chore: allow QPK artifact v7 workflow pin

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/vps_codex_service_ops.yml

@@ -49,7 +49,8 @@ jobs:
             651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e \
             bb91e4cad1a32d58dc0e4023f1cbe0c7ec150d81 \
             6b887d9954eb656141597eac077ca22053a525ef \
-            b939522701b527096e5d028346e777714466bcc5; do
+            b939522701b527096e5d028346e777714466bcc5 \
+            8b8ce3543c04bf12920e38b0f45d2b32a8896580; do
             gh api \
               "repos/QuantStrategyLab/QuantPlatformKit/contents/.github/workflows/reusable-drift-check.yml?ref=${ref}" \
               --jq '.sha' >/dev/null
@@ -64,7 +65,7 @@ jobs:
           CODEX_AUDIT_SERVICE_ALLOWED_REFS: refs/heads/main
           # Exact canonical audit job plus immutable QPK `uses:` refs pinned by strategy drift callers.
           # Rotation tracked in #64; remove the old QPK SHA after final strategy-run verification.
-          CODEX_AUDIT_SERVICE_ALLOWED_JOB_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@644cd9002ae92f2aaca6f7efb4afa4986fae05ea,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@d0a081ca5868faaf1a6dd870cf4b93643978cd11,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@fcddef20eea5deb876e739263042acdcb3e9cd1b,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@4f8465b28a6787d39d21e50f9d95a77841d6ad56,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@bb91e4cad1a32d58dc0e4023f1cbe0c7ec150d81,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@6b887d9954eb656141597eac077ca22053a525ef,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@b939522701b527096e5d028346e777714466bcc5
+          CODEX_AUDIT_SERVICE_ALLOWED_JOB_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@644cd9002ae92f2aaca6f7efb4afa4986fae05ea,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@d0a081ca5868faaf1a6dd870cf4b93643978cd11,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@fcddef20eea5deb876e739263042acdcb3e9cd1b,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@4f8465b28a6787d39d21e50f9d95a77841d6ad56,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@bb91e4cad1a32d58dc0e4023f1cbe0c7ec150d81,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@6b887d9954eb656141597eac077ca22053a525ef,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@b939522701b527096e5d028346e777714466bcc5,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@8b8ce3543c04bf12920e38b0f45d2b32a8896580
           CODEX_AUDIT_SERVICE_ALLOWED_DIRECT_REPOSITORIES: QuantStrategyLab/AIAuditBridge
           CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies
           CODEX_AUDIT_SERVICE_MODEL: ${{ vars.CODEX_AUDIT_SERVICE_MODEL }}

docs/drift_oidc_rotation.md

@@ -10,7 +10,7 @@ To rotate the QPK reusable workflow without an untrusted or unavailable window:
 4. Verify CN, US, and crypto drift runs.
 5. Remove the old SHA, merge, and deploy again.
 
-Current rotation retains the prior exact QPK workflow refs while CN, HK, US, and crypto move to `b939522701b527096e5d028346e777714466bcc5`. That version upgrades both artifact actions to the supported runner runtime; it does not broaden caller identity or execution authority. [issue #64](https://github.com/QuantStrategyLab/AIAuditBridge/issues/64) tracks removal after the new pins complete scheduled verification. The deploy workflow verifies that every allowlisted QPK SHA resolves to `reusable-drift-check.yml` before changing the service.
+Current rotation retains the prior exact QPK workflow refs while CN, HK, US, and crypto move to `8b8ce3543c04bf12920e38b0f45d2b32a8896580`. That version upgrades both artifact actions to the supported runner runtime; it does not broaden caller identity or execution authority. [issue #64](https://github.com/QuantStrategyLab/AIAuditBridge/issues/64) tracks removal after the new pins complete scheduled verification. The deploy workflow verifies that every allowlisted QPK SHA resolves to `reusable-drift-check.yml` before changing the service.
 
