Monthly Audit Review: 2026-05

[github-actions]

This issue tracks the monthly audit orchestration run.

Targets:

• QuantStrategyLab/CryptoSnapshotPipelines
• QuantStrategyLab/BinancePlatform

Source of truth for policy and scheduling stays in GitHub Actions.

Payload:

{
  "month": "2026-05",
  "title": "Monthly Audit Review: 2026-05",
  "monthly_label": "monthly-review",
  "auto_merge_label": "auto-merge-ok",
  "targets": [
    "QuantStrategyLab/CryptoSnapshotPipelines",
    "QuantStrategyLab/BinancePlatform"
  ]
}

[Pigbibi]

Downstream runner result

Read the issue body and latest comments before editing.

• Issue comments inspected: none
• Machine-readable payload month: 2026-05
• Payload targets honored:
  • QuantStrategyLab/CryptoSnapshotPipelines
  • QuantStrategyLab/BinancePlatform
• Note: the operator prompt mentioned a US equity snapshot repo, but the issue payload does not include UsEquitySnapshotPipelines, so I did not edit that repository in this run.

Architecture check: the current control plane is broadly reasonable. CryptoSnapshotPipelines owns upstream snapshot selection, monthly review packaging, AI review payload generation, planner/fanout, and upstream shadow/challenger evidence. BinancePlatform owns downstream execution reporting, execution-health AI review, low-risk auto-optimization PR creation, and guarded post-CI auto-merge for eligible automation branches. The missing pieces I found were narrow evidence/reporting guardrails, not a need to rebuild the architecture.

Draft PRs opened:

• Improve monthly review audit controls CryptoSnapshotPipelines#48

  • Requires same-cycle shadow outputs before monthly review briefing.
  • Deduplicates repeated Claude Primary Review headings in final AI review markdown.
  • Updates docs for shadow-output requirements and secondary review/optimization automation.
  • Tightens the copied zero-trade completion guard.

• Improve monthly execution review diagnostics BinancePlatform#34

  • Adds zero-trade diagnostics grouped by strategy sleeve and gate.
  • Deduplicates repeated Claude Primary Review headings in final AI review markdown.
  • Tightens auto-optimization completion detection so generic old gating summaries are not treated as the new diagnostics.
  • Documents auto optimization and guarded auto-merge boundaries.

Targeted validation passed:

• CryptoSnapshotPipelines: python3 -m pytest tests/test_monthly_review_briefing.py tests/test_render_monthly_ai_review.py tests/test_prepare_auto_optimization_pr.py
• BinancePlatform: python3 -m pytest tests/test_monthly_report_bundle.py tests/test_render_monthly_ai_review.py tests/test_prepare_auto_optimization_pr.py

No PRs were merged by this runner.

[Pigbibi]

PR readiness update

Follow-up after checking the currently open PRs from this monthly audit run:

• CryptoSnapshotPipelines: Improve monthly review audit controls CryptoSnapshotPipelines#48

  • Status: ready for review
  • Mergeable: yes
  • CI: passing
  • Follow-up commit added: fixed a time-sensitive release-status test by allowing deterministic reference_date injection in the release summary builder.

• BinancePlatform: Improve monthly execution review diagnostics BinancePlatform#34

  • Status: ready for review
  • Mergeable: yes
  • CI: passing

Both PRs are now out of draft. I did not merge them and did not close this monthly issue.

[Pigbibi]

US snapshot monthly review expansion

User requested adding the US equity snapshot repository into the same monthly audit pattern.

Important contract note: the current issue body still lists only:

• QuantStrategyLab/CryptoSnapshotPipelines
• QuantStrategyLab/BinancePlatform

I treated the US snapshot work as an explicit follow-up expansion request instead of silently changing the historical issue payload.

Actions taken:

• Opened draft PR: Add monthly AI review and Codex remediation gate UsEquitySnapshotPipelines#22

  • Adds first-stage monthly AI review only.
  • Creates a Monthly Snapshot Review workflow that downloads publish artifacts, builds a monthly review bundle, creates/updates a monthly-review issue, and triggers AI review.
  • Adds AI Monthly Review to post bilingual artifact/contract-health review comments.
  • Does not add auto-fix, auto-PR remediation, or auto-merge yet.
  • CI: passing.

• Updated AuditOrchestrator repo variable AUDIT_TARGET_REPOS for future monthly issues:

  • QuantStrategyLab/CryptoSnapshotPipelines
  • QuantStrategyLab/BinancePlatform
  • QuantStrategyLab/UsEquitySnapshotPipelines

Claude/Codex implementation note:

• AuditOrchestrator and ccbot are designed for a VPS self-hosted Codex runner consuming monthly issues.
• The existing Crypto/Binance repository workflows currently use anthropics/claude-code-action for in-repo AI review/auto-optimization steps.
• For the US snapshot first stage, I matched the existing repository workflow pattern for AI review only. A later guarded phase can move remediation/auto-fix to the self-hosted Codex runner through ccbot-bridge, keeping the GitHub issue as the contract.

