aether-quant 5.4.8__tar.gz → 6.6.4__tar.gz

aether_quant-6.6.4/.devcontainer/README.md

@@ -0,0 +1,6 @@
+# .devcontainer
+
+Codespaces and Dev Container definitions. See [`development/infrastructure.md`](../development/infrastructure.md).
+
+- **`devcontainer.json`:** the training Codespace. Python 3.11 with sshd, CPU PyTorch and both requirements files. Create it on 4 cores / 16 GB (`-m standardLinux32gb`), with `--devcontainer-path .devcontainer/devcontainer.json`, because the repo has two definitions.
+- **`dind-v1-test/`:** Lean backtests in a temporary 4-core Codespace. Pinned to `python:3.11-bookworm` (the Docker-in-Docker feature doesn't support Debian trixie). Move Docker's data root to the large local disk before building the 20 GB image: `/etc/docker/daemon.json` with `{"data-root": "/tmp/docker-data", "dns": ["168.63.129.16"]}`, then restart `dockerd`.

aether_quant-6.6.4/.devcontainer/dind-v1-test/devcontainer.json

@@ -0,0 +1,14 @@
+{
+    "name": "Aether Quant DinD v1 Test",
+    "image": "mcr.microsoft.com/devcontainers/python:3.11-bookworm",
+    "features": {
+        "ghcr.io/devcontainers/features/sshd:1": {
+            "version": "latest"
+        },
+        "ghcr.io/devcontainers/features/docker-in-docker:2": {}
+    },
+    "hostRequirements": {
+        "cpus": 4,
+        "memory": "16gb"
+    }
+}

aether_quant-6.6.4/.dockerignore

@@ -0,0 +1,55 @@
+__pycache__/
+*.pyc
+*.pyo
+.venv/
+node_modules/
+webui/node_modules/
+webui/dist/
+backtests/
+.lean/
+.git/
+.av/
+.claude/
+Aether-quant-Obsidian-Vault/
+# Large data directories not needed by the FastAPI server
+data/
+ml/
+storage/
+
+# Local secrets and broker/API credentials - mirrors .gitignore's own list.
+# Being .gitignore'd does NOT keep a file out of the image: the engine build
+# does `COPY . .`, and that same image is published to ghcr (single fat
+# target, no slim variant), so anything not excluded here is baked into a
+# public registry layer - recoverable via `docker history`/`docker save` even
+# if a later commit removes it. lean.live.json is the rendered, secret-bearing
+# config `aq render-lean-config` produces (execution/lean_config_render.py);
+# lean.json itself is git-tracked with empty placeholders but is excluded too,
+# so a locally-populated copy can never leak. Keep this list in sync with
+# .gitignore's "Local secrets" block.
+.env
+.env.*
+!.env.compose.example
+!.env.live.example
+ib_config.py
+*_config.local.py
+config.local.json
+lean.local.json
+lean.live.json
+lean.json
+*.key
+*.pem
+
+# cpp_inference_ext/'s compiled build artifacts - mirrors .gitignore's own
+# exclusion list. Docker now builds this extension fresh for the
+# container's own Python 3.11 (see Dockerfile) - a locally-pre-built
+# stray .pyd/.so from a developer's own (ABI-incompatible) host Python
+# must never leak into the build context and get baked into the image,
+# which is published to a public ghcr registry.
+cpp_inference_ext/build/
+cpp_inference_ext/*.egg-info/
+cpp_inference_ext/*.pyd
+cpp_inference_ext/*.so
+cpp_inference_ext/install_log*.txt
+data_pre2013/
+data_wide/
+data_crypto_wide/

aether_quant-6.6.4/.gitattributes

@@ -0,0 +1,5 @@
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# Shell scripts run on Linux Codespaces: always LF in the working tree.
+*.sh text eol=lf

aether_quant-6.6.4/.githooks/README.md

@@ -0,0 +1,5 @@
+# .githooks
+
+Opt-in git hooks: `git config core.hooksPath .githooks`.
+
+- **`pre-commit`:** runs `aq secrets-check` and blocks a commit with a populated secret in `lean.json` or a tracked `.env`. See [`SECURITY.md`](../SECURITY.md).

