fix(demo): vendor 2008 hindcast data excluded by .gitignore

[Ajay03299]

Fixes #1.

demo/hindcast_2008.py — the walk-forward replay featured in the README — failed with FileNotFoundError on any fresh clone. The unanchored *.csv rule in .gitignore matches at every depth, so the four fixtures the script expects in demo/data/2008/ were silently skipped by git add and never committed, despite the module docstring stating they are meant to be vendored.

Changes

.gitignore — adds !demo/data/**/*.csv after the *.csv rule so the demo fixtures are tracked. Scoped narrowly; no other CSV path is affected.

demo/data/2008/*.csv — the four fixtures, ~225 KB total, all public and keyless:

File	Source
ff_factors_0309.csv	Ken French Data Library — daily research factors
ind10_0309.csv	Ken French Data Library — 10 industry portfolios, value-weighted
ted.csv	FRED TEDRATE
vix.csv	FRED VIXCLS

demo/data/fetch_2008.py — regenerates the fixtures from source. Committing data without the code that produces it makes provenance unverifiable, so the script ships alongside. It handles the two format hazards in the French files: the 10-industry file contains a second equal-weighted section (truncated at its marker, otherwise every date would appear twice and corrupt rolling(63).corr()), and missing data is encoded as -99.99, which would survive /100.0 as a −99.99% return — the script raises instead. Row parsing whitelists on ^\d{8}, rather than a fixed skiprows, so a change to the upstream preamble fails loudly instead of shifting the header into the data.

Verified deterministic: re-running the fetcher into a clean directory produces byte-identical output to the committed files.

tests/test_hindcast_data.py — 15 tests, no network. The most important asserts the fixtures are git-tracked, not merely present on disk; that is the precise condition that failed here, and a test for file existence alone would have passed on the author's machine. Also covers date-index alignment between the two French files (they feed vol21 and corr63 separately, so a mismatch would reindex to NaN and silently degrade Λ rather than raise), required columns, sentinel values, and window coverage. An end-to-end test runs the demo and asserts it exits 0 while reproducing its headline result; it restores figures/hindcast_2008.png afterward so the run is non-destructive.

.github/workflows/ci.yml — adds pandas matplotlib to the explicit install. They were only reaching CI through pip install -r requirements.txt || true, which silently no-ops if any pin fails to resolve — and requirements.txt pins jax[cuda12] and apache-airflow, neither of which is reliable on a GPU-less runner. Test dependencies shouldn't depend on a best-effort install.

Verification

$ python demo/hindcast_2008.py
eval sample: 2004-04-01 → 2009-12-31  (1449 trading days)
θ = 2.0 (composite 2σ) · sustain rule = 5 consecutive closes
first close  > θ : 2007-08-10
first SUSTAINED  : 2007-08-16   → 272 trading days before Lehman
false positives before 2007: 0 days above θ
✓ figures/hindcast_2008.png

Matches the README's stated result. pytest tests/ -q → 65 passed (50 existing + 15 new) on Python 3.13, macOS arm64.

Notes

• I went with vendoring over a fetch-on-first-run script since it preserves the demo's zero-setup, keyless property, and the docstring indicates that was the intent. Happy to switch to fetch-only if you'd prefer to keep data out of the repo — the script is already written either way.
• Redistribution: the Ken French files are freely published for research use and attributed in both the fetch script and the demo docstring. Say the word if you'd rather not vendor them.
• Out of scope, noticed while working: requirements.txt pins jax[cuda12], which can't install on non-NVIDIA machines (it blocked my local setup on Apple Silicon), and setup.sh assumes conda plus Docker containers for TimescaleDB and Kafka. Neither is needed to run the demos. Worth a separate issue if useful.