fix: harden paper evidence and release provenance

PERFORMANCE.md

@@ -135,6 +135,14 @@ The fixed paper experiment is stricter than the general report: it accepts no
 missing price rows, performs no forward fill, and requires at least 274 signal
 warm-up sessions before the evaluation window.
 
+`scripts/release_paper_artifacts.sh` is intentionally bound to the reviewed
+input digest. When release-critical paths are unchanged, it regenerates from the
+recorded source commit and timestamp. Changed experiment, report, or paper source
+requires an explicit `QUANTCORTEX_GENERATED_AT` and regenerates from current
+`HEAD`. The wrapper fails rather than labeling a different matrix with the
+reviewed provider provenance. A new panel requires a new, explicitly reviewed
+experiment configuration and source record.
+
 For an explicitly requested live download:
 
 ```bash

docs/evaluation-contracts.md

@@ -37,8 +37,14 @@ the complete symbol set and gross limit:
 }
 ```
 
-`target_tape_to_payload` and `target_tape_from_payload` implement that envelope;
-`schemas/canonical_target_tape.schema.json` specifies it for other engines.
+`target_tape_to_payload` and `target_tape_from_payload` implement that envelope.
+`schemas/canonical_target_tape.schema.json` specifies its serialized structure
+and primitive constraints for other engines. Runtime validation additionally
+enforces cross-record portfolio invariants: no duplicate timestamp-symbol rows,
+the declared symbol universe at every decision, and the per-decision gross
+limit. The paper experiment round-trips each variant through this boundary
+before backtesting and publishes canonical payload hashes in
+`paper/results/target_tape_hashes.json`.
 
 The evaluation contract also records post-overlay exposure rules and the
 paper-trading order-state policy: persist intent before submission, block

docs/img/performance_manifest.json

@@ -1,19 +1,19 @@
 {
   "schema_version": 4,
-  "generated_at": "2026-06-16T22:00:41Z",
+  "generated_at": "2026-06-18T22:06:35Z",
   "generator": {
     "path": "scripts/generate_report.py",
     "script_sha256": "b536aa7fc5e4fe7df6c7ff28c0992629a489869eaec46486db7aff1cb946099b",
     "git": {
-      "source_commit": "d185c44928af865882c4d830066432dc97eb9972",
+      "source_commit": "ef6e7e3414aed0ae9b77d50748a22823529486af",
       "worktree_clean_at_start": true
     },
     "source_tree": {
-      "sha256": "a72c2fcd825bb15a2879a3b33d63487a34348b837ff733b7c1ee9d0232ed19cb",
+      "sha256": "f964d653b5e645e1efe97889e8acb43fbb0c2c8ddeb0835803f07c299abff5a0",
       "file_count": 107,
       "files": {
-        "poetry.lock": "fa8904674c2b24f3141acae607fd0a49d97125bc109c18def9fccbb2256c8de0",
-        "pyproject.toml": "175abd743d38f6b6c1cc8ae42471d62d83c86beb245d93fea231c666f51b2643",
+        "poetry.lock": "abce2cd132651851d81034dea085d7dbfbe5e44321f2e13997db69f46d7f080b",
+        "pyproject.toml": "eaeeb454c28bf7f6d9e530002bb7e88624b56b6c3e1fcb71e6414045cb9c42a0",
         "quantcortex/__init__.py": "14bf1ebdacd054c3738e4704d33da6709a39206463df8b8ced5376da342c4036",
         "quantcortex/alpha/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
         "quantcortex/alpha/factors/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
@@ -37,7 +37,7 @@
         "quantcortex/alpha/validation/alphalens_report.py": "8463289117add78a576e37a5b99a539be5c808fca86100e26deb29e8060aa60d",
         "quantcortex/alpha/validation/factor_decay.py": "9e6e049165f014db2122d9ed57415e45e48142b475dfb7221247d447d9a50397",
