Skip to content

QuantLite firewall: provenance-aware, issuer-independent scoring - #1

Merged
prasants merged 2 commits into
mainfrom
feature/score-firewall
Jun 12, 2026
Merged

QuantLite firewall: provenance-aware, issuer-independent scoring#1
prasants merged 2 commits into
mainfrom
feature/score-firewall

Conversation

@prasants

Copy link
Copy Markdown
Owner

The firewall: provenance-aware, issuer-independent scoring

The QuantLite Score already answers what a track record's returns were (a
reproducible artifact with a SHA-256 input digest). This adds the second,
load-bearing question: where did the returns come from?

A score is only worth money while the rated party cannot buy a better one.
This layer makes the score independent of who pays — enforced in code, not
policy.

What's in it

  • score.provenanceDataSource / is_independent,
    SourceAttestation, AttestedScore / FirewallReport,
    assert_firewall / FirewallError.
  • A SourceAttestation binds an input digest to an independent origin
    (exchange custody, fund administrator, prime broker, allocator) and the
    party vouching for it, sealed with its own tamper-evident hash.
  • Five-check verification in one pass: artifact consistency, attestation
    consistency, digest agreement, score reproduction, source independence.
  • A manager-submitted score still reproduces — it simply is not
    firewall-clean. The report distinguishes "the number is fake" from "the
    number is real but the provenance is not independent."

Quality

  • 24 new tests; full score package suite (42 tests) passing.
  • ruff lint + format clean. Additive and non-breaking: existing artifact and
    engine hashing untouched.

Docs

  • docs/firewall.md — specification plus the marketplace-operator
    integration (venue as custodian of record).
  • STRATEGY.md — commercial rationale and the non-negotiable invariant:
    paying more can never produce a better number.

prasants added 2 commits June 11, 2026 16:14
Introduces quantlite.score, an open scoring methodology (QLS-1.0) for
trading track records, built on the existing forensics and resampling
stack:

- Composite 0-100 score: Deflated Sharpe skill (35%), bootstrap
  robustness (20%), tail risk (20%), consistency (15%), track record
  sufficiency (10%), with letter grades A+ through F.
- Integrity checks that flag return smoothing, outlier dependence, the
  short-volatility signature, cherry-picked start dates, and short
  records. Critical flags cap the score at 40, warnings at 70.
- Verifiable artifacts: canonical JSON with SHA-256 input digest and
  content hash; verify_artifact() reproduces any score bit for bit.
- Deterministic by construction: seeded bootstrap, platform-independent
  canonicalisation, calibration constants frozen per methodology version.
- Full specification in docs/score.md, 23 new tests, changelog and
  README updates.
The score answers what the returns were; the firewall answers where they
came from. A SourceAttestation binds an input digest to an independent
origin (exchange custody, fund admin, prime broker, allocator) and the
party vouching for it. A score is firewall-clean only when its inputs are
attested to a source the rated manager does not control, making the rating
independent of who pays.

- score.provenance: DataSource/is_independent, SourceAttestation,
  AttestedScore/FirewallReport, assert_firewall/FirewallError.
- Five-check verification in one pass: artifact consistency, attestation
  consistency, digest agreement, score reproduction, source independence.
- 24 new tests; docs/firewall.md spec with marketplace-operator integration;
  STRATEGY.md commercial rationale; changelog.
@prasants
prasants merged commit 4fe7b3b into main Jun 12, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant