chore(deps): bump the github-actions group across 1 directory with 9 updates

Bumps the github-actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.38.1` | `4.39.1` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.38.1` | `4.39.1` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.38.1` | `4.39.1` | | [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `02cb101ec7c40f2c49e1d9714d64511d8e1b74de` | `683b588c487a69d01f6c6ddf40f036ff682cc2c8` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action) | `1.0.5` | `1.0.6` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.1` | `4.39.1` | Updates `github/codeql-action/init` from 4.38.1 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/autobuild` from 4.38.1 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.38.1 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `dtolnay/rust-toolchain` from 02cb101ec7c40f2c49e1d9714d64511d8e1b74de to 683b588c487a69d01f6c6ddf40f036ff682cc2c8 - [Release notes](https://github.com/dtolnay/rust-toolchain/releases) - [Commits](https://github.com/dtolnay/rust-toolchain/compare/02cb101ec7c40f2c49e1d9714d64511d8e1b74de...683b588c487a69d01f6c6ddf40f036ff682cc2c8) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `rust-lang/crates-io-auth-action` from 1.0.5 to 1.0.6 - [Release notes](https://github.com/rust-lang/crates-io-auth-action/releases) - [Commits](https://github.com/rust-lang/crates-io-auth-action/compare/c6f97d42243bad5fab37ca0427f495c86d5b1a18...3268eb413133e2960fa4ae0e963ca76380c54cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) Updates `github/codeql-action/upload-sarif` from 4.38.1 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/autobuild dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dtolnay/rust-toolchain dependency-version: 683b588c487a69d01f6c6ddf40f036ff682cc2c8 dependency-type: direct:production dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: rust-lang/crates-io-auth-action dependency-version: 1.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #16 from masdevid/dependabot/github_actions/github-actions-af0bba1cf7
2026-10-28 12:19:48 +00:00 · 2026-10-14 10:01:31 +07:00 · 2026-10-14 10:01:09 +07:00 · 2026-10-07 12:14:45 +00:00 · 2026-09-23 12:19:42 +00:00 · 2026-09-18 04:17:37 +07:00
26 changed files with 2137 additions and 364 deletions
@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: '22 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (Rust)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
+        with:
+          languages: rust
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
@@ -4,6 +4,7 @@ on: [pull_request]

 permissions:
  contents: read
+  pull-requests: read

 jobs:
  dependency-review:
@@ -27,7 +27,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: stable

@@ -55,7 +55,7 @@ jobs:
          tar -czf mcp-mt5-quant-macos-arm64.tar.gz mcp-mt5-quant-macos

      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: macos-binary
          path: dist/mcp-mt5-quant-macos-arm64.tar.gz
@@ -66,7 +66,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: stable

@@ -94,7 +94,7 @@ jobs:
          tar -czf mcp-mt5-quant-linux-x64.tar.gz mcp-mt5-quant-linux

      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: linux-binary
          path: dist/mcp-mt5-quant-linux-x64.tar.gz
@@ -110,7 +110,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
        with:
          toolchain: stable

@@ -125,7 +125,7 @@ jobs:
          restore-keys: cargo-publish-

      - name: Get crates.io authentication token
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
        id: auth

      - name: Publish to crates.io
@@ -143,29 +143,69 @@ jobs:
      contents: write
    env:
      RELEASE_TAG: ${{ github.event.inputs.version || github.ref_name }}
+      # secrets context is NOT available in step-level if: expressions —
+      # referencing it there makes the whole workflow fail validation
+      # (startup-failure runs on every push). Route the check through a
+      # job-level env var instead: env IS readable in if:.
+      HAS_GPG_SECRETS: ${{ secrets.GPG_PRIVATE_KEY != '' && secrets.GPG_PASSPHRASE != '' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download macOS artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: macos-binary
          path: dist

      - name: Download Linux artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: linux-binary
          path: dist

+      # ── GPG signing of release artifacts (delivery_unsigned) ────────────────
+      # Guarded: only runs when BOTH signing secrets are configured. When they
+      # are absent the release still ships (unsigned) instead of failing — so
+      # forks/contributors without the secrets are not blocked. When present,
+      # each binary gets a detached ASCII-armored signature and the public key
+      # (docs/signing-key.asc) is attached to the release for verification.
+      - name: Import GPG key and sign artifacts
+        if: env.HAS_GPG_SECRETS == 'true'
+        env:
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_KEYID: EF1CA6A2E2D0CEFF61DC7F080256A0C36A6D5E72
+        run: |
+          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
+          for f in dist/mcp-mt5-quant-macos-arm64.tar.gz \
+                   dist/mcp-mt5-quant-linux-x64.tar.gz; do
+            gpg --batch --yes --pinentry-mode loopback \
+                --passphrase "$GPG_PASSPHRASE" \
+                --detach-sign --armor -u "$GPG_KEYID" "$f"
+          done
+
+      - name: Build release asset list
+        id: assets
+        run: |
+          {
+            echo "files<<EOF"
+            echo "dist/mcp-mt5-quant-macos-arm64.tar.gz"
+            echo "dist/mcp-mt5-quant-linux-x64.tar.gz"
+            echo "docs/signing-key.asc"
+            if [ -f dist/mcp-mt5-quant-macos-arm64.tar.gz.asc ] && \
+               [ -f dist/mcp-mt5-quant-linux-x64.tar.gz.asc ]; then
+              echo "dist/mcp-mt5-quant-macos-arm64.tar.gz.asc"
+              echo "dist/mcp-mt5-quant-linux-x64.tar.gz.asc"
+            fi
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
      - name: Create GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          name: ${{ env.RELEASE_TAG }}
-          files: |
-            dist/mcp-mt5-quant-macos-arm64.tar.gz
-            dist/mcp-mt5-quant-linux-x64.tar.gz
+          files: ${{ steps.assets.outputs.files }}
          draft: false
          prerelease: false
          generate_release_notes: true
@@ -174,13 +214,17 @@ jobs:

  # ── MCP Package ──────────────────────────────────────────────────────────────
  # Builds the installable MCP package (binary + config + docs),
-  # computes its SHA256, and uploads to the release.
+  # computes its SHA256, and uploads to the release. Also attests the FINAL
+  # release bytes — the macOS tarball is re-packaged here (server.json added),
+  # so attesting in the build jobs would cover digests that never ship.

  build-mcp-package:
    needs: release
    runs-on: macos-latest
    permissions:
-      contents: write
+      contents: write       # Attach the package to the GitHub Release
+      id-token: write       # Required for build provenance attestation (OIDC)
+      attestations: write   # Required to publish the attestation
    outputs:
      sha256: ${{ steps.compute-sha256.outputs.sha256 }}
    env:
@@ -189,11 +233,17 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download macOS binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: macos-binary
          path: dist

+      - name: Download Linux binary
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: linux-binary
+          path: dist
+
      - name: Build MCP package
        run: |
          mkdir -p mcp-package/mcp-server/bin
@@ -205,6 +255,19 @@ jobs:
          cp server.json mcp-package/
          cd mcp-package && tar -czf ../mcp-mt5-quant-macos-arm64.tar.gz . && cd ..

