feat: add offline legacy profile index schema

[Pigbibi]

Scope

LI0 only: offline schema/validator and synthetic inventory transformation.

• Versioned index maps domain/canonical profile to observed safe one-segment raw prefixes.
• Backend-qualified inventory metadata, deterministic digest, completion flag, collision report.
• Strict path validation and sanitized diagnostics.
• Explicit local synthetic directory/key-list inputs only; no network, credentials, object-store client, production scan, or publish.

Spec: /Users/lisiyi/Documents/Codex/2026-07-14/ba-2/outputs/soxl_tqqq_legacy_profile_index_redesign_v1_2026-07-14.md PR-LI-0
Commit: 8e6002027cb915cf446dadc07da2b70b75b4414f

Non-goals

No PerformanceStore integration, timing codec, caller/orchestrator, capability/persist_mode/ephemeral/exporter/live changes.

Validation

5 focused tests; full 601 passed, 1 skipped; ruff, compileall, diff-check passed.

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: blocking findings were cleared by independent Codex arbitration

⚖️ Codex Review Arbitration

✅ clear: The prior blocking finding is fixed in the cumulative diff: build_index_from_keys() now accepts nested backtest artifacts with len(parts) < 4 as the rejection check and has an explicit test for nested paths in tests/test_legacy_profile_index.py. The first current finding is not supported by the source of truth: canonical_profile_id() in src/quant_platform_kit/strategy_lifecycle/capabilities.py is a local pure alias table that raises only CapabilityError for unsupported profiles, and legacy_profile_index.py calls it only after _safe_prefix() has already constrained inputs to safe strings, so the asserted hidden-failure path is speculative rather than a demonstrated current bug. The second current finding is also not contract-backed: index_from_dict() publicly returns a mutable dict[str, Any], and neither the schema, tests, nor documentation require the returned value to be deeply detached or immutable after validation; the function only guarantees validation on entry and digest checking at that moment. The current findings therefore are not proven valid against the present cumulative PR diff.

ℹ️ Other Findings

1. 🟡 [MEDIUM] Security in src/quant_platform_kit/strategy_lifecycle/legacy_profile_index.py

build_index_from_local_fixture() uses root.rglob("*.json") without rejecting symlinks. A caller can place symlinked JSON files (or symlinked subtrees, depending on platform behavior) under the synthetic fixture root and cause the scan to ingest paths backed by files outside the intended fixture tree, violating the module's stated "explicit synthetic directory only" boundary. (line 104)

Suggestion: When walking the fixture tree, reject symlinked files/directories or resolve each candidate and ensure it stays under root.resolve() before including it in the exported key list.

---

Review by Codex PR Review bot • PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e6002027c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c88a7beae5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject empty profile prefix entries

When a hand-edited/exported index recomputes the digest with prefixes: [] and every backend_prefixes list also empty, this validator accepts a profile entry the builder never emits. In a complete inventory that can make downstream consumers treat a canonical profile such as SOXL as indexed while there are no observed legacy prefixes to migrate or diagnose; fail closed on not normalized_top instead of accepting an empty entry.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Require the advertised backends field

Because this defaults a missing inventory.backends to [backend], an externally supplied index can recompute its digest and pass validation without the backends field that build_index_from_keys emits as part of the schema. Any downstream consumer that trusts index_from_dict to return the v1 shape and reads validated["inventory"]["backends"] will still hit a missing key, so the validator should fail closed when backends is absent instead of synthesizing it only for internal checks.

Useful? React with 👍 / 👎.