feat: verify universal no-order strategy coverage (#299)

* feat: verify universal no-order strategy coverage

Co-Authored-By: Codex <noreply@openai.com>

* fix: preserve legacy paper request boundaries

Co-Authored-By: Codex <noreply@openai.com>

---------

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/manual-strategy-switch.yml

@@ -23,12 +23,13 @@ on:
         required: true
         type: string
       execution_mode:
-        description: "live writes live mode; paper sets dry_run_only=true and execution_mode=paper."
+        description: "live is gated; dry_run is the universal no-order path. paper is retained only as a legacy alias for dry_run, not P4 paper trading."
         required: true
         type: choice
         default: live
         options:
           - live
+          - dry_run
           - paper
       variable_scope:
         description: "Where GitHub variables are written. blank = platform default."

README.md

@@ -102,6 +102,7 @@ Notes:
 - LongBridge, IBKR, Schwab, and Firstrade `service_targets_mode=auto` checks the target repository's multi-service inventory, so even preview mode requires `RUNTIME_SETTINGS_GH_TOKEN`.
 - Binance runs through an Oracle Cloud VPS self-hosted runner. Repository variable writes are consumed by the next externally scheduled `main.yml` dispatch; the central switch does not dispatch that runtime workflow because it may execute live trading. A strategy cadence change also requires a separate review of the external VPS scheduler.
 - QMT remains dry-run only and has no live deployment configuration. Its generated target can stage repository variables, but `trigger_platform_sync=true` is rejected.
+- Every strategy must retain a domain-matched, no-order `dry_run` route. The health report verifies this coverage; it is not P4 paper trading. See [Universal Dry-run Coverage V1](docs/qsl_universal_dry_run_coverage_v1.zh-CN.md).
 - `plugin_mode=none` is the safe default. `auto` remains only as a compatibility alias for `none`; strategy names must not auto-mount a `latest_signal.json` artifact. Legacy `custom` mounts are disabled and cannot bypass P1/P2/P3 binding through the manual form. A future runtime plugin must be referenced by the frozen P2 candidate and recomputable in P3; see the [Strategy Plugin Contract V2](docs/qsl_strategy_plugin_contract_v2.zh-CN.md).
 - The workflow is bound to the `runtime-strategy-switch` GitHub Environment. For a personal system, required reviewers are optional; prefer storing `RUNTIME_SETTINGS_GH_TOKEN` as an Environment secret and rely on preview, confirmation text, and a least-privilege token for day-to-day safety.
 - Follow the simplified permission-control plan before enabling real switches: [docs/manual_strategy_switch_permission_control.zh-CN.md](docs/manual_strategy_switch_permission_control.zh-CN.md).

README.zh-CN.md

@@ -88,6 +88,7 @@ confirm_apply=APPLY_AND_SYNC
 - LongBridge、IBKR、Schwab、Firstrade 的 `service_targets_mode=auto` 会检查目标仓库是否已有多服务清单，因此即使只做 preview 也需要 `RUNTIME_SETTINGS_GH_TOKEN`。
 - Binance 运行在 Oracle Cloud VPS 的 self-hosted runner。仓库变量会在外部调度器下一次触发 `main.yml` 时被读取；中控不会自动触发该运行 workflow，因为它可能直接执行实盘。切换到不同运行频率的策略时，还必须单独复核 VPS 外部调度器。
 - QMT 当前仅支持 dry-run，尚无实盘部署配置；可以生成目标并暂存仓库变量，但会拒绝 `trigger_platform_sync=true`。
+- 所有策略都必须有至少一条按策略域匹配的平台 `dry_run`（不下单）路径；该覆盖由健康报告持续校验。它不等同于 P4 paper 交易，详见[通用不下单演练覆盖 V1](docs/qsl_universal_dry_run_coverage_v1.zh-CN.md)。
 - 当前 `plugin_mode=none` 是安全默认值。`auto` 仅为兼容旧请求而保留，实际等同于 `none`；不得再按策略名称自动挂载 `latest_signal.json`。旧 `custom` mount 已禁用，不能借由手动表单绕过 P1/P2/P3 绑定。未来只有被冻结的 P2 候选明确引用、并可在 P3 复算的插件 artifact 才能接入运行时，详见[策略插件契约 V2](docs/qsl_strategy_plugin_contract_v2.zh-CN.md)。
 - workflow 绑定 GitHub Environment `runtime-strategy-switch`。个人系统默认不需要 required reviewers；建议把 `RUNTIME_SETTINGS_GH_TOKEN` 配成这个 Environment 的 secret，真实写入靠 preview、确认词和 token 最小权限控制。
 - 启用真实切换前请按 [手动策略切换权限控制方案](docs/manual_strategy_switch_permission_control.zh-CN.md) 完成最简 secret、token 权限和回滚准备。