         "quantcortex/backtest/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-        "quantcortex/backtest/conformance.py": "e169cc67cac9eb56d8da4e4a0da1e257bb6cb8d1745baca681f50fab6c62fc57",
+        "quantcortex/backtest/conformance.py": "22f9b18101f0d9adcae98297e395c1ab6a90b18e411f24e7456f1d166b7df9b5",
         "quantcortex/backtest/costs/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
         "quantcortex/backtest/costs/transaction_costs.py": "48200419f37004c58df6f89041e31516d9ad98f66c22f75d11a0b9342474d5c7",
         "quantcortex/backtest/engines/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
@@ -58,7 +58,7 @@
         "quantcortex/backtest/validation/multiple_testing.py": "6b68f6f150dcc8fb90213dcf769307454c0c506e99666a533d5d07ae3ccb0b5d",
         "quantcortex/backtest/validation/survivorship_check.py": "5b772bd6b40ffe44f590ec0ddb00b7e3dc61a1aba9cae8831227325f4f53beff",
         "quantcortex/data/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-        "quantcortex/data/local_csv.py": "30c11c3200530810b3345f8e29fdf966f35671e30c94fc5bb1b2db656e6df79b",
+        "quantcortex/data/local_csv.py": "6e5f3d24b1477ce122a1e80899e841fffd6d857034189f7d8605705f52c6839c",
         "quantcortex/data/processors/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
         "quantcortex/data/processors/adjustments.py": "ae2d4d0362e3484b89b5a5c57a7fd6320973b208ee0cd5a6be9a3f29d2544e2c",
         "quantcortex/data/processors/calendar.py": "e591bccc3e7f632501b068e7abec1ece182d0ef930589381776fe89158d1df51",

paper/README.md

@@ -38,11 +38,16 @@ scripts/release_paper_artifacts.sh \
 ```
 
 The input must contain `QQQ`, `VGT`, `GLD`, `TLT`, `SPY`, `VIG`, and `SHV` and
-must match the SHA-256 digest in `results/manifest.json` for exact
-reproduction. The wrapper requires committed tracked source, regenerates the
-reviewed `docs/img/` gallery and paper experiment in a detached clean worktree
-with the input mounted outside it, verifies the recorded source commit and clean
-start state, then copies reviewed artifacts back. The
+must match the SHA-256 digest in `results/manifest.json`; the release wrapper
+rejects another matrix rather than attaching the reviewed provenance to it. It
+uses the recorded source commit and timestamp when all release-critical paths
+are unchanged, so the final artifact commit can reproduce without timestamp-only
+drift. Changed experiment, report, or paper source must set
+`QUANTCORTEX_GENERATED_AT` explicitly; that creates a release from current
+`HEAD`. The wrapper requires committed tracked source, regenerates the reviewed
+`docs/img/` gallery and paper experiment in a detached clean worktree with the
+input mounted outside it, verifies the recorded source commit and clean start
+state, then copies reviewed artifacts back. The
 fixed experiment requires complete rows, performs no forward fill, and rejects
 fewer than 274 pre-evaluation sessions. Raw provider data is not committed.
 Aggregate tables, generated LaTeX values, figures, the explicit experiment
@@ -58,6 +63,9 @@ and 63-session sensitivity results. `sharpe_uncertainty.csv` directly resamples
 the conventional sample Sharpe statistic. `comparator_diagnostics.csv` records
 the causal target-exposure comparator after its own costs, while
 `evaluation_contract.json` records the machine-readable semantics.
+`target_tape_hashes.json` records the canonical payload hash, decision count,
+record count, and symbol set for every audited strategy variant without
+publishing the underlying provider matrix.