+      # Attest the exact bytes attached to the Release: the re-packaged macOS
+      # tarball at the repo root and the pass-through Linux tarball from the
+      # artifact — so attested digests match the published assets.
+      - name: Generate build provenance attestation (macOS)
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: mcp-mt5-quant-macos-arm64.tar.gz
+
+      - name: Generate build provenance attestation (Linux)
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/mcp-mt5-quant-linux-x64.tar.gz
+
      - name: Compute SHA256
        id: compute-sha256
        run: |
@@ -213,7 +276,7 @@ jobs:
          echo "MCP Package SHA256: $SHA256"

      - name: Upload MCP package to release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          files: mcp-mt5-quant-macos-arm64.tar.gz
@@ -221,7 +284,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload MCP package artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: mcp-package
          path: mcp-mt5-quant-macos-arm64.tar.gz
@@ -232,6 +295,16 @@ jobs:
  # checks, which github-actions[bot] cannot bypass on a direct push. The PR
  # runs those checks legitimately, then auto-merges once green. This job
  # blocks until the merge lands so mcp-publish reads the patched server.json.
+  #
+  # Bot identity (RELEASE_PAT): when the RELEASE_PAT secret exists (a
+  # fine-grained personal access token owned by masdevid with Contents+PR
+  # write), the branch push and the PR are attributed to masdevid instead of
+  # github-actions[bot]. GitHub only holds pull_request workflows for manual
+  # approval when the PR author is an OUTSIDE contributor — same-owner PRs
+  # run their checks immediately, making releases fully hands-off. Without
+  # the secret everything falls back to GITHUB_TOKEN: the release still
+  # completes, but the server.json PR's required status checks sit in
+  # "action_required" until manually approved once per release.

  update-server-json:
    needs: build-mcp-package
@@ -239,6 +312,14 @@ jobs:
    permissions:
      contents: write        # push the ci/* release branch
      pull-requests: write   # create the PR and enable auto-merge
+    env:
+      # Single bot identity used for BOTH the git push and the gh pr calls —
+      # GitHub ties workflow-trigger approval to the PR-authoring identity,
+      # so push and PR must match. Resolves to RELEASE_PAT when configured,
+      # otherwise the default GITHUB_TOKEN, so nothing breaks before the
+      # secret is added. Declared here instead of interpolated inline so the
+      # token never lands on a command line; GitHub masks it in logs anyway.
+      RELEASE_PAT_OR_TOKEN: ${{ secrets.RELEASE_PAT || github.token }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
@@ -284,6 +365,13 @@ jobs:
        id: commit
        run: |
          BRANCH="ci/server-json-sha-${VERSION}"
+          # Authenticate ALL pushes (stale-branch cleanup + branch upload)
+          # with the SAME identity that creates the PR below: GitHub ties
+          # workflow-trigger approval to the PR author, so a mismatch here
+          # would defeat the RELEASE_PAT hands-off path. Token comes from the
+          # job-level env (never interpolated inline, never echoed).
+          git remote set-url --push origin \
+            "https://x-access-token:${RELEASE_PAT_OR_TOKEN}@github.com/masdevid/mt5-quant.git"
          # Drop any stale branch/PR left over from a previous attempt at
          # this release so every run starts from a clean slate
          git push origin --delete "$BRANCH" 2>/dev/null || true
@@ -296,7 +384,14 @@ jobs:
            echo "server.json unchanged — no commit needed"
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
-            git commit -m "ci: update server.json SHA256 for v${VERSION} [skip ci]"
+            # Never add a CI-skip marker to this commit message: under the
+            # protect-master ruleset the server.json PR carries required
+            # status checks, and a CI-skip marker suppresses
+            # pull_request-triggered workflows, so those checks never report
+            # and auto-merge hangs until timeout. Omitting it is safe —
+            # release.yml triggers only on tags (no loop risk) and
+            # GITHUB_TOKEN-attributed merges never retrigger workflows.
+            git commit -m "ci: update server.json SHA256 for v${VERSION}"
            git push origin "$BRANCH"
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "Committed server.json update to ${BRANCH}"
@@ -306,20 +401,23 @@ jobs:
        if: steps.commit.outputs.changed == 'true'
        run: |
          BRANCH="ci/server-json-sha-${VERSION}"
-          GH_TOKEN="${{ github.token }}" gh pr create \
-            --title "ci: update server.json SHA256 for v${VERSION} [skip ci]" \
+          # Same rule as above: no CI-skip marker in the title — GitHub
+          # honors markers on PR titles too, which would suppress the
+          # required checks.
+          GH_TOKEN="$RELEASE_PAT_OR_TOKEN" gh pr create \
+            --title "ci: update server.json SHA256 for v${VERSION}" \
            --body "Automated MCP package hash update." \
            --base master \
            --head "$BRANCH"

-          GH_TOKEN="${{ github.token }}" gh pr merge "$BRANCH" --auto --squash
+          GH_TOKEN="$RELEASE_PAT_OR_TOKEN" gh pr merge "$BRANCH" --auto --squash

          # Block until required checks (build, lint, cargo-deny x4) finish
          # and auto-merge completes — mcp-publish depends on this job and
          # checks out master expecting the patched server.json
          DEADLINE=$((SECONDS + 1800))
          while (( SECONDS < DEADLINE )); do
-            STATE=$(GH_TOKEN="${{ github.token }}" gh pr view "$BRANCH" --json state --jq .state)
+            STATE=$(GH_TOKEN="$RELEASE_PAT_OR_TOKEN" gh pr view "$BRANCH" --json state --jq .state)
            case "$STATE" in
              MERGED)
                echo "server.json PR merged to master"
@@ -349,60 +447,58 @@ jobs:
          ref: master   # Pull master so server.json has the correct SHA256

      - name: Download MCP package
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: mcp-package
          path: .

      - name: Install mcp-publisher
        id: install-publisher
+        env:
+          # Hash-pinned download (OpenSSF Scorecard Pinned-Dependencies):
+          # PUB_SHA256 is the mcp-publisher_linux_amd64.tar.gz entry from
+          # registry_1.8.1_checksums.txt shipped in the same release.
+          # Bump both values together when upgrading.
+          PUB_VERSION: v1.8.1
+          PUB_SHA256: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
        run: |
-          # Fetch the download URL for linux_amd64 directly from the release assets API
-          # (asset name format changed in v1.6.0 — look it up rather than constructing it)
-          URL=$(curl -sf \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/repos/modelcontextprotocol/registry/releases/latest" \
-            | python3 -c "
-          import sys, json
-          r = json.load(sys.stdin)
-          tag = r['tag_name']
-          assets = r.get('assets', [])
-          match = next((a['browser_download_url'] for a in assets
-                        if 'linux' in a['name'] and 'amd64' in a['name']
-                        and a['name'].endswith('.tar.gz')
-                        and 'sbom' not in a['name']
-                        and 'sigstore' not in a['name']), None)
-          if match:
-              print(match)
-          else:
-              print(f'https://github.com/modelcontextprotocol/registry/releases/download/{tag}/mcp-publisher_linux_amd64.tar.gz', file=sys.stderr)
-              sys.exit(1)
-          " 2>/dev/null)
+          URL="https://github.com/modelcontextprotocol/registry/releases/download/${PUB_VERSION}/mcp-publisher_linux_amd64.tar.gz"

-          if [[ -z "$URL" ]]; then
+          echo "Downloading: $URL"
+          if ! curl -fsSL -o "$RUNNER_TEMP/mcp-publisher.tar.gz" "$URL"; then
            echo "installed=false" >> "$GITHUB_OUTPUT"
-            echo "Could not resolve mcp-publisher download URL"
-          else
-            echo "Downloading: $URL"
-            if curl -fsSL -o mcp-publisher.tar.gz "$URL"; then
-              tar -xzf mcp-publisher.tar.gz 2>/dev/null || true
-              BINARY=$(find . -maxdepth 3 -name "mcp-publisher" ! -path "./.git/*" | head -1)
-              if [[ -n "$BINARY" && -f "$BINARY" ]]; then
-                chmod +x "$BINARY"
-                sudo mv "$BINARY" /usr/local/bin/mcp-publisher
-                echo "installed=true" >> "$GITHUB_OUTPUT"
-                echo "Installed: $(mcp-publisher --version 2>/dev/null || echo 'ok')"
-              else
-                echo "installed=false" >> "$GITHUB_OUTPUT"
-                echo "Binary not found in archive"
-              fi
-              rm -f mcp-publisher.tar.gz
-            else
-              echo "installed=false" >> "$GITHUB_OUTPUT"
-              echo "Download failed: $URL"
-            fi
+            echo "Download failed: $URL"
+            exit 0
          fi

