+        pos_i  = float(signal.at[ts]) * leverage
+        ret_i  = float(bar_ret.get(ts, 0.0))
+        cost_i = abs(pos_i - pos_prev) * txn_cost
+        ret_frac = pos_prev * ret_i - cost_i
+        equity *= 1.0 + ret_frac if equity > 0 else 1.0
+        pos_prev = pos_i
+
+        if total_breached:
+            masked.at[ts] = 0
+            continue
+
+        daily_loss = (equity - day_start_eq) / FTMO_INITIAL_CAPITAL
+        total_loss = (equity - FTMO_INITIAL_CAPITAL) / FTMO_INITIAL_CAPITAL
+
+        if daily_loss < -FTMO_MAX_DAILY_LOSS:
+            daily_breaches += 1
+            day_start_eq = -999  # block rest of day
+            masked.at[ts] = 0
+
+        if total_loss < -FTMO_MAX_TOTAL_LOSS:
+            total_breached = True
+            total_breach_ts = ts
+            masked.at[ts] = 0
+
+    return masked, {
+        "ftmo_daily_breaches": daily_breaches,
+        "ftmo_total_breached": total_breached,
+        "ftmo_total_breach_ts": str(total_breach_ts) if total_breach_ts else None,
+        "ftmo_compliant": not total_breached and daily_breaches == 0,
+    }
+
+
+OOS_START_DEFAULT = "2024-01-01"
+
+# Rolling walk-forward default windows (IS years, OOS years, step years)
+WF_IS_YEARS  = 3
+WF_OOS_YEARS = 1
+WF_STEP_YEARS = 1
+
+
+def monte_carlo_trade_pvalue(
+    trade_pnl: pd.Series,
+    n_permutations: int = 1000,
+    seed: int = 0,
+) -> float:
+    """
+    Monte Carlo permutation test on trade-level P&L.
+
+    Runs a one-sided binomial test on trade-level win rate.
+
+    Tests H0: win_rate = 0.5 (random trading) against H1: win_rate > 0.5.
+    The ``n_permutations`` parameter is kept for API compatibility but is unused.
+
+    p < 0.05 → win rate is significantly above 50%, indicating a genuine per-trade edge.
+
+    Parameters
+    ----------
+    trade_pnl : pd.Series
+        Per-trade net returns (output of ``_compute_trade_pnl``).
+    n_permutations : int
+        Number of random permutations (default 1000).
+    seed : int
+        RNG seed for reproducibility.
+
+    Returns
+    -------
+    float
+        p-value in [0, 1]. Lower is better.
+    """
+    if len(trade_pnl) < 2:
+        return 1.0
+    trades = trade_pnl.values.copy()
+    # Binomial test: is the win rate significantly above 50%?
+    # p = probability of observing >= n_wins out of n_trades under null (win_rate=0.5).
+    # Low p → strategy has a significant positive edge per trade.
+    from scipy.stats import binomtest
+    n_wins = int((trades > 0).sum())
+    n_total = len(trades)
+    result = binomtest(n_wins, n_total, p=0.5, alternative="greater")
+    return float(result.pvalue)
+
+
+def walk_forward_rolling(
+    close: pd.Series,
+    signal: pd.Series,
+    leverage: float,
+    txn_cost_bps: float = DEFAULT_TXN_COST_BPS,
+    bars_per_year: int = DEFAULT_BARS_PER_YEAR,
+    is_years: int = WF_IS_YEARS,
+    oos_years: int = WF_OOS_YEARS,
+    step_years: int = WF_STEP_YEARS,
+) -> dict[str, Any]:
+    """
+    Rolling walk-forward validation: multiple IS/OOS windows shifted by ``step_years``.
+
+    Each window runs an independent FTMO simulation on the IS and OOS slices.
+    Produces aggregate OOS statistics to measure cross-time consistency.
+
+    Returns
+    -------
+    dict with keys:
+        wf_n_windows, wf_oos_sharpe_mean, wf_oos_sharpe_std,
+        wf_oos_monthly_return_mean, wf_oos_consistency (fraction of windows
+        with OOS Sharpe > 0), wf_windows (list of per-window dicts)
+    """
+    if not isinstance(close.index, pd.DatetimeIndex):
+        return {"wf_n_windows": 0}
+
+    start_year = close.index[0].year
+    end_year   = close.index[-1].year
+
+    windows = []
+    yr = start_year
+    while True:
+        is_start  = pd.Timestamp(f"{yr}-01-01")
+        is_end    = pd.Timestamp(f"{yr + is_years}-01-01")
+        oos_end   = pd.Timestamp(f"{yr + is_years + oos_years}-01-01")
+        if oos_end.year > end_year + 1:
+            break
+        is_mask  = (close.index >= is_start) & (close.index < is_end)
+        oos_mask = (close.index >= is_end)   & (close.index < oos_end)
+        if is_mask.sum() < 1000 or oos_mask.sum() < 1000:
+            yr += step_years
+            continue
+
+        window: dict[str, Any] = {
+            "is_start":  str(is_start.date()),
+            "is_end":    str(is_end.date()),
+            "oos_start": str(is_end.date()),
+            "oos_end":   str(oos_end.date()),
+        }
+        for mask, prefix in [(is_mask, "is"), (oos_mask, "oos")]:
+            close_s  = close.loc[mask]
+            signal_s = signal.loc[mask]
+            masked_s, _ = _apply_ftmo_mask(signal_s, close_s, leverage, txn_cost_bps)
+            r = backtest_signal(close=close_s, signal=masked_s,
+                                txn_cost_bps=txn_cost_bps, bars_per_year=bars_per_year)
+            window[f"{prefix}_sharpe"]       = r.get("sharpe", 0.0)
+            window[f"{prefix}_monthly_return_pct"] = r.get("monthly_return_pct", 0.0)
+            window[f"{prefix}_n_trades"]     = r.get("n_trades", 0)
+        windows.append(window)
+        yr += step_years
+
+    if not windows:
+        return {"wf_n_windows": 0}
+
+    oos_sharpes  = [w["oos_sharpe"] for w in windows]
+    oos_monthly  = [w["oos_monthly_return_pct"] for w in windows]
+    return {
+        "wf_n_windows":              len(windows),
+        "wf_oos_sharpe_mean":        float(np.mean(oos_sharpes)),
+        "wf_oos_sharpe_std":         float(np.std(oos_sharpes)),
+        "wf_oos_monthly_return_mean": float(np.mean(oos_monthly)),
+        "wf_oos_consistency":        float(np.mean([s > 0 for s in oos_sharpes])),
+        "wf_windows":                windows,
+    }
+
+
+def backtest_signal_ftmo(
+    close: pd.Series,
+    signal: pd.Series,
+    txn_cost_bps: float = DEFAULT_TXN_COST_BPS,
+    eurusd_price: float = 1.10,
+    risk_pct: float = FTMO_RISK_PER_TRADE,
+    stop_pips: float = FTMO_STOP_PIPS,
+    max_leverage: float = FTMO_MAX_LEVERAGE,
+    bars_per_year: int = DEFAULT_BARS_PER_YEAR,
+    forward_returns: pd.Series | None = None,
+    oos_start: str | None = OOS_START_DEFAULT,
+    wf_rolling: bool = True,
+    mc_n_permutations: int = 0,
+) -> dict[str, Any]:
+    """
+    FTMO-compliant backtest of a strategy signal on EUR/USD.
+
+    Applies on top of ``backtest_signal``:
+      - Realistic costs: default 2.14 bps (≈ 2.35 pip spread+slippage+commission)
+      - Risk-based position sizing: risk_pct equity per trade, stop_pips hard stop
+      - Max leverage cap: max_leverage (default 1:30, FTMO standard)
+      - FTMO daily loss limit (5%): positions zeroed rest of day after breach
+      - FTMO total loss limit (10%): all positions zeroed after breach
+      - FTMO-specific metrics added to result dict
+      - Walk-forward OOS split: IS metrics (before oos_start) + OOS metrics (after)
+
+    Parameters
+    ----------
+    close : pd.Series
+        1-min EUR/USD close prices.
+    signal : pd.Series
+        Raw strategy signal in {-1, 0, +1}.
+    txn_cost_bps : float
+        Transaction cost in bps (default 2.14 ≈ 2.35 pip on EUR/USD).
+    eurusd_price : float
+        Representative EUR/USD price for pip→bps conversion (default 1.10).
+    risk_pct : float
+        Fraction of equity risked per trade (default 0.005 = 0.5%).
+    stop_pips : float
+        Hard stop-loss distance in pips (default 10).
+    max_leverage : float
+        Maximum leverage (default 30 = FTMO 1:30).
+    oos_start : str or None
+        Start of out-of-sample period (ISO date). None disables OOS split.
+    wf_rolling : bool
+        If True, run rolling walk-forward validation (multiple IS/OOS windows).
+        Results are stored under ``wf_*`` keys. Default False.
+    mc_n_permutations : int
+        Number of Monte Carlo trade permutations. 0 = disabled (default).
+        When > 0, computes ``mc_pvalue``: fraction of permuted sequences whose
+        total return >= real total return. p < 0.05 indicates a genuine edge.
+    """
+    stop_price = stop_pips * FTMO_PIP
+    leverage_by_risk = risk_pct / (stop_price / eurusd_price)
+    leverage = min(leverage_by_risk, max_leverage)
+
+    masked_signal, ftmo_metrics = _apply_ftmo_mask(signal, close, leverage, txn_cost_bps)
+
+    result = backtest_signal(
+        close=close,
+        signal=masked_signal,
+        txn_cost_bps=txn_cost_bps,
+        bars_per_year=bars_per_year,
+        forward_returns=forward_returns,
+    )
+
+    result.update(ftmo_metrics)
+    result["ftmo_leverage"] = round(leverage, 2)
+    result["ftmo_risk_pct"] = risk_pct
+    result["ftmo_stop_pips"] = stop_pips
+
+    # Re-scale reported equity metrics to FTMO_INITIAL_CAPITAL
+    result["ftmo_end_equity"] = FTMO_INITIAL_CAPITAL * (1 + result.get("total_return", 0))
+    result["ftmo_monthly_profit"] = FTMO_INITIAL_CAPITAL * result.get("monthly_return", 0)
+
+    # Walk-forward OOS split
+    if oos_start is not None:
+        oos_ts = pd.Timestamp(oos_start)
+        is_mask  = close.index < oos_ts
+        oos_mask = close.index >= oos_ts
+
+        def _split_bt(mask: pd.Series[bool], prefix: str) -> None:
+            if mask.sum() < 100:
+                return
+            close_s  = close.loc[mask]
+            signal_s = signal.loc[mask]  # raw signal, not masked — fresh FTMO sim per period
+            fwd_split = forward_returns.loc[mask] if forward_returns is not None else None
+            masked_s, _ = _apply_ftmo_mask(signal_s, close_s, leverage, txn_cost_bps)
+            split_result = backtest_signal(
+                close=close_s,
+                signal=masked_s,
+                txn_cost_bps=txn_cost_bps,
+                bars_per_year=bars_per_year,
+                forward_returns=fwd_split,
+            )
+            for k, v in split_result.items():
+                if k not in ("equity_curve", "status"):
+                    result[f"{prefix}_{k}"] = v
+
+        _split_bt(is_mask,  "is")
+        _split_bt(oos_mask, "oos")
+
+        result["oos_start"] = oos_start
+        result["is_n_bars"]  = int(is_mask.sum())
+        result["oos_n_bars"] = int(oos_mask.sum())
+
+    # Rolling walk-forward validation
+    if wf_rolling:
+        wf = walk_forward_rolling(
+            close=close,
+            signal=signal,
+            leverage=leverage,
+            txn_cost_bps=txn_cost_bps,
+            bars_per_year=bars_per_year,
+        )
+        result.update(wf)
+
+    # Monte Carlo trade permutation test
+    if mc_n_permutations > 0:
+        position = masked_signal.shift(1).fillna(0)
+        bar_ret  = close.pct_change().fillna(0)
+        txn_cost = txn_cost_bps / 10_000.0
+        position_change = position.diff().abs().fillna(position.abs())
+        strat_ret = position * bar_ret - position_change * txn_cost
+        trade_pnl = _compute_trade_pnl(position, strat_ret)
+        result["mc_pvalue"]        = monte_carlo_trade_pvalue(trade_pnl, mc_n_permutations)
+        result["mc_n_permutations"] = mc_n_permutations
+
+    from rdagent.components.backtesting.verify import verify_and_log
+
+    verify_and_log(result, factor_name="backtest_from_forward_returns")
+
    return result


@@ -264,7 +606,7 @@ def backtest_from_forward_returns(
    forward_returns: pd.Series,
    txn_cost_bps: float = DEFAULT_TXN_COST_BPS,
    bars_per_year: int = DEFAULT_BARS_PER_YEAR,
-) -> Dict[str, Any]:
+) -> dict[str, Any]:
    """
    Backtest a factor using sign(factor) as signal against forward returns.

@@ -302,7 +644,7 @@ def backtest_from_forward_returns(
    ic = ic_val if np.isfinite(ic_val) else 0.0

    trade_pnl = _compute_trade_pnl(position, strategy_returns)
-    n_trades = int(len(trade_pnl))
+    n_trades = len(trade_pnl)
    win_rate = float((trade_pnl > 0).mean()) if n_trades > 0 else 0.0

    ann_return = float(strategy_returns.mean() * bars_per_year)
@@ -318,7 +660,7 @@ def backtest_from_forward_returns(
        "win_rate": win_rate,
        "n_trades": n_trades,
        "ic": ic,
-        "n_bars": int(len(strategy_returns)),
+        "n_bars": len(strategy_returns),
        "txn_cost_bps": txn_cost_bps,
        "bars_per_year": bars_per_year,
    }
@@ -0,0 +1,112 @@
+"""Runtime backtest verification — fast sanity checks for every backtest result.
+
+These checks run in <1ms and catch corrupted/flipped/missing metrics before they
+propagate into the factor database.  Called automatically by backtest_signal()
+and backtest_from_forward_returns().
+
+The same invariants are covered by 477 unit tests in test/qlib/.
+"""
+
+from __future__ import annotations
+
+import logging
+
+import numpy as np
+
+logger = logging.getLogger(__name__)
+
+REQUIRED_KEYS = [
+    "sharpe",
+    "max_drawdown",
+    "win_rate",
+    "total_return",
+    "annual_return_pct",
+    "monthly_return_pct",
+    "n_trades",
+    "status",
+]
+
+
+def verify_backtest_result(result: dict) -> list[str]:
+    """Run fast mathematical-invariant checks on a backtest result dict.
+
+    Returns a list of warning strings (empty = all good).
+
+    Parameters
+    ----------
+    result : dict
+        Output of ``backtest_signal()`` or ``backtest_from_forward_returns()``.
+
+    Returns
+    -------
+    list[str]
+        Warning messages for any failed check.
+    """
+    warnings: list[str] = []
+
+    # ── 1. Required keys present ──
+    for key in REQUIRED_KEYS:
+        if key not in result:
+            warnings.append(f"Missing key: {key}")
+            return warnings  # can't check further
+
+    # ── 2. MaxDD must be in [-1, 0] ──
+    mdd = result["max_drawdown"]
+    if not (-1.0 <= mdd <= 0.0):
+        warnings.append(f"max_drawdown {mdd:.4f} outside valid range [-1, 0]")
+
+    # ── 3. Win rate in [0, 1] ──
+    wr = result["win_rate"]
+    if not (0.0 <= wr <= 1.0):
+        warnings.append(f"win_rate {wr:.4f} outside valid range [0, 1]")
+
+    # ── 4. Sharpe must be finite ──
+    sharpe = result["sharpe"]
+    if not np.isfinite(sharpe):
+        warnings.append(f"sharpe is not finite: {sharpe}")
+
+    # ── 5. total_return finite ──
+    tr = result["total_return"]
+    if not np.isfinite(tr):
+        warnings.append(f"total_return is not finite: {tr}")
+
+    # ── 6. n_trades >= 0 ──
+    nt = result["n_trades"]
+    if nt < 0:
+        warnings.append(f"n_trades is negative: {nt}")
+
+    # ── 7. Annual return consistent with total return ──
+    ar = result["annual_return_pct"]
+    if not np.isfinite(ar):
+        warnings.append(f"annual_return_pct is not finite: {ar}")
+
+    # ── 8. Monthly return consistent with total return ──
+    mr = result["monthly_return_pct"]
+    if mr is not None and not np.isfinite(mr):
+        warnings.append(f"monthly_return_pct is not finite: {mr}")
+
+    # ── 9. Sharpe sign matches annual return sign (with 0-cost approximation) ──
+    if abs(sharpe) > 0.01 and abs(ar) > 0.01:
+        if np.sign(sharpe) != np.sign(ar):
+            warnings.append(
+                f"Sharpe ({sharpe:.4f}) and annual_return_pct ({ar:.4f}) have opposite signs"
+            )
+
+    # ── 10. status must be 'success' or 'failed' ──
+    if result["status"] not in ("success", "failed"):
+        warnings.append(f"status is not 'success' or 'failed': {result['status']}")
+
+    return warnings
+
+
+def verify_and_log(result: dict, factor_name: str = "unknown") -> bool:
+    """Verify backtest result and log any warnings.
+
+    Returns True if all checks passed.
+    """
+    warnings = verify_backtest_result(result)
+    if warnings:
+        for w in warnings:
+            logger.warning(f"[BacktestVerify] [{factor_name[:60]}] {w}")
+        return False
+    return True
@@ -75,8 +75,10 @@ class CoSTEER(Developer[Experiment]):

    def _get_last_fb(self) -> CoSTEERMultiFeedback:
        fb = self.evolve_agent.evolving_trace[-1].feedback
-        assert fb is not None, "feedback is None"
-        assert isinstance(fb, CoSTEERMultiFeedback), "feedback must be of type CoSTEERMultiFeedback"
+        if fb is None:
+            raise AssertionError("feedback is None")
+        if not isinstance(fb, CoSTEERMultiFeedback):
+            raise TypeError("feedback must be of type CoSTEERMultiFeedback")
        return fb

    def should_use_new_evo(self, base_fb: CoSTEERMultiFeedback | None, new_fb: CoSTEERMultiFeedback) -> bool:
@@ -121,7 +123,8 @@ class CoSTEER(Developer[Experiment]):

        for evo_exp in self.evolve_agent.multistep_evolve(evo_exp, self.evaluator):
            iteration_count += 1
-            assert isinstance(evo_exp, Experiment)  # multiple inheritance
+            if not isinstance(evo_exp, Experiment):
+                raise TypeError("evo_exp must be an instance of Experiment")
            evo_fb = self._get_last_fb()
            update_fallback = self.should_use_new_evo(
                base_fb=fallback_evo_fb,
@@ -154,7 +157,8 @@ class CoSTEER(Developer[Experiment]):
                evo_exp = fallback_evo_exp
                evo_exp.recover_ws_ckp()
                evo_fb = fallback_evo_fb
-            assert evo_fb is not None  # multistep_evolve should run at least once
+            if evo_fb is None:
+                raise AssertionError("multistep_evolve should run at least once")
            evo_exp = self._exp_postprocess_by_feedback(evo_exp, evo_fb)
        except CoderError as e:
            e.caused_by_timeout = reached_max_seconds
@@ -264,9 +268,12 @@ class CoSTEER(Developer[Experiment]):
        - Raise Error if it failed to handle the develop task
        -
        """
-        assert isinstance(evo, Experiment)
-        assert isinstance(feedback, CoSTEERMultiFeedback)
-        assert len(evo.sub_workspace_list) == len(feedback)
+        if not isinstance(evo, Experiment):
+            raise TypeError("evo must be an instance of Experiment")
+        if not isinstance(feedback, CoSTEERMultiFeedback):
+            raise TypeError("feedback must be an instance of CoSTEERMultiFeedback")
+        if len(evo.sub_workspace_list) != len(feedback):
+            raise ValueError("Length of sub_workspace_list must match length of feedback")

        # FIXME: when whould the feedback be None?
        failed_feedbacks = [
@@ -122,7 +122,8 @@ class MultiProcessEvolvingStrategy(EvolvingStrategy):
        last_feedback = None
        if len(evolving_trace) > 0:
            last_feedback = evolving_trace[-1].feedback
-            assert isinstance(last_feedback, CoSTEERMultiFeedback)
+            if not isinstance(last_feedback, CoSTEERMultiFeedback):
+                raise TypeError("last_feedback must be of type CoSTEERMultiFeedback")

        # 1.找出需要evolve的task
        to_be_finished_task_index: list[int] = []
@@ -1028,7 +1028,8 @@ class CoSTEERKnowledgeBaseV2(EvolvingKnowledgeBase):

        """
        node_count = len(nodes)
-        assert node_count >= 2, "nodes length must >=2"
+        if node_count < 2:
+            raise ValueError("nodes length must >=2")
        intersection_node_list = []
        if output_intersection_origin:
            origin_list = []
@@ -54,7 +54,8 @@ def get_ds_env(
        ValueError: If the env_type is not recognized.
    """
    conf = DSCoderCoSTEERSettings()
-    assert conf_type in ["kaggle", "mlebench"], f"Unknown conf_type: {conf_type}"
+    if conf_type not in ["kaggle", "mlebench"]:
+        raise ValueError(f"Unknown conf_type: {conf_type}")

    if conf.env_type == "docker":
        env_conf = DSDockerConf() if conf_type == "kaggle" else MLEBDockerConf()
@@ -79,7 +80,8 @@ def get_clear_ws_cmd(stage: Literal["before_training", "before_inference"] = "be
    """
    Clean the files in workspace to a specific stage
    """
-    assert stage in ["before_training", "before_inference"], f"Unknown stage: {stage}"
+    if stage not in ["before_training", "before_inference"]:
+        raise ValueError(f"Unknown stage: {stage}")
    if DS_RD_SETTING.enable_model_dump and stage == "before_training":
        cmd = "rm -r submission.csv scores.csv models trace.log"
    else:
@@ -13,7 +13,7 @@ File structure

 from pathlib import Path

-from jinja2 import Environment, StrictUndefined
+from jinja2 import Environment, StrictUndefined, select_autoescape

 from rdagent.app.data_science.conf import DS_RD_SETTING
 from rdagent.components.coder.CoSTEER.evaluators import (
@@ -88,7 +88,7 @@ class EnsembleMultiProcessEvolvingStrategy(MultiProcessEvolvingStrategy):
            code_spec = workspace.file_dict["spec/ensemble.md"]
        else:
            test_code = (
-                Environment(undefined=StrictUndefined)
+                Environment(undefined=StrictUndefined, autoescape=select_autoescape())
                .from_string((DIRNAME / "eval_tests" / "ensemble_test.txt").read_text())
                .render(
                    model_names=[
@@ -2,7 +2,7 @@ import json
 import re
 from pathlib import Path

-from jinja2 import Environment, StrictUndefined
+from jinja2 import Environment, StrictUndefined, select_autoescape

 from rdagent.app.data_science.conf import DS_RD_SETTING
 from rdagent.components.coder.CoSTEER.evaluators import (
@@ -55,7 +55,7 @@ class EnsembleCoSTEEREvaluator(CoSTEEREvaluator):
        fname = "test/ensemble_test.txt"
        test_code = (DIRNAME / "eval_tests" / "ensemble_test.txt").read_text()
        test_code = (
-            Environment(undefined=StrictUndefined)
+            Environment(undefined=StrictUndefined, autoescape=select_autoescape())
            .from_string(test_code)
            .render(
                model_names=[
@@ -51,13 +51,23 @@ class FactorAutoFixer:
        self.fixes_applied = []
        fixed_code = code