 
 The primary accounting path is the event-driven engine. It holds explicit
 adjusted-close pseudo-shares between rebalances, sizes targets against post-cost

paper/build_manifest.json

@@ -1,18 +1,18 @@
 {
   "anonymous_pdf": {
     "path": "quantcortex_audit_anonymous.pdf",
-    "sha256": "1ee5d885f03316f70c06dd0c9a7e2cd18ef352f83a7045077925c1f767bf20f9"
+    "sha256": "3bf902d420224032fa11492ddb4f8d3b636972f4a3d7740e4b7aef4bbf8484ff"
   },
   "pdf": {
     "path": "quantcortex_audit_neurips2026.pdf",
-    "sha256": "d43a4c75a1b49b3d2c5e703128e5208be60688e8b1d3bd20c51a3ebbb29e6ede"
+    "sha256": "59fcd30467d449984118d746417d810757d32fbceb72af25d0d4a84a65203000"
   },
   "schema_version": 1,
-  "source_commit": "d185c44928af865882c4d830066432dc97eb9972",
-  "source_date_epoch": 1781647230,
+  "source_commit": "ef6e7e3414aed0ae9b77d50748a22823529486af",
+  "source_date_epoch": 1781820388,
   "source_manifest": {
     "path": "quantcortex_audit_neurips2026.sources.sha256",
-    "sha256": "11096197aee3ed3a6b5505788756789b5deeddee140d3a204c4ed6ac4349b919"
+    "sha256": "ffd76bc58b7b0dd3499cb934a33abd613477478b3fb1fadabb16d5b47b5cbbde"
   },
   "tectonic_bundle": {
     "name": "default_bundle_v33.tar",

paper/main.tex

@@ -319,7 +319,9 @@ \subsection{Reference implementation and order-state controls}
 versions, dependency lock, input SHA-256, experiment design, source-tree hashes,
 and the hash of every published table and figure. A versioned JSON contract and
 canonical long-form target-tape schema make the engine boundary machine
-readable; deterministic fixtures exercise it without using the empirical price
+readable. The fixed experiment round-trips every strategy decision stream
+through the versioned payload boundary and records a canonical payload hash;
+deterministic fixtures test the same boundary without using the empirical price
 matrix. The empirical sections below exercise the
 research and backtest contracts. Order-state controls are verified by
 deterministic tests: paper-trading state is written atomically as a versioned

paper/quantcortex_audit_anonymous.sha256

@@ -1 +1 @@
-1ee5d885f03316f70c06dd0c9a7e2cd18ef352f83a7045077925c1f767bf20f9  quantcortex_audit_anonymous.pdf
+3bf902d420224032fa11492ddb4f8d3b636972f4a3d7740e4b7aef4bbf8484ff  quantcortex_audit_anonymous.pdf

paper/quantcortex_audit_neurips2026.sha256

@@ -1 +1 @@
-d43a4c75a1b49b3d2c5e703128e5208be60688e8b1d3bd20c51a3ebbb29e6ede  quantcortex_audit_neurips2026.pdf
+59fcd30467d449984118d746417d810757d32fbceb72af25d0d4a84a65203000  quantcortex_audit_neurips2026.pdf

paper/quantcortex_audit_neurips2026.sources.sha256

@@ -1,9 +1,9 @@
-bbd36070a922fae4569f654b6b905a710c3dc8c318636dfa934ea82842e57d9a  main.tex
+26c3a3aac4ded1b4db38503857a8627d6d7b95d851f8b11897f303d4c6e01618  main.tex
 9ef5395fcb6993271813e21c97ea594bfc45b5f8dcc9ec52fc4e16a809a0091a  anonymous.tex
 4bb1dc333bc0b23fb706bc5755b2cef765a2757284798d6ed9d090d530b47f6e  checklist.tex
 c0c907c664fe2629306b7c07973747b44dc1c04f9ead03ffd292719374e1f531  references.bib
 0c1ad36961fcd9198dcc2558cf2793e1df39973bde8264fd701f5e7970672757  neurips_2026.sty
