chore: auto-update QPK_PIN and pin manifests

[Pigbibi]

Automated update of QPK_PIN and QSL Git SHA pin manifests.

Compatibility checks passed ✅ — all downstream-critical QPK modules verified importable.

Updated SHAs:

• QPK: a06a99f74566ce60ae91fc39317cdfc16558e325
• Strategy repos: latest HEAD from each

🤖 Generated with Claude Code

[github-actions]

🤖 Codex PR Review

🚫 Merge blocked: active blocking history requires independent source-of-truth clearance

⚖️ Codex Review Arbitration

🚫 block: Trusted blocking history remains active because the cumulative PR diff does not demonstrably fix the prior packaging defect. In the current diff, src/quant_platform_kit.egg-info/SOURCES.txt still adds package/test entries including src/quant_platform_kit/strategy_lifecycle/capabilities.py, legacy_profile_index.py, qpk_vnext_n1.py, tests/test_backtest_capabilities.py, tests/test_legacy_profile_index.py, tests/test_qpk_vnext_n1.py, and tests/test_strategy_review_validator.py, but the cumulative PR diff contains no corresponding file additions for any of those paths. Since SOURCES.txt is the sdist manifest contract, this still describes contents not actually merged by the PR, so the prior high-severity release/packaging break is not shown fixed.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 31d353a91a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep generated egg-info out of pin-only updates

In the context where this auto-update is merged to main, this non-pin file change means the push is no longer covered by .github/workflows/update-qpk-pin.yml's paths-ignore list, which only ignores QPK_PIN, qsl-pins.txt, constraints.txt, docs, and Markdown files. That will fire the same pin workflow again and create another pin PR for the pin commit itself instead of stopping at the advertised feature SHA f3e719e; it can also cause duplicate downstream pin-sync PRs. Either drop the regenerated SOURCES.txt change from this pin-only commit or update the generated metadata in the feature commit being pinned.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Align strategy repo pins before publishing constraints

When consumers use this manifest as pip constraints, line 5 constrains QPK to f3e719e while the newly pinned strategy commits still declare their own dependency on QPK 651c9ac in their pyproject.toml metadata (checked UsEquityStrategies@604842, HkEquityStrategies@45ab0d, CnEquityStrategies@a16978, and CryptoStrategies@2aac3a). python -m pip install --help defines -c as “Constrain versions using the given constraints file”, so installing any of these strategy packages under constraints.txt will ask the resolver for two different direct URLs for quant-platform-kit and fail until those downstream commits are repinned first.

Useful? React with 👍 / 👎.