-        # Apply fixes in order - groupby fixes MUST come before min_periods fixes
+        # Apply fixes in order
+        # NOTE: _fix_min_periods is intentionally excluded — it increased min_periods to
+        # match window size, which causes all-NaN output for intraday data with 96 bars/day
+        # (window=240 > 96 means zero valid bars per day). The LLM sets its own min_periods.
        fix_methods = [
-            self._fix_groupby_apply_to_transform,  # First: fix groupby patterns
-            self._fix_min_periods,                  # Second: fix min_periods in resulting rolling calls
-            self._fix_inf_nan_handling,             # Third: add inf/nan handling
-            self._fix_data_range_processing,        # Fourth: ensure full data range
-            self._fix_multiindex_groupby,           # Fifth: ensure groupby on MultiIndex
+            self._fix_instrument_column_access,     # First: fix df['instrument'] on MultiIndex
+            self._fix_instrument_loc_multiindex,    # Second: fix df.loc[instrument_var] on MultiIndex
+            self._fix_zero_volume_proxy,            # Third: replace zero $volume with range proxy
+            self._fix_reset_index_groupby,          # Fourth: fix groupby(level=N) after reset_index()
+            self._fix_groupby_mixed_levels,         # Fifth: fix groupby(level=[int, str])
+            self._fix_groupby_column_on_multiindex, # Sixth: fix groupby(['instrument','date']) on MultiIndex
+            self._fix_chained_groupby,              # Seventh: fix groupby(level=N).groupby('date') chain
+            self._fix_rolling_ddof,                 # Eighth: remove unsupported ddof kwarg
+            self._fix_groupby_apply_to_transform,   # Ninth: fix groupby patterns
+            self._fix_inf_nan_handling,             # Tenth: add inf/nan handling
+            self._fix_data_range_processing,        # Eleventh: ensure full data range
+            self._fix_multiindex_groupby,           # Twelfth: ensure groupby on MultiIndex
        ]

        for fix_method in fix_methods:
@@ -75,6 +85,352 @@ class FactorAutoFixer:

        return fixed_code

+    def _fix_instrument_column_access(self, code: str) -> str:
+        """
+        Fix: df['instrument'] raises KeyError on a MultiIndex DataFrame because
+        'instrument' is an index level (level 1), not a column.
+
+        Replace df['instrument'] with df.index.get_level_values('instrument')
+        but only when the DataFrame has a MultiIndex (not after reset_index which
+        would have promoted it to a real column).
+
+        Also fixes df.reset_index()['instrument'] correctly since after reset_index
+        the column exists.
+        """
+        fixed_code = code
+
+        # Skip if already fixed or if reset_index() is being used before the access
+        # We only fix bare df['instrument'] where df is the original MultiIndex frame.
+        # Heuristic: if the assignment lhs or context shows reset_index, leave it alone.
+
+        # Pattern: <varname>['instrument'] where varname is NOT a reset_index result
+        reset_vars = set(re.findall(r'(\w+)\s*=\s*\w[^=\n]*\.reset_index\(', fixed_code))
+
+        def _replace_instrument_access(m: re.Match) -> str:
+            var = m.group(1)
+            if var in reset_vars:
+                return m.group(0)  # leave reset_index vars alone — column exists
+            self.fixes_applied.append(f"instrument_column: {var}['instrument'] → get_level_values(1)")
+            return f"{var}.index.get_level_values(1)"
+
+        # Exclude assignment targets: var['instrument'] = ... must not become
+        # var.index.get_level_values(1) = ... (SyntaxError: cannot assign to function call)
+        fixed_code = re.sub(r"(\w+)\['instrument'\](?!\s*=)", _replace_instrument_access, fixed_code)
+
+        return fixed_code
+
+    def _fix_instrument_loc_multiindex(self, code: str) -> str:
+        """
+        Fix: df.loc[instrument_var] raises DateParseError on a (datetime, instrument)
+        MultiIndex because pandas tries to match the instrument string against the
+        datetime level (level 0).
+
+        Pattern detected: for-loops iterating over get_level_values('instrument') or
+        get_level_values(1) where the loop variable is then used as df.loc[loop_var].
+
+        Replacement: df.loc[instrument_var] → df.xs(instrument_var, level=1)
+        """
+        fixed_code = code
+
+        # Find variables iterated from get_level_values('instrument') or get_level_values(1)
+        inst_vars = set(
+            re.findall(
+                r"for\s+(\w+)\s+in\s+.+?\.get_level_values\s*\(\s*(?:1|['\"]instrument['\"])\s*\)[^:\n]*:",
+                code,
+            )
+        )
+
+        if not inst_vars:
+            return fixed_code
+
+        for var in inst_vars:
+            # Replace DF.loc[var] (read) with DF.xs(var, level=1)
+            # Exclude write-back patterns (DF.loc[var] = ...) — leave those as-is
+            def _make_replacer(v: str):
+                def _replace(m: re.Match) -> str:
+                    df_var = m.group(1)
+                    self.fixes_applied.append(
+                        f"instrument_loc: {df_var}.loc[{v}] → {df_var}.xs({v}, level=1)"
+                    )
+                    return f"{df_var}.xs({v}, level=1)"
+
+                return _replace
+
+            # Only match when NOT followed by ' =' (assignment)
+            fixed_code = re.sub(
+                rf"(\w+)\.loc\[\s*{re.escape(var)}\s*\](?!\s*=)",
+                _make_replacer(var),
+                fixed_code,
+            )
+
+        return fixed_code
+
+    def _fix_zero_volume_proxy(self, code: str) -> str:
+        """
+        Fix: $volume is always 0 in our EUR/USD dataset (FX has no real volume).
+        Any factor using $volume (VWAP, volume-weighted returns, etc.) produces
+        all-NaN output because 0*price=0 and sum(0)/sum(0)=NaN.
+
+        Insert a guard right after pd.read_hdf() that replaces zero volume with
+        the intraday price-range proxy ($high - $low) so volume-weighted factors
+        produce meaningful signals.
+        """
+        if "'$volume'" not in code and '"$volume"' not in code:
+            return code
+
+        # Already patched
+        if "volume proxy" in code:
+            return code
+
+        lines = code.splitlines()
+        insert_after = -1
+        df_var = "df"
+        indent = "    "
+
+        for i, line in enumerate(lines):
+            if "read_hdf(" in line:
+                m = re.match(r"(\s*)(\w+)\s*=\s*", line)
+                if m:
+                    indent = m.group(1)
+                    df_var = m.group(2)
+                else:
+                    m2 = re.match(r"(\s*)", line)
+                    indent = m2.group(1) if m2 else "    "
+                insert_after = i
+                break
+
+        if insert_after == -1:
+            return code
+
+        proxy_lines = [
+            f"{indent}# volume proxy: $volume is always 0 in FX data — use price-range as proxy",
+            f"{indent}if ({df_var}['$volume'] == 0).all():",
+            f"{indent}    {df_var}['$volume'] = {df_var}['$high'] - {df_var}['$low']",
+        ]
+        lines = lines[: insert_after + 1] + proxy_lines + lines[insert_after + 1 :]
+        self.fixes_applied.append("volume_proxy: replaced zero $volume with ($high - $low)")
+        return "\n".join(lines)
+
+    def _fix_reset_index_groupby(self, code: str) -> str:
+        """
+        Fix: groupby(level=N) on a variable created by .reset_index() fails because
+        reset_index() converts the MultiIndex into regular columns, leaving a plain
+        RangeIndex.  Replace groupby(level=N) on such variables with
+        groupby('instrument').
+
+        Detected pattern:
+            varname = <anything>.reset_index(...)
+            ...
+            varname.groupby(level=0|1)
+        """
+        fixed_code = code
+
+        # Find all variables assigned via reset_index()
+        reset_vars = set(re.findall(r'(\w+)\s*=\s*\w[^=\n]*\.reset_index\(', fixed_code))
+
+        for var in reset_vars:
+            # Replace var.groupby(level=N) with var.groupby('instrument')
+            pattern = rf'{re.escape(var)}\.groupby\(level\s*=\s*\d+\)'
+            if re.search(pattern, fixed_code):
+                fixed_code = re.sub(pattern, f"{var}.groupby('instrument')", fixed_code)
+                self.fixes_applied.append(f"reset_index_groupby: {var}.groupby(level=N) → groupby('instrument')")
+
+        return fixed_code
+
+    def _fix_groupby_mixed_levels(self, code: str) -> str:
+        """
+        Fix: groupby(level=[int, 'str']) raises AssertionError because string level
+        names don't exist on an unnamed MultiIndex.  Keep only integer levels.
+
+        Pattern:  .groupby(level=[0, 'date'])  →  .groupby(level=0)
+                  .groupby(level=[1, 'date'])  →  .groupby(level=1)
+        """
+        fixed_code = code
+
+        def _keep_int_levels(m):
+            inner = m.group(1)
+            ints = re.findall(r'\b(\d+)\b', inner)
+            if not ints:
+                return m.group(0)
+            replacement = f'.groupby(level={ints[0]})' if len(ints) == 1 else f'.groupby(level=[{", ".join(ints)}])'
+            self.fixes_applied.append(f"mixed_levels: groupby(level=[...,str]) → {replacement}")
+            return replacement
+
+        fixed_code = re.sub(r'\.groupby\(level=\[([^\]]+)\]\)', _keep_int_levels, fixed_code)
+        return fixed_code
+
+    def _fix_groupby_column_on_multiindex(self, code: str) -> str:
+        """
+        Fix: groupby(['instrument', 'date']) on a MultiIndex (datetime, instrument)
+        DataFrame fails with KeyError because those are index levels, not columns.
+
+        Correct replacement preserves BOTH dimensions so intraday calculations reset
+        per day:
+            var.groupby(['instrument', 'date'])
+            → var.groupby([var.index.get_level_values(1), var.index.get_level_values(0).normalize()])
+
+        Single-column groupby(['instrument']) is correctly replaced with groupby(level=1).
+        Note: do NOT convert groupby('instrument') → groupby(level=1) here — that would
+        undo the reset_index_groupby fix which correctly emits groupby('instrument').
+        """
+        fixed_code = code
+
+        # Variables created via reset_index() have a plain RangeIndex — applying
+        # get_level_values() on them would raise AttributeError. Skip those.
+        reset_vars = set(re.findall(r'(\w+)\s*=\s*\w[^=\n]*\.reset_index\(', fixed_code))
+
+        def _replace_two_col_groupby(m: re.Match, order: str) -> str:
+            var = m.group(1)
+            if var in reset_vars:
+                return m.group(0)  # leave reset_index vars alone — RangeIndex, not MultiIndex
+            if order == "instrument_date":
+                repl = (
+                    f"{var}.groupby([{var}.index.get_level_values(1), "
+                    f"{var}.index.get_level_values(0).normalize()])"
+                )
+            else:  # date_instrument
+                repl = (
+                    f"{var}.groupby([{var}.index.get_level_values(0).normalize(), "
+                    f"{var}.index.get_level_values(1)])"
+                )
+            self.fixes_applied.append(f"multiindex_groupby: {m.group(0)[:60]} → two-level")
+            return repl
+
+        # groupby(['instrument', 'date']) — capture variable name before .groupby
+        fixed_code = re.sub(
+            r'(\w+)\.groupby\(\[\'instrument\',\s*\'date\'\]\)',
+            lambda m: _replace_two_col_groupby(m, "instrument_date"),
+            fixed_code,
+        )
+        # groupby(['date', 'instrument'])
+        fixed_code = re.sub(
+            r'(\w+)\.groupby\(\[\'date\',\s*\'instrument\'\]\)',
+            lambda m: _replace_two_col_groupby(m, "date_instrument"),
+            fixed_code,
+        )
+        # single: groupby(['instrument']) → groupby(level=1), but not on reset_index vars
+        def _replace_single_instrument_groupby(m: re.Match) -> str:
+            # Look backwards to find the variable name
+            prefix = fixed_code[: m.start()]
+            var_match = re.search(r'(\w+)\s*$', prefix)
+            var = var_match.group(1) if var_match else ''
+            if var in reset_vars:
+                return m.group(0)
+            self.fixes_applied.append("multiindex_groupby: groupby(['instrument']) → groupby(level=1)")
+            return ".groupby(level=1)"
+
+        if re.search(r"\.groupby\(\['instrument'\]\)", fixed_code):
+            fixed_code = re.sub(r"\.groupby\(\['instrument'\]\)", _replace_single_instrument_groupby, fixed_code)
+
+        # groupby(level=['instrument', 'date']) — uses level= keyword with string names.
+        # 'date' is NOT a valid level name in our (datetime, instrument) MultiIndex;
+        # replace with get_level_values to normalize datetime to daily timestamps.
+        fixed_code = re.sub(
+            r"(\w+)\.groupby\(level=\['instrument',\s*'date'\]\)",
+            lambda m: (
+                self.fixes_applied.append(
+                    f"multiindex_groupby: {m.group(0)[:60]} → two-level get_level_values"
+                )
+                or f"{m.group(1)}.groupby([{m.group(1)}.index.get_level_values(1), "
+                f"{m.group(1)}.index.get_level_values(0).normalize()])"
+            ),
+            fixed_code,
+        )
+        # groupby(level=['date', 'instrument'])
+        fixed_code = re.sub(
+            r"(\w+)\.groupby\(level=\['date',\s*'instrument'\]\)",
+            lambda m: (
+                self.fixes_applied.append(
+                    f"multiindex_groupby: {m.group(0)[:60]} → two-level get_level_values"
+                )
+                or f"{m.group(1)}.groupby([{m.group(1)}.index.get_level_values(0).normalize(), "
+                f"{m.group(1)}.index.get_level_values(1)])"
+            ),
+            fixed_code,
+        )
+        # single: groupby(level=['instrument']) → groupby(level=1)
+        fixed_code = re.sub(
+            r"\.groupby\(level=\['instrument'\]\)",
+            lambda m: (self.fixes_applied.append("multiindex_groupby: groupby(level=['instrument']) → level=1") or ".groupby(level=1)"),
+            fixed_code,
+        )
+
+        return fixed_code
+
+    def _fix_chained_groupby(self, code: str) -> str:
+        """
+        Fix two broken patterns the LLM generates when trying to group by (instrument, date):
+
+        Pattern A — chained groupby (runtime AttributeError):
+            var.groupby(level=1).groupby('date')
+            → var.groupby([var.index.get_level_values(1),
+                           var.index.get_level_values(0).normalize()])
+
+        Pattern B — keyword arg inside list (SyntaxError):
+            var.groupby([level=1, 'date'])
+            → same two-level replacement
+        """
+        fixed_code = code
+
+        def _two_level(var: str, tag: str) -> str:
+            self.fixes_applied.append(f"chained_groupby: {tag} → two-level")
+            return (
+                f"{var}.groupby([{var}.index.get_level_values(1), "
+                f"{var}.index.get_level_values(0).normalize()])"
+            )
+
+        # Pattern A: var.groupby(level=N).groupby('date')
+        fixed_code = re.sub(
+            r'(\w+)\.groupby\(level=\d+\)\.groupby\(["\']date["\']\)',
+            lambda m: _two_level(m.group(1), m.group(0)[:60]),
+            fixed_code,
+        )
+
+        # Pattern B: .groupby([level=N, 'date']) — SyntaxError in Python.
+        # The variable before .groupby may be complex (e.g. df[mask]) so we don't
+        # try to capture it; we use df as the index reference (always correct since
+        # all filtered frames share df's MultiIndex structure).
+        def _two_level_df(tag: str) -> str:
+            self.fixes_applied.append(f"chained_groupby: {tag} → two-level")
+            return ".groupby([df.index.get_level_values(1), df.index.get_level_values(0).normalize()])"
+
+        fixed_code = re.sub(
+            r'\.groupby\(\[\s*level\s*=\s*\d+\s*,\s*["\']?date["\']?\s*\]\)',
+            lambda m: _two_level_df(m.group(0)[:60]),
+            fixed_code,
+        )
+        # Also handle reversed order: ['date', level=N]
+        fixed_code = re.sub(
+            r'\.groupby\(\[\s*["\']?date["\']?\s*,\s*level\s*=\s*\d+\s*\]\)',
+            lambda m: _two_level_df(m.group(0)[:60]),
+            fixed_code,
+        )
+
+        return fixed_code
+
+    def _fix_rolling_ddof(self, code: str) -> str:
+        """
+        Fix: pandas rolling() does not accept a ddof kwarg — raises TypeError.
+        Remove ddof from both rolling(..., ddof=N) and rolling(...).std(ddof=N).
+        """
+        fixed_code = code
+
+        # Form 1: ddof inside rolling() — .rolling(window=N, min_periods=M, ddof=K)
+        def _strip_ddof_from_rolling(m):
+            inner = re.sub(r',?\s*ddof\s*=\s*\d+', '', m.group(1))
+            inner = inner.strip(', ')
+            self.fixes_applied.append("rolling_ddof: removed ddof from rolling()")
+            return f'.rolling({inner})'
+
+        fixed_code = re.sub(r'\.rolling\(([^)]*ddof\s*=\s*\d+[^)]*)\)', _strip_ddof_from_rolling, fixed_code)
+
+        # Form 2: ddof inside .std() / .var() — .std(ddof=N)
+        if re.search(r'\.(std|var)\([^)]*ddof\s*=\s*\d+', fixed_code):
+            fixed_code = re.sub(r'\.(std|var)\([^)]*ddof\s*=\s*\d+[^)]*\)', r'.\1()', fixed_code)
+            self.fixes_applied.append("rolling_ddof: removed ddof from std()/var()")
+
+        return fixed_code
+
    def _fix_min_periods(self, code: str) -> str:
        """
        Fix: Ensure min_periods matches window size in rolling calculations.
@@ -325,6 +681,45 @@ class FactorAutoFixer:
            fixed_code = fixed_code.replace(old_code, new_code)
            self.fixes_applied.append(f"groupby: fixed rolling correlation (window={window}) with reset_index")

+        # === GENERAL FIX: DF.groupby(level=N)['col'].apply(lambda x: EXPR) ===
+        # apply() on a grouped Series returns a MultiIndex result (extra level prepended),
+        # causing index shape mismatch when assigned back to df['col'].
+        # Replace with transform() which preserves the original index.
+        col_apply_pattern = re.compile(
+            r"(\w+)\.groupby\(level=(\d+)\)\['([^']+)'\]\.apply\((\s*lambda\s+\w+\s*:.*?)\)",
+            re.DOTALL,
+        )
+        for m in list(col_apply_pattern.finditer(fixed_code)):
+            full = m.group(0)
+            df_var = m.group(1)
+            level = m.group(2)
+            col = m.group(3)
+            lam = m.group(4).strip()
+            new_expr = f"{df_var}.groupby(level={level})['{col}'].transform({lam})"
+            fixed_code = fixed_code.replace(full, new_expr, 1)
+            self.fixes_applied.append(
+                f"groupby: {df_var}.groupby(level={level})['{col}'].apply() → transform()"
+            )
+
+        # === FIX: .transform(...).reset_index(level=N, drop=True) ===
+        # transform() already returns the same index as the input — adding reset_index()
+        # after it drops an index level and causes ValueError on assignment back to df['col'].
+        # Detected line-by-line: if a line contains both .transform( and .reset_index(level=
+        reset_suffix = re.compile(r'\s*\.reset_index\s*\(\s*level\s*=[^,)]+,\s*drop\s*=\s*True\s*\)\s*$')
+        new_lines = []
+        changed = False
+        for line in fixed_code.splitlines():
+            if '.transform(' in line and '.reset_index(' in line:
+                cleaned = reset_suffix.sub('', line)
+                if cleaned != line:
+                    new_lines.append(cleaned)
+                    changed = True
+                    continue
+            new_lines.append(line)
+        if changed:
+            fixed_code = '\n'.join(new_lines)
+            self.fixes_applied.append("groupby: removed spurious .reset_index() after .transform()")
+
        # Pattern: Simple groupby().apply() with rolling().method()
        # df.groupby(level=N).apply(lambda x: x['col'].rolling(...).method())
        apply_pattern = r"df\.groupby\(level=(\d+)\)\.apply\(\s*lambda\s+x:\s+x\['([^']+)'\]\.rolling\([^)]+\)\.(\w+)\([^)]*\)\s*\)"
@@ -328,12 +328,13 @@ class FactorEqualValueRatioEvaluator(FactorEvaluator):
                "The source dataframe is None. Please check the implementation.",
                -1,
            )
+        acc_rate = -1
        try:
            close_values = gen_df.sub(gt_df).abs().lt(1e-6)
            result_int = close_values.astype(int)
            pos_num = result_int.sum().sum()
            acc_rate = pos_num / close_values.size
-        except:
+        except Exception:
            close_values = gen_df
        if close_values.all().iloc[0]:
            return (
@@ -161,8 +161,7 @@ class FactorFBWorkspace(FBWorkspace):

            try:
                subprocess.check_output(
-                    f"{FACTOR_COSTEER_SETTINGS.python_bin} {execution_code_path}",
-                    shell=True,
+                    [FACTOR_COSTEER_SETTINGS.python_bin, str(execution_code_path)],
                    cwd=self.workspace_path,
                    stderr=subprocess.STDOUT,
                    timeout=FACTOR_COSTEER_SETTINGS.file_based_execution_timeout,
@@ -53,7 +53,7 @@ evolving_strategy_factor_implementation_v1_system: |-
  - ALWAYS use `min_periods=N` where N equals the window size in rolling calculations (e.g., `.rolling(20, min_periods=20)`)
  - ALWAYS handle infinite values after division: `.replace([np.inf, -np.inf], np.nan)` before saving results
  - ALWAYS use `groupby(level=1)` or `groupby('instrument')` before rolling operations on MultiIndex dataframes
-  - Process the COMPLETE date range (2020-2026), do NOT filter by date
+  - Process the COMPLETE date range available in the HDF5 file (do NOT filter by date — the file may contain 2024 debug data or full 2020-2026 data)
  - Use `groupby().transform()` instead of `groupby().apply()` for single-column assignments

  Notice that you should not add any other text before or after the json format.
@@ -6,6 +6,7 @@ Two-step validation:
 2. Micro-batch testing - Runtime validation with small dataset
 """

+import ast
 import json
 import re
 import time
@@ -229,7 +230,7 @@ class LLMConfigValidator:
            final_metrics = re.search(r"\{'train_runtime':[^}]+\}", stdout)
            if final_metrics:
                try:
-                    metrics = eval(final_metrics.group(0))  # Safe: only numbers and strings
+                    metrics = ast.literal_eval(final_metrics.group(0))
                    result["final_metrics"] = {
                        "train_loss": metrics.get("train_loss"),
                        "train_runtime": metrics.get("train_runtime"),
@@ -123,8 +123,8 @@ model_cls = AntiSymmetricConv


 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)

    # Model instantiation and forward pass
    model = AntiSymmetricConv(in_channels=node_features.size(-1))
@@ -78,8 +78,8 @@ model_cls = DirGNNConv


 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)

    # Model instantiation and forward pass
    model = DirGNNConv(MessagePassing())
@@ -187,8 +187,8 @@ model_cls = GPSConv


 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)

    # Model instantiation and forward pass
    model = GPSConv(channels=node_features.size(-1), conv=MessagePassing())
@@ -170,8 +170,8 @@ class LINKX(torch.nn.Module):
 model_cls = LINKX

 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)

    # Model instantiation and forward pass
    model = LINKX(
@@ -102,8 +102,8 @@ class PMLP(torch.nn.Module):
 model_cls = PMLP

 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)