[Pigbibi]

US snapshot Codex remediation expansion

Follow-up to the first-stage US snapshot monthly review PR.

PR updated:

• Add monthly AI review and Codex remediation gate UsEquitySnapshotPipelines#22
  • Status: draft PR remains open.
  • Mergeable: yes.
  • CI: passing on f0be4c7.
  • Added ccbot/Codex remediation handoff after AI review: the AI review workflow now creates or updates a codex-bridge issue labeled monthly-codex-remediation and auto-merge-ok for the self-hosted VPS ccbot runner.
  • Added separate post-CI auto-merge gate for Codex remediation PRs. It only merges PRs that are non-draft, have auto-merge-ok, include the expected monthly remediation marker, pass CI, and touch only approved review/remediation/docs/tests paths.
  • Added error reporting through GitHub Step Summary and guarded failure modes in the remediation issue publisher and merge evaluator.
  • Updated README and operator runbook with the ccbot/Codex flow and merge boundaries.

Targeted validation:

• python3 -m pytest tests/test_monthly_report_bundle.py tests/test_monthly_review_workflow_config.py tests/test_render_monthly_ai_review.py tests/test_post_monthly_ai_review_comment.py tests/test_codex_remediation_issue.py tests/test_evaluate_codex_pr_merge.py -q
• Result: 13 passed.

Implementation note:

• The US snapshot code-remediation phase now routes through self-hosted ccbot/Codex via codex-bridge issues.
• The merge decision is intentionally separated into a GitHub Actions gate so Codex opens/fixes PRs while repository policy controls final merge.
• The local ccbot bridge still needs to watch QuantStrategyLab/UsEquitySnapshotPipelines for the codex-bridge / monthly-codex-remediation labels in its VPS config before the first live run.

No PRs were merged by this runner.

[Pigbibi]

Crypto snapshot Codex bridge follow-up

I checked the existing CryptoSnapshotPipelines automation after the US snapshot expansion. Important correction: CryptoSnapshotPipelines already had monthly AI review / optimization automation, but its code-remediation path was still GitHub-hosted anthropics/claude-code-action, not the VPS ccbot/Codex bridge.

New draft PR opened:

• Route monthly optimization tasks to Codex bridge CryptoSnapshotPipelines#49
  • Status: draft PR remains open.
  • Mergeable: yes.
  • CI: passing on cd7c7fd.
  • Routes low-risk non-experiment [auto-pr-safe] Crypto monthly optimization task issues to ccbot/Codex by adding codex-bridge and auto-merge-ok labels plus an explicit issue contract.
  • Keeps the existing Claude Action workflow only as a manual-dispatch/non-Codex fallback; normal queued remediation issues with codex-bridge are skipped by that workflow.
  • Extends the post-CI auto-merge gate to recognize codex/monthly-optimization-issue-* PR branches and require PR-level auto-merge-ok for Codex PRs.
  • Updates README/operator runbook for the ccbot/Codex remediation flow.
  • Carries the same deterministic release-status reference_date test fix already used by PR #48 so this branch passes the current CI suite.

Targeted validation:

• python3 -m pytest tests/test_fanout_monthly_optimization_tasks.py tests/test_auto_optimization_pr_workflow_config.py tests/test_prepare_auto_optimization_pr.py -q
• Result: 12 passed.
• git diff --check: passed.
• GitHub Actions CI test: passed.

Operational note:

• For live operation, the VPS ccbot-bridge config should watch QuantStrategyLab/CryptoSnapshotPipelines and QuantStrategyLab/UsEquitySnapshotPipelines for the relevant codex-bridge labels.
• No PRs were merged by this runner.

[Pigbibi]

Final merge and bridge status

Checked the VPS ccbot bridge configuration and PR readiness after the monthly audit run.

Bridge status:

• ccbot-bridge-targets.service is active.
• Target bridge now watches QuantStrategyLab/CryptoSnapshotPipelines and QuantStrategyLab/UsEquitySnapshotPipelines for codex-bridge issues.
• Target workspaces were moved to clean dedicated worktrees:
  • /home/ubuntu/Projects/CryptoSnapshotPipelinesCodexBridge
  • /home/ubuntu/Projects/UsEquitySnapshotPipelinesCodexBridge

Merged:

• Improve monthly review audit controls CryptoSnapshotPipelines#48: merged, CI passing, mergeable CLEAN before merge.
• Improve monthly execution review diagnostics BinancePlatform#34: merged, CI passing, mergeable CLEAN before merge.

Left open as draft:

• Route monthly optimization tasks to Codex bridge CryptoSnapshotPipelines#49: draft, CI passing; not merged.
• Add monthly AI review and Codex remediation gate UsEquitySnapshotPipelines#22: draft, CI passing; not merged.

