[MarketDataApp]

Two changes to .github/workflows/audit-callers.yml, and the second is the
reason the first is safe.

THE SCHEDULE IS NOW WEEKLY, 07:00 UTC on Monday rather than 07:00 UTC daily.
What this audit catches is a rename, a deleted caller or a workflow switched
off in the Actions UI -- a human edit, not a background process -- and every
merge to main runs the whole audit as well. Daily bought little over weekly
and spent a run on it.

THE AUDIT NOW POSTS TO SLACK WHEN IT FAILS. Email was the only alert, so a
weekly schedule would have meant up to seven days between a repository losing
its reviews and anyone hearing about it. That silence is precisely what this
workflow exists to break, so the workflow must not fall into it.

It uses the same path support-agent, daily-standup, proxy and codex-keeper
already use -- POST to notify.marketdata.app with the organisation's
SLACK_NOTIFY_TOKEN -- so the alarm brings no new credential. An alarm with
its own secret is an alarm with its own way to fail. The token goes in an
Authorization: Bearer header rather than the ?token= query string the
older callers in the fleet use, because a query string lands in the run log,
in any redirect, and in the receiving proxy's access log.

Three properties the step depends on, each asserted by a test:

• if: failure(), and || true on the curl. The audit's own verdict stays
  the job's conclusion. A notifier that can fail the job would report a
  Slack outage as fleet drift, and the next real failure would then read as
  another outage.
• It runs AFTER both audit steps. The second carries if: always() so one
  broken repository cannot hide the rest; an alarm between them would fire
  while half the fleet is still unchecked and report one repository as the
  whole answer.
• The token is not in the URL.

The gap documented in the README is unchanged and is not made worse: GitHub
still disables a scheduled workflow after 60 days of repository inactivity,
and a workflow already disabled that way does not process a later push.

737 tests pass.

[marketdata-code-review]

✅ Ready — Code review

This pull request changes the caller audit from daily to Monday at 07:00 UTC and adds a failure-only Slack notification that preserves the audit job’s conclusion. The README and configuration-focused tests cover the notification’s trigger, ordering, token placement, and non-fatal behavior.

Rating patch 5/6 (solid) · proof 5/6 (reproducible) · overall 5/6

---

Reviewed 1ac6d3e · revision 1 · codex (gpt-5.6-sol) · claude unavailable · rules: default