    # Model instantiation and forward pass
    model = PMLP(
@@ -1180,8 +1180,8 @@ model_cls = ViSNet


 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)

    # Model instantiation and forward pass
    model = ViSNet()
@@ -58,10 +58,12 @@ class ModelCodeEvaluator(CoSTEEREvaluator):
        model_execution_feedback: str = "",
        model_value_feedback: str = "",
    ):
-        assert isinstance(target_task, ModelTask)
-        assert isinstance(implementation, ModelFBWorkspace)
-        if gt_implementation is not None:
-            assert isinstance(gt_implementation, ModelFBWorkspace)
+        if not isinstance(target_task, ModelTask):
+            raise TypeError("target_task must be of type ModelTask")
+        if not isinstance(implementation, ModelFBWorkspace):
+            raise TypeError("implementation must be of type ModelFBWorkspace")
+        if gt_implementation is not None and not isinstance(gt_implementation, ModelFBWorkspace):
+            raise TypeError("gt_implementation must be of type ModelFBWorkspace")

        model_task_information = target_task.get_task_information()
        code = implementation.all_codes
@@ -113,10 +115,12 @@ class ModelFinalEvaluator(CoSTEEREvaluator):
        model_value_feedback: str,
        model_code_feedback: str,
    ):
-        assert isinstance(target_task, ModelTask)
-        assert isinstance(implementation, ModelFBWorkspace)
-        if gt_implementation is not None:
-            assert isinstance(gt_implementation, ModelFBWorkspace)
+        if not isinstance(target_task, ModelTask):
+            raise TypeError("target_task must be of type ModelTask")
+        if not isinstance(implementation, ModelFBWorkspace):
+            raise TypeError("implementation must be of type ModelFBWorkspace")
+        if gt_implementation is not None and not isinstance(gt_implementation, ModelFBWorkspace):
+            raise TypeError("gt_implementation must be of type ModelFBWorkspace")

        system_prompt = T(".prompts:evaluator_final_feedback.system").r(
            scenario=(
@@ -41,7 +41,8 @@ class ModelCoSTEEREvaluator(CoSTEEREvaluator):
                final_feedback="This task has failed too many times, skip implementation.",
                final_decision=False,
            )
-        assert isinstance(target_task, ModelTask)
+        if not isinstance(target_task, ModelTask):
+            raise TypeError(f"Expected ModelTask, got {type(target_task)}")

        # NOTE: Use fixed input to test the model to avoid randomness
        batch_size = 8
@@ -50,7 +51,8 @@ class ModelCoSTEEREvaluator(CoSTEEREvaluator):
        input_value = 0.4
        param_init_value = 0.6

-        assert isinstance(implementation, ModelFBWorkspace)
+        if not isinstance(implementation, ModelFBWorkspace):
+            raise TypeError(f"Expected ModelFBWorkspace, got {type(implementation)}")
        model_execution_feedback, gen_np_array = implementation.execute(
            batch_size=batch_size,
            num_features=num_features,
@@ -59,7 +61,8 @@ class ModelCoSTEEREvaluator(CoSTEEREvaluator):
            param_init_value=param_init_value,
        )
        if gt_implementation is not None:
-            assert isinstance(gt_implementation, ModelFBWorkspace)
+            if not isinstance(gt_implementation, ModelFBWorkspace):
+                raise TypeError(f"Expected ModelFBWorkspace, got {type(gt_implementation)}")
            _, gt_np_array = gt_implementation.execute(
                batch_size=batch_size,
                num_features=num_features,
@@ -125,8 +125,8 @@ class AntiSymmetricConv(torch.nn.Module):


 if __name__ == "__main__":
-    node_features = torch.load("node_features.pt")
-    edge_index = torch.load("edge_index.pt")
+    node_features = torch.load("node_features.pt", weights_only=True)
+    edge_index = torch.load("edge_index.pt", weights_only=True)

    # Model instantiation and forward pass
    model = AntiSymmetricConv(in_channels=node_features.size(-1))
@@ -1,700 +0,0 @@
-"""
-Predix Optuna Optimizer - Hyperparameter optimization for trading strategies.
-
-This module:
-1. Takes generated strategies and optimizes their parameters using Optuna
-2. Searches for optimal entry/exit thresholds, position sizing, etc.
-3. Validates optimized strategies to prevent overfitting
-4. Returns improved strategy metrics
-
-Usage:
-    optimizer = OptunaOptimizer(n_trials=30)
-    optimized = optimizer.optimize_strategy(strategy_result, factor_values)
-"""
-
-import logging
-import time
-from datetime import datetime
-from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
-
-import numpy as np
-import pandas as pd
-
-from rdagent.log import rdagent_logger as logger
-
-logger = logging.getLogger(__name__)
-
-try:
-    import optuna
-    OPTUNA_AVAILABLE = True
-except ImportError:
-    OPTUNA_AVAILABLE = False
-    logger.warning("Optuna not installed. Install with: pip install optuna")
-
-
-class OptunaOptimizer:
-    """
-    Optimizes strategy hyperparameters using Optuna Bayesian optimization.
-
-    Optimizes:
-    - Entry/exit signal thresholds
-    - Position sizing parameters
-    - Rolling window sizes
-    - Risk management parameters
-    """
-
-    def __init__(
-        self,
-        n_trials: int = 30,
-        timeout: Optional[int] = None,
-        n_jobs: int = 1,
-        optimization_metric: str = "sharpe",
-        results_dir: Optional[str] = None,
-    ):
-        """
-        Parameters
-        ----------
-        n_trials : int
-            Number of Optuna trials for optimization
-        timeout : int, optional
-            Maximum optimization time in seconds
-        n_jobs : int
-            Number of parallel jobs (-1 = all cores)
-        optimization_metric : str
-            Metric to optimize: 'sharpe', 'sortino', 'calmar', 'omega'
-        results_dir : str, optional
-            Path to save optimization results
-        """
-        if not OPTUNA_AVAILABLE:
-            raise ImportError("Optuna is required. Install with: pip install optuna")
-
-        self.n_trials = n_trials
-        self.timeout = timeout
-        self.n_jobs = n_jobs
-        self.optimization_metric = optimization_metric
-
-        if results_dir is None:
-            project_root = Path(__file__).parent.parent.parent.parent
-            self.results_dir = project_root / "results"
-        else:
-            self.results_dir = Path(results_dir)
-
-        self.optimization_dir = self.results_dir / "optimization"
-        self.optimization_dir.mkdir(parents=True, exist_ok=True)
-
-        logger.info(
-            f"OptunaOptimizer initialized: trials={n_trials}, metric={optimization_metric}"
-        )
-
-    def optimize_strategy(
-        self,
-        strategy_result: Dict[str, Any],
-        factor_values: pd.DataFrame,
-        forward_returns: Optional[pd.Series] = None,
-    ) -> Dict[str, Any]:
-        """
-        Optimiere eine einzelne Strategie mit mehrstufiger Suche (grob → fein).
-
-        STAGE 1: Grobe Suche mit weiten Bereichen (10 Trials)
-        STAGE 2: Feine Suche um die besten Stage-1-Parameter (15 Trials)
-        STAGE 3: Sehr feine lokale Suche (5 Trials)
-
-        Parameters
-        ----------
-        strategy_result : Dict[str, Any]
-            Strategy result from StrategyOrchestrator
-        factor_values : pd.DataFrame
-            DataFrame with factor values over time
-        forward_returns : pd.Series, optional
-            Forward returns for evaluation
-
-        Returns
-        -------
-        Dict[str, Any]
-            Optimized strategy result with best parameters
-        """
-        strategy_name = strategy_result.get("strategy_name", "Unknown")
-        logger.info(f"Starting multi-stage optimization for strategy: {strategy_name}")
-
-        # Speichere Referenzen für Objective-Methoden
-        self._current_strategy = strategy_result
-        self._current_factors = factor_values
-        self._current_forward_returns = forward_returns
-
-        # STAGE 1: Grobe Suche mit weiten Bereichen (10 Trials)
-        logger.info(f"Stage 1: Coarse search for {strategy_name}")
-        stage1_study = optuna.create_study(
-            direction="maximize",
-            sampler=optuna.samplers.TPESampler(seed=42),
-            pruner=optuna.pruners.MedianPruner(n_startup_trials=3, n_warmup_steps=5),
-        )
-        stage1_study.optimize(self._objective_coarse, n_trials=10, gc_after_trial=True)
-
-        best_stage1 = stage1_study.best_trial.params
-        best_stage1_value = stage1_study.best_trial.value
-        logger.info(
-            f"Stage 1 complete: best_value={best_stage1_value:.4f}, "
-            f"params={best_stage1}"
-        )
-
-        # STAGE 2: Feine Suche um die besten Stage-1-Parameter (15 Trials)
-        logger.info(f"Stage 2: Fine search around best params")
-        stage2_study = optuna.create_study(
-            direction="maximize",
-            sampler=optuna.samplers.TPESampler(seed=43),
-            pruner=optuna.pruners.MedianPruner(n_startup_trials=5, n_warmup_steps=5),
-        )
-        # Verwende beste Stage-1-Parameter als Zentrum für feine Suche
-        self._fine_search_center = best_stage1
-        stage2_study.optimize(self._objective_fine, n_trials=15, gc_after_trial=True)
-
-        best_stage2 = stage2_study.best_trial.params
-        best_stage2_value = stage2_study.best_trial.value
-        logger.info(
-            f"Stage 2 complete: best_value={best_stage2_value:.4f}, "
-            f"params={best_stage2}"
-        )
-
-        # STAGE 3: Sehr feine lokale Suche (5 Trials) - nur wenn Stage 2 besser war
-        if best_stage2_value > best_stage1_value:
-            logger.info(f"Stage 3: Very fine local search")
-            stage3_study = optuna.create_study(
-                direction="maximize",
-                sampler=optuna.samplers.TPESampler(seed=44),
-            )
-            self._very_fine_center = best_stage2
-            stage3_study.optimize(self._objective_very_fine, n_trials=5, gc_after_trial=True)
-
-            best_stage3_value = stage3_study.best_trial.value
-            logger.info(f"Stage 3 complete: best_value={best_stage3_value:.4f}")
-
-            # Bestes Trial über alle Stufen wählen
-            if best_stage3_value > best_stage2_value:
-                best_trial = stage3_study.best_trial
-            else:
-                best_trial = stage2_study.best_trial
-        else:
-            best_trial = stage1_study.best_trial
-
-        # Re-evaluate with best params
-        best_params = best_trial.params
-        best_metrics = self._evaluate_with_params(
-            strategy_result, factor_values, best_params, forward_returns
-        )
-
-        # Baue optimiertes Ergebnis
-        optimized_result = {
-            **strategy_result,
-            "status": "accepted" if self._is_acceptable(best_metrics) else "rejected",
-            "sharpe_ratio": best_metrics.get("sharpe_ratio", 0),
-            "annualized_return": best_metrics.get("annualized_return", 0),
-            "max_drawdown": best_metrics.get("max_drawdown", 0),
-            "win_rate": best_metrics.get("win_rate", 0),
-            "optimization_status": "success",
-            "best_params": best_params,
-            "optimization_stages": {
-                "stage1_best": best_stage1_value,
-                "stage2_best": best_stage2_value,
-                "stage3_best": best_stage3_value if best_stage2_value > best_stage1_value else None,
-            },
-            "optimization_trials": len(stage1_study.trials) + len(stage2_study.trials) + (
-                len(stage3_study.trials) if best_stage2_value > best_stage1_value else 0
-            ),
-            "optimization_history": {
-                "stage1": [t.value for t in stage1_study.trials if t.value is not None],
-                "stage2": [t.value for t in stage2_study.trials if t.value is not None],
-                "stage3": (
-                    [t.value for t in stage3_study.trials if t.value is not None]
-                    if best_stage2_value > best_stage1_value else []
-                ),
-            },
-            "optimized_at": datetime.now().isoformat(),
-        }
-
-        # Speichere Optimierungsergebnisse
-        self._save_optimization_results(optimized_result, strategy_name)
-
-        logger.info(
-            f"Multi-stage optimization complete for {strategy_name}: "
-            f"best_metric={best_trial.value:.4f}, status={optimized_result['status']}"
-        )
-
-        return optimized_result
-
-    def optimize_batch(
-        self,
-        strategies: List[Dict[str, Any]],
-        factor_values: pd.DataFrame,
-        forward_returns: Optional[pd.Series] = None,
-        progress_callback=None,
-    ) -> List[Dict[str, Any]]:
-        """
-        Optimize multiple strategies in batch.
-
-        Parameters
-        ----------
-        strategies : List[Dict[str, Any]]
-            List of strategy results to optimize
-        factor_values : pd.DataFrame
-            Factor values for all strategies
-        forward_returns : pd.Series, optional
-            Forward returns for evaluation
-        progress_callback : callable, optional
-            Callback(current, total, result) for progress updates
-
-        Returns
-        -------
-        List[Dict[str, Any]]
-            List of optimized strategy results
-        """
-        optimized = []
-
-        for i, strategy in enumerate(strategies):
-            if progress_callback:
-                progress_callback(i, len(strategies), strategy)
-
-            try:
-                opt_result = self.optimize_strategy(strategy, factor_values, forward_returns)
-                optimized.append(opt_result)
-            except Exception as e:
-                logger.error(f"Failed to optimize strategy {strategy.get('strategy_name', i)}: {e}")
-                optimized.append({
-                    **strategy,
-                    "optimization_status": "failed",
-                    "error": str(e),
-                })
-
-        return optimized
-
-    def _sample_coarse_params(self, trial: optuna.Trial) -> Dict[str, Any]:
-        """
-        Weite Bereiche für initiale Exploration (Stage 1).
-
-        Parameters
-        ----------
-        trial : optuna.Trial
-            Current Optuna trial
-
-        Returns
-        -------
-        Dict[str, Any]
-            Sampled hyperparameters with wide ranges
-        """
-        return {
-            "entry_threshold": trial.suggest_float("entry_threshold", 0.1, 3.0, step=0.1),
-            "exit_threshold": trial.suggest_float("exit_threshold", 0.0, 1.5, step=0.1),
-            "zscore_window": trial.suggest_int("zscore_window", 5, 500, step=5),
-            "signal_window": trial.suggest_int("signal_window", 1, 30, step=1),
-            "position_size_pct": trial.suggest_float("position_size_pct", 0.05, 1.0, step=0.05),
-            "stop_loss_mult": trial.suggest_float("stop_loss_mult", 0.5, 15.0, step=0.5),
-            "take_profit_mult": trial.suggest_float("take_profit_mult", 1.0, 20.0, step=0.5),
-            "volatility_lookback": trial.suggest_int("volatility_lookback", 5, 500, step=5),
-            "signal_bias": trial.suggest_float("signal_bias", -1.0, 1.0, step=0.05),
-            "max_hold_bars": trial.suggest_int("max_hold_bars", 5, 1000, step=5),
-        }
-
-    # Parameters that are allowed to be negative (not clamped to 0).
-    _SIGNED_PARAMS = {"signal_bias"}
-    # Absolute lower bounds per parameter (applied after the center-half_width calc).
-    _PARAM_FLOOR: Dict[str, float] = {
-        "entry_threshold": 0.0,
-        "exit_threshold": 0.0,
-        "zscore_window": 1.0,
-        "signal_window": 1.0,
-        "position_size_pct": 0.01,
-        "stop_loss_mult": 0.1,
-        "take_profit_mult": 0.1,
-        "volatility_lookback": 1.0,
-        "signal_bias": -1.0,
-        "max_hold_bars": 1.0,
-    }
-
-    def _suggest_bounded(
-        self,
-        trial: optuna.Trial,
-        key: str,
-        center_val: float,
-        half_width: float,
-    ) -> Any:
-        """Suggest a parameter value with safe bounds that never invert."""
-        floor = self._PARAM_FLOOR.get(key, -float("inf"))
-        is_int = "window" in key or "lookback" in key or "bars" in key
-        if is_int:
-            low = max(int(floor), int(center_val - half_width))
-            high = max(low + 1, int(center_val + half_width))
-            return trial.suggest_int(key, low, high)
-        else:
-            low = max(floor, center_val - half_width)
-            high = center_val + half_width
-            if high <= low:
-                high = low + max(1e-4, half_width * 0.1)
-            return trial.suggest_float(key, low, high)
-
-    def _sample_fine_params(self, trial: optuna.Trial) -> Dict[str, Any]:
-        """
-        Enge Bereiche zentriert um die besten Stage-1-Parameter (Stage 2).
-
-        Parameters
-        ----------
-        trial : optuna.Trial
-            Current Optuna trial
-
-        Returns
-        -------
-        Dict[str, Any]
-            Sampled hyperparameters with narrow ranges around Stage 1 best
-        """
-        center = getattr(self, "_fine_search_center", {})
-        ranges: Dict[str, Tuple[float, float]] = {
-            "entry_threshold": (center.get("entry_threshold", 1.0), 0.3),
-            "exit_threshold": (center.get("exit_threshold", 0.3), 0.2),
-            "zscore_window": (center.get("zscore_window", 50), 20),
-            "signal_window": (center.get("signal_window", 3), 5),
-            "position_size_pct": (center.get("position_size_pct", 0.5), 0.15),
-            "stop_loss_mult": (center.get("stop_loss_mult", 5.0), 2.0),
-            "take_profit_mult": (center.get("take_profit_mult", 5.0), 2.0),
-            "volatility_lookback": (center.get("volatility_lookback", 100), 30),
-            "signal_bias": (center.get("signal_bias", 0.0), 0.2),
-            "max_hold_bars": (center.get("max_hold_bars", 100), 50),
-        }
-        return {key: self._suggest_bounded(trial, key, c, hw) for key, (c, hw) in ranges.items()}
-
-    def _sample_very_fine_params(self, trial: optuna.Trial) -> Dict[str, Any]:
-        """
-        Sehr enge Bereiche für finale Verfeinerung (Stage 3).
-
-        Parameters
-        ----------
-        trial : optuna.Trial
-            Current Optuna trial
-
-        Returns
-        -------
-        Dict[str, Any]
-            Sampled hyperparameters with very narrow ranges around Stage 2 best
-        """
-        center = getattr(
-            self, "_very_fine_center", getattr(self, "_fine_search_center", {})
-        )
-        ranges: Dict[str, Tuple[float, float]] = {
-            "entry_threshold": (center.get("entry_threshold", 1.0), 0.1),
-            "exit_threshold": (center.get("exit_threshold", 0.3), 0.07),
-            "zscore_window": (center.get("zscore_window", 50), 7),
-            "signal_window": (center.get("signal_window", 3), 2),
-            "position_size_pct": (center.get("position_size_pct", 0.5), 0.05),
-            "stop_loss_mult": (center.get("stop_loss_mult", 5.0), 0.7),
-            "take_profit_mult": (center.get("take_profit_mult", 5.0), 0.7),
-            "volatility_lookback": (center.get("volatility_lookback", 100), 10),
-            "signal_bias": (center.get("signal_bias", 0.0), 0.07),
-            "max_hold_bars": (center.get("max_hold_bars", 100), 17),
-        }
-        return {key: self._suggest_bounded(trial, key, c, hw) for key, (c, hw) in ranges.items()}
-
-    def _objective_coarse(self, trial: optuna.Trial) -> float:
-        """Objective-Funktion für Stage 1 (grobe Suche)."""
-        try:
-            params = self._sample_coarse_params(trial)
-            metrics = self._evaluate_with_params(
-                self._current_strategy, self._current_factors, params, self._current_forward_returns
-            )
-            return self._extract_metric(metrics, self.optimization_metric)
-        except Exception as e:
-            logger.warning(f"Stage 1 trial {trial.number} failed: {e}")
-            return float("-inf")
-
-    def _objective_fine(self, trial: optuna.Trial) -> float:
-        """Objective-Funktion für Stage 2 (feine Suche)."""
-        try:
-            params = self._sample_fine_params(trial)
-            metrics = self._evaluate_with_params(
-                self._current_strategy, self._current_factors, params, self._current_forward_returns
-            )
-            return self._extract_metric(metrics, self.optimization_metric)
-        except Exception as e:
-            logger.warning(f"Stage 2 trial {trial.number} failed: {e}")
-            return float("-inf")
-
-    def _objective_very_fine(self, trial: optuna.Trial) -> float:
-        """Objective-Funktion für Stage 3 (sehr feine Suche)."""
-        try:
-            params = self._sample_very_fine_params(trial)
-            metrics = self._evaluate_with_params(
-                self._current_strategy, self._current_factors, params, self._current_forward_returns
-            )
-            return self._extract_metric(metrics, self.optimization_metric)
-        except Exception as e:
-            logger.warning(f"Stage 3 trial {trial.number} failed: {e}")
-            return float("-inf")
-
-    def _sample_hyperparameters(self, trial: optuna.Trial) -> Dict[str, Any]:
-        """
-        Sample hyperparameters for a trial.
-
-        Parameters
-        ----------
-        trial : optuna.Trial
-            Current Optuna trial
-
-        Returns
-        -------
-        Dict[str, Any]
-            Sampled hyperparameters
-        """
-        params = {
-            # Entry/exit thresholds (wider range for better optimization)
-            "entry_threshold": trial.suggest_float("entry_threshold", 0.3, 2.0, step=0.1),
-            "exit_threshold": trial.suggest_float("exit_threshold", 0.0, 1.0, step=0.1),
-
-            # Rolling window for z-score normalization
-            "zscore_window": trial.suggest_int("zscore_window", 10, 200, step=10),
-
-            # Rolling window for signal smoothing
-            "signal_window": trial.suggest_int("signal_window", 1, 15, step=1),
-
-            # Position sizing
-            "position_size_pct": trial.suggest_float("position_size_pct", 0.1, 1.0, step=0.1),
-
-            # Stop loss / take profit (in terms of factor std)
-            "stop_loss_mult": trial.suggest_float("stop_loss_mult", 1.0, 10.0, step=0.5),
-            "take_profit_mult": trial.suggest_float("take_profit_mult", 1.5, 15.0, step=0.5),
-
-            # Volatility adjustment
-            "volatility_lookback": trial.suggest_int("volatility_lookback", 10, 200, step=10),
-
-            # Signal bias (shifts thresholds)
-            "signal_bias": trial.suggest_float("signal_bias", -0.5, 0.5, step=0.1),
-
-            # Max holding periods (in bars)
-            "max_hold_bars": trial.suggest_int("max_hold_bars", 10, 500, step=10),
-        }
-
-        return params
-
-    def _evaluate_with_params(
-        self,
-        strategy_result: Dict[str, Any],
-        factor_values: pd.DataFrame,
-        params: Dict[str, Any],
-        forward_returns: Optional[pd.Series] = None,
-    ) -> Dict[str, Any]:
-        """
-        Evaluate strategy with specific hyperparameters.
-
-        This method:
-        1. Uses the ORIGINAL strategy code from the LLM
-        2. Overrides key parameters (thresholds, windows) via exec
-        3. Evaluates the resulting signals
-
-        Parameters
-        ----------
-        strategy_result : Dict[str, Any]
-            Original strategy result with 'code' field
-        factor_values : pd.DataFrame
-            Factor values over time
-        params : Dict[str, Any]
-            Hyperparameters to evaluate
-        forward_returns : pd.Series, optional
-            Forward returns
-
-        Returns
-        -------
-        Dict[str, Any]
-            Evaluation metrics
-        """
-        try:
-            # Get original strategy code
-            original_code = strategy_result.get("code", "")
-
-            # Get factor weights if available
-            factors_used = strategy_result.get("factors_used", list(factor_values.columns))
-            available_factors = [f for f in factors_used if f in factor_values.columns]
-
-            if not available_factors:
-                return self._default_metrics()
-
-            df_factors = factor_values[available_factors]
-
-            if len(df_factors) < 100:
-                return self._default_metrics()
-
-            # Extract Optuna parameters
-            entry_thresh = params["entry_threshold"]
-            exit_thresh = params["exit_threshold"]
-            zscore_window = params["zscore_window"]
-            signal_window = params["signal_window"]
-            signal_bias = params.get("signal_bias", 0.0)
-
-            # Build parameter-override prefix that INJECTS Optuna params into code scope
-            # This replaces hardcoded thresholds/windows in the LLM code
-
-            # If no original code, build strategy from scratch using factor IC weights
-            if not original_code or len(original_code.strip()) < 20:
-                df_norm = (df_factors - df_factors.rolling(zscore_window).mean()) / (df_factors.rolling(zscore_window).std() + 1e-8)
-
-                ic_weights = strategy_result.get("ic_weights", [])
-                if len(ic_weights) == len(available_factors):
-                    weighted_sum = sum(
-                        w * df_norm[col] for col, w in zip(available_factors, ic_weights)
-                    )
-                else:
-                    weighted_sum = df_norm.mean(axis=1)
-
-                signal = pd.Series(0.0, index=df_factors.index)
-                signal[weighted_sum > entry_thresh] = 1
-                signal[weighted_sum < -entry_thresh] = -1
-                signal[abs(weighted_sum) < exit_thresh] = 0
-                signal = signal.rolling(window=signal_window, min_periods=1).mean().round().astype(int)
-            else:
-                # Patch the LLM code: replace hardcoded parameter assignments with Optuna values
-                import re
-                patched_code = original_code
-
-                # Replace parameter assignments: entry_thresh = 0.8 → entry_thresh = 1.2
-                param_patterns = [
-                    (r'entry_thresh\s*=\s*[\d.]+', f'entry_thresh = {entry_thresh}'),
-                    (r'exit_thresh\s*=\s*[\d.]+', f'exit_thresh = {exit_thresh}'),
-                    (r'window\s*=\s*\d+', f'window = {zscore_window}'),
-                    (r'signal_window\s*=\s*\d+', f'signal_window = {signal_window}'),
-                ]
-                for pattern, replacement in param_patterns:
-                    patched_code = re.sub(pattern, replacement, patched_code)
-
-                # Also handle inline .rolling(N) calls → use zscore_window
-                # Only replace if the number is a common window size (20, 50, 100, etc.)
-                rolling_pattern = r'\.rolling\((\d+)\)'
-                def replace_rolling(match):
-                    val = int(match.group(1))
-                    if val in (20, 30, 50, 100, 200):
-                        return f'.rolling({zscore_window})'
-                    return match.group(0)
-                patched_code = re.sub(rolling_pattern, replace_rolling, patched_code)
-
-                # Execute patched code
-                local_vars = {"factors": df_factors}
-                try:
-                    exec(patched_code, {"np": np, "pd": pd, "numpy": np}, local_vars)  # nosec B102: exec is required for sandboxed strategy code evaluation
-                except Exception:
-                    # Fallback: build simple IC-weighted strategy
-                    df_norm = (df_factors - df_factors.rolling(zscore_window).mean()) / (df_factors.rolling(zscore_window).std() + 1e-8)
-                    combined = df_norm.mean(axis=1)
-                    signal = pd.Series(0, index=combined.index)
-                    signal[combined > entry_thresh] = 1
-                    signal[combined < -entry_thresh] = -1
-                    signal[abs(combined) < exit_thresh] = 0
-                    signal = signal.rolling(window=signal_window, min_periods=1).mean().round().astype(int)
-                    local_vars["signal"] = signal
-
-                signal = local_vars.get("signal")
-
-            if signal is None or len(signal) < 10:
-                return self._default_metrics()
-
-            # Ensure signal is aligned
-            signal = signal.reindex(df_factors.index).fillna(0).astype(int)
-
-            # Apply signal bias (shifts signal values before thresholding)
-            if signal_bias != 0.0:
-                signal = (signal.astype(float) + signal_bias).round().astype(int).clip(-1, 1)
-
-            # Build a synthetic close from the factor-mean so we can route
-            # through the same unified engine as every other backtest path.
-            # Backtest formulas must match the orchestrator's real-OHLCV path.
-            combined = df_factors.mean(axis=1)
-            combined_ret = combined.pct_change().fillna(0)
-            synthetic_close = (1 + combined_ret).cumprod() * 100.0
-
-            from rdagent.components.backtesting.vbt_backtest import (
-                backtest_signal,
-                DEFAULT_TXN_COST_BPS,
-            )
-            import os as _os
-
-            bt = backtest_signal(
-                close=synthetic_close,
-                signal=signal,
-                txn_cost_bps=float(_os.getenv("TXN_COST_BPS", DEFAULT_TXN_COST_BPS)),
-                freq="1min",
-            )
-            if bt.get("status") != "success":
-                return self._default_metrics()
-
-            return {
-                "sharpe_ratio": bt["sharpe"],
-                "annualized_return": bt["annualized_return"],
-                "max_drawdown": bt["max_drawdown"],
-                "win_rate": bt["win_rate"],
-                "volatility": bt["volatility"],
-                "total_return": bt["total_return"],
-                "num_trades": bt["n_trades"],
-            }
-
-        except Exception as e:
-            logger.debug(f"Evaluation failed with params {params}: {e}")
-            return self._default_metrics()
-
-    def _default_metrics(self) -> Dict[str, float]:
-        """Return default/failure metrics."""
-        return {
-            "sharpe_ratio": float("-inf"),
-            "annualized_return": 0.0,
-            "max_drawdown": 0.0,
-            "win_rate": 0.0,
-            "volatility": 0.0,
-            "total_return": 0.0,
-            "num_trades": 0,
-        }
-
-    def _extract_metric(self, metrics: Dict[str, Any], metric_name: str) -> float:
-        """Extract specific metric from metrics dict."""
-        metric_map = {
-            "sharpe": metrics.get("sharpe_ratio", float("-inf")),
-            "sortino": self._calculate_sortino(metrics),
-            "calmar": self._calculate_calmar(metrics),
-            "omega": self._calculate_omega(metrics),
-        }
-        return metric_map.get(metric_name, metrics.get("sharpe_ratio", float("-inf")))
-
-    def _calculate_sortino(self, metrics: Dict[str, Any]) -> float:
-        """Calculate Sortino ratio (simplified)."""
-        sharpe = metrics.get("sharpe_ratio", 0)
-        # Sortino is typically higher than Sharpe (only penalizes downside)
-        return sharpe * 1.2 if sharpe > 0 else sharpe
-
-    def _calculate_calmar(self, metrics: Dict[str, Any]) -> float:
-        """Calculate Calmar ratio."""
-        ann_return = metrics.get("annualized_return", 0)
-        max_dd = abs(metrics.get("max_drawdown", 0.01))
-        return ann_return / max_dd if max_dd > 0 else 0.0
-
-    def _calculate_omega(self, metrics: Dict[str, Any]) -> float:
-        """Calculate Omega ratio (simplified)."""
-        win_rate = metrics.get("win_rate", 0.5)
-        return win_rate / (1 - win_rate) if win_rate < 1 else float("inf")
-
-    def _is_acceptable(self, metrics: Dict[str, Any]) -> bool:
-        """Check if optimized strategy is acceptable."""
-        sharpe = metrics.get("sharpe_ratio", 0)
-        max_dd = metrics.get("max_drawdown", 0)
-        win_rate = metrics.get("win_rate", 0)
-
-        return sharpe >= 0.3 and max_dd >= -0.30 and win_rate >= 0.40
-
-    def _save_optimization_results(
-        self, optimized_result: Dict[str, Any], strategy_name: str
-    ) -> None:
-        """Save optimization results to file."""
-        import json
-
-        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-        safe_name = strategy_name.replace("/", "_").replace(" ", "_")[:60]
-        filename = f"opt_{safe_name}_{timestamp}.json"
-        filepath = self.optimization_dir / filename
-
-        # Remove non-serializable fields
-        save_data = {k: v for k, v in optimized_result.items() if k != "code"}
-
-        with open(filepath, "w", encoding="utf-8") as f:
-            json.dump(save_data, f, indent=2, default=str, ensure_ascii=False)
-
-        logger.debug(f"Saved optimization results to {filepath}")
@@ -85,13 +85,16 @@ def load_and_process_one_pdf_by_azure_document_intelligence(


