scripts/cii_criteria.py and scripts/cii_justifications.json moved to the
new dedicated repo, generalized for any project:
https://github.com/masdevid/cii-best-practices
Install as an agent skill with:
npx skills add masdevid/cii-best-practices
Referencing secrets.* in a step-level if: expression makes GitHub reject
the whole workflow file at parse time: every push to any branch produced
a startup-failure run for release.yml with zero jobs ('Code Scanning
could not...' style runs named .github/workflows/release.yml). The tags
trigger was irrelevant because an unparseable workflow has no readable
triggers.
Fix: evaluate the both-secrets-present check in job-level env (where the
secrets context IS allowed) and test env.HAS_GPG_SECRETS in the step if:.
Behavior unchanged: sign when both secrets exist, ship unsigned otherwise.
The Rust workflow lint job failed on master:
- cargo fmt --check: imports in src/main.rs were misordered
(mcp_server/models/pipeline lines out of alphabetical order,
McpError/McpRequest/McpResponse tuple unsorted) from b843146.
- cargo clippy -D warnings: clippy::new_without_default now fires on
DealAnalyzer, ReportExtractor, OptimizationParser, StageExecutor
and McpServer because the lib target (src/lib.rs) makes their
pub constructors part of the public API.
Fix: reorder main.rs imports per rustfmt; add Default impls
delegating to new() for the five types.
Satisfies vulnerability_report_process/know_secure_design/know_common_errors via SECURITY.md; delivery_unsigned via GPG-signed releases (public key in docs/signing-key.asc); N/A justifications for the 4 N/A-able MUST criteria (crypto_password_storage, vulnerability_report_private, vulnerability_report_response, release_notes_vulns). Backs the OpenSSF Best Practices passing badge and closes the CIIBestPracticesID alert.
The scripts/cii_criteria.py helper fetches bestpractices.dev criteria
and generates pre-filled edit URLs for each criterion, streamlining
badge maintenance. CONTRIBUTING.md backs the contribution and testing
criteria referenced by the CII best-practices submission.
- Add opt_max_agents config (default 75% of CPUs, capped at 20)
- Set LocalAgents in tester .ini and pin MT5 to CPUs 0..max_agents via taskset
- Resolve .set filename consistently between tester + ini config
- Move .mt5mcp_jobs to temp dir for persistence across CWD changes
- Fix optimization XML row parsing to descend into Cell/Data nodes
- Add run_rolling_backtest tool for N consecutive weekly backtests
- Add max_passes support for optimization to cap genetic passes
- Kill stale MT5/agent processes before optimization launch
- Auto-parse optimization results on status poll when process completes
- Fix XML namespace for SpreadsheetML parsing
- Change optimization model from 4 to 1 for better accuracy
- Persist completion results to job metadata
- CHANGELOG: inactivity_kill_secs default is disabled (None), not 120
- TROUBLESHOOTING: clarify inactivity_kill_secs is opt-in (must be
passed explicitly); correct "default 120" claim
- MCP_TOOLS: inactivity_kill_secs is disabled by default; add note
that Wine/macOS may not exit naturally even with ShutdownTerminal=1
- handlers/backtest.rs: remove stale comment claiming inactivity
watchdog is "intentionally skipped when shutdown=true" — replaced
with accurate description of the new 30s HTML-wait + kill behavior
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- fix: inactivity watchdog now waits 30s for HTML report then kills
terminal64.exe unconditionally — ShutdownTerminal=1 does not cause
MT5 to exit on Wine/macOS; relying on natural exit caused all runs
to fall back to journal extraction
- fix: tester agent log deduplication — each deal is written twice in
the log; use HashSet to skip already-seen deal numbers
- fix: position tracker for entry direction inference — infer "in"/"out"
from per-symbol signed lot accumulation instead of guessing
- fix: is_closed_trade() no longer gates on profit!=0.0 — journal deals
have profit=0.0 legitimately; the old gate hid all 140 deals from
list_deals
- fix: log file selection priority — prefer Agent-127.0.0.1 over
Agent-0.0.0.0 (startup-only log), tiebreak by file size
- feat: launch_backtest default shutdown=true; inactivity_kill_secs
default 120s exposed as tool parameter
- feat: report DB stores deals in SQLite; analytics resolve by
report_id / report_dir / latest
Verified: 1-month DPS21/XAUUSD.cent/M5 backtest produces full HTML
report with all metrics (win_rate=70%, profit_factor=0.77, sharpe=-3.61,
max_dd=6.93%) and all 17 analytics tools returning real data.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add cargo-publish job that runs in parallel with binary builds.
The release job now depends on [build-macos, build-linux, cargo-publish]
so the crate is always published to crates.io before the GitHub release
and binaries are attached.
Requires CARGO_REGISTRY_TOKEN secret in repo settings.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add ini_safe() helper that strips CR/LF from user-supplied string params
before they are written into terminal.ini and backtest_config.ini.
Applies to: expert path, symbol, timeframe, set_file — any value that
could carry an embedded newline and inject extra INI directives.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
database.rs:
- search_by_tags: replace string-interpolated LIKE with parameterized ?N bindings
- search_by_notes: replace format!() SQL with prepared statement + ?1/?2 params
- search_by_set_file: same — use ?1 for pattern and ?2 for limit
backtest.rs (extract_and_store / monitor_backtest_completion):
- extract_and_store now returns bool — callers only delete report file if true
- guard both success paths with conditional delete + warning on failure
- replace .parent().unwrap() panic with explicit match + error log + graceful return
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- mcp_server.rs: #[allow(dead_code)] on NotificationCallback type alias and get_notification_sender method
- handlers/mod.rs: #[allow(dead_code)] on past_complete_month helper
- Cargo.toml: move maintenance key into [package.metadata] (was invalid at package level)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Deals-in-DB architecture: per-deal data now stored in SQLite instead of
deals.csv/deals.json files.
- storage: add `deals` table with report_id FK; insert_deals/get_deals/get_by_report_dir methods
- extract: stop writing deals.csv and deals.json; only metrics.json written to disk
- pipeline: call db.insert_deals() after extraction; HTML report still deleted after parse
- analytics: all 19 tools now load deals from DB (report_id > report_dir > latest)
- analytics: resolve_report() helper replaces load_report_data/read_deals_from_csv
- analytics: calling any analytics tool with no args uses the latest report automatically
- tools: add export_deals_csv for on-demand CSV generation from DB
- tools: add get_by_report_dir for backward-compat lookup by filesystem path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Added list_symbols to Core workflow
- Added list_jobs to Optimization section
- Added promote_to_baseline to Reports section
- Added read_set_file and write_set_file to .set files section
- Added diff_set_files to .set analysis section
- Added check_update and update to Debugging section
- Added get_backtest_history to History & Comparison section
Brings documented tools from 87 to 89 (matching actual count)
- Correct path: /mcp-server/bin/mt5-quant (not project root)
- Verified by downloading and extracting actual release tarball
- Updated both Full Example and Environment Variables sections
- Changed /target/release/mt5-quant to /mt5-quant for prebuilt binary path
- Added path notes explaining prebuilt vs dev build locations
- Fixed both Full Example and Environment Variables sections
