[Pigbibi]

AI assistance

Codex (gpt-6.1-sol) implemented and locally verified this owner-authorized governance change. Independent exact-head Codex App review remains required before merge.

What changed

Formerly owner-only paths still required a manual label after a clean review. Route every sensitive/high-risk path, including the gate and trust policy, through the existing exact-head clean Codex App marker and native required-check evidence. Remove all owner-label authorization logic from risk-gate; retain immutable base trust, evidence re-reads and workflow concurrency.

Update AGENTS, the decision document, README siblings and style-guide contribution rules. Source merge does not authorize live-trading deployment, Secrets/IAM changes or deletion; those require explicit owner chat authorization recorded by the coordinator. Live trading, Kelly and stop-loss remain OFF unless explicitly authorized. Agents may not manipulate approval labels, force-push or print secrets.

This affects this repository only. Other repositories must adopt their own reviewed update; this PR changes no organization settings, production state, protected switches or deployment.

How verified

• Regression run on the original gate fails the new sensitive-path approval expectations; corrected gate passes 83 risk tests.
• Combined Node suites: 136 pass; Python suites: 61 pass.
• Phase-2 docs check: zero blocking findings, one existing README advisory; changed workflow passes actionlint.
• Repository Gitleaks wrapper: zero file/rule findings after removing generated scanner-test bytecode.
• Diff whitespace check passes. Existing required native checks and branch protection remain unchanged; hosted review and CI are separate from offline validation.

Risk

Gate/trust paths now require automated evidence rather than a label. Trusted App identity is read from the immutable base policy, never candidate code. Unknown/stale/invalid/read-failure evidence remains blocking. Workflow write authority remains commit statuses only. The reusable governance observer remains report-only.

Central publication check

publication-check/2.0-advisory (build 83d9d1130377), advisory: 34 matches / 34 matching lines. Credential scanner: zero findings. First 20 masked matches in the complete tracked candidate tree (existing identifiers/placeholders; not credentials):

.<PROJECT_ID>/CODEOWNERS:4: /.github/CODEOWNERS @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:5: /.github/workflows/ @<PROJECT_ID>
.gitleaks.toml:7: id = "<HOST>"
.gitleaks.toml:18: description = "Only explicit <PROJECT_ID> JSON placeholders in the scanner fixture"
AGENTS.md:76:   `gs://<bucket>/...` and `<account-id>`, and use <PROJECT_ID> values in
docs/STYLE_GUIDE.md:163: | Dated status banners in a README | "<PROJECT_ID> source check: merged; acceptance pending" | Replace with a present-tense status sentence, or remove. Dated evidence records are separate. |
docs/STYLE_GUIDE.md:393: # Console gap audit, <PROJECT_ID>
docs/STYLE_GUIDE.md:452: > <PROJECT_ID> 源码核对：库与所选平台 adapter 已合并；生产数据可用性及交易周期验收另行确认。
docs/adr/0001-incremental-architecture-boundaries.md:117: - Compare the baseline and candidate at the same boundary using fixed <PROJECT_ID>
docs/architecture-conventions.md:175: consistent with the changed content, and use <PROJECT_ID> resource names in examples.
docs/secret-scanning.md:63: It adds `<HOST>`, matching
docs/secret-scanning.md:159: | `<PROJECT_ID>/PushPlusSmsToTelegram` | Intended `state` branch |
docs/secret-scanning.md:160: | `<PROJECT_ID>/TelegramAutoSignBot` | `logs` branch |
docs/secret-scanning.md:161: | `<PROJECT_ID>/GoogleVoicePulseBot` | `logs` branch |
scripts/check_cross_repo_links.py:51:     "<PROJECT_ID>": ("repos", None),
scripts/check_cross_repo_links.py:52:     "<PROJECT_ID>": ("repos", "<PROJECT_ID>"),
scripts/check_cross_repo_links.py:72:             # <PROJECT_ID> and <PROJECT_ID> live in one directory; the name is what
scripts/check_cross_repo_links.py:74:             is_gdei = path.name.startswith("<PROJECT_ID>")
scripts/check_style.py:102: # finding. `<PROJECT_ID>-` is on the list because the organisation's fixtures are
scripts/check_style.py:107:     r"|^(?:your|my|example|sample|placeholder|shared|<PROJECT_ID>)[-_]"

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T15:55:50.866952Z	1d911d0	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 1d911d0e0b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Pigbibi]

Superseded by #46, which landed the canonical gate on main at 260d39b8. That change keeps the gate in a single implementation shared by every gate-carrying repository and drops the discovery-matrix approach this pull request proposed. Closing per the owner's decision; the branch is kept.