[codex] Port live AiGateway service architecture

.github/workflows/monthly-orchestrator.yml

@@ -117,7 +117,7 @@ jobs:
               ...targets.map(t => `- ${t}`),
               '',
               'Only snapshot artifact repositories are in scope for monthly report audits.',
-              'Each source repository owns its monthly review issue and dispatches CodexAuditBridge with source_repo and issue_number.',
+              'Each source repository owns its monthly review issue and dispatches AIAuditBridge with source_repo and issue_number.',
               '',
               'Source of truth for policy and scheduling stays in GitHub Actions.',
               '',
@@ -175,6 +175,6 @@ jobs:
             echo "- Month: ${{ steps.resolve-month.outputs.month }}"
             echo "- Tracking issue: ${{ steps.publish-monthly-issue.outputs.issue_url }}"
             echo
-            echo "CodexAuditBridge execution requires a source repository issue number."
+            echo "AIAuditBridge execution requires a source repository issue number."
             echo "The source repositories create those issues in their own monthly workflows, then dispatch codex_audit.yml with source_repo and issue_number."
           } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/vps_codex_service_ops.yml

@@ -39,6 +39,11 @@ jobs:
       - name: Run VPS service operation
         env:
           CODEX_AUDIT_SSH_UNBAN_IP: ${{ inputs.ssh_unban_ip }}
+          CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge
+          CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CodexAuditBridge/.github/workflows/codex_pr_review.yml@refs/pull/*/merge
+          CODEX_AUDIT_SERVICE_ALLOWED_REFS: refs/heads/main,refs/pull/*/merge
+          CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines
           CODEX_AUDIT_SERVICE_MODEL: ${{ vars.CODEX_AUDIT_SERVICE_MODEL }}
           CODEX_AUDIT_SERVICE_REASONING_EFFORT: ${{ vars.CODEX_AUDIT_SERVICE_REASONING_EFFORT }}
+          CODEX_AUDIT_SERVICE_TOKEN: ${{ secrets.CODEX_AUDIT_SERVICE_TOKEN }}
         run: bash scripts/deploy_codex_audit_service.sh "${{ inputs.mode }}"

CONTRIBUTING.md

@@ -2,13 +2,13 @@
 
 ## 中文摘要
 
-- 用途：本文档说明如何向 `CodexAuditBridge` 提交低风险、可审阅的变更。
+- 用途：本文档说明如何向 `AIAuditBridge` 提交低风险、可审阅的变更。
 - 主要覆盖：`Ground Rules`、`Documentation Standards`、`Branching and Pull Requests`、`Local Verification`。
 - 阅读顺序：先确认仓库边界和变更范围，再运行适合本仓库的本地校验。
 - 风险提示：涉及策略、artifact、自动化、密钥、云资源、券商或交易所行为的变更，必须先用测试环境、dry-run 或只读证据验证；不要只凭示例修改生产。
 - 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
 
-Thanks for contributing to `CodexAuditBridge`.
+Thanks for contributing to `AIAuditBridge`.
 
 ## Ground Rules
 

README.md

@@ -33,11 +33,11 @@ This avoids hard-coding Codex CLI setup in every source repository and avoids de
 
 ## Compatibility governance role
 
-Compatibility governance metadata in this repository is ops/control-plane only:
+`QuantStrategyLab/AIAuditBridge` is an ops/control-plane consumer only:
 
-- It aligns audit/review execution contracts across QuantStrategyLab repositories.
+- It consumes compatibility governance metadata to align audit/review execution.
 - It must **not** participate in trading runtime dependency graphs or strategy/runtime upgrade flows.
-- All governance references from this repo should be interpreted as control-plane/tooling compatibility, not runtime coupling.
+- All governance references here are for control-plane operation and should not be interpreted as runtime coupling.
 
