[Pigbibi]

AI assistance

Codex, GPT-6.1 Sol.

What changed

Adopt the pinned cloud-run-tags/v1 QPK operator contract in the HK notification
canary and Cloud Run sync-plan builder. Exact service names are retained; malformed
names fail without echoing identifying input. Plans expose tag headroom and explicit
TAG_IMPOSSIBLE status without granting tag or traffic authority.

The canary uses complete tag inventory and a persisted shared reservation, then
creates a private exclusive operation claim before any cloud write. Every mutation
and restoration rechecks claim content and file identity. Claims survive restarts
and uncertainty. Tight budgets use deterministic shortened tags; collisions and
nonpositive headroom refuse. No LongBridge caller opts into micro-traffic.

The QPK source is an unmerged implementation snapshot from qpk-cr-tag-helper-r1,
versioned and pinned by SHA-256 in scripts/vendor/cloud-run-tags-source.json.
No dependency bump or workflow edit is required.

How verified

• Original related tests: 74 passed; 25 initial new regressions failed before the patch.
• Final adverse cases against original callers: 34 failed before / passed after (2 additional baseline cases already passed).
• Focused: 163 passed; full pytest: 3106 passed, 1 skipped, 420 subtests passed.
• Ruff, dependency pin consistency, offline lock check and diff check passed.
• Workflow shell contract: 92 no-traffic cases, 9 lifecycle cases, authentication
  exclusion and candidate archive checks passed.
• Documentation check: zero blocking, one existing README outline advisory.
• Offline evidence only; no deployment, cloud mutation or runtime delivery claimed.

Why

Owner decision t1255s7222 approves Option B adoption without service renames.
Design references: cr-service-name-inventory-r1/out/DECISION_MEMO.md and
GENERATORS.md; shared implementation: qpk-cr-tag-helper-r1.
This replaces the canary's separate UUID-prefix shortening and exposes the same
budget at the existing plan-generation boundary.

Risk

Protected operator paths require the existing owner/risk disposition. No label,
merge, deployment, dispatch, traffic, IAM, Secret, vars or service rename is included.
Live, Kelly and stop-loss switches are unchanged. Existing paper adoption,
image-only/no-traffic, source, readiness, etag and restoration gates are retained.
An impossible tag does not invalidate an untagged image-only plan. Local claims
and remote mutations are not atomic; lost ownership or unverified restoration
requires separately authorized operator reconciliation.

Publication scan

Central checker: publication-check/2.0-advisory build 83d9d1130377, advisory; total matches 1467, matching lines 1456. Existing-tree matches and <PROJECT_ID> fixtures are reported; no credential was added. Advisory matches alone do not block publication under the owner rule.
First 20 matches below contain shared-masked text only.

[
  {
    "file": ".env.example",
    "line": 21,
    "text": "TELEGRAM_TOKEN=<<HOST>>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 7,
    "text": "/.env.example @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 8,
    "text": "/.github/CODEOWNERS @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 9,
    "text": "/.github/workflows/ @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 10,
    "text": "/application/account_new_risk_gate_support.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 11,
    "text": "/application/durable_execution_commands.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 12,
    "text": "/application/execution_receipt_adapter.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 13,
    "text": "/application/execution_service.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 14,
    "text": "/application/execution_state.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 15,
    "text": "/application/longbridge_execution.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 16,
    "text": "/application/paper_execution_command_consumer.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 17,
    "text": "/application/paper_strategy_risk_state.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 18,
    "text": "/runtime_execution_policy.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/CODEOWNERS",
    "line": 19,
    "text": "/scripts/execution_report_heartbeat.py @<PROJECT_ID>"
  },
  {
    "file": ".<PROJECT_ID>/dot-review/review.cjs",
    "line": 106,
    "text": "  const token = <REDACTED> core.getIDToken(audienceText); // Exact bytes; URL normalization may change an audience."
  },
  {
    "file": ".<PROJECT_ID>/dot-review/review.cjs",
    "line": 190,
    "text": "  const <PROJECT_ID> = {...pr,head:{...pr.head,sha:pair.target},base:{...pr.base,sha:pair.base}};"
  },
  {
    "file": ".<PROJECT_ID>/dot-review/review.cjs",
    "line": 191,
    "text": "  const binding = {...b.binding({repository:trust.repo.full_name,pr:<PROJECT_ID>,policyCommit:trust.commit,files},trust.policySha),"
  },
  {
    "file": ".<PROJECT_ID>/dot-review/test-review.cjs",
    "line": 81,
    "text": "  const content='<PROJECT_ID> source\\n', sourceSHA='d'.repeat(40);"
  },
  {
    "file": ".<PROJECT_ID>/dot-review/test-review.cjs",
    "line": 82,
    "text": "  const pr={number:7,changed_files:1,commits:1,title:'<PROJECT_ID> change',body:'<PROJECT_ID> body',"
  },
  {
    "file": ".<PROJECT_ID>/dot-review/test-review.cjs",
    "line": 100,
    "text": "    assert.equal(audience,'https://audience.example.test');return '<PROJECT_ID>-only';},summary};"
  }
]

Candidate head: fc4872a0dae8e9d5ec4aa0a6a130234b4f4e38c2. Keep this PR Draft. Exact-head review is requested separately.

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T15:49:58.638492Z	dbb5580	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: fc4872a0da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".