-f14a548364f13b40e75d44c2eb2c3aa0965668ac35a6acd30d22ef207abb1fdf  results/generated_values.tex
+98611c031c54382859488367dc1f5474a283014e3db2867f8210dab49ac85f25  results/generated_values.tex
 83aea7fe6e6a97b55f8fe4b00218ae11972902947ed058d8281d40cb1d6e6f3c  figures/accounting_summary.pdf
 a2a0284f9c0687ba6ff52b4a8077189d7a2ba21b63e5e77c4287639b6bbc23b4  figures/audit_protocol.pdf
 de3901b50dba906bc418660a4de8983ad311a0d4ed12b946e4d12b104435e4e2  figures/bootstrap_robustness.pdf

paper/results/generated_values.tex

@@ -4,7 +4,7 @@
 \newcommand{\PaperRequiredWarmupSessions}{274}
 \newcommand{\PaperBootstrapReplications}{5,000}
 \newcommand{\PaperInputDigest}{efb384a62157e56a0cd8065abf45c1ed07d90ec26c681e5d54d74fe4cb9c55e1}
-\newcommand{\PaperSourceTreeDigest}{df200735ec35013b252a3aa689752b9eae485c21abe7247bc590c444f18221b6}
+\newcommand{\PaperSourceTreeDigest}{044c219b82295b187b92a7044757289faf91757d276206fe6abdec5d52252e60}
 \newcommand{\PaperNetCAGR}{1.40\%}
 \newcommand{\PaperGrossCAGR}{3.17\%}
 \newcommand{\PaperCashCAGR}{2.50\%}

paper/results/manifest.json

@@ -20,15 +20,81 @@
     "results/cost_sensitivity.csv": "25b9969cf8ecdabd19e7761ad2973252c9f5b9f994b6dc147595a2a112c24d88",
     "results/engine_comparison.csv": "ea0322dcd2aa4a1eb3b5996045c3a4b2ed25a85684a578ee788b013b99b643cd",
     "results/evaluation_contract.json": "77ee05ce64622ef9ba1bfbd7dae85c4f6fd44f07db0b21feaf6b3e0e418673e7",
-    "results/generated_values.tex": "f14a548364f13b40e75d44c2eb2c3aa0965668ac35a6acd30d22ef207abb1fdf",
+    "results/generated_values.tex": "98611c031c54382859488367dc1f5474a283014e3db2867f8210dab49ac85f25",
     "results/protocol_switches.csv": "20d5a0dc37e07a20c1f2772c8e9940ff6464ef1da98692edd5fdb06531bc2393",
     "results/return_decomposition.csv": "53a84aa9b91c92f0037e48dc09154807cbf003ccf0038f39da8406108bf709cc",
     "results/sharpe_uncertainty.csv": "aead873ced9b25c76c6944aa6e3ba0901ade65c784fa5cb8cc10ad1c6c01f136",
     "results/subperiods.csv": "9e6206fd38422640b4539e1207aade8821c2ee474af18e74268cb4bf69c249db",
+    "results/target_tape_hashes.json": "7eac818e4f37ed936561138c9a00f2038b6051723673a0162b609b2ae64bca03",
     "results/uncertainty.json": "6a6a0aa9a02def987f09de273d99cb28a6929cedf090d6245e2e1fa818d2c54a",
     "results/yearly_returns.csv": "53cfee7bb987c332b9db1766619b0eb085415e358724872a77ebd6c5f1ed6256"
   },
   "configuration_sha256": "20ab6c2850734e9c7a44eae17b4c3f7db4dbfda18d85cb9ecd9fcc729b475128",
+  "decision_streams": {
+    "path": "results/target_tape_hashes.json",
+    "variants": {
+      "full": {
+        "canonical_payload_sha256": "a5c103d7d53dbc538971a7f85674843e5ace76ea10e4e09cc061f6bc9a05aaf4",
+        "decision_count": 521,
+        "max_gross": 1.0,
+        "record_count": 3126,
+        "schema_version": 1,
+        "symbols": [
+          "GLD",
+          "QQQ",
+          "SPY",
+          "TLT",
+          "VGT",
+          "VIG"
+        ]
+      },
+      "no_regime": {
+        "canonical_payload_sha256": "cdbf2c1a4a500589ed0ee3b4954c2b85b9774bffd7fd046d77359a25c0908280",
