-
⚡
-
AiGateway
-
QuantStrategyLab · 运维面板
GitHub 组织成员登录
-
-
-
- 使用 GitHub 登录
-
-
+
+
+ AiGateway
QuantStrategyLab
+
+
+ AiGateway
+ QuantStrategyLab
+ AI audit gateway operations
+ AiGateway 是 QuantStrategyLab 内部的 AI 审计与网关边界，统一承载 API 使用、配额控制、变更效果评估与影子审计，让 AI 能力在组织边界内安全、可观测、可追溯地运行。
+
+ 组织成员登录
+ 使用 GitHub 账号登录以查看内部运维数据。
+
+
+ 使用 GitHub 登录
+
+ 仅限 QuantStrategyLab 组织成员访问
+
+
登录后，您可以查看
+
+ - 服务整体健康状态与关键接口指标摘要
+ - 各仓库 / 团队的配额消耗与预算概览
+ - 变更有效性评估（90 天）
+ - 影子审计分歧统计与裁决结果
+ - 最近变更记录（7 天）
+
+
+
+
`;
// ── Helpers ────────────────────────────────────────────────────────────
@@ -274,6 +270,10 @@ function allowedDashboardApiPath(pathname) {
return DASHBOARD_API_ROUTES.has(clean) ? clean : "";
}
+function shouldIgnoreLegacyEndpointBase(basePath, pathname) {
+ return basePath === "/v1/codex-audit" && pathname.startsWith("/v1/ai/");
+}
+
export function buildDashboardApiUrl(rawOrigin, pathname, search = "") {
if (!rawOrigin || !rawOrigin.trim()) throw new Error("AI_GATEWAY_ORIGIN_URL not configured");
const clean = allowedDashboardApiPath(pathname);
@@ -281,7 +281,7 @@ export function buildDashboardApiUrl(rawOrigin, pathname, search = "") {
const origin = new URL(rawOrigin.trim());
if (origin.protocol !== "https:") throw new Error("AI_GATEWAY_ORIGIN_URL must use HTTPS");
const basePath = withoutTrailingSlash(origin.pathname);
- origin.pathname = !basePath || basePath === "/" ? clean : basePath + clean;
+ origin.pathname = !basePath || basePath === "/" || shouldIgnoreLegacyEndpointBase(basePath, clean) ? clean : basePath + clean;
origin.search = search;
origin.hash = "";
return origin.toString();
diff --git a/cloudflare/ai-gateway-dash/tests/index.test.mjs b/cloudflare/ai-gateway-dash/tests/index.test.mjs
index 00fb9571..76a160ab 100644
--- a/cloudflare/ai-gateway-dash/tests/index.test.mjs
+++ b/cloudflare/ai-gateway-dash/tests/index.test.mjs
@@ -17,6 +17,13 @@ test("buildDashboardApiUrl allows effectiveness route with query", () => {
);
});
+test("buildDashboardApiUrl maps AiGateway routes at root when origin is legacy audit endpoint", () => {
+ assert.equal(
+ buildDashboardApiUrl("https://origin.example/v1/codex-audit", "/v1/ai/health", ""),
+ "https://origin.example/v1/ai/health",
+ );
+});
+
test("buildDashboardApiUrl rejects unsupported origin paths", () => {
assert.throws(
() => buildDashboardApiUrl("https://origin.example", "/v1/ai/execute/jobs", ""),
diff --git a/cloudflare/codex-audit-proxy/README.md b/cloudflare/codex-audit-proxy/README.md
index 36885c9e..ccf7e5b1 100644
--- a/cloudflare/codex-audit-proxy/README.md
+++ b/cloudflare/codex-audit-proxy/README.md
@@ -1,6 +1,6 @@
-# Cloudflare Worker Proxy for CodexAuditBridge
+# Cloudflare Worker Proxy for AIAuditBridge
-This Worker provides a free `workers.dev` HTTPS entry point for CodexAuditBridge when no custom domain is available.
+This Worker provides a free `workers.dev` HTTPS entry point for AIAuditBridge when no custom domain is available.
This Worker should stay separate from the Pigbibi CodexGateway Worker so origin URLs, repository allowlists, and logs remain isolated.
@@ -28,7 +28,7 @@ The production shape is:
quantstrategylab-codex-audit-proxy -> VPS HTTPS origin -> codex-audit-service
```
-After deploy, set the `CodexAuditBridge` GitHub secret `CODEX_AUDIT_SERVICE_URL` to the Worker URL, for example:
+After deploy, set the `AIAuditBridge` GitHub secret `CODEX_AUDIT_SERVICE_URL` to the Worker URL, for example:
```text
https://quantstrategylab-codex-audit-proxy.
.workers.dev
diff --git a/cloudflare/codex-audit-proxy/src/index.mjs b/cloudflare/codex-audit-proxy/src/index.mjs
index e5d2a0aa..370e7343 100644
--- a/cloudflare/codex-audit-proxy/src/index.mjs
+++ b/cloudflare/codex-audit-proxy/src/index.mjs
@@ -1,4 +1,4 @@
-/** CodexAuditBridge Cloudflare proxy — forwards authenticated requests to VPS origin.
