QuantStrategyLab · Pigbibi · Sep 9, 2026 · Sep 9, 2026
diff --git a/.github/workflows/research_input_readback.yml b/.github/workflows/research_input_readback.yml
@@ -2,6 +2,20 @@ name: VPS Research Input Readback
 
 on:
   workflow_dispatch:
+    inputs:
+      operation:
+        description: Bounded operation to perform
+        required: true
+        default: readback
+        type: choice
+        options:
+          - readback
+          - soxl_learning
+      blend_gate_mid_soxl_weights:
+        description: Reviewed baseline and up to two bounded learning values
+        required: true
+        default: '0.65,0.60,0.55'
+        type: string
 
 permissions:
   contents: read
@@ -12,9 +26,9 @@ concurrency:
 
 jobs:
   readback:
-    if: github.repository == 'QuantStrategyLab/AIAuditBridge' && github.ref == 'refs/heads/main'
+    if: github.repository == 'QuantStrategyLab/AIAuditBridge' && github.ref == 'refs/heads/main' && (inputs.operation != 'soxl_learning' || github.run_attempt == 1)
     runs-on: [self-hosted, codex-vps]
-    timeout-minutes: 10
+    timeout-minutes: ${{ inputs.operation == 'soxl_learning' && 35 || 10 }}
     permissions:
       contents: read
       id-token: write
@@ -24,6 +38,16 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Initialize the sanitized learning record
+        if: inputs.operation == 'soxl_learning'
+        env:
+          LEARNING_OUTPUT: ${{ runner.temp }}/aab-soxl-learning-${{ github.run_id }}-${{ github.run_attempt }}/summary.json
+        run: |
+          set -euo pipefail
+          umask 077
+          mkdir -m 700 "$(dirname "$LEARNING_OUTPUT")"
+          python3 -c 'import os; from pathlib import Path; from scripts.run_soxl_manual_learning import initialize_record; initialize_record(Path(os.environ["LEARNING_OUTPUT"]), {"repository": os.environ["GITHUB_REPOSITORY"], "ref": os.environ["GITHUB_REF"], "event_name": os.environ["GITHUB_EVENT_NAME"], "actor": os.environ["GITHUB_ACTOR"], "run_id": os.environ["GITHUB_RUN_ID"], "run_attempt": os.environ["GITHUB_RUN_ATTEMPT"]})'
+
       - name: Checkout the frozen original P1 validator
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -32,6 +56,24 @@ jobs:
           path: validator-source
           persist-credentials: false
 
+      - name: Checkout the bounded learning consumer
+        if: inputs.operation == 'soxl_learning'
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          repository: QuantStrategyLab/UsEquitySnapshotPipelines
+          ref: b03ecbe4e0a7a0de22f298499f867a7039e4b60a
+          path: consumer-source
+          persist-credentials: false
+
+      - name: Checkout the frozen strategy runtime
+        if: inputs.operation == 'soxl_learning'
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          repository: QuantStrategyLab/UsEquityStrategies
+          ref: 7756fe32585e85cf1d09a163203a02e3eee39fe1
+          path: ues-source
+          persist-credentials: false
+
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v6.2.0
         with:
           python-version: '3.11'
@@ -44,6 +86,21 @@ jobs:
           python -m pip install --quiet 'uv==0.11.19'
           env -u UV_PYTHON -u VIRTUAL_ENV uv sync --locked --no-dev --no-editable --python 3.11
 
+      - name: Install the bounded learning consumer runtime
+        if: inputs.operation == 'soxl_learning'
+        working-directory: consumer-source
+        run: env -u UV_PYTHON -u VIRTUAL_ENV uv sync --locked --no-dev --no-editable --python 3.11
+
+      - name: Install the frozen strategy runtime
+        if: inputs.operation == 'soxl_learning'
+        working-directory: ues-source
+        env:
+          UV_PROJECT_ENVIRONMENT: ${{ runner.temp }}/aab-soxl-ues-env-${{ github.run_id }}-${{ github.run_attempt }}
+        run: |
+          env -u UV_PYTHON -u VIRTUAL_ENV uv sync --locked --no-dev --no-editable --python 3.11
+          rm -rf -- build
+          test -z "$(git status --porcelain --untracked-files=all)"
+
       # Direct federation grants only object reads on the fixed P1 root below.
       # The provider additionally binds numeric repo/owner IDs, main and this workflow.
       # No service-account key, user ADC, daemon credential or AI invocation is used.
@@ -64,6 +121,14 @@ jobs:
           EXPECTED_MANIFEST_SHA256: 06ce97ad581fdc465896ef324ce16ac65f2695af95ec18ce27238bdd71032f74
           READBACK_ROOT: ${{ runner.temp }}/aab-research-input-${{ github.run_id }}-${{ github.run_attempt }}
           VALIDATOR_SOURCE: ${{ github.workspace }}/validator-source
+          OPERATION: ${{ inputs.operation }}
+          PARAMETER_GRID: ${{ inputs.blend_gate_mid_soxl_weights }}
+          CONSUMER_SOURCE: ${{ github.workspace }}/consumer-source
+          UES_SOURCE: ${{ github.workspace }}/ues-source
+          LEARNING_OUTPUT: ${{ runner.temp }}/aab-soxl-learning-${{ github.run_id }}-${{ github.run_attempt }}/summary.json
+          CODEX_AUDIT_SERVICE_URL: ${{ secrets.CODEX_AUDIT_SERVICE_URL }}
+          CODEX_AUDIT_SERVICE_AUDIENCE: ${{ vars.CODEX_AUDIT_SERVICE_AUDIENCE || 'quant-codex-audit' }}
+          UES_ENV_ROOT: ${{ runner.temp }}/aab-soxl-ues-env-${{ github.run_id }}-${{ github.run_attempt }}
         run: |
           set -euo pipefail
           cleanup() {
@@ -182,8 +247,36 @@ jobs:
           }))
           PY
 
