Show selectable model comparisons and keep local app current

README.md

@@ -18,19 +18,26 @@ From the directory containing `backend/`, `frontend/`, and `scripts/` (run `cd h
 ./scripts/dev
 ```
 
-Open [http://127.0.0.1:5173](http://127.0.0.1:5173). Ctrl+C stops both processes.
+`./scripts/dev` requires a clean `main` checkout with `origin` pointing to
+`hypertrial/hyperoptions`. It checks `origin/main` before installing locked
+dependencies, fast-forwards a clean checkout, and then starts both services.
+If the remote cannot be reached, it warns that the version is unverified and
+starts the clean local checkout. A feature branch, local changes, or divergent
+history stops startup with a repair message. While running, the UI checks for
+a newer remote revision; restart `./scripts/dev` to apply it. Open
+[http://127.0.0.1:5173](http://127.0.0.1:5173). Ctrl+C stops both processes.
 
 For separate terminals:
 
 ```bash
 cd backend
-uv sync --group dev --group research
+uv sync --frozen --group dev --group research
 uv run --group research uvicorn options_api.main:app --reload --no-access-log --host 127.0.0.1 --port 8000
 ```
 
 ```bash
 cd frontend
-npm install
+npm ci
 npm run generate:api
 npm run dev
 ```
@@ -105,6 +112,11 @@ After the expiry session completes, the separate **Expiry · close-based result*
 
 `GET /api/health`, `GET /api/tickers?q=&limit=`, `GET /api/covered-calls/{ticker}?moneyness=`, and `GET /api/cash-secured-puts/{ticker}?moneyness=` serve the chain. Eligible chain rows include a backend-generated `watch_key`; ineligible rows include `watchability_reason`. The watchlist uses `POST /api/watchlist` with that key, `GET /api/watchlist`, `DELETE /api/watchlist/{id}`, and `POST /api/watchlist/refresh`; job progress is available from `GET /api/jobs/{id}`. The manual `/api/research/*` routes have been removed. Tickers must match `^[A-Z]{1,5}$` and belong to the Nasdaq-listed universe. The universe fails closed: if it cannot be loaded, ticker search and chain routes return 503. Unknown symbols return 404. Host validation admits loopback hosts only, including IPv6 `::1`. CORS allows the local Vite origin. API writes require that origin and JSON, and write bodies are capped at 16 KiB.
 
+`GET /api/version?frontend_sha=` reports the frozen running revision, branch,
+remote revision or offline status, check time, and optional frontend/backend
+revision match. Its remote check is cached for 60 seconds and never changes
+the running checkout.
+
 The checked-in `frontend/openapi.json` is generated from FastAPI. `npm run generate:api` regenerates TypeScript types and Zod page validators under `frontend/src/generated/`. `npm run check:api` fails if that output drifts.
 
 Nasdaq fetches use a bounded policy: the required option chain has two attempts, a 15s read timeout, and a 22s overall deadline. Optional stock info and history use a shorter 8s deadline so a degraded page does not wait through two full chain timeouts. HTTP 429 is not retried; numeric `Retry-After` is forwarded. The ticker screener uses the same 15s read timeout as the chain.

backend/pyproject.toml

@@ -4,6 +4,7 @@ version = "0.1.0"
 description = "Local Nasdaq covered-call and cash-secured-put options workstation"
 requires-python = ">=3.12,<3.13"
 dependencies = [
+    "arch>=8,<9",
     "duckdb>=1.2",
     "exchange-calendars>=4.11,<5",
     "fastapi>=0.115",
@@ -27,9 +28,7 @@ dev = [
     "httpx2>=2.9",
     "ruff>=0.15",
 ]
-research = [
-    "arch>=8,<9",
-]
+research = []
 
 [tool.ruff]
 target-version = "py312"