OpenByteInc/QuantDinger

Review signals: 3 download and execute, 7 hardcoded secret. 1 static matches retained as context.

Source contains download and execute; review its purpose. install.sh 3 findings.

Gitleaks found a possible hardcoded secret; value withheld. 4 distinct locations. 7 findings.

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Repository version consistency is checked by the documented version script.: Real input produced the expected result: Version check OK.

  Source: python scripts/check_version.py

  Input: Run the repository version consistency check.

  Expected: Version check succeeds and reports the canonical version.

  Command: /usr/bin/python3 scripts/check_version.py

  Observed: Version check OK. Canonical = 5.6.1 (1 declarations verified).

Examples

• Repository version consistency check: command completed successfully

  Source: README.md#Useful-repository-checks

  Input: Check declared version metadata.

  Expected: The script reports the canonical version and exits successfully.

  Command: /usr/bin/python3 scripts/check_version.py

  Observed: Version check OK. Canonical = 5.6.1 (1 declarations verified).

• Core Docker Compose stack startup: The documented `docker compose up -d --build` was not executed because ordinary Docker access fails with permission denied on /var/run/docker.sock. Docker and Compose are installed; `sudo docker info` confirmed server version 29.1.3. `docker compose config -q` passed.

  Source: README.md#Option-B-source-checkout

  Expected: documented command completes successfully

  Observed: The documented `docker compose up -d --build` was not executed because ordinary Docker access fails with permission denied on /var/run/docker.sock. Docker and Compose are installed; `sudo docker info` confirmed server version 29.1.3. `docker compose config -q` passed.

Local or hosted: local

Initialize environment configuration and run the README source deployment

pwd; id -u; rg --files -g 'README*' -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g 'go.mod' -g 'Cargo.toml' -g 'Makefile' -g 'requirements*.txt' -g 'uv.lock' -g 'p3-models.md' | head -100; git status --short --branch; git remote -v
ls -la; find .. -name AGENTS.md -o -name 'README*' | head -100; python3 --version; command -v sudo && sudo -n true; 
cat README.md
cat AGENTS.md; cat mcp_server/README.md; cat docs/agent/MCP_SETUP.md
python3 - <<'PY'
import os
for p in ['<guest-path>','/inputs/coldpass-preflight.py','<host-path>']:
 print(p, os.path.exists(p))
PY
python3 -m pip --version; command -v docker || true; command -v git || true; ls -la .coldpass
git init; git remote add origin https://github.com/OpenByteInc/QuantDinger; git fetch --depth 1 origin d7642d7e46a3c4070e1a156731f4e53c7646e78c; git reset --mixed FETCH_HEAD; python3 -m ensurepip --version; docker --version; docker compose version; ls -la mcp_server; find mcp_server -maxdepth 2 -type f | head -30
sudo -n apt-get update && sudo -n apt-get install -y docker.io docker-compose-v2 python3-pip python3.12-venv
sudo service docker start; docker info; docker compose version; sed -n '1,240p' install.sh; git status --short --branch; git rev-parse HEAD
python3 -m venv <guest-path> && <guest-path> -m pip --version; python3 scripts/sync_env.py --help; python3 scripts/check_version.py
mkdir -p .coldpass; python3 scripts/sync_env.py --env-file .coldpass/probe-output.env --template .env.example; cat .coldpass/probe-output.env; head -60 scripts/sync_env.py; ls <guest-path>
sed -n '60,140p' scripts/sync_env.py; find .github/workflows -type f -maxdepth 1 -print | head; docker compose config -q; sudo docker info --format '{{.ServerVersion}}'
python3 scripts/sync_env.py --env-file .coldpass/probe-output.env --template .env.example --check; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/usr/bin/python3","scripts/sync_env.py","--env-file",".coldpass/probe-output.env","--template",".env.example"],"cwd":"<guest-path>","expected_text":"Environment is up to date: .coldpass/probe-output.env"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The sync command creates or updates an environment file from the template.","source":"python scripts/sync_env.py --env-file .env --template .env.example --backup","input":"An absent output env file is initialized from .env.example.","expected":"The output env file is created from the template.","probe_kind":"cli","argv":["/usr/bin/python3","scripts/sync_env.py","--env-file",".coldpass/claim-output.env","--template",".env.example"],"expected_text":"Created environment file: .coldpass/claim-output.env","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README documented environment sync operation","source":"README.md#Option-B-source-checkout","input":"Initialize a fresh dotenv file from the documented example template.","expected":"A fresh env file matching the template is written.","argv":["/usr/bin/python3","scripts/sync_env.py","--env-file",".coldpass/example-output.env","--template",".env.example"],"cwd":"<guest-path>","expected_text":"Created environment file: .coldpass/example-output.env"},{"kind":"example","claim":"Core Docker Compose stack startup","source":"README.md#Option-B-source-checkout","reason":"The documented `docker compose up -d --build` cannot run: ordinary docker access returned permission denied for /var/run/docker.sock; privileged docker info was confirmed available, but starting containers via sudo would need a lifecycle cleanup and the deployment is large."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Scheduler worker performs domain scheduling cycles","source":"README.md#Main-execution-paths","quote":"app/commands/scheduler.py -> scheduling services -> durable state and notifications","schedule":"Scheduler worker repeatedly runs portfolio, deployment, payment, and signal schedules.","method":"not run","input":"The Compose runtime must be active to exercise its scheduler cycle.","expected":"Scheduled domain work runs and persists state.","kind":"cli","argv":["/usr/bin/python3","scripts/sync_env.py","--env-file",".coldpass/cycle-output.env","--template",".env.example"],"cwd":"<guest-path>","expected_text":"Created environment file: .coldpass/cycle-output.env"}]}
EOF

cat > .coldpass/report.json <<'EOF'
{"outcome":"blocked","fault_owner":"prerequisite","operation":"Initialize environment configuration and run the README source deployment","operation_scope":"Python 3.12.3 sync_env CLI and documented Docker Compose stack","steps":["Read README.md and confirmed Python 3.12.3 as required by the development section.","Initialized git and fetched/reset to pinned commit d7642d7e46a3c4070e1a156731f4e53c7646e78c.","Installed docker.io, docker-compose-v2, python3-pip, and python3.12-venv with sudo apt.","Ran python3 scripts/sync_env.py --env-file .coldpass/probe-output.env --template .env.example and confirmed creation from template.","Ran python3 scripts/sync_env.py --env-file .coldpass/probe-output.env --template .env.example --check; it reported the file up to date.","Ran docker compose config -q successfully."],"deviations":["README quick start `docker compose up -d --build` was not run because nonroot Docker access fails with permission denied on /var/run/docker.sock. Docker binaries and Compose are installed; sudo docker info returned server version 29.1.3.","Standalone MCP quick start requires a configured running backend and QUANTDINGER_AGENT_TOKEN; no credentials or external service were available."],"stuck_step":"Start the Docker Compose services described in README.md under Quick start > Option B: source checkout.","main_blocker":"Docker daemon socket permissions prevent the ordinary guest user from running the documented Compose startup command.","plain_failure":"The documented environment sync command and Compose configuration validation work, but the actual QuantDinger service stack could not be started because the guest user cannot access the Docker daemon socket.","suggested_fix":"Provide Docker socket access to the guest user or run the documented Compose lifecycle with appropriate guest privileges, then query the documented API health endpoint."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat .coldpass/cycles.json
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"The README describes scheduler-worker recurring work, but it requires the deployed runtime and its database. Docker access was blocked, so no product cycle can be triggered with the available services. The documented configuration sync command was exercised instead.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
import json
for path in ['.coldpass/probe.json','.coldpass/claims.json','.coldpass/examples.json']:
 d=json.load(open(path))
 entries=d if isinstance(d,list) else [d]
 for e in entries:
  a=e.get('argv',[])
  if 'sync_env.py' in a:
   i=a.index('--env-file')+1
   out=a[i]
   import os
   if os.path.exists(out): os.remove(out)
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat .coldpass/claims.json; ls -la .coldpass/*output*
rm -f .coldpass/claim-output.env .coldpass/probe-output.env .coldpass/example-output.env; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat .coldpass/probe.json
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/usr/bin/python3","scripts/check_version.py"],"cwd":"<guest-path>","expected_text":"Version check OK."}
EOF
python3 - <<'PY'
import json
p='.coldpass/claims.json'; d=json.load(open(p)); d[0]['argv']=['/usr/bin/python3','scripts/sync_env.py','--env-file','.coldpass/claim-output.env','--template','.env.example']; open(p,'w').write(json.dumps(d))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Repository version consistency is checked by the documented version script.","source":"python scripts/check_version.py","input":"Run the repository version consistency check.","expected":"Version check succeeds and reports the canonical version.","probe_kind":"cli","argv":["/usr/bin/python3","scripts/check_version.py"],"expected_text":"Version check OK.","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Repository version consistency check","source":"README.md#Useful-repository-checks","input":"Check declared version metadata.","expected":"The script reports the canonical version and exits successfully.","argv":["/usr/bin/python3","scripts/check_version.py"],"cwd":"<guest-path>","expected_text":"Version check OK."},{"kind":"example","claim":"Core Docker Compose stack startup","source":"README.md#Option-B-source-checkout","reason":"The documented `docker compose up -d --build` was not executed because ordinary Docker access fails with permission denied on /var/run/docker.sock. Docker and Compose are installed; `sudo docker info` confirmed server version 29.1.3. `docker compose config -q` passed."}]
EOF
rm -f .coldpass/probe-output.env .coldpass/claim-output.env .coldpass/example-output.env
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay