chore: adopt ecosystem qualification

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,80 @@
+name: Bug report
+description: Report reproducible incorrect behavior in ecosystem policy or tooling
+title: "[Bug]: "
+labels:
+  - "type: bug"
+  - "priority: normal"
+  - "status: needs-triage"
+  - "compatibility: affected"
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Search existing issues first. Do not disclose suspected vulnerabilities here.
+  - type: dropdown
+    id: library
+    attributes:
+      label: Affected library
+      options:
+        - data
+        - engineer
+        - backtest
+        - specs
+        - live
+        - diagnostic
+        - models
+        - ecosystem
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Affected package version
+      placeholder: "0.1.0"
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include Python version, operating system, installation method, and relevant extras.
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Provide the smallest complete example and error output.
+    validations:
+      required: true
+  - type: dropdown
+    id: compatibility
+    attributes:
+      label: Compatibility impact
+      options:
+        - Public behavior or results
+        - Python or operating-system support
+        - Cross-library contract
+        - Installation or dependency resolution
+        - No known compatibility impact
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: State the observable conditions that demonstrate the issue is resolved.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/ml4t/data/security/advisories/new
+    about: Report suspected vulnerabilities privately.
+  - name: Usage questions
+    url: https://github.com/orgs/ml4t/discussions
+    about: Ask questions that do not describe a defect or requested change.

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,55 @@
+name: Documentation problem
+description: Report missing, incorrect, or difficult documentation
+title: "[Docs]: "
+labels:
+  - "type: documentation"
+  - "priority: normal"
+  - "status: needs-triage"
+  - "compatibility: none"
+body:
+  - type: dropdown
+    id: library
+    attributes:
+      label: Affected library
+      options:
+        - data
+        - engineer
+        - backtest
+        - specs
+        - live
+        - diagnostic
+        - models
+        - ecosystem
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Package or documentation version
+    validations:
+      required: true
+  - type: input
+    id: location
+    attributes:
+      label: Page or API location
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: State what is missing, incorrect, or difficult to follow.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Required documentation outcome
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,66 @@
+name: Feature request
+description: Request a concrete new or expanded capability
+title: "[Feature]: "
+labels:
+  - "type: feature"
+  - "priority: normal"
+  - "status: needs-triage"
+  - "compatibility: affected"
+body:
+  - type: dropdown
+    id: library
+    attributes:
+      label: Owning library
+      options:
+        - data
+        - engineer
+        - backtest
+        - specs
+        - live
+        - diagnostic
+        - models
+        - ecosystem
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Current package version
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: User problem
+      description: Describe the workflow that cannot be completed or is unnecessarily difficult.
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Required outcome
+      description: State observable behavior without prescribing an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Existing alternatives
+      description: Describe workarounds or related APIs already considered.
+  - type: dropdown
+    id: compatibility
+    attributes:
+      label: Compatibility impact
+      options:
+        - Existing API extension
+        - New cross-library contract
+        - Potentially incompatible behavior
+        - No known compatibility impact
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## Owning issue
+
+Closes #
+
+## Outcome
+
+Describe the user-visible or standards outcome.
+
+## Compatibility
+
+- [ ] No public compatibility impact
+- [ ] Compatibility impact is documented in the owning issue and migration guidance
+
+## Verification
+
+- [ ] Tests reproduce the prior failure or verify the requested behavior
+- [ ] Ruff lint and format checks pass
+- [ ] `ty` passes
+- [ ] Test suite passes
+- [ ] Package build passes when applicable
+- [ ] Strict MkDocs build passes when documentation is affected
+- [ ] Ecosystem qualification passes
+
+## Documentation and release
+
+State the documentation, release notes, and patch-release work required after merge.