aether_quant-6.6.4/.githooks/pre-commit

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Aether Quant pre-commit secret guard (Phase V2-22 security).
+#
+# Blocks a commit that would publish a secret: a populated secret field in the
+# tracked lean.json, or a tracked real `.env` file. All detection lives in
+# `aq secrets-check` (execution/secret_scan.py) - this hook just invokes it.
+#
+# Enable once per clone (opt-in, so it never surprises a fresh checkout):
+#     git config core.hooksPath .githooks
+#
+# Runs under git's POSIX sh (git-bash on Windows), so keep it portable.
+
+set -e
+
+repo_root=$(git rev-parse --show-toplevel)
+cd "$repo_root"
+
+# Prefer the installed `aq` console script; fall back to running the module
+# directly with whichever Python is on PATH (venv-activated shells get theirs).
+if command -v aq >/dev/null 2>&1; then
+    aq secrets-check
+elif command -v python >/dev/null 2>&1; then
+    python aq_cli.py secrets-check
+elif command -v python3 >/dev/null 2>&1; then
+    python3 aq_cli.py secrets-check
+else
+    echo "pre-commit: could not find 'aq' or 'python' to run secrets-check" >&2
+    exit 1
+fi
+
+# V6.6.4 - the library gate: a public function that no aether_quant facade exports blocks the commit (scripts/library_gate.py). It reads the source and imports nothing.
+if command -v python >/dev/null 2>&1; then
+    python scripts/library_gate.py
+elif command -v python3 >/dev/null 2>&1; then
+    python3 scripts/library_gate.py
+fi

aether_quant-6.6.4/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,36 @@
+---
+name: Bug report
+about: Something is broken, wrong, or behaves differently than documented.
+title: "[bug] "
+labels: ["bug"]
+---
+
+## What happened
+
+<!-- Lead with the observable failure. -->
+
+## Where
+
+<!-- File, module or command, e.g. `aq evaluate --rank-book`. -->
+
+## Expected vs actual
+
+- **Expected:**
+- **Actual:**
+
+## Reproduction
+
+```text
+<steps from a clean clone; `aq config get <key>` output helps>
+```
+
+## Evidence
+
+```text
+<smallest relevant output>
+```
+
+## Environment
+
+- OS, Python version, commit or tag:
+- [ ] I checked `development/Problems.md` for a known entry

aether_quant-6.6.4/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,23 @@
+---
+name: Feature request
+about: A new subsystem, module, CLI capability, or behavioral improvement.
+title: "[feature] "
+labels: ["enhancement"]
+---
+
+## Problem to solve
+
+<!-- The need, not the implementation. -->
+
+## Proposed behaviour
+
+<!-- New `aq` command or flag, config block, or output. -->
+
+## Fit
+
+- [ ] An unmodified `config.json` keeps today's behaviour.
+- [ ] Testable without Lean: pure logic in a package module, not `main.py`.
+
+## Alternatives considered
+
+<!-- What you ruled out, and why. -->

aether_quant-6.6.4/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+<!-- Title: `V<version> <what and why>` for release-bound PRs, otherwise plain and descriptive. -->
+
+## What and why
+
+<!-- One paragraph. Reference development/Problems.md entries (#N) where they apply. -->
+
+## Behaviour
+
+- [ ] Unchanged when new flags are absent, **or** the change is intentional and listed here:
+- New config keys and defaults: <!-- or "none" -->
+
+## Verification
+
+- [ ] `aq test` green (N passed), `ruff check .` clean, `aq verify --quick` green
+- [ ] A new public function or class is in `aether_quant`, or listed with a reason (`scripts/library_gate.py`)
+- [ ] A new invariant in a safety, admission or ledger path has a Lean spec, a differential test and a property test (`development/verification.md`)
+- [ ] `scripts/clean_checkout_test.ps1`, or `scripts/codespace_verify.ps1 -Start` on a low-memory PC
+- New tests: <!-- files, and what they pin -->
+- Manual checks: <!-- dry runs, real-data spot checks -->
+
+## Docs
+
+- [ ] README or package README
+- [ ] `development/Changelog.md`, and `development/Problems.md` if a bug was found
+- [ ] `development/architecture.md` or `infrastructure.md` if structure or services changed
+- [ ] `aq docs sync`, and the vault regenerated

aether_quant-6.6.4/.github/dependabot.yml

@@ -0,0 +1,21 @@
+# V5.5.0 - weekly dependency PRs, one ecosystem each. The CI jobs
+# (dependency-audit, webui npm audit) report advisories; this is what turns
+# an advisory into a reviewable bump. tests/test_ci_workflows.py pins the
+# three ecosystems so none can be dropped silently.
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/requirements"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "npm"
+    directory: "/webui"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

