Add automation authority and ledger endpoints

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

README.md

@@ -33,6 +33,12 @@ When a source issue contains a `codex-pr-feedback` marker from a failed CI run o
 
 This avoids hard-coding Codex CLI setup in every source repository and avoids depending on a repository outside the `QuantStrategyLab` organization.
 
+Automation authority is intentionally split from model confidence. The service treats routine low-risk maintenance as auto-merge eligible, allows already-live same-family strategy optimization to auto-merge only when service-owned checks provide trusted proof and the repo/autonomy policy already allows auto-merge, and keeps new/reconstructed strategies, live-candidate promotion, plugin position-control changes, broker/order execution changes, workflow permissions, and secrets behind human review. `POST /v1/ai/automation/authority` accepts request metadata only as restrictive hints; it cannot relax the policy for live-impacting automation.
+
+Static-token dashboards can read automation control and run-ledger state only for repositories listed in `CODEX_AUDIT_SERVICE_DASHBOARD_REPOSITORIES`; write endpoints still require GitHub OIDC or local test auth.
+
+Automation run state is persisted through the service ledger. Async Codex jobs are recorded automatically; external workflows can also call `POST /v1/ai/automation/runs`. Ledger ownership follows `source_repository` when present, otherwise the authenticated repository. Operators and dashboards can read `GET /v1/ai/automation/runs`, `GET /v1/ai/automation/runs/{run_id}`, and `GET /v1/ai/automation/control` to decide whether to continue, pause auto-fix, switch to review-only, or escalate.
+
 ## Compatibility governance role
 
 `QuantStrategyLab/AIAuditBridge` is an ops/control-plane consumer only:

README.zh-CN.md

@@ -31,8 +31,16 @@ Codex 执行现在只走 service backend：workflow 从 GitHub-hosted runner 调
 
 当源 issue 中出现 CI 失败或 requested-changes review 产生的 `codex-pr-feedback` marker 时，bridge 会把本次运行视为有界重试。只要 marker 指向的 PR 仍然 open、同仓、base 是请求的 source ref，并且 head 分支属于同一个 monthly issue，bridge 会更新现有 PR 分支，而不是再创建一个新 PR。在清理该 PR 上旧的受控自动合并 label 前，bridge 会复用 baseline policy label；如果 policy 无效，或 auto-merge / human-review label 无法安全区分，则跳过 label mutation。
 
+Automation authority 与模型置信度分离：低风险例行维护可进入 auto-merge；已 live 的同族策略优化只有在服务端可信 proof 完整、且仓库/自治策略本身已允许 auto-merge 时才可自动合并；新建/重构策略、live-candidate 晋升、影响仓位控制的插件、broker/order 执行、workflow 权限与 secrets 始终保留人工复核边界。`POST /v1/ai/automation/authority` 中的请求 metadata 只能收紧决策，不能放宽 live-impacting 自动化策略。
+
+Static-token dashboard 只能读取 `CODEX_AUDIT_SERVICE_DASHBOARD_REPOSITORIES` 中列出的仓库的 automation control 与 run-ledger 状态；写接口仍要求 GitHub OIDC 或本地测试 auth。
+
 这样可以避免每个 source repository 都硬编码 Codex CLI，也不会依赖 `QuantStrategyLab` 组织外的仓库。
 
+自动化授权层和模型置信度分开处理。service 将低风险日常维护视为可自动合并；已 live 的同族策略优化只有在 service-owned 检查给出 trusted proof 时才允许自动合并；新策略/重构策略、live-candidate 提升、插件 position-control、券商/订单执行、workflow 权限和 secrets 相关变更都保留人工复核。`POST /v1/ai/automation/authority` 接收的请求 metadata 只能作为降权提示，不能放宽 live 影响自动化 policy。
+
+自动化运行状态通过 service ledger 持久化。异步 Codex job 会自动记录；外部 workflow 也可调用 `POST /v1/ai/automation/runs` 写入状态。Ledger owner 优先使用 `source_repository`，没有时回退到认证仓库。Dashboard 或运维脚本可读取 `GET /v1/ai/automation/runs`、`GET /v1/ai/automation/runs/{run_id}` 和 `GET /v1/ai/automation/control`，判断继续执行、暂停 auto-fix、切到 review-only 或升级人工处理。
+
 ## 兼容性治理定位
 
