Add verified Windows and Linux x86-64 demo paths

.gitattributes

@@ -2,6 +2,7 @@
 
 *.py text eol=lf
 *.ps1 text eol=lf
+*.sh text eol=lf
 *.md text eol=lf
 *.toml text eol=lf
 *.yml text eol=lf

.github/workflows/ci.yml

@@ -9,6 +9,36 @@ permissions:
   contents: read
 
 jobs:
+  linux-x86-demo:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: requirements.linux.lock
+
+      - name: Install locked dependencies
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.linux.lock
+          python -m pip check
+
+      - name: Run Linux x86-64 offline demo
+        shell: bash
+        run: |
+          test "$(uname -m)" = "x86_64"
+          bash -n scripts/portfolio_demo.sh
+          PYTHON_PATH="$(command -v python)" bash scripts/portfolio_demo.sh --output-dir artifacts/ci_linux_x86_demo
+          test ! -e handoff.md
+          test -f docs/internal/handoff.md
+
   offline-evaluation:
     runs-on: windows-latest
     timeout-minutes: 20

README.en.md

@@ -0,0 +1,105 @@
+# ResearchOps Agent
+
+[中文](README.md) · **English**
+
+[![offline-quality-gate](https://github.com/cedRiC874/researchops-agent/actions/workflows/ci.yml/badge.svg)](https://github.com/cedRiC874/researchops-agent/actions/workflows/ci.yml)
+![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)
+
+_CI signal: Ubuntu x86-64 installs locked dependencies and runs the complete Linux x86-64 offline demo; the Windows offline gate runs the complete unit/integration suite and rebuilds and verifies the frozen 50-task evidence._
+
+**Let an LLM analyze research data without letting it invent the numbers:** ResearchOps Agent delegates planning to the model, deterministic data-quality and statistical work to controlled tools, and binds every reported claim to reviewable evidence and approval boundaries.
+
+![Aggregate ANCOVA and Welch effects](artifacts/phase3/effect_estimates.png)
+
+_Thirty-second result: provide a de-identified CSV, a research question and an explicit study design; receive an aggregate analysis with sample flow, effect estimates, confidence intervals, evidence IDs and limitations._
+
+The model never sees real filesystem paths and cannot freely run Python, SQL or shell commands. It can only call allowlisted logical tools; deterministic local implementations produce the statistics and append them to the audit chain.
+
+> This is a research prototype and portfolio project, not a clinical decision tool or a production-validated product.
+
+## A concrete result: baseline-adjusted treatment effect
+
+Example question: in a fully synthetic 240-row randomized trial, do follow-up systolic blood-pressure values differ between treatment and control, after accounting for baseline pressure?
+
+| Method | treatment − control | 95% CI | p-value | Analysis n | Evidence ID |
+| --- | ---: | ---: | ---: | ---: | --- |
+| ANCOVA, baseline-adjusted, HC3 | -5.6069 mmHg | [-7.9351, -3.2787] | 3.82e-6 | 212 | `E-7C87BB6C88EB` |
+| Welch, unadjusted sensitivity analysis | -6.7887 mmHg | [-10.8425, -2.7349] | 0.001134 | 212 | `E-B93CD9DC7751` |
+
+Negative values mean lower follow-up pressure in the treatment group. The report may use benefit language only when the study design pre-specifies `beneficial_direction=lower`.
+
+> **Professional boundary:** the requested population is intention-to-treat, but 28 missing follow-up outcomes leave 212 available cases in the realized analysis. The system therefore records `requested_population=intention_to_treat` and `realized_population=available_case`, and refuses to describe this result as a complete ITT analysis.
+
+Reviewable artifacts: [analysis bundle](artifacts/phase3/analysis_bundle.json) · [aggregate chart](artifacts/phase3/effect_estimates.png)
+
+## Quickstart
+
+The strict frozen-evidence demo currently supports Python 3.11+ on Windows x86-64 and Linux x86-64 with NumPy/OpenBLAS. macOS and ARM do not yet have a comparable numerical baseline and are outside this strict demo's supported scope.
+
+To avoid treating cross-OS floating-point differences as the same evidence, the canonical ANCOVA identity is pinned separately to Windows x86-64 `E-36034128278C` and Linux x86-64 `E-14EBFFCA843E`.
+
+### Windows x86-64 / PowerShell
+
+```powershell
+python -m venv .venv
+.\.venv\Scripts\python.exe -m pip install -r requirements.lock
+powershell -ExecutionPolicy Bypass -File .\scripts\portfolio_demo.ps1
+```
+
+### Linux x86-64
+
+```bash
+python3 -m venv .venv
+./.venv/bin/python -m pip install -r requirements.linux.lock
+bash ./scripts/portfolio_demo.sh
+```
+
+The Linux lock keeps the same package versions as the Windows lock while excluding the Windows-only `pywin32`. The Linux demo uses the separately frozen `evals/tasks.linux-x86_64.jsonl`, which rebinds only cross-OS evidence/chart IDs without relaxing numerical or quality thresholds. CI installs this lock and runs the complete demo.
+
+The demo rebuilds the frozen 50-task deterministic evaluation, verifies all 50 event hash chains, checks sensitive-data canaries, and writes to a new artifact directory. It never invokes an online Provider and never overwrites an existing artifact.
+
+## Architecture
+
+```mermaid
+flowchart LR
+    I["Research question + de-identified CSV + explicit design"]
+    A["Agent planning"]
+    R["Logical resource registry"]
+    Q["Data quality + method selection"]
+    S["Deterministic statistics"]
+    E["Evidence bundle + chart + report"]
+    P["Central risk policy"]
+    H["Human approval"]
+    X["Controlled executor"]
+    L["SQLite audit + SHA-256 chain"]
+    V["Phase 5 / Phase 6 evaluators"]
+
+    I --> R --> Q --> S --> E
+    R --> A
+    A -->|"logical IDs only"| P
+    P -->|"read-only allow"| X
+    P -->|"controlled write"| H --> X
+    X --> Q
+    X --> E
+    X --> L
+    H --> L
+    Q --> V
+    S --> V
+    E --> V
+    A --> V
+```
+
+Key boundaries:
+
+- The study design must be explicit; the system does not infer randomization, causality, pairing or covariate timing from column names.
+- Method recommendations and execution bind to the dataset SHA-256 and fail safely if the input changes.
+- Every report claim must match the current tool output's `evidence_id + metric_path + displayed_value + direction`.
+- Unknown tools, unknown risk, unauthorized resources and unapproved writes are denied by default.
+
+See [ARCHITECTURE.md](docs/ARCHITECTURE.md) for the detailed design.
+
+For current online/offline validation, failure denominators, Provider history, candidate commitments and strict claim boundaries, see **[STATUS.md](STATUS.md)**.
+
+## License
+
+[MIT](LICENSE)

