[Pigbibi]

AI assistance

Cursor Grok 4.7.

What changed

The manual Strategy Switch Console deploy entry now accepts the already-merged reviewed main 084ba4281cfff3304cf226ce511a2fc0a6b67b08 as an exact frontend release source. The previous reviewed main c1b737d6e721eb9fe71a12c613fbb49d3fa51563 stays an exact historical pin, the same way other historical release SHAs remain individually allowlisted. No arbitrary SHA is accepted.

The new selector uses the same gates as the existing reviewed-main block: refs/heads/main, release_frontend_assets=true, sync_secrets=false, sync_strategy_profiles=false, skip_binance_receiver_checks=false, ancestry against the workflow control revision, the pinned tree, the pinned asset map, and a detached checkout. The overlay step skips the legacy frontend overlay only for these two exact SHAs, each with its own tree and asset-map check. Publication keeps version-pinned binding inheritance for both reviewed-main SHAs.

Verified from origin/main before editing:

• commit 084ba4281cfff3304cf226ce511a2fc0a6b67b08
• parent 395ddd561a16d38ae0d145e5a7e9bb7b60c44ae6
• tree 23f94567c2e8b631e8ef035bfea497acef795123
• web/strategy-switch-console/v2_asset_map.js blob 5287f259185ed44f3784aa6374cb00412b3c6238

How verified

• node tests/console_deploy_safety_validation.mjs — exit 0. Summary: console_deploy_safety_validation: PASS (manual-only; 16 original write gates; exclusive preflight/deploy/restore; 2 exact Binance gates; 52 offline reader cases; 178 source cases; 29 restore cases; 19 overlay cases; 2 config cases; 257 isolated release cases; 24 schema readback cases).
• python3 scripts/check_style.py --phase 2 — exit 0, 0 blocking. One pre-existing README advisory remains.
• Workflow YAML parsed with PyYAML.

No Deploy or Publish workflow was dispatched. No merge.

Why

Deploy Strategy Switch Console cannot release the squash-merged #1086 frontend because 084ba4281cfff3304cf226ce511a2fc0a6b67b08 is absent from the reviewed-main allowlist. This is the same class of blocker #1082 fixed for c1b737d6e721eb9fe71a12c613fbb49d3fa51563.

Risk

High: protected manual release workflow. This draft only extends the exact-SHA allowlist. It does not deploy, does not change workflow permissions, and does not enable secret sync, strategy-profile sync, Meridian activation, external flow, IBKR resume, backend-only release, rollback, or read-only modes.

Eventual release dispatch, not performed here, remains:

• release_frontend_assets=true
• source_sha=084ba4281cfff3304cf226ce511a2fc0a6b67b08
• sync_secrets=false
• sync_strategy_profiles=false
• skip_binance_receiver_checks=false
• external_flow_enable=false
• ibkr_candidate_resume=off
• render_and_compare_only=false
• private_release_check=off
• read_only_preflight=false
• diagnose_restore_target=false
• check_explicit_version_inherit=false
• backend_only_release=false
• rollback_to_pre_release=false

RO-M07 HOLD stays in place: this pin does not enable sync_strategy_profiles or Meridian activation. Runtime adoption is not proven by this change.

  

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-08T14:01:32.072958Z	e48dd62	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-08T14:03:15.761065Z	e48dd62	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.