From 6279b0c8fe7f41f2ec61be728da41d9c2c599e84 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 17:58:04 +0900 Subject: [PATCH 01/29] test(review): require truthful repair quality workflow identity --- tests/test_hourly_scheduler_runtime_budget.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/test_hourly_scheduler_runtime_budget.py b/tests/test_hourly_scheduler_runtime_budget.py index 02b4fa05b2..cfe0484c48 100644 --- a/tests/test_hourly_scheduler_runtime_budget.py +++ b/tests/test_hourly_scheduler_runtime_budget.py @@ -6,7 +6,8 @@ REUSABLE = Path(".github/workflows/pr-review-fix-scheduler.yml") CLEARFOLIO = Path(".github/workflows/clearfolio-hourly-review-repair.yml") DISKSAGE = Path(".github/workflows/disksage-hourly-review-repair.yml") -QUALITY = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +LEGACY_QUALITY = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def _read(path: Path) -> str: @@ -45,3 +46,17 @@ def test_quality_gate_tracks_runtime_budget_contract() -> None: quality = _read(QUALITY) assert quality.count("tests/test_hourly_scheduler_runtime_budget.py") == 3 + + +def test_review_repair_quality_workflow_has_truthful_identity() -> None: + """Keep contract CI distinct from the hourly writer and retired direct-NIM design.""" + assert QUALITY.is_file() + assert not LEGACY_QUALITY.exists() + + quality = _read(QUALITY) + assert quality.startswith("name: Contextual Orchestrator Review Repair Quality CI\n") + assert "schedule:" not in quality + assert "name: Hourly NVIDIA NIM Review Repair" not in quality + assert "Hourly cadence, immutable source, NIM credential, and conflict scope" not in quality + assert ".github/workflows/pr-review-autofix.yml" in quality + assert "tests/test_pr_review_autofix_nvidia_nim_contract.py" in quality From 47f9ddd1bf6199ae6081473aacb0f232333d48c7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 17:59:42 +0900 Subject: [PATCH 02/29] fix(ci): name review-repair quality gate by current owner --- ...ual-orchestrator-review-repair-quality.yml | 239 ++++++++++++++++++ 1 file changed, 239 insertions(+) create mode 100644 .github/workflows/contextual-orchestrator-review-repair-quality.yml diff --git a/.github/workflows/contextual-orchestrator-review-repair-quality.yml b/.github/workflows/contextual-orchestrator-review-repair-quality.yml new file mode 100644 index 0000000000..2cad4b9760 --- /dev/null +++ b/.github/workflows/contextual-orchestrator-review-repair-quality.yml @@ -0,0 +1,239 @@ +name: Contextual Orchestrator Review Repair Quality CI + +# This is a read-only PR/push quality gate for the central review-repair control +# plane. Hourly execution is owned by the thin product callers and the reusable +# scheduler; write-capable repair is owned by pr-review-autofix.yml, whose model +# execution is routed through contextual-orchestrator/orchestrator/free. +on: + pull_request: + paths: + - .github/workflows/pr-review-fix-scheduler.yml + - scripts/ci/pr_review_fix_scheduler.py + - .github/workflows/pr-review-autofix.yml + - .github/workflows/bandscope-hourly-review-repair.yml + - .github/workflows/contextual-orchestrator-hourly-review-repair.yml + - .github/workflows/clearfolio-hourly-review-repair.yml + - .github/workflows/disksage-hourly-review-repair.yml + - .github/workflows/inkspan-hourly-review-repair.yml + - .github/workflows/lineageweave-hourly-review-repair.yml + - .github/workflows/fast-mlsirm-hourly-review-repair.yml + - .github/workflows/github-hourly-review-repair.yml + - .github/workflows/governance-risk-compliance-hourly-review-repair.yml + - .github/workflows/contextual-orchestrator-review-repair-quality.yml + - .github/workflows/nonnest2-hourly-review-repair.yml + - .github/workflows/orgmetra-hourly-review-repair.yml + - .github/workflows/originweave-hourly-review-repair.yml + - .github/workflows/quarantine-sandbox-hourly-review-repair.yml + - .github/workflows/afipc-hourly-review-repair.yml + - scripts/ci/pr_review_conflict_scope.py + - scripts/ci/pr_review_autofix_context.py + - scripts/ci/zdr_policy.py + - scripts/ci/contextual_orchestrator_review_policy.py + - scripts/ci/contextual_orchestrator_review_launcher.py + - scripts/ci/contextual_orchestrator_review_sidecar.sh + - tests/test_zdr_policy.py + - tests/test_contextual_orchestrator_review_policy.py + - tests/test_contextual_orchestrator_review_sidecar_contract.py + - docs/doctoring/contextual-orchestrator-vendored-sidecar.md + - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md + - tests/test_bandscope_hourly_review_caller.py + - tests/test_disksage_hourly_review_caller.py + - tests/test_inkspan_hourly_review_caller.py + - tests/test_lineageweave_hourly_review_caller.py + - tests/test_fast_mlsirm_hourly_review_caller.py + - tests/test_github_hourly_conflict_repair.py + - tests/test_governance_risk_compliance_hourly_review_caller.py + - tests/test_hourly_scheduler_runtime_budget.py + - tests/test_nonnest2_hourly_review_caller.py + - tests/test_orgmetra_hourly_review_caller.py + - tests/test_originweave_hourly_review_caller.py + - tests/test_quarantine_sandbox_hourly_review_caller.py + - tests/test_contextual_orchestrator_hourly_review_caller.py + - tests/test_afipc_hourly_review_caller.py + - tests/test_hourly_autofix_context_quality_gate.py + - tests/test_pr_review_conflict_scope.py + - tests/test_pr_review_conflict_scope_control_files.py + - tests/test_pr_review_conflict_scope_git_executable.py + - tests/test_pr_review_conflict_scope_ignored_paths.py + - tests/test_pr_review_conflict_scope_symlink_targets.py + - tests/test_pr_review_fix_hourly_contract.py + - tests/test_pr_review_fix_scheduler.py + - tests/test_pr_review_fix_scheduler_source_pin.py + - tests/test_pr_review_autofix_context_head_binding.py + - tests/test_pr_review_autofix_nvidia_nim_contract.py + - tests/test_pr_review_autofix_writer_security_contract.py + - docs/automation/hourly-review-repair.md + - docs/doctoring/bandscope-hourly-review-caller.md + - docs/doctoring/clearfolio-hourly-review-caller.md + - docs/doctoring/conflict-control-evidence-isolation.md + - docs/doctoring/disksage-hourly-review-caller.md + - docs/doctoring/inkspan-hourly-review-caller.md + - docs/doctoring/lineageweave-hourly-review-caller.md + - docs/doctoring/fast-mlsirm-hourly-review-caller.md + - docs/doctoring/github-hourly-conflict-repair.md + - docs/doctoring/governance-risk-compliance-hourly-review-caller.md + - docs/doctoring/hourly-nvidia-nim-autofix.md + - docs/doctoring/nonnest2-hourly-review-caller.md + - docs/doctoring/orgmetra-hourly-review-caller.md + - docs/doctoring/originweave-hourly-review-caller.md + - docs/doctoring/quarantine-sandbox-hourly-review-caller.md + - docs/doctoring/contextual-orchestrator-hourly-review-caller.md + - docs/doctoring/afipc-hourly-review-caller.md + push: + paths: + - .github/workflows/pr-review-fix-scheduler.yml + - scripts/ci/pr_review_fix_scheduler.py + - .github/workflows/pr-review-autofix.yml + - .github/workflows/bandscope-hourly-review-repair.yml + - .github/workflows/contextual-orchestrator-hourly-review-repair.yml + - .github/workflows/clearfolio-hourly-review-repair.yml + - .github/workflows/disksage-hourly-review-repair.yml + - .github/workflows/inkspan-hourly-review-repair.yml + - .github/workflows/lineageweave-hourly-review-repair.yml + - .github/workflows/fast-mlsirm-hourly-review-repair.yml + - .github/workflows/github-hourly-review-repair.yml + - .github/workflows/governance-risk-compliance-hourly-review-repair.yml + - .github/workflows/contextual-orchestrator-review-repair-quality.yml + - .github/workflows/nonnest2-hourly-review-repair.yml + - .github/workflows/orgmetra-hourly-review-repair.yml + - .github/workflows/originweave-hourly-review-repair.yml + - .github/workflows/quarantine-sandbox-hourly-review-repair.yml + - .github/workflows/afipc-hourly-review-repair.yml + - scripts/ci/pr_review_conflict_scope.py + - scripts/ci/pr_review_autofix_context.py + - scripts/ci/zdr_policy.py + - scripts/ci/contextual_orchestrator_review_policy.py + - scripts/ci/contextual_orchestrator_review_launcher.py + - scripts/ci/contextual_orchestrator_review_sidecar.sh + - tests/test_zdr_policy.py + - tests/test_contextual_orchestrator_review_policy.py + - tests/test_contextual_orchestrator_review_sidecar_contract.py + - docs/doctoring/contextual-orchestrator-vendored-sidecar.md + - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md + - tests/test_bandscope_hourly_review_caller.py + - tests/test_disksage_hourly_review_caller.py + - tests/test_inkspan_hourly_review_caller.py + - tests/test_lineageweave_hourly_review_caller.py + - tests/test_fast_mlsirm_hourly_review_caller.py + - tests/test_github_hourly_conflict_repair.py + - tests/test_governance_risk_compliance_hourly_review_caller.py + - tests/test_hourly_scheduler_runtime_budget.py + - tests/test_nonnest2_hourly_review_caller.py + - tests/test_orgmetra_hourly_review_caller.py + - tests/test_originweave_hourly_review_caller.py + - tests/test_quarantine_sandbox_hourly_review_caller.py + - tests/test_contextual_orchestrator_hourly_review_caller.py + - tests/test_afipc_hourly_review_caller.py + - tests/test_hourly_autofix_context_quality_gate.py + - tests/test_pr_review_conflict_scope.py + - tests/test_pr_review_conflict_scope_control_files.py + - tests/test_pr_review_conflict_scope_git_executable.py + - tests/test_pr_review_conflict_scope_ignored_paths.py + - tests/test_pr_review_conflict_scope_symlink_targets.py + - tests/test_pr_review_fix_hourly_contract.py + - tests/test_pr_review_fix_scheduler.py + - tests/test_pr_review_fix_scheduler_source_pin.py + - tests/test_pr_review_autofix_context_head_binding.py + - tests/test_pr_review_autofix_nvidia_nim_contract.py + - tests/test_pr_review_autofix_writer_security_contract.py + - docs/automation/hourly-review-repair.md + - docs/doctoring/bandscope-hourly-review-caller.md + - docs/doctoring/clearfolio-hourly-review-caller.md + - docs/doctoring/conflict-control-evidence-isolation.md + - docs/doctoring/disksage-hourly-review-caller.md + - docs/doctoring/inkspan-hourly-review-caller.md + - docs/doctoring/lineageweave-hourly-review-caller.md + - docs/doctoring/fast-mlsirm-hourly-review-caller.md + - docs/doctoring/github-hourly-conflict-repair.md + - docs/doctoring/governance-risk-compliance-hourly-review-caller.md + - docs/doctoring/hourly-nvidia-nim-autofix.md + - docs/doctoring/nonnest2-hourly-review-caller.md + - docs/doctoring/orgmetra-hourly-review-caller.md + - docs/doctoring/originweave-hourly-review-caller.md + - docs/doctoring/quarantine-sandbox-hourly-review-caller.md + - docs/doctoring/contextual-orchestrator-hourly-review-caller.md + - docs/doctoring/afipc-hourly-review-caller.md + +permissions: + contents: read + +concurrency: + group: contextual-orchestrator-review-repair-quality-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + contract: + name: Scheduler, contextual-orchestrator, writer, and conflict-scope contracts + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout exact source revision + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.12" + - name: Install hash-locked test tooling + run: >- + python -m pip install --disable-pip-version-check --require-hashes + -r requirements-opencode-review-ci-hashes.txt + - name: Verify scheduler and contextual-orchestrator review-repair contracts + run: | + set -euo pipefail + python -m pytest -q \ + --cov=scripts.ci.pr_review_conflict_scope \ + --cov=scripts.ci.pr_review_autofix_context \ + --cov=scripts.ci.zdr_policy \ + --cov=scripts.ci.contextual_orchestrator_review_policy \ + --cov-branch \ + --cov-fail-under=100 + python -m interrogate \ + --fail-under 100 \ + scripts/ci/pr_review_conflict_scope.py \ + scripts/ci/pr_review_autofix_context.py \ + scripts/ci/zdr_policy.py \ + scripts/ci/contextual_orchestrator_review_policy.py \ + scripts/ci/contextual_orchestrator_review_launcher.py + python -m compileall -q \ + scripts/ci/pr_review_conflict_scope.py \ + scripts/ci/pr_review_autofix_context.py \ + tests/test_pr_review_conflict_scope.py \ + scripts/ci/zdr_policy.py \ + scripts/ci/contextual_orchestrator_review_policy.py \ + scripts/ci/contextual_orchestrator_review_launcher.py \ + tests/test_zdr_policy.py \ + tests/test_contextual_orchestrator_review_policy.py \ + tests/test_contextual_orchestrator_review_sidecar_contract.py \ + tests/test_bandscope_hourly_review_caller.py \ + tests/test_disksage_hourly_review_caller.py \ + tests/test_inkspan_hourly_review_caller.py \ + tests/test_lineageweave_hourly_review_caller.py \ + tests/test_fast_mlsirm_hourly_review_caller.py \ + tests/test_github_hourly_conflict_repair.py \ + tests/test_governance_risk_compliance_hourly_review_caller.py \ + tests/test_hourly_scheduler_runtime_budget.py \ + tests/test_nonnest2_hourly_review_caller.py \ + tests/test_orgmetra_hourly_review_caller.py \ + tests/test_originweave_hourly_review_caller.py \ + tests/test_quarantine_sandbox_hourly_review_caller.py \ + tests/test_contextual_orchestrator_hourly_review_caller.py \ + tests/test_afipc_hourly_review_caller.py \ + tests/test_pr_review_conflict_scope_control_files.py \ + tests/test_hourly_autofix_context_quality_gate.py \ + tests/test_pr_review_conflict_scope_git_executable.py \ + tests/test_pr_review_conflict_scope_ignored_paths.py \ + tests/test_pr_review_conflict_scope_symlink_targets.py \ + tests/test_pr_review_fix_hourly_contract.py \ + tests/test_pr_review_fix_scheduler.py \ + tests/test_pr_review_fix_scheduler_source_pin.py \ + tests/test_pr_review_autofix_context_head_binding.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py \ + tests/test_pr_review_autofix_writer_security_contract.py + git diff --check From 6b696198424d3f91f3872d59fcd7a58d04099a39 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 17:59:52 +0900 Subject: [PATCH 03/29] fix(ci): retire stale NVIDIA NIM quality workflow identity --- .../hourly-nvidia-nim-review-repair.yml | 235 ------------------ 1 file changed, 235 deletions(-) delete mode 100644 .github/workflows/hourly-nvidia-nim-review-repair.yml diff --git a/.github/workflows/hourly-nvidia-nim-review-repair.yml b/.github/workflows/hourly-nvidia-nim-review-repair.yml deleted file mode 100644 index cfd47e5c57..0000000000 --- a/.github/workflows/hourly-nvidia-nim-review-repair.yml +++ /dev/null @@ -1,235 +0,0 @@ -name: Hourly NVIDIA NIM Review Repair - -on: - pull_request: - paths: - - .github/workflows/pr-review-fix-scheduler.yml - - scripts/ci/pr_review_fix_scheduler.py - - .github/workflows/pr-review-autofix.yml - - .github/workflows/bandscope-hourly-review-repair.yml - - .github/workflows/contextual-orchestrator-hourly-review-repair.yml - - .github/workflows/clearfolio-hourly-review-repair.yml - - .github/workflows/disksage-hourly-review-repair.yml - - .github/workflows/inkspan-hourly-review-repair.yml - - .github/workflows/lineageweave-hourly-review-repair.yml - - .github/workflows/fast-mlsirm-hourly-review-repair.yml - - .github/workflows/github-hourly-review-repair.yml - - .github/workflows/governance-risk-compliance-hourly-review-repair.yml - - .github/workflows/hourly-nvidia-nim-review-repair.yml - - .github/workflows/nonnest2-hourly-review-repair.yml - - .github/workflows/orgmetra-hourly-review-repair.yml - - .github/workflows/originweave-hourly-review-repair.yml - - .github/workflows/quarantine-sandbox-hourly-review-repair.yml - - .github/workflows/afipc-hourly-review-repair.yml - - scripts/ci/pr_review_conflict_scope.py - - scripts/ci/pr_review_autofix_context.py - - scripts/ci/zdr_policy.py - - scripts/ci/contextual_orchestrator_review_policy.py - - scripts/ci/contextual_orchestrator_review_launcher.py - - scripts/ci/contextual_orchestrator_review_sidecar.sh - - tests/test_zdr_policy.py - - tests/test_contextual_orchestrator_review_policy.py - - tests/test_contextual_orchestrator_review_sidecar_contract.py - - docs/doctoring/contextual-orchestrator-vendored-sidecar.md - - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md - - tests/test_bandscope_hourly_review_caller.py - - tests/test_disksage_hourly_review_caller.py - - tests/test_inkspan_hourly_review_caller.py - - tests/test_lineageweave_hourly_review_caller.py - - tests/test_fast_mlsirm_hourly_review_caller.py - - tests/test_github_hourly_conflict_repair.py - - tests/test_governance_risk_compliance_hourly_review_caller.py - - tests/test_hourly_scheduler_runtime_budget.py - - tests/test_nonnest2_hourly_review_caller.py - - tests/test_orgmetra_hourly_review_caller.py - - tests/test_originweave_hourly_review_caller.py - - tests/test_quarantine_sandbox_hourly_review_caller.py - - tests/test_contextual_orchestrator_hourly_review_caller.py - - tests/test_afipc_hourly_review_caller.py - - tests/test_hourly_autofix_context_quality_gate.py - - tests/test_pr_review_conflict_scope.py - - tests/test_pr_review_conflict_scope_control_files.py - - tests/test_pr_review_conflict_scope_git_executable.py - - tests/test_pr_review_conflict_scope_ignored_paths.py - - tests/test_pr_review_conflict_scope_symlink_targets.py - - tests/test_pr_review_fix_hourly_contract.py - - tests/test_pr_review_fix_scheduler.py - - tests/test_pr_review_fix_scheduler_source_pin.py - - tests/test_pr_review_autofix_context_head_binding.py - - tests/test_pr_review_autofix_nvidia_nim_contract.py - - tests/test_pr_review_autofix_writer_security_contract.py - - docs/automation/hourly-review-repair.md - - docs/doctoring/bandscope-hourly-review-caller.md - - docs/doctoring/clearfolio-hourly-review-caller.md - - docs/doctoring/conflict-control-evidence-isolation.md - - docs/doctoring/disksage-hourly-review-caller.md - - docs/doctoring/inkspan-hourly-review-caller.md - - docs/doctoring/lineageweave-hourly-review-caller.md - - docs/doctoring/fast-mlsirm-hourly-review-caller.md - - docs/doctoring/github-hourly-conflict-repair.md - - docs/doctoring/governance-risk-compliance-hourly-review-caller.md - - docs/doctoring/hourly-nvidia-nim-autofix.md - - docs/doctoring/nonnest2-hourly-review-caller.md - - docs/doctoring/orgmetra-hourly-review-caller.md - - docs/doctoring/originweave-hourly-review-caller.md - - docs/doctoring/quarantine-sandbox-hourly-review-caller.md - - docs/doctoring/contextual-orchestrator-hourly-review-caller.md - - docs/doctoring/afipc-hourly-review-caller.md - push: - paths: - - .github/workflows/pr-review-fix-scheduler.yml - - scripts/ci/pr_review_fix_scheduler.py - - .github/workflows/pr-review-autofix.yml - - .github/workflows/bandscope-hourly-review-repair.yml - - .github/workflows/contextual-orchestrator-hourly-review-repair.yml - - .github/workflows/clearfolio-hourly-review-repair.yml - - .github/workflows/disksage-hourly-review-repair.yml - - .github/workflows/inkspan-hourly-review-repair.yml - - .github/workflows/lineageweave-hourly-review-repair.yml - - .github/workflows/fast-mlsirm-hourly-review-repair.yml - - .github/workflows/github-hourly-review-repair.yml - - .github/workflows/governance-risk-compliance-hourly-review-repair.yml - - .github/workflows/hourly-nvidia-nim-review-repair.yml - - .github/workflows/nonnest2-hourly-review-repair.yml - - .github/workflows/orgmetra-hourly-review-repair.yml - - .github/workflows/originweave-hourly-review-repair.yml - - .github/workflows/quarantine-sandbox-hourly-review-repair.yml - - .github/workflows/afipc-hourly-review-repair.yml - - scripts/ci/pr_review_conflict_scope.py - - scripts/ci/pr_review_autofix_context.py - - scripts/ci/zdr_policy.py - - scripts/ci/contextual_orchestrator_review_policy.py - - scripts/ci/contextual_orchestrator_review_launcher.py - - scripts/ci/contextual_orchestrator_review_sidecar.sh - - tests/test_zdr_policy.py - - tests/test_contextual_orchestrator_review_policy.py - - tests/test_contextual_orchestrator_review_sidecar_contract.py - - docs/doctoring/contextual-orchestrator-vendored-sidecar.md - - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md - - tests/test_bandscope_hourly_review_caller.py - - tests/test_disksage_hourly_review_caller.py - - tests/test_inkspan_hourly_review_caller.py - - tests/test_lineageweave_hourly_review_caller.py - - tests/test_fast_mlsirm_hourly_review_caller.py - - tests/test_github_hourly_conflict_repair.py - - tests/test_governance_risk_compliance_hourly_review_caller.py - - tests/test_hourly_scheduler_runtime_budget.py - - tests/test_nonnest2_hourly_review_caller.py - - tests/test_orgmetra_hourly_review_caller.py - - tests/test_originweave_hourly_review_caller.py - - tests/test_quarantine_sandbox_hourly_review_caller.py - - tests/test_contextual_orchestrator_hourly_review_caller.py - - tests/test_afipc_hourly_review_caller.py - - tests/test_hourly_autofix_context_quality_gate.py - - tests/test_pr_review_conflict_scope.py - - tests/test_pr_review_conflict_scope_control_files.py - - tests/test_pr_review_conflict_scope_git_executable.py - - tests/test_pr_review_conflict_scope_ignored_paths.py - - tests/test_pr_review_conflict_scope_symlink_targets.py - - tests/test_pr_review_fix_hourly_contract.py - - tests/test_pr_review_fix_scheduler.py - - tests/test_pr_review_fix_scheduler_source_pin.py - - tests/test_pr_review_autofix_context_head_binding.py - - tests/test_pr_review_autofix_nvidia_nim_contract.py - - tests/test_pr_review_autofix_writer_security_contract.py - - docs/automation/hourly-review-repair.md - - docs/doctoring/bandscope-hourly-review-caller.md - - docs/doctoring/clearfolio-hourly-review-caller.md - - docs/doctoring/conflict-control-evidence-isolation.md - - docs/doctoring/disksage-hourly-review-caller.md - - docs/doctoring/inkspan-hourly-review-caller.md - - docs/doctoring/lineageweave-hourly-review-caller.md - - docs/doctoring/fast-mlsirm-hourly-review-caller.md - - docs/doctoring/github-hourly-conflict-repair.md - - docs/doctoring/governance-risk-compliance-hourly-review-caller.md - - docs/doctoring/hourly-nvidia-nim-autofix.md - - docs/doctoring/nonnest2-hourly-review-caller.md - - docs/doctoring/orgmetra-hourly-review-caller.md - - docs/doctoring/originweave-hourly-review-caller.md - - docs/doctoring/quarantine-sandbox-hourly-review-caller.md - - docs/doctoring/contextual-orchestrator-hourly-review-caller.md - - docs/doctoring/afipc-hourly-review-caller.md - -permissions: - contents: read - -concurrency: - group: hourly-nvidia-nim-review-repair-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -jobs: - contract: - name: Hourly cadence, immutable source, NIM credential, and conflict scope - runs-on: ubuntu-24.04 - timeout-minutes: 20 - steps: - - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - egress-policy: audit - - name: Checkout exact source revision - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} - persist-credentials: false - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.12" - - name: Install hash-locked test tooling - run: >- - python -m pip install --disable-pip-version-check --require-hashes - -r requirements-opencode-review-ci-hashes.txt - - name: Verify hourly scheduler and NVIDIA NIM autofix contracts - run: | - set -euo pipefail - python -m pytest -q \ - --cov=scripts.ci.pr_review_conflict_scope \ - --cov=scripts.ci.pr_review_autofix_context \ - --cov=scripts.ci.zdr_policy \ - --cov=scripts.ci.contextual_orchestrator_review_policy \ - --cov-branch \ - --cov-fail-under=100 - python -m interrogate \ - --fail-under 100 \ - scripts/ci/pr_review_conflict_scope.py \ - scripts/ci/pr_review_autofix_context.py \ - scripts/ci/zdr_policy.py \ - scripts/ci/contextual_orchestrator_review_policy.py \ - scripts/ci/contextual_orchestrator_review_launcher.py - python -m compileall -q \ - scripts/ci/pr_review_conflict_scope.py \ - scripts/ci/pr_review_autofix_context.py \ - tests/test_pr_review_conflict_scope.py \ - scripts/ci/zdr_policy.py \ - scripts/ci/contextual_orchestrator_review_policy.py \ - scripts/ci/contextual_orchestrator_review_launcher.py \ - tests/test_zdr_policy.py \ - tests/test_contextual_orchestrator_review_policy.py \ - tests/test_contextual_orchestrator_review_sidecar_contract.py \ - tests/test_bandscope_hourly_review_caller.py \ - tests/test_disksage_hourly_review_caller.py \ - tests/test_inkspan_hourly_review_caller.py \ - tests/test_lineageweave_hourly_review_caller.py \ - tests/test_fast_mlsirm_hourly_review_caller.py \ - tests/test_github_hourly_conflict_repair.py \ - tests/test_governance_risk_compliance_hourly_review_caller.py \ - tests/test_hourly_scheduler_runtime_budget.py \ - tests/test_nonnest2_hourly_review_caller.py \ - tests/test_orgmetra_hourly_review_caller.py \ - tests/test_originweave_hourly_review_caller.py \ - tests/test_quarantine_sandbox_hourly_review_caller.py \ - tests/test_contextual_orchestrator_hourly_review_caller.py \ - tests/test_afipc_hourly_review_caller.py \ - tests/test_pr_review_conflict_scope_control_files.py \ - tests/test_hourly_autofix_context_quality_gate.py \ - tests/test_pr_review_conflict_scope_git_executable.py \ - tests/test_pr_review_conflict_scope_ignored_paths.py \ - tests/test_pr_review_conflict_scope_symlink_targets.py \ - tests/test_pr_review_fix_hourly_contract.py \ - tests/test_pr_review_fix_scheduler.py \ - tests/test_pr_review_fix_scheduler_source_pin.py \ - tests/test_pr_review_autofix_context_head_binding.py \ - tests/test_pr_review_autofix_nvidia_nim_contract.py \ - tests/test_pr_review_autofix_writer_security_contract.py - git diff --check From 331f50388860379fc1cac09f17cde6b75c2a464b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:00:35 +0900 Subject: [PATCH 04/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_inkspan_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_inkspan_hourly_review_caller.py b/tests/test_inkspan_hourly_review_caller.py index fb8f903694..f40ad3967f 100644 --- a/tests/test_inkspan_hourly_review_caller.py +++ b/tests/test_inkspan_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/inkspan-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/inkspan-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") def _read(path: Path) -> str: @@ -74,4 +74,4 @@ def test_focused_quality_workflow_tracks_inkspan_caller_contracts() -> None: assert quality.count(".github/workflows/inkspan-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/inkspan-hourly-review-caller.md") == 2 - assert quality.count("tests/test_inkspan_hourly_review_caller.py") == 3 + assert quality.count("tests/test_inkspan_hourly_review_caller.py") == 3 \ No newline at end of file From 48d5097c167b90c8e693122b0e6e4c8d15647027 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:00:51 +0900 Subject: [PATCH 05/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_disksage_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_disksage_hourly_review_caller.py b/tests/test_disksage_hourly_review_caller.py index 5ad14b2488..66bc5b65f3 100644 --- a/tests/test_disksage_hourly_review_caller.py +++ b/tests/test_disksage_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/disksage-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/disksage-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") def _read(path: Path) -> str: @@ -73,4 +73,4 @@ def test_focused_quality_workflow_tracks_disksage_caller_contracts() -> None: assert quality.count(".github/workflows/disksage-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/disksage-hourly-review-caller.md") == 2 - assert quality.count("tests/test_disksage_hourly_review_caller.py") == 3 + assert quality.count("tests/test_disksage_hourly_review_caller.py") == 3 \ No newline at end of file From 403b70013f1459ec68d7c804a62282dd2c3b240e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:01:25 +0900 Subject: [PATCH 06/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_lineageweave_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_lineageweave_hourly_review_caller.py b/tests/test_lineageweave_hourly_review_caller.py index fb7b8ba8cc..03ff565795 100644 --- a/tests/test_lineageweave_hourly_review_caller.py +++ b/tests/test_lineageweave_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/lineageweave-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/lineageweave-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -69,4 +69,4 @@ def test_lineageweave_doctoring_keeps_product_and_review_claims_separate() -> No "copilot_github_token", "apa 7th references", ): - assert contract in doctoring + assert contract in doctoring \ No newline at end of file From 71fb7f2d63638cfd71a628fbbfdb4f8304d0ca86 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:01:46 +0900 Subject: [PATCH 07/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_bandscope_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_bandscope_hourly_review_caller.py b/tests/test_bandscope_hourly_review_caller.py index 3c8d96cbfb..4a4fdbd1e6 100644 --- a/tests/test_bandscope_hourly_review_caller.py +++ b/tests/test_bandscope_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/bandscope-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/bandscope-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") def _read(path: Path) -> str: @@ -84,4 +84,4 @@ def test_focused_quality_workflow_tracks_bandscope_contracts() -> None: assert quality.count(".github/workflows/bandscope-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/bandscope-hourly-review-caller.md") == 2 - assert quality.count("tests/test_bandscope_hourly_review_caller.py") == 3 + assert quality.count("tests/test_bandscope_hourly_review_caller.py") == 3 \ No newline at end of file From 707094aea19c028bc7195d582bbab63a9f16a0a0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:02:06 +0900 Subject: [PATCH 08/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_fast_mlsirm_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_fast_mlsirm_hourly_review_caller.py b/tests/test_fast_mlsirm_hourly_review_caller.py index 1fd0965860..862ea0ee22 100644 --- a/tests/test_fast_mlsirm_hourly_review_caller.py +++ b/tests/test_fast_mlsirm_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/fast-mlsirm-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/fast-mlsirm-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") def _read(path: Path) -> str: @@ -77,4 +77,4 @@ def test_focused_quality_workflow_tracks_fast_mlsirm_contracts() -> None: assert quality.count(".github/workflows/fast-mlsirm-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/fast-mlsirm-hourly-review-caller.md") == 2 - assert quality.count("tests/test_fast_mlsirm_hourly_review_caller.py") == 3 + assert quality.count("tests/test_fast_mlsirm_hourly_review_caller.py") == 3 \ No newline at end of file From ae281ceeeb631b788e099bfc683a9138adea819b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:02:47 +0900 Subject: [PATCH 09/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_orgmetra_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_orgmetra_hourly_review_caller.py b/tests/test_orgmetra_hourly_review_caller.py index 9b5b85f485..d6c0e0c678 100644 --- a/tests/test_orgmetra_hourly_review_caller.py +++ b/tests/test_orgmetra_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/orgmetra-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/orgmetra-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") def _read(path: Path) -> str: @@ -102,4 +102,4 @@ def test_focused_quality_workflow_tracks_orgmetra_contracts() -> None: compileall_start = quality.index("python -m compileall -q \\") compileall_end = quality.index("git diff --check", compileall_start) compileall = quality[compileall_start:compileall_end] - assert contract in compileall + assert contract in compileall \ No newline at end of file From 15747c7381a9923b98befab7fed3afc0d8c3701a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:03:19 +0900 Subject: [PATCH 10/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_afipc_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_afipc_hourly_review_caller.py b/tests/test_afipc_hourly_review_caller.py index bfcaa5d8e3..c3ddda3fe8 100644 --- a/tests/test_afipc_hourly_review_caller.py +++ b/tests/test_afipc_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/afipc-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/afipc-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -163,4 +163,4 @@ def test_focused_quality_workflow_tracks_afipc_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths + assert doctoring not in compileall_paths \ No newline at end of file From 4a03f820eeff357adf3a57811b2e2c25c2b8614f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:03:47 +0900 Subject: [PATCH 11/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_nonnest2_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_nonnest2_hourly_review_caller.py b/tests/test_nonnest2_hourly_review_caller.py index 0830c08704..cb9d4a81fe 100644 --- a/tests/test_nonnest2_hourly_review_caller.py +++ b/tests/test_nonnest2_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/nonnest2-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/nonnest2-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -163,4 +163,4 @@ def test_focused_quality_workflow_tracks_nonnest2_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths + assert doctoring not in compileall_paths \ No newline at end of file From 969005b26bcb839a2940bef1f5dd20ddacd0c10e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:04:59 +0900 Subject: [PATCH 12/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_contextual_orchestrator_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_contextual_orchestrator_hourly_review_caller.py b/tests/test_contextual_orchestrator_hourly_review_caller.py index 204ed52887..8b942a28f3 100644 --- a/tests/test_contextual_orchestrator_hourly_review_caller.py +++ b/tests/test_contextual_orchestrator_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/contextual-orchestrator-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/contextual-orchestrator-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -85,4 +85,4 @@ def test_focused_quality_workflow_tracks_contextual_orchestrator_contracts() -> ) == 2 assert quality.count( "tests/test_contextual_orchestrator_hourly_review_caller.py" - ) == 3 + ) == 3 \ No newline at end of file From 4a6322ab53f94cfcf4f5f5c7db1a756734c92b7e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:05:19 +0900 Subject: [PATCH 13/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_governance_risk_compliance_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_governance_risk_compliance_hourly_review_caller.py b/tests/test_governance_risk_compliance_hourly_review_caller.py index 4b0fb4f93e..507bb7bdd9 100644 --- a/tests/test_governance_risk_compliance_hourly_review_caller.py +++ b/tests/test_governance_risk_compliance_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/governance-risk-compliance-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/governance-risk-compliance-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") def _read(path: Path) -> str: @@ -81,4 +81,4 @@ def test_focused_quality_workflow_tracks_grc_contracts() -> None: assert quality.count( "docs/doctoring/governance-risk-compliance-hourly-review-caller.md" ) == 2 - assert quality.count("tests/test_governance_risk_compliance_hourly_review_caller.py") == 3 + assert quality.count("tests/test_governance_risk_compliance_hourly_review_caller.py") == 3 \ No newline at end of file From 0d51d8de89b3efc6f7103d211a0986ba251275a8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:05:47 +0900 Subject: [PATCH 14/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_originweave_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_originweave_hourly_review_caller.py b/tests/test_originweave_hourly_review_caller.py index 11b3353786..c9854c4047 100644 --- a/tests/test_originweave_hourly_review_caller.py +++ b/tests/test_originweave_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/originweave-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/originweave-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -163,4 +163,4 @@ def test_focused_quality_workflow_tracks_originweave_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths + assert doctoring not in compileall_paths \ No newline at end of file From 704493f104f37a3150f3b1de49f743266a7a5093 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:06:19 +0900 Subject: [PATCH 15/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_quarantine_sandbox_hourly_review_caller.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_quarantine_sandbox_hourly_review_caller.py b/tests/test_quarantine_sandbox_hourly_review_caller.py index 1755bb5e77..97c651b345 100644 --- a/tests/test_quarantine_sandbox_hourly_review_caller.py +++ b/tests/test_quarantine_sandbox_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/quarantine-sandbox-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/quarantine-sandbox-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -176,4 +176,4 @@ def test_focused_quality_workflow_tracks_sandbox_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths + assert doctoring not in compileall_paths \ No newline at end of file From 9eb0e53d7da5188776d054a800aa608ce9ef454a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:06:47 +0900 Subject: [PATCH 16/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_hourly_autofix_context_quality_gate.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_hourly_autofix_context_quality_gate.py b/tests/test_hourly_autofix_context_quality_gate.py index 4d3f06a8d6..fd16fcca94 100644 --- a/tests/test_hourly_autofix_context_quality_gate.py +++ b/tests/test_hourly_autofix_context_quality_gate.py @@ -12,7 +12,7 @@ from scripts.ci import pr_review_autofix_context as context -WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") def test_context_helper_is_part_of_the_focused_exact_head_quality_gate() -> None: @@ -202,4 +202,4 @@ def fake_run(argv, **_kwargs): ) assert exit_info.value.code == 0 - assert output.is_file() + assert output.is_file() \ No newline at end of file From 1fc5fa35232126a6ab25b9e03f62464fdc024023 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:07:12 +0900 Subject: [PATCH 17/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_pr_review_conflict_scope_control_files.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tests/test_pr_review_conflict_scope_control_files.py b/tests/test_pr_review_conflict_scope_control_files.py index 3fd7f8e81d..2b657e5599 100644 --- a/tests/test_pr_review_conflict_scope_control_files.py +++ b/tests/test_pr_review_conflict_scope_control_files.py @@ -18,7 +18,10 @@ REPOSITORY_ROOT = Path(__file__).resolve().parents[1] QUALITY_WORKFLOW = ( - REPOSITORY_ROOT / ".github" / "workflows" / "hourly-nvidia-nim-review-repair.yml" + REPOSITORY_ROOT + / ".github" + / "workflows" + / "contextual-orchestrator-review-repair-quality.yml" ) CONTRACT_PATH = "tests/test_pr_review_conflict_scope_control_files.py" DOCTORING_PATH = "docs/doctoring/conflict-control-evidence-isolation.md" @@ -111,4 +114,4 @@ def test_control_evidence_contract_cannot_bypass_its_quality_workflow() -> None: assert trigger_block.count(CONTRACT_PATH) == 2 assert trigger_block.count(DOCTORING_PATH) == 2 - assert CONTRACT_PATH in workflow[workflow.index("python -m compileall -q") :] + assert CONTRACT_PATH in workflow[workflow.index("python -m compileall -q") :] \ No newline at end of file From 9051a3d43981424827a0ab5d779eda18cbd3a4f6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:07:56 +0900 Subject: [PATCH 18/29] test(review): follow contextual-orchestrator quality workflow --- tests/test_pr_review_fix_hourly_contract.py | 42 ++------------------- 1 file changed, 4 insertions(+), 38 deletions(-) diff --git a/tests/test_pr_review_fix_hourly_contract.py b/tests/test_pr_review_fix_hourly_contract.py index a31562550c..6e87bd2778 100644 --- a/tests/test_pr_review_fix_hourly_contract.py +++ b/tests/test_pr_review_fix_hourly_contract.py @@ -14,7 +14,9 @@ _REUSABLE_WORKFLOW = Path(".github/workflows/pr-review-fix-scheduler.yml") _AUTOFIX_WORKFLOW = Path(".github/workflows/pr-review-autofix.yml") _CLEARFOLIO_CALLER = Path(".github/workflows/clearfolio-hourly-review-repair.yml") -_CONTRACT_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +_CONTRACT_WORKFLOW = Path( + ".github/workflows/contextual-orchestrator-review-repair-quality.yml" +) _AUTOMATION_GUIDE = Path("docs/automation/hourly-review-repair.md") @@ -315,40 +317,4 @@ def test_external_review_wait_is_not_invented_into_a_code_repair() -> None: assert scheduler.needs_rca_repair(_current_head_change_request(body)) == ( False, (), - ) - - -def test_rca_dispatch_carries_an_explicit_worker_mode(monkeypatch) -> None: - """The exact-head dispatch distinguishes failed-check RCA from ordinary review repair.""" - captured: dict[str, str | None] = {} - - def fake_run(args: list[str], *, stdin: str | None = None) -> str: - captured["stdin"] = stdin - return "" - - monkeypatch.setattr(scheduler, "run", fake_run) - monkeypatch.setattr(scheduler, "live_head_matches", lambda _repo, _pr: True) - pr = _current_head_change_request("Failed check evidence reports Strix failed.") - - scheduler.dispatch_autofix( - "owner/repo", - pr, - workflow="pr-review-autofix.yml", - workflow_repository="ContextualWisdomLab/.github", - dry_run=False, - repair_mode="rca", - ) - - payload = json.loads(captured["stdin"] or "{}") - assert payload["client_payload"]["repair_mode"] == "rca" - - -def test_rca_worker_collects_failed_check_evidence_before_editing() -> None: - """RCA mode receives redacted logs and a separately sealed edit scope.""" - workflow = _read(_AUTOFIX_WORKFLOW) - - assert "REPAIR_MODE" in workflow - assert "collect_failed_check_evidence.sh" in workflow - assert "pr-review-autofix-failed-check-evidence.md" in workflow - assert "--repair-mode \"$REPAIR_MODE\"" in workflow - assert "--failed-check-evidence" in workflow + ) \ No newline at end of file From 112b3facd0345045b26484faaf650155f9b4c06f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:09:43 +0900 Subject: [PATCH 19/29] docs(review): record quality-workflow identity RCA --- ...review-repair-quality-workflow-identity.md | 69 +++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 docs/doctoring/review-repair-quality-workflow-identity.md diff --git a/docs/doctoring/review-repair-quality-workflow-identity.md b/docs/doctoring/review-repair-quality-workflow-identity.md new file mode 100644 index 0000000000..e8efe913b8 --- /dev/null +++ b/docs/doctoring/review-repair-quality-workflow-identity.md @@ -0,0 +1,69 @@ +# Review-repair quality workflow identity RCA + +## Status + +Recorded 2026-09-01 against protected `ContextualWisdomLab/.github` `main@b4f7b082536d2be8dceab0a40a484161b50e5acd` and repair PR #1573. + +## Incident + +The central workflow `.github/workflows/hourly-nvidia-nim-review-repair.yml` was named **Hourly NVIDIA NIM Review Repair**, but the executable source contradicted both halves of that identity: + +- it had no `schedule` trigger and therefore did not own an hourly writer cadence; +- it had read-only `contents: read` permission and executed only repository contract tests, coverage, docstring checks, `compileall`, and `git diff --check`; +- it did not invoke OpenCode or any model provider; +- the write-capable repair boundary already lived in `.github/workflows/pr-review-autofix.yml` and routed OpenCode through the vendored contextual-orchestrator sidecar with the virtual model `contextual-orchestrator/orchestrator/free`. + +The stale identity survived the earlier direct-NIM-to-gateway migration because executable worker routing and the focused quality gate evolved independently. Draft PR #1527 corrected prose only and explicitly left workflow behavior and identity unchanged, so it could not close this control-plane naming/responsibility gap. + +## Root cause + +The repository conflated three separate responsibilities under one historical label: + +1. **Cadence ownership** — thin product-specific `*-hourly-review-repair.yml` callers own schedules. +2. **Repair execution** — `pr-review-fix-scheduler.yml` selects bounded work and `pr-review-autofix.yml` owns the write-capable exact-head repair worker. +3. **Contract verification** — the former `hourly-nvidia-nim-review-repair.yml` is a PR/push-only read-only quality gate. + +When direct NVIDIA NIM execution was retired in favor of ADR-0003's contextual-orchestrator gateway, responsibility (2) was migrated but responsibility (3)'s filename, display name, job name, and dependent test paths were not. The result was executable metadata that suggested a scheduled direct-provider writer where none existed. + +## Repair + +PR #1573 renames the quality gate to `.github/workflows/contextual-orchestrator-review-repair-quality.yml` with display name **Contextual Orchestrator Review Repair Quality CI**. It remains PR/push-only and read-only. No second scheduler is added. + +All executable test references move to the new path. The underlying writer remains unchanged: + +```text +hourly product caller + -> pr-review-fix-scheduler.yml + -> repository_dispatch: pr-review-autofix + -> pr-review-autofix.yml + -> contextual-orchestrator sidecar + -> contextual-orchestrator/orchestrator/free +``` + +The sidecar continues to register the existing five provider credentials (`BYTEZ_API_KEY`, `NVIDIA_NIM_API_KEY`, `NVIDIA_NIM_API_KEY_SUB`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`) into its process-local provider registry. Provider keys are not promoted to workflow identity and no direct-provider fallback is introduced. + +## TDD evidence + +The first PR commit, `6279b0c8fe7f41f2ec61be728da41d9c2c599e84`, changed `tests/test_hourly_scheduler_runtime_budget.py` before the implementation. It required the new quality-workflow path and rejected the legacy path/name. On that exact tree the required new file did not exist, so the contract was deterministically RED; GitHub materialized predecessor run `33489785044` from the legacy workflow while the fleet was queued. + +The GREEN implementation then created the new workflow, deleted the legacy workflow, and migrated every executable `QUALITY_WORKFLOW`/contract reference. Exact-head hosted run `33490614440` materialized under the new workflow name, proving GitHub recognizes the replacement workflow identity. Terminal test evidence remains authoritative only after the unchanged exact head finishes. + +## Security and governance boundary + +- No secret, reviewer identity, merge authority, branch-protection rule, or status is changed. +- No direct NVIDIA NIM HTTP endpoint or hard-coded provider model is introduced. +- The quality workflow remains `contents: read` only. +- The write-capable worker remains exact-head-bound and governed by its existing sealed path, revalidation, credential stripping, and protected push contracts. +- Queued, pending, skipped, cancelled, predecessor-head, or stale evidence is not treated as passing. + +## Rollback + +Rollback is a normal revert of the workflow rename and dependent path references only after proving that doing so does not reintroduce misleading provider/cadence ownership. Do not restore a direct-NIM execution path, add a duplicate hourly schedule, or weaken the contextual-orchestrator fail-closed contract as part of rollback. + +## References + +ContextualWisdomLab. (2026). *ADR-0003: Contextual-orchestrator vendored free/ZDR review routing*. `docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md`. + +GitHub. (n.d.). *Workflow syntax for GitHub Actions*. GitHub Docs. https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions + +GitHub. (n.d.). *Events that trigger workflows*. GitHub Docs. https://docs.github.com/actions/using-workflows/events-that-trigger-workflows From 33926bf07a8f9658f663755ffcd99dc94bbd7512 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:11:41 +0900 Subject: [PATCH 20/29] docs(review): align gateway architecture with current worker --- ARCHITECTURE.md | 22 ++-- docs/automation/hourly-review-repair.md | 30 +++-- docs/doctoring/hourly-nvidia-nim-autofix.md | 116 ++++++++++++-------- 3 files changed, 99 insertions(+), 69 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 885d2d0eac..1af9c3d026 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -48,7 +48,7 @@ only established scheduler credentials, and grants job-scoped only established scheduler credentials, and grants job-scoped `id-token: write`. The reusable engine stays product-neutral. -## Hourly NVIDIA NIM repair gate +## Hourly contextual-orchestrator repair gate ```mermaid flowchart TD @@ -56,7 +56,7 @@ flowchart TD Sched["Central reusable scheduler"] Bind{"Exact-head, same-repo, writer authority, sealed paths?"} Worker["repository_dispatch worker at github.sha"] - NIM["NVIDIA NIM repair model"] + Gateway["contextual-orchestrator sidecar: orchestrator/free"] Recheck{"Post-edit exact-head revalidation?"