{
  "projectId": "quantdinger",
  "title": "QuantDinger · 源码静态检查与执行边界",
  "summary": "Agent Gateway 默认走模拟订单路径。真实下单必须同时通过 token 的交易许可、paper_only 关闭和服务端总开关；实盘路径还检查市价可用性及名义金额配额。",
  "scope": "固定 commit 公开源码的 REA 文件清单与 Python Agent Gateway 下单路由检查；未启动服务或连接交易所。",
  "status": "partial",
  "analyzedAt": "2026-10-13",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "REA 已检查固定源码内容的兼容派生清单",
      "detail": "官方源码 ZIP 下载超时，使用已下载的同 commit tar 归档，解压后未改文件内容并转换为 ZIP 供 REA 检查；inspect_artifact 返回 1134 个内容节点、1138 个文件/目录出现项。这个结果证明本次检查输入的身份和结构，不证明 Python、Go 或 Rust 代码运行行为，也不等同于完成产品逆向。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_4fee47cf0ea2a10224a3d705c104bb2475361e0e4dc8868b891779c2d0c3927f"
      ],
      "sourceUrls": [
        "https://codeload.github.com/OpenByteInc/QuantDinger/tar.gz/ba8cd667acca3e934bbc1cb354922eff413393dc"
      ]
    },
    {
      "title": "Agent 实盘接口包含服务端总开关",
      "detail": "quick_trade.py 以交易权限装饰器保护订单路由；当 token 的 paper_only=false 而 AGENT_LIVE_TRADING_ENABLED 未启用时返回 501。总开关环境变量默认 false。此结论只覆盖 /agent/v1 对应路由，不自动扩展到项目中的其他交易入口。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/OpenByteInc/QuantDinger/blob/ba8cd667acca3e934bbc1cb354922eff413393dc/backend_api_python/app/routes/agent_v1/quick_trade.py#L40",
        "https://github.com/OpenByteInc/QuantDinger/blob/ba8cd667acca3e934bbc1cb354922eff413393dc/backend_api_python/app/routes/agent_v1/quick_trade.py#L404",
        "https://github.com/OpenByteInc/QuantDinger/blob/ba8cd667acca3e934bbc1cb354922eff413393dc/backend_api_python/app/routes/agent_v1/quick_trade.py#L456"
      ]
    },
    {
      "title": "实盘额度检查发生在路由到执行器之前",
      "detail": "实盘分支先取得参考价；价格不可用时返回错误。随后调用 _reserve_live_notional，未取得额度即拒绝，之后才调用 _place_live_order。代码还存在 Idempotency-Key 去重处理，但本次没有并发、超时或重试实验，不能保证端到端幂等性。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/OpenByteInc/QuantDinger/blob/ba8cd667acca3e934bbc1cb354922eff413393dc/backend_api_python/app/routes/agent_v1/quick_trade.py#L449",
        "https://github.com/OpenByteInc/QuantDinger/blob/ba8cd667acca3e934bbc1cb354922eff413393dc/backend_api_python/app/routes/agent_v1/quick_trade.py#L466"
      ]
    },
    {
      "title": "模拟成交是本地记录",
      "detail": "paper 分支调用 _paper_fill_outcome 和 _record_paper_order，返回 paper-fill。模拟记录与交易所真实成交并非同一种证据，不应在网站上混为实盘表现。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/OpenByteInc/QuantDinger/blob/ba8cd667acca3e934bbc1cb354922eff413393dc/backend_api_python/app/routes/agent_v1/quick_trade.py#L61",
        "https://github.com/OpenByteInc/QuantDinger/blob/ba8cd667acca3e934bbc1cb354922eff413393dc/backend_api_python/app/routes/agent_v1/quick_trade.py#L502"
      ]
    }
  ],
  "limitations": [
    "GitHub 最新 release 接口返回 v5.5.4，但没有附加二进制资产；本次分析固定 commit 源码，未证明其与部署镜像逐字一致。",
    "REA 未提供本项目 Python 后端的语义或动态测试结果；真实调用行为仍需独立部署和隔离验证。",
    "未检查所有 UI、MCP、常规 quick_trade 或经纪商入口，不能据一个 Agent Gateway 路由概括全产品权限。"
  ],
  "artifacts": [
    {
      "label": "官方源码归档 · ba8cd667acca",
      "url": "https://codeload.github.com/OpenByteInc/QuantDinger/tar.gz/ba8cd667acca3e934bbc1cb354922eff413393dc",
      "sha256": "f94e00f288528ca8b5b39b4652746106e6ce302211afd0b6928c4a25e9d5dca5",
      "bytes": 13598574
    }
  ],
  "evidenceIds": [
    "ev_4fee47cf0ea2a10224a3d705c104bb2475361e0e4dc8868b891779c2d0c3927f"
  ],
  "reportUrl": "/research/rea/quantdinger.json",
  "methodology": "REA 原始输出负责产物身份、文件结构或原生元数据；code_inference 结论来自带固定版本引用的源码阅读。未完成动态运行、实盘测试、完整安全审计或收益验证。",
  "sourceCommit": "ba8cd667acca3e934bbc1cb354922eff413393dc",
  "releasedArtifactAvailable": false,
  "analysisInput": {
    "sha256": "27e148e637259d0e571dd1e2a3e2ccce0de4dd0a550bdff027f257446a95fd76",
    "format": "zip",
    "evidenceId": "ev_4fee47cf0ea2a10224a3d705c104bb2475361e0e4dc8868b891779c2d0c3927f",
    "operation": "inspect_artifact",
    "publicSourceUrls": [
      "https://codeload.github.com/OpenByteInc/QuantDinger/tar.gz/ba8cd667acca3e934bbc1cb354922eff413393dc"
    ],
    "derivedFromSha256": "f94e00f288528ca8b5b39b4652746106e6ce302211afd0b6928c4a25e9d5dca5",
    "transformation": "官方固定 commit 的 tar.gz 解压后未改文件内容，zip -X -qr 生成兼容输入；原包与派生包分开记录。"
  },
  "analysisAttempts": [
    {
      "command": "rea inspect-artifact <quantdinger source directory> --format json",
      "result": "unavailable",
      "code": "target_unavailable",
      "reason": "REA CLI 的此入口拒绝普通目录；已改用明确记录的 ZIP 输入。"
    },
    {
      "command": "rea inspect-artifact quantdinger-source-rea-input.zip --format json",
      "result": "completed",
      "evidenceIds": [
        "ev_4fee47cf0ea2a10224a3d705c104bb2475361e0e4dc8868b891779c2d0c3927f"
      ],
      "coverage": "public_source_archive_inventory"
    },
    {
      "command": "GET official fixed-commit GitHub source ZIP",
      "result": "unavailable",
      "reason": "下载超过 120 秒中止；用已成功取得的同 commit 官方 tar.gz 作为原始来源，不将派生 ZIP 称为官方分发文件。"
    }
  ]
}