Handle deferred Global ETF recovery safely

.github/workflows/global_etf_research_codegen.yml

@@ -13,6 +13,11 @@ on:
         required: true
         default: false
         type: boolean
+      resume_deferred:
+        description: Resume one due, pre-execution Codex quota deferral
+        required: true
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -49,6 +54,14 @@ jobs:
             echo "execute_and_auth_only_are_mutually_exclusive" >&2
             exit 2
           fi
+          if [ "${{ inputs.resume_deferred }}" = "true" ] && [ "${{ inputs.execute }}" != "true" ]; then
+            echo "resume_deferred_requires_execute" >&2
+            exit 2
+          fi
+          if [ "${{ inputs.resume_deferred }}" = "true" ] && [ "${{ inputs.auth_only }}" = "true" ]; then
+            echo "resume_deferred_and_auth_only_are_mutually_exclusive" >&2
+            exit 2
+          fi
 
       - name: Checkout frozen UsEquityStrategies base
         if: inputs.execute == true || inputs.auth_only == true
@@ -98,7 +111,11 @@ jobs:
         run: |
           set -euo pipefail
           if [ "${{ inputs.execute }}" = "true" ]; then
-            "$CASE_ROOT/venv/bin/python" -m scripts.run_global_etf_research_codegen --execute --ues-repo-root "$GITHUB_WORKSPACE/ues-source"
+            resume_arg=()
+            if [ "${{ inputs.resume_deferred }}" = "true" ]; then
+              resume_arg+=(--resume-deferred)
+            fi
+            "$CASE_ROOT/venv/bin/python" -m scripts.run_global_etf_research_codegen --execute --ues-repo-root "$GITHUB_WORKSPACE/ues-source" "${resume_arg[@]}"
           else
             python3 -m scripts.run_global_etf_research_codegen
           fi
@@ -110,15 +127,7 @@ jobs:
           umask 077
           mkdir -p "$CASE_ROOT/artifact"
           chmod 700 "$CASE_ROOT/artifact"
-          python3 - "$HOME/.local/state/aiauditbridge/global-etf-review-20260917-auth-recovery-35124525442/result.json" "$CASE_ROOT/artifact/result.json" <<'PY'
-          import json, sys
-          from pathlib import Path
-          source, target = map(Path, sys.argv[1:])
-          if source.is_file():
-              value = json.loads(source.read_text(encoding="utf-8"))
-              value.pop("source", None)
-              target.write_text(json.dumps(value, ensure_ascii=False, sort_keys=True), encoding="utf-8")
-          PY
+          python3 -m scripts.run_global_etf_research_codegen --project-result > "$CASE_ROOT/artifact/result.json"
 
       - name: Upload only the bounded advisory result
         if: always() && inputs.execute == true

README.md

@@ -62,8 +62,15 @@ The manual workflow also has an `auth_only` path for its existing OIDC and
 audit-service health check. It cannot be combined with `execute`, and it does
 not read the research source, create a claim, or call a model.
 A claim without a terminal result remains unknown and is never retried
-automatically. Only the advisory result is projected to a seven-day GitHub
-artifact; source body and raw response stay private on VPS. No deployment,
+automatically. A Codex response is deferred only when its saved pre-execution
+quota record has the exact bounded shape; ordinary gateway failures remain
+failed. Default re-entry returns a saved deferred result without another call.
+The manual `resume_deferred` input is false by default and can make one due
+recovery attempt only after reusing the verified claim source and rerunning the
+fixed candidate tests. It keeps the original claim, result, and response,
+leaves a permanent same-root recovery lock, and blocks after an unknown outcome
+or another model call after a completed recovery. Only the advisory result is projected to a seven-day
+GitHub artifact; source body and raw response stay private on VPS. No deployment,
 trading, or financial promotion authority is granted.
 
 ## Bounded SOXL research entry