Merge pull request #132 from QuantStrategyLab/codex/provision-api-reviewer-env

fix: load provider credentials for audit service

Author: Pigbibi

ops/codex-audit/README.md

@@ -14,6 +14,8 @@ Fully automatic monthly model tier maintenance:
 Repo secrets `OPENAI_API_KEY` / `ANTHROPIC_API_KEY` are written to
 `/etc/codex-audit-bridge/model-catalog.env` by the self-hosted workflow
 [Deploy Model Catalog Sync](../../.github/workflows/deploy_model_catalog_sync.yml).
+The same root-owned file is imported by `codex-audit-service`; no provider key
+is placed in repository code, workflow output, or an inline systemd setting.
 
 - **auto**: push to `main` that touches catalog paths triggers deploy
 - **manual**: Actions → Deploy Model Catalog Sync → `deploy` / `inspect` / `sync-now`

scripts/deploy_codex_audit_service.sh

@@ -22,6 +22,9 @@ ALLOWED_DIRECT_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_DIRECT_REPOSITORIES:-
 ALLOWED_SOURCE_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES:-QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies}"
 JOB_DIR="${CODEX_AUDIT_SERVICE_JOB_DIR:-/var/lib/codex-audit-bridge/jobs}"
 ADMIN_ENV_FILE="${CODEX_AUDIT_SERVICE_ADMIN_ENV_FILE:-/etc/codex-audit-bridge/admin.env}"
+# The model-catalog deploy owns the provider-key file.  Reuse that root-owned
+# file instead of duplicating API keys in a second deployment path.
+PROVIDER_ENV_FILE="${CODEX_AUDIT_SERVICE_PROVIDER_ENV_FILE:-/etc/codex-audit-bridge/model-catalog.env}"
 EXECUTION_POLICY_FILE="${CODEX_AUDIT_SERVICE_EXECUTION_POLICY_PATH:-/etc/codex-audit-bridge-policy/execution_policy.json}"
 AUDIT_MODEL="${CODEX_AUDIT_SERVICE_MODEL:-}"
 AUDIT_REASONING_EFFORT="${CODEX_AUDIT_SERVICE_REASONING_EFFORT:-}"
@@ -386,6 +389,7 @@ Environment=CODEX_AUDIT_SERVICE_OPENAI_USAGE_WINDOW_DAYS=${OPENAI_USAGE_WINDOW_D
 Environment=CODEX_AUDIT_SERVICE_ANTHROPIC_USAGE_WINDOW_DAYS=${ANTHROPIC_USAGE_WINDOW_DAYS}
 Environment=CODEX_AUDIT_SERVICE_SANDBOX=read-only
 EnvironmentFile=-${ADMIN_ENV_FILE}
+EnvironmentFile=-${PROVIDER_ENV_FILE}
 ${audit_model_line}
 ${audit_reasoning_effort_line}
 ${audit_token_line}

tests/test_run_monthly_codex_audit.py

@@ -2490,6 +2490,9 @@ def test_vps_deploy_adds_nginx_audit_route_without_router_service(self) -> None:
         self.assertIn("ANTHROPIC_USAGE_WINDOW_DAYS=", deploy_script)
         self.assertIn("CODEX_AUDIT_SERVICE_ADMIN_ENV_FILE", deploy_script)
         self.assertIn("EnvironmentFile=-${ADMIN_ENV_FILE}", deploy_script)
+        self.assertIn("CODEX_AUDIT_SERVICE_PROVIDER_ENV_FILE", deploy_script)
+        self.assertIn("EnvironmentFile=-${PROVIDER_ENV_FILE}", deploy_script)
+        self.assertIn("/etc/codex-audit-bridge/model-catalog.env", deploy_script)
         self.assertIn("sudo install -m 0600 -o root -g root", deploy_script)
         self.assertIn('sudo rm -f "$ADMIN_ENV_FILE"', deploy_script)
         self.assertNotIn("Environment=OPENAI_ADMIN_KEY=", deploy_script)