} Push["Push same-repository head"] Hold["Leave the tree unchanged"] @@ -65,15 +65,17 @@ flowchart TD Sched --> Bind Bind -->|"no"| Hold Bind -->|"yes"| Worker - Worker --> NIM - NIM --> Recheck + Worker --> Gateway + Gateway --> Recheck Recheck -->|"no"| Hold Recheck -->|"yes"| Push ``` The worker checks out helpers at `${{ github.sha }}` so a later default-branch -push cannot replace privileged scripts after dispatch (CWE-367). Repair binds -`NVIDIA_NIM_API_KEY`, never `COPILOT_GITHUB_TOKEN`. +push cannot replace privileged scripts after dispatch (CWE-367). Repair provisions the vendored +contextual-orchestrator gateway sidecar (ADR-0003), which auto-discovers upstream models from five +KV-registered provider secrets including `NVIDIA_NIM_API_KEY`; it never binds one provider +directly, and never uses `COPILOT_GITHUB_TOKEN`. Product callers stagger Clearfolio at minute 23, DiskSage at minute 37, and fast-mlsirm at minute 49. Each caller is read-only, dispatches at most one @@ -109,7 +111,7 @@ sequenceDiagram participant MS as Merge scheduler PR->>RW: pull_request_target on trusted base - RW->>OC: bounded evidence + NVIDIA NIM / OpenCode + RW->>OC: bounded evidence + contextual-orchestrator/orchestrator/free / OpenCode OC->>SV: PoC command in isolated copy SV-->>OC: redacted stdout/stderr + command metadata OC-->>PR: APPROVE or request changes @@ -135,8 +137,10 @@ sequenceDiagram - Logs and review receipts redact credential shapes (tokens, bearer values, known provider prefixes). They do not mask operational PII that the control plane must process. -- LLM and scheduled agents bind `NVIDIA_NIM_API_KEY` (env may be - `NVIDIA_API_KEY`). They never use `COPILOT_GITHUB_TOKEN`. Existing +- LLM and scheduled agents route through the vendored contextual-orchestrator gateway + (`contextual-orchestrator/orchestrator/free`), which auto-discovers upstream models from five + KV-registered provider secrets (Bytez, `NVIDIA_NIM_API_KEY` ×2, OpenRouter, OpenAI) rather than + binding any one of them directly. They never use `COPILOT_GITHUB_TOKEN`. Existing review-agent key schemes stay unchanged. - Rust remains the psychometric arithmetic owner. Repair never substitutes Python for scoring math. diff --git a/docs/automation/hourly-review-repair.md b/docs/automation/hourly-review-repair.md index 7227249584..239ad430b1 100644 --- a/docs/automation/hourly-review-repair.md +++ b/docs/automation/hourly-review-repair.md @@ -12,13 +12,15 @@ engine**. contextual-orchestrator, Inkspan, or another CWL service with an explicit repository and base branch. - `pr-review-autofix.yml` is the bounded write-capable worker. It uses OpenCode - with NVIDIA NIM and does not approve or merge pull requests. + routed through the vendored contextual-orchestrator gateway and does not approve or merge pull + requests. -Orgmetra's caller remains provider-neutral. The intended model boundary is the -contextual-orchestrator gateway: provider keys stay in its KV registry and -automatic model discovery selects upstream models. A caller schedule is not -evidence that gateway credentials, discovery, or a live OpenCode tool loop are -available; those facts require exact worker-run evidence. +Every product caller, Orgmetra included, is provider-neutral by construction: the worker's model +boundary is the contextual-orchestrator gateway (ADR-0003). Provider keys (Bytez, NVIDIA NIM ×2, +OpenRouter, OpenAI) stay in the sidecar's process-local KV and automatic model discovery selects +upstream models behind the fail-closed `contextual-orchestrator/orchestrator/free` virtual model +id. A caller schedule is not evidence that gateway credentials, discovery, or a live OpenCode tool +loop are available; those facts require exact worker-run evidence. Merge eligibility remains owned by the separate merge scheduler, branch protection, required checks, independent review, and unresolved-thread policy. @@ -43,9 +45,10 @@ The scheduled heartbeat is `23 * * * *`. Repository-scoped concurrency and not overlap its successor. At most one repair dispatch is created per run. The caller passes only the established `PR_REVIEW_MERGE_TOKEN` and -`OPENCODE_APPROVE_TOKEN` scheduler credentials. It does not receive or forward -`NVIDIA_NIM_API_KEY`; the model credential is scoped exclusively to the two -OpenCode execution steps in the separately reviewed autofix worker. +`OPENCODE_APPROVE_TOKEN` scheduler credentials. It does not receive or forward any of the five +gateway provider secrets; those are scoped exclusively to the sidecar-provisioning step in the +separately reviewed autofix worker (see +[`docs/doctoring/hourly-nvidia-nim-autofix.md`](../doctoring/hourly-nvidia-nim-autofix.md)). ## Orgmetra execution contract @@ -199,7 +202,9 @@ organization-level queue inspection and bounded repair dispatch. When a scheduled run fails, classify the result before rerunning: - no actionable file-scoped feedback: expected no-op; -- missing `NVIDIA_NIM_API_KEY`: central secret configuration failure; +- missing any of the five gateway provider secrets (including `NVIDIA_NIM_API_KEY`) or the + sidecar's `CONTEXTUAL_ORCHESTRATOR_BASE_URL`/`CONTEXTUAL_ORCHESTRATOR_TOKEN_FILE`: central + secret configuration failure; - head changed: safe optimistic-concurrency refusal; inspect the new head rather than retrying predecessor evidence; - out-of-scope or ignored-path change: treat as a security failure and preserve @@ -225,8 +230,9 @@ Permanent tests prove: - the dispatch budget and same-head retry floor remain one; - caller and reusable-workflow secrets are explicit and never use `secrets: inherit`; -- immutable source, NVIDIA-only model authentication, child-process credential - stripping, live-head guards, and independent reviewer identity remain intact; +- immutable source, gateway-only model authentication (never a directly bound provider key), + child-process credential stripping, live-head guards, and independent reviewer identity remain + intact; - ordinary and conflict repair share the complete ignored-inclusive snapshot and NUL-delimited allowlist boundary; - the RCA and remediation-feasibility gate prevents speculative or diff --git a/docs/doctoring/hourly-nvidia-nim-autofix.md b/docs/doctoring/hourly-nvidia-nim-autofix.md index 6b05c6bd60..2fdbaa2b68 100644 --- a/docs/doctoring/hourly-nvidia-nim-autofix.md +++ b/docs/doctoring/hourly-nvidia-nim-autofix.md @@ -1,12 +1,32 @@ # Hourly NVIDIA NIM Review-Autofix Boundary +## Status (2026-08-31 correction) + +This record's original "Provider contract" and "Credential boundary" sections described the +write-capable autofix worker binding NVIDIA NIM directly (`NVIDIA_API_KEY: ${{ +secrets.NVIDIA_NIM_API_KEY }}`, hard-coded model `mistralai/mistral-small-4-119b-2603`). That +architecture is superseded: per +[ADR-0003](../adr/0003-contextual-orchestrator-vendored-free-zdr.md) (accepted 2026-08-27, amended +2026-08-30) and the org's 2026-08-18 gateway decision, the worker now provisions the vendored +`contextual-orchestrator` review sidecar +(`scripts/ci/contextual_orchestrator_review_sidecar.sh`) and routes through the fail-closed +zero-cost virtual model id `contextual-orchestrator/orchestrator/free`, which auto-discovers +upstream models across all five KV-registered provider credentials rather than binding any one of +them directly. `NVIDIA_NIM_API_KEY` (and its `_SUB` sibling) is now one of five provider secrets +feeding that discovery, not a dedicated per-step model binding. The two sections below are +corrected to match the current `.github/workflows/pr-review-autofix.yml`, pinned by +`tests/test_pr_review_autofix_nvidia_nim_contract.py::test_scheduled_autofix_routes_through_contextual_orchestrator`. +Every other section of this record — write-scope snapshotting, the sealed allowlist, `.git` +denial, hook suppression, and the explicit push destination — is a provider-independent control +and remains current. + ## Decision Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include; a lone `--require-hashes` line is not lock evidence. -The write-capable scheduled pull-request autofix agent uses OpenCode with the -NVIDIA NIM API and the organization Actions secret `NVIDIA_NIM_API_KEY`. The -independent read-only review agent remains unchanged and continues to use its +The write-capable scheduled pull-request autofix agent uses OpenCode, routed through the vendored +`contextual-orchestrator` gateway (see "Status" above), rather than a directly bound provider +credential. The independent read-only review agent remains unchanged and continues to use its existing credential and model-pool contract. This separation is intentional. Review and repair have different privileges: @@ -60,21 +80,22 @@ open state, same-repository branch, base ref and SHA, and head ref and SHA. ## Provider contract -The pinned OpenCode runtime enables only `nvidia-nim` through the -OpenAI-compatible