aether_quant-6.6.4/.github/workflows/ci.yml

@@ -0,0 +1,420 @@
+name: CI
+
+# V5.3.9 - deep CI suite: windows+ubuntu pytest matrix with a calibrated
+# coverage fail-under gate (82% measured - 2), ruff lint, the full webui
+# vitest suite, an offline CLI smoke battery, and workflow self-validation.
+# V5.5.0 - guard jobs for the offline/live-parity round: fast-guards,
+# subsystem-matrix, wheel-smoke, python-compat, docker-checks, parity-smoke,
+# secret-scan and test-count-drift. tests/test_ci_workflows.py pins them all.
+# V6.2.0 - Linux jobs pin ubuntu-24.04: ubuntu-latest moves to 26.04 from 2026-10-19
+# and setup-python's 3.11 builds for a new image can lag; the actions run on Node 24.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# V5.4.2 - cancel superseded runs on rapid-fire pushes (ported from Aether-Vault)
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  python-tests:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-latest]
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Syntax-check main.py (no Lean runtime available in CI - see development/Problems.md #69)
+        run: python -m py_compile main.py
+
+      - name: Install CPU-only PyTorch (Linux runner)
+        if: runner.os == 'Linux'
+        run: pip install torch --index-url https://download.pytorch.org/whl/cpu
+
+      - name: Install dependencies
+        run: |
+          pip install -r requirements/requirements.txt -r requirements/requirements-dev.txt
+          pip install pytest-cov
+
+      - name: Run full test suite with coverage gate
+        run: >
+          pytest -m "not lean_backtest" -ra
+          --cov --cov-report=term-missing --cov-report=xml
+          --cov-fail-under=80
+
+      - name: Upload coverage artifact
+        if: matrix.os == 'ubuntu-24.04'
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-xml
+          path: coverage.xml
+
+  python-lint:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements-dev.txt
+
+      # V5.3.11 FIX: bare `ruff check .` — NOT `aq test --ruff` (which
+      # requires importing aq_cli → pandas via the full package chain, but
+      # this job intentionally has a minimal environment). Local devs use
+      # `aq test --ruff`; CI uses bare ruff for speed.
+      # V5.4.7: ruff is PINNED - the previous unbounded range let new ruff
+      # releases add rules and break CI independently of any repo change.
+      - name: Install ruff
+        run: pip install "ruff==0.16.4"
+
+      - name: Ruff check (E/F ruleset calibrated in pyproject.toml)
+        run: ruff check .
+
+      - name: Syntax-check main.py
+        run: python -m py_compile main.py
+
+  dependency-audit:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements.txt
+
+      - name: Install pip-audit
+        run: pip install pip-audit
+
+      - name: Audit runtime dependencies for known CVEs
+        run: |
+          pip install -r requirements/requirements.txt
+          pip-audit --requirement requirements/requirements.txt --desc
+
+      - name: Audit dev dependencies for known CVEs
+        run: |
+          pip-audit --requirement requirements/requirements-dev.txt --desc
+
+  webui-tests:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: webui
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: webui/package-lock.json
+
+      - run: npm ci
+      - run: npx tsc -b
+      - run: npx oxlint
+      # V5.3.9 - the full frontend suite finally runs in CI too.
+      - run: npx vitest run --pool=threads
+      - run: npm run build
+      # V5.5.0 - advisory: a new upstream advisory must be visible without
+      # turning an unrelated PR red (the lockfile is the owner's to bump).
+      - name: npm audit (advisory, runtime deps, high+)
+        continue-on-error: true
+        run: npm audit --omit=dev --audit-level=high
+
+  cli-smoke:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements.txt
+
+      # V5.5.0 - the default Linux torch wheel drags in ~2 GB of CUDA libraries a
+      # CPU-only runner never uses. Installing the CPU build FIRST lets the
+      # requirements install below see torch as already satisfied.
+      - name: Install CPU-only PyTorch
+        run: pip install torch --index-url https://download.pytorch.org/whl/cpu
+
+      - name: Install package editable
+        run: |
+          pip install -r requirements/requirements.txt
+          pip install -e .
+
+      - name: CLI smoke battery (offline, deterministic)
+        run: |
+          aq --help > /dev/null
+          aq evaluate --help > /dev/null
+          aq config get phase1.universe.name
+          aq secrets-check
+
+  workflows-lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      # V5.3.10 - single-step pinned install + validate: the previous two-step