No draft PRs were merged.

[Pigbibi]

Full automation completion update

Completed the remaining monthly audit automation work after the final request.

Merged PRs in this pass:

• Route monthly optimization tasks to Codex bridge CryptoSnapshotPipelines#49

  • Squash merged at 2026-05-10T02:06:37Z.
  • CI test: passing before merge.
  • Merge state before merge: CLEAN.
  • Remote branch monthly-codex-remediation-bridge deleted.
  • Routes low-risk monthly optimization remediation through VPS ccbot-bridge / Codex via codex-bridge issues.
  • Adds PR feedback loop: failed CI or changes_requested review comments are posted back to the source codex-bridge issue so ccbot dispatches Codex again to fix the same PR branch.

• Add monthly AI review and Codex remediation gate UsEquitySnapshotPipelines#22

  • Squash merged at 2026-05-10T02:06:43Z.
  • CI test: passing before merge.
  • Merge state before merge: CLEAN.
  • Remote branch monthly-audit-stage1 deleted.
  • Adds monthly snapshot review issue creation, AI review, ccbot/Codex remediation issue creation, guarded auto-merge, and the same PR feedback loop for CI/review fixes.

Previously completed in this run:

• Improve monthly review audit controls CryptoSnapshotPipelines#48: merged.
• Improve monthly execution review diagnostics BinancePlatform#34: merged.

Bridge/config status checked:

• ccbot-bridge-targets.service: active.
• Target bridge watches:
  • QuantStrategyLab/CryptoSnapshotPipelines with label codex-bridge.
  • QuantStrategyLab/UsEquitySnapshotPipelines with label codex-bridge.
• Dedicated clean worktrees are configured and updated to merged origin/main:
  • /home/ubuntu/Projects/CryptoSnapshotPipelinesCodexBridge
  • /home/ubuntu/Projects/UsEquitySnapshotPipelinesCodexBridge
• AUDIT_TARGET_REPOS includes:
  • QuantStrategyLab/CryptoSnapshotPipelines
  • QuantStrategyLab/BinancePlatform
  • QuantStrategyLab/UsEquitySnapshotPipelines

Resulting automation path:

1. Monthly workflow creates the audit/review issue.
2. AI review posts findings.
3. Low-risk remediation is queued as a codex-bridge issue.
4. VPS ccbot dispatches local Codex.
5. Codex opens/updates a PR, runs targeted tests, marks ready only when eligible, and applies the merge label when allowed.
6. GitHub CI gates the PR.
7. Failed CI or requested review changes are posted back to the source issue for another Codex pass.
8. Passing eligible PRs are auto-merged by repository guard workflows and branches are deleted.

No further PRs remain open from this monthly automation pass.

[Pigbibi]

Codex feedback retry limit update

Implemented the bounded retry policy for the ccbot/Codex remediation loop.

Merged in this pass:

• Limit Codex feedback retry rounds CryptoSnapshotPipelines#50

  • Squash merged at 2026-05-10T02:30:29Z.
  • CI test: passing before merge.
  • Merge state before merge: CLEAN.
  • Remote branch codex-feedback-retry-limit deleted.
  • Adds a maximum of three automatic Codex PR feedback rounds per source codex-bridge issue.
  • After the cap is reached, the workflow removes codex-bridge and comments that human review is required.

• Limit Codex feedback retry rounds UsEquitySnapshotPipelines#23

  • Squash merged at 2026-05-10T02:30:29Z.
  • CI test: passing before merge.
  • Merge state before merge: CLEAN.
  • Remote branch codex-feedback-retry-limit deleted.
  • Adds the same three-round automatic retry cap and human-review stop condition.

Targeted validation:

• CryptoSnapshotPipelines: python3 -m pytest tests/test_fanout_monthly_optimization_tasks.py tests/test_auto_optimization_pr_workflow_config.py tests/test_prepare_auto_optimization_pr.py -q
  • Result: 13 passed.
• UsEquitySnapshotPipelines: python3 -m pytest tests/test_monthly_report_bundle.py tests/test_monthly_review_workflow_config.py tests/test_render_monthly_ai_review.py tests/test_post_monthly_ai_review_comment.py tests/test_codex_remediation_issue.py tests/test_evaluate_codex_pr_merge.py -q
  • Result: 14 passed.
• git diff --check: passed in both repositories.

Operational state:

• ccbot-bridge-targets.service: active.
• Dedicated ccbot worktrees are clean and updated to merged origin/main:
  • /home/ubuntu/Projects/CryptoSnapshotPipelinesCodexBridge
  • /home/ubuntu/Projects/UsEquitySnapshotPipelinesCodexBridge

The feedback loop is now bounded: CI/review failures requeue Codex through the source issue for up to three rounds; after that automation stops by removing codex-bridge and leaves the issue for human inspection.