From 1ddd5093ab85f13c1bbd4b43f82089021af58e77 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Wed, 14 Oct 2026 23:03:58 +0800
Subject: [PATCH] fix(drift): move Drift Check to QPK v2 task-service reusable
 workflow

The pinned QPK reusable workflow (086166) still invoked the retired
AIAuditBridge v1 dual-review pipeline, which only knows codex/gpt/claude
reviewers. Those reviewers were removed in the v2 migration, so every
critical drift review ended as reviewers_unavailable and failed the run.

Pin the reusable workflow, its QPK checkout and the preflight QPK checkout
to QPK main (eae362b), whose drift_review step talks to the project-scoped
v2 task service. The reviewer provider (dot/grok) is selected by the
service-side project policy; this caller only passes AI_SERVICE_URL,
AI_SERVICE_AUDIENCE and AI_SERVICE_REVIEWERS_JSON. Review stays advisory
and fail-closed. Drop the retired CODEX_AUDIT_SERVICE_URL wiring.
---
 .github/workflows/drift-check.yml   | 11 ++++++-----
 tests/test_drift_workflow_config.py | 16 ++++++++++++----
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/drift-check.yml b/.github/workflows/drift-check.yml
index a617674..fa164f6 100644
--- a/.github/workflows/drift-check.yml
+++ b/.github/workflows/drift-check.yml
@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: QuantStrategyLab/QuantPlatformKit
-          ref: 086166458d4e3f61bb8937054cf7e69ff6ef914a
+          ref: eae362bd3e3fad5be59a7615eeba10be839a9934
           path: external/QuantPlatformKit
 
       - name: Set up Python
@@ -207,7 +207,7 @@ jobs:
       contents: read
       issues: write
       id-token: write
-    uses: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@086166458d4e3f61bb8937054cf7e69ff6ef914a
+    uses: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@eae362bd3e3fad5be59a7615eeba10be839a9934
     with:
       strategy_domain: crypto
       caller_event_name: ${{ github.event_name }}
@@ -215,9 +215,10 @@ jobs:
       snapshot_repository: QuantStrategyLab/CryptoLivePoolPipelines
       snapshot_checkout_path: external/CryptoLivePoolPipelines
       snapshot_repository_ref: ${{ needs.preflight_backtests.outputs.snapshot_repository_ref }}
-      ai_gateway_service_url: ${{ vars.AI_GATEWAY_SERVICE_URL }}
-      quant_platform_kit_ref: 086166458d4e3f61bb8937054cf7e69ff6ef914a
+      ai_service_url: ${{ vars.AI_SERVICE_URL }}
+      ai_service_audience: ${{ vars.AI_SERVICE_AUDIENCE }}
+      ai_service_reviewers_json: ${{ vars.AI_SERVICE_REVIEWERS_JSON }}
+      quant_platform_kit_ref: eae362bd3e3fad5be59a7615eeba10be839a9934
       lifecycle_preflight_artifact: lifecycle-preflight-${{ github.run_id }}-${{ github.run_attempt }}
     secrets:
-      codex_audit_service_url: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
       snapshot_repository_token: ${{ secrets.SNAPSHOT_REPOSITORY_TOKEN || secrets.QSL_REPO_SYNC_TOKEN || github.token }}
diff --git a/tests/test_drift_workflow_config.py b/tests/test_drift_workflow_config.py
index 7936460..52839f6 100644
--- a/tests/test_drift_workflow_config.py
+++ b/tests/test_drift_workflow_config.py
@@ -25,10 +25,10 @@ def test_drift_workflow_wires_real_pipeline_inputs_and_preflight_bundle() -> Non
     assert "repository: QuantStrategyLab/QuantPlatformKit" in workflow
     assert (
         "repository: QuantStrategyLab/QuantPlatformKit\n"
-        "          ref: 086166458d4e3f61bb8937054cf7e69ff6ef914a\n"
+        "          ref: eae362bd3e3fad5be59a7615eeba10be839a9934\n"
         "          path: external/QuantPlatformKit"
     ) in workflow
-    assert "quant_platform_kit_ref: 086166458d4e3f61bb8937054cf7e69ff6ef914a" in workflow
+    assert "quant_platform_kit_ref: eae362bd3e3fad5be59a7615eeba10be839a9934" in workflow
     assert "python -m pip install --no-deps -e external/QuantPlatformKit" in workflow
     assert "scripts/run_walk_forward_backtest.py" in workflow
     assert '"--list-profiles"' in workflow
@@ -38,10 +38,18 @@ def test_drift_workflow_wires_real_pipeline_inputs_and_preflight_bundle() -> Non
     assert "Upload lifecycle preflight artifact" in workflow
     assert "lifecycle-preflight-${{ github.run_id }}-${{ github.run_attempt }}" in workflow
     assert workflow.count("github.ref == format('refs/heads/{0}', github.event.repository.default_branch)") == 2
-    assert "uses: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@086166458d4e3f61bb8937054cf7e69ff6ef914a" in workflow
+    assert "uses: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@eae362bd3e3fad5be59a7615eeba10be839a9934" in workflow
     assert "strategy_domain: crypto" in workflow
     assert "snapshot_repository: QuantStrategyLab/CryptoLivePoolPipelines" in workflow
     assert "snapshot_checkout_path: external/CryptoLivePoolPipelines" in workflow
     assert "lifecycle_preflight_artifact: lifecycle-preflight-${{ github.run_id }}-${{ github.run_attempt }}" in workflow
-    assert "codex_audit_service_url: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}" in workflow
+    # Retired v1 Codex/GPT/Claude reviewer wiring must not return.
+    assert "codex_audit_service_url" not in workflow
+    assert "ai_gateway_service_url" not in workflow
+    # V2 project-scoped task service; provider (e.g. dot) is chosen by the
+    # service-side project policy, not by this caller.
+    assert "ai_service_url: ${{ vars.AI_SERVICE_URL }}" in workflow
+    assert "ai_service_audience: ${{ vars.AI_SERVICE_AUDIENCE }}" in workflow
+    assert "ai_service_reviewers_json: ${{ vars.AI_SERVICE_REVIEWERS_JSON }}" in workflow
+    assert "id-token: write" in workflow
     assert "secrets.SNAPSHOT_REPOSITORY_TOKEN || secrets.QSL_REPO_SYNC_TOKEN || github.token" in workflow