+      # pattern (PATH append, then bare `actionlint`) failed with
+      # "command not found" on the runner. Pinned to v1.7.7 for
+      # reproducibility (meta-tested in tests/test_ci_workflows.py).
+      - name: Validate workflow files (actionlint v1.7.7)
+        run: |
+          curl -sSL -o actionlint.tar.gz \
+            https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz
+          tar -xzf actionlint.tar.gz actionlint
+          ./actionlint -no-color -verbose
+
+  # V5.5.0 - the cheap, high-signal guards, in one place so a PR that breaks
+  # test registration, the README flag docs, a workflow, the packaging list,
+  # a docs link or a parity fix fails in minutes instead of after the whole
+  # coverage matrix. They also run inside python-tests; this is the fast copy.
+  fast-guards:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements-dev.txt
+
+      # V5.5.0 - the default Linux torch wheel drags in ~2 GB of CUDA libraries a
+      # CPU-only runner never uses. Installing the CPU build FIRST lets the
+      # requirements install below see torch as already satisfied.
+      - name: Install CPU-only PyTorch
+        run: pip install torch --index-url https://download.pytorch.org/whl/cpu
+
+      - name: Install dependencies
+        run: pip install -r requirements/requirements.txt -r requirements/requirements-dev.txt
+
+      - name: Guard tests (registration, help surface, workflows, packaging, docs links, parity round)
+        run: >
+          pytest -q -p no:cacheprovider
+          tests/test_cli_help_surface.py
+          tests/test_ci_workflows.py
+          tests/test_dockerignore_secrets.py
+          tests/test_lean_runtime_imports.py
+          tests/test_packaging_modules.py
+          tests/test_docs_links.py
+          tests/test_docs_facts.py
+          tests/test_aether_quant_coverage.py
+          tests/test_v550_parity_fixes.py
+          tests/test_aq_cli.py::test_subsystem_test_files_maps_every_real_test_file_to_exactly_one_bucket
+
+  # V5.5.0 - `aq test --<subsystem>` per bucket: proves every bucket is
+  # self-contained (no hidden cross-file ordering) and that the routing in
+  # aq_cli.py::_SUBSYSTEM_TEST_FILES works, which the single full-tree run
+  # never exercises. The full run above stays the coverage source of truth.
+  subsystem-matrix:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        subsystem: [cli, audit, risk, portfolio, features, data-pipeline, webui, ml, retraining, notifications, storage, live, evaluation, formal, meta]
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements-dev.txt
+
+      # V5.5.0 - the default Linux torch wheel drags in ~2 GB of CUDA libraries a
+      # CPU-only runner never uses. Installing the CPU build FIRST lets the
+      # requirements install below see torch as already satisfied.
+      - name: Install CPU-only PyTorch
+        run: pip install torch --index-url https://download.pytorch.org/whl/cpu
+
+      - name: Install dependencies and the package
+        run: |
+          pip install -r requirements/requirements.txt -r requirements/requirements-dev.txt
+          pip install -e .
+
+      - name: aq test --${{ matrix.subsystem }}
+        run: aq test --${{ matrix.subsystem }}
+
+  # V5.5.0 - builds the real wheel and exercises it OUTSIDE the checkout.
+  # `pip install -e .` (cli-smoke) puts the whole repo on sys.path and hides
+  # every pyproject.toml packaging gap; this job found four missing packages
+  # and a missing root module the first time it ran.
+  wheel-smoke:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0 # setuptools-scm needs tags to version the wheel
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements.txt
+
+      - name: Build the wheel
+        run: |
+          pip install build
+          python -m build --wheel
+
+      - name: Install the wheel into a clean venv (CPU torch first)
+        run: |
+          python -m venv "$RUNNER_TEMP/aq-wheel"
+          "$RUNNER_TEMP/aq-wheel/bin/pip" install --upgrade pip
+          "$RUNNER_TEMP/aq-wheel/bin/pip" install torch --index-url https://download.pytorch.org/whl/cpu
+          "$RUNNER_TEMP/aq-wheel/bin/pip" install -r requirements/requirements.txt dist/*.whl
+
+      - name: Smoke-test the installed wheel from outside the checkout
+        working-directory: ${{ runner.temp }}
+        run: '"$RUNNER_TEMP/aq-wheel/bin/python" "$GITHUB_WORKSPACE/scripts/wheel_smoke.py"'
+
+  # V5.5.0 - requires-python is >=3.10 but every other job runs 3.11, so a
+  # 3.11-only construct would ship unnoticed. Byte-compiling is syntax-only
+  # (cheap, no dependencies); it still catches except*, 3.12 f-strings, etc.