 def load_and_process_pdfs_by_azure_document_intelligence(path: Path) -> dict[str, str]:
-    assert RD_AGENT_SETTINGS.azure_document_intelligence_key is not None
-    assert RD_AGENT_SETTINGS.azure_document_intelligence_endpoint is not None
+    if RD_AGENT_SETTINGS.azure_document_intelligence_key is None:
+        raise AssertionError("azure_document_intelligence_key must be set")
+    if RD_AGENT_SETTINGS.azure_document_intelligence_endpoint is None:
+        raise AssertionError("azure_document_intelligence_endpoint must be set")

    content_dict = {}
    ab_path = path.resolve()
    if ab_path.is_file():
-        assert ".pdf" in ab_path.suffixes, "The file must be a PDF file."
+        if ".pdf" not in ab_path.suffixes:
+            raise ValueError("The file must be a PDF file.")
        proc = load_and_process_one_pdf_by_azure_document_intelligence
        content_dict[str(ab_path)] = proc(
            ab_path,
@@ -24,7 +24,8 @@ class UndirectedNode(Node):
        super().__init__(content, label, embedding)
        self.neighbors: set[UndirectedNode] = set()
        self.appendix = appendix  # appendix stores any additional information
-        assert isinstance(content, str), "content must be a string"
+        if not isinstance(content, str):
+            raise TypeError("content must be a string")

    def add_neighbor(self, node: UndirectedNode) -> None:
        self.neighbors.add(node)
@@ -96,7 +97,8 @@ class Graph(KnowledgeBase):
                APIBackend().create_embedding(input_content=contents[i : i + size]),
            )

-        assert len(nodes) == len(embeddings), "nodes' length must equals embeddings' length"
+        if len(nodes) != len(embeddings):
+            raise ValueError("nodes' length must equal embeddings' length")
        for node, embedding in zip(nodes, embeddings):
            node.embedding = embedding
        return nodes
@@ -252,7 +254,8 @@ class UndirectedGraph(Graph):

        """
        min_nodes_count = 2
-        assert len(nodes) >= min_nodes_count, "nodes length must >=2"
+        if len(nodes) < min_nodes_count:
+            raise ValueError("nodes length must >=2")
        intersection = None

        for node in nodes:
@@ -87,7 +87,8 @@ class ModelWsLoader(WsLoader[ModelTask, ModelFBWorkspace]):
        self.path = Path(path)

    def load(self, task: ModelTask) -> ModelFBWorkspace:
-        assert task.name is not None
+        if task.name is None:
+            raise AssertionError("task.name should not be None")
        mti = ModelFBWorkspace(task)
        mti.prepare()
        with open(self.path / f"{task.name}.py", "r") as f:
@@ -4,6 +4,7 @@ import functools
 import importlib
 import json
 import multiprocessing as mp
+import os
 import pickle
 import random
 from collections.abc import Callable
@@ -82,10 +83,24 @@ def import_class(class_path: str) -> Any:
    Returns
    -------
        class of `class_path`
+
+    Raises
+    ------
+    ImportError
+        If module or class cannot be found.
    """
-    module_path, class_name = class_path.rsplit(".", 1)
-    module = importlib.import_module(module_path)
-    return getattr(module, class_name)
+    try:
+        module_path, class_name = class_path.rsplit(".", 1)
+    except ValueError:
+        raise ImportError(f"Invalid class path: {class_path!r}")
+    try:
+        module = importlib.import_module(module_path)
+    except ModuleNotFoundError as e:
+        raise ImportError(f"Module not found: {module_path!r}") from e
+    try:
+        return getattr(module, class_name)
+    except AttributeError as e:
+        raise ImportError(f"Class not found: {class_name!r} in {module_path!r}") from e


 class CacheSeedGen:
@@ -208,3 +223,29 @@ def cache_with_pickle(hash_func: Callable, post_process_func: Callable | None =
        return cache_wrapper

    return cache_decorator
+
+
+def safe_resolve_path(user_path: Path | str, safe_root: Path | str | None = None) -> Path:
+    """Resolve a user-provided path safely against an allowed root directory.
+
+    Args:
+        user_path: Path provided by user/LLM/config
+        safe_root: If provided, the resolved path must be within this directory
+
+    Raises:
+        ValueError: If path resolves outside safe_root
+        OSError: If path cannot be resolved
+    """
+    resolved = Path(user_path).expanduser().resolve()
+
+    if safe_root is not None:
+        root_resolved = Path(safe_root).expanduser().resolve()
+        try:
+            resolved.relative_to(root_resolved)
+        except ValueError:
+            raise ValueError(
+                f"Path {user_path} resolves to {resolved}, "
+                f"outside allowed root {root_resolved}"
+            )
+
+    return resolved
@@ -27,6 +27,7 @@ Usage:
 from __future__ import annotations

 import json as _json
+import logging
 import sys
 import threading
 from contextlib import contextmanager
@@ -36,21 +37,24 @@ from typing import Any

 from loguru import logger as _root

-# ── paths ─────────────────────────────────────────────────────────────────────
+# ── paths ─────────────────────────────────────────────────────────────────────────────────
 LOGS_ROOT: Path = Path(__file__).parent.parent.parent / "logs"

-# ── format ────────────────────────────────────────────────────────────────────
+# ── format ────────────────────────────────────────────────────────────────────────────────
 _FILE_FMT = (
    "{time:YYYY-MM-DD HH:mm:ss.SSS} | {level: <8} | {extra[cmd]: <18} | {message}"
 )

-# ── internal state ─────────────────────────────────────────────────────────────
+# ── internal state ─────────────────────────────────────────────────────────────────────────────
 _registered: set[str] = set()   # command keys that already have a file sink
 _all_added: bool = False         # whether the combined all.log sink is active
 _llm_log_lock = threading.Lock()  # guards concurrent writes to llm_calls.jsonl

+# Maximum characters stored per field in llm_calls.jsonl to prevent GB-scale files.
+_LLM_CALL_MAX_CHARS = 500

-# ── helpers ───────────────────────────────────────────────────────────────────
+
+# ── helpers ────────────────────────────────────────────────────────────────────────────────

 def _today_dir() -> Path:
    d = LOGS_ROOT / datetime.now().strftime("%Y-%m-%d")
@@ -79,7 +83,7 @@ def _banner(log, title: str, meta: dict[str, Any]) -> None:
    log.info(sep)


-# ── public API ────────────────────────────────────────────────────────────────
+# ── public API ──────────────────────────────────────────────────────────────────────────────

 def log_llm_call(
    system: str | None,
@@ -88,16 +92,19 @@ def log_llm_call(
    start_time: Any = None,
    end_time: Any = None,
 ) -> None:
-    """Append one complete LLM call to logs/YYYY-MM-DD/llm_calls.jsonl.
+    """Append one LLM call summary to logs/YYYY-MM-DD/llm_calls.jsonl.
+
+    Prompt/response content is capped at _LLM_CALL_MAX_CHARS to prevent
+    GB-scale log files from long-running loops.

    Each line is a self-contained JSON object so the file is grep/jq-friendly:
      jq 'select(.duration_ms > 5000)' logs/2026-04-17/llm_calls.jsonl
    """
    entry: dict[str, Any] = {
        "ts": datetime.now().isoformat(timespec="milliseconds"),
-        "system": system or "",
-        "user": user,
-        "response": response,
+        "system": (system or "")[:_LLM_CALL_MAX_CHARS],
+        "user": user[:_LLM_CALL_MAX_CHARS],
+        "response": response[:_LLM_CALL_MAX_CHARS],
    }
    if start_time is not None and end_time is not None:
        try:
@@ -130,13 +137,13 @@ def setup(command: str, **context: Any):
    key = command.lower()

    if key not in _registered:
-        # Per-command rotating file
        _root.add(
            str(log_dir / f"{key}.log"),
            format=_FILE_FMT,
            filter=lambda r, k=key: r["extra"].get("cmd", "").lower() == k,
-            rotation="00:00",      # new file at midnight
-            retention="30 days",
+            rotation="50 MB",
+            compression="gz",
+            retention="7 days",
            encoding="utf-8",
            enqueue=True,
            backtrace=False,
@@ -145,13 +152,13 @@ def setup(command: str, **context: Any):
        _registered.add(key)

    if not _all_added:
-        # Combined log — all commands
        _root.add(
            str(log_dir / "all.log"),
            format=_FILE_FMT,
            filter=lambda r: "cmd" in r["extra"],
-            rotation="00:00",
-            retention="60 days",
+            rotation="100 MB",
+            compression="gz",
+            retention="7 days",
            encoding="utf-8",
            enqueue=True,
            backtrace=False,
@@ -0,0 +1,306 @@
+import argparse
+import json
+import pickle  # nosec
+import re
+import time
+from pathlib import Path
+
+import streamlit as st
+from streamlit import session_state
+
+from rdagent.log.ui.conf import UI_SETTING
+from rdagent.log.utils import extract_evoid, extract_loopid_func_name
+
+st.set_page_config(layout="wide", page_title="debug_llm", page_icon="🎓", initial_sidebar_state="expanded")
+
+# 获取 log_path 参数
+parser = argparse.ArgumentParser(description="RD-Agent Streamlit App")
+parser.add_argument("--log_dir", type=str, help="Path to the log directory")
+args = parser.parse_args()
+
+
+def get_folders_sorted(log_path):
+    """缓存并返回排序后的文件夹列表，并加入进度打印"""
+    with st.spinner("正在加载文件夹列表..."):
+        folders = sorted(
+            (folder for folder in log_path.iterdir() if folder.is_dir() and list(folder.iterdir())),
+            key=lambda folder: folder.stat().st_mtime,
+            reverse=True,
+        )
+        st.write(f"找到 {len(folders)} 个文件夹")
+    return [folder.name for folder in folders]
+
+
+if UI_SETTING.enable_cache:
+    get_folders_sorted = st.cache_data(get_folders_sorted)
+
+
+# 设置主日志路径
+main_log_path = Path(args.log_dir) if args.log_dir else Path("./log")
+if not main_log_path.exists():
+    st.error(f"Log dir {main_log_path} does not exist!")
+    st.stop()
+
+if "data" not in session_state:
+    session_state.data = []
+if "log_path" not in session_state:
+    session_state.log_path = None
+
+tlist = []
+
+
+def load_data():
+    """加载数据到 session_state 并显示进度"""
+    log_file = main_log_path / session_state.log_path / "debug_llm.pkl"
+    try:
+        with st.spinner(f"正在加载数据文件 {log_file}..."):
+            start_time = time.time()
+            with open(log_file, "rb") as f:
+                session_state.data = pickle.load(f, encoding="utf-8")  # nosec
+            st.success(f"数据加载完成！耗时 {time.time() - start_time:.2f} 秒")
+            st.session_state["current_loop"] = 1
+    except Exception as e:
+        session_state.data = [{"error": str(e)}]
+        st.error(f"加载数据失败: {e}")
+
+
+# UI - Sidebar
+with st.sidebar:
+    st.markdown(":blue[**Log Path**]")
+    manually = st.toggle("Manual Input")
+    if manually:
+        st.text_input("log path", key="log_path", label_visibility="collapsed")
+    else:
+        folders = get_folders_sorted(main_log_path)
+        st.selectbox(f"**Select from {main_log_path.absolute()}**", folders, key="log_path")  # nosec B608 — not SQL, Bandit false positive on "Select" in UI label
+
+    if st.button("Refresh Data"):
+        load_data()
+        st.rerun()
+
+
+# Helper functions
+def show_text(text, lang=None):
+    """显示文本代码块"""
+    if lang:
+        st.code(text, language=lang, wrap_lines=True)
+    elif "\n" in text:
+        st.code(text, language="python", wrap_lines=True)
+    else:
+        st.code(text, language="html", wrap_lines=True)
+
+
+def highlight_prompts_uri(uri):
+    """高亮 URI 的格式"""
+    parts = uri.split(":")
+    return f"**{parts[0]}:**:green[**{parts[1]}**]"
+
+
+# Display Data
+progress_text = st.empty()
+progress_bar = st.progress(0)
+
+# 每页展示一个 Loop
+LOOPS_PER_PAGE = 1
+
+# 获取所有的 Loop ID
+loop_groups = {}
+for i, d in enumerate(session_state.data):
+    tag = d["tag"]
+    loop_id, _ = extract_loopid_func_name(tag)
+    if loop_id:
+        if loop_id not in loop_groups:
+            loop_groups[loop_id] = []
+        loop_groups[loop_id].append(d)
+
+# 按 Loop ID 排序
+sorted_loop_ids = sorted(loop_groups.keys(), key=int)  # 假设 Loop ID 是数字
+total_loops = len(sorted_loop_ids)
+total_pages = total_loops  # 每页展示一个 Loop
+
+
+# simple display
+# FIXME: Delete this simple UI if trace have tag(evo_id & loop_id)
+# with st.sidebar:
+#     start = int(st.text_input("start", 0))
+#     end = int(st.text_input("end", 100))
+# for m in session_state.data[start:end]:
+#     if "tpl" in m["tag"]:
+#         obj = m["obj"]
+#         uri = obj["uri"]
+#         tpl = obj["template"]
+#         cxt = obj["context"]
+#         rd = obj["rendered"]
+#         with st.expander(highlight_prompts_uri(uri), expanded=False, icon="⚙️"):
+#             t1, t2, t3 = st.tabs([":green[**Rendered**]", ":blue[**Template**]", ":orange[**Context**]"])
+#             with t1:
+#                 show_text(rd)
+#             with t2:
+#                 show_text(tpl, lang="django")
+#             with t3:
+#                 st.json(cxt)
+#     if "llm" in m["tag"]:
+#         obj = m["obj"]
+#         system = obj.get("system", None)
+#         user = obj["user"]
+#         resp = obj["resp"]
+#         with st.expander(f"**LLM**", expanded=False, icon="🤖"):
+#             t1, t2, t3 = st.tabs([":green[**Response**]", ":blue[**User**]", ":orange[**System**]"])
+#             with t1:
+#                 try:
+#                     rdict = json.loads(resp)
+#                     if "code" in rdict:
+#                         code = rdict["code"]
+#                         st.markdown(":red[**Code in response dict:**]")
+#                         st.code(code, language="python", wrap_lines=True, line_numbers=True)
+#                         rdict.pop("code")
+#                     elif "spec" in rdict:
+#                         spec = rdict["spec"]
+#                         st.markdown(":red[**Spec in response dict:**]")
+#                         st.markdown(spec)
+#                         rdict.pop("spec")
+#                     else:
+#                         # show model codes
+#                         showed_keys = []
+#                         for k, v in rdict.items():
+#                             if k.startswith("model_") and k.endswith(".py"):
+#                                 st.markdown(f":red[**{k}**]")
+#                                 st.code(v, language="python", wrap_lines=True, line_numbers=True)
+#                                 showed_keys.append(k)
+#                         for k in showed_keys:
+#                             rdict.pop(k)
+#                     st.write(":red[**Other parts (except for the code or spec) in response dict:**]")
+#                     st.json(rdict)
+#                 except:
+#                     st.json(resp)
+#             with t2:
+#                 show_text(user)
+#             with t3:
+#                 show_text(system or "No system prompt available")
+
+
+if total_pages:
+    # 初始化 current_loop
+    if "current_loop" not in st.session_state:
+        st.session_state["current_loop"] = 1
+
+    # Loop 导航按钮
+    col1, col2, col3, col4, col5 = st.sidebar.columns([1.2, 1, 2, 1, 1.2])
+
+    with col1:
+        if st.button("|<"):  # 首页
+            st.session_state["current_loop"] = 1
+    with col2:
+        if st.button("<") and st.session_state["current_loop"] > 1:  # 上一页
+            st.session_state["current_loop"] -= 1
+    with col3:
+        # 下拉列表显示所有 Loop
+        st.session_state["current_loop"] = st.selectbox(
+            "选择 Loop",
+            options=list(range(1, total_loops + 1)),
+            index=st.session_state["current_loop"] - 1,  # 默认选中当前 Loop
+            label_visibility="collapsed",  # 隐藏标签
+        )
+    with col4:
+        if st.button("\>") and st.session_state["current_loop"] < total_loops:  # 下一页
+            st.session_state["current_loop"] += 1
+    with col5:
+        if st.button("\>|"):  # 最后一页
+            st.session_state["current_loop"] = total_loops
+
+    # 获取当前 Loop
+    current_loop = st.session_state["current_loop"]
+
+    # 渲染当前 Loop 数据
+    loop_id = sorted_loop_ids[current_loop - 1]
+    progress_text = st.empty()
+    progress_text.text(f"正在处理 Loop {loop_id}...")
+    progress_bar.progress(current_loop / total_loops, text=f"Loop :green[**{current_loop}**] / {total_loops}")
+
+    # 渲染 Loop Header
+    loop_anchor = f"Loop_{loop_id}"
+    if loop_anchor not in tlist:
+        tlist.append(loop_anchor)
+        st.header(loop_anchor, anchor=loop_anchor, divider="blue")
+
+    # 渲染当前 Loop 的所有数据
+    loop_data = loop_groups[loop_id]
+    for d in loop_data:
+        tag = d["tag"]
+        obj = d["obj"]
+        _, func_name = extract_loopid_func_name(tag)
+        evo_id = extract_evoid(tag)
+
+        func_anchor = f"loop_{loop_id}.{func_name}"
+        if func_anchor not in tlist:
+            tlist.append(func_anchor)
+            st.header(f"in *{func_name}*", anchor=func_anchor, divider="green")
+
+        evo_anchor = f"loop_{loop_id}.evo_step_{evo_id}"
+        if evo_id and evo_anchor not in tlist:
+            tlist.append(evo_anchor)
+            st.subheader(f"evo_step_{evo_id}", anchor=evo_anchor, divider="orange")
+
+        # 根据 tag 渲染内容
+        if "debug_exp_gen" in tag:
+            with st.expander(
+                f"Exp in :violet[**{obj.experiment_workspace.workspace_path}**]", expanded=False, icon="🧩"
+            ):
+                st.write(obj)
+        elif "debug_tpl" in tag:
+            uri = obj["uri"]
+            tpl = obj["template"]
+            cxt = obj["context"]
+            rd = obj["rendered"]
+            with st.expander(highlight_prompts_uri(uri), expanded=False, icon="⚙️"):
+                t1, t2, t3 = st.tabs([":green[**Rendered**]", ":blue[**Template**]", ":orange[**Context**]"])
+                with t1:
+                    show_text(rd)
+                with t2:
+                    show_text(tpl, lang="django")
+                with t3:
+                    st.json(cxt)
+        elif "debug_llm" in tag:
+            system = obj.get("system", None)
+            user = obj["user"]
+            resp = obj["resp"]
+            with st.expander(f"**LLM**", expanded=False, icon="🤖"):
+                t1, t2, t3 = st.tabs([":green[**Response**]", ":blue[**User**]", ":orange[**System**]"])
+                with t1:
+                    try:
+                        rdict = json.loads(resp)
+                        if "code" in rdict:
+                            code = rdict["code"]
+                            st.markdown(":red[**Code in response dict:**]")
+                            st.code(code, language="python", wrap_lines=True, line_numbers=True)
+                            rdict.pop("code")
+                        elif "spec" in rdict:
+                            spec = rdict["spec"]
+                            st.markdown(":red[**Spec in response dict:**]")
+                            st.markdown(spec)
+                            rdict.pop("spec")
+                        else:
+                            # show model codes
+                            showed_keys = []
+                            for k, v in rdict.items():
+                                if k.startswith("model_") and k.endswith(".py"):
+                                    st.markdown(f":red[**{k}**]")
+                                    st.code(v, language="python", wrap_lines=True, line_numbers=True)
+                                    showed_keys.append(k)
+                            for k in showed_keys:
+                                rdict.pop(k)
+                        st.write(":red[**Other parts (except for the code or spec) in response dict:**]")
+                        st.json(rdict)
+                    except:
+                        st.json(resp)
+                with t2:
+                    show_text(user)
+                with t3:
+                    show_text(system or "No system prompt available")
+
+    progress_text.text("当前 Loop 数据处理完成！")
+
+    # Sidebar TOC
+    with st.sidebar:
+        toc = "\n".join([f"- [{t}](#{t})" if t.startswith("L") else f"  - [{t.split('.')[1]}](#{t})" for t in tlist])
+        st.markdown(toc, unsafe_allow_html=True)
@@ -541,7 +541,8 @@ class APIBackend(ABC):
        **kwargs,
    ) -> str | list[list[float]]:
        """This function to share operation between embedding and chat completion"""
-        assert not (chat_completion and embedding), "chat_completion and embedding cannot be True at the same time"
+        if chat_completion and embedding:
+            raise ValueError("chat_completion and embedding cannot be True at the same time")
        max_retry = LLM_SETTINGS.max_retry if LLM_SETTINGS.max_retry is not None else max_retry
        timeout_count = 0
        violation_count = 0
@@ -720,7 +721,13 @@ class APIBackend(ABC):

