What you are inheriting

What transfers

The database, and what it means for the track record

The calibration record is the product's strongest claim — 264 boundary breaches in 4,975 scored EUR/USD readings, 5.3% against a declared 5%, plus 220 in 3,922 for gold. That record lives in the database, not in the code.

Which means there is a choice to make, and it should be made explicitly rather than assumed:

There is no wrong answer. There is only an answer that has to be agreed. ApiKeys is empty at handover — any key you mint afterwards is a live machine credential of yours.

Settings with no safe default on your infrastructure

The full reference lists every configuration section the code reads. These are the ones that will stop you.

The one thing that catches people

ConnectionStrings__Quant=Data Source=/data/quant.db

Behaviours that read as bugs if nobody tells you

"Generate report" needs two processes, not one

The dashboard serves the page and queues the work. The process that performs it is a hosted service inside the bot host. Run the dashboard alone and every request is accepted, stored, and never executed.

# both, not one
dotnet run --project QuantMarketEngine/src/QuantMarketEngine.Dashboard --urls http://localhost:5199
dotnet run --project QuantMarketEngine/src/QuantMarketEngine.TelegramBot

And the report does not appear the instant you press the button. The page returns immediately and says the instrument is being analysed. The worker picks the job up and takes five to ten seconds. Then you refresh — there is no live update and the page does not poll.

Someone who presses the button and stares at an unchanged table will conclude it did nothing. That is the single most likely first impression to get wrong.

The human approval gate — the precise claim

Every report the engine publishes on its own schedule waits for a person, and a reading its own checks call unfit is never published by any route.

One route is deliberately exempt: a report a subscriber requests from the reports page is generated and published without waiting for an operator. That is an owner decision rather than an oversight — a subscriber who has to wait for someone to notice cannot use the button. Its pre-publication checks still apply, so a stale bar never goes out as today's market.

The scheduled run, the event-driven watcher and the operator's own "Report now" all stop at the gate.

PDF export needs a browser on the host

It prints through headless Chrome or Edge. The Docker images do not include one, so PDF export is off in a default container until a browser is installed and PdfExport:BrowserPath is set. The link hides itself, the endpoint answers 503, and the text and JSON exports are unaffected.

In a container you may also need PdfExport:NoSandbox=true — Chrome's sandbox needs kernel namespaces a container running as root usually does not have. It is off by default because the flag makes the feature work everywhere and weakens it everywhere, which is the operator's decision rather than a default to inherit.

The PDF is English only. Arabic in a PDF needs bidirectional layout, and the rasteriser reverses digits inside a mixed Arabic/Latin run. The Arabic report is delivered as text instead.

The dashboard screens are English; the content is not

Report downloads on the platform are English by design. Arabic is still produced everywhere else — on disk, on Telegram, on the public site, and from the API's ?lang=ar. Bilingual rendering from one engine is one of the product's buyer profiles, not something that was removed.

The security policy forbids all JavaScript

script-src 'none' is correct today because the dashboard is static server-rendered Blazor with no JavaScript at all. Adding @rendermode InteractiveServer to any component will break the policy until it is widened. This is stated in the middleware and covered by a test, so you find out at build time rather than in production.

Known limits, stated plainly

• No customers and no revenue. This is an asset sale.
• The billing integration has never processed a real transaction. Stripe hosted Checkout, the hosted Billing Portal and a signature-verified webhook are all implemented behind a provider interface, and card data never touches the platform. The gap is a live card, not the code.
• Silver runs on the engine but is not scored yet. Its feed carries no intraday range, so several readings are deliberately withheld rather than estimated, and its calibration still reads "sample too small". Gold shares the feed shape and settles at FAIR market quality. This is a data limit, not an engine limit — more history does not move it; a provider with intraday movement does.
• The probability cone is the weakest surface, and the report says so itself. EUR/USD's 20-day lower edge runs 6.3% against 5%; gold's upper edges run worse. The daily VaR — the headline figure — passes on both.
• Three sections ship disabled: fundamental analysis, the event-driven trigger, and parts of the economic calendar. All three are configuration values rather than missing code. The calendar currently carries 14 central-bank and US releases through 17 December 2026, after which it goes quiet until the list is extended.
• 38 of 166 engine constants have no written justification. They are catalogued as such, the count is published rather than hidden, and none of them reaches the client-facing page. The other 128 carry their derivation or their measurement.

Your first hour — how to check all of this yourself

Nothing above asks to be taken on trust. These commands run against the repository you receive.

cd QuantMarketEngine/src/QuantMarketEngine.TelegramBot && python -c "
import sqlite3
c=sqlite3.connect('quant.db')
for s, in c.execute('select distinct Symbol from AnalysisOutcomes order by Symbol'):
    t=c.execute('select count(*) from AnalysisOutcomes where Symbol=?',(s,)).fetchone()[0]
    b=c.execute('select count(*) from AnalysisOutcomes where Symbol=? and VaRBreached=1',(s,)).fetchone()[0]
    if t>=200: print(f'{s}: {b}/{t} = {b/t*100:.1f}%')
"

cd QuantMarketEngine && dotnet test --nologo -v q

git rev-list --count HEAD && git ls-files '*.cs' '*.razor' | xargs wc -l | grep -w total | awk '{s+=$1} END {print s}'

cd QuantMarketEngine && dotnet list package --vulnerable --include-transitive

cd QuantMarketEngine/src/QuantMarketEngine.TelegramBot
dotnet run -- report        # writes 5 files per symbol into reports/
dotnet run -- audit         # the calibration cards — the engine grading itself