+/** AIAuditBridge Cloudflare proxy — forwards authenticated requests to VPS origin.
Allowed paths (expanded for AiGateway v2):
GET /healthz
@@ -82,6 +82,10 @@ function withoutTrailingSlash(pathname) {
return pathname.replace(/\/+$/, "");
}
+function shouldIgnoreLegacyEndpointBase(basePath, pathname) {
+ return basePath === "/v1/codex-audit" && pathname.startsWith("/v1/ai/");
+}
+
/** Check if pathname matches any allowed route or is a valid sub-path (jobs/{id}, changes/{id}). */
function matchRoute(pathname) {
const clean = withoutTrailingSlash(pathname);
@@ -136,7 +140,7 @@ export function buildOriginUrl(rawOriginUrl, pathname, search = "") {
throw new Error("CODEX_AUDIT_ORIGIN_URL must use HTTPS");
}
const basePath = withoutTrailingSlash(origin.pathname);
- if (!basePath || basePath === "/") {
+ if (!basePath || basePath === "/" || shouldIgnoreLegacyEndpointBase(basePath, pathname)) {
origin.pathname = pathname;
} else if (pathname === basePath || pathname.startsWith(basePath + "/")) {
origin.pathname = pathname;
diff --git a/cloudflare/codex-audit-proxy/tests/index.test.mjs b/cloudflare/codex-audit-proxy/tests/index.test.mjs
index df160839..8c8b7b5f 100644
--- a/cloudflare/codex-audit-proxy/tests/index.test.mjs
+++ b/cloudflare/codex-audit-proxy/tests/index.test.mjs
@@ -33,6 +33,13 @@ test("buildOriginUrl maps async status route next to audit endpoint", () => {
);
});
+test("buildOriginUrl maps AiGateway routes at root when origin is legacy audit endpoint", () => {
+ assert.equal(
+ buildOriginUrl("https://origin.example/v1/codex-audit", "/v1/ai/health"),
+ "https://origin.example/v1/ai/health",
+ );
+});
+
test("buildOriginUrl preserves nested base path", () => {
assert.equal(
buildOriginUrl("https://origin.example/codex", "/v1/codex-audit"),
diff --git a/docs/async_service_deployment.md b/docs/async_service_deployment.md
index 3693949a..cdd045d8 100644
--- a/docs/async_service_deployment.md
+++ b/docs/async_service_deployment.md
@@ -15,7 +15,7 @@ The synchronous `POST /v1/codex-audit` endpoint remains available for local diag
## Boundary with Pigbibi CodexGateway
-`AIAuditBridge` intentionally stays separate from `Pigbibi/AIGateway`.
+`AIAuditBridge` intentionally stays separate from `Pigbibi/CodexGateway`.
- `CodexGateway` is a generic Codex invocation facade for prompt/context/image/schema calls.
- `AIAuditBridge` owns QuantStrategyLab monthly audit semantics: source issue context, bounded repository snapshots, service patch contracts, source repository allowlists, GitHub App writeback, and generated remediation PRs.
@@ -29,11 +29,11 @@ The historical self-hosted direct-Codex workflows in `SelfHostedCodexAuditBridge
- Source repositories, including public QuantStrategyLab repositories, must not store provider keys or the Codex service URL.
- Source repositories should only dispatch the bridge workflow and provide issue/source context. Avoid running Codex directly in public workflows.
- `QuantStrategyLab/AIAuditBridge` is public, so it may contain only client/orchestration code. Its service URL, provider fallback keys, GitHub App private key, and Cloudflare origin stay in GitHub or Cloudflare secrets.
-- The VPS service should allow only `QuantStrategyLab/AIAuditBridge` in `CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES`; this OIDC allowlist is required because the bridge repository is public.
-- The VPS service should require `CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS=QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main`.
-- The VPS service should require `CODEX_AUDIT_SERVICE_ALLOWED_REFS=refs/heads/main`.
+- The VPS service should allow `QuantStrategyLab/AIAuditBridge` in `CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES`; keep `QuantStrategyLab/CodexAuditBridge` only as temporary migration compatibility.
+- The VPS service should require explicit `CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS` for the canonical `AIAuditBridge` workflows and any temporary legacy workflow refs.
+- The VPS service should keep `CODEX_AUDIT_SERVICE_ALLOWED_REFS` as narrow as the enabled workflows allow, normally `refs/heads/main` plus `refs/pull/*/merge` for PR review smoke tests.
- Keep `CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES=public` unless the bridge repository is intentionally private.
-- The VPS service should keep `CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES` limited to the current source repositories.
+- The VPS service should keep `CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES` limited to current audit source repositories and PR review targets.
- The Cloudflare Worker stores only `CODEX_AUDIT_ORIGIN_URL` as a Worker secret. Do not commit the origin URL if it exposes infrastructure details.
- Job IDs are random and status reads still require service authentication. Job responses never include the original prompt.