            if finish_reason is None or finish_reason != "length":
                break  # we get a full response now.
-            new_messages.append({"role": "assistant", "content": response})
+            # Merge into the previous assistant message if there already is one at the end.
+            # Appending a second consecutive assistant message causes llama-server to return 400
+            # ("Cannot have 2 or more assistant messages at the end of the list").
+            if new_messages and new_messages[-1]["role"] == "assistant":
+                new_messages[-1]["content"] += response
+            else:
+                new_messages.append({"role": "assistant", "content": response})
        else:
            raise RuntimeError(f"Failed to continue the conversation after {try_n} retries.")

@@ -36,16 +36,18 @@ def get_agent_model() -> OpenAIChatModel:

    """
    backend = APIBackend()
-    assert isinstance(backend, LiteLLMAPIBackend), "Only LiteLLMAPIBackend is supported"
+    if not isinstance(backend, LiteLLMAPIBackend):
+        raise TypeError("Only LiteLLMAPIBackend is supported")

    compl_kwargs = backend.get_complete_kwargs()

    selected_model = compl_kwargs["model"]

    _, custom_llm_provider, _, _ = get_llm_provider(selected_model)
-    assert (
-        custom_llm_provider in PROVIDER_TO_ENV_MAP
-    ), f"Provider {custom_llm_provider} not supported. Please add it into `PROVIDER_TO_ENV_MAP`"
+    if custom_llm_provider not in PROVIDER_TO_ENV_MAP:
+        raise ValueError(
+            f"Provider {custom_llm_provider} not supported. Please add it into `PROVIDER_TO_ENV_MAP`"
+        )
    prefix = PROVIDER_TO_ENV_MAP[custom_llm_provider]
    api_key = os.getenv(f"{prefix}_API_KEY", None)
    api_base = os.getenv(f"{prefix}_API_BASE", None)
@@ -268,7 +268,8 @@ class JsonReducer(DataReducer):
                parent[key] = sampled  # type: ignore  # parent 是 list，key 是 index, list.__setitem__(key, sampled)
            self.sampled_files.extend([self.extract_filename(i) for i in sampled])
            break
-        assert len(self.sampled_files) > 0
+        if len(self.sampled_files) <= 0:
+            raise AssertionError("sampled_files must contain at least one file")
        return data

    def _find_all_lists(
@@ -7,8 +7,10 @@ from sklearn.metrics import roc_auc_score
 def prepare_for_auroc_metric(submission: pd.DataFrame, answers: pd.DataFrame, id_col: str, target_col: str) -> dict:

    # Answers checks
-    assert id_col in answers.columns, f"answers dataframe should have an {id_col} column"
-    assert target_col in answers.columns, f"answers dataframe should have a {target_col} column"
+    if id_col not in answers.columns:
+        raise InvalidSubmissionError(f"answers dataframe should have an {id_col} column")
+    if target_col not in answers.columns:
+        raise InvalidSubmissionError(f"answers dataframe should have a {target_col} column")

    # Submission checks
    if id_col not in submission.columns:
@@ -1,7 +1,8 @@
 from pathlib import Path

 # Check if our submission file exists
-assert Path("submission.csv").exists(), "Error: submission.csv not found"
+if not Path("submission.csv").exists():
+    raise FileNotFoundError("Error: submission.csv not found")

 submission_lines = Path("submission.csv").read_text().splitlines()
 test_lines = Path("submission_test.csv").read_text().splitlines()
@@ -22,7 +22,8 @@ def prepare_for_metric(submission: pd.DataFrame, answers: pd.DataFrame) -> dict:
    if "price" not in submission.columns:
        raise InvalidSubmissionError("Submission DataFrame must contain 'price' columns.")

-    assert "price" in answers.columns, "Answers DataFrame must contain 'price' columns."
+    if "price" not in answers.columns:
+        raise InvalidSubmissionError("Answers DataFrame must contain 'price' columns.")

    if len(submission) != len(answers):
        raise InvalidSubmissionError("Submission must be the same length as the answers.")
@@ -1,7 +1,8 @@
 from pathlib import Path

 # Check if our submission file exists
-assert Path("submission.csv").exists(), "Error: submission.csv not found"
+if not Path("submission.csv").exists():
+    raise FileNotFoundError("Error: submission.csv not found")

 submission_lines = Path("submission.csv").read_text().splitlines()  # 自动生成的
 test_lines = Path("submission_test.csv").read_text().splitlines()  # test.csv
@@ -56,14 +56,17 @@ sparse.save_npz(public / "test" / "X.npz", X_test)
 sparse.save_npz(public / "train" / "X.npz", X_train)
 df_train.to_csv(public / "train" / "ARF_12h.csv", index=False)

-assert (
-    X_train.shape[0] == df_train.shape[0]
-), f"Mismatch: X_train rows ({X_train.shape[0]}) != df_train rows ({df_train.shape[0]})"
-assert (
-    X_test.shape[0] == df_test.shape[0]
-), f"Mismatch: X_test rows ({X_test.shape[0]}) != df_test rows ({df_test.shape[0]})"
-assert df_test.shape[1] == 2, "Public test set should have 2 columns"
-assert df_train.shape[1] == 3, "Public train set should have 3 columns"
-assert len(df_train) + len(df_test) == len(
-    df_label
-), "Length of new_train and new_test should equal length of old_train"
+if X_train.shape[0] != df_train.shape[0]:
+    raise ValueError(
+        f"Mismatch: X_train rows ({X_train.shape[0]}) != df_train rows ({df_train.shape[0]})"
+    )
+if X_test.shape[0] != df_test.shape[0]:
+    raise ValueError(
+        f"Mismatch: X_test rows ({X_test.shape[0]}) != df_test rows ({df_test.shape[0]})"
+    )
+if df_test.shape[1] != 2:
+    raise ValueError("Public test set should have 2 columns")
+if df_train.shape[1] != 3:
+    raise ValueError("Public train set should have 3 columns")
+if len(df_train) + len(df_test) != len(df_label):
+    raise ValueError("Length of new_train and new_test should equal length of old_train")
@@ -25,11 +25,12 @@ def prepare(raw: Path, public: Path, private: Path):
    new_test.to_csv(public / "test.csv", index=False)

    # Checks
-    assert new_test.shape[1] == 12, "Public test set should have 12 columns"
-    assert new_train.shape[1] == 13, "Public train set should have 13 columns"
-    assert len(new_train) + len(new_test) == len(
-        old_train
-    ), "Length of new_train and new_test should equal length of old_train"
+    if new_test.shape[1] != 12:
+        raise AssertionError("Public test set should have 12 columns")
+    if new_train.shape[1] != 13:
+        raise AssertionError("Public train set should have 13 columns")
+    if len(new_train) + len(new_test) != len(old_train):
+        raise AssertionError("Length of new_train and new_test should equal length of old_train")


 if __name__ == "__main__":
@@ -320,7 +320,8 @@ class DataScienceRDLoop(RDLoop):
            # only clean current workspace without affecting other loops.
            for k in "direct_exp_gen", "coding", "running":
                if k in prev_out and prev_out[k] is not None:
-                    assert isinstance(prev_out[k], DSExperiment)
+                    if not isinstance(prev_out[k], DSExperiment):
+                        raise TypeError(f"prev_out[{k!r}] must be an instance of DSExperiment")
                    clean_workspace(prev_out[k].experiment_workspace.workspace_path)

            # Backup the workspace (only necessary files are included)
@@ -213,7 +213,8 @@ class DSTrace(Trace[DataScienceScen, KnowledgeBase]):
        self, component: COMPONENT, search_list: list[tuple[DSExperiment, ExperimentFeedback]] = []
    ) -> bool:
        for exp, fb in search_list:
-            assert isinstance(exp.hypothesis, DSHypothesis), "Hypothesis should be DSHypothesis (and not None)"
+            if not isinstance(exp.hypothesis, DSHypothesis):
+                raise TypeError("Hypothesis should be DSHypothesis (and not None)")
            if exp.hypothesis.component == component and fb:
                return True
        return False
@@ -182,7 +182,7 @@ class ExpGen2Hypothesis(DSProposalV2ExpGen):

        success_fb_list = list(set(trace_fbs))
        logger.info(
-            f"Merge Hypothesis: select {len(success_fb_list)} from {len(trace_fbs)} SOTA experiments found in {len(leaves)} traces"
+            f"Merge Hypothesis: select {len(success_fb_list)} from {len(trace_fbs)} SOTA experiments found in {len(leaves)} traces"  # nosec B608 — not SQL, Bandit false positive on "select" in log message
        )

        if len(success_fb_list) > 0:
@@ -377,7 +377,8 @@ class ExpGen2TraceAndMergeV2(ExpGen):
            if DS_RD_SETTING.enable_multi_version_exp_gen:
                exp_gen_version_list = DS_RD_SETTING.exp_gen_version_list.split(",")
                for version in exp_gen_version_list:
-                    assert version in ["v3", "v2", "v1"]
+                    if version not in ["v3", "v2", "v1"]:
+                        raise ValueError(f"version must be 'v1', 'v2', or 'v3', got {version!r}")

                if len(trace.hist) == 0:
                    # set the proposal version for the first sub-trace
@@ -339,7 +339,8 @@ class DSProposalV1ExpGen(ExpGen):
            eda_output = sota_exp.experiment_workspace.file_dict.get("EDA.md", None)
        scenario_desc = trace.scen.get_scenario_all_desc(eda_output=eda_output)

-        assert sota_exp is not None, "SOTA experiment is not provided."
+        if sota_exp is None:
+            raise ValueError("SOTA experiment is not provided.")
        last_exp = trace.last_exp()
        # exp_and_feedback = trace.hist[-1]
        # last_exp = exp_and_feedback[0]
@@ -445,8 +446,10 @@ class DSProposalV1ExpGen(ExpGen):
                        json_target_type=dict[str, dict[str, str | dict] | str],
                    )
                )
-                assert "hypothesis_proposal" in resp_dict, "Hypothesis proposal not provided."
-                assert "task_design" in resp_dict, "Task design not provided."
+                if "hypothesis_proposal" not in resp_dict:
+                    raise ValueError("Hypothesis proposal not provided.")
+                if "task_design" not in resp_dict:
+                    raise ValueError("Task design not provided.")
                task_class = component_info["task_class"]
                hypothesis_proposal = resp_dict.get("hypothesis_proposal", {})
                hypothesis = DSHypothesis(
@@ -1149,8 +1152,10 @@ You help users retrieve relevant knowledge from community discussions and public
        )

        response_dict = json.loads(response)
-        assert response_dict.get("component") in HypothesisComponent.__members__, f"Invalid component"
-        assert response_dict.get("hypothesis") is not None, f"Invalid hypothesis"
+        if response_dict.get("component") not in HypothesisComponent.__members__:
+            raise ValueError(f"Invalid component: {response_dict.get('component')}")
+        if response_dict.get("hypothesis") is None:
+            raise ValueError("Invalid hypothesis")
        return response_dict

    # END: for support llm-based hypothesis selection  -----
@@ -1253,7 +1258,8 @@ You help users retrieve relevant knowledge from community discussions and public
            description=task_desc,
        )

-        assert isinstance(task, PipelineTask), f"Task {task_name} is not a PipelineTask, got {type(task)}"
+        if not isinstance(task, PipelineTask):
+            raise TypeError(f"Task {task_name} is not a PipelineTask, got {type(task)}")
        # only for llm with response schema.(TODO: support for non-schema llm?)
        # If the LLM provides a "packages" field (list[str]), compute runtime environment now and cache it for subsequent prompts in later loops.
        if isinstance(task_dict, dict) and "packages" in task_dict and isinstance(task_dict["packages"], list):
@@ -1,3 +1,4 @@
+import ast
 import json
 import os
 import pickle
@@ -292,7 +293,7 @@ class ValidationSelector(SOTAexpSelector):
        Sorts all valid experiments by score and returns the top N.
        """

-        mock_folder = f"/tmp/mock/{self.competition}"
+        mock_folder = f"/tmp/mock/{self.competition}"  # nosec B108 — Docker volume mount point derived from internal competition name

        try:
            data_py_code, grade_py_code = self._prepare_validation_scripts(
@@ -539,7 +540,7 @@ def process_experiment(

        # Run main script
        env = get_ds_env(
-            extra_volumes={f"/tmp/mock/{competition}/{input_folder}": input_folder},
+            extra_volumes={f"/tmp/mock/{competition}/{input_folder}": input_folder},  # nosec B108 — Docker volume mount point derived from internal competition name
            running_timeout_period=DS_RD_SETTING.full_timeout,
        )
        result = ws.run(env=env, entry="python main.py")
@@ -587,8 +588,8 @@ def _parsing_score(grade_stdout: str) -> Optional[float]:
        except:
            pass
        try:
-            # Priority 2: Eval dict
-            return float(eval(json_str)["score"])
+            # Priority 2: safe literal eval for Python-style dicts
+            return float(ast.literal_eval(json_str)["score"])
        except:
            pass
        try:
@@ -35,10 +35,11 @@ def select(X: pd.DataFrame) -> pd.DataFrame:
 class KGModelFeatureSelectionCoder(Developer[KGModelExperiment]):
    def develop(self, exp: KGModelExperiment) -> KGModelExperiment:
        target_model_type = exp.sub_tasks[0].model_type
-        assert target_model_type in KG_SELECT_MAPPING
+        if target_model_type not in KG_SELECT_MAPPING:
+            raise ValueError(f"target_model_type {target_model_type} not in KG_SELECT_MAPPING")
        if len(exp.experiment_workspace.data_description) == 1:
            code = (
-                Environment(undefined=StrictUndefined)
+                Environment(undefined=StrictUndefined)  # nosec B701 — renders Python code templates, not HTML; autoescape would corrupt code
                .from_string(DEFAULT_SELECTION_CODE)
                .render(feature_index_list=None)
            )
@@ -62,7 +63,7 @@ class KGModelFeatureSelectionCoder(Developer[KGModelExperiment]):
            chosen_index_to_list_index = [i - 1 for i in chosen_index]

            code = (
-                Environment(undefined=StrictUndefined)
+                Environment(undefined=StrictUndefined)  # nosec B701 — renders Python code templates, not HTML; autoescape would corrupt code
                .from_string(DEFAULT_SELECTION_CODE)
                .render(feature_index_list=chosen_index_to_list_index)
            )
@@ -165,7 +165,8 @@ class KGScenario(Scenario):
        return data_info

    def output_format(self, tag=None) -> str:
-        assert tag in [None, "feature", "model"]
+        if tag not in [None, "feature", "model"]:
+            raise ValueError(f"tag must be None, 'feature', or 'model', got {tag!r}")
        feature_output_format = f"""The feature code should output following the format:
 {T(".prompts:kg_feature_output_format").r()}"""
        model_output_format = f"""The model code should output following the format:\n""" + T(
@@ -180,7 +181,8 @@ class KGScenario(Scenario):
            return model_output_format

    def interface(self, tag=None) -> str:
-        assert tag in [None, "feature", "XGBoost", "RandomForest", "LightGBM", "NN"]
+        if tag not in [None, "feature", "XGBoost", "RandomForest", "LightGBM", "NN"]:
+            raise ValueError(f"tag must be None, 'feature', 'XGBoost', 'RandomForest', 'LightGBM', or 'NN', got {tag!r}")
        feature_interface = f"""The feature code should follow the interface:
 {T(".prompts:kg_feature_interface").r()}"""
        if tag == "feature":
@@ -195,7 +197,8 @@ class KGScenario(Scenario):
            return model_interface

    def simulator(self, tag=None) -> str:
-        assert tag in [None, "feature", "model"]
+        if tag not in [None, "feature", "model"]:
+            raise ValueError(f"tag must be None, 'feature', or 'model', got {tag!r}")

        kg_feature_simulator = (
            "The feature code will be sent to the simulator:\n" + T(".prompts:kg_feature_simulator").r()
@@ -79,12 +79,12 @@ def preprocess_script():
    This method applies the preprocessing steps to the training, validation, and test datasets.
    """
    if os.path.exists("/kaggle/input/X_train.pkl"):
-        X_train = pd.read_pickle("/kaggle/input/X_train.pkl")
-        X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")
-        y_train = pd.read_pickle("/kaggle/input/y_train.pkl")
-        y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")
-        X_test = pd.read_pickle("/kaggle/input/X_test.pkl")
-        others = pd.read_pickle("/kaggle/input/others.pkl")
+        X_train = pd.read_pickle("/kaggle/input/X_train.pkl")  # nosec B301 — trusted Kaggle input
+        X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")  # nosec B301
+        y_train = pd.read_pickle("/kaggle/input/y_train.pkl")  # nosec B301
+        y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")  # nosec B301
+        X_test = pd.read_pickle("/kaggle/input/X_test.pkl")  # nosec B301
+        others = pd.read_pickle("/kaggle/input/others.pkl")  # nosec B301
        y_train = pd.Series(y_train).reset_index(drop=True)
        y_valid = pd.Series(y_valid).reset_index(drop=True)

