Merge pull request #1 from QuantStrategyLab/codex/migrate-new-slug-docs

chore: switch defaults to AIAuditBridge slug

Author: Pigbibi

.github/workflows/codex_pr_review.yml

@@ -2,7 +2,7 @@ name: Codex PR Review
 
 # Runs on PRs AND can be called as a reusable workflow from other repos.
 # Consumer repos use:
-#   uses: QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@main
+#   uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main
 #   secrets: inherit
 on:
   pull_request:

README.md

@@ -46,7 +46,7 @@ When adding a new dispatcher, update `SOURCE_REPO_TASKS` in `scripts/run_monthly
 
 CodexAuditBridge uses the service backend only. The workflow runs on `ubuntu-latest` and requires a QuantStrategyLab-owned HTTPS/443 Codex audit service.
 
-Configure these values in `QuantStrategyLab/CodexAuditBridge`:
+Configure these values in `QuantStrategyLab/AIAuditBridge`:
 
 - Repository secret `CODEX_AUDIT_SERVICE_URL`, for example `https://codex-audit.example.com`.
   Use a secret because the URL may expose origin infrastructure details.
@@ -83,7 +83,7 @@ Configure these values in `QuantStrategyLab/CodexAuditBridge`:
 Run the service host with:
 
 ```bash
-CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/CodexAuditBridge \
+CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge \
 CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
 CODEX_AUDIT_SERVICE_AUDIENCE=quant-codex-audit \
 CODEX_AUDIT_SERVICE_MODEL=gpt-5.4 \

README.zh-CN.md

@@ -46,7 +46,7 @@ Codex 执行现在只走 service backend：workflow 从 GitHub-hosted runner 调
 
 CodexAuditBridge 只使用 service backend。workflow 运行在 `ubuntu-latest`，并调用 QuantStrategyLab 自有 HTTPS/443 Codex audit service。
 
-需要在 `QuantStrategyLab/CodexAuditBridge` 配置：
+需要在 `QuantStrategyLab/AIAuditBridge` 配置：
 
 - Repository secret `CODEX_AUDIT_SERVICE_URL`，例如 `https://codex-audit.example.com`。
   URL 可能暴露源站基础设施信息，因此放在 secret，不放在普通 variable。
@@ -67,7 +67,7 @@ CodexAuditBridge 只使用 service backend。workflow 运行在 `ubuntu-latest`
 service host 启动示例：
 
 ```bash
-CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/CodexAuditBridge \
+CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge \
 CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
 CODEX_AUDIT_SERVICE_AUDIENCE=quant-codex-audit \
 CODEX_AUDIT_SERVICE_MODEL=gpt-5.4 \

docs/async_service_deployment.md

@@ -4,7 +4,7 @@ CodexAuditBridge uses an async service contract to avoid keeping a GitHub Action
 
 ## Architecture
 
-1. A source repository creates or updates an audit issue, then dispatches `QuantStrategyLab/CodexAuditBridge`.
+1. A source repository creates or updates an audit issue, then dispatches `QuantStrategyLab/AIAuditBridge`.
 2. CodexAuditBridge clones the source repository with a scoped GitHub App token, builds the audit prompt, and requests a GitHub Actions OIDC token with audience `quant-codex-audit`.
 3. CodexAuditBridge submits `POST /v1/codex-audit/jobs` through the Cloudflare Worker.
 4. The Worker forwards only Quant audit routes with bearer tokens to the VPS origin. The VPS service validates OIDC signature, audience, repository, workflow ref, git ref, source repository allowlists, and payload size.
@@ -28,9 +28,9 @@ The historical self-hosted direct-Codex workflows in `SelfHostedCodexAuditBridge
 
 - Source repositories, including public QuantStrategyLab repositories, must not store provider keys or the Codex service URL.
 - Source repositories should only dispatch the bridge workflow and provide issue/source context. Avoid running Codex directly in public workflows.
-- `QuantStrategyLab/CodexAuditBridge` is public, so it may contain only client/orchestration code. Its service URL, provider fallback keys, GitHub App private key, and Cloudflare origin stay in GitHub or Cloudflare secrets.
-- The VPS service should allow only `QuantStrategyLab/CodexAuditBridge` in `CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES`; this OIDC allowlist is required because the bridge repository is public.
-- The VPS service should require `CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS=QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main`.
+- `QuantStrategyLab/AIAuditBridge` is public, so it may contain only client/orchestration code. Its service URL, provider fallback keys, GitHub App private key, and Cloudflare origin stay in GitHub or Cloudflare secrets.
+- The VPS service should allow only `QuantStrategyLab/AIAuditBridge` in `CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES`; this OIDC allowlist is required because the bridge repository is public.
+- The VPS service should require `CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS=QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main`.
 - The VPS service should require `CODEX_AUDIT_SERVICE_ALLOWED_REFS=refs/heads/main`.
 - Keep `CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES=public` unless the bridge repository is intentionally private.
 - The VPS service should keep `CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES` limited to the current source repositories.
@@ -55,8 +55,8 @@ For public source repositories:
 After merging the async service code, run the manual `VPS Codex Service Ops` workflow with deploy mode, or run on the VPS:
 
 ```bash
-CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/CodexAuditBridge \
-CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS='QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main' \
+CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge \
+CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS='QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main' \
 CODEX_AUDIT_SERVICE_ALLOWED_REFS='refs/heads/main' \
 CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES='public' \
 CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
@@ -95,7 +95,7 @@ the Worker URL, the Worker may reject it before it reaches the origin service.
 ### 3. Point CodexAuditBridge at the Worker
 