- Static service bearer tokens are no longer supported; production calls must use GitHub Actions OIDC.
@@ -55,11 +55,11 @@ For public source repositories:
After merging the async service code, run the manual `VPS Codex Service Ops` workflow with deploy mode, or run on the VPS:
```bash
-CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge \
-CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS='QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main' \
-CODEX_AUDIT_SERVICE_ALLOWED_REFS='refs/heads/main' \
+CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge \
+CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS='QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge' \
+CODEX_AUDIT_SERVICE_ALLOWED_REFS='refs/heads/main,refs/pull/*/merge' \
CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES='public' \
-CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
+CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
CODEX_AUDIT_SERVICE_AUDIENCE=quant-codex-audit \
CODEX_AUDIT_SERVICE_MODEL=gpt-5.4 \
CODEX_AUDIT_SERVICE_REASONING_EFFORT=auto \
diff --git a/scripts/deploy_codex_audit_service.sh b/scripts/deploy_codex_audit_service.sh
index 8247dd2e..0a97ff58 100644
--- a/scripts/deploy_codex_audit_service.sh
+++ b/scripts/deploy_codex_audit_service.sh
@@ -8,10 +8,10 @@ DEPLOY_DIR="${CODEX_AUDIT_SERVICE_DEPLOY_DIR:-/opt/codex-audit-bridge}"
AUDIT_PORT="${CODEX_AUDIT_SERVICE_PORT:-8797}"
AUDIENCE="${CODEX_AUDIT_SERVICE_AUDIENCE:-quant-codex-audit}"
ALLOWED_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES:-QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge}"
-ALLOWED_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main}"
-ALLOWED_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_REFS:-refs/heads/main}"
+ALLOWED_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge}"
+ALLOWED_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_REFS:-refs/heads/main,refs/pull/*/merge}"
ALLOWED_REPOSITORY_VISIBILITIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES:-public}"
-ALLOWED_SOURCE_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES:-QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines}"
+ALLOWED_SOURCE_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES:-QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines}"
JOB_DIR="${CODEX_AUDIT_SERVICE_JOB_DIR:-/var/lib/codex-audit-bridge/jobs}"
AUDIT_MODEL="${CODEX_AUDIT_SERVICE_MODEL:-}"
AUDIT_REASONING_EFFORT="${CODEX_AUDIT_SERVICE_REASONING_EFFORT:-}"
@@ -48,6 +48,19 @@ systemctl_status_brief() {
fi
}
+systemctl_environment_brief() {
+ local service="$1"
+ if systemctl list-unit-files "${service}.service" >/dev/null 2>&1; then
+ echo "### ${service}.service environment"
+ systemctl show "$service" --property=Environment --no-pager 2>/dev/null \
+ | sed 's/^Environment=//' \
+ | tr ' ' '\n' \
+ | sed -E "s/^[\"']//; s/[\"']$//" \
+ | grep -E '^CODEX_AUDIT_SERVICE_(ALLOWED_|AUDIENCE=|HOST=|PORT=|JOB_DIR=|QUOTA_STORE=|SANDBOX=|MODEL=|REASONING_EFFORT=)' \
+ | mask_infra || true
+ fi
+}
+
sshd_bin() {
if command -v sshd >/dev/null 2>&1; then
command -v sshd
@@ -125,6 +138,10 @@ inspect() {
systemctl_status_brief caddy
echo
+ echo "## Codex audit service environment"
+ systemctl_environment_brief "$AUDIT_SERVICE_NAME"
+ echo
+
echo "## SSH access hints"
local sshd
sshd="$(sshd_bin || true)"
@@ -162,6 +179,14 @@ install_file() {
sudo install -D -m "$mode" "$source" "$target"
}
+install_service_package() {
+ sudo rm -rf "${DEPLOY_DIR}/service"
+ sudo install -d -m 0755 "${DEPLOY_DIR}/service"
+ sudo cp -R service/. "${DEPLOY_DIR}/service/"
+ sudo find "${DEPLOY_DIR}/service" -type d -exec chmod 0755 {} +
+ sudo find "${DEPLOY_DIR}/service" -type f -exec chmod 0644 {} +
+}
+
write_audit_service_unit() {
local runner_user runner_home
runner_user="$(id -un)"
@@ -174,6 +199,10 @@ write_audit_service_unit() {
if [ -n "$AUDIT_REASONING_EFFORT" ]; then
