chore(deps): align QPK pin to 2381aa4577e9

.github/workflows/codex_review_gate.yml

@@ -23,7 +23,9 @@ permissions:
   pull-requests: read
 
 concurrency:
-  group: codex-review-gate-${{ github.event.pull_request.number }}
+  # A non-Codex review still emits pull_request_review.  Keep that skipped
+  # event from cancelling the active pull_request polling run.
+  group: codex-review-gate-${{ github.event.pull_request.number }}-${{ github.event_name }}
   cancel-in-progress: true
 
 jobs:

pyproject.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 description = "QuantStrategyLab platform layer for Binance exchange."
 requires-python = ">=3.11"
 dependencies = [
-  "quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@69a0256934d081b5ef309a885384b9eb9f62cf90",
+  "quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@2381aa4577e9fd6329053a73a1c888929170eaf3",
   "crypto-strategies @ git+https://github.com/QuantStrategyLab/CryptoStrategies.git@ef78312d7653095f585c4f75d45bf765bedc2751",
   "python-binance",
   "pandas",
@@ -23,7 +23,7 @@ test = [
 
 [tool.uv]
 override-dependencies = [
-  "quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@69a0256934d081b5ef309a885384b9eb9f62cf90",
+  "quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@2381aa4577e9fd6329053a73a1c888929170eaf3",
 ]
 
 [tool.ruff]

qsl.toml

@@ -9,7 +9,7 @@ expires_at = "2026-09-30"
 next_action = "keep uv.lock current and maintain QPK/CryptoStrategies pin consistency"
 
 [qsl.requires]
-quant_platform_kit = "69a0256934d081b5ef309a885384b9eb9f62cf90"
+quant_platform_kit = "2381aa4577e9fd6329053a73a1c888929170eaf3"
 crypto_strategies = "ef78312d7653095f585c4f75d45bf765bedc2751"
 
 [qsl.compat]

tests/test_uv_dependency_workflow.py

@@ -1,3 +1,4 @@
+import re
 import unittest
 from pathlib import Path
 
@@ -36,14 +37,11 @@ def test_ci_runtime_and_watchdog_use_uv_lock(self) -> None:
         self.assertIn("python -m pip install --upgrade pip uv", watchdog)
         self.assertIn("uv sync --frozen --no-dev", watchdog)
         self.assertIn("uv run --no-sync python - <<'PY'", watchdog)
-        self.assertIn(
-            "QuantPlatformKit.git?rev=69a0256934d081b5ef309a885384b9eb9f62cf90#69a0256934d081b5ef309a885384b9eb9f62cf90",
-            lockfile,
-        )
-        self.assertNotIn(
-            "QuantPlatformKit.git?rev=69a0256934d081b5ef309a885384b9eb9f62cf90#53b2ca73a5a50257b5d1a3c769b75c40924e4ba6",
-            lockfile,
-        )
+        pyproject = Path("pyproject.toml").read_text(encoding="utf-8")
+        match = re.search(r"QuantPlatformKit\.git@([0-9a-f]{40})", pyproject)
+        self.assertIsNotNone(match)
+        qpk_pin = match.group(1)
+        self.assertIn(f"QuantPlatformKit.git?rev={qpk_pin}#{qpk_pin}", lockfile)
         self.assertNotIn("requirements-lock.txt", ci)
         self.assertNotIn("requirements.txt", ci)
 

tests/test_watchdog_workflow.py

@@ -10,6 +10,7 @@
 RUNTIME_WORKFLOW = ROOT / ".github" / "workflows" / "main.yml"
 PYPROJECT = ROOT / "pyproject.toml"
 LOCK = ROOT / "uv.lock"
+QSL = ROOT / "qsl.toml"
 
 
 def _project_dependencies() -> list[str]:
@@ -91,13 +92,22 @@ def test_watchdog_reads_firestore_heartbeat_with_supported_qpk_api(self) -> None
         self.assertIn("alive = is_heartbeat_fresh(heartbeat, max_age_seconds)", text)
         self.assertNotIn(".check_alive()", text)
 
-    def test_watchdog_qpk_pin_includes_health_module_release(self) -> None:
+    def test_watchdog_qpk_pin_matches_lockfile(self) -> None:
         requirement = _dependency("quant-platform-kit @ ")
         lock = LOCK.read_text(encoding="utf-8")
+        revision = requirement.rsplit("@", maxsplit=1)[1]
 
-        self.assertIn("QuantPlatformKit.git?rev=69a0256934d081b5ef309a885384b9eb9f62cf90", lock)
-        self.assertIn("@69a0256934d081b5ef309a885384b9eb9f62cf90", requirement)
-        self.assertNotIn("@0af622ac9d47f7ef93f9379f9ded314c27a344ff", lock)
+        self.assertRegex(revision, r"^[0-9a-f]{40}$")
+        self.assertIn(f"QuantPlatformKit.git?rev={revision}#{revision}", lock)
+
+    def test_qsl_qpk_pin_matches_manifest(self) -> None:
+        requirement = _dependency("quant-platform-kit @ ")
+        qsl = tomllib.loads(QSL.read_text(encoding="utf-8"))
+
+        self.assertEqual(
+            qsl["qsl"]["requires"]["quant_platform_kit"],
+            requirement.rsplit("@", maxsplit=1)[1],
+        )
 
     def test_crypto_strategies_pin_matches_qpk_health_dependency(self) -> None:
         requirement = _dependency("crypto-strategies @ ")