 ```bash
-gh secret set CODEX_AUDIT_SERVICE_URL -R QuantStrategyLab/CodexAuditBridge
+gh secret set CODEX_AUDIT_SERVICE_URL -R QuantStrategyLab/AIAuditBridge
 ```
 
 Set the secret value to the Worker base URL, for example:

scripts/deploy_codex_audit_service.sh

@@ -7,8 +7,8 @@ AUDIT_SERVICE_NAME="${CODEX_AUDIT_SERVICE_SYSTEMD_NAME:-codex-audit-service}"
 DEPLOY_DIR="${CODEX_AUDIT_SERVICE_DEPLOY_DIR:-/opt/codex-audit-bridge}"
 AUDIT_PORT="${CODEX_AUDIT_SERVICE_PORT:-8797}"
 AUDIENCE="${CODEX_AUDIT_SERVICE_AUDIENCE:-quant-codex-audit}"
-ALLOWED_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES:-QuantStrategyLab/CodexAuditBridge}"
-ALLOWED_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS:-QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main}"
+ALLOWED_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES:-QuantStrategyLab/AIAuditBridge}"
+ALLOWED_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main}"
 ALLOWED_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_REFS:-refs/heads/main}"
 ALLOWED_REPOSITORY_VISIBILITIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES:-public}"
 ALLOWED_SOURCE_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES:-QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines}"

tests/test_run_monthly_codex_audit.py

@@ -259,15 +259,15 @@ def test_codex_audit_service_oidc_requires_repository_workflow_and_ref_allowlist
             "aud": "quant-codex-audit",
             "iss": codex_audit_service.GITHUB_OIDC_ISSUER,
             "exp": int(time.time()) + 300,
-            "repository": "QuantStrategyLab/CodexAuditBridge",
-            "workflow_ref": "QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main",
+            "repository": "QuantStrategyLab/AIAuditBridge",
+            "workflow_ref": "QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main",
             "ref": "refs/heads/main",
             "repository_visibility": "public",
         }
         env = {
-            "CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES": "QuantStrategyLab/CodexAuditBridge",
+            "CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES": "QuantStrategyLab/AIAuditBridge",
             "CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS": (
-                "QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main"
+                "QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main"
             ),
             "CODEX_AUDIT_SERVICE_ALLOWED_REFS": "refs/heads/main",
             "CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES": "public",
@@ -284,19 +284,19 @@ def test_codex_audit_service_oidc_requires_repository_workflow_and_ref_allowlist
         ):
             claims = codex_audit_service._verify_github_oidc("header.payload.signature")
 
-        self.assertEqual(claims["repository"], "QuantStrategyLab/CodexAuditBridge")
+        self.assertEqual(claims["repository"], "QuantStrategyLab/AIAuditBridge")
 
     def test_codex_audit_service_oidc_rejects_missing_workflow_allowlist(self) -> None:
         payload = {
             "aud": "quant-codex-audit",
             "iss": codex_audit_service.GITHUB_OIDC_ISSUER,
             "exp": int(time.time()) + 300,
-            "repository": "QuantStrategyLab/CodexAuditBridge",
-            "workflow_ref": "QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main",
+            "repository": "QuantStrategyLab/AIAuditBridge",
+            "workflow_ref": "QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main",
             "ref": "refs/heads/main",
         }
         env = {
-            "CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES": "QuantStrategyLab/CodexAuditBridge",
+            "CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES": "QuantStrategyLab/AIAuditBridge",
             "CODEX_AUDIT_SERVICE_ALLOWED_REFS": "refs/heads/main",
         }
         with (
@@ -348,7 +348,7 @@ def test_resolve_source_repo_token_prefers_source_scoped_tokens(self) -> None:
             {
                 "CODEX_AUDIT_GH_TOKEN": "source-token",
                 "GITHUB_TOKEN": "workflow-token",
-                "GITHUB_REPOSITORY": "QuantStrategyLab/CodexAuditBridge",
+                "GITHUB_REPOSITORY": "QuantStrategyLab/AIAuditBridge",
             },
             clear=True,
         ):
@@ -376,7 +376,7 @@ def test_resolve_source_repo_token_rejects_cross_repo_github_token(self) -> None
             os.environ,
             {
                 "GITHUB_TOKEN": "workflow-token",
-                "GITHUB_REPOSITORY": "QuantStrategyLab/CodexAuditBridge",
+                "GITHUB_REPOSITORY": "QuantStrategyLab/AIAuditBridge",
             },
             clear=True,
         ):