audit_reasoning_effort_line="Environment=CODEX_AUDIT_SERVICE_REASONING_EFFORT=${AUDIT_REASONING_EFFORT}"
fi
+ audit_token_line=""
+ if [ -n "${CODEX_AUDIT_SERVICE_TOKEN:-}" ]; then
+ audit_token_line="Environment=CODEX_AUDIT_SERVICE_TOKEN=${CODEX_AUDIT_SERVICE_TOKEN}"
+ fi
sudo tee "/etc/systemd/system/${AUDIT_SERVICE_NAME}.service" >/dev/null </dev/null < str:
[
"## Codex Audit",
"",
- "CodexAuditBridge stopped before making repository changes because the service backend failed outside the source PR/test surface.",
+ "AIAuditBridge stopped before making repository changes because the service backend failed outside the source PR/test surface.",
"",
f"- Failure category: `{category}`",
f"- Detail: `{sanitize_inline_code(reason, 600)}`",
@@ -741,7 +741,7 @@ def build_service_repository_context(
"## Repository context snapshot",
"",
"The service backend cannot access the source checkout directly. The following bounded text snapshot is provided "
- "by CodexAuditBridge after path filtering.",
+ "by AIAuditBridge after path filtering.",
"",
]
total = len("\n".join(parts).encode("utf-8"))
@@ -776,7 +776,7 @@ def service_patch_contract_instructions() -> str:
[
"## Service patch contract",
"",
- "You are running behind CodexAuditBridge's service backend. You cannot edit the checkout directly.",
+ "You are running behind AIAuditBridge's service backend. You cannot edit the checkout directly.",
"For review_and_fix mode, return exactly one JSON object and no surrounding prose:",
"",
"```json",
@@ -840,6 +840,16 @@ def codex_service_job_url(service_url: str, job_id: str) -> str:
return service_url.rstrip("/") + f"/jobs/{job_id}"
+def codex_service_api_url(service_url: str, api_path: str) -> str:
+ if not api_path.startswith("/v1/ai/"):
+ raise BridgeError("Codex audit service API path must start with /v1/ai/")
+ suffix = "/v1/codex-audit"
+ base = service_url.rstrip("/")
+ if base.endswith(suffix):
+ base = base[: -len(suffix)]
+ return base.rstrip("/") + api_path
+
+
def request_github_oidc_token(audience: str) -> str:
request_url = env_value("ACTIONS_ID_TOKEN_REQUEST_URL")
request_token = env_value("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
@@ -966,6 +976,47 @@ def request_codex_service(
raise BridgeError("Codex audit service job timed out before completion")
+def register_gateway_change(
+ *,
+ source_repo: str,
+ task: str,
+ action: str,
+ risk: str,
+ changed_paths: list[str],
+ issue_number: int,
+ pr_number: int,
+ pr_url: str,
+) -> str:
+ """Best-effort write to AiGateway closed-loop change registry."""
+ raw_url = env_value("CODEX_AUDIT_SERVICE_URL")
+ if not raw_url:
+ return ""
+ try:
+ service_url = normalize_codex_service_url(raw_url)
+ audience = env_value("CODEX_AUDIT_SERVICE_AUDIENCE", DEFAULT_SERVICE_AUDIENCE)
+ request_codex_service_json(
+ method="POST",
+ url=codex_service_api_url(service_url, "/v1/ai/feedback/register"),
+ audience=audience,
+ payload={
+ "source_repository": source_repo,
+ "task": task,
+ "action": action,
+ "risk": risk,
+ "confidence": 0.0,
+ "changed_paths": changed_paths,
+ "before_metrics": {},
+ "issue_number": issue_number,
+ "pr_number": pr_number,
+ "external_url": pr_url,
+ },
+ timeout_seconds=30,
+ )
+ except BridgeError as exc:
+ return str(exc)
+ return ""
+
+
def extract_json_object(text: str) -> dict[str, Any]:
stripped = text.strip()
fence = re.fullmatch(r"```(?:json)?\s*(.*?)\s*```", stripped, flags=re.DOTALL | re.IGNORECASE)
@@ -1652,6 +1703,7 @@ def publish_remediation(
policy=workspace.baseline_auto_merge_policy,
diff_stats=diff_stats,
)
+ gateway_action = "auto_pr"
stale_auto_merge_label_removed = workspace.stale_auto_merge_label_removed
stale_auto_merge_label_error = ""
if (
@@ -1749,6 +1801,7 @@ def publish_remediation(
f"after Bridge classified the change set as `{guard['risk_level']}` risk. "
"CI and the source guard own the final merge decision."
