{
  "projectId": "nofx",
  "title": "NOFX · 源码静态检查与执行边界",
  "summary": "风控并非仅写在模型提示中：Go 下单路径确实调用仓位数量与名义仓位上限函数。但这些函数依赖策略配置；利润回撤监控也包含取仓失败直接返回的分支。",
  "scope": "固定 commit 官方源码 ZIP 的 REA 清单与 Go 交易风控代码检查；未分析已部署服务或运行 Go 程序。",
  "status": "partial",
  "analyzedAt": "2026-10-13",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "REA 已固定源码归档身份与文件清单",
      "detail": "inspect_artifact 返回 776 个内容节点、776 个文件/目录出现项。这个结果证明本次检查输入的身份和结构，不证明 Python、Go 或 Rust 代码运行行为，也不等同于完成产品逆向。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_9da514875ace5e3eda83dd3d388e7542f116013f725d8cc4a90be917916a72eb"
      ],
      "sourceUrls": [
        "https://codeload.github.com/NoFxAiOS/nofx/zip/ef476f28926c7d0c03f105a19b18f91e30a652a7"
      ]
    },
    {
      "title": "开仓路径调用代码层面的仓位检查",
      "detail": "auto_trader_orders.go 在开仓流程调用 enforceMaxPositions 与 enforcePositionValueRatio。后者根据账户权益和币种分组计算上限，并对过大的名义仓位做裁剪。这比只在 LLM 提示中声明风控更具体，但仍未证明所有交易入口都经过此路径。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_orders.go#L62",
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_orders.go#L105",
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_risk.go#L231"
      ]
    },
    {
      "title": "单项仓位上限依赖策略配置存在",
      "detail": "enforcePositionValueRatio 在 StrategyConfig 为 nil 时直接返回原输入；有配置时才读取比例并计算上限。该局部分支提示审查部署初始化和配置校验的必要性，不能仅凭它断言线上存在可利用的绕过。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_risk.go#L231"
      ]
    },
    {
      "title": "利润回撤保护有明确触发和可观测限制",
      "detail": "监控每分钟读取持仓，取仓失败时记录日志后返回。关闭条件是当前价格方向收益高于 5% 且相对峰值利润回吐至少 40%；这不是全账户最大亏损保险，也不覆盖接口失败期间的保证。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_risk.go#L13",
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_risk.go#L39",
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_risk.go#L57",
        "https://github.com/NoFxAiOS/nofx/blob/ef476f28926c7d0c03f105a19b18f91e30a652a7/trader/auto_trader_risk.go#L122"
      ]
    }
  ],
  "limitations": [
    "REA 只对源码 ZIP 建立文件清单，不解析 Go 运行语义；以上控制流程均为固定代码的静态推断。",
    "未取得和验证当前线上服务、Docker 镜像或可执行发行文件，源码与实际部署版本对应关系未知。",
    "未运行测试、策略、回测或交易账户请求，不据此评价盈利或整体安全性。"
  ],
  "artifacts": [
    {
      "label": "官方源码归档 · ef476f28926c",
      "url": "https://codeload.github.com/NoFxAiOS/nofx/tar.gz/ef476f28926c7d0c03f105a19b18f91e30a652a7",
      "sha256": "cfe5fa09e7731bb520481d260246011c92e97c0cf68131933defbbac020ba773",
      "bytes": 22082182
    },
    {
      "label": "REA 输入：官方源码 ZIP · ef476f28926c",
      "url": "https://codeload.github.com/NoFxAiOS/nofx/zip/ef476f28926c7d0c03f105a19b18f91e30a652a7",
      "sha256": "82e495d5567a4e82d619ba080bb88c3cde888251293970c4a15adb93024b2c25",
      "bytes": 22476381
    }
  ],
  "evidenceIds": [
    "ev_9da514875ace5e3eda83dd3d388e7542f116013f725d8cc4a90be917916a72eb"
  ],
  "reportUrl": "/research/rea/nofx.json",
  "methodology": "REA 原始输出负责产物身份、文件结构或原生元数据；code_inference 结论来自带固定版本引用的源码阅读。未完成动态运行、实盘测试、完整安全审计或收益验证。",
  "sourceCommit": "ef476f28926c7d0c03f105a19b18f91e30a652a7",
  "releasedArtifactAvailable": false,
  "analysisInput": {
    "sha256": "82e495d5567a4e82d619ba080bb88c3cde888251293970c4a15adb93024b2c25",
    "format": "zip",
    "evidenceId": "ev_9da514875ace5e3eda83dd3d388e7542f116013f725d8cc4a90be917916a72eb",
    "operation": "inspect_artifact",
    "publicSourceUrls": [
      "https://codeload.github.com/NoFxAiOS/nofx/zip/ef476f28926c7d0c03f105a19b18f91e30a652a7"
    ]
  },
  "analysisAttempts": [
    {
      "command": "rea inspect-artifact <nofx source directory> --format json",
      "result": "unavailable",
      "code": "target_unavailable",
      "reason": "REA CLI 的此入口拒绝普通目录；已改用明确记录的 ZIP 输入。"
    },
    {
      "command": "rea inspect-artifact nofx-source.zip --format json",
      "result": "completed",
      "evidenceIds": [
        "ev_9da514875ace5e3eda83dd3d388e7542f116013f725d8cc4a90be917916a72eb"
      ],
      "coverage": "public_source_archive_inventory"
    }
  ]
}