.github/workflows/ecosystem.yml

@@ -0,0 +1,23 @@
+name: Ecosystem qualification
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ecosystem-qualification-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qualification:
+    permissions:
+      contents: read
+    uses: ml4t/ecosystem/.github/workflows/qualify-library.yml@457678d8860d0c816b1dc376e7e2691daa93af4d # v0.1.0
+    with:
+      import-package: ml4t.data
+      prerelease-exception: python-315-polars

.github/workflows/release.yml

@@ -18,6 +18,15 @@ env:
   NO_MKDOCS_2_WARNING: "1"
 
 jobs:
+  ecosystem-qualification:
+    name: Ecosystem Qualification
+    permissions:
+      contents: read
+    uses: ml4t/ecosystem/.github/workflows/qualify-library.yml@457678d8860d0c816b1dc376e7e2691daa93af4d # v0.1.0
+    with:
+      import-package: ml4t.data
+      prerelease-exception: python-315-polars
+
   compatibility:
     name: Release Compatibility
     uses: ./.github/workflows/compatibility.yml
@@ -83,7 +92,7 @@ jobs:
   build:
     name: Build Validated Artifacts
     runs-on: ubuntu-latest
-    needs: [compatibility, provider-contracts, quality]
+    needs: [ecosystem-qualification, compatibility, provider-contracts, quality]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

SECURITY.md

@@ -0,0 +1,7 @@
+# Security Policy
+
+Do not report suspected vulnerabilities in a public issue. Use
+[GitHub private vulnerability reporting](https://github.com/ml4t/data/security/advisories/new).
+
+Include affected versions, impact, reproduction details, and known mitigations. Do not publish
+exploit details until coordinated disclosure is complete.

pyproject.toml

@@ -171,6 +171,8 @@ test = [
     "hypothesis>=6.80.0",
     "ty",
     "xlsxwriter>=3.1.0",
+    "oandapyV20>=0.7.0",
+    "requests>=2.32.0",
 ]
 dev = [
     { include-group = "test" },
@@ -180,11 +182,10 @@ dev = [
     "pip-audit>=2.10.1",
     "databento>=0.38.0",
     "yfinance>=0.2.0",
-    "oandapyV20>=0.7.0",
 ]
 
 [tool.uv]
-prerelease = "disallow"
+prerelease = "if-necessary-or-explicit"
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]

tests/test_multi_asset.py

@@ -319,6 +319,7 @@ def test_batch_load_universe_performance_target(self):
         finally:
             Universe.remove_custom("test_perf_10")
 
+    @pytest.mark.slow
     def test_storage_load_100_symbols_performance(self, tmp_path):
         """Test loading 100 symbols from storage completes in <1 second."""
         # Create storage and populate with 100 symbols

tests/test_package_metadata.py

@@ -40,16 +40,17 @@ def test_supported_python_and_platform_metadata() -> None:
     } <= classifiers
     assert "Programming Language :: Python :: 3.11" not in classifiers
     assert "Programming Language :: Python :: 3.15" not in classifiers
-    pydantic_requirement = next(
-        (item for item in project["dependencies"] if item.startswith("pydantic>=")),
-        None,
-    )
-    assert pydantic_requirement == "pydantic>=2.12,<3"
+    pydantic_requirements = {
+        item
+        for item in project["dependencies"]
+        if item.startswith("pydantic>=") or item.startswith("pydantic==")
+    }
+    assert pydantic_requirements == {"pydantic>=2.12,<3"}
 
 
-def test_resolver_uses_stable_dependencies() -> None:
-    """The default lock cannot select prerelease-only compatibility packages."""
-    assert load_config()["tool"]["uv"]["prerelease"] == "disallow"
+def test_resolver_uses_prereleases_only_when_explicitly_required() -> None:
+    """The default lock selects prereleases only for explicit compatibility pins."""
+    assert load_config()["tool"]["uv"]["prerelease"] == "if-necessary-or-explicit"
 
 
 def test_license_uses_spdx_metadata() -> None:

tests/test_release_workflows.py

@@ -48,7 +48,12 @@ def test_publish_uses_only_the_validated_package_directory() -> None:
     build = release["jobs"]["build"]
     publish = release["jobs"]["publish"]
 
-    assert build["needs"] == ["compatibility", "provider-contracts", "quality"]
+    assert build["needs"] == [
+        "ecosystem-qualification",
+        "compatibility",
+        "provider-contracts",
+        "quality",
+    ]
     assert publish["needs"] == "build"
     assert publish["environment"] == "pypi"
     assert publish["permissions"] == {"contents": "read", "id-token": "write"}