+          # Never execute unverified bytes: hard-fail the job on any digest
+          # mismatch (upstream re-release or tampering)
+          ACTUAL=$(sha256sum "$RUNNER_TEMP/mcp-publisher.tar.gz" | awk '{print $1}')
+          if [[ "$ACTUAL" != "$PUB_SHA256" ]]; then
+            echo "::error::SHA256 mismatch for mcp-publisher ${PUB_VERSION}: expected ${PUB_SHA256}, got ${ACTUAL}"
+            exit 1
+          fi
+          echo "SHA256 verified: $ACTUAL"
+
+          EXTRACT_DIR="$(mktemp -d)"
+          if ! tar -xzf "$RUNNER_TEMP/mcp-publisher.tar.gz" -C "$EXTRACT_DIR"; then
+            rm -rf "$EXTRACT_DIR" "$RUNNER_TEMP/mcp-publisher.tar.gz"
+            echo "installed=false" >> "$GITHUB_OUTPUT"
+            echo "Extraction failed"
+            exit 0
+          fi
+
+          if [[ -f "$EXTRACT_DIR/mcp-publisher" ]]; then
+            chmod +x "$EXTRACT_DIR/mcp-publisher"
+            sudo mv "$EXTRACT_DIR/mcp-publisher" /usr/local/bin/mcp-publisher
+            echo "installed=true" >> "$GITHUB_OUTPUT"
+            echo "Installed: $(mcp-publisher --version 2>/dev/null || echo 'ok')"
+          else
+            echo "installed=false" >> "$GITHUB_OUTPUT"
+            echo "Binary not found in archive"
+          fi
+          rm -rf "$EXTRACT_DIR" "$RUNNER_TEMP/mcp-publisher.tar.gz"
+
      - name: Validate server.json before publish
        id: validate
        run: |
@@ -33,7 +33,7 @@ jobs:

    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+    - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
      with:
        toolchain: stable
        components: clippy, rustfmt
@@ -1,12 +1,14 @@
 name: Scorecard supply-chain security
 on:
  branch_protection_rule:
+  workflow_dispatch:
  schedule:
    - cron: '30 6 * * 3'
  push:
    branches: [master]

-permissions: read-all
+permissions:
+  contents: read

 jobs:
  analysis:
@@ -15,24 +17,65 @@ jobs:
    permissions:
      security-events: write
      id-token: write
-      contents: read
+      contents: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: SARIF file
          path: results.sarif

-      - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
        with:
          sarif_file: results.sarif
+
+      - name: Update badge JSON
+        if: github.ref == 'refs/heads/master'
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import json
+          import urllib.request
+
+          url = "https://api.scorecard.dev/projects/github.com/masdevid/mt5-quant"
+          with urllib.request.urlopen(url) as resp:
+              data = json.load(resp)
+
+          score = float(data["score"])
+          if score >= 9:
+              color = "brightgreen"
+          elif score >= 7:
+              color = "yellowgreen"
+          elif score >= 5:
+              color = "yellow"
+          else:
+              color = "red"
+
+          badge = {
+              "schemaVersion": 1,
+              "label": "OpenSSF Scorecard",
+              "message": f"{score:g}",
+              "color": color,
+          }
+          with open("badge.json", "w") as f:
+              json.dump(badge, f)
+          print("Wrote badge.json:", badge)
+          PY
+
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
+          git checkout -B badges
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -f badge.json
+          git commit -m "chore: update OpenSSF Scorecard badge" || echo "no changes to commit"
+          git push -f origin badges
@@ -1,5 +1,17 @@
 # Changelog

+## [1.34.3] — 2026-08-25
+
+- chore(deps): bump dirs from 5.0.1 to 6.0.0 (#6)
+- chore(deps): bump base64 from 0.22.1 to 0.23.1 (#4)
+- chore(deps): bump rusqlite from 0.31.0 to 0.40.2 (#5)
+- ci(release): generate build provenance attestations for artifacts
+- chore(deps): bump the minor-and-patch group across 1 directory with 7 updates (#3)
+- fix(release): drop [skip ci] from server.json PR so required checks can run
+- docs(readme): fix Scorecard badge, add CI, crates.io, and license badges
+- ci(scorecard): rename invalid 'publish' input to 'publish_results' so results are published
+
+
 ## [1.34.2] — 2026-08-25

 - ci(release): publish to crates.io via trusted publishing (OIDC)
@@ -0,0 +1,40 @@
+# Contributing to MT5-Quant
+
+Thanks for your interest in improving MT5-Quant! This document explains how to
+contribute and what we expect from contributions.
+
+## How to contribute
+
+1. **Fork** the repository and create a topic branch from `master`.
+2. Make your change, keeping it focused (one logical change per PR).
+3. Open a **pull request against `master`**. A pull request template
+   (`.github/PULL_REQUEST_TEMPLATE.md`) is provided — please fill it in.
+4. Ensure CI passes (build, `cargo test`, clippy, formatting, cargo-deny,
+   CodeQL). Maintainers review and merge once checks and review are satisfied.
+
+## Development setup
+
+- Install Rust (stable toolchain) and, for full backtests, Wine/MT5 as described
+  in `README.md` and `docs/QUICKSTART.md`.
+- Build the release binary with either:
+  - `bash scripts/build-rust.sh`, or
+  - `cargo build --release`
+- The binary is produced at `target/release/mt5-quant`.
+
+## Testing requirement
+
+- **Non-trivial changes must include tests.** New functionality should come with
+  unit or integration tests where practical.
+- `cargo test` runs automatically in CI (`rust.yml`) on every push and pull
+  request, so a change that breaks tests cannot merge.
+
+## Commit style
+
+- Follow **Conventional Commits** (`feat:`, `fix:`, `docs:`, `refactor:`,
+  `test:`, `release:`), as documented in `AGENTS.md`.
+
+## Issue tracker
+
+- Bugs and enhancement requests are tracked on the project's
+  [GitHub Issues](https://github.com/masdevid/mt5-quant/issues), with
+  bug-report and feature-request templates under `.github/ISSUE_TEMPLATE/`.
@@ -2,18 +2,6 @@
 # It is not intended for manual editing.
 version = 4

-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -68,7 +56,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
@@ -79,7 +67,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
 "anstyle",
 "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
@@ -96,9 +84,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"

 [[package]]
 name = "base64"
-version = "0.22.1"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"

 [[package]]
 name = "bitflags"
@@ -136,9 +124,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
 "iana-time-zone",
 "js-sys",
@@ -150,9 +138,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -160,9 +148,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
 "anstream",
 "anstyle",
@@ -172,14 +160,14 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.6.1"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -201,33 +189,44 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"

 [[package]]
-name = "dirs"
-version = "5.0.1"
+name = "core_detect"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
+[[package]]
+name = "dirs"
+version = "7.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f"
 dependencies = [
 "dirs-sys",
 ]

 [[package]]
 name = "dirs-sys"
-version = "0.4.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
 dependencies = [
 "libc",
 "option-ext",
 "redox_users",
- "windows-sys 0.48.0",
+ "windows-sys",
 ]

 [[package]]
 name = "encoding_rs"
-version = "0.8.35"
+version = "0.8.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
 dependencies = [
 "cfg-if",
+ "core_detect",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
 ]

 [[package]]
@@ -243,7 +242,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
@@ -276,6 +275,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"

+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -300,22 +305,22 @@ dependencies = [
 "wasip3",
 ]

-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
- "foldhash",
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash 0.2.0",
 ]

 [[package]]
@@ -323,14 +328,17 @@ name = "hashbrown"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+dependencies = [
+ "foldhash 0.2.0",
+]

 [[package]]
 name = "hashlink"
-version = "0.9.1"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+checksum = "32069d97bb81e38fa67eab65e3393bf804bb85969f2bc06bf13f64aef5aba248"
 dependencies = [
- "hashbrown 0.14.5",
+ "hashbrown 0.17.0",
 ]

 [[package]]
@@ -432,9 +440,9 @@ dependencies = [

 [[package]]
 name = "libsqlite3-sys"
-version = "0.28.0"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c10584274047cb335c23d3e61bcef8e323adae7c5c8c760540f73610177fc3f"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
 "cc",
 "pkg-config",
@@ -476,12 +484,12 @@ checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
 "libc",
 "wasi",
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
 name = "mt5-quant"
-version = "1.34.2"
+version = "1.34.3"
 dependencies = [
 "anyhow",
 "base64",
@@ -503,13 +511,19 @@ dependencies = [
 "walkdir",
 ]

+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
@@ -581,7 +595,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
 "proc-macro2",
- "syn",
+ "syn 2.0.117",
 ]

 [[package]]
@@ -619,9 +633,9 @@ dependencies = [

 [[package]]
 name = "redox_users"
-version = "0.4.6"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
 "getrandom 0.2.17",
 "libredox",
@@ -630,9 +644,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -642,9 +656,9 @@ dependencies = [

 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -653,9 +667,9 @@ dependencies = [

 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"

 [[package]]
 name = "roxmltree"
@@ -667,10 +681,20 @@ dependencies = [
 ]

 [[package]]
-name = "rusqlite"
-version = "0.31.0"
+name = "rsqlite-vfs"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b838eba278d213a8beaf485bd313fd580ca4505a00d5871caeb1457c55322cae"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.40.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
 "bitflags",
 "fallible-iterator",
@@ -678,6 +702,7 @@ dependencies = [
 "hashlink",
 "libsqlite3-sys",
 "smallvec",
+ "sqlite-wasm-rs",
 ]

 [[package]]
@@ -690,7 +715,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
@@ -728,9 +753,9 @@ checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"

 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
 "serde_core",
 "serde_derive",
@@ -738,29 +763,29 @@ dependencies = [

 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
 "serde_derive",
 ]

 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.4",
 ]

 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
 "itoa",
 "memchr",
@@ -807,6 +832,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
 [[package]]
 name = "smallvec"
 version = "1.15.1"
@@ -820,7 +851,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
 "libc",
- "windows-sys 0.61.2",
+ "windows-sys",
+]
+
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
+dependencies = [
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -840,6 +883,17 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -850,27 +904,27 @@ dependencies = [
 "getrandom 0.4.2",
 "once_cell",
 "rustix",
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
 name = "thiserror"
-version = "1.0.69"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
 "thiserror-impl",
 ]

 [[package]]
 name = "thiserror-impl"
-version = "1.0.69"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.4",
 ]

 [[package]]
@@ -884,9 +938,9 @@ dependencies = [

 [[package]]
 name = "tokio"
-version = "1.52.1"
+version = "1.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
 dependencies = [
 "bytes",
 "libc",
@@ -896,7 +950,7 @@ dependencies = [
 "signal-hook-registry",
 "socket2",
 "tokio-macros",
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
@@ -907,7 +961,7 @@ checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.117",
 ]

 [[package]]
@@ -929,7 +983,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.117",
 ]

 [[package]]
@@ -993,9 +1047,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 dependencies = [
 "getrandom 0.4.2",
 "js-sys",
@@ -1014,12 +1068,6 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"

-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -1086,7 +1134,7 @@ dependencies = [
 "bumpalo",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.117",
 "wasm-bindgen-shared",
 ]

@@ -1139,7 +1187,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys",
 ]

 [[package]]
@@ -1163,7 +1211,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.117",
 ]

 [[package]]
@@ -1174,7 +1222,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.117",
 ]

 [[package]]
@@ -1201,15 +1249,6 @@ dependencies = [
 "windows-link",
 ]

-[[package]]
-name = "windows-sys"
-version = "0.48.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
-dependencies = [
- "windows-targets",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -1219,63 +1258,6 @@ dependencies = [
 "windows-link",
 ]

-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
-
 [[package]]
 name = "wit-bindgen"
 version = "0.51.0"
@@ -1312,7 +1294,7 @@ dependencies = [
 "heck",
 "indexmap",
 "prettyplease",
- "syn",
+ "syn 2.0.117",
 "wasm-metadata",
 "wit-bindgen-core",
 "wit-component",
@@ -1328,7 +1310,7 @@ dependencies = [
 "prettyplease",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 2.0.117",
 "wit-bindgen-core",
 "wit-bindgen-rust",
 ]
@@ -1370,26 +1352,6 @@ dependencies = [
 "wasmparser",
 ]

-[[package]]
-name = "zerocopy"
-version = "0.8.48"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.48"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.21"
@@ -1,6 +1,6 @@
 [package]
 name = "mt5-quant"
-version = "1.34.2"
+version = "1.34.3"
 edition = "2021"
 description = "MCP server for MT5 strategy development on macOS/Linux"
 authors = ["masdevid <masdevid@example.com>"]
@@ -30,11 +30,11 @@ tracing = "0.1"
 tracing-subscriber = "0.3"
 uuid = { version = "1.0", features = ["v4"] }
 regex = "1.0"
-dirs = "5.0"
+dirs = "7.0"
 walkdir = "2.0"
 chrono = { version = "0.4", features = ["serde"] }
 encoding_rs = "0.8"
 tempfile = "3.0"
 roxmltree = "0.21.1"
-rusqlite = { version = "0.31", features = ["bundled"] }
-base64 = "0.22"
+rusqlite = { version = "0.40", features = ["bundled"] }
+base64 = "0.23"
@@ -1,6 +1,6 @@
 # MT5-Quant

-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/masdevid/mt5-quant/badge)](https://scorecard.dev/viewer/?uri=github.com/masdevid/mt5-quant) [![Rust CI](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml/badge.svg)](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml) [![crates.io](https://img.shields.io/crates/v/mt5-quant.svg)](https://crates.io/crates/mt5-quant) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![OpenSSF Scorecard](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/masdevid/mt5-quant/badges/badge.json)](https://scorecard.dev/viewer/?uri=github.com/masdevid/mt5-quant) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/14227/badge)](https://bestpractices.coreinfrastructure.org/projects/14227) [![Rust CI](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml/badge.svg)](https://github.com/masdevid/mt5-quant/actions/workflows/rust.yml) [![crates.io](https://img.shields.io/crates/v/mt5-quant.svg)](https://crates.io/crates/mt5-quant) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) [![CodeQL](https://img.shields.io/badge/CodeQL-enabled-brightgreen)](https://github.com/masdevid/mt5-quant/security/code-scanning)

 **MCP server for MT5 strategy development on macOS/Linux.** 89 tools to compile, backtest, analyze, optimize, debug crashes, and manage MQL5 Expert Advisors — no Windows required.

@@ -33,14 +33,68 @@ Claude: [compile → clean → backtest → analyze 1,847 deals]

 ### Install MT5-Quant

-Ask your LLM coding platform to install and configure MT5-Quant:
+#### Option A — Cargo (recommended, needs Rust toolchain)

-> "Please install mt5-quant. It's a Rust-based MCP server for MT5 backtesting at https://github.com/masdevid/mt5-quant. Run its `scripts/setup.sh` to auto-detect Wine and MT5 paths, register the MCP server, and configure everything."
+```bash
+cargo install mt5-quant --locked
+```

-The LLM will:
-1. Download the pre-built binary (or `cargo build --release`)
-2. Run `scripts/setup.sh` to auto-detect Wine/MT5 and write config
-3. Register the MCP server with your coding platform
+#### Option B — Pre-built binaries (no toolchain)
+
+```bash
+# macOS Apple Silicon
+curl -LO https://github.com/masdevid/mt5-quant/releases/latest/download/mcp-mt5-quant-macos-arm64.tar.gz
+tar xzf mcp-mt5-quant-macos-arm64.tar.gz   # → mcp-mt5-quant-macos/mt5-quant
+
+# Linux x64
+curl -LO https://github.com/masdevid/mt5-quant/releases/latest/download/mcp-mt5-quant-linux-x64.tar.gz
+tar xzf mcp-mt5-quant-linux-x64.tar.gz     # → mcp-mt5-quant-linux/mt5-quant
+```
+
+Move the binary somewhere on your `PATH` (e.g. `/usr/local/bin` or `~/.local/bin`) so clients can launch it as `mt5-quant`.
+
+#### Option C — Register with your LLM client (copy-paste)
+
+**Claude Code**
+
+```bash
+claude mcp add mt5-quant -- mt5-quant --stdio
+```
+
+**Claude Desktop** — `~/Library/Application Support/Claude/claude_desktop_config.json`
+
+```json
+{ "mcpServers": { "mt5-quant": { "command": "mt5-quant", "args": ["--stdio"] } } }
+```
+
+**Cursor** — `.cursor/mcp.json` (same JSON shape as Claude Desktop)
+
+```json
+{ "mcpServers": { "mt5-quant": { "command": "mt5-quant", "args": ["--stdio"] } } }
+```
+
+**opencode** — `.opencode/opencode.jsonc`
+
+```jsonc
+{ "mcp": { "mt5-quant": { "type": "local", "command": ["mt5-quant", "--stdio"], "enabled": true } } }
+```
+
+**Codex CLI** — `~/.codex/config.toml`
+
+```toml
+[mcp_servers.mt5-quant]
+command = "mt5-quant"
+args = ["--stdio"]
+```
+
+Then finish setup (auto-detects Wine + MT5 paths):
+
+```bash
+bash scripts/setup.sh
+```
+
+> **Tip:** you can also just ask your LLM coding agent to do all of the above:
+> *"Please install mt5-quant from https://github.com/masdevid/mt5-quant — download or build it, run its `scripts/setup.sh` to auto-detect Wine and MT5 paths, and register it as an MCP server."*

