feat: generate frozen legacy live continuity targets

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/manual-strategy-switch.yml

@@ -31,6 +31,27 @@ on:
           - live
           - dry_run
           - paper
+      live_continuity_state:
+        description: "Optional frozen legacy live baseline state. This cannot create a new live permission or increase risk."
+        required: true
+        type: choice
+        default: NONE
+        options:
+          - NONE
+          - ACTIVE_LKG
+          - ACTIVE_REDUCED
+          - RECONCILE_ONLY
+          - RISK_REDUCTION_ONLY
+          - PAUSED
+          - ROLLBACK_LKG
+      live_continuity_baseline_id:
+        description: "Required only with a continuity state: audited identifier of the existing authorised baseline."
+        required: false
+        type: string
+      live_continuity_captured_at:
+        description: "Required only with a continuity state: ISO date when the exact legacy target was captured."
+        required: false
+        type: string
       variable_scope:
         description: "Where GitHub variables are written. blank = platform default."
         required: false
@@ -146,6 +167,9 @@ jobs:
       TARGET_NAME: ${{ inputs.target_name }}
       STRATEGY_PROFILE: ${{ inputs.strategy_profile }}
       EXECUTION_MODE: ${{ inputs.execution_mode }}
+      LIVE_CONTINUITY_STATE: ${{ inputs.live_continuity_state }}
+      LIVE_CONTINUITY_BASELINE_ID: ${{ inputs.live_continuity_baseline_id }}
+      LIVE_CONTINUITY_CAPTURED_AT: ${{ inputs.live_continuity_captured_at }}
       VARIABLE_SCOPE: ${{ inputs.variable_scope }}
       GITHUB_ENVIRONMENT_NAME: ${{ inputs.github_environment }}
       DEPLOYMENT_SELECTOR: ${{ inputs.deployment_selector }}
@@ -345,6 +369,11 @@ jobs:
           if [ -n "${SERVICE_NAME:-}" ]; then
             args+=(--service-name "${SERVICE_NAME}")
           fi
+          if [ "${LIVE_CONTINUITY_STATE}" != "NONE" ]; then
+            args+=(--live-continuity-state "${LIVE_CONTINUITY_STATE}")
+            args+=(--live-continuity-baseline-id "${LIVE_CONTINUITY_BASELINE_ID}")
+            args+=(--live-continuity-captured-at "${LIVE_CONTINUITY_CAPTURED_AT}")
+          fi
           if [ -n "${EXTRA_VARIABLES_JSON:-}" ]; then
             args+=(--extra-variables-json "${EXTRA_VARIABLES_JSON}")
           fi
@@ -391,6 +420,10 @@ jobs:
           print("- strategy_profile: `<redacted>`")
           print("- service_name: `<redacted>`")
           print(f"- execution_mode: `{target['runtime_target']['execution_mode']}`")
+          continuity = target["runtime_target"].get("live_continuity")
+          if isinstance(continuity, dict):
+              print(f"- live_continuity_state: `{continuity['state']}`")
+              print(f"- live_continuity_baseline_kind: `{continuity['baseline_kind']}`")
           print("- values: `<redacted>`")
           print()
           print("### Variables")

README.zh-CN.md

@@ -65,6 +65,8 @@ python3 -m unittest discover -s python/tests -v
 3. 再运行 `apply=true`，并填写 `confirm_apply=APPLY`，写入目标仓库变量。
 4. 对 Cloud Run 平台，如需同步运行环境，额外设置 `trigger_platform_sync=true`，并填写 `confirm_apply=APPLY_AND_SYNC`。
 
