chore(governance): harden review gate and qsl metadata

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Pigbibi

.github/codex_auto_merge_policy.json

@@ -44,6 +44,7 @@
     ],
     "timeout_minutes": 20,
     "max_diff_lines": 2400,
-    "block_on_review_failure": false
+    "auto_converge_after": 3,
+    "block_on_review_failure": true
   }
 }

.github/workflows/codex_pr_review.yml

@@ -0,0 +1,30 @@
+name: Codex PR Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  id-token: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: codex-pr-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    uses: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@main
+    with:
+      caller_concurrency_key: pr-${{ github.event.pull_request.number || github.run_id }}
+      allow_unconfigured_backend: false
+      api_fallback_enabled: "false"
+      direct_api_primary_enabled: "false"
+    secrets: inherit
+    permissions:
+      contents: read
+      id-token: write
+      issues: write
+      pull-requests: write

.github/workflows/invoke-cloud-run.yml

@@ -14,6 +14,9 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+
 env:
   GCP_PROJECT_ID: firstradequant
   GCP_WORKLOAD_IDENTITY_PROVIDER: projects/1088907247379/locations/global/workloadIdentityPools/github-actions/providers/github-main

.github/workflows/sync-cloud-run-env.yml

@@ -7,6 +7,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   GCP_PROJECT_ID: firstradequant
   GCP_PROJECT_NUMBER: "1088907247379"

qsl.toml

@@ -1,12 +1,12 @@
 [qsl]
 repo = "FirstradePlatform"
-tier = "runtime-platform"
-ring = 3
+tier = "runtime"
+upgrade_ring = "ring_d"
 allow_legacy = false
 
 [qsl.requires]
 quant_platform_kit = "69a0256934d081b5ef309a885384b9eb9f62cf90"
 us_equity_strategies = "17ddb86c72d44b2c7b78ba7a10d8f71b21180166"
 
 [qsl.compat]
-bundle = "2026.07.2"
+bundle = "2026.07.3"

tests/test_qsl_metadata.py

@@ -9,10 +9,10 @@ def test_qsl_metadata_has_runtime_platform_fields() -> None:
     with qsl_path.open("rb") as f:
         qsl = tomllib.load(f)["qsl"]
 
-    assert qsl["tier"] == "runtime-platform"
-    assert qsl["ring"] == 3
+    assert qsl["tier"] == "runtime"
+    assert qsl["upgrade_ring"] == "ring_d"
     assert qsl.get("repo") == "FirstradePlatform"
-    assert qsl["compat"]["bundle"] == "2026.07.2"
+    assert qsl["compat"]["bundle"] == "2026.07.3"
     requires = qsl["requires"]
     assert "quant_platform_kit" in requires
     assert "us_equity_strategies" in requires