 ### First Backtest

@@ -228,6 +282,19 @@ For crashes or unexplained failures during backtest/compile/optimization:

 **[Full Troubleshooting Guide →](docs/TROUBLESHOOTING.md)**

+## Documentation
+
+| Doc | Description |
+|-----|-------------|
+| [QUICKSTART](docs/QUICKSTART.md) | Step-by-step install, setup, and first backtest |
+| [MCP_TOOLS](docs/MCP_TOOLS.md) | Full input/output schemas for all 90 tools |
+| [CONFIG](docs/CONFIG.md) | Configuration reference (`config/mt5-quant.yaml`) |
+| [ARCHITECTURE](docs/ARCHITECTURE.md) | Design principles and internal module layout |
+| [REMOTE_AGENTS](docs/REMOTE_AGENTS.md) | Distribute optimization across Linux agents via Wine |
+| [TROUBLESHOOTING](docs/TROUBLESHOOTING.md) | Platform-specific fixes for Wine, MT5, and backtests |
+
+Full index with reading order: [docs/INDEX.md](docs/INDEX.md)
+
 ---

 ## Acknowledgements
@@ -1,35 +1,154 @@
 # Security Policy

-## Supported Versions
+This document describes how to report security issues in **mt5-quant**, and the
+secure-development practices the project follows. It backs the OpenSSF Best
+Practices criteria `vulnerability_report_process`, `know_secure_design`, and
+`know_common_errors`, and the signed-release process described under
+[Signing](#signing-of-release-artifacts) backs `delivery_unsigned`.

-Only the latest minor release line receives security fixes. Older versions should upgrade.
+mt5-quant is a Rust MCP server that drives MetaTrader 5 (under Wine/CrossOver)
+to compile, backtest, and analyze trading Expert Advisors. It runs **locally**;
+it never exposes a network listener and never transmits user data off the
+machine except for the opt-in version self-check (HTTPS to GitHub). The security
+notes below focus on the real risks in that model: untrusted input from MT5
+report files, the user-supplied Wine/MT5 configuration, and the build/publish
+pipeline.

-| Version | Supported          |
-| ------- | ------------------ |
-| 1.34.x  | :white_check_mark: |
-| < 1.34  | :x:                |
+## Vulnerability reporting process

-## Reporting a Vulnerability
+We encourage responsible disclosure. If you discover a vulnerability, please
+report it through **one** of the following channels (in order of preference):

-**Please do not open public GitHub issues for security matters.**
+1. **GitHub Security Advisories (recommended).** Open a private security
+   advisory at <https://github.com/masdevid/mt5-quant/security/advisories/new>.
+   This keeps the details confidential while we prepare a fix.
+2. **Public GitHub Issue.** If you prefer, open a normal issue at
+   <https://github.com/masdevid/mt5-quant/issues>. Public reports are accepted;
+   please avoid posting working exploits in the open issue body — link to a
+   private gist or email the maintainer instead.

-Preferred: use GitHub [Private Vulnerability Reporting](https://github.com/masdevid/mt5-quant/security/advisories/new) — **Security tab → Report a vulnerability**. This keeps the report confidential while we work on a fix.
+### What to include

-Please include as much of the following as you can:
+A useful report contains:

- Affected version (and commit SHA, if relevant)
- Steps to reproduce or a proof of concept
- Expected vs. actual behavior
- Any known mitigations
+- A clear description of the vulnerability and its impact.
+- The affected version(s) (`mt5-quant --version` or the `version` field in
+  `Cargo.toml`).
+- Steps to reproduce, or a proof-of-concept input (e.g. a crafted MT5 report,
+  `.set` file, or tool argument).
+- Any relevant logs, crashes, or sanitizer/fuzzer output.

-## Response Commitment
+### Expected handling timeline

- **Acknowledgement:** within **72 hours** of your report
- **Fix target:** vulnerabilities rated **critical/high** are targeted for a patch release within **14 days**
- We will keep you informed of progress and credit you in the advisory unless you prefer otherwise
+- **Acknowledgement:** within 7 days of a complete report.
+- **Triage & severity assessment:** within 14 days.
+- **Fix or mitigation plan:** timeline depends on severity; critical issues are
+  addressed as soon as a patch is ready, and a coordinated disclosure date is
+  agreed with the reporter when a private advisory is used.
+- **Disclosure:** once a fixed release is published, the advisory (if used) is
+  made public and the fix is credited to the reporter unless they request
+  anonymity.

-## Scope Notes
+There is no formal contractual SLA; reports are handled on a best-effort,
+case-by-case basis through the public channels above.

-MT5-Quant drives Wine and MetaTrader 5 locally — it launches external processes with paths, arguments, and configuration sourced from its YAML config file, `.set` parameter files, and MCP tool arguments. Reports concerning path traversal, config injection, or unsafe command construction through these surfaces are very much in scope and welcome.
+## Secure development practices (`know_secure_design`)