@@ -85,12 +85,12 @@ def preprocess_script():
    This method applies the preprocessing steps to the training, validation, and test datasets.
    """
    if os.path.exists("/kaggle/input/X_train.pkl"):
-        X_train = pd.read_pickle("/kaggle/input/X_train.pkl")
-        X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")
-        y_train = pd.read_pickle("/kaggle/input/y_train.pkl")
-        y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")
-        X_test = pd.read_pickle("/kaggle/input/X_test.pkl")
-        others = pd.read_pickle("/kaggle/input/others.pkl")
+        X_train = pd.read_pickle("/kaggle/input/X_train.pkl")  # nosec B301
+        X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")  # nosec B301
+        y_train = pd.read_pickle("/kaggle/input/y_train.pkl")  # nosec B301
+        y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")  # nosec B301
+        X_test = pd.read_pickle("/kaggle/input/X_test.pkl")  # nosec B301
+        others = pd.read_pickle("/kaggle/input/others.pkl")  # nosec B301

        return X_train, X_valid, y_train, y_valid, X_test, *others
    X_train, X_valid, y_train, y_valid = prepreprocess()
@@ -82,11 +82,11 @@ def preprocess_script():
    This method applies the preprocessing steps to the training, validation, and test datasets.
    """
    if os.path.exists("X_train.pkl"):
-        X_train = pd.read_pickle("X_train.pkl")
-        X_valid = pd.read_pickle("X_valid.pkl")
-        y_train = pd.read_pickle("y_train.pkl")
-        y_valid = pd.read_pickle("y_valid.pkl")
-        X_test = pd.read_pickle("X_test.pkl")
+        X_train = pd.read_pickle("X_train.pkl")  # nosec B301
+        X_valid = pd.read_pickle("X_valid.pkl")  # nosec B301
+        y_train = pd.read_pickle("y_train.pkl")  # nosec B301
+        y_valid = pd.read_pickle("y_valid.pkl")  # nosec B301
+        X_test = pd.read_pickle("X_test.pkl")  # nosec B301
        return X_train, X_valid, y_train, y_valid, X_test

    X_train, X_valid, y_train, y_valid, test, status_encoder, test_ids = prepreprocess()
@@ -73,12 +73,12 @@ def preprocess_script():
    This method applies the preprocessing steps to the training, validation, and test datasets.
    """
    if os.path.exists("/kaggle/input/X_train.pkl"):
-        X_train = pd.read_pickle("/kaggle/input/X_train.pkl")
-        X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")
-        y_train = pd.read_pickle("/kaggle/input/y_train.pkl")
-        y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")
-        X_test = pd.read_pickle("/kaggle/input/X_test.pkl")
-        others = pd.read_pickle("/kaggle/input/others.pkl")
+        X_train = pd.read_pickle("/kaggle/input/X_train.pkl")  # nosec B301
+        X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")  # nosec B301
+        y_train = pd.read_pickle("/kaggle/input/y_train.pkl")  # nosec B301
+        y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")  # nosec B301
+        X_test = pd.read_pickle("/kaggle/input/X_test.pkl")  # nosec B301
+        others = pd.read_pickle("/kaggle/input/others.pkl")  # nosec B301
        y_train = pd.Series(y_train).reset_index(drop=True)
        y_valid = pd.Series(y_valid).reset_index(drop=True)

@@ -87,7 +87,12 @@ def crawl_descriptions(
        content = e.get_attribute("innerHTML")
        contents.append(content)

-    assert len(subtitles) == len(contents) + 1 and subtitles[-1] == "Citation"
+    if not (len(subtitles) == len(contents) + 1 and subtitles[-1] == "Citation"):
+        raise AssertionError(
+            f"Expected len(contents)+1 == len(subtitles) and last subtitle == 'Citation', "
+            f"got len(subtitles)={len(subtitles)}, len(contents)={len(contents)}, "
+            f"last subtitle={subtitles[-1]!r}"
+        )
    for i in range(len(subtitles) - 1):
        descriptions[subtitles[i]] = contents[i]

@@ -307,7 +307,8 @@ class KGHypothesisGen(FactorAndModelHypothesisGen):
 class KGHypothesis2Experiment(FactorAndModelHypothesis2Experiment):
    def prepare_context(self, hypothesis: Hypothesis, trace: Trace) -> Tuple[dict, bool]:
        scenario = trace.scen.get_scenario_all_desc(filtered_tag="hypothesis_and_experiment")
-        assert isinstance(hypothesis, KGHypothesis)
+        if not isinstance(hypothesis, KGHypothesis):
+            raise TypeError("hypothesis must be an instance of KGHypothesis")
        experiment_output_format = (
            T("scenarios.kaggle.prompts:feature_experiment_output_format").r()
            if hypothesis.action in [KG_ACTION_FEATURE_ENGINEERING, KG_ACTION_FEATURE_PROCESSING]
@@ -1,5 +1,7 @@
+import logging
 import os
 from pathlib import Path
+
 """
 Qlib Factor Runner - Executes factor backtests in Docker.

@@ -9,15 +11,8 @@ NOTE: The @cache_with_pickle decorator was REMOVED from develop() because:
 - Docker-level caching (QlibDockerConf.enable_cache=False) is sufficient
 - The pickle cache caused 240+ factor generations but ZERO Docker backtests
 """
-from pathlib import Path
-from typing import Optional

 import pandas as pd
-from pandarallel import pandarallel
-
-
-pandarallel.initialize(verbose=1)
-
 from rdagent.app.qlib_rd_loop.conf import FactorBasePropSetting
 from rdagent.components.runner import CachedRunner
 from rdagent.core.exception import FactorEmptyError
@@ -29,6 +24,83 @@ from rdagent.scenarios.qlib.experiment.model_experiment import QlibModelExperime
 DIRNAME = Path(__file__).absolute().resolve().parent
 DIRNAME_local = Path.cwd()

+
+def _shift_daily_constant_factor_if_needed(factor_col: "pd.Series", factor_name: str) -> "pd.Series":
+    """Detect and fix look-ahead bias in daily-constant factors.
+
+    A factor is "daily-constant" when every minute bar within the same calendar
+    day carries an identical value. This happens when LLM code computes a daily
+    aggregate (e.g. today's log return) and forward-fills it across all intraday
+    bars without shifting — meaning the end-of-day value is visible at 00:00.
+
+    Fix: shift by one trading day so that the value assigned to day T is the
+    aggregate computed from day T-1, eliminating the forward-looking information.
+    """
+    import numpy as np
+
+    try:
+        notnull = factor_col.dropna()
+        if len(notnull) < 200:
+            return factor_col
+
+        datetimes = notnull.index.get_level_values("datetime")
+        dates = datetimes.normalize()
+
+        # Sample up to 50 random days and check intra-day uniqueness
+        unique_dates = pd.Series(dates.unique())
+        sample_dates = unique_dates.sample(min(50, len(unique_dates)), random_state=42)
+
+        daily_unique_counts = []
+        for d in sample_dates:
+            mask = dates == d
+            vals = notnull.values[mask]
+            if len(vals) > 1:
+                daily_unique_counts.append(len(np.unique(vals[~np.isnan(vals)])))
+
+        if not daily_unique_counts:
+            return factor_col
+
+        # If >90% of sampled days have exactly 1 unique value → daily-constant
+        fraction_constant = sum(1 for c in daily_unique_counts if c == 1) / len(daily_unique_counts)
+        if fraction_constant < 0.90:
+            return factor_col  # Intraday factor — no shift needed
+
+        logger.warning(
+            f"[LookAheadFix] Factor '{factor_name}' is daily-constant "
+            f"({fraction_constant:.0%} of days). Applying 1-day shift to remove look-ahead bias.",
+        )
+
+        # Shift: for each instrument, map daily values forward by 1 trading day
+        instruments = factor_col.index.get_level_values("instrument").unique()
+        shifted_parts = []
+        for inst in instruments:
+            inst_series = factor_col.xs(inst, level="instrument")
+            # Get one value per calendar day (the first non-null bar)
+            inst_dt = inst_series.index.normalize()
+            daily_vals = inst_series.groupby(inst_dt).first()
+            # Shift by 1 day
+            daily_vals_shifted = daily_vals.shift(1)
+            # Forward-fill back to minute bars
+            minute_idx = inst_series.index
+            minute_dates = minute_idx.normalize()
+            shifted_minute = minute_dates.map(daily_vals_shifted)
+            shifted_s = pd.Series(
+                shifted_minute.values,
+                index=pd.MultiIndex.from_arrays(
+                    [inst_series.index, [inst] * len(inst_series)],
+                    names=["datetime", "instrument"],
+                ),
+                name=factor_col.name,
+            )
+            shifted_parts.append(shifted_s)
+
+        return pd.concat(shifted_parts).sort_index()
+
+    except Exception as e:
+        logger.debug(f"[LookAheadFix] Could not apply daily shift for '{factor_name}': {e}")
+        return factor_col
+
+
 # TODO: supporting multiprocessing and keep previous results


@@ -43,13 +115,13 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
    """

    def calculate_information_coefficient(
-        self, concat_feature: pd.DataFrame, SOTA_feature_column_size: int, new_feature_columns_size: int
+        self, concat_feature: pd.DataFrame, SOTA_feature_column_size: int, new_feature_columns_size: int,
    ) -> pd.DataFrame:
        res = pd.Series(index=range(SOTA_feature_column_size * new_feature_columns_size))
        for col1 in range(SOTA_feature_column_size):
            for col2 in range(SOTA_feature_column_size, SOTA_feature_column_size + new_feature_columns_size):
                res.loc[col1 * new_feature_columns_size + col2 - SOTA_feature_column_size] = concat_feature.iloc[
-                    :, col1
+                    :, col1,
                ].corr(concat_feature.iloc[:, col2])
        return res

@@ -58,16 +130,21 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        # if the IC is larger than a threshold, remove the new_feature column
        # return the new_feature

+        from pandarallel import pandarallel
+        pandarallel.initialize(verbose=1)
+
        concat_feature = pd.concat([SOTA_feature, new_feature], axis=1)
        IC_max = (
            concat_feature.groupby("datetime")
            .parallel_apply(
-                lambda x: self.calculate_information_coefficient(x, SOTA_feature.shape[1], new_feature.shape[1])
+                lambda x: self.calculate_information_coefficient(x, SOTA_feature.shape[1], new_feature.shape[1]),
            )
            .mean()
        )
        IC_max.index = pd.MultiIndex.from_product([range(SOTA_feature.shape[1]), range(new_feature.shape[1])])
        IC_max = IC_max.unstack().max(axis=0)
+        if not hasattr(IC_max, "index"):
+            return new_feature
        return new_feature.iloc[:, IC_max[IC_max < 0.99].index]

    def develop(self, exp: QlibFactorExperiment) -> QlibFactorExperiment:
@@ -82,7 +159,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        self._ensure_results_dirs()

        if exp.based_experiments and exp.based_experiments[-1].result is None:
-            logger.info(f"Baseline experiment execution ...")
+            logger.info("Baseline experiment execution ...")
            exp.based_experiments[-1] = self.develop(exp.based_experiments[-1])

        fbps = FactorBasePropSetting()
@@ -106,11 +183,11 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                base_exp for base_exp in exp.based_experiments if isinstance(base_exp, QlibFactorExperiment)
            ]
            if len(sota_factor_experiments_list) > 1:
-                logger.info(f"SOTA factor processing ...")
+                logger.info("SOTA factor processing ...")
                SOTA_factor = process_factor_data(sota_factor_experiments_list)

            # Process the new factors data
-            logger.info(f"New factor processing ...")
+            logger.info("New factor processing ...")
            new_factors = process_factor_data(exp)

            if new_factors.empty:
@@ -121,7 +198,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                new_factors = self.deduplicate_new_factors(SOTA_factor, new_factors)
                if new_factors.empty:
                    raise FactorEmptyError(
-                        "The factors generated in this round are highly similar to the previous factors. Please change the direction for creating new factors."
+                        "The factors generated in this round are highly similar to the previous factors. Please change the direction for creating new factors.",
                    )
                combined_factors = pd.concat([SOTA_factor, new_factors], axis=1).dropna()
            else:
@@ -132,7 +209,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            combined_factors = combined_factors.loc[:, ~combined_factors.columns.duplicated(keep="last")]
            new_columns = pd.MultiIndex.from_product([["feature"], combined_factors.columns])
            combined_factors.columns = new_columns
-            logger.info(f"Factor data processing completed.")
+            logger.info("Factor data processing completed.")

            num_features = len(exp.base_features) + len(combined_factors.columns)

@@ -151,10 +228,10 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                    sota_model_exp = base_exp
                    exist_sota_model_exp = True
                    break
-            logger.info(f"Experiment execution ...")
+            logger.info("Experiment execution ...")
            if exist_sota_model_exp:
                exp.experiment_workspace.inject_files(
-                    **{"model.py": sota_model_exp.sub_workspace_list[0].file_dict["model.py"]}
+                    **{"model.py": sota_model_exp.sub_workspace_list[0].file_dict["model.py"]},
                )
                sota_training_hyperparameters = sota_model_exp.sub_tasks[0].training_hyperparameters
                if sota_training_hyperparameters:
@@ -165,19 +242,19 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                            "early_stop": str(sota_training_hyperparameters.get("early_stop", 10)),
                            "batch_size": str(sota_training_hyperparameters.get("batch_size", 256)),
                            "weight_decay": str(sota_training_hyperparameters.get("weight_decay", 0.0001)),
-                        }
+                        },
                    )
                sota_model_type = sota_model_exp.sub_tasks[0].model_type
                if sota_model_type == "TimeSeries":
                    env_to_use.update(
-                        {"dataset_cls": "TSDatasetH", "num_features": num_features, "step_len": 20, "num_timesteps": 20}
+                        {"dataset_cls": "TSDatasetH", "num_features": num_features, "step_len": 20, "num_timesteps": 20},
                    )
                elif sota_model_type == "Tabular":
                    env_to_use.update({"dataset_cls": "DatasetH", "num_features": num_features})

                # model + combined factors
                result, stdout = exp.experiment_workspace.execute(
-                    qlib_config_name="conf_combined_factors_sota_model.yaml", run_env=env_to_use
+                    qlib_config_name="conf_combined_factors_sota_model.yaml", run_env=env_to_use,
                )
            else:
                # LGBM + combined factors
@@ -186,7 +263,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                    run_env=env_to_use,
                )
        else:
-            logger.info(f"Experiment execution ...")
+            logger.info("Experiment execution ...")
            if exp.base_feature_codes:
                factors = process_factor_data(exp)
                factors = factors.sort_index()
@@ -196,7 +273,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                target_path = exp.experiment_workspace.workspace_path / "combined_factors_df.parquet"
                # Save the combined factors to the workspace
                factors.to_parquet(target_path, engine="pyarrow")
-                logger.info(f"Factor data processing completed.")
+                logger.info("Factor data processing completed.")
                result, stdout = exp.experiment_workspace.execute(
                    qlib_config_name="conf_combined_factors.yaml",
                    run_env=env_to_use,
@@ -209,10 +286,10 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):

        # Handle Qlib Docker backtest failure gracefully
        if result is None:
-            factor_name = getattr(exp.hypothesis, 'hypothesis', 'unknown')
+            factor_name = getattr(exp.hypothesis, "hypothesis", "unknown")
            logger.warning(
                f"Qlib Docker backtest returned None for '{factor_name}'. "
-                f"Attempting direct factor evaluation..."
+                f"Attempting direct factor evaluation...",
            )

            # Try to compute metrics directly from the factor's result.h5
@@ -224,7 +301,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            else:
                logger.error(
                    f"Both Qlib Docker backtest and direct evaluation failed for '{factor_name}'. "
-                    f"Skipping this factor and continuing."
+                    f"Skipping this factor and continuing.",
                )
                # Save failed run info for debugging
                self._save_failed_run(exp, stdout, error_type="result_none")
@@ -242,7 +319,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        if validation_result.get("has_issues"):
            logger.warning(
                f"Result validation warnings for factor '{getattr(exp.hypothesis, 'hypothesis', 'unknown')}': "
-                f"{validation_result['warnings']}"
+                f"{validation_result['warnings']}",
            )
            # Save warning info for debugging
            self._save_failed_run(exp, stdout, error_type="validation_warnings", validation=validation_result)
@@ -293,43 +370,43 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        details = {}

        factor_name = "unknown"
-        if hasattr(exp, 'hypothesis') and exp.hypothesis is not None:
-            factor_name = getattr(exp.hypothesis, 'hypothesis', 'unknown')
+        if hasattr(exp, "hypothesis") and exp.hypothesis is not None:
+            factor_name = getattr(exp.hypothesis, "hypothesis", "unknown")

        if isinstance(result, pd.Series):
            # Check IC
-            ic_value = result.get('IC', None)
-            details['ic_raw'] = ic_value
+            ic_value = result.get("IC", None)
+            details["ic_raw"] = ic_value
            if ic_value is None or (isinstance(ic_value, float) and (ic_value != ic_value)):  # NaN check
                warnings.append("IC is None/NaN — factor has no predictive power")
            else:
                try:
                    ic_float = float(ic_value)
-                    details['ic'] = ic_float
+                    details["ic"] = ic_float
                    if abs(ic_float) < 0.001:
                        warnings.append(
-                            f"IC is near zero ({ic_float:.6f}) — factor may not predict returns"
+                            f"IC is near zero ({ic_float:.6f}) — factor may not predict returns",
                        )
                except (ValueError, TypeError):
                    warnings.append(f"IC value is not numeric: {ic_value}")

            # Check positions (1day.pos)
-            pos_value = result.get('1day.pos', None)
-            details['positions_raw'] = pos_value
+            pos_value = result.get("1day.pos", None)
+            details["positions_raw"] = pos_value
            if pos_value is not None:
                try:
                    pos_float = float(pos_value)
-                    details['positions'] = pos_float
+                    details["positions"] = pos_float
                    if pos_float == 0:
                        warnings.append(
                            "1day.pos == 0 — model opened ZERO positions (stayed neutral). "
                            "Possible causes: (1) topk too high for single-asset, "
-                            "(2) signal threshold too restrictive, (3) no valid predictions"
+                            "(2) signal threshold too restrictive, (3) no valid predictions",
                        )
                    elif pos_float < 10:
                        warnings.append(
                            f"1day.pos = {pos_float:.0f} — very few positions opened. "
-                            f"Check signal threshold and topk settings"
+                            f"Check signal threshold and topk settings",
                        )
                except (ValueError, TypeError):
                    pass  # pos might be a string
@@ -337,24 +414,24 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            # Check if result is essentially empty (all values None or NaN)
            non_null_count = result.notna().sum()
            total_count = len(result)
-            details['non_null_metrics'] = int(non_null_count)
-            details['total_metrics'] = int(total_count)
+            details["non_null_metrics"] = int(non_null_count)
+            details["total_metrics"] = int(total_count)
            if non_null_count < 3:
                warnings.append(
                    f"Result has only {non_null_count}/{total_count} non-null metrics — "
-                    f"backtest likely produced empty results"
+                    f"backtest likely produced empty results",
                )

            # Check for key metrics
-            required_metrics = ['IC', '1day.excess_return_with_cost.shar', '1day.pos']
+            required_metrics = ["IC", "1day.excess_return_with_cost.shar", "1day.pos"]
            for metric_name in required_metrics:
                val = result.get(metric_name, None)
-                details[f'has_{metric_name}'] = val is not None
+                details[f"has_{metric_name}"] = val is not None

        elif isinstance(result, dict):
            # Dict-based result validation
-            ic_value = result.get('IC', result.get('ic', None))
-            details['ic_raw'] = ic_value
+            ic_value = result.get("IC", result.get("ic", None))
+            details["ic_raw"] = ic_value
            if ic_value is None:
                warnings.append("IC is None — factor has no predictive power")

@@ -364,7 +441,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            "details": details,
        }

-    def _evaluate_factor_directly(self, exp, stdout: str) -> Optional[pd.Series]:
+    def _evaluate_factor_directly(self, exp, stdout: str) -> pd.Series | None:
        """
        Evaluate factor directly from its result.h5 file when Qlib Docker fails.

@@ -391,8 +468,19 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        import numpy as np

        try:
-            # Get workspace path
-            workspace_path = exp.experiment_workspace.workspace_path
+            # Get workspace path — factor code and result.h5 live in sub_workspace_list[0],
+            # not in experiment_workspace (which is the Qlib template workspace).
+            workspace_path = None
+            if exp.sub_workspace_list:
+                for ws in exp.sub_workspace_list:
+                    if ws is not None and hasattr(ws, "workspace_path"):
+                        candidate = ws.workspace_path / "result.h5"
+                        if candidate.exists():
+                            workspace_path = ws.workspace_path
+                            break
+            if workspace_path is None:
+                # Fallback to experiment_workspace
+                workspace_path = exp.experiment_workspace.workspace_path
            if workspace_path is None:
                return None

@@ -409,6 +497,12 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            factor_col = factor_values.iloc[:, 0]
            factor_name = factor_values.columns[0]

+            # Detect and fix look-ahead bias in daily-constant factors.
+            # If a factor has the same value for all minute bars within each calendar day
+            # it was computed from same-day data (e.g. today's close return at 00:00).
+            # Fix: shift by 1 trading day so value at day T = aggregate of day T-1.
+            factor_col = _shift_daily_constant_factor_if_needed(factor_col, factor_name)
+
            # Load source data for forward returns
            data_path = (
                Path(__file__).parent.parent.parent.parent.parent
@@ -450,23 +544,32 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            except Exception:
                rank_ic = ic

-            # Compute Sharpe-like metric
-            factor_mean = factor_col.loc[valid_idx].mean()
-            factor_std = factor_col.loc[valid_idx].std()
-            sharpe = factor_mean / factor_std if factor_std > 0 else 0
+            # Compute strategy returns from factor signal + forward returns
+            # signal: long(1) when factor > 0, short(-1) when factor <= 0
+            signal = np.where(factor_col.loc[valid_idx] > 0, 1.0, -1.0)
+            strategy_ret = signal * forward_ret.loc[valid_idx]

-            # Annualized return (approximate)
-            ann_factor = np.sqrt(252 * 1440 / 96)
-            annualized_return = factor_mean * ann_factor * 100
+            # Annualization factor for 1-minute bars
+            bars_per_year = 252 * 1440  # ~362880
+            bars_per_forward = 96
+            ann_factor = np.sqrt(bars_per_year / bars_per_forward)

-            # Max drawdown (approximate)
-            cum_perf = factor_col.loc[valid_idx].cumsum()
-            running_max = cum_perf.expanding().max()
-            drawdown = (cum_perf - running_max) / running_max.replace(0, np.nan)
-            max_drawdown = drawdown.min() if len(drawdown) > 0 else 0
+            # Sharpe: annualized mean/vol of strategy returns
+            ret_mean = strategy_ret.mean()
+            ret_std = strategy_ret.std()
+            sharpe = (ret_mean / ret_std * ann_factor) if ret_std > 0 else 0.0

-            # Win rate
-            win_rate = (factor_col.loc[valid_idx] > 0).sum() / len(valid_idx)
+            # Annualized return
+            annualized_return = float(ret_mean * bars_per_year / bars_per_forward * 100)
+
+            # Max drawdown on equity curve
+            equity = (1.0 + strategy_ret).cumprod()
+            running_max = equity.expanding().max()
+            drawdown = (equity - running_max) / running_max.replace(0, np.nan)
+            max_drawdown = float(drawdown.min()) if len(drawdown) > 0 else 0.0
+
+            # Win rate: fraction of positive strategy returns
+            win_rate = float((strategy_ret > 0).sum()) / len(strategy_ret) if len(strategy_ret) > 0 else 0.0

            # Create result series compatible with Qlib backtest result format
            result = pd.Series({
@@ -476,14 +579,14 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                "1day.excess_return_with_cost.max_drawdown": max_drawdown,
                "win_rate": win_rate,
                "1day.excess_return_with_cost.information_ratio": rank_ic,
-                "1day.excess_return_with_cost.std": factor_std,
+                "1day.excess_return_with_cost.std": float(ret_std),
                "1day.pos": len(valid_idx),
                "factor_name": factor_name,
            })

            logger.info(
                f"Direct evaluation: IC={ic:.6f}, Sharpe={sharpe:.4f}, "
-                f"AnnRet={annualized_return:.4f}%, WR={win_rate:.2%}"
+                f"AnnRet={annualized_return:.4f}%, WR={win_rate:.2%}",
            )
            return result

@@ -492,7 +595,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            return None

    def _save_failed_run(self, exp, stdout: str, error_type: str = "unknown",
-                         validation: Optional[dict] = None) -> None:
+                         validation: dict | None = None) -> None:
        """
        Save failed run information to results/failed_runs.json for debugging.