+        "decision_count": 521,
+        "max_gross": 1.0,
+        "record_count": 3126,
+        "schema_version": 1,
+        "symbols": [
+          "GLD",
+          "QQQ",
+          "SPY",
+          "TLT",
+          "VGT",
+          "VIG"
+        ]
+      },
+      "no_vol_scaler": {
+        "canonical_payload_sha256": "faeb6bca8e7a467d670b0be6ad1cbd44192e468b159c1a30456afa4dcf58c7fa",
+        "decision_count": 521,
+        "max_gross": 1.0,
+        "record_count": 3126,
+        "schema_version": 1,
+        "symbols": [
+          "GLD",
+          "QQQ",
+          "SPY",
+          "TLT",
+          "VGT",
+          "VIG"
+        ]
+      },
+      "signal_only": {
+        "canonical_payload_sha256": "0746243609426143207f8c42a83026fb4f78c6564d893e57cab56831c7c18a69",
+        "decision_count": 521,
+        "max_gross": 1.0,
+        "record_count": 3126,
+        "schema_version": 1,
+        "symbols": [
+          "GLD",
+          "QQQ",
+          "SPY",
+          "TLT",
+          "VGT",
+          "VIG"
+        ]
+      }
+    }
+  },
   "design": {
     "all_in_cost_levels_bps": [
       0.0,
@@ -174,14 +240,14 @@
     "path": "results/evaluation_contract.json",
     "schema_version": 1
   },
-  "generated_at": "2026-06-16T22:00:41Z",
+  "generated_at": "2026-06-18T22:06:35Z",
   "generator": {
     "dependency_lock": {
       "path": "poetry.lock",
-      "sha256": "fa8904674c2b24f3141acae607fd0a49d97125bc109c18def9fccbb2256c8de0"
+      "sha256": "abce2cd132651851d81034dea085d7dbfbe5e44321f2e13997db69f46d7f080b"
     },
     "git": {
-      "source_commit": "d185c44928af865882c4d830066432dc97eb9972",
+      "source_commit": "ef6e7e3414aed0ae9b77d50748a22823529486af",
       "worktree_clean_at_start": true
     },
     "packages": {
@@ -195,12 +261,12 @@
     "path": "scripts/run_paper_experiments.py",
     "platform": "macOS-26.4-arm64-arm-64bit-Mach-O",
     "python": "3.14.4",
-    "script_sha256": "2f7c00e1d387d7efde57c0264d3cd702176af2fa94e5f5646309b0641ddb34bc",
+    "script_sha256": "922bf3c414e0eadca5c13ee831528347dd83a0cd174efbdf15a987b511845de5",
     "source_tree": {
-      "file_count": 109,
+      "file_count": 110,
       "files": {
-        "poetry.lock": "fa8904674c2b24f3141acae607fd0a49d97125bc109c18def9fccbb2256c8de0",
-        "pyproject.toml": "175abd743d38f6b6c1cc8ae42471d62d83c86beb245d93fea231c666f51b2643",
+        "poetry.lock": "abce2cd132651851d81034dea085d7dbfbe5e44321f2e13997db69f46d7f080b",
+        "pyproject.toml": "eaeeb454c28bf7f6d9e530002bb7e88624b56b6c3e1fcb71e6414045cb9c42a0",
         "quantcortex/__init__.py": "14bf1ebdacd054c3738e4704d33da6709a39206463df8b8ced5376da342c4036",
         "quantcortex/alpha/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
         "quantcortex/alpha/factors/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
@@ -224,7 +290,7 @@
         "quantcortex/alpha/validation/alphalens_report.py": "8463289117add78a576e37a5b99a539be5c808fca86100e26deb29e8060aa60d",
         "quantcortex/alpha/validation/factor_decay.py": "9e6e049165f014db2122d9ed57415e45e48142b475dfb7221247d447d9a50397",