-Out of scope: vulnerabilities in Wine, MetaTrader 5 itself, or broker infrastructure — please report those upstream to the respective vendors.
+mt5-quant follows these practices to keep the code trustworthy:
+
+- **Input validation at every tool boundary.** All 89 MCP tool handlers in
+  `src/tools/handlers/` parse and validate their arguments at the entry point
+  (using helpers such as `required_str`, `resolve_report`, and
+  `prepare_analysis`). Untrusted data — tool arguments, the filesystem, and MT5
+  output — is never trusted inside core logic.
+- **No hardcoded secrets.** The source tree contains no embedded credentials,
+  API tokens, or private keys. The only secrets are user-provided: a local
+  `config/mt5-quant.yaml` (gitignored) holding the Wine/MT5 paths, and an
+  optional release PAT used only in CI. Neither is persisted by the project
+  itself.
+- **Safe parsing of untrusted MT5 reports.** Backtest/optimization reports come
+  from MetaTrader 5 as either HTML or SpreadsheetML XML (`.htm.xml`, Build 48+).
+  Parsers in `src/analytics/extract.rs` and `src/optimization/parser.rs` use
+  explicit, bounded parsing (no `eval`, no regex-backed HTML/script execution)
+  and fail fast on malformed input. These parsers are additionally exercised by
+  the cargo-fuzz harness in `fuzz/` (see `dynamic_analysis*` criteria).
+- **Least privilege at runtime.** The architecture enforces **a single MT5
+  instance** and never runs two backtests in parallel on the same Wine prefix.
+  When no display is available the pipeline falls back to headless/Xvfb mode; the
+  only external process launched is the user-configured Wine/MT5 binary.
+- **Dependency auditing in CI.** Every push and pull request runs
+  `cargo-deny` (license + advisory + source checks) and the GitHub
+  `dependency-review` action. Vulnerable or non-compliant dependencies block the
+  build via the `protect-master` ruleset's required status checks.
+- **Fuzzing of parsers.** `fuzz/` contains libFuzzer targets that feed arbitrary
+  bytes into the report/metrics parsers with debug assertions and integer-
+  overflow traps enabled, catching panics and invariant violations.
+- **Isolation of the Wine/MT5 sandbox.** MT5 runs under the user's Wine prefix,
+  which is isolated from the host shell environment. The server does not grant
+  MT5 any elevated privileges.
+- **Static analysis.** Clippy runs with `-D warnings` (warnings fail the build)
+  and GitHub CodeQL (Rust) scans every push/PR.
+
+## Common implementation errors we avoid (`know_common_errors`)
+
+The codebase is deliberately written to avoid well-known Rust/systems pitfalls:
+
+- **Integer overflow.** Rust's release builds disable overflow checks by
+  default, so arithmetic on deal volumes, prices, and cumulative PnL uses
+  `checked_*`/`saturating_*` operations or is validated at parse time. The
+  fuzz harness re-enables `debug-assertions` so overflow traps fire during
+  testing.
+- **Path traversal in `.set` file handling.** `.set` files (UTF-16LE parameter
+  files for EAs) are read/written through helpers in
+  `src/tools/handlers/setfiles.rs`. Paths are resolved against the configured
+  tester profiles directory and normalized; user-supplied filenames are never
+  interpolated into shell commands and are confined to that directory.
+- **UTF-16LE encoding pitfalls.** MetaTrader strips `||Y` flags from UTF-8 `.set`
+  files, so all writes use UTF-16LE with an explicit BOM and `chmod 444`. The
+  helpers never assume UTF-8, avoiding silent mojibake / flag loss.
+- **Avoiding `unsafe`.** The crate uses no `unsafe` blocks in application logic;
+  all FFI with Wine/MT5 is performed via the `std::process` API and the system
+  `curl`/`gpg` binaries, not raw pointer manipulation.
+- **Proper error propagation.** Errors are returned as typed `Result`s and
+  propagated with `?`; there are no swallowed errors or empty `catch`-and-ignore
+  paths. Invalid states halt fast with descriptive messages (Fail-Fast
+  philosophy) rather than being silently patched.
+- **No injection via shell.** Wine/MT5 is launched with an argument vector (not
+  a constructed shell string), eliminating command-injection from config values.
+
+## Signing of release artifacts
+
+To satisfy `delivery_unsigned`, **release artifacts are GPG-signed**:
+
+- Each GitHub Release publishes the macOS (`mcp-mt5-quant-macos-arm64.tar.gz`)
+  and Linux (`mcp-mt5-quant-linux-x64.tar.gz`) binaries **plus** their detached
+  ASCII-armored signatures (`*.tar.gz.asc`), and the project's public key at
+  **`docs/signing-key.asc`**.
+- The signing key is an RSA-4096 key generated for the `mt5-quant releases`
+  identity. The public half is committed to the repository; the private half is
+  held only in CI secrets (`GPG_PRIVATE_KEY`, `GPG_PASSPHRASE`) and is never
+  committed.
+- Signing is performed in CI (`release.yml`) with
+  `gpg --detach-sign --armor` and is **guarded** so the release still succeeds
+  if the signing secrets are not configured — it simply omits the signatures in
+  that case.
+
+### Verifying a downloaded release
+
+```bash
+# 1. Import the project public key
+gpg --import docs/signing-key.asc
+
+# 2. Verify a release artifact
+gpg --verify mcp-mt5-quant-linux-x64.tar.gz.asc \
+            mcp-mt5-quant-linux-x64.tar.gz
+
+# A good signature from "mt5-quant releases <releases@mt5-quant.local>"
+# confirms the artifact was produced by the project's release pipeline.
+```
+
+## Supported versions
+
+Security fixes are applied to the latest released version on the `master`
+branch. Older releases are not back-ported; users should upgrade to the current
+release to receive fixes.
@@ -0,0 +1,23 @@
+# Documentation Index
+
+**Start here:** [QUICKSTART.md](QUICKSTART.md) — install MT5-Quant, run `scripts/setup.sh` to auto-detect Wine/MT5 paths, register it with your LLM client, and complete your first backtest.
+
+| Doc | Description |
+|-----|-------------|
+| [QUICKSTART.md](QUICKSTART.md) | Step-by-step install, setup, and first backtest |
+| [MCP_TOOLS.md](MCP_TOOLS.md) | Full input/output schemas for all 90 tools |
+| [CONFIG.md](CONFIG.md) | Configuration reference (`config/mt5-quant.yaml`) |
+| [ARCHITECTURE.md](ARCHITECTURE.md) | Design principles and internal module layout |
+| [REMOTE_AGENTS.md](REMOTE_AGENTS.md) | Distribute optimization across Linux agents via Wine |
+| [TROUBLESHOOTING.md](TROUBLESHOOTING.md) | Platform-specific fixes for Wine, MT5, and backtests |
+
+## Suggested reading order
+
+1. [QUICKSTART.md](QUICKSTART.md) — get a working installation and first report
+2. [MCP_TOOLS.md](MCP_TOOLS.md) — browse what your LLM agent can call
+3. [CONFIG.md](CONFIG.md) — tune symbols, timeframes, deposit defaults
+4. [TROUBLESHOOTING.md](TROUBLESHOOTING.md) — when something fails
+5. [ARCHITECTURE.md](ARCHITECTURE.md) — how the pipeline works under the hood
+6. [REMOTE_AGENTS.md](REMOTE_AGENTS.md) — scale up optimization throughput
+
+These files are also bundled in every release tarball and MCP package, so installed copies stay available offline.
