[codex] Port live AiGateway service architecture - #10
Conversation
Co-Authored-By: Codex <noreply@openai.com>
🤖 Codex PR ReviewPlease ensure a human reviewer checks this PR before merging. |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1e35afcf94
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| except BridgeError as exc: | ||
| return str(exc) |
There was a problem hiding this comment.
When CODEX_AUDIT_SERVICE_URL is set, this best-effort helper only converts BridgeErrors into warnings. request_codex_service_json() can also raise transport/timeout errors or JSONDecodeError for non-JSON responses, and publish_remediation() calls this after pushing/creating the PR but before posting the source issue comment. In those service-outage cases the run can fail after the remediation PR exists, leaving operators without the completion comment even though the change-feed write was intended to be non-blocking.
Useful? React with 👍 / 👎.
| ALLOWED_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge}" | ||
| ALLOWED_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_REFS:-refs/heads/main,refs/pull/*/merge}" |
There was a problem hiding this comment.
Allowing codex_pr_review.yml@refs/pull/*/merge and refs/pull/*/merge means PR runs can mint OIDC tokens that pass the service allowlist. I checked .github/workflows/codex_pr_review.yml: it runs on pull_request, grants id-token: write, checks out the PR merge commit, then runs python scripts/run_codex_pr_review.py, so in PR contexts where GitHub exposes the requested OIDC token (for example same-repository PR branches), PR-authored code can submit arbitrary jobs to the shared Codex service instead of being limited to trusted main-branch workflow code.
Useful? React with 👍 / 👎.
| function shouldIgnoreLegacyEndpointBase(basePath, pathname) { | ||
| return basePath === "/v1/codex-audit" && pathname.startsWith("/v1/ai/"); | ||
| } |
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
1 participant
Summary
AIAuditBridgerepo while keepingCodexAuditBridgeonly as temporary legacy compatibility.Why
AIAuditBridgeis now the canonical QuantStrategyLab AI audit bridge, but the oldCodexAuditBridgerepo had newer live service/dashboard fixes. This PR brings those fixes forward so the dashboard can become a real operational surface instead of a static shell.Validation
bash -n scripts/deploy_codex_audit_service.shnode --test cloudflare/ai-gateway-dash/tests/index.test.mjspython3 -m ruff check .python3 -m unittest discover -s tests -v(206 tests)git diff --checkNotes
CodexAuditBridgeremains in service allowlists only for migration compatibility./v1/ai/feedback/evaluateand/v1/ai/feedback/shadowdata.