Retire duplicate AIAudit PR reviewer

.github/actionlint.yaml

@@ -1,8 +1,3 @@
 self-hosted-runner:
   labels:
     - codex-vps
-paths:
-  .github/workflows/codex_pr_review.yml:
-    ignore:
-      - 'workflow_repository'
-      - 'workflow_sha'

.github/codex_auto_merge_policy.json

@@ -23,61 +23,5 @@
     }
   },
   "max_changed_files": 30,
-  "max_changed_lines": 2000,
-  "approved_change_bundles": [
-    {
-      "name": "retire-duplicate-aiaudit-pr-reviewer",
-      "exact_changed_paths": [
-        ".github/actionlint.yaml",
-        ".github/codex_auto_merge_policy.json",
-        ".github/workflows/codex_pr_review.yml",
-        ".github/workflows/vps_codex_service_ops.yml",
-        "README.md",
-        "README.zh-CN.md",
-        "client/gateway_client.py",
-        "docs/ai_autonomy_architecture.md",
-        "docs/async_service_deployment.md",
-        "docs/drift_oidc_rotation.md",
-        "prompts/pr_review.md",
-        "scripts/deploy_codex_audit_service.sh",
-        "scripts/run_codex_pr_review.py",
-        "service/dual_review_primary.py",
-        "service/org_health.py",
-        "tests/test_codex_audit_service_complexity.py",
-        "tests/test_dual_review_primary.py",
-        "tests/test_oidc_reusable_workflow_auth.py",
-        "tests/test_org_health.py",
-        "tests/test_run_codex_pr_review.py",
-        "tests/test_run_monthly_codex_audit.py",
-        "tests/test_single_pr_reviewer_contract.py"
-      ],
-      "exact_deleted_paths": [
-        "prompts/pr_review.md",
-        "scripts/run_codex_pr_review.py",
-        "tests/test_run_codex_pr_review.py"
-      ],
-      "max_changed_lines": 3000
-    }
-  ],
-  "pr_review": {
-    "enabled": true,
-    "block_severities": [
-      "critical",
-      "high"
-    ],
-    "skip_paths": [
-      "docs/**",
-      "**.md",
-      "**.txt",
-      "**.json",
-      "**.csv",
-      "LICENSE",
-      ".github/dependabot*"
-    ],
-    "skip_risk_levels": [
-      "low"
-    ],
-    "timeout_minutes": 20,
-    "max_diff_lines": 2400
-  }
+  "max_changed_lines": 2000
 }

.github/workflows/codex_pr_review.yml

@@ -1,37 +1,27 @@
-name: Codex PR Review
+name: Retired Codex PR Review Compatibility
 
-# Runs on PRs AND can be called as a reusable workflow from other repos.
-# Consumer repos use:
-#   uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main
-#   secrets:
-#     CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
+# Compatibility-only entry point for disabled legacy callers.
+# GitHub Codex App is the sole AI PR reviewer.
 on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
   workflow_call:
     inputs:
       caller_concurrency_key:
-        description: "Stable caller-side key used to cancel stale review jobs for the same PR."
         required: false
         type: string
       allow_unconfigured_backend:
-        description: "Deprecated compatibility input. The review check always fails closed when no backend is available."
         required: false
         type: boolean
         default: false
       api_fallback_enabled:
-        description: "Optional true/false override for direct API fallback. Reusable callers default to false and do not inherit repository variables."
         required: false
         type: string
         default: "false"
       direct_api_primary_enabled:
-        description: "Optional true/false override for API-only PR review. Reusable callers default to false and do not inherit repository variables."
         required: false
         type: string
         default: "false"
     secrets:
       CODEX_AUDIT_REUSABLE_WORKFLOW_TOKEN:
-        description: "Token that can read QuantStrategyLab/AIAuditBridge when this workflow is called from another private repo."
         required: false
       ANTHROPIC_API_KEY:
         required: false
@@ -40,117 +30,14 @@ on:
       CODEX_AUDIT_SERVICE_URL:
         required: false
 