@@ -0,0 +1,65 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGqN954BEAC8tSNRLfu4BgrTk/k83jWkB3aHBrgohPTGXemEGSTP6WZbeI+6
+NSHw70lB9MlPx65AhzJoLVxIzI9SwBBtoQ+DzoK6QIYaJZkstbMZi5U8rxNXTpU7
+4jyScoLb097ZYpxNhDK5hrxRxN0rg82jmSgC+PrVXuGohgkbHbVHjQJouLr3MuDZ
+d+y1ET+WQ5kBSN/KIzKmnIxjaXFxSi/S90n3pLJADhtcJ0QKdOzKbNf+G2mdZrcG
+XbnphbfgRRWhg+mq/om+SNVz9LEdrrueoI2vAphWvuKSXJxUEAb/hqvQnInbiBIq
+E02K3A3Dypf80jGfB/93wGTx7thxlWzedczm57iZJ0DJu2OT1aXF0uK1hnG9jEUB
+yrruXBuziSLNnQS8X3prbOAMCK3TWEV+l1+F6uK9Dp6vuvSFzmMfEJW+MRK7Yhl7
+7Bi4TlEaWo72DOV7U3XvvcU6kxSdU/CnC79ibMhM8+u0rPa9089Mo0BSqyoP/GFX
+5G2hKjB+gBX4brCT0KMGPal18aaZ9Ej6q3XiziLNY2K9AyXMrFtmwFcnpNQxuA1e
+yewIQ7daV6MJM/DQc8haLr8DxisWEX57OxJywu8l7aldsrQQrxSOO24Or7AUG2lA
+eaGNM14njRU4zJ6BNKnozv3JJTRT6TpqWv6ZSPgXh+BvhdC032uVOJdKCQARAQAB
+tC1tdDUtcXVhbnQgcmVsZWFzZXMgPHJlbGVhc2VzQG10NS1xdWFudC5sb2NhbD6J
+Am4EEwEIAFgWIQTvHKai4tDO/2HcfwgCVqDDam1ecgUCao33nhsUgAAAAAAEAA5t
+YW51MiwyLjUrMS4xMiwwLDMDGy8EBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheA
+AAoJEAJWoMNqbV5y71IP+we/bZUebidePUvLLlHmL2QKWd4iOqlw4zeQDTuEwRTf
+S3qDmiIDytEAJ6AyhQIC+Po4in9hywDOUZnCXgz+VPsWWjdeIyEGNPzmmUU8vcMr
+R3VgeQni3b2qsx5RQnDGLz6y2aF6QdMK8TMlG8QVypsJ8N74A68+voEE2vli6nGJ
+Jf1Hucn4t7cCWCDgpsSrL+dSM4DXZ0Uz1XByXUXvrIf8/XkFgk6l0V7V24uUdOUl
+X5QVL/414wOC5UvzrsuZtE19gdP7BH5IHWAmBwx8CGOuKGiwEZydqnjrGykMCY1s
+80pe6LWYOWsWAmu12lzNlFG/1JxL106YqnMukPn1CTMzWnrEAriRSKVuLN2KvUHd
+QNAbxdBbZCaAmEkoUoBnk/7OEgcmeri8F0PnElRIN7IzJBcqG0JZKx5VAudLveX
+vNU469Jh9isxCmev6rpI7QreCWUF/QeKgDGcCKp8acJQqfmACMgYGFkcS9OrCnL
+qVGGj16IVEIYs4yRde9X4pYL4PTlv10QWpcTaoaMpOmsr2YkYORHE/QWya6+Pf4h
+Dj1NZSof+RuaYjkIFryog8IPtVuRbg7T8UIT9K9wTKf1sRSFCcF1EAYwy0yv5Ch6
+qCZUQtjhHf7zttsSiFtAfcF0ymnI8Vunv099tpTqKwB0u0ke5+yjNJqPOb7y8Nmm
+uQINBGqN954BEADmekxbtTMLr0ayftAh3ZcmNCVSJrn3tSEkmyPCeI2yBxEg7J+H
+ebu+jzleI1jOi4Us6l4mD+GFfXub09LldryugjFLcvI05/vgtlFErC9zEFv+1L5v
+0RylV94PJXJFxxdDUUp4/cdERg+QT/h5jLZhoHKvUQ4PnoTOpEjTElLuH/1Zk480
+MbHkB0fjm4DV1MzG1pYf8QaSkTCEhnXC7SvnlcerU1LuH33VWXlkXHhho3mho3qK
+alf8yjG0PlH+ikvqEHvzOH5SCzUD2hI84/p7vtBvPoQvGdzBIhP+m6QsbeGbxt94
+UYBUudM1c405cYPf1p1wl9Oz96MvH4IM4ucS6c3WK33ALwgdYqA7kbNyhSqk+o+a
+T7zSroCHRhDaVxHH+Qlad8YRVoIGoX24650CbmuiJ7N0SHyny2AFk15EMzoHcI28
+3joSfkUqg7io7/w/k7q0b9fbVkvMn+zQqpYeo7xPqXVDcBpfPXLQZzQgCUiweUbi
+j8rxFEHYFGXxKm2NxZdX5t8ss14Ggv16MNM8/fwDfJ7Scxo5y1TFFSZgNs3dAcdd
+zhBbxHRZTlxyan24O3xrF+aP6BsiXyHUQs/WPYewen0eEWXrfRTr/GgfIONGSk6S
+IWKwbMLnPvkMATwFee8Pf75QO9keNB1nX4dEGeKLhEC1xLJvS8yaNmJorQARAQAB
+iQSIBBgBCAA8FiEE7xymouLQzv9h3H8IAlagw2ptXnIFAmqN954bFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAhsuAkAJEAJWoMNqbV5ywXQgBBkBCAAdFiEETywc
+/FBIkF+vVFdyEHpgkPDwwZsFAmqN954ACgkQEHpgkPDwwZvVwQ//cLwJyiAOfpce
+NOBmsuvz4M5xSvxiMpW3N93of3FwGXtWxp0pdlljVxmx1iv+wwK5uYQsbBPgC48J
+JvUr7W1V/6QcFNQbOevLA5GVcm533gGgeQ+hrptUPL0l3W610DnUO6yQEWRdGyKG
+EM+uQZe20CKb/NyUiOTf9s9zO3rJT/7IYWTitpxvK1t/83FAOvAD6oVQNTwgHVGL
+oKTC2i7MdQ2M9Hc64UGG2D28L/plLUwkLKLDtlcueTv+qSi7RZMjQhpBfhnoH9by
+pOXLNJCFUhVIAIMB5WncjqpAbXneGgLPhDe8napFKB4Mxky1+jycFq+AgVA98/y9
+y3hmOIrK+lnTan1rtUYh6O0Tf9DlDM58/Dr4Pbt7S949WGccEtArCX1B7SqcgvO7
+TP5ENFHmaSTwheTtPnzgiwrICO+BXL9bYyb/oUj0U1zIiVQxDmgiz5M9CM8/5221
+tPH8lFLAGtGvnpjlRzcKX7WL8+fD8V4fZCC4mzt7xMZdRZB5D5upE+7N/EdjNEM0
+UBoBbpZ0muFWtp5f1m2Fu1zJpEDIimfKKl+YHFkODyxOXGeOrRLQB42ecFDOCg0X
+ie5hqQ+PnASiaHMC48ZVTYy6T4+rcGRIcRg+FzvK0Lef8J1klQwN85rc71AIV7a1
+ZWzn35vUqW1YTjBA4mKSGp050BFpNFYFUA/+MW1iqDGwvZC76KXlrA1q9OlTs41q
+9oBW2BgpV7Xaj9AEYC87LTbXGDL5QfLisI7NAVkXKUkRRyhG6J2NiDyPKxnE9V2Y
+eFzq6ENSj7MWSonatQmEyGXeMkbBLfddCssb0FU934ACCzccchB1mHA+CqimKiPe
+mMMW3OPZ0u4lvTrFPktL/PkPHyV75xgQvr7JsKnjdT9h3VHsm4krhC3f2yi5+orb
+nicS5NSGv1l4xNJbqI2nfMk02VY64WOMqduVo12KQeazPO0JBRVFXOMGrmiuluPU
+EFDIbu8AZdU67mhIvIDuP9bkm53EOXT3xk0GZ9iiUhlnvbEW9Oewbw9Lircz3Wwp
+VeQtp+fbaLrWosAmpeUIxhUP9RJmfHjEMJ+AGrLeAZ3UJQMoR2uUoN45/c+aiUPT
+6tNH8BXhloyr6hIfCpkPzbTKpu2jhf1vDTyIigIt5wZoshCbVDy680+1keIPxEuM
+HR1s1Sm5NkvX9VRxk7ZSjv9BPL2GVDmPez0+LlBI1hxHDrzhH8iCNka15GL8eNTR
+JW3zeFWpgfbqm6XP90bKLRSZXybr1vz5k0znWXje4uIW8iuHiPBNi0pHRJktZ0Fo
+z/wtRZUl9wzbQnYqmewAt7hzLc379KsYexOesJoDLgq8iCSyWZbUgC/euMZV9emL
+GqF/jfDJVQqPMNY=
+=sjIH
+-----END PGP PUBLIC KEY BLOCK-----
@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage
@@ -0,0 +1,33 @@
+[package]
+name = "mt5-quant-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[dependencies.mt5-quant]
+path = ".."
+
+[[bin]]
+name = "parse_metrics"
+path = "fuzz_targets/parse_metrics.rs"
+test = false
+doc = false
+bench = false
+
+# Enable debug/overflow assertions during fuzzing. cargo-fuzz builds fuzz
+# targets in release mode by default, so we explicitly turn debug-assertions
+# back on for the release profile. This backs the
+# `dynamic_analysis_enable_assertions` CII criterion: any debug_assert! or
+# arithmetic-overflow check inside the crate is active while libFuzzer feeds
+# arbitrary input, so crashes from invariant violations are caught as bugs.
+[profile.release]
+debug-assertions = true
+
+[profile.dev]
+debug-assertions = true
@@ -0,0 +1,36 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use mt5_quant::models::Metrics;
+
+// Fuzz target for the pure, I/O-free MT5 backtest report metrics parser.
+//
+// `Metrics::from_html` takes an arbitrary `&str` and extracts the numeric
+// summary metrics from an MT5 HTML/XML report. It is panic-free on bad input:
+// every numeric parse uses `unwrap_or`, regex patterns are compile-time
+// constants (never panicking), and the function returns `Option<Metrics>`
+// (None when no metrics are found). We return early on non-UTF-8 input and on
+// the None case, so the fuzzer only ever exercises the parser itself.
+fuzz_target!(|data: &[u8]| {
+    let Ok(text) = std::str::from_utf8(data) else {
+        // Parser only accepts UTF-8 text; arbitrary byte sequences are
+        // out of scope and must not cause a crash.
+        return;
+    };
+
+    if let Some(metrics) = Metrics::from_html(text) {
+        // Force the computed fields to be materialized so any logic error
+        // inside the parser surfaces during fuzzing.
+        let _ = (
+            metrics.net_profit,
+            metrics.profit_factor,
+            metrics.max_dd_pct,
+            metrics.sharpe_ratio,
+            metrics.total_trades,
+            metrics.recovery_factor,
+            metrics.win_rate_pct,
+            metrics.gross_profit,
+            metrics.gross_loss,
+        );
+    }
+});
@@ -7,13 +7,13 @@
    "url": "https://github.com/masdevid/mt5-quant",
    "source": "github"
  },
-  "version": "1.34.2",
+  "version": "1.34.3",
  "packages": [
    {
      "registryType": "mcpb",
-      "version": "1.34.2",
-      "identifier": "https://github.com/masdevid/mt5-quant/releases/download/v1.34.2/mcp-mt5-quant-macos-arm64.tar.gz",
-      "fileSha256": "TBD_CI_WILL_UPDATE",
+      "version": "1.34.3",
+      "identifier": "https://github.com/masdevid/mt5-quant/releases/download/v1.34.3/mcp-mt5-quant-macos-arm64.tar.gz",
+      "fileSha256": "2f303cb3deb62e47742e5eb4d73a0e3edf200aadf7db9da39a0ef2151d064171",
      "transport": {
        "type": "stdio"
      },
@@ -7,6 +7,12 @@ use crate::models::metrics::Metrics;