+          if [ "$OPERATION" = "soxl_learning" ]; then
+            cd "$GITHUB_WORKSPACE"
+            UV_PROJECT_ENVIRONMENT="$UES_ENV_ROOT" python3 -m scripts.run_soxl_manual_learning \
+              --parameter-grid "$PARAMETER_GRID" \
+              --manifest-sha256 "$EXPECTED_MANIFEST_SHA256" \
+              --root "$READBACK_ROOT/root" \
+              --consumer-source "$CONSUMER_SOURCE" \
+              --ues-source "$UES_SOURCE" \
+              --output "$LEARNING_OUTPUT" \
+              --repository "$GITHUB_REPOSITORY" \
+              --ref "$GITHUB_REF" \
+              --event-name "$GITHUB_EVENT_NAME" \
+              --actor "$GITHUB_ACTOR" \
+              --run-id "$GITHUB_RUN_ID" \
+              --run-attempt "$GITHUB_RUN_ATTEMPT"
+          fi
+
+      - name: Upload the sanitized learning record
+        if: always() && inputs.operation == 'soxl_learning'
+        uses: actions/upload-artifact@v7
+        with:
+          name: soxl-manual-learning-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/aab-soxl-learning-${{ github.run_id }}-${{ github.run_attempt }}/summary.json
+          if-no-files-found: error
+          retention-days: 35
+
       - name: Remove the bounded readback workspace
         if: always()
         env:
           READBACK_ROOT: ${{ runner.temp }}/aab-research-input-${{ github.run_id }}-${{ github.run_attempt }}
-        run: rm -rf -- "$READBACK_ROOT"
+          LEARNING_OUTPUT_ROOT: ${{ runner.temp }}/aab-soxl-learning-${{ github.run_id }}-${{ github.run_attempt }}
+          UES_ENV_ROOT: ${{ runner.temp }}/aab-soxl-ues-env-${{ github.run_id }}-${{ github.run_attempt }}
+        run: rm -rf -- "$READBACK_ROOT" "$LEARNING_OUTPUT_ROOT" "$UES_ENV_ROOT"
diff --git a/.github/workflows/vps_codex_service_ops.yml b/.github/workflows/vps_codex_service_ops.yml
@@ -61,7 +61,7 @@ jobs:
           CODEX_AUDIT_SSH_UNBAN_IP: ${{ inputs.ssh_unban_ip }}
           CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies
           # workflow_dispatch emits protected-main workflow_ref claims; the deploy script pins delegated QPK code by exact job_workflow_ref SHA.
-          CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/strategy_optimization_watcher.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/portfolio_research_proposal_diagnosis.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/HkEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main
+          CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/research_input_readback.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/strategy_optimization_watcher.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/portfolio_research_proposal_diagnosis.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/HkEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main
           CODEX_AUDIT_SERVICE_ALLOWED_REFS: refs/heads/main
           # Exact canonical audit job plus immutable QPK `uses:` refs pinned by strategy drift callers.
           # Rotation tracked in #64; remove the old QPK SHA after final strategy-run verification.

diff --git a/scripts/deploy_codex_audit_service.sh b/scripts/deploy_codex_audit_service.sh
@@ -11,7 +11,7 @@ ALLOWED_REPOSITORIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES:-QuantStrategyL
 # Direct review and strategy workflow identities are pinned to protected main because GitHub emits workflow_ref with the dispatch branch.
 # Delegated reusable code is constrained separately by the exact job_workflow_ref SHA below.
 # The ref allowlist retains PR merge refs because GitHub can preserve the incoming PR ref for reusable calls; _verify_github_oidc requires both allowlists.
-ALLOWED_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/strategy_optimization_watcher.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/portfolio_research_proposal_diagnosis.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/HkEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main}"
+ALLOWED_WORKFLOW_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS:-QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/research_input_readback.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/strategy_optimization_watcher.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/portfolio_research_proposal_diagnosis.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/HkEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main}"
 ALLOWED_REFS="${CODEX_AUDIT_SERVICE_ALLOWED_REFS:-refs/heads/main}"
 ALLOWED_REPOSITORY_VISIBILITIES="${CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORY_VISIBILITIES:-public}"
 # Exact canonical audit job identity. Single source of truth for delegated drift code follows.