[Pigbibi]

Summary

Add invocation-local archive scanned/eligible/read/attributable counts and fixed exclusion counts. Unknown or truncated reads preserve null attribution totals; successful empty listings produce measured zeros. SDK read failures expose only allowlisted operation/category labels and suppress provider text. Receiver payload and publication gates are unchanged.

Stack

Depends on Draft #520. Base branch: fix/dry-run-exception-receipt-r1 at 86427ce. Candidate: e084769. Six diagnostic files only relative to that base. Do not merge out of order.

Validation and baseline-red publication exception

Owner t1234s7059 A authorizes this ordered Draft publication under t1233s7013 A. Exact original baseline: 576e533. Python 3.12.15, unchanged frozen lock, explicit original sibling-source paths.
Fresh receipt base: 18 failed, 1479 passed, 21 errors, 118 subtests passed. Stacked candidate: 18 failed, 1487 passed, 21 errors, 118 subtests passed. Exact failed/error identities match: introduced=0, retained=39 classified missing-shared-module environment failures. Full suite remains RED. The original dry-run receipt integrity failure is fixed by #520 and is absent from this candidate. Focused regression checks: 51 passed, 13 subtests passed. Ruff/whitespace passed; documentation check has zero blocking and one existing README advisory.
The earlier frozen-installed receipt baseline suite stopped after 160.19 seconds in urllib3 handling, 1097 passed, exit 2: INCOMPLETE, never PASS. No green frozen candidate full suite is claimed. Publication exception is valid only for these exact candidates/base/tree/environment and invalidates on drift. Required native checks are unchanged; this is not merge/deploy authority.

Risk and self-review

Retained fail-before tests exercise safe categories, suppression of private provider text, unknown counts on failure, and measured empty counts; all pass now. Counts use current invocation reads. No persisted state or cross-process writer is introduced. No trading gate, dependency, risk workflow, Secret or IAM change. Real SDK runtime behavior and deployed adoption remain unverified.

AI disclosure

Prepared with OpenAI Codex (GPT-6 family; exact model managed by host).

Central publication check

publication-check/2.0-advisory, build 83d9d1130377, advisory exit 0; total findings 1155, matching lines 1150. Existing tree findings are advisory. First 20 masked matches:

.<PROJECT_ID>/CODEOWNERS:4 /.env.example @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:5 /.github/CODEOWNERS @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:6 /.github/workflows/ @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:7 /application/execution_receipt_adapter.py @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:8 /application/execution_service.py @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:9 /application/paper_execution_admission.py @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:10 /application/paper_execution_command_consumer.py @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:11 /runtime_execution_policy.py @<PROJECT_ID>
.<PROJECT_ID>/CODEOWNERS:12 /scripts/execution_report_heartbeat.py @<PROJECT_ID>
.<PROJECT_ID>/dot-review/review.cjs:106   const token = <REDACTED> core.getIDToken(audienceText); // Exact bytes; URL normalization may change an audience.
.<PROJECT_ID>/dot-review/review.cjs:190   const <PROJECT_ID> = {...pr,head:{...pr.head,sha:pair.target},base:{...pr.base,sha:pair.base}};
.<PROJECT_ID>/dot-review/review.cjs:191   const binding = {...b.binding({repository:trust.repo.full_name,pr:<PROJECT_ID>,policyCommit:trust.commit,files},trust.policySha),
.<PROJECT_ID>/dot-review/test-review.cjs:81   const content='<PROJECT_ID> source\n', sourceSHA='d'.repeat(40);
.<PROJECT_ID>/dot-review/test-review.cjs:82   const pr={number:7,changed_files:1,commits:1,title:'<PROJECT_ID> change',body:'<PROJECT_ID> body',
.<PROJECT_ID>/dot-review/test-review.cjs:100     assert.equal(audience,'https://audience.example.test');return '<PROJECT_ID>-only';},summary};
.<PROJECT_ID>/dot-review/test-review.cjs:111         task={id:'<PROJECT_ID>-task',owner:'example/repo',provider:'dot',revision:1,status:'running',request,output:null,artifacts:[]};
.<PROJECT_ID>/workflows/diagnose-cached-stage-failure.yml:52   GCP_PROJECT_ID: <PROJECT_ID>
.<PROJECT_ID>/workflows/diagnose-cached-stage-failure.yml:53   GCP_WORKLOAD_IDENTITY_PROVIDER: projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<PROJECT_ID>-actions/providers/<PROJECT_ID>-main
.<PROJECT_ID>/workflows/diagnose-cached-stage-failure.yml:54   GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: firstrade-platform-deploy@<PROJECT_ID>.iam.gserviceaccount.com
.<PROJECT_ID>/workflows/diagnose-cached-stage-failure.yml:69       id-token: <REDACTED>

@codex review

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T01:40:40.489640Z	e084769	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: e0847694e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".