# Moonfish responsibility and testability

Moonfish is now a governed A-share research and paper-portfolio domain product
with a retained price-action migration foundation. The active product owns
point-in-time eligibility, deterministic factors/ranking, dossiers,
independent bull/bear review inputs, recommendation-plan mathematics,
paper-account evidence, Bookkeeper finalization payloads, and MoonFlow boundary
handoffs. The older price-action packages remain useful as a deterministic
suite-pack reference for evidence, replay, release, rollback, and operations
readiness.

Moonfish does not own a broker, market-order path, licensed data rights,
publication authority, final human approval, MoonFlow storage, MoonBook storage,
MoonClaw runtime internals, MoonGate provider/proxy state, or Moondesk shell
logic.

## Current implementation status

- `moonpack/` is the installable MoonPack distribution for
  `Moonfish Systematic A-Share Research` version `0.20.0`.
- `suitepack/` is the MoonBit manifest source for that distribution and checks
  schema/tool authority boundaries. It exposes `finance.moonfish` as the
  generic Moondesk Finance-area handover contract.
- `cmd/moonfish_service` and `cmd/moonfish_tool` are the native MoonBit service
  and verified pack command. The Python localhost pilot has been removed.
- `ashare/systematic/` and `ashare/systematic_run/` own deterministic scoring,
  ranking, regime, eligibility, exact trading-policy validation, focus-candidate
  selection, and readiness blockers.
- `ashare/technical_alert/` retains the earlier momentum heuristic as an
  explicitly non-investment alert. Its formulas are versioned and visible;
  every result says `follows_policy: false`, `investment_score: false`, and
  `recommendation_eligible: false`.
- `ashare/book_store/` persists append-only request and result records under a
  MoonBook root with confinement, digest, idempotency, and conflict checks.
- `ashare/market_store/` owns a native embedded-SQLite operational projection
  for security identities, revisioned daily bars, committed sessions,
  evidence artifacts, resumable dataset cursors, and shared provider quota.
- `ashare/cninfo_provider/` and `cmd/moonfish_cninfo_backfill` own bounded
  official-public-web disclosure evidence acquisition after the immutable
  basic filter. They preserve raw pages and reported fields, build resumable
  indexes, and never turn title tags into policy conclusions.
- `ashare/candidate_learning/` owns bounded post-filter historical experiments.
  It receives an explicit candidate cohort, cannot enumerate or modify the
  basic-filter universe, and emits only exploratory or rejected parameter
  proposals until historical point-in-time cohort replay and acceptance gates
  are complete.
- `ashare/post_filter_rl/` owns the full-policy post-basic-filter parameter
  experiment. It registers all active atomic source-policy criteria, evaluates
  only criteria backed by historical evidence, and emits explicit unknowns for
  the remainder. Its input cohort is immutable and it cannot enumerate the
  market.
- `ashare/sina_store_adapter/` normalizes full Sina discovery snapshots and
  aggregate quote batches into the market store. Completeness, session date,
  uniqueness, and post-close checks run before commit.
- MoonClaw owns installed workflow intake, authorization, command execution,
  events, retries, and durable job state. Moonfish never creates a parallel
  orchestration store.
- Moondesk discovers `finance.moonfish` from generic installed pack metadata
  and proxies the pack-owned app; it contains no A-share branching.
- The price-action packages remain green under MoonBit tests and expose their
  readiness through `cmd/main -- summary`.

## Recommendation contract

Every systematic input must bind
`moonfish-a-share-trading-policy@2.0.0` by exact SHA-256. The governed objective
searches for a 10x extreme bull scenario within one quarter, or 40–65 trading
sessions, and selects the highest qualified rank for the next session. It is
not the expected return, forecast, or guarantee. The current fixture or
community feed, incomplete point-in-time evidence, missing named review, and
unset owner risk parameters all prevent an investment-ready result.