docs/manual_strategy_switch_permission_control.zh-CN.md

@@ -61,6 +61,8 @@
 
 这就是个人模式下的一键切换。不需要找 Codex，也不需要人工审批。
 
+`dry_run` 是所有平台共用的“不下单演练”选项。它不等同于 P4 paper 账户，也不会启用订单或实盘资格；`paper` 仅为旧调用兼容，会按 `dry_run` 处理。每个策略必须保持至少一条按市场域匹配的平台 `dry_run` 路线，健康报告会在配置漂移时失败。
+
 ## 保留的安全门
 
 这些防线不会增加太多操作成本，但能挡住常见误操作：

docs/qsl_universal_dry_run_coverage_v1.zh-CN.md

@@ -0,0 +1,59 @@
+# QSL 通用不下单演练覆盖 V1
+
+> 状态：已接入 `QuantRuntimeSettings` 配置校验、健康报告与策略切换控制台。
+
+## 要解决的问题
+
+策略档案原本可以声明 `allowed_execution_modes: ["dry_run"]`，但手动切换器会把该请求写成 `execution_mode=paper` 与 `dry_run_only=true`。这样虽然多数旧平台仍不会下单，却会在控制平面的策略许可校验中被误判为“策略不允许 paper”，使本该可用的安全演练路径无法使用。
+
+本规范把三件事分开：
+
+| 名称 | 当前含义 | 是否会下单 |
+| --- | --- | --- |
+| `dry_run` | 所有注册策略和平台必须提供的安全演练路径 | 否 |
+| 旧 `paper + dry_run_only=true` | 已有运行目标的兼容表示；按策略政策等价于 `dry_run` | 否 |
+| P4 `PAPER_BROKER` | 独立 paper 账户、凭据、订单适配器、对账与签名 policy 的未来能力 | 仅在其独立接线后 |
+
+因此，控制台的“演练（不下单）”不是 P4，也不是实盘开关。它不会赋予 broker、订单、资金、P4/P5/P6 或自动晋级权限。
+
+## 通用契约
+
+`platform-config.json` 的每个平台 deployment 必须声明：
+
+```json
+{
+  "default_execution_mode": "live",
+  "supported_execution_modes": ["live", "dry_run"]
+}
+```
+
+其中 `supported_execution_modes` 是**当前控制面可安全提交的模式**，而不是券商产品或凭据能力表。P4 尚未接线，所以不得在这里声明 `paper`。未配置实盘的平台只能声明：
+
+```json
+{
+  "default_execution_mode": "dry_run",
+  "supported_execution_modes": ["dry_run"],
+  "dry_run_only": true
+}
+```
+
+每个策略的 `allowed_execution_modes` 必须包含 `dry_run`。健康报告同时检查策略域与平台支持域的交集：任何策略没有至少一条 `dry_run` 路径时，`strategy_platform_dry_run_coverage` 会以 critical failure 失败，自动修复流程只能修复配置/生成物，不能启用订单或提高生命周期。
+
+## 插件边界
+
+插件 mount 的 `expected_mode` 只能是 `dry_run`、`paper` 或 `shadow`，不得请求 `live`。这只是拒绝插件借配置获得实盘权限；它并不自动挂载插件。旧 custom mount 继续停用，未来插件仍必须由冻结的 P1/P2/P3 `strategy_plugin_signal.v2` 适配器绑定并可复算。
+
+## 操作与验证
+
+控制台和 `Manual Strategy Switch` 都提供 `dry_run`。选择它会写入 `dry_run_only=true`；为兼容现有平台同步适配器，当前生成的运行目标仍使用 `execution_mode=paper` 加 `dry_run_only=true` 这个不下单载荷，控制面一律把它按 `dry_run` 校验。`paper` workflow 输入只为旧调用兼容保留，且仍受策略原有 `paper` 许可约束；它不能绕过策略许可，也不能当作 P4 paper 交易使用。
+
+提交任何策略、平台或插件配置变更前后运行：
+
+```bash
+python3 python/scripts/build_config.py --check
+python3 python/scripts/runtime_settings.py validate
+python3 python/scripts/build_config.py --platform-health-report
+node tests/strategy_switch_worker_validation.mjs
+```
+
+完整 Python、生成物一致性、Worker 与安全检查由 GitHub-hosted CI 执行。通过这些检查只说明配置和不下单控制链完整；真实平台连通、数据质量、P4/P5 receipt 与 P6 实盘资格仍由各自独立的运行证据和策略门槛决定。

