[Pigbibi]

Summary

Fix dry-run exception receipts so failures remain failed/not_applicable, independent of shared resolver precedence. Preserve live submission uncertainty. Only the receipt adapter and its regression tests change.

Validation and baseline-red publication exception

Owner t1234s7059 A explicitly authorizes Draft publication only. Exact baseline: 576e533; candidate: 86427ce (full head in PR metadata). Main has not advanced. Python 3.12.15, unchanged frozen lock, explicit original sibling-source paths.
Fresh baseline: 19 failed, 1477 passed, 21 errors, 118 subtests passed. Candidate: 18 failed, 1479 passed, 21 errors, 118 subtests passed. Exact failed/error identity comparison: introduced=0, resolved=1 (the dry-run receipt integrity regression), retained=39 missing-shared-module environment failures. Full suite remains RED. Focused receipt tests: 12 passed, 13 subtests passed; Ruff and whitespace checks pass.
The earlier frozen-installed baseline suite was interrupted after 160.19 seconds in urllib3 connection handling (1097 passed, exit 2): INCOMPLETE, never PASS. No green frozen candidate full suite is claimed. This exception is valid only for this candidate/base/tree/environment and invalidates on drift. Native required checks remain unchanged; publication grants no merge or deploy permission.

Risk and self-review

Fail-closed regression failed before and passed after on the original-source path. Live exception uncertainty regression passes. No new logging, identifiers, persistent state, concurrency or snapshot handling. No workflow, trading gate, dependency, Secret or IAM changes. Runtime adoption is unverified.

AI disclosure

Prepared with OpenAI Codex (GPT-6 family; exact model managed by host).

Central publication check

publication-check/2.0-advisory, build 83d9d1130377, advisory exit 0; total findings 1154, matching lines 1149. Existing tree findings are advisory. First 20 masked matches:

.github/CODEOWNERS:4 /.env.example @<PROJECT_ID>
.github/CODEOWNERS:5 /.github/CODEOWNERS @<PROJECT_ID>
.github/CODEOWNERS:6 /.github/workflows/ @<PROJECT_ID>
.github/CODEOWNERS:7 /application/execution_receipt_adapter.py @<PROJECT_ID>
.github/CODEOWNERS:8 /application/execution_service.py @<PROJECT_ID>
.github/CODEOWNERS:9 /application/paper_execution_admission.py @<PROJECT_ID>
.github/CODEOWNERS:10 /application/paper_execution_command_consumer.py @<PROJECT_ID>
.github/CODEOWNERS:11 /runtime_execution_policy.py @<PROJECT_ID>
.github/CODEOWNERS:12 /scripts/execution_report_heartbeat.py @<PROJECT_ID>
.github/dot-review/review.cjs:106   const token = <REDACTED> core.getIDToken(audienceText); // Exact bytes; URL normalization may change an audience.
.github/dot-review/review.cjs:190   const <PROJECT_ID> = {...pr,head:{...pr.head,sha:pair.target},base:{...pr.base,sha:pair.base}};
.github/dot-review/review.cjs:191   const binding = {...b.binding({repository:trust.repo.full_name,pr:<PROJECT_ID>,policyCommit:trust.commit,files},trust.policySha),
.github/dot-review/test-review.cjs:81   const content='<PROJECT_ID> source\n', sourceSHA='d'.repeat(40);
.github/dot-review/test-review.cjs:82   const pr={number:7,changed_files:1,commits:1,title:'<PROJECT_ID> change',body:'<PROJECT_ID> body',
.github/dot-review/test-review.cjs:100     assert.equal(audience,'https://audience.example.test');return '<PROJECT_ID>-only';},summary};
.github/dot-review/test-review.cjs:111         task={id:'<PROJECT_ID>-task',owner:'example/repo',provider:'dot',revision:1,status:'running',request,output:null,artifacts:[]};
.github/workflows/diagnose-cached-stage-failure.yml:52   GCP_PROJECT_ID: <PROJECT_ID>
.github/workflows/diagnose-cached-stage-failure.yml:53   GCP_WORKLOAD_IDENTITY_PROVIDER: projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<PROJECT_ID>-actions/providers/<PROJECT_ID>-main
.github/workflows/diagnose-cached-stage-failure.yml:54   GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: firstrade-platform-deploy@<PROJECT_ID>.iam.gserviceaccount.com
.github/workflows/diagnose-cached-stage-failure.yml:69       id-token: <REDACTED>

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T22:15:56.489349Z	9155154	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 86427ce2fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Pigbibi]

@codex review

Refresh the review for the synchronized Draft head. The original two-file receipt patch is unchanged. Focused tests: 12 passed and 13 subtests passed; full suite: 1841 passed and 118 subtests passed with NO_GCE_CHECK=true on the credential-free development host; repository Ruff and whitespace checks passed. Keep this PR in Draft.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 9155154b1d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".