)
+ gateway_action = "auto_merge"
except BridgeError as exc:
body_lines.append("")
body_lines.append(f"Auto-merge was requested but the guarded label could not be added: `{exc}`")
@@ -1767,6 +1820,18 @@ def publish_remediation(
elif workspace.feedback_retry_pr and workspace.stale_auto_merge_label_skip_reason:
body_lines.append("")
body_lines.append(stale_auto_merge_label_skip_message(workspace.stale_auto_merge_label_skip_reason))
+ gateway_warning = register_gateway_change(
+ source_repo=source_repo,
+ task=task,
+ action=gateway_action,
+ risk=str(guard_risk.get("risk_level") or ""),
+ changed_paths=paths,
+ issue_number=issue_number,
+ pr_number=int(pr["number"]),
+ pr_url=str(pr_url),
+ )
+ if gateway_warning:
+ print(f"warning: AiGateway change registration failed: {gateway_warning[:300]}", file=sys.stderr)
post_issue_comment(token, source_repo, issue_number, "\n".join(body_lines))
return 0
@@ -2411,7 +2476,7 @@ def blocked_paths(paths: list[str], *, task: str = DEFAULT_TASK) -> list[str]:
def truncate_markdown(text: str, limit: int = 12000) -> str:
if len(text) <= limit:
return text
- return text[:limit] + "\n\n...[truncated by CodexAuditBridge]"
+ return text[:limit] + "\n\n...[truncated by AIAuditBridge]"
def strip_audit_heading(text: str) -> str:
diff --git a/service/ai_gateway_service.py b/service/ai_gateway_service.py
index 0529ab34..faa1a323 100644
--- a/service/ai_gateway_service.py
+++ b/service/ai_gateway_service.py
@@ -485,6 +485,7 @@ def _find_active_job_by_dedupe_key(dedupe_key: str) -> dict[str, Any] | None:
def _run_job(job_id: str, payload: dict[str, Any]) -> None:
+ started = time.time()
try:
job = _read_job(job_id)
job["status"] = "running"
@@ -511,6 +512,12 @@ def _run_job(job_id: str, payload: dict[str, Any]) -> None:
job["failure_category"] = _classify_failure(result.error)
job["updated_at"] = _now()
_write_job(job)
+ get_health_monitor().record(
+ "/v1/ai/execute/jobs/run",
+ time.time() - started,
+ job["status"] == "succeeded",
+ str(job.get("failure_category") or job.get("error") or ""),
+ )
_audit_log("job_completed", job_id=job_id, status=job["status"],
repository=job.get("repository"), task=job.get("task"))
except Exception as exc:
@@ -523,6 +530,7 @@ def _run_job(job_id: str, payload: dict[str, Any]) -> None:
job["error"] = str(exc)[-4000:]
job["failure_category"] = _classify_failure(str(exc))
_write_job(job)
+ get_health_monitor().record("/v1/ai/execute/jobs/run", time.time() - started, False, type(exc).__name__)
_audit_log("job_failed", job_id=job_id, error=type(exc).__name__,
repository=job.get("repository"))
@@ -756,6 +764,7 @@ def _handle_analyze(self, payload: dict[str, Any]) -> None:
def _handle_execute_async(self, claims: dict[str, Any], payload: dict[str, Any]) -> None:
"""POST /v1/ai/execute/jobs — async Codex execution."""
+ started = time.time()
req = parse_execute_request(payload)
# Security: validate source_repository against allowlist
@@ -763,24 +772,27 @@ def _handle_execute_async(self, claims: dict[str, Any], payload: dict[str, Any])
if source_repo:
_validate_source_repo(source_repo)
_validate_source_repo_org(claims, source_repo)
+ quota_repo = source_repo or str(claims.get("repository") or "unknown")
# Quota check
quota = get_quota_manager()
- qr = quota.check(source_repo, "codex-cli", req.prompt)
+ qr = quota.check(quota_repo, "codex-cli", req.prompt)
if not qr["allowed"]:
_json_response(self, HTTPStatus.TOO_MANY_REQUESTS, {
"status": "error", "error": qr["reason"],
"remaining_usd": qr.get("remaining_usd", 0),
})
return
- quota.record_execute(source_repo)
+ quota.record_execute(quota_repo)
payload.setdefault("task", TASK_EXECUTE)
job = _submit_job(claims, payload)
+ get_health_monitor().record("/v1/ai/execute/jobs", time.time() - started, True)
_json_response(self, HTTPStatus.ACCEPTED, job)
def _handle_execute_sync(self, claims: dict[str, Any], payload: dict[str, Any]) -> None:
"""POST /v1/ai/execute — sync Codex execution (backward compat)."""
+ started = time.time()
req = parse_execute_request(payload)
source_repo = str(payload.get("source_repository") or "")
if source_repo:
@@ -806,6 +818,7 @@ def _handle_execute_sync(self, claims: dict[str, Any], payload: dict[str, Any])
reasoning_effort=reasoning_effort,
timeout=req.timeout_seconds,
)
+ get_health_monitor().record("/v1/ai/execute", time.time() - started, result.success, result.error if not result.success else "")
if result.success:
_json_response(self, HTTPStatus.OK, {"status": "ok", "output": result.output})
else:
@@ -899,16 +912,23 @@ def _handle_review(self, payload: dict[str, Any]) -> None:
def _handle_feedback_register(self, claims: dict[str, Any], payload: dict[str, Any]) -> None:
"""POST /v1/ai/feedback/register — register an autonomous change with pre-metrics."""
