Repository navigation
rpb: autonomous M1-M9 loop on trade-backtest - #2
Merged
Merged
Conversation
added 12 commits
August 30, 2026 22:41
Bootstrap plan for 4-wave / 9-milestone autonomous run: - W1: PLAN.md (this), qa test runner, devops CI - W2: backend vercel.json fix, backend input validation, security audit - W3: frontend a11y/CSP, docs README/CHANGELOG/AGENTS - W4: orchestrator final reports Includes AGENTS.md auto-bootstrap from repo-builder context layer (will be replaced by M8 with real content).
signal-monitor.js module.exports expanded to expose calculateMA, calculateRSI, calculateMACD for testability (additive only, no behavior change). Co-reviewed per PLAN.md risk R2. Test runner: tests/run.js (stdlib assert, zero deps, ~50 LOC) Tests: tests/signal-monitor.test.js (5 cases: MA, RSI, MACD, goldenCross, deathCross)
Runs node --check (4 JS files) + node tests/run.js on push to master, feat/**, fix/**, chore/**, docs/**, test/** and on pull_request against master. ubuntu-latest, Node 20. Actions pinned by SHA (40-char), resolved via: git ls-remote https://github.com/actions/checkout refs/heads/main git ls-remote https://github.com/actions/setup-node refs/heads/main at workflow-creation time: - actions/checkout@f548e57 - actions/setup-node@94196ee Cache exception: setup-node cache parameter intentionally omitted because the repo has no package.json / lockfile (cache: 'npm' would fail). Documented in workflow header comment. No secrets, no deploy steps.
vercel.json referenced src: 'SPEC.md' but the actual SPEC lives at PRD/SPEC.md. This would cause the Vercel deploy to 404 on the SPEC static asset. Re-pointed the build entry to the real path. No other changes to vercel.json (routes and @vercel/* settings preserved). Note: M4 was executed by parent driver rather than backend subagent because two consecutive subagent runs crashed mid-reasoning on this trivial 5-LOC fix (likely harness flakiness with very small subagent prompts). Documented in loop/lessons.md for follow-up.
…l; drop node-fetch api/klines.js: new validateSymbol() rejects non-alphanumeric, > 20 chars, path-traversal (../, /), and SSRF probes (://). interval now validated against whitelist ['1m','5m','15m','1h','4h','1d','1w']. 400 responses on invalid input; happy-path payload schema unchanged. api/fundamental.js: removed broken 'const fetch = require(node-fetch)' (no package.json in repo, would throw at runtime). Now uses Node 18+ global fetch. Added same validateSymbol() guard. Requires Node 18+ runtime — added to FOLLOWUP.md. No changes to signal-monitor.js (M2 export expansion verified intact). Existing happy-path payload shapes preserved; M6 security audit owns CORS posture. Note: M5 was executed by parent driver rather than backend subagent because the backend subagent crashed during infrastructure bring-up (see M4 lesson). The diff is exactly per PLAN.md spec; independent verify all green.
Audit-only deliverable per PLAN.md M6 scope. 8 findings total: - 2 medium: F1 Telegram HTML parse_mode without escape; F2 CORS wildcard - 3 low: F3 no rate-limit; F4 env-var-at-init; F5 UA spoofing - 3 informational: F6 node-fetch (resolved M5); F7 vercel.json SPEC path (resolved M4); F8 .gitignore OK No leaked secrets, no XSS sinks reachable from untrusted input in current code paths. All recommended fixes deferred to owners per PLAN.md scope discipline; tracked in FOLLOWUP.md (M9) for prioritized follow-up. Note: M6 executed by parent driver rather than security subagent (subagent infrastructure flakiness — see loop/lessons.md).
Adds a CSP meta tag to <head> with these directives:
- default-src 'self'
- script-src 'self' 'unsafe-inline' unpkg cdn.jsdelivr.net (for
lightweight-charts + qrcode CDN bundles)
- style-src 'self' 'unsafe-inline' fonts.googleapis.com
- font-src 'self' fonts.gstatic.com
- img-src 'self' data: https:
- connect-src 'self' api.binance.com query{1,2}.finance.yahoo.com
api.coingecko.com (data sources used by /api/klines and /api/fundamental)
- frame-ancestors 'none'; base-uri 'self'; form-action 'self'
'unsafe-inline' on script-src is required because the page renders
onclick= handlers via innerHTML (e.g. modal close, share buttons).
Long-term: refactor to addEventListener and drop 'unsafe-inline'.
Tracked in FOLLOWUP.md.
Sub-tasks verified as already-done (no edits needed):
- <html lang="zh-Hant"> already present (lang=zh-TW).
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
already correct.
- No icon-only buttons in current markup (grep returned 0 candidates).
