[codex] add strategy optimization watcher

[Pigbibi]

Summary

• Add minimal automation contracts for trigger/evidence/action/gate/task payloads.
• Add deterministic strategy metric degradation policy and issue-only watcher/task generation.
• Add a dry-run-by-default workflow and runner that only opens optimization issues after safe path/repo validation.
• Document the Strategy Optimization Watcher issue-only safety boundary.

Safety boundary

• No strategy code changes are generated or applied by this batch.
• No live parameters, broker/order paths, PR merge, or deployment actions are performed.
• Cross-repository runs fail closed without a GitHub App token, and metrics paths are constrained to the source checkout.

Test Plan

• actionlint .github/workflows/strategy_optimization_watcher.yml
• python3 -m ruff check service/automation_contracts.py service/strategy_optimization_policy.py service/strategy_watch.py scripts/run_strategy_optimization_watcher.py tests/test_automation_contracts.py tests/test_strategy_optimization_policy.py tests/test_strategy_watch.py tests/test_run_strategy_optimization_watcher.py tests/test_strategy_optimization_watcher_workflow.py
• python3 -m compileall -q service scripts tests
• python3 -m unittest discover tests

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 2 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Security in scripts/run_strategy_optimization_watcher.py

Existing-issue reuse trusts any open issue whose body contains the watcher marker. Because the marker key is predictable (watcher_issue_key() is derived only from the public subject), anyone who can create or edit issues in the target repo can plant that HTML comment and cause the watcher to comment on the wrong issue instead of creating or updating its own record, which undermines the audit trail. (line 87)

Suggestion: Only reuse issues that can be authenticated as watcher-owned (for example, verify the author/app account or a dedicated label), and stop relying on a spoofable body marker alone. Strengthen the key so it is not derived solely from the public subject.

2. 🟡 [MEDIUM] Logic in service/strategy_watch.py

StrategyWatchSnapshot.from_dict() falls back from current_metrics to the legacy current field using truthiness. If the canonical field is present but empty ({}), the code silently ignores it and reads the alias instead; the same bug exists for baseline_metrics/baseline. That can evaluate stale or unintended metrics and open optimization issues incorrectly. (line 39)

Suggestion: Choose the source field by key presence rather than truthiness, e.g. use payload['current_metrics'] when 'current_metrics' in payload, and only fall back to current when the canonical key is absent.

---

Review by Codex PR Review bot • PR

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.