-permissions:
-  contents: read
-  id-token: write
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: codex-pr-review-${{ github.repository }}-${{ inputs.caller_concurrency_key || github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
+permissions: {}
 
 jobs:
-  review:
+  retired:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
+    timeout-minutes: 1
     steps:
-      - name: Reject unsupported fork pull requests
-        if: github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository
+      - name: Reject retired AIAudit PR review calls
         run: |
-          echo "::error::Codex review is not configured for fork pull requests; merge remains blocked." >&2
+          echo "::error::AIAudit PR review is retired; use the GitHub Codex App."
           exit 1
-
-      - name: Checkout review target
-        uses: actions/checkout@v6
-        with:
-          path: source
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
-          persist-credentials: false
-
-      - name: Validate AIAuditBridge self-review ref
-        if: github.repository == 'QuantStrategyLab/AIAuditBridge'
-        env:
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          if [ "${GITHUB_EVENT_NAME}" != "pull_request_target" ] || [ -z "${PR_HEAD_SHA}" ]; then
-            echo "::error::AIAuditBridge self-review requires pull_request_target with a PR head SHA." >&2
-            exit 1
-          fi
-
-      - name: Checkout bridge review scripts
-        uses: actions/checkout@v6
-        with:
-          repository: ${{ github.repository == 'QuantStrategyLab/AIAuditBridge' && 'QuantStrategyLab/AIAuditBridge' || job.workflow_repository }}
-          ref: ${{ github.repository == 'QuantStrategyLab/AIAuditBridge' && github.event.pull_request.base.sha || job.workflow_sha }}
-          path: bridge
-          token: ${{ secrets.CODEX_AUDIT_REUSABLE_WORKFLOW_TOKEN || github.token }}
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-
-      - name: Run Codex PR Review
-        id: review
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          ANTHROPIC_MODEL: ${{ vars.ANTHROPIC_MODEL || 'claude-sonnet-4-6' }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          OPENAI_MODEL: ${{ vars.OPENAI_MODEL || 'gpt-5.4-mini' }}
-          CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
-          CODEX_AUDIT_SERVICE_AUDIENCE: ${{ vars.CODEX_AUDIT_SERVICE_AUDIENCE || 'quant-codex-audit' }}
-          CODEX_PR_REVIEW_REPO_ROOT: ${{ github.workspace }}/source
-          CODEX_PR_REVIEW_REUSABLE_CALL: ${{ github.repository != 'QuantStrategyLab/AIAuditBridge' && 'true' || 'false' }}
-          CODEX_PR_REVIEW_API_FALLBACK_INPUT: ${{ inputs.api_fallback_enabled }}
-          CODEX_PR_REVIEW_DIRECT_API_PRIMARY_INPUT: ${{ inputs.direct_api_primary_enabled }}
-          CODEX_PR_REVIEW_API_FALLBACK_DEFAULT: ${{ vars.CODEX_PR_REVIEW_API_FALLBACK_ENABLED || 'true' }}
-          CODEX_PR_REVIEW_DIRECT_API_PRIMARY_DEFAULT: ${{ vars.CODEX_PR_REVIEW_DIRECT_API_PRIMARY_ENABLED || 'true' }}
-        working-directory: source
-        run: |
-          set -euo pipefail
-          bridge_script="${GITHUB_WORKSPACE}/bridge/scripts/run_codex_pr_review.py"
-          if [ -f "${bridge_script}" ]; then
-            script_path="${bridge_script}"
-          else
-            echo "::error::Trusted Codex review script not found. Ensure the bridge checkout can read QuantStrategyLab/AIAuditBridge." >&2
-            exit 1
-          fi
-          resolve_boolean() {
-            local name="$1" requested="$2" fallback="$3" value
-            if [ "${CODEX_PR_REVIEW_REUSABLE_CALL}" = "true" ]; then
-              # Only consumers reach this branch; their explicit/default input is authoritative.
-              value="${requested}"
-            else
-              # AIAuditBridge self-review has no workflow_call inputs; retain its local policy.
-              value="${fallback}"
-            fi
-            value="$(printf '%s' "${value}" | tr '[:upper:]' '[:lower:]')"
-            case "${value}" in
-              true|false) printf '%s' "${value}" ;;
-              *) echo "::error::${name} must be true or false" >&2; return 1 ;;
-            esac
-          }
-          if ! api_fallback_enabled="$(resolve_boolean CODEX_PR_REVIEW_API_FALLBACK_ENABLED "${CODEX_PR_REVIEW_API_FALLBACK_INPUT}" "${CODEX_PR_REVIEW_API_FALLBACK_DEFAULT}")"; then
-            exit 1
-          fi
-          if ! direct_api_primary_enabled="$(resolve_boolean CODEX_PR_REVIEW_DIRECT_API_PRIMARY_ENABLED "${CODEX_PR_REVIEW_DIRECT_API_PRIMARY_INPUT}" "${CODEX_PR_REVIEW_DIRECT_API_PRIMARY_DEFAULT}")"; then
-            exit 1
-          fi
-          CODEX_PR_REVIEW_API_FALLBACK_ENABLED="${api_fallback_enabled}" \
-          CODEX_PR_REVIEW_DIRECT_API_PRIMARY_ENABLED="${direct_api_primary_enabled}" \
-            timeout --signal=TERM --kill-after=60s 25m python -I "${script_path}"
-
-      - name: Upload review diagnostics
-        if: always()
-        uses: actions/upload-artifact@v7
-        with:
-          name: codex-pr-review-${{ github.event.pull_request.number || github.run_id }}-${{ github.run_id }}
-          path: source/data/output/codex_pr_review/
-          if-no-files-found: warn

