chore(deps): align QPK pin to 2381aa4577e9

[Pigbibi]

Summary

• 自动将 QPK pin 对齐到 2381aa4577e9
• 若仓库使用 uv.lock，同步刷新 lockfile

Test plan

• Repo CI 转绿

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b1a4f5d6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Logic in tests/test_contract_governance.py

The rewritten governance test no longer enforces that quant-platform-kit is pinned to a vetted commit containing the required shared health module. Previously it explicitly rejected an older healthless revision; now any commit will pass as long as pyproject.toml, qsl.toml, and uv.lock all match. That weakens the only guardrail in this PR against accidentally promoting an incompatible or incomplete QPK revision into production. (line 130)

Suggestion: Keep the cross-file consistency checks, but also preserve an allowlist or invariant that validates the pin against an approved QPK revision (or at minimum asserts the presence/version of the required health module capability) so a bad commit cannot pass merely by updating all three files together.

---

Review by Codex PR Review bot • PR