 `QuantStrategyLab/AIAuditBridge` 只作为 ops/control-plane 的消费侧参与兼容治理：

docs/architecture.md

@@ -43,6 +43,8 @@ operations: **Analyze**, **Execute**, and **Review**.
 | `health.py` | Online endpoint metrics, error rates, latency tracking |
 | `quota.py` | Per-repo budget enforcement, model cost estimation |
 | `autonomy.py` | Confidence scoring, change risk classification |
+| `automation_authority.py` | Machine-readable live-impact authority policy |
+| `automation_run_ledger.py` | Persistent automation run state and runtime control suggestions |
 | `feedback.py` | Closed-loop change tracking and evaluation |
 
 ### Adapters (`service/adapters/`)
@@ -70,6 +72,10 @@ operations: **Analyze**, **Execute**, and **Review**.
 | `/v1/ai/health` | GET | Online service health snapshot | No |
 | `/healthz` | GET | Liveness check | No |
 | `/v1/ai/quota` | GET | Provider usage, Codex account limits, and internal estimates | No |
+| `/v1/ai/automation/authority` | POST | Evaluate auto/human-review authority for live-impacting changes | No |
+| `/v1/ai/automation/control` | GET | Convert health/quota/org-health into continue/review-only/pause/escalate | No |
+| `/v1/ai/automation/runs` | GET/POST | Read or record automation run ledger entries | No |
+| `/v1/ai/automation/runs/{id}` | GET | Read one automation run ledger entry | No |
 | `/v1/ai/feedback/*` | GET/POST | Change tracking and evaluation | No |
 
 Health status vocabulary is defined in [`health_taxonomy.md`](health_taxonomy.md). Do not use `/v1/ai/health` as a substitute for monthly audit results, artifact freshness, or strategy-level health evidence.
@@ -114,6 +120,8 @@ POST /v1/ai/review
   → optional Codex verification
   → extract confidence scores
   → compute consensus + recommended action
+  → cap action through automation authority policy
+  → re-cap through service/quota/org health runtime guards
   → return {results, consensus, recommended_action}
 ```
 
@@ -124,6 +132,24 @@ POST /v1/ai/review
   requirement.
 - **Authorization**: Source repository org must match OIDC claims repository org
   (prevents cross-org escalation).
+- **Automation authority**: Request metadata can only make a decision stricter.
+  Live-equivalent auto-merge requires service-owned trusted proof and an
+  existing repo/autonomy policy decision that already allows auto-merge; public
+  endpoints cannot self-declare it. The review path may read trusted proof from
+  `CODEX_AUDIT_SERVICE_TRUSTED_AUTOMATION_PROOF_PATH`, keyed by
+  `trusted_proof_id` and the server-computed prompt SHA-256; proof records carry
+  the reviewed `source_repository`, `commit_sha`, `diff_hash`, and `changed_paths`,
+  and the caller must be that repository or an explicit automation operator.
+- **Automation ledger tenancy**: Ledger reads and writes use `source_repository`
+  as owner when present, otherwise the authenticated repository; `caller_repository`
+  is audit metadata, not read authorization.
+- **Automation control state**: Run task state may be reported by callers, but
+  control action and health/quota/org-health fields are derived by the service.
+- **Operator access**: Cross-repository automation reads/writes require an
+  explicit operator claim/scope or `CODEX_AUDIT_SERVICE_AUTOMATION_OPERATOR_REPOSITORIES`.
+  Static-token and no-auth local callers are repository-scoped unless explicitly allowlisted.
+- **Dashboard read access**: Static-token dashboards may read automation control
+  and ledger state only for repositories listed in `CODEX_AUDIT_SERVICE_DASHBOARD_REPOSITORIES`.
 - **Sandbox**: Codex sandbox restricted to service-side allowlist (default: `read-only`).
 - **Codex reasoning effort**: `CODEX_AUDIT_SERVICE_REASONING_EFFORT` can hard
   override CLI effort; unset/`auto` routes low/medium/high by task complexity.