Tushare is not registered or packaged as an active provider. Native Sina
providers acquire permissioned daily history, current valuation inputs,
financial reports, actions, disclosures, accessibility, breadth, and industry
evidence under explicit request limits. Expensive symbol-level evidence is
fetched only after a completed-price-history acquisition shortlist. This
shortlist is operational prioritization, not a policy pass or investment
score.

The first run bootstraps the security master from the structured 100-row
market-center pages. Subsequent completed sessions use cached symbols and
aggregate quote batches of at most 300, reducing a roughly 5,529-symbol update
to about 19 requests. A failed or truncated large response falls back to
100-symbol batches. SQLite serializes the quota across command processes and
skips already committed sessions.

A qualified long watch is not merely a ticker. Its responsible deliverable
binds the exact security and evidence cutoff to:

- reference/observation price and entry conditions;
- deterministic staged and full goal prices;
- gross and after-cost expected increase rates;
- next valid session plus the installed policy's 40–65-session planned
  sale/expiry horizon, with exact policy/objective/digest binding;
- measurable thesis, catalyst, accounting, governance, liquidity, suspension,
  price-limit, and regime invalidation;
- explicit staged/full/forced exit rules;
- independent reviews and a named-human release decision.

`monitor_only` and `no_qualified_idea` deliberately omit a publishable numeric
target. Numeric targets are code-authored from a versioned policy and cannot be
changed by the language model.

Every decision-producing result must state `decision_class`,
`follows_policy`, `policy_evaluation`, `unknown_metric_handling`, and
`recommendation_eligible`. A technical alert may reuse named policy filters,
but it must list the remaining policy gaps and cannot be presented as a policy
decision. Unknown or unverified metrics remain explicit unknowns and block
qualification; neither deterministic code nor a language model may substitute
an estimate.

## Responsibility boundary

| Concern | Responsible owner | Moonfish behavior |
|---|---|---|
| Market facts and licensing | Approved provider/operator | Record provenance and fail closed when unavailable or unlicensed. |
| Deterministic ranking and target math | Moonfish | Produce replayable calculations under a versioned policy. |
| Thesis language and counter-case | MoonClaw through pack tools | Keep inference separate from reported facts and calculations. |
| Release decision | Named human/licensed structure | Preserve approval; never self-publish a recommendation. |
| Portfolio validation | Moonfish paper account | Simulate bounded fills only; never connect to a broker. |
| Outcome learning | MoonBook Bookkeeper | Send evidence for Three-Gap review; never self-modify weights. |
| MoonFlow closed loop | MoonFlow host | Moonfish emits generic boundary records only; it never imports or writes MoonFlow storage. |
| Price-action migration evidence | Moonfish PA foundation | Retain as parity/archive evidence and tested suite-pack scaffolding, not as the active product direction. |

## Refactored test seam

`decision_action_responsibility` is a pure classification used by the legacy
price-action policy. Passive observations, conditional advisory setups, and a
forbidden executable market-order shape are now explicit rather than inferred
from repeated action checks. The systematic A-share path remains advisory-only
and exposes no broker/order tool in its pack manifest.

Test layers keep deterministic math, policy decisions, provider ingestion,
workflow/replay, paper-account mutation, UI projection, and live licensed-data
acceptance separate. Fixture success cannot satisfy the live-provider or
commercial-release gate.

Current validation evidence:

- MoonBit: `moon check --warn-list +73` and `moon test` pass.
- Pack distribution: the MoonBit `suitepack` test decodes, compares, validates,
  and installs the checked-in MoonPack.
- Installed execution: the generic MoonClaw pack runner verifies the receipt,
  executes `systematic.run`, and reloads the succeeded durable job.
- Persistence: MoonBook retains separate accepted-request and completed-result
  records and returns idempotent retries without rerunning the workflow.
- Operator path: Moondesk catalogs the installed Finance area, opens the
  same-origin app route, and submits the workflow through the native service.
- No product `.py`, `.pyc`, or Python test files remain.