+  python-compat:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.10"
+
+      - name: Byte-compile first-party sources on Python 3.10
+        run: >
+          python -m compileall -q
+          -x '(^|/)(\.git|\.venv|venv|node_modules|backtests|webui|Aether-quant-Obsidian-Vault|build|dist|\.matplotlib_cache)(/|$)'
+          .
+
+      # Byte-compiling can't see a standard-library name that is new in 3.11 (datetime.UTC, #326). vermin reads what each source needs and fails on anything above 3.10.
+      - name: First-party sources need no more than Python 3.10 (vermin)
+        run: |
+          pip install vermin==1.9.2
+          vermin -t=3.10- --no-tips --violations -q aether_quant analyzer audit data_pipeline evaluation execution experience experts features inference liquidity moe monitoring notifications performance portfolio regime retraining risk topology aq_cli.py docs_facts.py json_safety.py performance_probe.py risk_controls.py generate_backtest_report.py generate_evaluation_report.py scripts/cycle_daily.py scripts/forward_ledger.py
+
+  # V5.5.0 - Docker is never built with Lean in CI (the 40 GB base image does
+  # not fit a hosted runner), but everything checkable without it is checked.
+  docker-checks:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Lint Dockerfiles (hadolint v2.12.0, errors only)
+        run: |
+          curl -sSL -o hadolint \
+            https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64
+          chmod +x hadolint
+          ./hadolint --failure-threshold error Dockerfile Dockerfile.lean
+
+      - name: Validate docker-compose.yml (default and lean profile)
+        run: |
+          docker compose -f docker-compose.yml config -q
+          docker compose -f docker-compose.yml --profile lean config -q
+
+      - name: Build the webui stage of the engine image
+        run: docker build --target webui-builder -t aq-webui-check .
+
+  # V5.5.0 - the new parity tooling, run in isolation so a regression in
+  # the offline/live-parity measurements is named by the job that failed.
+  parity-smoke:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements-dev.txt
+
+      # V5.5.0 - the default Linux torch wheel drags in ~2 GB of CUDA libraries a
+      # CPU-only runner never uses. Installing the CPU build FIRST lets the
+      # requirements install below see torch as already satisfied.
+      - name: Install CPU-only PyTorch
+        run: pip install torch --index-url https://download.pytorch.org/whl/cpu
+
+      - name: Install dependencies
+        run: pip install -r requirements/requirements.txt -r requirements/requirements-dev.txt
+
+      - name: Backtest audit, as-live simulator, calibration and sleeve tests
+        run: >
+          pytest -q -p no:cacheprovider
+          tests/test_backtest_audit.py
+          tests/test_live_parity.py
+          tests/test_volatility_threshold_calibration.py
+          tests/test_legacy_sleeve.py
+          tests/test_performance_probe.py
+          tests/test_rank_book_simulator.py
+          tests/test_feature_parity.py
+
+      - name: Offline parity audit of feature replicas (synthetic, no data files needed)
+        run: python scripts/feature_parity_audit.py --synthetic-only
+
+  # V5.5.0 - ADVISORY until it has run once against the real history: a
+  # first scan may flag historic dev defaults that need an allowlist entry.
+  secret-scan:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Scan the working tree for secrets (gitleaks v8.18.4)
+        run: |
+          curl -sSL -o gitleaks.tar.gz \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz
+          tar -xzf gitleaks.tar.gz gitleaks
+          ./gitleaks detect --source . --no-git --no-banner --redact --exit-code 1 --config .gitleaks.toml
+
+  # V5.5.0 - WARN-ONLY: the README badge is rewritten by a local `aq test`,
+  # so it lags whenever a test is added in a commit that skipped it. This
+  # surfaces the drift without blocking anyone.
+  test-count-drift:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: "pip"
+          cache-dependency-path: requirements/requirements-dev.txt
+
+      # V5.5.0 - the default Linux torch wheel drags in ~2 GB of CUDA libraries a
+      # CPU-only runner never uses. Installing the CPU build FIRST lets the
+      # requirements install below see torch as already satisfied.
+      - name: Install CPU-only PyTorch
+        run: pip install torch --index-url https://download.pytorch.org/whl/cpu
+
+      - name: Install dependencies
+        run: pip install -r requirements/requirements.txt -r requirements/requirements-dev.txt
+
+      - name: Compare the collected test count with the README badge
+        run: python scripts/check_test_count_drift.py