 
 ## Supported source repositories
@@ -99,12 +99,12 @@ Configure these values in `QuantStrategyLab/AIAuditBridge`:
 Run the service host with:
 
 ```bash
-CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge \
-CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
+CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge \
+CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
 CODEX_AUDIT_SERVICE_AUDIENCE=quant-codex-audit \
 CODEX_AUDIT_SERVICE_MODEL=gpt-5.4 \
 CODEX_AUDIT_SERVICE_REASONING_EFFORT=auto \
-python3 scripts/codex_audit_service.py
+python3 -m service.ai_gateway_service
 ```
 
 Terminate TLS on 443 with the platform load balancer or a reverse proxy and forward `/v1/codex-audit` to the service port. Do not pass GitHub write tokens to this service.

README.zh-CN.md

@@ -33,12 +33,13 @@ Codex 执行现在只走 service backend：workflow 从 GitHub-hosted runner 调
 
 ## 兼容性治理定位
 
-本仓库中的兼容性治理元数据只用于 ops/control-plane：
+`QuantStrategyLab/AIAuditBridge` 只作为 ops/control-plane 的消费侧参与兼容治理：
 
-- 对齐 QuantStrategyLab 各仓库的审计/评审执行契约；
+- 仅消费兼容矩阵和治理元数据，确保审计/评审边界行为一致；
 - 不参与策略/交易运行时的依赖图、升级决策或 runtime 级联；
 - 本仓库中的兼容关系只用于审计与 review 运营（control-plane），不应被源仓库当作交易策略运行时依赖。
 
+
 ## 支持的 source repository
 
 | Source repository | 允许的 task |
@@ -75,11 +76,11 @@ AIAuditBridge 只使用 service backend。workflow 运行在 `ubuntu-latest`，
 service host 启动示例：
 
 ```bash
-CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge \
-CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
+CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES=QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge \
+CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES='QuantStrategyLab/AIAuditBridge,QuantStrategyLab/CodexAuditBridge,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/ResearchSignalContextPipelines' \
 CODEX_AUDIT_SERVICE_AUDIENCE=quant-codex-audit \
 CODEX_AUDIT_SERVICE_MODEL=gpt-5.4 \
-python3 scripts/codex_audit_service.py
+python3 -m service.ai_gateway_service
 ```
 
 443/TLS 建议由平台负载均衡或反向代理负责，并把 `/v1/codex-audit` 转发到 service 端口。不要把 GitHub 写 token 传给这个 service。

SECURITY.md

@@ -2,13 +2,13 @@
 
 ## 中文摘要
 
-- 用途：本文档说明如何报告 `CodexAuditBridge` 的安全问题，以及密钥或凭证暴露时的处理顺序。
+- 用途：本文档说明如何报告 `AIAuditBridge` 的安全问题，以及密钥或凭证暴露时的处理顺序。
 - 主要覆盖：`Reporting a Vulnerability`、`Secret and Credential Exposure`、`Scope Notes`。
 - 阅读顺序：发现问题后先避免公开泄露，再通过私密渠道提供最小复现信息。
 - 风险提示：涉及实盘、密钥、权限、Cloud Run、GitHub Actions、交易所或券商 API 的问题，不要开公开 issue 或贴出敏感日志。
 - 英文正文保留更完整的命令、字段名和配置键；如果摘要和正文不一致，以正文中的实际命令和配置为准。
 
-Thanks for helping keep `CodexAuditBridge` safe.
+Thanks for helping keep `AIAuditBridge` safe.
 
 This repository is part of the QuantStrategyLab automation, research, or trading-support surface. Please do **not** open a public issue for vulnerabilities involving credentials, broker or exchange access, cloud resources, workflow tokens, private market data, account identifiers, order execution, or secret material.
 

cloudflare/ai-gateway-dash/README.md

@@ -14,6 +14,9 @@ Cloudflare Worker that serves an operations dashboard for the AiGateway service.
 | `AI_GATEWAY_ORIGIN_URL` | VPS origin URL (e.g. `https://43.156.238.238.sslip.io`) |
 | `DASHBOARD_API_TOKEN` | Static token for read-only API access |
 
+`DASHBOARD_API_TOKEN` must match the VPS service `CODEX_AUDIT_SERVICE_TOKEN`
+so the dashboard can read `/v1/ai/*` endpoints.
+
 ## Deploy
 
 ```bash