fix: run crypto drift preflight on trusted inputs

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/drift-check.yml

@@ -13,34 +13,18 @@ permissions:
 
 jobs:
   preflight_backtests:
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-      LIFECYCLE_PERFORMANCE_BUCKET: ${{ vars.LIFECYCLE_PERFORMANCE_BUCKET || '' }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Require lifecycle bucket
-        run: |
-          set -euo pipefail
-          if [ -z "${LIFECYCLE_PERFORMANCE_BUCKET:-}" ]; then
-            echo "::error::LIFECYCLE_PERFORMANCE_BUCKET must be configured for drift preflight"
-            exit 1
-          fi
-
       - name: Checkout QuantPlatformKit
         uses: actions/checkout@v6
         with:
           repository: QuantStrategyLab/QuantPlatformKit
-          ref: 335c7a22bc3f570bd5705427ccc40172eda6b289
+          ref: 9bb8f31e898ea238a6446472f9f5e58133128d0c
           path: external/QuantPlatformKit
 
       - name: Set up Python
@@ -55,10 +39,76 @@ jobs:
           python -m pip install -e . pandas
           python -m pip install --no-deps -e external/QuantPlatformKit
 
-      - name: Build lifecycle backtests in staging
+      - name: Download latest trusted lifecycle inputs
+        env:
+          GH_TOKEN: ${{ secrets.SNAPSHOT_REPOSITORY_TOKEN }}
+          INPUT_ROOT: ${{ runner.temp }}/crypto-lifecycle-inputs
+        run: |
+          set -euo pipefail
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::SNAPSHOT_REPOSITORY_TOKEN is required for lifecycle input artifact access"
+            exit 1
+          fi
+          gh api --paginate --slurp             "/repos/QuantStrategyLab/CryptoLivePoolPipelines/actions/artifacts?per_page=100"             > "${RUNNER_TEMP}/snapshot-artifacts.json"
+          python - <<'PY' > "${RUNNER_TEMP}/snapshot-artifact-selection.txt"
+          import json
+          import os
+          from pathlib import Path
+          pages = json.loads((Path(os.environ["RUNNER_TEMP"]) / "snapshot-artifacts.json").read_text())
+          artifacts = [item for page in pages for item in page.get("artifacts", [])]
+          candidates = [
+              item for item in artifacts
+              if not item.get("expired")
+              and str(item.get("name", "")).startswith("crypto-lifecycle-inputs-")
+              and item.get("workflow_run", {}).get("head_branch") == "main"
+          ]
+          if not candidates:
+              raise SystemExit("no trusted crypto lifecycle input artifact is available")
+          selected = max(candidates, key=lambda item: item["created_at"])
+          print(selected["id"], selected["workflow_run"]["id"])
+          PY
+          read -r artifact_id workflow_run_id < "${RUNNER_TEMP}/snapshot-artifact-selection.txt"
+          gh api "/repos/QuantStrategyLab/CryptoLivePoolPipelines/actions/runs/${workflow_run_id}"             > "${RUNNER_TEMP}/snapshot-workflow-run.json"
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+          run = json.loads((Path(os.environ["RUNNER_TEMP"]) / "snapshot-workflow-run.json").read_text())
+          expected = {
+              "conclusion": "success",
+              "head_branch": "main",
+              "path": ".github/workflows/publish-lifecycle-inputs.yml",
+          }
+          mismatches = {key: run.get(key) for key, value in expected.items() if run.get(key) != value}
+          if run.get("head_repository", {}).get("full_name") != "QuantStrategyLab/CryptoLivePoolPipelines":
+              mismatches["head_repository"] = run.get("head_repository", {}).get("full_name")
+          if mismatches:
+              raise SystemExit(f"lifecycle input provenance check failed: {mismatches}")
+          PY
+          gh api "/repos/QuantStrategyLab/CryptoLivePoolPipelines/actions/artifacts/${artifact_id}/zip"             > "${RUNNER_TEMP}/snapshot-artifact.zip"
+          python - <<'PY'
+          import os
+          import zipfile
+          from pathlib import Path
+          archive = Path(os.environ["RUNNER_TEMP"]) / "snapshot-artifact.zip"
+          target_root = Path(os.environ["INPUT_ROOT"])
+          required = {"research_panel.csv.gz", "market_history.csv.gz", "manifest.json"}
+          with zipfile.ZipFile(archive) as bundle:
+              by_name = {Path(name).name: name for name in bundle.namelist() if Path(name).name in required}
+              missing = sorted(required - set(by_name))
+              if missing:
+                  raise SystemExit(f"crypto lifecycle artifact is missing: {', '.join(missing)}")
+              target_root.mkdir(parents=True, exist_ok=True)
+              for name, member in by_name.items():
+                  (target_root / name).write_bytes(bundle.read(member))
+          PY
+
+      - name: Build lifecycle preflight bundle
         env:
-          LIFECYCLE_PREFLIGHT_STAGING_ROOT: ${{ runner.temp }}/lifecycle_preflight
+          INPUT_ROOT: ${{ runner.temp }}/crypto-lifecycle-inputs
+          LIFECYCLE_PREFLIGHT_BUNDLE_ROOT: ${{ runner.temp }}/lifecycle-preflight-bundle
         run: |
+          set -euo pipefail
           python - <<'PY'
           import json
           import os
@@ -71,65 +121,61 @@ jobs:
                   text=True,
               )
           )["profiles"]
-          staging_root = Path(os.environ["LIFECYCLE_PREFLIGHT_STAGING_ROOT"])
+          input_root = Path(os.environ["INPUT_ROOT"])
+          bundle_root = Path(os.environ["LIFECYCLE_PREFLIGHT_BUNDLE_ROOT"])
+          store_root = bundle_root / "data" / "lifecycle_store"
           for profile in profiles:
+              returns_output = (
+                  bundle_root
+                  / "external"
+                  / "CryptoLivePoolPipelines"
+                  / "data"
+                  / "output"
+                  / profile
+                  / "portfolio_and_tracker_returns.csv"
+              )
               subprocess.check_call(
                   [
                       "python",
                       "scripts/run_walk_forward_backtest.py",
                       "--profile",
                       profile,
+                      "--panel",
+                      str(input_root / "research_panel.csv.gz"),
+                      "--market-history",
+                      str(input_root / "market_history.csv.gz"),
                       "--store-root",
-                      str(staging_root),
+                      str(store_root),
+                      "--returns-output",
+                      str(returns_output),
                   ]
               )
           PY
 
