fix: isolate quant monitor runtime checkout (#121)

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

ops/quant-monitor/AGENTS.md

@@ -9,8 +9,8 @@ VPS Codex 定时监控（`codex-quant.timer` 每 30 分钟）+ 收盘简报（`c
 | 变量 | 说明 |
 |------|------|
 | `QUANT_MONITOR_ROOT` | 本目录 |
-| `AIAUDIT_BRIDGE_ROOT` | `~/Projects/AIAuditBridge` |
-| `QUANT_PLATFORM_KIT_ROOT` | `~/Projects/QuantPlatformKit` |
+| `AIAUDIT_BRIDGE_ROOT` | `/home/ubuntu/quant-monitor-runtime/AIAuditBridge`（专用运行副本） |
+| `QUANT_PLATFORM_KIT_ROOT` | `$QUANT_MONITOR_ROOT/data/lifecycle-projects/QuantPlatformKit`（专用镜像） |
 | `GLOBAL_TELEGRAM_CHAT_ID` | systemd 注入，勿提交 git |
 | `GH_TOKEN` | `gh` 拉仓 + 开 Issue |
 | `QSL_GITHUB_REPO` | 非策略类 briefing Issue 的默认仓库；策略证据按 domain 写入对应策略仓 |
@@ -19,8 +19,8 @@ VPS Codex 定时监控（`codex-quant.timer` 每 30 分钟）+ 收盘简报（`c
 
 ## 每 30 分钟（health_check.sh）
 
-1. `sync_strategy_repos.sh` — `git pull` 四策略仓 + QPK
-2. `health_cycle.py` — `build_dashboard` + `run_drift_detection`
+1. `sync_strategy_repos.sh` — 更新四策略仓 + QPK 的只读专用镜像
+2. `sync_lifecycle_artifacts.py`，随后 `health_cycle.py` — `build_dashboard` + `run_drift_detection`
 3. lifecycle `overall_score < 60` 或 drift ≥ 0.50 → 生成 monitoring evidence
 4. evidence → 对应策略仓的去重、issue-only AI optimization proposal
 5. 分数或漂移本身不发 Telegram；数据/工件不可用或 Issue 记录失败才通知人工

ops/quant-monitor/scripts/deploy_to_vps.sh

@@ -5,7 +5,10 @@ set -euo pipefail
 VPS_HOST="${VPS_HOST:-qvps}"
 VPS_PORT="${VPS_PORT:-8822}"
 AAB_ROOT="${AIAUDIT_BRIDGE_ROOT:-$(cd "$(dirname "$0")/../../.." && pwd)}"
-REMOTE_AAB="${REMOTE_AAB:-/home/ubuntu/Projects/AIAuditBridge}"
+# Keep the production monitor separate from developers' worktrees.  The
+# service is allowed to fast-forward this checkout, while developer checkouts
+# must remain untouched.
+REMOTE_AAB="/home/ubuntu/quant-monitor-runtime/AIAuditBridge"
 REMOTE_MONITOR="$REMOTE_AAB/ops/quant-monitor"
 
 echo "[deploy] updating AIAuditBridge on ${VPS_HOST}"
@@ -33,7 +36,7 @@ rsync -avz -e "ssh -p ${VPS_PORT}" \
 echo "[deploy] bootstrap runtime + systemd"
 ssh -p "${VPS_PORT}" "${VPS_HOST}" bash -s <<'REMOTE'
 set -euo pipefail
-REMOTE_AAB="/home/ubuntu/Projects/AIAuditBridge"
+REMOTE_AAB="/home/ubuntu/quant-monitor-runtime/AIAuditBridge"
 REMOTE_MONITOR="$REMOTE_AAB/ops/quant-monitor"
 OLD_UNIT="/etc/systemd/system/codex-quant.service"
 CHAT_ID=""

