[Pigbibi]

AI assistance

Codex (GPT-6); existing review bot will review the exact published head.

What changed

Bind the protected deploy job to the Environment selected by vars.IBKR_DEPLOY_ENVIRONMENT and resolve deployment credential aliases at job scope. Add a required reusable-workflow dry_run input, default manual dispatch to validation only, and gate every post-validation execution step and alternate mode behind explicit execution selection.

How verified

• Full offline suite: 6518 passed, 6 skipped, 368 subtests passed; exit 0.
• Focused workflow contracts: 15 passed. Six adverse tests fail against the unchanged new-main workflows and pass on the candidate.
• Ruff, workflow shell contract, actionlint (ShellCheck disabled), documentation style and diff whitespace checks pass. Documentation style retains one existing README advisory.
• No workflow dispatch or cloud operation was executed.

Why

The deployment path lacked an Environment binding and a validation-only input. This bounded patch makes plan validation the default and requires an existing protected Environment selector before authentication. It is rebased onto main after #971; the original local worktree is preserved.

Risk

High: deployment workflow behavior and credential resolution. Environment configuration and protection rules must be established separately under exact authorization. Dry-run authenticates and validates inputs; it does not prove future writes, serving adoption or runtime readiness. Existing risk/governance workflows are unchanged. Deployment, Secret, IAM, Scheduler and switch changes are outside this PR execution.

Publication check

Central checker: publication-check/2.0-advisory, build 83d9d1130377; advisory scan completed, exit 0. Total findings: 2555; matching lines: 2430. Existing-tree findings are advisory and are not a clean-secret assertion. First 20 masked matches:

• .env.example:11: IB_GATEWAY_HOST=<PROJECT_ID>
• .env.example:19: TELEGRAM_TOKEN=<>
• .<PROJECT_ID>/CODEOWNERS:9: /.env.example @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:10: /.github/CODEOWNERS @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:11: /application/account_new_risk_gate_support.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:12: /application/execution_kernel_adapter.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:13: /application/execution_receipt_adapter.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:14: /application/execution_service.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:15: /application/ibkr_order_execution.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:16: /application/paper_execution_admission.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:17: /application/paper_execution_command_consumer.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:18: /application/portfolio_risk_diagnostics.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:19: /application/relative_risk_preview.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:20: /application/tqqq_offline_risk.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:21: /runtime_execution_policy.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:22: /scripts/deploy_notification_only.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:23: /scripts/deploy_pilot_no_traffic.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:24: /scripts/execution_report_heartbeat.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:25: /scripts/ibkr_deployment_audit.py @<PROJECT_ID>
• .<PROJECT_ID>/CODEOWNERS:26: /scripts/summarize_execution_ledger_cloud.py @<PROJECT_ID>

[Pigbibi]

@codex review

Please review the complete five-file candidate at head db5576c against main after #971. Focus on the Environment credential boundary, fail-closed input validation, and dry-run suppression of execution paths. This request grants no deployment or merge authority.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T07:50:15.531347Z	0d88254	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db5576ce03

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Pigbibi]

@codex review

Please review the complete candidate at exact head 0d882549780a390c750817653d9404256ff5fd51 against main, including the bounded fix for discussion_r4476624356. Scheduler-only dry-run must reject missing location or Scheduler service account before reporting validation success. Local full suite: 6519 passed, 6 skipped, 368 subtests passed. Preserve all native gates; no deployment or merge is requested.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 0d88254978

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Pigbibi]

@codex review

Please review the complete candidate at exact head 0d882549780a390c750817653d9404256ff5fd51 against main, including the bounded fix for discussion_r4476624356. Scheduler-only dry-run must reject missing location or Scheduler service account before reporting validation success. Local full suite: 6519 passed, 6 skipped, 368 subtests passed. Preserve all native gates; no deployment or merge is requested.

[Pigbibi]

@codex review

Please review the complete candidate at exact head 0d882549780a390c750817653d9404256ff5fd51 against main, including the bounded fix for discussion_r4476624356. Scheduler-only dry-run must reject missing location or Scheduler service account before reporting validation success. Local full suite: 6519 passed, 6 skipped, 368 subtests passed. Preserve all native gates; no deployment or merge is requested.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 0d88254978

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".