README.md

@@ -1,5 +1,12 @@
 # ResearchOps Agent
 
+**中文** · [English](README.en.md)
+
+[![offline-quality-gate](https://github.com/cedRiC874/researchops-agent/actions/workflows/ci.yml/badge.svg)](https://github.com/cedRiC874/researchops-agent/actions/workflows/ci.yml)
+![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)
+
+_CI 信号：Ubuntu x86-64 安装锁定依赖并运行完整 Linux x86-64 离线演示；Windows 离线质量门运行完整单元/集成套件，并重建与验证固定 50 题 evidence。_
+
 **让 LLM 做科研数据分析，但不让它编数字：** ResearchOps Agent 让模型负责规划，让确定性工具负责数据质量、方法选择、统计计算与可视化，并把每条结论绑定到可复核 evidence 与人工审批边界。
 
 ![ANCOVA 与 Welch 聚合效应图](artifacts/phase3/effect_estimates.png)
@@ -27,14 +34,28 @@ _30 秒演示结果：输入脱敏 CSV、研究问题和显式研究设计，输
 
 ## Quickstart
 
-Windows PowerShell，三行运行无网络、无 API Key 的完整离线演示：
+严格 frozen-evidence 演示当前支持 Python 3.11+ 的 Windows x86-64 和 Linux x86-64（NumPy/OpenBLAS）。macOS 与 ARM 尚未建立可比较的数值基线，因此不在这一严格演示的支持范围内。
+
+为避免把跨操作系统的浮点位差异误当成同一证据，canonical ANCOVA identity 分别固定为 Windows x86-64 `E-36034128278C` 与 Linux x86-64 `E-14EBFFCA843E`。
+
+### Windows x86-64 / PowerShell
 
 ```powershell
 python -m venv .venv
 .\.venv\Scripts\python.exe -m pip install -r requirements.lock
 powershell -ExecutionPolicy Bypass -File .\scripts\portfolio_demo.ps1
 ```
 
+### Linux x86-64
+
+```bash
+python3 -m venv .venv
+./.venv/bin/python -m pip install -r requirements.linux.lock
+bash ./scripts/portfolio_demo.sh
+```
+
+Linux 锁文件与 Windows 锁文件保持同一组版本，仅排除 Windows 专用的 `pywin32`；Linux demo 使用独立冻结的 `evals/tasks.linux-x86_64.jsonl`，只重绑定跨操作系统变化的 evidence/chart IDs，不放宽数值或质量阈值。CI 会安装该锁文件并执行完整 demo。
+
 演示会重建固定 50 题确定性评测、验证 50 条事件哈希链、检查敏感信息 canary，并把结果写入一个新的 artifact 目录。它不会运行在线 Provider，也不会覆盖已有产物。
 
 ## 架构

docs/internal/README.md

@@ -0,0 +1,12 @@
+# Internal project notes
+
+This directory contains historical operator and session-handoff notes. These
+files are useful for repository maintenance, but they are not product
+documentation, current evidence, or a source of runtime instructions.
+
+- [handoff.md](handoff.md) is a dated historical snapshot and may reference
+  superseded branches, commits, candidates or CI runs.
+- Current public status and claim boundaries live in [STATUS.md](../../STATUS.md).
+- Current contributor-facing design documentation lives under [docs](../).
+
+No API key or credential value should ever be added to this directory.