Skip to content

chore: dispatch audits to AIAuditBridge #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pigbibi merged 1 commit into from
Jul 3, 2026
Merged

chore: dispatch audits to AIAuditBridge #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/dispatch_shadow_signal.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ on:
- codex
- openai
source_ref:
description: "Ref to pass to CodexAuditBridge"
description: "Ref to pass to AIAuditBridge"
required: false
default: "main"

Expand Down Expand Up @@ -107,7 +107,7 @@ jobs:
private-key: ${{ secrets.CROSS_REPO_GITHUB_APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}
repositories: |
CodexAuditBridge
AIAuditBridge
Comment on lines 109 to +110

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Scope the app token to the configured bridge

When vars.CODEX_AUDIT_BRIDGE_REPOSITORY is set to a bridge other than QuantStrategyLab/AIAuditBridge, the dispatch later uses that configured BRIDGE_REPOSITORY, but this step now always creates an installation token scoped only to AIAuditBridge. The upstream actions/create-github-app-token docs define repositories as the list of repositories to grant access to, and the script prefers APP_TOKEN over CODEX_AUDIT_DISPATCH_TOKEN, so a configured bridge such as QuantStrategyLab/CodexAuditBridge will fail authorization instead of falling back. Please derive this repository entry from BRIDGE_REPOSITORY or omit it for owner-wide installation access.

Useful? React with 👍 / 👎.

permission-actions: write

- name: Create shadow signal issue and dispatch bridge
Expand Down
8 changes: 4 additions & 4 deletions docs/architecture.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ QuantStrategyLab already separates strategy math, snapshot generation, runtime
execution, and broker adapters. This repository adds a research-only signal context
pipeline without changing that production boundary.

This repository is deliberately narrower than `CodexAuditBridge`. It owns
This repository is deliberately narrower than `AIAuditBridge`. It owns
research inputs, validation, saved artifacts, and replay harnesses. It does not
own model provider routing, API keys, GitHub App write orchestration, live
notifications, or execution behavior.
Expand All @@ -21,7 +21,7 @@ order routing.

- `ResearchSignalContextPipelines` stores context examples, schema, validation,
replay tooling, and shadow artifacts.
- `CodexAuditBridge` owns provider routing and API keys.
- `AIAuditBridge` owns provider routing and API keys.
- GitHub Issues are the first operator notification layer for monthly shadow
signal runs.
- The scheduled workflow builds the market context bundle before dispatching the
Expand All @@ -35,7 +35,7 @@ order routing.
The current lifecycle is accumulation-first:

1. Build a point-in-time context bundle.
2. Ask `CodexAuditBridge` to review it and produce a shadow-only artifact when
2. Ask `AIAuditBridge` to review it and produce a shadow-only artifact when
evidence is sufficient.
3. Save both `latest_signal.json` and dated `signal_history/YYYY-MM-DD.json`.
4. Replay only saved artifacts against later prices.
Expand All @@ -52,7 +52,7 @@ The current lifecycle is accumulation-first:
artifacts.
- Sending runtime Telegram or broker-facing notifications directly from this
research repository before a deterministic plugin contract exists.
- Duplicating `CodexAuditBridge` provider fallback or cross-repository write
- Duplicating `AIAuditBridge` provider fallback or cross-repository write
logic inside this repository.

## Validation Strategy
Expand Down
2 changes: 1 addition & 1 deletion scripts/post_shadow_signal_request.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ def build_issue_body(
"## Operator Notification",
"",
"This issue is the operator-facing notification for the shadow signal run.",
"CodexAuditBridge should post its review result here and may open a focused PR",
"AIAuditBridge should post its review result here and may open a focused PR",
"only for schema-valid shadow artifacts.",
"",
"## Boundaries",
Expand Down
2 changes: 1 addition & 1 deletion scripts/run_codex_pr_review.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
from typing import Any

# ---------------------------------------------------------------------------
# Configuration (aligned with CodexAuditBridge)
# Configuration (aligned with AIAuditBridge)
# ---------------------------------------------------------------------------

API_BASE = "https://api.github.com"
Expand Down
Loading