CI and Cloudflare publication

The trading droplet was retired on September 14, 2026. All active checks and Cloudflare publication jobs run on ephemeral GitHub-hosted ubuntu-latest runners. No workflow can restart the trading runtime.

Workflow	Trigger	Checks
CI (Fast)	Pull requests to main	Ruff, format, strict mypy, hermetic pytest
CI	Main pushes and manual	Same plus coverage
Cloudflare Terminal	Web/edge/workflow changes in pull requests and main	Worker authentication tests, frontend lint/static build, Pages Functions build
Security Scan	Security-relevant changes and manual	SBOM and Grype
Backtest regression	Manual definition; disabled in repository UI	Golden tests; no broker credentials

The old nightly/report/watchdog schedules are removed. The droplet API deploy and other historical operations are unconditionally disabled. See hosting and retirement status.

Local validation

Use the repository virtualenv, without loading a broker environment file:

ruff check .
ruff format --check .
make lint
pytest -n auto --dist loadscope -m "not slow and not paper and not integration"
pytest -n auto --dist loadscope --cov -m "not slow and not paper and not integration"

The strict-mypy module subset is listed in both CI workflows. CI excludes tests requiring external services or paper-account credentials; those checks are not required for publishing the Cloudflare app and must not be run against a broker.

The shared setup action caches dependencies separately from historical droplet caches. PostgreSQL and Redis service containers are job-local test fixtures, not production services.

Cloudflare publication jobs use QGTMAI secrets. The web workflow deploys the private qgtm-terminal-api authentication Worker and qgtm-trading Pages project with a service binding. It preserves the existing founder password hashes as Worker secrets and verifies public health plus anonymous-session rejection. A successful software build does not approve trading, strategy promotion, or a replacement runtime.