Also adds scripts/verify.py to satisfy the repo-builder pre-commit
hook for HTML/script changes. The script runs the project's two
verify gates (node --check + node tests/run.js), stdlib-only, so it
runs on any host without pip install.
Replaces the auto-bootstrap AGENTS.md skeleton with real project guidance per PLAN.md M8 spec. All three docs are aligned with the post-M1..M7 state of the repo. - README.md: quickstart, repository layout, verify steps, API reference, build/deploy notes, link-outs to SPEC, SECURITY_FINDINGS, PLAN. - CHANGELOG.md: per-milestone entries under [Unreleased]; v2.2.1-spec baseline entry from the existing PRD rewrite. - AGENTS.md: real 目標 / 避免 / 技術棧 sections in 繁體中文, matches the constraints discovered during the loop (no package.json, no SPEC §1-§9 edits, rpb(<owner>): commit prefix, SHA-pinned CI, verify gate at node --check + node tests/run.js). Note: M8 executed by parent driver rather than docs subagent (subagent infrastructure flakiness on this repo — see loop/lessons.md). All relative file references in the docs were independently verified to exist at repo root.
…ms, lessons, FOLLOWUP
Settles the autonomous development loop on trade-backtest. M9 produces
only documentation artifacts; no code changes, no push, no SPEC edits.
Deliverables (per PLAN.md M9 scope):
- BUILD_REPORT.md: per-milestone summary table, wave summary, verify
command list, files-added table, git state, followup/lessons cross-refs.
- FOLLOWUP.md: prioritized backlog P0..P5 with named owner + effort per
item. Traces back to SECURITY_FINDINGS.md (F1-F8) and loop/lessons.md
(L1-L5) plus gaps discovered during this run.
- loop/lessons.md: 5 actionable lessons. L1 (subagent flakiness) and L3
(pre-commit hook expects scripts/verify.py) are repo-builder-specific
improvements; L2/L4/L5 are general engineering wisdom.
- loop/reflection/wave-{1,2,3,4}-post-mortem.md: per-wave observations
on what went well, what was rough, process improvements, stats.
State: all 9 milestones done, 0 blocked, 1 retry used (M2). 13 commits
on feat/autonomous-run. Working tree clean post-commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR delivers
12 commits on
feat/autonomous-runproduced by an autonomous M1–M9 development loop. 9 milestones, 4 waves, 1 retry used (M2 first-attempt subagent crash), 0 blocked.Per-milestone summary
PLAN.md(4 waves / 9 milestones)tests/run.js+tests/signal-monitor.test.js(5 cases, stdlib assert, no npm).github/workflows/ci.yml(SHA-pinned actions)vercel.jsonSPEC.md → PRD/SPEC.md path fixvalidateSymbol()+ interval whitelist on both APIs; removed brokennode-fetchrequireSECURITY_FINDINGS.md(2 medium, 3 low, 3 informational)index.htmlREADME.md+CHANGELOG.md+ realAGENTS.mdBUILD_REPORT.md+FOLLOWUP.md+ 4 wave post-mortems +loop/lessons.mdNotable bug fixes
vercel.jsonreferencedsrc: "SPEC.md"(404 on deploy) → re-pointed toPRD/SPEC.md.api/fundamental.jsdidrequire('node-fetch')with nopackage.json(would throw at runtime) → switched to Node 18+ globalfetch.New artifacts
tests/run.js,tests/signal-monitor.test.js— 5 smoke tests.github/workflows/ci.yml— SHA-pinned CIscripts/verify.py— pre-commit verify gate (project-level)SECURITY_FINDINGS.md— 8 findingsREADME.md,CHANGELOG.md,BUILD_REPORT.md,FOLLOWUP.mdloop/lessons.md,loop/reflection/wave-{1..4}-post-mortem.mdDeferred (see
FOLLOWUP.md)P0 security: F1 Telegram HTML parse_mode without escape · F2 CORS wildcard.
P1 runtime: R1
api/fundamental.jsrequires Node 18+; R2 Wilder RSI plateau is99.0099..., not literal100.P2 perf: F3 no rate-limiting on
/api/*; F4 env-var-at-config-init.P3 frontend: drop
'unsafe-inline'from CSP onceonclick=handlers refactor toaddEventListener.Hard rules honored
rpb(<owner>):prefixPRD/SPEC.md§1–§9 core scopepackage.json/ npm install@v4/@maingit pushtomaster(PR is the gate)Verification status
node --check lightweight-charts.4.1.0.js signal-monitor.js api/klines.js api/fundamental.js→ exit 0node tests/run.js→ 5 passed, 0 failedpython3 scripts/verify.py→ result=PASSFull details
See
BUILD_REPORT.mdin this branch for the complete per-milestone table, file diff summary, and stats.