TickFlow Stock Quant Workbench

Evidence shows: README clearly states it is a personal open-source project, not an official TickFlow project, and warns it is for learning/research only, prohibiting commercial use; Docker deployment explicitly notes Codex credentials are mounted read-only and warns to enable only in trusted environments; configuration requires manual API key entry, and leaving blank disables AI. However, there is no clear least-privilege design (e.g., non-root container), user confirmation mechanisms (e.g., second confirmation for critical actions), data flow transparency (e.g., explicit disclosure of data sent to third-party AI), sensitive data handling details (e.g., API key encryption), dependency security audits (e.g., vulnerability scanning), external effect controls (e.g., network request whitelist), rollback mechanisms (e.g., data backup/recovery), and source attribution (e.g., third-party data source licenses). Thus each criterion scores 1 due to insufficient evidence or partial mention.

Evidence shows: README and test files describe functional modules (screener, backtest, monitor, etc.) consistent with code structure; test files demonstrate tests for backtest engine, cost model, dependency resolution, indicating good internal consistency. However, dependency availability is limited by reliance on TickFlow data source and AI APIs; if these services are unavailable, functionality is restricted, and no offline fallback is provided. Failure messages: tests include error assertions, but no user-visible error prompt design is shown. Therefore self_consistency scores 2, dependency_availability and failure_messages score 1.

Evidence shows: README explicitly targets individual retail investors and quantitative enthusiasts, offers multiple deployment methods (Dev, Docker, desktop client), and supports custom data sources and strategies, adapting to different scenarios. Capability boundaries are clear: explicitly states it does not do AI stock recommendations or limit-up prediction, and warns beginners to avoid. Trigger precision: monitoring rules support multi-condition AND/OR, but detailed configuration precision is not specified. Environment fit: supports Windows, macOS, Linux, and considers old CPU compatibility, but browser compatibility is not mentioned. Therefore audience_and_scenarios, capability_boundaries, environment_fit score 2, trigger_precision scores 1.

Evidence shows: README structure is clear, including quick start, core features, configuration, documentation links, etc., indicating good information architecture. Installation notes are detailed, providing Dev, Docker, desktop client methods, and environment dependencies. Naming stability: project and module names are consistent in README, but no version history or naming conventions are provided. Examples and FAQ: interface screenshots and documentation are present, but FAQ is missing. Known limitations are clear: states it does not constitute investment advice, backtest results do not represent future returns, and warns beginners to avoid. License is MIT, but copyright year is 2026, which may be inaccurate. Versioning/changelog: roadmap exists but no formal changelog. Maintenance responsibility: README provides email and community links, but maintainer identity is not clear. Therefore information_architecture, install_notes, known_limitations, license score 2, naming_stability, examples_and_faq, versioning_changelog, maintenance_responsibility score 1.

Evidence shows: Output usability: multiple interface screenshots and feature descriptions indicate diverse output forms (charts, tables, reports), but no actual run verification. Marginal value: provides comprehensive features like screening, backtesting, monitoring, attractive to quantitative enthusiasts, but relies on external data sources and AI, possibly limiting uniqueness. Cost-benefit: self-hosted, zero-maintenance, but requires user configuration and possibly paid data sources; cost-effectiveness is not clear. Therefore output_usability and marginal_value score 2, cost_benefit scores 1.

Evidence shows: README feature descriptions are basically consistent with code structure; test files verify some functionality, but no independent third-party verification. Cross-source corroboration: only relies on README and tests, no external documentation or user reviews. Fact-inference separation: README clearly distinguishes feature descriptions and disclaimers, but some performance claims (e.g., millisecond scanning) lack benchmark tests. Therefore claim_traceability, cross_source_corroboration, fact_inference_separation all score 1.