platform-config.json

@@ -155,8 +155,9 @@
         "default_execution_mode": "live"
       },
       "deployment": {
-        "default_execution_mode": "live",
-        "dry_run_only": false,
+      "default_execution_mode": "live",
+      "supported_execution_modes": ["live", "dry_run"],
+      "dry_run_only": false,
         "runtime_model": "cloud_run",
         "settings_activation": "cloud_run_sync_workflow",
         "live_configured": true,
@@ -197,8 +198,9 @@
         "default_execution_mode": "live"
       },
       "deployment": {
-        "default_execution_mode": "live",
-        "dry_run_only": false,
+      "default_execution_mode": "live",
+      "supported_execution_modes": ["live", "dry_run"],
+      "dry_run_only": false,
         "runtime_model": "cloud_run",
         "settings_activation": "cloud_run_sync_workflow",
         "live_configured": true,
@@ -237,8 +239,9 @@
         "default_execution_mode": "live"
       },
       "deployment": {
-        "default_execution_mode": "live",
-        "dry_run_only": false,
+      "default_execution_mode": "live",
+      "supported_execution_modes": ["live", "dry_run"],
+      "dry_run_only": false,
         "runtime_model": "cloud_run",
         "settings_activation": "cloud_run_sync_workflow",
         "live_configured": true,
@@ -277,8 +280,9 @@
         "default_execution_mode": "live"
       },
       "deployment": {
-        "default_execution_mode": "live",
-        "dry_run_only": false,
+      "default_execution_mode": "live",
+      "supported_execution_modes": ["live", "dry_run"],
+      "dry_run_only": false,
         "runtime_model": "cloud_run",
         "settings_activation": "cloud_run_sync_workflow",
         "live_configured": true,
@@ -316,8 +320,9 @@
         ]
       },
       "deployment": {
-        "default_execution_mode": "paper",
-        "dry_run_only": true,
+      "default_execution_mode": "dry_run",
+      "supported_execution_modes": ["dry_run"],
+      "dry_run_only": true,
         "runtime_model": "not_configured",
         "settings_activation": "not_wired",
         "live_configured": false,
@@ -355,8 +360,9 @@
         ]
       },
       "deployment": {
-        "default_execution_mode": "live",
-        "dry_run_only": false,
+      "default_execution_mode": "live",
+      "supported_execution_modes": ["live", "dry_run"],
+      "dry_run_only": false,
         "runtime_model": "oracle_vps_self_hosted",
         "settings_activation": "next_runtime_workflow_dispatch",
         "live_configured": true,