change_id = _new_change_id()
+ source_repo = str(payload.get("source_repository") or "")
+ if source_repo:
+ _validate_source_repo(source_repo)
+ _validate_source_repo_org(claims, source_repo)
record = ChangeRecord(
change_id=change_id,
- repo=str(claims.get("repository", "")),
+ repo=source_repo or str(claims.get("repository", "")),
task=str(payload.get("task", "")),
action=str(payload.get("action", "")),
confidence=float(payload.get("confidence", 0.0)),
risk=str(payload.get("risk", "")),
changed_paths=[str(p) for p in payload.get("changed_paths", []) if isinstance(p, str)],
before_metrics={str(k): float(v) for k, v in payload.get("before_metrics", {}).items()},
- source_repo=str(payload.get("source_repository", "")),
+ source_repo=source_repo,
+ external_url=str(payload.get("external_url", "")),
+ issue_number=int(payload["issue_number"]) if payload.get("issue_number") is not None else None,
+ pr_number=int(payload["pr_number"]) if payload.get("pr_number") is not None else None,
)
write_change(record)
_audit_log("change_registered", change_id=change_id, repo=record.repo,
diff --git a/service/feedback.py b/service/feedback.py
index 07b96143..1c6b2f5e 100644
--- a/service/feedback.py
+++ b/service/feedback.py
@@ -108,6 +108,9 @@ class ChangeRecord:
effect: str = EFFECT_PENDING
effect_detail: str = ""
rollback_issue_url: str = ""
+ external_url: str = ""
+ issue_number: int | None = None
+ pr_number: int | None = None
created_at: float = field(default_factory=_now)
evaluated_at: float | None = None
source_repo: str = ""
@@ -126,6 +129,9 @@ def to_dict(self) -> dict[str, Any]:
"effect": self.effect,
"effect_detail": self.effect_detail,
"rollback_issue_url": self.rollback_issue_url,
+ "external_url": self.external_url,
+ "issue_number": self.issue_number,
+ "pr_number": self.pr_number,
"created_at": self.created_at,
"evaluated_at": self.evaluated_at,
"source_repo": self.source_repo,
@@ -146,6 +152,9 @@ def from_dict(cls, d: dict[str, Any]) -> "ChangeRecord":
effect=str(d.get("effect", EFFECT_PENDING)),
effect_detail=str(d.get("effect_detail", "")),
rollback_issue_url=str(d.get("rollback_issue_url", "")),
+ external_url=str(d.get("external_url", "")),
+ issue_number=int(d["issue_number"]) if d.get("issue_number") is not None else None,
+ pr_number=int(d["pr_number"]) if d.get("pr_number") is not None else None,
created_at=float(d.get("created_at", _now())),
evaluated_at=float(d.get("evaluated_at", 0)) if d.get("evaluated_at") else None,
source_repo=str(d.get("source_repo", "")),
diff --git a/service/quota.py b/service/quota.py
index b7fb90ab..8089d724 100644
--- a/service/quota.py
+++ b/service/quota.py
@@ -141,6 +141,16 @@ def __init__(self):
self._weekly_budget = DEFAULT_WEEKLY_BUDGET_USD
self._repo_budgets: dict[str, dict[str, float]] = {}
self._load_config()
+ self._load_records()
+
+ def _store_path(self) -> Path | None:
+ path = os.environ.get("CODEX_AUDIT_SERVICE_QUOTA_STORE", "").strip()
+ if path:
+ return Path(path)
+ job_dir = os.environ.get("CODEX_AUDIT_SERVICE_JOB_DIR", "").strip()
+ if job_dir:
+ return Path(job_dir) / "quota.json"
+ return None
def _load_config(self) -> None:
config_path = os.environ.get("CODEX_AUDIT_SERVICE_QUOTA_CONFIG", "").strip()
@@ -156,6 +166,41 @@ def _load_config(self) -> None:
if isinstance(raw.get("repo_budgets"), dict):
self._repo_budgets = raw["repo_budgets"]
+ def _load_records(self) -> None:
+ path = self._store_path()
+ if path is None:
+ return
+ if not path.exists():
+ return
+ try:
+ raw = json.loads(path.read_text(encoding="utf-8"))
+ except (json.JSONDecodeError, OSError):
+ return
+ records = raw.get("records") if isinstance(raw, dict) else None
+ if not isinstance(records, dict):
+ return
+ self._records = {
+ repo: QuotaRecord.from_dict(item)
+ for repo, item in records.items()
+ if isinstance(repo, str) and isinstance(item, dict)
+ }
+
+ def _save_records_locked(self) -> None:
+ path = self._store_path()
+ if path is None:
+ return
+ path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+ payload = json.dumps(
+ {"records": {repo: record.to_dict() for repo, record in self._records.items()}},
+ ensure_ascii=False,
+ sort_keys=True,
+ ).encode("utf-8")
+ tmp = path.with_suffix(path.suffix + ".tmp")
+ with open(tmp, "wb") as handle:
+ handle.write(payload)
+ os.chmod(tmp, 0o600)
+ os.replace(tmp, path)
+
def _reset_if_needed(self, record: QuotaRecord) -> QuotaRecord:
now = time.time()
if now - record.last_reset_daily > 86400:
@@ -227,6 +272,7 @@ def record(self, repo: str, model: str, prompt: str, output: str = "") -> None:
record.codex_calls += 1
record.total_cost_usd += cost
self._records[repo] = record
+ self._save_records_locked()
def record_execute(self, repo: str) -> None:
"""Record a codex exec call (flat cost)."""