.github/workflows/vps_codex_service_ops.yml

@@ -57,11 +57,11 @@ jobs:
           CODEX_AUDIT_SSH_UNBAN_IP: ${{ inputs.ssh_unban_ip }}
           CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies
           # workflow_dispatch emits protected-main workflow_ref claims; the deploy script pins delegated QPK code by exact job_workflow_ref SHA.
-          CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/BinancePlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CharlesSchwabPlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CnEquitySnapshotPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CryptoLivePoolPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/FirstradePlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/HkEquitySnapshotPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/HkEquityStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/IBKRGatewayManager/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/InteractiveBrokersPlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/LongBridgePlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/MarketSignalSources/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/PoliticalEventTrackingResearch/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QmtPlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantAdvisorResearch/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantPlatformKit/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantRuntimeSettings/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantStrategyPlugins/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/ResearchSignalContextPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/SchwabTokenAutoRefresher/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/UsEquitySnapshotPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main
-          CODEX_AUDIT_SERVICE_ALLOWED_REFS: refs/heads/main,refs/pull/*/merge
+          CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main
+          CODEX_AUDIT_SERVICE_ALLOWED_REFS: refs/heads/main
           # Rotation tracked in #64; remove the old SHA by 2026-07-18 after final strategy-run verification.
           # Must match the immutable QPK `uses:` ref pinned by all strategy drift callers.
-          CODEX_AUDIT_SERVICE_ALLOWED_JOB_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@86458c44b06593b6d7a1602b3c38e7a1c143ef17,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@644cd9002ae92f2aaca6f7efb4afa4986fae05ea,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@d0a081ca5868faaf1a6dd870cf4b93643978cd11,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@fcddef20eea5deb876e739263042acdcb3e9cd1b,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@4f8465b28a6787d39d21e50f9d95a77841d6ad56,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e
+          CODEX_AUDIT_SERVICE_ALLOWED_JOB_WORKFLOW_REFS: QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@644cd9002ae92f2aaca6f7efb4afa4986fae05ea,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@d0a081ca5868faaf1a6dd870cf4b93643978cd11,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@fcddef20eea5deb876e739263042acdcb3e9cd1b,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@4f8465b28a6787d39d21e50f9d95a77841d6ad56,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e
           CODEX_AUDIT_SERVICE_ALLOWED_DIRECT_REPOSITORIES: QuantStrategyLab/AIAuditBridge
           CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies
           CODEX_AUDIT_SERVICE_MODEL: ${{ vars.CODEX_AUDIT_SERVICE_MODEL }}