python/scripts/build_config.py

@@ -42,6 +42,10 @@
 MARKET_FIELDS = {"market", "market_calendar", "market_timezone"}
 FEATURE_SNAPSHOT_FIELDS = {"required", "path", "manifest_path"}
 RUNTIME_MODELS = {"cloud_run", "oracle_vps_self_hosted", "not_configured"}
+EXECUTION_MODES = {"live", "paper", "dry_run"}
+# ``paper`` remains a future P4 capability. The executable non-live path is
+# the no-order ``dry_run`` route declared by every registered platform.
+CONTROL_EXECUTION_MODES = {"live", "dry_run"}
 SETTINGS_ACTIVATION_MODES = {
     "cloud_run_sync_workflow",
     "next_runtime_workflow_dispatch",
@@ -137,6 +141,34 @@ def validate(config: dict) -> list[str]:
             )
         if not isinstance(deployment.get("live_configured"), bool):
             errors.append(f"platform {pid}: live_configured must be boolean")
+        supported_execution_modes = deployment.get("supported_execution_modes")
+        if not isinstance(supported_execution_modes, list) or not supported_execution_modes:
+            errors.append(f"platform {pid}: supported_execution_modes must be a non-empty list")
+            supported_execution_modes = []
+        elif any(
+            not isinstance(mode, str) or mode not in CONTROL_EXECUTION_MODES
+            for mode in supported_execution_modes
+        ):
+            errors.append(
+                f"platform {pid}: supported_execution_modes must only contain "
+                f"{sorted(CONTROL_EXECUTION_MODES)}"
+            )
+        elif len(set(supported_execution_modes)) != len(supported_execution_modes):
+            errors.append(f"platform {pid}: supported_execution_modes must not contain duplicates")
+        default_execution_mode = deployment.get("default_execution_mode")
+        if default_execution_mode not in EXECUTION_MODES:
+            errors.append(f"platform {pid}: unsupported default_execution_mode {default_execution_mode!r}")
+        elif default_execution_mode not in supported_execution_modes:
+            errors.append(
+                f"platform {pid}: default_execution_mode {default_execution_mode!r} "
+                "must be listed in supported_execution_modes"
+            )
+        if deployment.get("live_configured") is False and "live" in supported_execution_modes:
+            errors.append(f"platform {pid}: live_configured false cannot advertise live execution")
+        if deployment.get("dry_run_only") is True and supported_execution_modes != ["dry_run"]:
+            errors.append(
+                f"platform {pid}: dry_run_only true requires supported_execution_modes ['dry_run']"
+            )
         if settings_activation == "cloud_run_sync_workflow" and runtime_model != "cloud_run":
             errors.append(
                 f"platform {pid}: settings_activation {settings_activation!r} "
@@ -230,6 +262,17 @@ def validate(config: dict) -> list[str]:
                     f"strategy {sid}: scheduler timezone {scheduler_timezone!r} "
                     f"must match market_timezone {market_timezone!r}"
                 )
+        allowed_execution_modes = _normalize_allowed_execution_modes(sdata.get("allowed_execution_modes"))
+        if not allowed_execution_modes:
+            errors.append(f"strategy {sid}: allowed_execution_modes must be a non-empty list")
+        elif any(mode not in EXECUTION_MODES for mode in allowed_execution_modes):
+            errors.append(
+                f"strategy {sid}: allowed_execution_modes must only contain {sorted(EXECUTION_MODES)}"
+            )
+        elif "dry_run" not in allowed_execution_modes:
+            errors.append(
+                f"strategy {sid}: allowed_execution_modes must include dry_run for the universal no-order path"
+            )
         plugin_overrides = sdata.get("scheduler_profile_by_plugin", {})
         if not isinstance(plugin_overrides, dict):
             errors.append(f"strategy {sid}: scheduler_profile_by_plugin must be an object")
@@ -310,6 +353,63 @@ def validate(config: dict) -> list[str]:
     return errors
 
