[Pigbibi]

AI assistance

OpenAI Codex (GPT-6) prepared this change and ran the local checks.

What changed

Allow ordinary high-risk paths to satisfy risk-gate without an owner label
only when the latest trusted Codex marker is completed for the exact head,
has_unresolved_findings is false, and every discovered required check is green.
Keep secrets, IAM, deployment, trading/execution, broker credentials, Kelly,
stop-loss and gate trust configuration under the existing owner-only rule.

Check old and new paths for renames, preserve native protection and the shadow
observer, and serialize comment/PR/check events by PR. PROPOSAL.md contains the
exact owner-only globs, rationale, limits and rollback. AGENTS wording and README
indexes describe the proposal. The docs checker permits the specifically
requested root proposal filename while retaining nested filename checks.

How verified

• Full available suite: 191/191 local tests (130 Node, 52 docs, 9 secret scanner).
• Initial adverse run: 13/59 risk tests failed before the implementation; the
  named cases pass after. Root proposal naming and per-PR concurrency contract
  also have recorded fail-before/pass-after evidence.
• Actionlint 1.7.7 and YAML parsing pass on both changed workflows.
• Phase-2 docs check: zero blocking findings, one existing optional README advisory.
• Native scripts/scan-secrets.py dir .: zero file/rule findings; staged diff check passes.
• New identifier-matching content lines versus base: zero, excluding indentation-only moves.

Hosted CI is separate from these local results. Future token permissions, event
delivery and adoption are not established by unit tests.

Hosted CI readback

At the published head, Documentation check, Gitleaks, Governance shadow tests,
Commit message convention, Secret scan / Gitleaks and pr-template succeeded.
The current base workflow's risk-gate and Evaluate PR governance failed under
the existing owner-label rule; this Draft does not bypass that rule.
Secret scanner regression failed before tests while the unchanged installer
was downloading Gitleaks: HTTP 504, curl exit 22. Local scanner regression
9/9 and both directory/commit-range scans passed. Hosted CI is not all green;
no check was bypassed or rerun by this worker.

Why

Ordinary reviewed high-risk code should not require a repeated manual label.
Unknown, stale or changing evidence cannot authorize automatic approval.

Risk

High-risk governance change; Draft proposal only. The current base-branch gate
still governs this PR. The gate and trust policy remain owner-only, so this PR
cannot authorize its own adoption. No labels, repo/org settings, branch-protection
requirements, merge, deployment or trading switches are changed. Other repositories
require separate adoption. Legacy App-bound statuses with no source-App evidence
fail closed. Native workflow-name triggers need maintenance when workflows change.

A final status is a snapshot, not an atomic transaction with all GitHub evidence.
The established review/merge process and native protections remain required.
Rollback restores the previous workflow and AGENTS approval wording through a
separately authorized reviewed change and reevaluates affected open PRs.

Central publication check

Checker: publication-check/2.0-advisory; build: 83d9d1130377; mode: advisory.
Total matches: 35; matching lines: 35. These are inherited content,
with zero new matching content lines versus base (ignoring indentation-only moves).
The repository's native Gitleaks scanner passed with zero file/rule findings.

First 20 masked diagnostics (file:line plus masked text):

.<PROJECT_ID>/CODEOWNERS:4: /.github/CODEOWNERS @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:5: /.github/workflows/ @<PROJECT_ID>
.<PROJECT_ID>/workflows/risk-gate.yml:257:                     approved = latest?.event === 'labeled' && latest.actor?.login === '<PROJECT_ID>';
.gitleaks.toml:7: id = "<HOST>"
.gitleaks.toml:18: description = "Only explicit <PROJECT_ID> JSON placeholders in the scanner fixture"
AGENTS.md:76:   `gs://<bucket>/...` and `<account-id>`, and use <PROJECT_ID> values in
docs/STYLE_GUIDE.md:163: | Dated status banners in a README | "<PROJECT_ID> source check: merged; acceptance pending" | Replace with a present-tense status sentence, or remove. Dated evidence records are separate. |
docs/STYLE_GUIDE.md:387: # Console gap audit, <PROJECT_ID>
docs/STYLE_GUIDE.md:446: > <PROJECT_ID> 源码核对：库与所选平台 adapter 已合并；生产数据可用性及交易周期验收另行确认。
docs/adr/0001-incremental-architecture-boundaries.md:117: - Compare the baseline and candidate at the same boundary using fixed <PROJECT_ID>
docs/architecture-conventions.md:175: consistent with the changed content, and use <PROJECT_ID> resource names in examples.
docs/secret-scanning.md:63: It adds `<HOST>`, matching
docs/secret-scanning.md:159: | `<PROJECT_ID>/PushPlusSmsToTelegram` | Intended `state` branch |
docs/secret-scanning.md:160: | `<PROJECT_ID>/TelegramAutoSignBot` | `logs` branch |
docs/secret-scanning.md:161: | `<PROJECT_ID>/GoogleVoicePulseBot` | `logs` branch |
scripts/check_cross_repo_links.py:51:     "<PROJECT_ID>": ("repos", None),
scripts/check_cross_repo_links.py:52:     "<PROJECT_ID>": ("repos", "<PROJECT_ID>"),
scripts/check_cross_repo_links.py:72:             # <PROJECT_ID> and <PROJECT_ID> live in one directory; the name is what
scripts/check_cross_repo_links.py:74:             is_gdei = path.name.startswith("<PROJECT_ID>")
scripts/check_style.py:102: # finding. `<PROJECT_ID>-` is on the list because the organisation's fixtures are

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T15:28:20.393771Z	e40b3e2	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8ee76d1fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bind legacy statuses using the queried ref, not a missing field

When a required context uses a legacy commit status without an App binding, this condition always rejects it: listCommitStatusesForRef returns status objects with no sha property, as shown in GitHub's documented response. The request already binds those results to the exact head through ref: sha. Consequently, ordinary high-risk PRs with such a required context cannot pass automatic approval even when their review and checks are clean. The regression fixture masks this by inventing sha: H; removing that field makes “Required status contexts also need an exact-head success” fail. Use the request's immutable ref binding and make the fixture match the actual API response.

AGENTS.md reference: AGENTS.md:L93-L93

Useful? React with 👍 / 👎.

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: e40b3e29a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".