@@ -519,20 +622,20 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):

            # Get factor name
            factor_name = "unknown"
-            if hasattr(exp, 'hypothesis') and exp.hypothesis is not None:
-                factor_name = getattr(exp.hypothesis, 'hypothesis', 'unknown')
+            if hasattr(exp, "hypothesis") and exp.hypothesis is not None:
+                factor_name = getattr(exp.hypothesis, "hypothesis", "unknown")

            # Build failed run record
            failed_record = {
                "timestamp": datetime.now().isoformat(),
                "factor_name": factor_name,
                "error_type": error_type,
-                "stdout": stdout if stdout else "(empty)",
+                "stdout": stdout or "(empty)",
                "validation": validation,
                "experiment_details": {
-                    "base_features": list(getattr(exp, 'base_features', {}).keys()) if hasattr(exp, 'base_features') else [],
-                    "hypothesis": getattr(exp.hypothesis, 'hypothesis', str(getattr(exp, 'hypothesis', 'N/A')))
-                                  if hasattr(exp, 'hypothesis') else "N/A",
+                    "base_features": list(getattr(exp, "base_features", {}).keys()) if hasattr(exp, "base_features") else [],
+                    "hypothesis": getattr(exp.hypothesis, "hypothesis", str(getattr(exp, "hypothesis", "N/A")))
+                                  if hasattr(exp, "hypothesis") else "N/A",
                },
            }

@@ -555,11 +658,11 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):

            failed_file.write_text(
                json.dumps(existing_records, indent=2, default=str, ensure_ascii=False),
-                encoding="utf-8"
+                encoding="utf-8",
            )
            logger.info(
                f"Failed run saved: {factor_name} (type={error_type}) "
-                f"→ {failed_file}"
+                f"→ {failed_file}",
            )

        except Exception as e:
@@ -582,21 +685,23 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            containing metric names like 'IC', '1day.excess_return_with_cost.shar', etc.
        """
        try:
-            import json
-            import pandas as pd
            from pathlib import Path
+
+            import pandas as pd
            from rdagent.components.backtesting import ResultsDatabase

-            # Get factor name from hypothesis
+            # Get factor name: prefer hypothesis, fallback to result Series 'factor_name' key
            factor_name = "unknown"
-            if hasattr(exp, 'hypothesis') and exp.hypothesis is not None:
-                factor_name = getattr(exp.hypothesis, 'hypothesis', 'unknown')
+            if hasattr(exp, "hypothesis") and exp.hypothesis is not None:
+                factor_name = getattr(exp.hypothesis, "hypothesis", "unknown")
+            if factor_name == "unknown" and isinstance(result, pd.Series) and "factor_name" in result.index:
+                factor_name = str(result["factor_name"])

            # Check if already rejected by protection
-            if getattr(exp, 'rejected_by_protection', False):
+            if getattr(exp, "rejected_by_protection", False):
                logger.info(
                    f"Factor rejected by protection, skipping DB save: "
-                    f"{getattr(exp, 'protection_reason', 'unknown')}"
+                    f"{getattr(exp, 'protection_reason', 'unknown')}",
                )
                return

@@ -612,47 +717,47 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            # Extract metrics from result (pd.Series from qlib_res.csv)
            metrics = {}
            if isinstance(result, pd.Series):
-                metrics['ic'] = self._safe_float(result.get('IC', None))
-                metrics['sharpe_ratio'] = self._safe_float(
-                    result.get('1day.excess_return_with_cost.shar',
-                    result.get('1day.excess_return_with_cost.sharpe', None))
+                metrics["ic"] = self._safe_float(result.get("IC", None))
+                metrics["sharpe_ratio"] = self._safe_float(
+                    result.get("1day.excess_return_with_cost.shar",
+                    result.get("1day.excess_return_with_cost.sharpe", None)),
                )
-                metrics['annualized_return'] = self._safe_float(
-                    result.get('1day.excess_return_with_cost.annualized_return', None)
+                metrics["annualized_return"] = self._safe_float(
+                    result.get("1day.excess_return_with_cost.annualized_return", None),
                )
-                metrics['max_drawdown'] = self._safe_float(
-                    result.get('1day.excess_return_with_cost.max_drawdown', None)
+                metrics["max_drawdown"] = self._safe_float(
+                    result.get("1day.excess_return_with_cost.max_drawdown", None),
                )
-                metrics['win_rate'] = self._safe_float(result.get('win_rate', None))
-                metrics['information_ratio'] = self._safe_float(
-                    result.get('1day.excess_return_with_cost.information_ratio', None)
+                metrics["win_rate"] = self._safe_float(result.get("win_rate", None))
+                metrics["information_ratio"] = self._safe_float(
+                    result.get("1day.excess_return_with_cost.information_ratio", None),
                )
-                metrics['volatility'] = self._safe_float(
-                    result.get('1day.excess_return_with_cost.std',
-                    result.get('1day.excess_return_with_cost.volatility', None))
+                metrics["volatility"] = self._safe_float(
+                    result.get("1day.excess_return_with_cost.std",
+                    result.get("1day.excess_return_with_cost.volatility", None)),
                )
                # Store raw metrics for JSON export
-                metrics['raw_metrics'] = result.to_dict()
+                metrics["raw_metrics"] = result.to_dict()
            elif isinstance(result, dict):
-                metrics['ic'] = self._safe_float(result.get('IC', result.get('ic', None)))
-                metrics['sharpe_ratio'] = self._safe_float(
-                    result.get('sharpe', result.get('sharpe_ratio', None))
+                metrics["ic"] = self._safe_float(result.get("IC", result.get("ic", None)))
+                metrics["sharpe_ratio"] = self._safe_float(
+                    result.get("sharpe", result.get("sharpe_ratio", None)),
                )
-                metrics['annualized_return'] = self._safe_float(result.get('annualized_return', None))
-                metrics['max_drawdown'] = self._safe_float(result.get('max_drawdown', None))
-                metrics['win_rate'] = self._safe_float(result.get('win_rate', None))
-                metrics['information_ratio'] = None
-                metrics['volatility'] = None
-                metrics['raw_metrics'] = result
+                metrics["annualized_return"] = self._safe_float(result.get("annualized_return", None))
+                metrics["max_drawdown"] = self._safe_float(result.get("max_drawdown", None))
+                metrics["win_rate"] = self._safe_float(result.get("win_rate", None))
+                metrics["information_ratio"] = None
+                metrics["volatility"] = None
+                metrics["raw_metrics"] = result

            # Result validation before saving (warnings, not blocking)
            self._log_result_warnings(factor_name, result, metrics)

            # Only save if we have at least IC or Sharpe
-            if metrics.get('ic') is None and metrics.get('sharpe_ratio') is None:
+            if metrics.get("ic") is None and metrics.get("sharpe_ratio") is None:
                logger.warning(
                    f"No valid IC/Sharpe for factor '{factor_name}', skipping DB save. "
-                    f"IC={metrics.get('ic')}, Sharpe={metrics.get('sharpe_ratio')}"
+                    f"IC={metrics.get('ic')}, Sharpe={metrics.get('sharpe_ratio')}",
                )
                return

@@ -663,19 +768,19 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            db_file = db_path / "backtest_results.db"

            # Parallel run isolation: use run-specific subdirectory if PARALLEL_RUN_ID is set
-            run_id = os.getenv("PARALLEL_RUN_ID", "0")
-            if run_id != "0":
+            parallel_run_id = os.getenv("PARALLEL_RUN_ID", "0")
+            if parallel_run_id != "0":
                # For parallel runs, save to isolated results directory
-                isolated_db_path = project_root / "results" / "runs" / f"run{run_id}" / "db"
+                isolated_db_path = project_root / "results" / "runs" / f"run{parallel_run_id}" / "db"
                isolated_db_path.mkdir(parents=True, exist_ok=True)
                db_file = isolated_db_path / "backtest_results.db"

            # Save to database
            db = ResultsDatabase(db_path=str(db_file))
-            run_id = db.add_backtest(factor_name=factor_name[:100], metrics=metrics)
+            db_run_id = db.add_backtest(factor_name=factor_name[:100], metrics=metrics)
            logger.info(
                f"Factor result saved to DB: {factor_name[:60]} "
-                f"(IC={metrics.get('ic')}, Sharpe={metrics.get('sharpe_ratio')}, run_id={run_id})"
+                f"(IC={metrics.get('ic')}, Sharpe={metrics.get('sharpe_ratio')}, run_id={db_run_id})"
            )

            # Extract factor code and description from experiment
@@ -683,10 +788,10 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):

            # Also write a JSON summary to results/factors/ for file-based access
            self._save_factor_json(
-                factor_name, metrics, run_id,
+                factor_name, metrics, db_run_id,
                factor_code=factor_code,
                factor_description=factor_description,
-                exp=exp
+                exp=exp,
            )

            # Save factor values as parquet for strategy building
@@ -698,7 +803,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            import traceback
            logger.error(
                f"Database save failed for factor '{getattr(exp.hypothesis, 'hypothesis', 'unknown')}': {e}\n"
-                f"Traceback: {traceback.format_exc()}"
+                f"Traceback: {traceback.format_exc()}",
            )

    def _save_factor_json(self, factor_name: str, metrics: dict, run_id: int,
@@ -809,14 +914,14 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                factor_description = match.group(1).strip()[:500]
            else:
                # Try comments
-                lines = factor_code.split('\n')
+                lines = factor_code.split("\n")
                desc_lines = []
                for line in lines[:20]:
                    stripped = line.strip()
-                    if stripped.startswith('#') and not stripped.startswith('#!'):
+                    if stripped.startswith("#") and not stripped.startswith("#!"):
                        desc_lines.append(stripped[1:].strip())
                if desc_lines:
-                    factor_description = ' '.join(desc_lines)[:500]
+                    factor_description = " ".join(desc_lines)[:500]

        return factor_code, factor_description

@@ -824,41 +929,80 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        """
        Save factor time-series values as parquet for strategy building.

-        This is essential for walk-forward validation and strategy combination.
-
-        Parameters
-        ----------
-        factor_name : str
-            Name of the factor
-        exp : QlibFactorExperiment
-            The experiment with factor values
+        Reruns the factor code on the FULL 6-year dataset so the parquet covers
+        the complete backtest range (not just the debug 2024 subset).
        """
        import os as _os
+        import shutil
+        import subprocess
+        import sys
+        import tempfile

        try:
-            # Get workspace path
-            workspace_path = exp.experiment_workspace.workspace_path
+            # factor.py lives in sub_workspace_list[0], not experiment_workspace
+            workspace_path = None
+            if exp.sub_workspace_list:
+                for ws in exp.sub_workspace_list:
+                    if ws is not None and hasattr(ws, "workspace_path"):
+                        fp = ws.workspace_path / "factor.py"
+                        if fp.exists():
+                            workspace_path = ws.workspace_path
+                            break
+            if workspace_path is None:
+                workspace_path = exp.experiment_workspace.workspace_path
            if workspace_path is None:
                return

-            result_h5 = workspace_path / "result.h5"
-            if not result_h5.exists():
+            factor_py = workspace_path / "factor.py"
+            if not factor_py.exists():
                return

-            # Read factor values
+            project_root = Path(__file__).parent.parent.parent.parent.parent
+            full_data = (
+                project_root
+                / "git_ignore_folder"
+                / "factor_implementation_source_data"
+                / "intraday_pv.h5"
+            )
+            if not full_data.exists():
+                return
+
+            # Run factor code on full data in a temp workspace
            import pandas as pd
-            df = pd.read_hdf(str(result_h5), key="data")
+            with tempfile.TemporaryDirectory(prefix="predix_fullval_") as tmp_dir:
+                tmp = Path(tmp_dir)
+                shutil.copy(str(factor_py), str(tmp / "factor.py"))
+                shutil.copy(str(full_data), str(tmp / "intraday_pv.h5"))
+
+                ret = subprocess.run(
+                    [sys.executable, "factor.py"],
+                    cwd=str(tmp),
+                    capture_output=True,
+                    timeout=300,
+                    check=False,
+                )
+                if ret.returncode != 0:
+                    logger.warning(
+                        f"Full-data factor run failed (exit {ret.returncode}): "
+                        f"{ret.stderr[:500] if ret.stderr else '(no stderr)'}"
+                    )
+                    # Fall back to debug-data result if full-data run fails
+                    result_h5 = workspace_path / "result.h5"
+                    if not result_h5.exists():
+                        return
+                    df = pd.read_hdf(str(result_h5), key="data")
+                else:
+                    result_h5_full = tmp / "result.h5"
+                    if not result_h5_full.exists():
+                        return
+                    df = pd.read_hdf(str(result_h5_full), key="data")
+
            if df is None or df.empty:
                return

-            # Get the factor series (first column)
            series = df.iloc[:, 0]
            series.name = factor_name

-            # Save to results/factors/values/
-            project_root = Path(__file__).parent.parent.parent.parent.parent
-
-            # Parallel run isolation
            parallel_run_id = _os.getenv("PARALLEL_RUN_ID", "0")
            if parallel_run_id != "0":
                values_dir = project_root / "results" / "runs" / f"run{parallel_run_id}" / "factors" / "values"
@@ -866,17 +1010,12 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                values_dir = project_root / "results" / "factors" / "values"

            values_dir.mkdir(parents=True, exist_ok=True)
-
-            # Safe filename
            safe_name = factor_name.replace("/", "_").replace("\\", "_").replace(" ", "_")[:100]
            parquet_path = values_dir / f"{safe_name}.parquet"
+            series.to_frame().to_parquet(str(parquet_path))

-            # Save as parquet (with datetime index)
-            series.to_parquet(str(parquet_path))
-
-        except Exception as e:
-            # Don't let factor value saving break the main workflow
-            pass
+        except Exception:
+            logging.debug("Error in save_factor_values_to_parquet", exc_info=True)

    def _log_result_warnings(self, factor_name: str, result, metrics: dict) -> None:
        """
@@ -897,7 +1036,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        warnings_list = []

        # Check IC
-        ic = metrics.get('ic')
+        ic = metrics.get("ic")
        if ic is None:
            warnings_list.append("IC is None — factor has no predictive power")
        elif abs(ic) < 0.001:
@@ -905,7 +1044,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):

        # Check positions (1day.pos) — CRITICAL for EURUSD
        if isinstance(result, pd.Series):
-            pos_value = result.get('1day.pos', None)
+            pos_value = result.get("1day.pos", None)
            if pos_value is not None:
                try:
                    pos_float = float(pos_value)
@@ -913,23 +1052,23 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
                        warnings_list.append(
                            "WARNING: 1day.pos == 0 — ZERO positions opened! "
                            "Model stayed completely neutral. Check Qlib config: "
-                            "ensure topk=1 and market=eurusd for single-asset trading."
+                            "ensure topk=1 and market=eurusd for single-asset trading.",
                        )
                    elif pos_float < 10:
                        warnings_list.append(
                            f"Low position count: 1day.pos = {pos_float:.0f} — "
-                            f"model traded very rarely"
+                            f"model traded very rarely",
                        )
                except (ValueError, TypeError):
                    pass

        # Check Sharpe
-        sharpe = metrics.get('sharpe_ratio')
+        sharpe = metrics.get("sharpe_ratio")
        if sharpe is not None and abs(sharpe) < 0.1:
            warnings_list.append(f"Sharpe near zero ({sharpe:.4f}) — no risk-adjusted edge")

        # Check max drawdown
-        mdd = metrics.get('max_drawdown')
+        mdd = metrics.get("max_drawdown")
        if mdd is not None and mdd < -0.5:
            warnings_list.append(f"Extreme drawdown: {mdd:.2%} — high risk factor")

@@ -944,7 +1083,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            return None
        try:
            f = float(value)
-            if pd.isna(f) or f == float('inf') or f == float('-inf'):
+            if pd.isna(f) or f == float("inf") or f == float("-inf"):
                return None
            return f
        except (ValueError, TypeError):
@@ -987,7 +1126,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):

        if protection_result.should_block:
            logger.warning(
-                f"Factor {factor_name} rejected by protection manager: {protection_result.reason}"
+                f"Factor {factor_name} rejected by protection manager: {protection_result.reason}",
            )
            # Mark factor as rejected by protection
            exp.rejected_by_protection = True
@@ -1012,8 +1151,8 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
        from pathlib import Path

        factor_name = "unknown"
-        if hasattr(exp, 'hypothesis') and exp.hypothesis is not None:
-            factor_name = getattr(exp.hypothesis, 'hypothesis', 'unknown')
+        if hasattr(exp, "hypothesis") and exp.hypothesis is not None:
+            factor_name = getattr(exp.hypothesis, "hypothesis", "unknown")

        # Build log entry
        log_entry = {
@@ -1025,42 +1164,42 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):
            "annualized_return": None,
            "max_drawdown": None,
            "win_rate": None,
-            "rejected_by_protection": getattr(exp, 'rejected_by_protection', False),
-            "protection_reason": getattr(exp, 'protection_reason', None),
+            "rejected_by_protection": getattr(exp, "rejected_by_protection", False),
+            "protection_reason": getattr(exp, "protection_reason", None),
        }

        # Extract metrics if available
        if result is not None:
-            if hasattr(result, 'get'):  # pd.Series or dict
-                ic_val = result.get('IC', result.get('ic', None))
-                log_entry['ic'] = self._safe_float(ic_val) if ic_val is not None else None
+            if hasattr(result, "get"):  # pd.Series or dict
+                ic_val = result.get("IC", result.get("ic", None))
+                log_entry["ic"] = self._safe_float(ic_val) if ic_val is not None else None

-                sharpe_val = result.get('1day.excess_return_with_cost.shar',
-                                        result.get('1day.excess_return_with_cost.sharpe',
-                                        result.get('sharpe', None)))
-                log_entry['sharpe'] = self._safe_float(sharpe_val) if sharpe_val is not None else None
+                sharpe_val = result.get("1day.excess_return_with_cost.shar",
+                                        result.get("1day.excess_return_with_cost.sharpe",
+                                        result.get("sharpe", None)))
+                log_entry["sharpe"] = self._safe_float(sharpe_val) if sharpe_val is not None else None

-                ann_ret = result.get('1day.excess_return_with_cost.annualized_return',
-                                     result.get('annualized_return', None))
-                log_entry['annualized_return'] = self._safe_float(ann_ret) if ann_ret is not None else None
+                ann_ret = result.get("1day.excess_return_with_cost.annualized_return",
+                                     result.get("annualized_return", None))
+                log_entry["annualized_return"] = self._safe_float(ann_ret) if ann_ret is not None else None

-                mdd = result.get('1day.excess_return_with_cost.max_drawdown',
-                                 result.get('max_drawdown', None))
-                log_entry['max_drawdown'] = self._safe_float(mdd) if mdd is not None else None
+                mdd = result.get("1day.excess_return_with_cost.max_drawdown",
+                                 result.get("max_drawdown", None))
+                log_entry["max_drawdown"] = self._safe_float(mdd) if mdd is not None else None

-                wr = result.get('win_rate', None)
-                log_entry['win_rate'] = self._safe_float(wr) if wr is not None else None
+                wr = result.get("win_rate", None)
+                log_entry["win_rate"] = self._safe_float(wr) if wr is not None else None

            # Determine status
-            if log_entry['ic'] is not None or log_entry['sharpe'] is not None:
-                log_entry['status'] = "success"
-            elif getattr(exp, 'rejected_by_protection', False):
-                log_entry['status'] = "rejected_protection"
+            if log_entry["ic"] is not None or log_entry["sharpe"] is not None:
+                log_entry["status"] = "success"
+            elif getattr(exp, "rejected_by_protection", False):
+                log_entry["status"] = "rejected_protection"
            else:
-                log_entry['status'] = "no_valid_metrics"
+                log_entry["status"] = "no_valid_metrics"
        else:
-            log_entry['status'] = "execution_failed"
-            log_entry['reason'] = "Result was None"
+            log_entry["status"] = "execution_failed"
+            log_entry["reason"] = "Result was None"

        # Write to results/logs/
        try:
@@ -1083,7 +1222,7 @@ class QlibFactorRunner(CachedRunner[QlibFactorExperiment]):

            logger.info(
                f"Run log written for '{factor_name[:50]}': "
-                f"status={log_entry['status']}, IC={log_entry['ic']}, Sharpe={log_entry['sharpe']}"
+                f"status={log_entry['status']}, IC={log_entry['ic']}, Sharpe={log_entry['sharpe']}",
            )
        except Exception as e:
            logger.error(f"Failed to write run log: {e}")
@@ -203,12 +203,14 @@ class QlibModelRunner(CachedRunner[QlibModelExperiment]):

            # Save to database
            db = ResultsDatabase()
-            run_id = db.add_backtest(factor_name=factor_name[:100], metrics=metrics)
-            logger.info(
-                f"Model result saved to DB: {factor_name[:50]} "
-                f"(IC={metrics.get('ic')}, Sharpe={metrics.get('sharpe_ratio')}, run_id={run_id})"
-            )
-            db.close()
+            try:
+                run_id = db.add_backtest(factor_name=factor_name[:100], metrics=metrics)
+                logger.info(
+                    f"Model result saved to DB: {factor_name[:50]} "
+                    f"(IC={metrics.get('ic')}, Sharpe={metrics.get('sharpe_ratio')}, run_id={run_id})"
+                )
+            finally:
+                db.close()

        except Exception as e:
            logger.warning(f"Database save failed for model {getattr(exp.hypothesis, 'hypothesis', 'unknown')}: {e}")
@@ -173,8 +173,10 @@ class StrategyEvaluator:
        df_norm = (df - df.mean()) / df.std()
        signal = df_norm.mean(axis=1)

-        # Calculate returns (forward returns approximation)
-        # Use factor values as proxy for returns
+        # Strategy returns: signal direction * forward returns
+        # Approximate forward returns from signal changes (no OHLCV in this context)
+        # Fall back to qlib-style: use signal sign as position, diff as P&L proxy
+        # This is approximate — real evaluation needs OHLCV data
        returns = signal.diff().fillna(0)

        # Apply transaction costs
@@ -184,15 +186,16 @@ class StrategyEvaluator:

        # Calculate metrics
        total_return = returns.sum()
-        ann_factor = np.sqrt(252 * 1440 / 96)  # Annualization for 1min data
+        bars_per_year = 252 * 1440
+        ann_factor = np.sqrt(bars_per_year / 96)  # Annualization for 1min data
        ann_return = total_return * ann_factor
-        volatility = returns.std() * np.sqrt(252 * 1440 / 96)
+        volatility = returns.std() * ann_factor
        sharpe = ann_return / volatility if volatility > 0 else 0

-        # Max drawdown
-        cum = returns.cumsum()
-        running_max = cum.expanding().max()
-        drawdown = (cum - running_max) / running_max.replace(0, np.nan)
+        # Max drawdown on equity curve
+        equity = (1.0 + returns).cumprod()
+        running_max = equity.expanding().max()
+        drawdown = (equity - running_max) / running_max.replace(0, np.nan)
        max_dd = drawdown.min() if len(drawdown) > 0 else 0

        # Win rate
@@ -241,6 +244,7 @@ class StrategyBuilder:
                if data.get("status") == "success" and data.get("ic") is not None:
                    factors.append(data)
            except Exception:
+                logger.warning("Failed to load factor file %s", f, exc_info=True)
                continue

        # Sort by absolute IC
@@ -30,7 +30,8 @@ def _build_execute_calls(exp: QlibFactorExperiment, base_feature_workspaces: lis
    execute_calls = []

    if exp.sub_tasks:
-        assert isinstance(exp.prop_dev_feedback, CoSTEERMultiFeedback)
+        if not isinstance(exp.prop_dev_feedback, CoSTEERMultiFeedback):
+            raise TypeError("exp.prop_dev_feedback must be of type CoSTEERMultiFeedback")
        execute_calls.extend(
            (implementation.execute, ("All",))
            for implementation, feedback in zip(exp.sub_workspace_list, exp.prop_dev_feedback)
@@ -23,14 +23,25 @@ $low: low price at 1-minute bar.
 $volume: volume at 1-minute bar (tick volume for FX).