         "quantcortex/backtest/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-        "quantcortex/backtest/conformance.py": "e169cc67cac9eb56d8da4e4a0da1e257bb6cb8d1745baca681f50fab6c62fc57",
+        "quantcortex/backtest/conformance.py": "22f9b18101f0d9adcae98297e395c1ab6a90b18e411f24e7456f1d166b7df9b5",
         "quantcortex/backtest/costs/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
         "quantcortex/backtest/costs/transaction_costs.py": "48200419f37004c58df6f89041e31516d9ad98f66c22f75d11a0b9342474d5c7",
         "quantcortex/backtest/engines/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
@@ -245,7 +311,7 @@
         "quantcortex/backtest/validation/multiple_testing.py": "6b68f6f150dcc8fb90213dcf769307454c0c506e99666a533d5d07ae3ccb0b5d",
         "quantcortex/backtest/validation/survivorship_check.py": "5b772bd6b40ffe44f590ec0ddb00b7e3dc61a1aba9cae8831227325f4f53beff",
         "quantcortex/data/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-        "quantcortex/data/local_csv.py": "30c11c3200530810b3345f8e29fdf966f35671e30c94fc5bb1b2db656e6df79b",
+        "quantcortex/data/local_csv.py": "6e5f3d24b1477ce122a1e80899e841fffd6d857034189f7d8605705f52c6839c",
         "quantcortex/data/processors/__init__.py": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
         "quantcortex/data/processors/adjustments.py": "ae2d4d0362e3484b89b5a5c57a7fd6320973b208ee0cd5a6be9a3f29d2544e2c",
         "quantcortex/data/processors/calendar.py": "e591bccc3e7f632501b068e7abec1ece182d0ef930589381776fe89158d1df51",
@@ -305,11 +371,12 @@
         "quantcortex/timing/kama.py": "ffb848ba93041af1e04f2b7896ea7a8f33ac7e5e3e53db1e44f53af111829eda",
         "quantcortex/timing/tsmom.py": "c78ac313268091f45e0e589067f12e07e8a340fa243b8fae2853778ef4ba8ea9",
         "quantcortex/timing/vix_scaler.py": "a3667424e5573fb289e63c26c69da6a68d6c943742359f0466d29b25c56e3686",
-        "schemas/canonical_target_tape.schema.json": "81acbd7e03163ea0dc28f7b1a4bd2a73a4bbeef85dbdbc70aee01aa100c4e7e5",
+        "schemas/canonical_target_tape.schema.json": "4f1c0bf6d5360305d2982adea78de3f61c4bc1ebae9207cb2ba2bd4379b43d44",
         "schemas/evaluation_contract.schema.json": "970f24f587e669925306625d12c5a84dffd03ff5b222a59905849b2fa222784f",
-        "scripts/run_paper_experiments.py": "2f7c00e1d387d7efde57c0264d3cd702176af2fa94e5f5646309b0641ddb34bc"
+        "scripts/release_paper_artifacts.sh": "cf3de9434ab3991598e0c8d1d2c9346fde425fdf1eb792a6941fede0c66342e9",
+        "scripts/run_paper_experiments.py": "922bf3c414e0eadca5c13ee831528347dd83a0cd174efbdf15a987b511845de5"
       },
-      "sha256": "df200735ec35013b252a3aa689752b9eae485c21abe7247bc590c444f18221b6"
+      "sha256": "044c219b82295b187b92a7044757289faf91757d276206fe6abdec5d52252e60"
     },
     "threadpools": [
       {
@@ -321,7 +388,7 @@
       }
     ]
   },
-  "schema_version": 4,
+  "schema_version": 5,
   "source": {
     "adjustment_method": "yfinance adjusted close with auto_adjust=False",
     "cash_proxy": "SHV",