Wire bounded CN index ETF research into the strategy watcher

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
           python3 -m pip install 'quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@7363011d56926d39f4fffeb036e511391114e39f'
           python3 -m pip check
           python3 -m ruff check .
-          python3 -m pytest tests ops/quant-monitor/tests -q
+          python3 -m pytest tests ops/quant-monitor/tests -q --ignore=tests/test_run_cn_index_etf_research.py
 
       - uses: actions/setup-node@v6
         with:
@@ -60,3 +60,42 @@ jobs:
           set -euo pipefail
           node --experimental-default-type=module --test cloudflare/codex-audit-proxy/tests/index.test.mjs
           node --experimental-default-type=module --test cloudflare/ai-gateway-dash/tests/index.test.mjs
+
+      - name: Install the isolated CN research dependency set
+        run: |
+          set -euo pipefail
+          python3 -m venv "${RUNNER_TEMP}/aab-cn-research"
+          "${RUNNER_TEMP}/aab-cn-research/bin/python" -m pip install pytest 'cn-equity-strategies[research] @ git+https://github.com/QuantStrategyLab/CnEquityStrategies.git@2a0c5c9aafacfbe6519fb4029ca4ac18e4996a66'
+          "${RUNNER_TEMP}/aab-cn-research/bin/python" -m pip check
+      - name: Verify the real CN caller without network or model execution
+        env:
+          TZ: UTC
+          PYTEST_DISABLE_PLUGIN_AUTOLOAD: "1"
+          PYTHONDONTWRITEBYTECODE: "1"
+        run: |
+          set -euo pipefail
+          # Main-suite packaging leaves egg-info in the checkout. Test the same
+          # HEAD (including the PR merge) without those build-time metadata files.
+          cn_test_source="$(mktemp -d "${RUNNER_TEMP}/aab-cn-research-source.XXXXXX")"
+          git archive HEAD | tar -x -C "${cn_test_source}"
+          cd "${cn_test_source}"
+          "${RUNNER_TEMP}/aab-cn-research/bin/python" - <<'PY'
+          import importlib.metadata
+          from pathlib import Path
+          import socket
+          import sys
+          import pytest
+
+          def blocked(*args, **kwargs):
+              raise AssertionError("real socket prohibited")
+
+          socket.socket.connect = blocked
+          socket.create_connection = blocked
+          for package in ("cn-equity-strategies", "quant-platform-kit", "ai-gateway-client"):
+              installed = importlib.metadata.distribution(package)
+              assert Path(installed.locate_file("")).resolve().is_relative_to(Path(sys.prefix).resolve())
+          raise SystemExit(pytest.main([
+              "-q", "-p", "no:cacheprovider", "--tb=short",
+              "tests/test_run_cn_index_etf_research.py",
+          ]))
+          PY

.github/workflows/strategy_optimization_watcher.yml

@@ -47,6 +47,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     outputs:
+      source_repo: ${{ env.SOURCE_REPO }}
+      dry_run: ${{ env.STRATEGY_WATCH_DRY_RUN }}
       soxl_learning_ready: ${{ steps.soxl-watcher-learning-ready.outputs.ready }}
       soxl_p1_manifest_sha256: ${{ steps.soxl-watcher-learning-ready.outputs.p1_manifest_sha256 }}
     env:
@@ -642,3 +644,54 @@ jobs:
       - name: Remove watcher learning workspace
         if: always()
         run: rm -rf -- "$LEARNING_ROOT"
+
+  cn-index-etf-research:
+    needs: strategy-optimization-watcher
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      vars.CN_INDEX_ETF_RESEARCH_ENABLED == 'true' &&
+      needs.strategy-optimization-watcher.outputs.source_repo == 'QuantStrategyLab/CnEquitySnapshotPipelines' &&
+      needs.strategy-optimization-watcher.outputs.dry_run == 'false'
+    runs-on: [self-hosted, codex-vps]
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+    concurrency:
+      group: cn-index-etf-research-vps
+      cancel-in-progress: false
+    env:
+      PYTHONDONTWRITEBYTECODE: "1"
+      CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
+      CODEX_AUDIT_SERVICE_AUDIENCE: ${{ vars.CODEX_AUDIT_SERVICE_AUDIENCE || 'quant-codex-audit' }}
+      AI_GATEWAY_RESEARCH_PROVIDERS: codex
+    steps:
+      - name: Checkout approved Bridge job
+        uses: actions/checkout@v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Read this workflow's verified watcher artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: strategy-optimization-watcher-${{ github.run_id }}
+          path: data/input/cn-index-etf-watcher
+
+      - name: Run the policy-bound CN research job
+        run: |
+          set -euo pipefail
+          mkdir -p data/output/cn-index-etf-research
+          /opt/codex-cn-index-etf-research/venv/bin/python \
+            -m scripts.run_cn_index_etf_research \
+            --watcher-result data/input/cn-index-etf-watcher/result.json \
+            > data/output/cn-index-etf-research/result.json
+
+      - name: Upload sanitized research status
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cn-index-etf-research-${{ github.run_id }}
+          path: data/output/cn-index-etf-research/result.json
+          if-no-files-found: warn
+          retention-days: 7