+若是在**恢复已明确授权的旧实盘基线**，可额外填写 `live_continuity_state`、`live_continuity_baseline_id` 和 `live_continuity_captured_at`。工具会用完整 target 自动计算冻结 hash；它只接受 `legacy_authorized` 基线，不能借此创建新的实盘权限、扩大资金/杠杆或把研究候选直接提升为实盘。
+
 常用例子：
 
 ```text

python/scripts/build_runtime_switch.py

@@ -16,10 +16,12 @@
 ROOT = SCRIPT_DIR.parents[1]
 
 from runtime_settings import (  # noqa: E402
+    LIVE_CONTINUITY_STATES,
     SUPPORTED_PLATFORMS,
     compact_json,
     env_string,
     platform_repository,
+    runtime_target_fingerprint,
     select_service_target_entry_index,
     validate_target,
 )
@@ -820,9 +822,35 @@ def _build_runtime_target(args: argparse.Namespace) -> dict[str, Any]:
     execution_windows = _load_json_object(args.execution_windows_json, field_name="execution_windows_json")
     if execution_windows:
         runtime_target["execution_windows"] = execution_windows
+    _apply_live_continuity(runtime_target, args)
     return runtime_target
 
 
+def _apply_live_continuity(runtime_target: dict[str, Any], args: argparse.Namespace) -> None:
+    """Attach a frozen legacy baseline without granting new live authority."""
+
+    state = str(getattr(args, "live_continuity_state", "") or "").strip().upper()
+    if not state or state == "NONE":
+        return
+    if state not in LIVE_CONTINUITY_STATES:
+        raise ValueError(f"live_continuity_state must be one of NONE, {', '.join(sorted(LIVE_CONTINUITY_STATES))}")
+    if runtime_target.get("execution_mode") != "live" or runtime_target.get("dry_run_only") is not False:
+        raise ValueError("live_continuity is only valid for an execution_mode=live, non-dry-run target")
+    baseline_id = str(getattr(args, "live_continuity_baseline_id", "") or "").strip()
+    captured_at = str(getattr(args, "live_continuity_captured_at", "") or "").strip()
+    if not baseline_id or not captured_at:
+        raise ValueError(
+            "live_continuity_baseline_id and live_continuity_captured_at are required when live_continuity_state is set"
+        )
+    runtime_target["live_continuity"] = {
+        "state": state,
+        "baseline_kind": "legacy_authorized",
+        "baseline_id": baseline_id,
+        "baseline_target_sha256": runtime_target_fingerprint(runtime_target),
+        "captured_at": captured_at,
+    }
+
+
 def _build_target_entry(
     *,
     platform: str,
@@ -1041,6 +1069,14 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--account-scope", default="")
     parser.add_argument("--service-name", default="")
     parser.add_argument("--execution-windows-json", default="")
+    parser.add_argument(
+        "--live-continuity-state",
+        choices=("NONE", *sorted(LIVE_CONTINUITY_STATES)),
+        default="NONE",
+        help="Freeze an already authorised legacy baseline; does not create new live authority.",
+    )
+    parser.add_argument("--live-continuity-baseline-id", default="")
+    parser.add_argument("--live-continuity-captured-at", default="")
     parser.add_argument("--plugin-mode", choices=("auto", "none", "custom"), default="none")
     parser.add_argument("--custom-plugin-mounts-json", default="")
     parser.add_argument("--artifact-bucket-uri", default=DEFAULT_ARTIFACT_BUCKET_URI)

python/tests/test_runtime_settings.py

@@ -1373,6 +1373,62 @@ def test_build_switch_target_defaults_longbridge_sg_tqqq(self):
         self.assertEqual(plugin_payload["strategy_plugins"], [])
         self.assertEqual(runtime_settings.validate_target(target), [])
 
+    def test_build_switch_target_freezes_eligible_legacy_live_baseline(self):
+        parser = build_runtime_switch.build_parser()
+        args = parser.parse_args(
+            [
+                "--platform",
+                "longbridge",
+                "--target-name",
+                "sg",
+                "--strategy-profile",
+                "soxl_soxx_trend_income",
+                "--execution-mode",
+                "live",
+                "--live-continuity-state",
+                "ACTIVE_LKG",
+                "--live-continuity-baseline-id",
+                "soxl-longbridge-lkg-20260830",
+                "--live-continuity-captured-at",
+                "2026-08-30",
+            ]
+        )
+
+        target = build_runtime_switch.build_switch_target(args)
+        continuity = target["runtime_target"]["live_continuity"]
+
+        self.assertEqual(continuity["state"], "ACTIVE_LKG")
+        self.assertEqual(continuity["baseline_kind"], "legacy_authorized")
+        self.assertEqual(
+            continuity["baseline_target_sha256"],
+            runtime_settings.runtime_target_fingerprint(target["runtime_target"]),
+        )
+        self.assertEqual(runtime_settings.validate_target(target), [])
+
+    def test_build_switch_target_rejects_continuity_for_dry_run(self):
+        parser = build_runtime_switch.build_parser()
+        args = parser.parse_args(
+            [
+                "--platform",
+                "longbridge",
+                "--target-name",
+                "sg",
+                "--strategy-profile",
+                "tqqq_growth_income",
+                "--execution-mode",
+                "dry_run",
+                "--live-continuity-state",
+                "ACTIVE_LKG",
+                "--live-continuity-baseline-id",
+                "tqqq-longbridge-lkg-20260830",
+                "--live-continuity-captured-at",
+                "2026-08-30",
+            ]
+        )
+
+        with self.assertRaisesRegex(ValueError, "only valid for an execution_mode=live"):
+            build_runtime_switch.build_switch_target(args)
+
     def test_build_switch_target_treats_legacy_auto_plugin_mode_as_none(self):
         parser = build_runtime_switch.build_parser()
         args = parser.parse_args(