-      - name: Promote staged lifecycle backtests
-        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-        env:
-          LIFECYCLE_PREFLIGHT_STAGING_ROOT: ${{ runner.temp }}/lifecycle_preflight
-        run: |
-          python - <<'PY'
-          import json
-          import os
-          import subprocess
-          from pathlib import Path
-
-          from quant_platform_kit.strategy_lifecycle.performance_store import PerformanceStore
-
-          domain = "crypto"
-          staging_root = Path(os.environ["LIFECYCLE_PREFLIGHT_STAGING_ROOT"])
-          source = PerformanceStore(local_root=staging_root)
-          target = PerformanceStore.from_env()
-          profiles = json.loads(
-              subprocess.check_output(
-                  ["python", "scripts/run_walk_forward_backtest.py", "--list-profiles"],
-                  text=True,
-              )
-          )["profiles"]
-          results = [source.load_latest_backtest(domain, profile) for profile in profiles]
-          if any(result is None for result in results):
-              raise RuntimeError("staged lifecycle backtests are incomplete")
-          for result in results:
-              target.save_backtest_result(result)
-          PY
+      - name: Upload lifecycle preflight artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: lifecycle-preflight-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/lifecycle-preflight-bundle
+          if-no-files-found: error
 
   drift:
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
     needs: preflight_backtests
     permissions:
       contents: read
       issues: write
       id-token: write
-    uses: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@17278db4e7aef0007346d853eb308b6c1bd8c859
+    uses: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@9bb8f31e898ea238a6446472f9f5e58133128d0c
     with:
       strategy_domain: crypto
       caller_event_name: ${{ github.event_name }}
       caller_pr_head_repository: ${{ github.event.pull_request.head.repo.full_name || '' }}
       snapshot_repository: QuantStrategyLab/CryptoLivePoolPipelines
       snapshot_checkout_path: external/CryptoLivePoolPipelines
       ai_gateway_service_url: ${{ vars.AI_GATEWAY_SERVICE_URL }}
-      lifecycle_performance_bucket: ${{ vars.LIFECYCLE_PERFORMANCE_BUCKET }}
+      quant_platform_kit_ref: 9bb8f31e898ea238a6446472f9f5e58133128d0c
+      lifecycle_preflight_artifact: lifecycle-preflight-${{ github.run_id }}-${{ github.run_attempt }}
     secrets:
       codex_audit_service_url: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
       snapshot_repository_token: ${{ secrets.SNAPSHOT_REPOSITORY_TOKEN }}

pyproject.toml

@@ -9,7 +9,7 @@ description = "Shared crypto strategy catalog and implementations"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-  "quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@335c7a22bc3f570bd5705427ccc40172eda6b289",
+  "quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@9bb8f31e898ea238a6446472f9f5e58133128d0c",
 ]
 
 [tool.setuptools]