ops/quant-monitor/systemd/codex-daily-briefing.service.example

@@ -7,19 +7,19 @@ Wants=network-online.target
 Type=oneshot
 User=ubuntu
 Group=ubuntu
-WorkingDirectory=/home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor
-Environment=QUANT_MONITOR_ROOT=/home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor
-Environment=AIAUDIT_BRIDGE_ROOT=/home/ubuntu/Projects/AIAuditBridge
-Environment=QUANT_PLATFORM_KIT_ROOT=/home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor/data/lifecycle-projects/QuantPlatformKit
+WorkingDirectory=/home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor
+Environment=QUANT_MONITOR_ROOT=/home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor
+Environment=AIAUDIT_BRIDGE_ROOT=/home/ubuntu/quant-monitor-runtime/AIAuditBridge
+Environment=QUANT_PLATFORM_KIT_ROOT=/home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor/data/lifecycle-projects/QuantPlatformKit
 Environment=QUANT_SENTINEL_TELEGRAM_SECRET_NAME=quant-sentinel-telegram-bot-token
 Environment=QUANT_SENTINEL_GCP_PROJECT=firstradequant
 Environment=GLOBAL_TELEGRAM_CHAT_ID=
 Environment=QSL_GITHUB_REPO=QuantStrategyLab/CnEquityStrategies
 RuntimeDirectory=quant-monitor
 RuntimeDirectoryMode=0750
-ExecStartPre=/bin/bash /home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor/scripts/load_telegram_env.sh /run/quant-monitor/telegram.env
+ExecStartPre=/bin/bash /home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor/scripts/load_telegram_env.sh /run/quant-monitor/telegram.env
 EnvironmentFile=-/run/quant-monitor/telegram.env
-ExecStart=/bin/bash /home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor/scripts/daily_briefing_pipeline.sh
+ExecStart=/bin/bash /home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor/scripts/daily_briefing_pipeline.sh
 
 [Install]
 WantedBy=multi-user.target

ops/quant-monitor/systemd/codex-quant.service.example

@@ -7,20 +7,20 @@ Wants=network-online.target
 Type=oneshot
 User=ubuntu
 Group=ubuntu
-WorkingDirectory=/home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor
-Environment=QUANT_MONITOR_ROOT=/home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor
-Environment=AIAUDIT_BRIDGE_ROOT=/home/ubuntu/Projects/AIAuditBridge
-Environment=QUANT_PLATFORM_KIT_ROOT=/home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor/data/lifecycle-projects/QuantPlatformKit
+WorkingDirectory=/home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor
+Environment=QUANT_MONITOR_ROOT=/home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor
+Environment=AIAUDIT_BRIDGE_ROOT=/home/ubuntu/quant-monitor-runtime/AIAuditBridge
+Environment=QUANT_PLATFORM_KIT_ROOT=/home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor/data/lifecycle-projects/QuantPlatformKit
 Environment=QUANT_SENTINEL_TELEGRAM_SECRET_NAME=quant-sentinel-telegram-bot-token
 Environment=QUANT_SENTINEL_GCP_PROJECT=firstradequant
 # Set on VPS only — do not commit real chat id to git:
 Environment=GLOBAL_TELEGRAM_CHAT_ID=
 Environment=QSL_GITHUB_REPO=QuantStrategyLab/CnEquityStrategies
 RuntimeDirectory=quant-monitor
 RuntimeDirectoryMode=0750
-ExecStartPre=/bin/bash /home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor/scripts/load_telegram_env.sh /run/quant-monitor/telegram.env
+ExecStartPre=/bin/bash /home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor/scripts/load_telegram_env.sh /run/quant-monitor/telegram.env
 EnvironmentFile=-/run/quant-monitor/telegram.env
-ExecStart=/bin/bash /home/ubuntu/Projects/AIAuditBridge/ops/quant-monitor/scripts/health_check.sh
+ExecStart=/bin/bash /home/ubuntu/quant-monitor-runtime/AIAuditBridge/ops/quant-monitor/scripts/health_check.sh
 
 [Install]
 WantedBy=multi-user.target

ops/quant-monitor/tests/test_deploy_scripts.py

@@ -83,6 +83,17 @@ def test_deploy_script_only_accepts_monitor_alert_exit(self) -> None:
         self.assertIn("ExecMainStatus", script)
         self.assertIn('if [[ "$monitor_status" != "2" ]]', script)
 
+    def test_deployment_uses_a_dedicated_runtime_checkout(self) -> None:
+        script = (ROOT / "scripts" / "deploy_to_vps.sh").read_text(encoding="utf-8")
+        service = (ROOT / "systemd" / "codex-quant.service.example").read_text(
+            encoding="utf-8"
+        )
+
+        runtime_root = "/home/ubuntu/quant-monitor-runtime/AIAuditBridge"
+        self.assertIn(f'REMOTE_AAB="{runtime_root}"', script)
+        self.assertIn(f"WorkingDirectory={runtime_root}/ops/quant-monitor", service)
+        self.assertNotIn("/home/ubuntu/Projects/AIAuditBridge", service)
+
 
 if __name__ == "__main__":
     unittest.main()