[Pigbibi]

What changed

The merged #715 jobs.get proposal has no restricted apply entrypoint. Add a single-purpose PAPER workflow and REST adapter, offline adverse tests and operating documentation.

The workflow uses existing PAPER WIF and Environment longbridge-paper, main only, run_attempt=1, queued concurrency without cancellation, mode default dry-run, and confirmation APPLY_PAPER_SCHEDULER_JOBS_GET. Only paperSchedulerJobsGet with cloudscheduler.jobs.get and the single existing-reader project binding are supported. Etags, fresh readbacks, collision rejection and single-attempt transport fail closed. Missing protected mappings block before authentication.

How verified

26 focused tests passed; full suite: 3142 passed, 1 skipped, 431 subtests passed. Ruff passed. Documentation check: zero blocking, one existing README advisory. Diff whitespace check passed. Publication checker details are attached below before publication.

Authority and limits

Owner t1293s7532=A authorizes Draft publication only, resumed after r1 FAILED_API_403 before publication. The prior #715 merge ended MERGED_APPLY_BLOCKED_NO_ENTRYPOINT. No merge, labels, workflow dispatch, IAM apply, image or Secret access, deploy or PAPER start. Cloud mutations=0; iam_apply=0; actions_apply_dispatches=0; READY_FOR_START_CARD=false. Merge and ONE later apply require a separate exact-revision owner card. External IAM writers require a reserved owner window; role creation and binding are not atomic, and uncertain results must not be retried.

AI-authored using Codex (host-configured model).

Central publication check

publication-check/2.0-advisory build 83d9d1130377; advisory findings=1487; matching lines=1476. Complete tracked candidate tree scanned; advisory matches do not authorize broader cleanup. First 20 (masked):

• .env.example:21 TELEGRAM_TOKEN=<>
• .<PROJECT_ID>/CODEOWNERS:7 /.env.example @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:8 /.github/CODEOWNERS @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:9 /.github/workflows/ @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:10 /application/account_new_risk_gate_support.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:11 /application/durable_execution_commands.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:12 /application/execution_receipt_adapter.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:13 /application/execution_service.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:14 /application/execution_state.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:15 /application/longbridge_execution.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:16 /application/paper_execution_command_consumer.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:17 /application/paper_strategy_risk_state.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:18 /runtime_execution_policy.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:19 /scripts/execution_report_heartbeat.py @<PROJECT_ID>
• .<PROJECT_ID>/dot-review/review.cjs:106 const token = core.getIDToken(audienceText); // Exact bytes; URL normalization may change an audience.
• .<PROJECT_ID>/dot-review/review.cjs:190 const <PROJECT_ID> = {...pr,head:{...pr.head,sha:pair.target},base:{...pr.base,sha:pair.base}};
• .<PROJECT_ID>/dot-review/review.cjs:191 const binding = {...b.binding({repository:trust.repo.full_name,pr:<PROJECT_ID>,policyCommit:trust.commit,files},trust.policySha),
• .<PROJECT_ID>/dot-review/test-review.cjs:81 const content='<PROJECT_ID> source\n', sourceSHA='d'.repeat(40);
• .<PROJECT_ID>/dot-review/test-review.cjs:82 const pr={number:7,changed_files:1,commits:1,title:'<PROJECT_ID> change',body:'<PROJECT_ID> body',
• .<PROJECT_ID>/dot-review/test-review.cjs:100 assert.equal(audience,'https://audience.example.test');return '<PROJECT_ID>-only';},summary};

AI assistance

Prepared with Codex using the host-configured model.

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T08:44:51.373499Z	e126b8c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: e126b8c279

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".