Technical debt audit — July 2026 (tracking issue)

[mmcky]

A technical-debt study of QuantEcon.py at v0.11.4 (commit 28d4b3b) identified 35 actionable items, filed as the sub-issues below and grouped under the milestone 2026-07 Technical Debt Audit. This issue is structure, not work: it carries no Type label, per QEP-2 (QuantEcon/qeps#2).

Method. Two independent AI-assisted audits (different models, one local, one cloud) were run against the same commit, compared, merged, and cross-validated: every disagreement between the two was re-verified against the working tree or the GitHub API before filing, and findings already covered by open issues were linked rather than re-filed. The full study reports are held locally by @mmcky.

State of the library. The headline is good: 600 tests pass cleanly on the current stack (NumPy 2.x, numba 0.66, Python 3.12–3.14 across three OSes), and recent maintenance is active and substantive. The debt found is overwhelmingly structural and procedural — deferred decisions, stale metadata, and quality signals that do not measure what they appear to measure — rather than a sign of neglect.

High priority

Issue	Theme
#868	Vendor rng_integers — private SciPy import, breaks on any SciPy release
#869	Install metadata contradicts itself (requires-python, floors, classifiers)
#870	fetch_nb_dependencies writes HTTP error pages and reports success
#871	Coverage excludes all numba-jitted code and counts the test tree
#872	Supply-chain hardening: permissions, SHA pinning, Trusted Publishing

Normal priority

Issue	Theme
#873	NumPy 2 workflow: broken trigger, likely obsolete
#874	Missing assert in test_ddp.py sparse-Q check
#875	Contract tests for the deprecation-shim layer
#876	mc_compute_stationary/mc_sample_path: warn for real or bless
#877	RandomState → Generator migration policy (discuss)
#878	Migrate IVP off legacy scipy.integrate.ode
#879	scipy.sparse matrix → array migration plan
#880	Slim mandatory deps: sympy, requests
#881	Dead packaging config (MANIFEST.in, flit excludes, nose relics)
#882	Code-hygiene quick wins
#883	Review eight F841 unused locals in numerical modules
#884	Ratchet the CI lint gate (follow-up to #457)
#885	Docs toolchain: unpin Sphinx, drop vendored sphinxext
#886	Decompose the four grade-D complexity hotspots
#887	gth_solve: consolidate or test the pure-Python fallback
#888	Coverage lift on _arma, _lss, _kalman
#889	Tests for quantecon/timings
#890	slow marker and wall-clock assertions
#891	SECURITY.md + private vulnerability reporting
#892	Code of conduct, templates, CODEOWNERS
#893	Triage the pre-2021 issue backlog
#894	Delete merged/abandoned remote branches
#895	Private-module convention for subpackages (discuss)
#896	Complete QEP-2 label adoption

Low priority

Issue	Theme
#897	Type-hint policy (discuss)
#898	Modernization sweep
#899	Fill 58 missing public docstrings
#900	Freshness pass on contributor-facing files
#901	Replace pejorative wording in a test comment
#902	Document the commit-prefix convention

Already tracked — linked, not re-filed

Findings covered by existing open issues: shim removal scheduling (#865), the six missing top-level exports (#853 — re-verified still missing on 2026-07-25), doctests in CI (#866), timer deprecation (#786), DLE modernization (#844), duplicated logic (#480), lint conventions (#457 — #884 is its concrete follow-up), API-doc generator (#169, #854, #852), IVP methods (#111 — pairs with #878).

Sequencing notes

#871 (coverage fix) before #888 (re-baselines its targets) and before #898's decorator normalization (exclusions key on decorator spellings). #853 before shim removal; #875 coordinates with both. #884 before #898 (baseline makes cleanup enforceable). #894 checks the update-fetch-utility branch before #870 is implemented. #896 is blocked on the QEP-2 rollout reaching software repositories.