Add automation authority and ledger endpoints

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

README.md

@@ -33,6 +33,10 @@ When a source issue contains a `codex-pr-feedback` marker from a failed CI run o
 
 This avoids hard-coding Codex CLI setup in every source repository and avoids depending on a repository outside the `QuantStrategyLab` organization.
 
+Automation authority is intentionally split from model confidence. The service treats routine low-risk maintenance as auto-merge eligible, allows already-live same-family strategy optimization to auto-merge only when service-owned checks provide trusted proof, and keeps new/reconstructed strategies, live-candidate promotion, plugin position-control changes, broker/order execution changes, workflow permissions, and secrets behind human review. `POST /v1/ai/automation/authority` accepts request metadata only as restrictive hints; it cannot relax the policy for live-impacting automation.
+
+Automation run state is persisted through the service ledger. Async Codex jobs are recorded automatically; external workflows can also call `POST /v1/ai/automation/runs`. Ledger ownership follows `source_repository` when present, otherwise the authenticated repository. Operators and dashboards can read `GET /v1/ai/automation/runs`, `GET /v1/ai/automation/runs/{run_id}`, and `GET /v1/ai/automation/control` to decide whether to continue, pause auto-fix, switch to review-only, or escalate.
+
 ## Compatibility governance role
 
 `QuantStrategyLab/AIAuditBridge` is an ops/control-plane consumer only:

README.zh-CN.md

@@ -33,6 +33,10 @@ Codex 执行现在只走 service backend：workflow 从 GitHub-hosted runner 调
 
 这样可以避免每个 source repository 都硬编码 Codex CLI，也不会依赖 `QuantStrategyLab` 组织外的仓库。
 
+自动化授权层和模型置信度分开处理。service 将低风险日常维护视为可自动合并；已 live 的同族策略优化只有在 service-owned 检查给出 trusted proof 时才允许自动合并；新策略/重构策略、live-candidate 提升、插件 position-control、券商/订单执行、workflow 权限和 secrets 相关变更都保留人工复核。`POST /v1/ai/automation/authority` 接收的请求 metadata 只能作为降权提示，不能放宽 live 影响自动化 policy。
+
+自动化运行状态通过 service ledger 持久化。异步 Codex job 会自动记录；外部 workflow 也可调用 `POST /v1/ai/automation/runs` 写入状态。Ledger owner 优先使用 `source_repository`，没有时回退到认证仓库。Dashboard 或运维脚本可读取 `GET /v1/ai/automation/runs`、`GET /v1/ai/automation/runs/{run_id}` 和 `GET /v1/ai/automation/control`，判断继续执行、暂停 auto-fix、切到 review-only 或升级人工处理。
+
 ## 兼容性治理定位
 
 `QuantStrategyLab/AIAuditBridge` 只作为 ops/control-plane 的消费侧参与兼容治理：

docs/architecture.md

@@ -43,6 +43,8 @@ operations: **Analyze**, **Execute**, and **Review**.
 | `health.py` | Online endpoint metrics, error rates, latency tracking |
 | `quota.py` | Per-repo budget enforcement, model cost estimation |
 | `autonomy.py` | Confidence scoring, change risk classification |
+| `automation_authority.py` | Machine-readable live-impact authority policy |
+| `automation_run_ledger.py` | Persistent automation run state and runtime control suggestions |
 | `feedback.py` | Closed-loop change tracking and evaluation |
 
 ### Adapters (`service/adapters/`)
@@ -70,6 +72,10 @@ operations: **Analyze**, **Execute**, and **Review**.
 | `/v1/ai/health` | GET | Online service health snapshot | No |
 | `/healthz` | GET | Liveness check | No |
 | `/v1/ai/quota` | GET | Provider usage, Codex account limits, and internal estimates | No |
+| `/v1/ai/automation/authority` | POST | Evaluate auto/human-review authority for live-impacting changes | No |
+| `/v1/ai/automation/control` | GET | Convert health/quota/org-health into continue/review-only/pause/escalate | No |
+| `/v1/ai/automation/runs` | GET/POST | Read or record automation run ledger entries | No |
+| `/v1/ai/automation/runs/{id}` | GET | Read one automation run ledger entry | No |
 | `/v1/ai/feedback/*` | GET/POST | Change tracking and evaluation | No |
 
 Health status vocabulary is defined in [`health_taxonomy.md`](health_taxonomy.md). Do not use `/v1/ai/health` as a substitute for monthly audit results, artifact freshness, or strategy-level health evidence.
@@ -114,6 +120,8 @@ POST /v1/ai/review
   → optional Codex verification
   → extract confidence scores
   → compute consensus + recommended action
+  → cap action through automation authority policy
+  → re-cap through service/quota/org health runtime guards
   → return {results, consensus, recommended_action}
 ```
 
@@ -124,6 +132,19 @@ POST /v1/ai/review
   requirement.
 - **Authorization**: Source repository org must match OIDC claims repository org
   (prevents cross-org escalation).
+- **Automation authority**: Request metadata can only make a decision stricter.
+  Live-equivalent auto-merge requires service-owned trusted proof; public
+  endpoints cannot self-declare it. The review path may read trusted proof from
+  `CODEX_AUDIT_SERVICE_TRUSTED_AUTOMATION_PROOF_PATH`, keyed by
+  `trusted_proof_id` and the server-computed prompt SHA-256; proof records carry
+  the reviewed `source_repository`, `commit_sha`, `diff_hash`, and `changed_paths`.
+- **Automation ledger tenancy**: Ledger reads and writes use `source_repository`
+  as owner when present, otherwise the authenticated repository.
+- **Automation control state**: Run task state may be reported by callers, but
+  control action and health/quota/org-health fields are derived by the service.
+- **Operator access**: Cross-repository automation reads/writes require an
+  explicit operator claim/scope or `CODEX_AUDIT_SERVICE_AUTOMATION_OPERATOR_REPOSITORIES`.
+  Static-token and no-auth local callers are repository-scoped unless explicitly allowlisted.
 - **Sandbox**: Codex sandbox restricted to service-side allowlist (default: `read-only`).
 - **Codex reasoning effort**: `CODEX_AUDIT_SERVICE_REASONING_EFFORT` can hard
   override CLI effort; unset/`auto` routes low/medium/high by task complexity.