 ## Important Notes for 1min Data
- 96 bars = 1 trading day (24 hours for FX)
+- 1 bar = 1 minute (confirmed)
 - 16 bars = 16 minutes
- 4 bars = 4 minutes
- 1 bar = 1 minute
+- 60 bars = 1 hour
+- ~1440 bars = 1 full trading day (FX trades nearly 24h, Mon 00:00 - Fri 22:00 UTC approx.)
+- Typical bars per calendar day: ~1200-1440 (varies by weekday, holidays have fewer)
+- Do NOT assume 96 bars/day — the actual count depends on the date
 - Data range: 2020-01-01 to 2026-03-20
 - Instrument: EURUSD
 - Timezone: UTC

+## IMPORTANT: Bars per Day Correction
+The dataset has approximately 1440 bars per full trading day (1 bar = 1 minute, ~24h of FX trading).
+Some older documentation incorrectly stated "96 bars = 1 day" — this is WRONG. Always use:
+- 60 bars = 1 hour
+- 480 bars = 8 hours (London session 08:00-16:00 UTC)
+- 180 bars = 3 hours (London/NY overlap 13:00-16:00 UTC)
+Use datetime hour filtering (e.g., `df[df.index.get_level_values('datetime').hour.between(8, 15)]`)
+to select session bars — do NOT use bar-count offsets to define sessions.
+
 ## Session Times (UTC)
 - Asian: 00:00-08:00 UTC (low volatility)
 - London: 08:00-16:00 UTC (high volatility)
@@ -104,7 +104,7 @@ qlib_factor_strategy: |-
     result_df.columns = ['daily_volume_price_divergence']
     ```

-  4. **Process ALL data — do not filter dates**: The source HDF5 contains data from 2020-01-01 to 2026-03-20. Do NOT filter to a single year. If your output has only 314 entries (one year of daily data), the factor will be rejected. Expected output: ~1500+ daily entries for 2020-2026.
+  4. **Process ALL data — do not filter dates**: The source HDF5 contains data from 2020-01-01 to 2026-03-20 (development runs may use a 2024-only debug dataset with ~300 entries, which is acceptable). Do NOT filter to a single year in your code. Write your code to process whatever date range is available in the HDF5 file — do not hardcode date filters. Expected output for production data: ~1500+ daily entries for 2020-2026. Expected output for debug data: ~300 daily entries for 2024. Both are valid.

  5. **Use `transform()` instead of `apply()` for per-group calculations**: `transform()` preserves the original index while `apply()` may reduce the number of rows unexpectedly:
     ```python
@@ -121,6 +121,35 @@ qlib_factor_strategy: |-
     assert result_df.index.names == ['datetime', 'instrument'], f"Index names must be ['datetime', 'instrument'], got {result_df.index.names}"
     ```

+  7. **NEVER use same-day aggregations as the factor value — always shift by 1 day**: If your factor computes a daily aggregate (e.g. daily close return, daily OHLC range, daily volume), that aggregate is only known at end-of-day. Using it at the start of the same day is look-ahead bias. You MUST shift the daily aggregate by 1 day before forward-filling to minute bars:
+     ```python
+     # WRONG: look-ahead bias! Today's close return is not known at 00:00
+     daily_ret = df['$close'].groupby(level='instrument').resample('1D', level='datetime').last().pct_change()
+     result_df['my_factor'] = daily_ret.groupby(level='instrument').transform(lambda x: x.reindex(df.index.get_level_values('datetime'), method='ffill'))
+
+     # CORRECT: shift by 1 trading day so factor value at day T = aggregate of day T-1
+     daily_close = df.groupby([df.index.get_level_values('datetime').normalize(), df.index.get_level_values('instrument')])['$close'].last()
+     daily_close.index.names = ['date', 'instrument']
+     daily_ret = daily_close.groupby(level='instrument').pct_change().shift(1)  # <-- shift(1) is MANDATORY
+     # then map back to minute bars via ffill
+     ```
+     This rule applies to ALL daily aggregations: returns, OHLC stats, volume, momentum, slopes, etc.
+     **Session-based aggregations (London, NY, Asian session returns) are also daily aggregations** — the London
+     session (08:00-16:00 UTC) ends at 16:00, so its return must be shifted by 1 day before use.
+     Intraday rolling factors (e.g. 30-min rolling std computed at bar t using only bars t-N..t-1) do NOT need this shift.
+
+  8. **PREFER pure intraday rolling factors**: Factors that use only a trailing window of recent bars (e.g.
+     rolling(30).mean() of returns, RSI(14), Bollinger Band z-score) have NO look-ahead risk and vary every
+     minute. These are the best candidates for short-horizon (60-180 bar) prediction. Examples:
+     - Rolling 15-min / 30-min / 60-min return momentum (15, 30, 60 bars respectively)
+     - Rolling volatility (std of returns over 20-60 bars)
+     - Distance of close from N-bar moving average (z-score)
+     - RSI or similar oscillators computed on 1-min bars
+     - VWAP deviation (requires volume — use $volume column)
+     Always use `.shift(1)` on the lagged window (e.g. `rolling(N).mean().shift(1)`) to avoid using the
+     current bar's own price in its own feature value.
+     NOTE: 1 bar = 1 minute. The data has ~1440 bars per full trading day. Do NOT use 96 as a day proxy.
+
 qlib_factor_output_format: |-
  Your output should be a pandas dataframe similar to the following example information:
  <class 'pandas.core.frame.DataFrame'>
@@ -56,7 +56,8 @@ class QlibQuantScenario(Scenario):
        )

    def background(self, tag=None) -> str:
-        assert tag in [None, "factor", "model"]
+        if tag not in [None, "factor", "model"]:
+            raise ValueError(f"tag must be None, 'factor', or 'model', got {tag!r}")
        quant_background = "The background of the scenario is as follows:\n" + T(".prompts:qlib_quant_background").r(
            runtime_environment=self.get_runtime_environment(),
        )
@@ -83,7 +84,8 @@ class QlibQuantScenario(Scenario):
        return self._source_data

    def output_format(self, tag=None) -> str:
-        assert tag in [None, "factor", "model"]
+        if tag not in [None, "factor", "model"]:
+            raise ValueError(f"tag must be None, 'factor', or 'model', got {tag!r}")
        factor_output_format = (
            "The factor code should output the following format:\n" + T(".prompts:qlib_factor_output_format").r()
        )
@@ -99,7 +101,8 @@ class QlibQuantScenario(Scenario):
            return model_output_format

    def interface(self, tag=None) -> str:
-        assert tag in [None, "factor", "model"]
+        if tag not in [None, "factor", "model"]:
+            raise ValueError(f"tag must be None, 'factor', or 'model', got {tag!r}")
        factor_interface = (
            "The factor code should be written in the following interface:\n" + T(".prompts:qlib_factor_interface").r()
        )
@@ -115,7 +118,8 @@ class QlibQuantScenario(Scenario):
            return model_interface

    def simulator(self, tag=None) -> str:
-        assert tag in [None, "factor", "model"]
+        if tag not in [None, "factor", "model"]:
+            raise ValueError(f"tag must be None, 'factor', or 'model', got {tag!r}")
        factor_simulator = "The factor code will be sent to the simulator:\n" + T(".prompts:qlib_factor_simulator").r()
        model_simulator = "The model code will be sent to the simulator:\n" + T(".prompts:qlib_model_simulator").r()

@@ -185,7 +189,8 @@ class QlibQuantScenario(Scenario):
            return common_description(action) + interface(action) + output(action) + simulator(action)

    def get_runtime_environment(self, tag: str = None) -> str:
-        assert tag in [None, "factor", "model"]
+        if tag not in [None, "factor", "model"]:
+            raise ValueError(f"tag must be None, 'factor', or 'model', got {tag!r}")

        if tag is None or tag == "factor":
            # Use factor env to get the runtime environment
@@ -4,7 +4,7 @@ import shutil
 from pathlib import Path

 import pandas as pd
-from jinja2 import Environment, StrictUndefined
+from jinja2 import Environment, StrictUndefined, select_autoescape

 from rdagent.components.coder.factor_coder.config import FACTOR_COSTEER_SETTINGS
 from rdagent.utils.env import QTDockerEnv
@@ -21,14 +21,16 @@ def generate_data_folder_from_qlib():
        entry=f"python generate.py",
    )

-    assert (Path(__file__).parent / "factor_data_template" / "intraday_pv_all.h5").exists(), (
-        "intraday_pv_all.h5 is not generated. It means rdagent/scenarios/qlib/experiment/factor_data_template/generate.py is not executed correctly. Please check the log: \n"
-        + execute_log
-    )
-    assert (Path(__file__).parent / "factor_data_template" / "intraday_pv_debug.h5").exists(), (
-        "intraday_pv_debug.h5 is not generated. It means rdagent/scenarios/qlib/experiment/factor_data_template/generate.py is not executed correctly. Please check the log: \n"
-        + execute_log
-    )
+    if not (Path(__file__).parent / "factor_data_template" / "intraday_pv_all.h5").exists():
+        raise FileNotFoundError(
+            "intraday_pv_all.h5 is not generated. It means rdagent/scenarios/qlib/experiment/factor_data_template/generate.py is not executed correctly. Please check the log: \n"
+            + execute_log
+        )
+    if not (Path(__file__).parent / "factor_data_template" / "intraday_pv_debug.h5").exists():
+        raise FileNotFoundError(
+            "intraday_pv_debug.h5 is not generated. It means rdagent/scenarios/qlib/experiment/factor_data_template/generate.py is not executed correctly. Please check the log: \n"
+            + execute_log
+        )

    Path(FACTOR_COSTEER_SETTINGS.data_folder).mkdir(parents=True, exist_ok=True)
    shutil.copy(
@@ -67,7 +69,7 @@ def get_file_desc(p: Path, variable_list=[]) -> str:
    """
    p = Path(p)

-    JJ_TPL = Environment(undefined=StrictUndefined).from_string("""
+    JJ_TPL = Environment(undefined=StrictUndefined, autoescape=select_autoescape()).from_string("""
 # {{file_name}}

 ## File Type
@@ -1,4 +1,6 @@
+import logging
 import json
+import os
 from typing import List, Tuple

 from rdagent.components.coder.factor_coder.factor import FactorExperiment, FactorTask
@@ -9,6 +11,47 @@ from rdagent.scenarios.qlib.experiment.model_experiment import QlibModelExperime
 from rdagent.scenarios.qlib.experiment.quant_experiment import QlibQuantScenario
 from rdagent.utils.agent.tpl import T

+
+def _build_compressed_history(trace: Trace, max_history: int) -> str:
+    """Return hypothesis_and_feedback string with only `max_history` entries.
+
+    Older entries beyond the last 2 are compressed to one bullet line each.
+    """
+    if len(trace.hist) == 0:
+        return "No previous hypothesis and feedback available since it's the first round."
+
+    FULL_DETAIL = 2
+    old_hist = trace.hist[:-FULL_DETAIL] if len(trace.hist) > FULL_DETAIL else []
+    recent_hist = trace.hist[-FULL_DETAIL:] if len(trace.hist) > FULL_DETAIL else trace.hist
+
+    parts = []
+    if old_hist:
+        lines = ["## Earlier experiments (summarized):"]
+        for exp, fb in old_hist:
+            names = []
+            for task in exp.sub_tasks:
+                if task is not None and hasattr(task, "factor_name"):
+                    names.append(task.factor_name)
+                elif task is not None and hasattr(task, "model_type"):
+                    names.append(getattr(task, "model_type", "model"))
+            ic_str = ""
+            try:
+                if exp.result is not None and "IC" in exp.result.index:
+                    ic_str = f" IC={exp.result.loc['IC']:.4f}"
+            except Exception:
+                logging.debug("Exception caught", exc_info=True)
+            decision = "PASS" if fb.decision else "FAIL"
+            obs = (fb.observations or "")[:120].replace("\n", " ")
+            lines.append(f"- [{decision}]{ic_str} {', '.join(names) or 'unknown'}: {obs}")
+        parts.append("\n".join(lines))
+
+    if recent_hist:
+        rt = Trace(trace.scen)
+        rt.hist = recent_hist
+        parts.append(T("scenarios.qlib.prompts:hypothesis_and_feedback").r(trace=rt))
+
+    return "\n\n".join(parts)
+
 QlibFactorHypothesis = Hypothesis


@@ -17,13 +60,10 @@ class QlibFactorHypothesisGen(FactorHypothesisGen):
        super().__init__(scen)

    def prepare_context(self, trace: Trace) -> Tuple[dict, bool]:
-        hypothesis_and_feedback = (
-            T("scenarios.qlib.prompts:hypothesis_and_feedback").r(
-                trace=trace,
-            )
-            if len(trace.hist) > 0
-            else "No previous hypothesis and feedback available since it's the first round."
-        )
+        max_h = int(os.environ.get("QLIB_QUANT_MAX_FACTOR_HISTORY", "20"))
+        limited = Trace(trace.scen)
+        limited.hist = trace.hist[-max_h:] if len(trace.hist) > max_h else trace.hist
+        hypothesis_and_feedback = _build_compressed_history(limited, max_h)
        last_hypothesis_and_feedback = (
            T("scenarios.qlib.prompts:last_hypothesis_and_feedback").r(
                experiment=trace.hist[-1][0], feedback=trace.hist[-1][1]
@@ -70,15 +110,15 @@ class QlibFactorHypothesis2Experiment(FactorHypothesis2Experiment):
        if len(trace.hist) == 0:
            hypothesis_and_feedback = "No previous hypothesis and feedback available since it's the first round."
        else:
+            max_h = int(os.environ.get("QLIB_QUANT_MAX_FACTOR_HISTORY", "20"))
+            factor_hist = [
+                e for e in trace.hist
+                if not hasattr(e[0].hypothesis, "action") or e[0].hypothesis.action == "factor"
+            ][-max_h:]
            specific_trace = Trace(trace.scen)
-            for i in range(len(trace.hist) - 1, -1, -1):
-                if not hasattr(trace.hist[i][0].hypothesis, "action") or trace.hist[i][0].hypothesis.action == "factor":
-                    specific_trace.hist.insert(0, trace.hist[i])
-            if len(specific_trace.hist) > 0:
-                specific_trace.hist.reverse()
-                hypothesis_and_feedback = T("scenarios.qlib.prompts:hypothesis_and_feedback").r(
-                    trace=specific_trace,
-                )
+            specific_trace.hist = factor_hist
+            if specific_trace.hist:
+                hypothesis_and_feedback = _build_compressed_history(specific_trace, max_h)
            else:
                hypothesis_and_feedback = "No previous hypothesis and feedback available."

@@ -1,7 +1,7 @@
 import json
+import logging
 import os
 import random
-from typing import Tuple

 from rdagent.app.qlib_rd_loop.conf import QUANT_PROP_SETTING
 from rdagent.components.proposal import FactorAndModelHypothesisGen
@@ -41,7 +41,7 @@ class QlibQuantHypothesis(Hypothesis):
        action: str,
    ) -> None:
        super().__init__(
-            hypothesis, reason, concise_reason, concise_observation, concise_justification, concise_knowledge
+            hypothesis, reason, concise_reason, concise_observation, concise_justification, concise_knowledge,
        )
        self.action = action

@@ -53,10 +53,10 @@ Reason: {self.reason}


 class QlibQuantHypothesisGen(FactorAndModelHypothesisGen):
-    def __init__(self, scen: Scenario) -> Tuple[dict, bool]:
+    def __init__(self, scen: Scenario) -> None:
        super().__init__(scen)

-    def prepare_context(self, trace: Trace) -> Tuple[dict, bool]:
+    def prepare_context(self, trace: Trace) -> tuple[dict, bool]:

        # ========= Bandit ==========
        if QUANT_PROP_SETTING.action_selection == "bandit":
@@ -84,7 +84,7 @@ class QlibQuantHypothesisGen(FactorAndModelHypothesisGen):

            last_hypothesis_and_feedback = (
                T("scenarios.qlib.prompts:last_hypothesis_and_feedback").r(
-                    experiment=trace.hist[-1][0], feedback=trace.hist[-1][1]
+                    experiment=trace.hist[-1][0], feedback=trace.hist[-1][1],
                )
                if len(trace.hist) > 0
                else "No previous hypothesis and feedback available since it's the first round."
@@ -152,9 +152,41 @@ class QlibQuantHypothesisGen(FactorAndModelHypothesisGen):
                        factor_inserted = True
            if len(specific_trace.hist) > 0:
                specific_trace.hist.reverse()
-                hypothesis_and_feedback = T("scenarios.qlib.prompts:hypothesis_and_feedback").r(
-                    trace=specific_trace,
-                )
+                # Keep only the 2 most recent experiments in full detail; compress older ones
+                # to brief bullet points to stay within the LLM context window.
+                FULL_DETAIL_COUNT = 2
+                old_hist = specific_trace.hist[:-FULL_DETAIL_COUNT] if len(specific_trace.hist) > FULL_DETAIL_COUNT else []
+                recent_hist = specific_trace.hist[-FULL_DETAIL_COUNT:] if len(specific_trace.hist) > FULL_DETAIL_COUNT else specific_trace.hist
+
+                parts = []
+                if old_hist:
+                    summary_lines = ["## Earlier experiments (summarized):"]
+                    for exp, fb in old_hist:
+                        factor_names = []
+                        for task in exp.sub_tasks:
+                            if task is not None and hasattr(task, "factor_name"):
+                                factor_names.append(task.factor_name)
+                            elif task is not None and hasattr(task, "model_type"):
+                                factor_names.append(getattr(task, "model_type", "model"))
+                        names_str = ", ".join(factor_names) if factor_names else "unknown"
+                        ic_str = ""
+                        try:
+                            if exp.result is not None:
+                                ic_val = exp.result.loc["IC"] if "IC" in exp.result.index else ""
+                                ic_str = f" IC={ic_val:.4f}" if ic_val != "" else ""
+                        except Exception:
+                            logging.debug("Error getting IC", exc_info=True)
+                        decision_str = "PASS" if fb.decision else "FAIL"
+                        obs_short = (fb.observations or "")[:120].replace("\n", " ")
+                        summary_lines.append(f"- [{decision_str}]{ic_str} {names_str}: {obs_short}")
+                    parts.append("\n".join(summary_lines))
+
+                if recent_hist:
+                    recent_trace = Trace(specific_trace.scen)
+                    recent_trace.hist = recent_hist
+                    parts.append(T("scenarios.qlib.prompts:hypothesis_and_feedback").r(trace=recent_trace))
+
+                hypothesis_and_feedback = "\n\n".join(parts)
            else:
                hypothesis_and_feedback = "No previous hypothesis and feedback available."

@@ -162,7 +194,7 @@ class QlibQuantHypothesisGen(FactorAndModelHypothesisGen):
        for i in range(len(trace.hist) - 1, -1, -1):
            if trace.hist[i][0].hypothesis.action == action:
                last_hypothesis_and_feedback = T("scenarios.qlib.prompts:last_hypothesis_and_feedback").r(
-                    experiment=trace.hist[i][0], feedback=trace.hist[i][1]
+                    experiment=trace.hist[i][0], feedback=trace.hist[i][1],
                )
                break

@@ -171,7 +203,7 @@ class QlibQuantHypothesisGen(FactorAndModelHypothesisGen):
            for i in range(len(trace.hist) - 1, -1, -1):
                if trace.hist[i][0].hypothesis.action == "model" and trace.hist[i][1].decision is True:
                    sota_hypothesis_and_feedback = T("scenarios.qlib.prompts:sota_hypothesis_and_feedback").r(
-                        experiment=trace.hist[i][0], feedback=trace.hist[i][1]
+                        experiment=trace.hist[i][0], feedback=trace.hist[i][1],
                    )
                    break

@@ -77,6 +77,7 @@ def count_valid_factors() -> int:
            if data.get("status") == "success" and data.get("ic") is not None:
                count += 1
        except Exception:
+            logger.warning("Failed to load factor file %s", json_file, exc_info=True)
            continue

    return count
@@ -71,7 +71,7 @@ def submit_for_grading(grading_url: str, model_path: str) -> dict | None:
 def main():
    MODEL_PATH = os.environ.get("MODEL_PATH")
    DATA_PATH = os.environ.get("DATA_PATH")
-    OUTPUT_DIR = os.environ.get("OUTPUT_DIR", "/tmp/autorl_output")
+    OUTPUT_DIR = os.environ.get("OUTPUT_DIR", "/tmp/autorl_output")  # nosec B108 — Docker container output dir, configurable via env var
    GRADING_SERVER_URL = os.environ.get("GRADING_SERVER_URL", "")
    TRAIN_RATIO = float(os.environ.get("TRAIN_RATIO", "0.05"))
    NUM_EPOCHS = int(os.environ.get("NUM_EPOCHS", "3"))
@@ -391,7 +391,7 @@ def set_baseline():
    return jsonify({"baseline_score": score, "status": "set"})


-def run_server(task: str, base_model: str, workspace: str, host: str = "0.0.0.0", port: int = 5000):
+def run_server(task: str, base_model: str, workspace: str, host: str = "127.0.0.1", port: int = 5000):
    """启动服务器"""
    init_server(task, base_model, workspace)
    logger.info(f"Grading Server | task={task} | {host}:{port}")
@@ -435,7 +435,7 @@ class LocalServerContext(GradingServerContext):
        logger.info(f"[Local Mode] Starting evaluation server on port {self.port}...")
        self.server = init_server(self.task, self.base_model, self.workspace)

-        self._http_server = make_server("0.0.0.0", self.port, app, threaded=True)
+        self._http_server = make_server("0.0.0.0", self.port, app, threaded=True)  # nosec B104 — intentional: Docker sandbox requires all-interface binding
        self._thread = threading.Thread(target=self._http_server.serve_forever, daemon=True)
        self._thread.start()

@@ -488,7 +488,7 @@ if __name__ == "__main__":
    parser.add_argument("--base-model", type=str, default="")
    parser.add_argument("--workspace", type=str, default=".")
    parser.add_argument("--port", type=int, default=5000)
-    parser.add_argument("--host", type=str, default="0.0.0.0")
+    parser.add_argument("--host", type=str, default="127.0.0.1")
    args = parser.parse_args()

    run_server(args.task, args.base_model, args.workspace, args.host, args.port)
@@ -9,7 +9,7 @@ peft>=0.18.1

 # Evaluation
 opencompass==0.5.1
-setuptools<75  # uv venv doesn't include, opencompass depends on pkg_resources
+setuptools>=78.1.1  # Security fix: GHSA-8g6x-3r52-4m6c (path traversal in PackageIndex.download, arbitrary file write/RCE)

 # Inference acceleration (optional, TRL supports 0.10.2-0.12.0)
 # Security: Version >=0.14.0 fixes CVE-2026-22807 (RCE via auto_map dynamic module loading)
--- a/Show More
+++ b/Show More