 pub struct DealAnalyzer;

+impl Default for DealAnalyzer {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl DealAnalyzer {
    pub fn new() -> Self {
        Self
@@ -8,6 +8,12 @@ use crate::models::{Deal, Metrics};

 pub struct ReportExtractor;

+impl Default for ReportExtractor {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl ReportExtractor {
    pub fn new() -> Self {
        Self
@@ -0,0 +1,60 @@
+pub mod analytics;
+pub mod compile;
+pub mod models;
+pub mod optimization;
+pub mod pipeline;
+pub mod storage;
+pub mod tools;
+
+pub mod mcp_server;
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct McpRequest {
+    pub jsonrpc: String,
+    pub id: Option<serde_json::Value>,
+    pub method: String,
+    pub params: Option<serde_json::Value>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct McpResponse {
+    pub jsonrpc: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub result: Option<serde_json::Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<McpError>,
+}
+
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct McpError {
+    pub code: i32,
+    pub message: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub data: Option<serde_json::Value>,
+}
+
+#[derive(Debug, serde::Serialize)]
+pub struct ServerInfo {
+    pub name: String,
+    pub version: String,
+}
+
+#[derive(Debug, serde::Serialize)]
+pub struct InitializeResult {
+    pub protocol_version: String,
+    pub capabilities: ServerCapabilities,
+    pub server_info: ServerInfo,
+}
+
+#[derive(Debug, serde::Serialize)]
+pub struct ServerCapabilities {
+    pub experimental: serde_json::Value,
+    pub tools: ToolCapabilities,
+}
+
+#[derive(Debug, serde::Serialize)]
+pub struct ToolCapabilities {
+    pub list_changed: bool,
+}
@@ -1,24 +1,16 @@
-mod analytics;
-mod compile;
-mod models;
-mod optimization;
-mod pipeline;
-mod storage;
-mod tools;
-
-mod mcp_server;
-
 use anyhow::Result;
 use clap::Parser;
-use serde_json::{json, Value};
+use serde_json::json;
 use std::io::{stdout, Write};
 use std::time::Instant;
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::TcpListener;
 use tracing::{error, info};

-use crate::models::Config;
-use crate::pipeline::backtest::{BacktestParams, BacktestPipeline};
+use mt5_quant::mcp_server::{McpServer, Notification};
+use mt5_quant::models::Config;
+use mt5_quant::pipeline::backtest::{BacktestParams, BacktestPipeline};
+use mt5_quant::{McpError, McpRequest, McpResponse};

 #[derive(Parser)]
 #[command(name = "mt5-quant")]
@@ -45,57 +37,6 @@ struct Cli {
    startup_delay: Option<u64>,
 }

-#[derive(Debug, serde::Deserialize, serde::Serialize)]
-pub struct McpRequest {
-    jsonrpc: String,
-    id: Option<Value>,
-    method: String,
-    params: Option<Value>,
-}
-
-#[derive(Debug, serde::Deserialize, serde::Serialize)]
-pub struct McpResponse {
-    jsonrpc: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    id: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    result: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    error: Option<McpError>,
-}
-
-#[derive(Debug, serde::Deserialize, serde::Serialize)]
-pub struct McpError {
-    code: i32,
-    message: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    data: Option<Value>,
-}
-
-#[derive(Debug, serde::Serialize)]
-pub struct ServerInfo {
-    name: String,
-    version: String,
-}
-
-#[derive(Debug, serde::Serialize)]
-pub struct InitializeResult {
-    protocol_version: String,
-    capabilities: ServerCapabilities,
-    server_info: ServerInfo,
-}
-
-#[derive(Debug, serde::Serialize)]
-pub struct ServerCapabilities {
-    experimental: Value,
-    tools: ToolCapabilities,
-}
-
-#[derive(Debug, serde::Serialize)]
-pub struct ToolCapabilities {
-    list_changed: bool,
-}
-
 #[tokio::main]
 async fn main() -> Result<()> {
    tracing_subscriber::fmt()
@@ -178,9 +119,9 @@ async fn run_test_launch(ea: Option<String>, startup_delay: Option<u64>) -> Resu
 async fn run_stdio_server() -> Result<()> {
    info!("Starting MT5-Quant MCP server on stdio");

-    let server = std::sync::Arc::new(mcp_server::McpServer::new());
+    let server = std::sync::Arc::new(McpServer::new());
    let (notification_tx, mut notification_rx) =
-        tokio::sync::mpsc::unbounded_channel::<mcp_server::Notification>();
+        tokio::sync::mpsc::unbounded_channel::<Notification>();
    server.set_notification_sender(notification_tx).await;

    // Spawn notification sender task
@@ -254,7 +195,7 @@ async fn run_tcp_server(port: u16) -> Result<()> {
    info!("Starting MT5-Quant MCP server on TCP port {}", port);

    let listener = TcpListener::bind(format!("127.0.0.1:{}", port)).await?;
-    info!("Listening on 127.0.0.1:{}", port);
+    info!("Running TCP server on port {}", port);

    loop {
        let (socket, addr) = listener.accept().await?;
@@ -272,7 +213,7 @@ async fn handle_connection(socket: tokio::net::TcpStream) -> Result<()> {
    let (reader, mut writer) = socket.into_split();
    let mut reader = BufReader::new(reader);
    let mut line = String::new();
-    let server = mcp_server::McpServer::new();
+    let server = McpServer::new();

    loop {
        line.clear();
@@ -31,6 +31,12 @@ pub struct McpServer {
    notification_tx: Arc<Mutex<Option<mpsc::UnboundedSender<Notification>>>>,
 }

+impl Default for McpServer {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl McpServer {
    pub fn new() -> Self {
        let config = ModelsConfig::load().unwrap_or_default();
@@ -17,6 +17,12 @@ pub struct OptimizationPass {

 pub struct OptimizationParser;

+impl Default for OptimizationParser {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl OptimizationParser {
    pub fn new() -> Self {
        Self
@@ -40,6 +40,13 @@ impl Stage {
 #[allow(dead_code)]
 pub struct StageExecutor;

+#[allow(dead_code)]
+impl Default for StageExecutor {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 #[allow(dead_code)]
 impl StageExecutor {
    pub fn new() -> Self {
@@ -367,7 +367,8 @@ impl ReportDb {
        keep_last: usize,
    ) -> Result<Vec<(String, String, Option<String>)>> {
        let conn = self.connect()?;
-        let count: usize = conn.query_row("SELECT COUNT(*) FROM reports", [], |r| r.get(0))?;
+        let count: i64 = conn.query_row("SELECT COUNT(*) FROM reports", [], |r| r.get(0))?;
+        let count = count as usize;

        if count <= keep_last {
            return Ok(Vec::new());
@@ -404,8 +405,8 @@ impl ReportDb {

    pub fn count(&self) -> Result<usize> {
        let conn = self.connect()?;
-        let n: usize = conn.query_row("SELECT COUNT(*) FROM reports", [], |r| r.get(0))?;
-        Ok(n)
+        let n: i64 = conn.query_row("SELECT COUNT(*) FROM reports", [], |r| r.get(0))?;
+        Ok(n as usize)
    }

    /// Get the latest report by created_at (most recent first)