Repository navigation
ci(governance): adopt the canonical risk gate - #677
Conversation
The organization copy publishes no ai-review context, so the Codex receipt is decorative. Replace it with the tested canonical gate: approver from RISK_GATE_OWNER, ai-review on the current head, ancestry drift, shared-head fail-closed and protected paths.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
A synchronize can move one pull request off a shared head even when its own evaluation fails, which leaves the released sibling on a stale collision error until another event or the six-hour sweep. Run the sibling refresh in a finally block and keep a refresh failure from masking the evaluation error.
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Pigbibi
added
the
owner-approved
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59c9035c51
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review the updated current head, including the Dependabot identity correction and its executable regression coverage. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
AI assistance
Qoder authored the original governance replacement. Codex (gpt-6.1-sol) addressed the unresolved Dependabot finding and added regression tests. Independent review is supplied by the established review bot on the exact current head.
What changed
Adopt the canonical trusted risk gate and update the approval guidance. The gate publishes the AI-review context, validates review receipts against the current head, checks base ancestry, rejects shared-head ambiguity, and preserves protected-path approval checks. Correct Dependabot authentication to require its bot account as both author and committer with a verified signature; web-interface commits receive no exemption.
How verified
Risk
Protected workflow change. Existing owner approval and required checks remain mandatory. No deployment, runtime, account, secret or IAM operation is included. Branch-protection adoption is a separately authorized post-merge action.
Publication check
Text artifacts: publication-check/2.0-advisory build 83d9d1130377; total matches 0; first 20 matches: none. Complete tracked-tree result is recorded below before publication.
Tracked tree: publication-check/2.0-advisory build 83d9d1130377; total matches 1677; matching lines 1662. Advisory only; matches include pre-existing placeholders and public organization references. No credential was introduced by the two-file correction.
First 20 matches (masked):
.env.example:9:SCHWAB_API_KEY=<<HOST>>.env.example:10:SCHWAB_APP_SECRET=<<HOST>>.env.example:15:TELEGRAM_TOKEN=<<HOST>>.env.example:44:STRATEGY_PLUGIN_ALERT_TELEGRAM_BOT_TOKEN=<<HOST>>CODEOWNERS:9:/.env.example @<PROJECT_ID>CODEOWNERS:10:/.github/CODEOWNERS @<PROJECT_ID>CODEOWNERS:11:/application/account_new_risk_gate_support.py @<PROJECT_ID>CODEOWNERS:12:/application/execution_claim.py @<PROJECT_ID>CODEOWNERS:13:/application/execution_event_accounting.py @<PROJECT_ID>CODEOWNERS:14:/application/execution_intent_continuity.py @<PROJECT_ID>CODEOWNERS:15:/application/execution_kernel_adapter.py @<PROJECT_ID>CODEOWNERS:16:/application/execution_receipt_adapter.py @<PROJECT_ID>CODEOWNERS:17:/application/execution_service.py @<PROJECT_ID>CODEOWNERS:18:/application/offline_execution_event_acceptance.py @<PROJECT_ID>CODEOWNERS:19:/application/paper_execution_admission.py @<PROJECT_ID>CODEOWNERS:20:/application/paper_execution_command_consumer.py @<PROJECT_ID>CODEOWNERS:21:/runtime_execution_policy.py @<PROJECT_ID>CODEOWNERS:22:/scripts/execution_report_heartbeat.py @<PROJECT_ID>CODEOWNERS:23:/scripts/inspect_schwab_token_secret_readiness.py @<PROJECT_ID>CODEOWNERS:24:/scripts/run_offline_execution_event_acceptance.py @<PROJECT_ID>