AlphaLab v3.0.0

AlphaLab v3.0.0

AlphaLab 3 turns the project into one coherent quantitative-research workspace. The release connects market discovery, evidence review, strategy testing, risk planning, and portfolio execution without hiding the deterministic checks behind the AI layer.

Highlights

• One product system. Public product pages, authentication, and 18 protected application routes now share a consistent bilingual design and responsive navigation model.
• Research with provenance. Scanner factors, fine-scan evidence, deeper validation, admission decisions, entry plans, execution state, and position protection remain attached to the research record.
• A clearer operating model. Saved, configured, verified, paper, and live states are displayed separately so a credential is never mistaken for a working connection.
• Professional data presentation. Charts, tables, metrics, filters, progress tracks, empty states, typography, and mobile behavior were rebuilt across Overview, Markets, Research, Strategies, and Trade.
• Deployment made explicit. Supabase provides durable user and pipeline state; the Docker runtime uses one Gunicorn worker so the built-in scheduler has one owner.
• Account recovery and safety. Email password recovery is recovery-session-gated, TOTP MFA is supported, and real entry execution fails closed when durable safety state is unavailable.
• Settings that change behavior. Saved scanner filters, risk mandate, order confirmation, execution offsets, mode, language, and automation preferences now drive the backend instead of acting as display-only controls.

Product map

• Overview: daily brief, activity log, and dependency health
• Markets: whole-market scanner, symbol analysis, and watchlists
• Research: seven-stage automation, candidate universe, and review queue
• Strategies: backtests, optimization, comparison, and rankings
• Trade: order workspace, portfolio performance, exposure, and positions
• Settings: product preferences, data providers, AI provider, and broker connections

The research path is:

Market Scanner → Fine Scan → Deeper Validation → Portfolio Admission → Entry Plan → Execution → Position & Exit

AI review is optional and advisory. Deterministic investability, validation, and risk gates remain authoritative.

Upgrade notes

1. Use Node.js 20+ and Python 3.11+.
2. Refresh frontend/.env and backend/.env from the new example files.
3. Add REACT_APP_SUPABASE_URL and REACT_APP_SUPABASE_ANON_KEY to the frontend. Keep the service-role key on the backend only.
4. Apply backend/supabase_schema.sql, backend/supabase_operations_store.sql, and backend/supabase_security_hardening.sql to the target Supabase project, in that order.
5. Review paper/live Alpaca mode, Safety Center readiness, and all risk controls before submitting an order.
6. Run exactly one web process when using the built-in background scheduler and managed-position guard. A multi-process deployment needs separate workers and distributed ownership.

The previous browser-side broker-mode setting is no longer part of the supported configuration model. Provider credentials are configured per user through the authenticated Connections workspace.

Behavior changes

• Navigation and route ownership now follow product workspaces rather than individual legacy pages.
• Status labels distinguish configuration, verification, connectivity, and runtime availability.
• Pipeline counts show true zero-width progress for zero results.
• Market and research stages persist their evidence and decision state through the shared backend/Supabase contract.
• Historical backtests use corporate-action-adjusted prices by default and fill completed-bar signals at the next tradable open to avoid look-ahead behavior.
• Pipeline history has bounded retention, scanner calls have finite timeouts, and service health reports current RSS rather than lifetime peak memory.
• The backend status endpoint reports product version 3.0.0.
• Production Docker builds use Node.js 20, non-root Nginx, and one Gunicorn worker with four threads on the documented Render Pro profile.

Security

• Removed unsafe-eval from the deployed Content Security Policy.
• Tightened the documented boundary between browser-safe Supabase values and server secrets.
• Updated Supabase RLS policies and grants so browser roles retain owner-scoped reads while validated writes remain behind the backend service role.
• Added private vulnerability reporting guidance, CODEOWNERS, and automated dependency update configuration.
• Upgraded Axios to 1.18.1 and React Router to 6.30.4, then refreshed compatible transitive packages without accepting npm's forced breaking replacement for Create React App.
• Added authenticated ownership checks to scanner, backtest, optimization, environment, operations, and retired legacy trade routes, together with bounded rate-limit state and proxy-aware client addressing.

Validation

The release branch is checked with:

• 64 frontend Jest tests;
• full frontend ESLint and TypeScript checks;
• a production frontend build;
• 293 backend pytest tests covering authentication, password recovery boundaries, durable operations, market scanning, validation, admission, scheduling, execution, and position protection;
• 12 Chromium Playwright smoke, accessibility, redirect-safety, and responsive-authentication checks;
• desktop and mobile review across public and authenticated routes;
• browser entry checks across all 34 public and protected routes.

ESLint completes with no errors or warnings. Final GitHub Actions results are recorded on the release pull request.

Known limitations

• Live data, AI analysis, notifications, and broker execution require external provider accounts and user-supplied credentials.
• The in-process scheduler is not safe to duplicate across multiple web workers.
• Some provider features vary by Alpaca account permissions and data subscription.
• Create React App 5 remains a legacy build toolchain. CI rejects high/critical dependency findings; the remaining low/moderate transitive findings require replacing the build stack rather than applying npm's invalid/breaking forced react-scripts@0.0.0 change.
• Route-level code splitting is implemented. Large chart and data-workspace chunks remain candidates for incremental optimization as their dependencies evolve.
• AlphaLab is research and execution software, not investment advice. Historical and simulated results do not guarantee future performance.

Full comparison

Compare v2.9.2...v3.0.0