@@ -239,6 +285,7 @@ def record_execute(self, repo: str) -> None:
record.codex_calls += 1
record.total_cost_usd += cost
self._records[repo] = record
+ self._save_records_locked()
def status(self, repo: str = "") -> dict[str, Any]:
"""Get quota status for a repo or all repos."""
diff --git a/tests/test_ai_gateway_service_get_routes.py b/tests/test_ai_gateway_service_get_routes.py
new file mode 100644
index 00000000..cbbbb6b4
--- /dev/null
+++ b/tests/test_ai_gateway_service_get_routes.py
@@ -0,0 +1,83 @@
+import json
+import os
+import tempfile
+import threading
+import unittest
+import urllib.request
+from http.server import ThreadingHTTPServer
+from unittest.mock import patch
+
+from service.ai_gateway_service import AiGatewayRequestHandler
+
+
+class AiGatewayGetRoutesTest(unittest.TestCase):
+ def test_read_routes_accept_query_strings(self) -> None:
+ with tempfile.TemporaryDirectory() as tmp:
+ env = {
+ "CODEX_AUDIT_SERVICE_AUTH": "none",
+ "CODEX_AUDIT_SERVICE_ALLOW_NO_AUTH_FOR_LOCAL_TESTS": "true",
+ "CODEX_AUDIT_SERVICE_JOB_DIR": tmp,
+ }
+ with patch.dict(os.environ, env, clear=False):
+ server = ThreadingHTTPServer(("127.0.0.1", 0), AiGatewayRequestHandler)
+ thread = threading.Thread(target=server.serve_forever, daemon=True)
+ thread.start()
+ try:
+ base_url = f"http://127.0.0.1:{server.server_port}"
+ effectiveness_url = f"{base_url}/v1/ai/changes/effectiveness?days=90"
+ with urllib.request.urlopen(effectiveness_url, timeout=5) as response:
+ self.assertEqual(response.status, 200)
+ effectiveness = json.loads(response.read().decode("utf-8"))
+ self.assertEqual(effectiveness["status"], "ok")
+ self.assertIn("report", effectiveness)
+
+ quota_url = f"{base_url}/v1/ai/quota?repo=QuantStrategyLab/AIAuditBridge"
+ with urllib.request.urlopen(quota_url, timeout=5) as response:
+ self.assertEqual(response.status, 200)
+ quota = json.loads(response.read().decode("utf-8"))
+ self.assertEqual(quota["status"], "ok")
+ self.assertEqual(quota["quota"]["repo"], "QuantStrategyLab/AIAuditBridge")
+ finally:
+ server.shutdown()
+ server.server_close()
+
+ def test_feedback_register_uses_source_repository_for_change_feed(self) -> None:
+ with tempfile.TemporaryDirectory() as tmp:
+ env = {
+ "CODEX_AUDIT_SERVICE_AUTH": "none",
+ "CODEX_AUDIT_SERVICE_ALLOW_NO_AUTH_FOR_LOCAL_TESTS": "true",
+ "CODEX_AUDIT_SERVICE_JOB_DIR": tmp,
+ }
+ with patch.dict(os.environ, env, clear=False):
+ server = ThreadingHTTPServer(("127.0.0.1", 0), AiGatewayRequestHandler)
+ thread = threading.Thread(target=server.serve_forever, daemon=True)
+ thread.start()
+ try:
+ base_url = f"http://127.0.0.1:{server.server_port}"
+ payload = {
+ "source_repository": "local/repo",
+ "task": "monthly_snapshot_audit",
+ "action": "auto_pr",
+ "risk": "low",
+ "changed_paths": ["docs/runbook.md"],
+ "external_url": "https://example.test/pr/12",
+ "issue_number": 7,
+ "pr_number": 12,
+ }
+ request = urllib.request.Request(
+ f"{base_url}/v1/ai/feedback/register",
+ data=json.dumps(payload).encode("utf-8"),
+ method="POST",
+ headers={"Content-Type": "application/json"},
+ )
+ with urllib.request.urlopen(request, timeout=5) as response:
+ self.assertEqual(response.status, 200)
+
+ with urllib.request.urlopen(f"{base_url}/v1/ai/changes?days=7", timeout=5) as response:
+ changes = json.loads(response.read().decode("utf-8"))["changes"]
+ self.assertEqual(changes[0]["repo"], "local/repo")
+ self.assertEqual(changes[0]["external_url"], "https://example.test/pr/12")
+ self.assertEqual(changes[0]["pr_number"], 12)
+ finally:
+ server.shutdown()
+ server.server_close()
diff --git a/tests/test_monthly_orchestrator_workflow.py b/tests/test_monthly_orchestrator_workflow.py
index 03e34243..b8a57c7e 100644
--- a/tests/test_monthly_orchestrator_workflow.py
+++ b/tests/test_monthly_orchestrator_workflow.py
@@ -34,5 +34,5 @@ def test_monthly_orchestrator_does_not_dispatch_without_source_issue() -> None:
assert "peter-evans/repository-dispatch" not in text
assert "event-type: monthly-audit" not in text
- assert "CodexAuditBridge execution requires a source repository issue number." in text
+ assert "AIAuditBridge execution requires a source repository issue number." in text
assert "source_repo and issue_number" in text
diff --git a/tests/test_quota.py b/tests/test_quota.py
index bcb64a22..aa18c65d 100644
--- a/tests/test_quota.py
+++ b/tests/test_quota.py
@@ -149,6 +149,17 @@ def test_get_weekly_budget_respects_repo_overrides(self) -> None:
self.manager._repo_budgets["premium/repo"] = {"weekly": 250.0}
self.assertEqual(self.manager.get_weekly_budget("premium/repo"), 250.0)
+ def test_records_persist_to_store(self) -> None:
+ with tempfile.TemporaryDirectory() as tmp:
+ store = str(Path(tmp) / "quota.json")
+ with patch.dict(os.environ, {"CODEX_AUDIT_SERVICE_QUOTA_STORE": store}):
+ first = QuotaManager()
+ first.record_execute("test/repo")
+ second = QuotaManager()
+ status = second.status("test/repo")
+ self.assertEqual(status["codex_calls"], 1)
+ self.assertGreater(status["total_cost_usd"], 0)
+
class TestQuotaConfigLoading(unittest.TestCase):
"""Quota configuration from JSON file."""