 Never use a wildcard for `job_workflow_ref`. Strategy drift delegation must use an exact QPK SHA. AIAuditBridge PR-review OIDC entries are retired and must not be restored; GitHub Codex App is the sole AI PR reviewer.
 

scripts/deploy_codex_audit_service.sh

@@ -17,7 +17,7 @@ ALLOWED_REPOSITORY_VISIBILITIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBI
 # Exact canonical audit job identity. Single source of truth for delegated drift code follows.
 # Rotation #64 removes the old SHA by 2026-07-18.
 # Rotate with the two-SHA procedure in docs/drift_oidc_rotation.md.
-ALLOWED_JOB_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_JOB_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@644cd9002ae92f2aaca6f7efb4afa4986fae05ea,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@d0a081ca5868faaf1a6dd870cf4b93643978cd11,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@fcddef20eea5deb876e739263042acdcb3e9cd1b,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@4f8465b28a6787d39d21e50f9d95a77841d6ad56,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@bb91e4cad1a32d58dc0e4023f1cbe0c7ec150d81,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@6b887d9954eb656141597eac077ca22053a525ef,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@b939522701b527096e5d028346e777714466bcc5}"
+ALLOWED_JOB_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_JOB_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@644cd9002ae92f2aaca6f7efb4afa4986fae05ea,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@d0a081ca5868faaf1a6dd870cf4b93643978cd11,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@fcddef20eea5deb876e739263042acdcb3e9cd1b,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@4f8465b28a6787d39d21e50f9d95a77841d6ad56,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@bb91e4cad1a32d58dc0e4023f1cbe0c7ec150d81,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@6b887d9954eb656141597eac077ca22053a525ef,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@b939522701b527096e5d028346e777714466bcc5,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@8b8ce3543c04bf12920e38b0f45d2b32a8896580}"
 ALLOWED_DIRECT_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_DIRECT_REPOSITORIES:-QuantStrategyLab/AIAuditBridge}"
 ALLOWED_SOURCE_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES:-QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies}"
 JOB_DIR="${CODEX_AUDIT_SERVICE_JOB_DIR:-/var/lib/codex-audit-bridge/jobs}"

tests/test_run_monthly_codex_audit.py

@@ -2455,7 +2455,7 @@ def test_vps_deploy_adds_nginx_audit_route_without_router_service(self) -> None:
         timeout_qpk_job_ref = "QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e"
         outcome_qpk_job_ref = "QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@bb91e4cad1a32d58dc0e4023f1cbe0c7ec150d81"
         artifact_qpk_job_ref = "QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@6b887d9954eb656141597eac077ca22053a525ef"
-        artifact_v6_qpk_job_ref = "QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@b939522701b527096e5d028346e777714466bcc5"
+        artifact_v7_qpk_job_ref = "QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@8b8ce3543c04bf12920e38b0f45d2b32a8896580"
         self.assertIn(qpk_job_ref, deploy_script)
         self.assertIn(qpk_job_ref, workflow)
         self.assertIn(next_qpk_job_ref, deploy_script)
@@ -2466,8 +2466,8 @@ def test_vps_deploy_adds_nginx_audit_route_without_router_service(self) -> None:
         self.assertIn(outcome_qpk_job_ref, workflow)
         self.assertIn(artifact_qpk_job_ref, deploy_script)
         self.assertIn(artifact_qpk_job_ref, workflow)
-        self.assertIn(artifact_v6_qpk_job_ref, deploy_script)
-        self.assertIn(artifact_v6_qpk_job_ref, workflow)
+        self.assertIn(artifact_v7_qpk_job_ref, deploy_script)
+        self.assertIn(artifact_v7_qpk_job_ref, workflow)
         self.assertIn("Single source of truth for delegated drift code", deploy_script)
         self.assertIn("Rotation #64 removes the old SHA by 2026-07-18", deploy_script)
         self.assertIn("QuantStrategyLab/CnEquityStrategies", deploy_script)