 
+def build_strategy_platform_dry_run_coverage(config: dict | None = None) -> dict[str, object]:
+    """Report whether every strategy has at least one no-order platform route.
+
+    This is a control-plane coverage proof, not a claim that P4 paper, P5
+    shadow, broker credentials, or a scheduler is active. A route exists only
+    when the strategy domain and both sides' ``dry_run`` declarations agree.
+    """
+    config = config if config is not None else load_config()
+    platforms = config.get("platforms", {})
+    strategies = config.get("strategies", {})
+    rows: list[dict[str, object]] = []
+    uncovered_profiles: list[str] = []
+    route_count = 0
+
+    for profile, strategy in sorted(strategies.items()):
+        if not isinstance(strategy, dict):
+            uncovered_profiles.append(str(profile))
+            continue
+        domain = str(strategy.get("domain") or "")
+        strategy_modes = _normalize_allowed_execution_modes(strategy.get("allowed_execution_modes"))
+        safe_platforms: list[str] = []
+        for platform_id, platform in sorted(platforms.items()):
+            if not isinstance(platform, dict) or domain not in platform.get("supported_domains", []):
+                continue
+            deployment = platform.get("deployment")
+            platform_modes = (
+                deployment.get("supported_execution_modes", [])
+                if isinstance(deployment, dict)
+                else []
+            )
+            if "dry_run" in strategy_modes and "dry_run" in platform_modes:
+                safe_platforms.append(str(platform_id))
+        route_count += len(safe_platforms)
+        if not safe_platforms:
+            uncovered_profiles.append(str(profile))
+        rows.append(
+            {
+                "profile": str(profile),
+                "domain": domain,
+                "dry_run_platforms": safe_platforms,
+            }
+        )
+
+    return {
+        "schema_version": "strategy_platform_dry_run_coverage.v1",
+        "summary": {
+            "strategy_count": len(rows),
+            "covered_strategy_count": len(rows) - len(uncovered_profiles),
+            "uncovered_strategy_count": len(uncovered_profiles),
+            "dry_run_route_count": route_count,
+        },
+        "uncovered_profiles": uncovered_profiles,
+        "profiles": rows,
+        "boundary": "No-order dry_run coverage only; it does not assert P4/P5/P6 runtime authority.",
+    }
+
+
 def validate_notification_references(config: dict, errors: list[str]) -> None:
     """Keep every Telegram notification route in runtime configuration."""
     notifications = config.get("notifications")
@@ -568,6 +668,7 @@ def build_platform_health_report(
     catalog = _strategy_catalog_by_profile(strategy_catalog)
     config_errors = validate(config)
     derivation_errors = report_strategy_profile_derivation_drift(config, catalog)
+    dry_run_coverage = build_strategy_platform_dry_run_coverage(config)
     live_candidate_queue = build_live_candidate_queue(catalog)
     automation_registry = build_strategy_automation_registry(config)
     runtime_enabled_profiles = [
@@ -588,6 +689,19 @@ def build_platform_health_report(
             "severity": "critical",
             "messages": derivation_errors,
         },
+        {
+            "name": "strategy_platform_dry_run_coverage",
+            "status": "fail" if dry_run_coverage["uncovered_profiles"] else "pass",
+            "severity": "critical",
+            "messages": (
+                [
+                    "no configured no-order platform route for: "
+                    + ", ".join(dry_run_coverage["uncovered_profiles"])
+                ]
+                if dry_run_coverage["uncovered_profiles"]
+                else []
+            ),
+        },
         {
             "name": "live_candidate_queue",
             "status": "warn" if live_candidate_queue else "pass",
@@ -619,9 +733,13 @@ def build_platform_health_report(
             "strategy_profile_count": len(catalog),
             "runtime_enabled_switchable_count": len(runtime_enabled_profiles),
             "live_candidate_queue_count": len(live_candidate_queue),
+            "dry_run_covered_strategy_count": dry_run_coverage["summary"]["covered_strategy_count"],
+            "dry_run_uncovered_strategy_count": dry_run_coverage["summary"]["uncovered_strategy_count"],
+            "dry_run_route_count": dry_run_coverage["summary"]["dry_run_route_count"],
             "automation_lane_counts": automation_registry["summary"]["lane_counts"],
         },
         "live_candidate_queue": live_candidate_queue,
+        "strategy_platform_dry_run_coverage": dry_run_coverage,
         "automation_registry": automation_registry,
         "codex_repair_context": {
             "safe_to_attempt": bool(failed_checks),

python/scripts/build_platform_config.py

@@ -50,6 +50,7 @@ def build_config_module(config: dict) -> str:
             "income_layer": caps.get("income_layer", False),
             "option_overlay": caps.get("option_overlay", False),
             "dca": caps.get("dca", False),
+            "supported_execution_modes": depl.get("supported_execution_modes", []),
             "execution_mode": depl.get("default_execution_mode", "live"),
             "service_name": depl.get("service_name", ""),
             "default_execution_mode": depl.get("default_execution_mode", "live"),