diff --git a/tests/test_run_monthly_codex_audit.py b/tests/test_run_monthly_codex_audit.py
index 561cd546..0edd8362 100644
--- a/tests/test_run_monthly_codex_audit.py
+++ b/tests/test_run_monthly_codex_audit.py
@@ -28,6 +28,7 @@
build_service_prompt,
classify_service_failure,
classify_guarded_auto_merge_risk,
+ codex_service_api_url,
codex_service_job_url,
codex_service_jobs_url,
convert_local_markdown_links,
@@ -101,6 +102,12 @@ def test_validate_repo_accepts_owner_repo(self) -> None:
with self.subTest(source_repo=source_repo):
self.assertEqual(validate_repo(source_repo), source_repo)
+ def test_codex_service_api_url_maps_legacy_endpoint_to_ai_route(self) -> None:
+ self.assertEqual(
+ codex_service_api_url("https://codex.quant.example/v1/codex-audit", "/v1/ai/feedback/register"),
+ "https://codex.quant.example/v1/ai/feedback/register",
+ )
+
def test_validate_repo_rejects_invalid_values(self) -> None:
with self.assertRaises(Exception):
validate_repo("QuantStrategyLab/CryptoLivePoolPipelines/extra")
@@ -2255,6 +2262,11 @@ def test_vps_ops_workflow_runs_only_manual_self_hosted_ops(self) -> None:
self.assertIn("- self-hosted", workflow)
self.assertIn("- codex-vps", workflow)
self.assertIn('bash scripts/deploy_codex_audit_service.sh "${{ inputs.mode }}"', workflow)
+ self.assertIn("CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES", workflow)
+ self.assertIn("CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS", workflow)
+ self.assertIn("CODEX_AUDIT_SERVICE_ALLOWED_REFS", workflow)
+ self.assertIn("CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES", workflow)
+ self.assertIn("QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge,QuantStrategyLab/CryptoLivePoolPipelines", workflow)
self.assertIn("actions/checkout@v6.0.3", workflow)
def test_vps_deploy_adds_nginx_audit_route_without_router_service(self) -> None:
@@ -2263,10 +2275,20 @@ def test_vps_deploy_adds_nginx_audit_route_without_router_service(self) -> None:
self.assertIn("location = /v1/codex-audit", deploy_script)
self.assertIn("location ^~ /v1/codex-audit/", deploy_script)
self.assertIn("CODEX_AUDIT_SERVICE_JOB_DIR", deploy_script)
+ self.assertIn("codex_pr_review.yml@refs/pull/*/merge", deploy_script)
+ self.assertIn("refs/pull/*/merge", deploy_script)
+ self.assertIn("QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge,QuantStrategyLab/CryptoLivePoolPipelines", deploy_script)
self.assertIn("proxy_pass http://127.0.0.1:{port}", deploy_script)
self.assertIn('"# CodexAuditBridge route start" not in block', deploy_script)
self.assertIn("audit service did not become healthy", deploy_script)
self.assertIn("nginx config test failed; restoring previous config", deploy_script)
+ self.assertIn("zzzz-managed-allowlists.conf", deploy_script)
+ self.assertIn('Environment="CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=${ALLOWED_REPOSITORIES}"', deploy_script)
+ self.assertIn("systemctl_environment_brief", deploy_script)
+ self.assertIn('sed -E "s/^[\\"', deploy_script)
+ self.assertIn('s/[\\"\']$//"', deploy_script)
+ self.assertIn("CODEX_AUDIT_SERVICE_(ALLOWED_|AUDIENCE=", deploy_script)
+ self.assertNotIn("^CODEX_AUDIT_SERVICE_TOKEN", deploy_script)
self.assertNotIn("CODEX_SERVICE_ROUTER", deploy_script)
self.assertNotIn("codex_service_router", deploy_script)