Repository navigation
ci: unify the risk gate on the canonical implementation - #46
Conversation
The reconciled verifier merged here fed its own check and workflow-run events back into the evidence it rereads, so every evaluation ended in error and both governance repositories were closed to merges. Restore the canonical gate the other 23 repositories run, keep the shadow tests that cover the reusable observer, and drop the gate tests that asserted the removed discovery matrix.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 30e2709bf7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The newest marker-bearing comment is selected before its payload is read, so a malformed newer receipt cannot fall back to an older clean one, and comments updated in the same second are ordered by id. Governance and AI-service paths stay high risk in the shared classifier.
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Release, deployment, service-account, permission and Kubernetes paths, plus pem/key/p12/pfx files, must keep the clearing-label requirement when the classifier is unified.
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
AI assistance
Qoder agent (DeepSeek) analysed the failure, wrote the change and ran the local checks. Codex reviews through the repository integration.
What changed
risk-gate.ymlis the canonical gate the other QuantStrategyLab repositories run, with two hardening fixes Codex found on this head:codex-review-state:v1are ordered byupdated_atand then by descending comment id, and only the newest is read. A malformed, duplicated or blocking newer receipt can no longer fall back to an older clean one..github/governance/is a protected prefix,ai_service,aiservice,kelly,stop_loss,release,service_account,serviceaccount,permission,role_binding,k8sandkubernetesare segmented path terms, and.pem,.key,.p12and.pfxfiles are matched by extension.The rest keeps the canonical behaviour:
pull_request_target,issue_comment,push,scheduleandworkflow_dispatchtriggers, therecord_labeljob that binds a label addition to its head and event, the per-PR writer, and therisk-gate,pr-templateandai-reviewcontexts.Also in this change:
.github/scripts/test-risk-gate.cjsremoved: it asserted the discovery matrix, the policy file and the per-PR job shape of the removed design..github/workflows/governance-shadow-tests.ymlrunsscripts/test-governance-shadow.cjsonly; the SHADOW observer is unchanged.AGENTS.md: the AI-only development clause is the canonical wording the other repositories use.PROPOSAL.md: marked superseded, with the reason..github/governance/policy.jsonstays becausegovernance-acceptance.ymlreads it.Final file sha256:
701918c57d6194e10f110ac987f8a4b937ddc17989fb271cced03907392ce322.How verified
actionlint1.7.12 exits 0 onrisk-gate.ymlandgovernance-shadow-tests.yml.ops/.../*release*.sh,src/ai_service/auth.py,src/kelly.py,src/risk/stop_loss.py,.github/governance/policy.jsonandcerts/client.pemas high risk, anddocs/release-notes.md,docs/kelly.mdandtests/stop_loss_test.pyas low risk.risk-gate,pr-templateandai-reviewstatuses on chore(deps): bump actions/setup-python from 5 to 7 #21, chore(deps): bump actions/checkout from 6 to 7 #22, chore(deps): bump actions/github-script from 8.0.0 to 9.0.0 #26, feat: Draft exact-head collaboration review prerequisites #39, Resolve tree/ links as directories in the cross-repository link checker #41 and ci: Remove owner label requirements from source merge gate #45 are allerrorwith "Evidence unavailable or changed; approval blocked".Why
The reconciled verifier added
check_run,check_suite,statusandworkflow_runtriggers and then reread check evidence, refusing to publish when the reread differed. Each run creates its own check runs, so the evidence changes while the run reads it: every evaluation ends inerror, and because the three contexts are required, the repository is closed to merges. Returning to the canonical gate removes the self-triggered loop; the other repositories move to this same file in one follow-up batch, so the organisation ends with one gate implementation.Risk
High: the change touches
.github/workflows/and governance documentation. Behaviour changes are deliberate: no check/status/workflow-run triggers, review provenance by the reservedchatgpt-codex-connector[bot]login rather than an App ID list, no live required-check discovery (branch protection still enforces those contexts), dependency updates exempt from review and template, and a wider high-risk classifier. No secret, token, label write, merge or deploy is added; the gate keeps read-only permissions plus the base-push dispatch.