README.md

# EdgePilot Research

Public, account-free strategy discovery and reproducible historical backtesting. This product does not connect trading accounts, accept exchange credentials, or place orders.

## License

EdgePilot Research is proprietary software made publicly installable for personal and organizational internal research. It is not open-source software. Redistribution, republication, resale, sublicensing, and use to provide a competing hosted or managed service require prior written permission from EdgePilot. See [`LICENSE`](LICENSE); third-party components remain governed by [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) and their respective licenses.

The public ZIP is a complete plugin transport archive, not a standalone Skill ZIP. Build both `edgepilot-research-openai-VERSION.zip` and `edgepilot-research-claude-VERSION.zip` together with `scripts/package_research.py --target all --package`. The command shares one fast remote HEAD/range verification and commits neither archive unless both pass. Both contain one Skill at `skills/edgepilot-research/SKILL.md`; the Claude build renders `${CLAUDE_PLUGIN_ROOT}` paths from that single source during packaging. Do not maintain or install a second copy of the Skill.

The plugin deliberately contains no third-party wheels. On a supported local-execution surface, run `skills/edgepilot-research/scripts/install_runtime.py`. It selects the immutable platform entry in `runtime-lock.json`, shows cache hits, matching local-wheelhouse files, and only the downloads still required before consent. `--wheelhouse /path/to/wheels` may supply any subset of locked files; every supplied file is still checked by exact filename, size, and SHA-256. The installer installs the complete locked wheelhouse without resolving dependencies at install time. The customized NautilusTrader wheel comes from EdgePilot; locked public dependency wheels come directly from `files.pythonhosted.org` and are not mirrored by EdgePilot. The host must already provide the CPython minor version named by that entry.

Installation reports each cache/download file and the venv, install, verification, and activation stages. Run the bundled installer once for each newly installed or upgraded plugin version; its content-addressed release selection makes this idempotent and prevents an older active release from hiding plugin updates. After it succeeds, run backtests and the Dashboard only through the stable state-directory launcher (`~/.edgepilot-research/bin/edgepilot-research` on macOS or `%APPDATA%\EdgePilotResearch\bin\edgepilot-research.cmd` on Windows). The Dashboard default is `127.0.0.1:8686`, records one verifiable local instance under the Research state directory, and refuses a second instance even on another port. Runtime first-use setup is driven by the Skill after explicit native-install consent; the Dashboard does not expose a runtime installer over HTTP.

Runtime, strategies, catalog data and runs are isolated under `~/.edgepilot-research/` (or `%APPDATA%\EdgePilotResearch` on Windows). The installer writes `bin/edgepilot-research` and, on Windows, `bin/edgepilot-research.cmd`. After installation, run that launcher by absolute path for every command, including `runtime status`, `backtest`, and `ui`. Do not invoke the plugin with host Python or `python -m edgepilot_research`; that skips the locked venv, so the Dashboard can report a local runtime while backtests fail with `edgepilot-backtest-core is unavailable`. `runtime repair` validates state and rewrites the launcher; `runtime uninstall --yes` removes only runtime files and preserves strategies, catalog and runs.

The first release lock supports macOS arm64 with CPython 3.12 (206,943,606 bytes across 15 wheels) and Windows amd64 with CPython 3.12 (159,195,940 bytes across 15 wheels). Linux is not in the first release: the existing CPython 3.14 Nautilus wheel cannot currently form a binary-only dependency closure because a compatible `msgspec>=0.21.1` wheel is unavailable. Unsupported platforms fail before downloading anything.

Backtests execute the installed package's formal `strategy.py` through NautilusTrader using the Manifest V2 benchmark preset. The CLI and Dashboard allow 90-day or 365-day periods, defaulting to 90. Before execution, Research uses the preset's exact Binance Futures instrument and bar type to download public bars into an atomically replaced local catalog; it does not read credentials or initialize an execution client. Unsupported venues fail explicitly. CSV data import remains available for a local file and explicit Nautilus instrument JSON, and arbitrary data URLs are never accepted.

Online catalog access is anonymous and limited to `/api/research/**`. Catalog search, inspection, formal three-card recommendations and package download do not require an installed runtime and do not send runtime-lock metadata to the Marketplace service. The recommendation endpoint accepts only the V2 seven-answer questionnaire and locale, does not accept the optional note, and does not persist questionnaire answers. Results are research artifacts, not investment advice.

After installation, the Codex plugin exposes `Help me choose a strategy` and `Show me the available strategies` as its two starting prompts. The Skill responds in the user's conversation language and keeps guiding from discovery into the V2 questionnaire. When the host can send an anonymous HTTPS POST, it uses `/api/research/recommendations`, whose three cards are scoped to Research/all exact versions. When the host cannot POST, it preserves the answers and offers anonymous catalog browsing; it only points to an already available Research Dashboard and never installs the runtime merely to obtain a recommendation. It never copies the ranking algorithm, requires login, or falls back to Live.

The Dashboard Marketplace includes **Find the right strategy**. Its independent page collects seven canonical answers plus one optional in-memory note, displays the complete three-card response, and can install or update the chosen exact version before opening its benchmark preset workspace. It does not automatically install the runtime, download data, or start a backtest. A catalog change between recommendation and installation is reported explicitly; the Dashboard never substitutes another card or version.

The local Dashboard is built from `ui/` and distributed as production assets under `src/edgepilot_research/ui_assets/app/`. Before packaging, run `cd ui && npm ci && npm test && npm run lint && npm run build`; packaging rejects a missing HTML shell, missing or unhashed JavaScript/CSS references, external script/style references, and source maps. Do not edit generated assets directly.

The Dashboard requires anonymous outbound HTTPS access to the Research Marketplace for its entire process lifetime. It checks catalog connectivity before binding its loopback port, so a sandboxed launch fails explicitly instead of serving a page whose Install button cannot work. On permissioned agent surfaces, grant network access before starting the generated launcher (`~/.edgepilot-research/bin/edgepilot-research ui` or `%APPDATA%\EdgePilotResearch\bin\edgepilot-research.cmd ui`); browser choice does not grant network access to the local Python backend.

A current Dashboard can be restarted safely with the stable launcher's `ui --stop` command, which requires its private instance record and `/api/health` identity to agree. The underlying loopback stop endpoint accepts no PID and refuses to stop while a backtest is queued or running. Dashboards from older plugin versions do not have this identity protocol and must be closed through an already-owned host process handle or by the user before restart.

## Release status

The runtime-download design is implemented in this repository, but public-directory acceptance is an external release gate. Packaging success does not mean that ChatGPT or Codex has approved local process execution, native wheel installation, runtime downloads, or every target surface. Before publishing, complete the checklist in [`../docs/research-v2-release.md`](../docs/research-v2-release.md), including native tests, license/SBOM review, HTTPS hosting, directory security scans, and end-to-end tests on every advertised surface. Unsupported surfaces must not be advertised.

- Privacy: https://edge-pilot.rivendell.capital/privacy
- Terms: https://edge-pilot.rivendell.capital/terms
- Support: https://edge-pilot.rivendell.capital/support
- Support email: agent_strategy@rivendell.capital
- Research OpenAPI: https://edge-pilot.rivendell.capital/openapi/research.json