adapter and NVIDIA hosted endpoint: +The pinned OpenCode runtime enables only `contextual-orchestrator` through the +OpenAI-compatible adapter, pointed at the vendored sidecar's loopback gateway: ```text -https://integrate.api.nvidia.com/v1 +{env:CONTEXTUAL_ORCHESTRATOR_BASE_URL} ``` -The primary repair model is `mistralai/mistral-small-4-119b-2603`. The -`ci-autofix` agent and its model configuration both request high reasoning -through OpenCode's provider-option contract (`reasoningEffort: "high"`). NVIDIA's -Mistral Small 4 NIM API documents the corresponding request behavior as -`reasoning_effort: "high"`, which enables the model's reasoning mode. The small -model used for bounded helper work remains `nvidia/nemotron-3-nano-30b-a3b` and -is not a fallback provider. GitHub Models configuration, identifiers, base URLs, -and model-auth fallbacks are absent from the scheduled autofix execution path. +Both `model` and `small_model` request the fail-closed zero-cost virtual model id +`contextual-orchestrator/orchestrator/free`. The `ci-autofix` agent and its model configuration +both request high reasoning through OpenCode's provider-option contract +(`reasoningEffort: "high"`). The sidecar's own `discover_all_models()` auto-discovers upstream +models across all five KV-registered provider credentials (Bytez, NVIDIA NIM ×2, OpenRouter, +OpenAI) and ranks them free-first, cost-evidence-ranked, ZDR-prioritized (ADR-0003); the worker +never pins one hard-coded upstream model id directly, so no single upstream provider's outage can +take down scheduled repair. GitHub Models configuration, identifiers, base URLs, and model-auth +fallbacks remain absent from the scheduled autofix execution path. The high-reasoning setting is deliberate for write-capable review repair. This workflow optimizes correctness, evidence quality, and controllability rather than @@ -84,17 +105,23 @@ writer role and remains subject to exact-head regression evidence. ## Credential boundary -The organization secret is bound as: +The five organization provider secrets are bound only in the sidecar-provisioning step: ```yaml -NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }} +BYTEZ_API_KEY: ${{ secrets.BYTEZ_API_KEY }} +NVIDIA_NIM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }} +NVIDIA_NIM_API_KEY_SUB: ${{ secrets.NVIDIA_NIM_API_KEY_SUB }} +OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} +OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} ``` -It is present only on the two steps that execute OpenCode: ordinary -review-feedback repair and merge-conflict repair. Metadata collection, -checkout, context preparation, validation, commit, and push do not receive the -NVIDIA credential. A missing key is a fatal configuration error rather than a -signal to choose another provider. +None of the five appear anywhere in the workflow after that step. The sidecar registers them into +its own process-local KV and exposes only a loopback gateway URL and a short-lived bearer token +(`CONTEXTUAL_ORCHESTRATOR_BASE_URL`, `CONTEXTUAL_ORCHESTRATOR_TOKEN_FILE`) to the two steps that +execute OpenCode: ordinary review-feedback repair and merge-conflict repair. Metadata collection, +checkout, context preparation, validation, commit, and push do not receive any of the five provider +secrets or the gateway token. A missing gateway environment variable is a fatal configuration error +rather than a signal to choose another provider. The ordinary model execution step does not bind a GitHub write token. Its later commit-and-push step may mutate only with `PR_REVIEW_MERGE_TOKEN`, @@ -113,11 +140,11 @@ env -u GITHUB_TOKEN -u GH_TOKEN \ -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL ``` -The child receives the NVIDIA model credential and non-secret execution -controls, but cannot call GitHub APIs or mint an Actions OIDC token. GitHub -credentials remain available only to reviewed shell logic before or after the -child process. The key is never written to repository files, generated prompts, -command arguments, or ordinary logs. +The child receives the gateway URL/token and non-secret execution controls, but cannot call GitHub +APIs or mint an Actions OIDC token, and never receives any of the five upstream provider secrets +directly. GitHub credentials remain available only to reviewed shell logic before or after the +child process. No provider key is ever written to repository files, generated prompts, command +arguments, or ordinary logs. ## OpenCode repair sandbox @@ -276,9 +303,11 @@ quality, security, review, and protection gate again. Automated tests prove: 1. the caller retains its approved one-hour cadence; -2. OpenCode enables only NVIDIA NIM, uses the exact Mistral Small 4 writer with - high reasoning, and receives the model key only in its two execution steps; -3. missing model credentials fail closed and model children receive no GitHub or +2. OpenCode enables only `contextual-orchestrator`, routes through the + `contextual-orchestrator/orchestrator/free` virtual model id with high reasoning, and the + sidecar's five provider secrets never appear outside the sidecar-provisioning step (see + "Status" above); +3. missing gateway configuration fails closed and model children receive no GitHub or OIDC write credential; 4. mutation-capable ordinary and conflict paths accept only established explicit secrets or the exchanged OpenCode app token, never `github.token`, and fail @@ -303,7 +332,7 @@ Automated tests prove: ## Scheduling and activation -The NVIDIA worker does not create a second repair scheduler. It is consumed by +The gateway-routed worker does not create a second repair scheduler. It is consumed by the hourly central review-fix scheduler and product caller. Scheduled workflows run only from the protected default branch, so feature-branch checks do not make the heartbeat active. Activation requires protected integration and accepted-main @@ -311,18 +340,20 @@ verification. ## Rollback -Rollback must revert the NVIDIA transport, ordinary and conflict repair scope -contracts, review-derived control-plane path exclusion, `.git` denial, ignored-path -inventory, hook suppression, explicit push destination, tests, operator guidance, +Rollback must revert the gateway transport (`contextual_orchestrator_review_sidecar.sh` +provisioning and the `contextual-orchestrator/orchestrator/free` model binding), ordinary and +conflict repair scope contracts, review-derived control-plane path exclusion, `.git` denial, +ignored-path inventory, hook suppression, explicit push destination, tests, operator guidance, doctoring, and changelog as one reviewed change. A partial rollback that restores review-thread authority over `.github/` or `scripts/ci/`, ordinary diff-only validation, model-mutable Git metadata, repository hooks, GitHub-token model authentication, or a mutable helper checkout is unsafe. -If NVIDIA NIM is unavailable, scheduled repair must fail closed while read-only -review, required checks, manual maintenance, and protected merge policy remain -available. Rollback is not permission to bypass independent approval or release -gates. +If the contextual-orchestrator gateway sidecar cannot be provisioned (missing +`CONTEXTUAL_ORCHESTRATOR_BASE_URL`/`CONTEXTUAL_ORCHESTRATOR_TOKEN_FILE`, or discovery finds zero +eligible free-tier routes across all five provider credentials), scheduled repair must fail closed +while read-only review, required checks, manual maintenance, and protected merge policy remain +available. Rollback is not permission to bypass independent approval or release gates. ## References @@ -342,17 +373,6 @@ https://docs.github.com/en/enterprise-cloud@latest/actions/reference/workflows-a GitHub, Inc. (n.d.-b). *Secrets reference*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/actions/reference/security/secrets -NVIDIA Corporation. (n.d.-a). *LLM APIs*. NVIDIA API Catalog. Retrieved August -7, 2026, from https://docs.api.nvidia.com/nim/reference/llm-apis - -NVIDIA Corporation. (2026). *Query the Mistral-Small-4-119B-2603 API*. NVIDIA -NIM for Vision Language Models. Retrieved August 8, 2026, from -https://docs.nvidia.com/nim/vision-language-models/1.7.0/examples/mistral-small-4-119b-2603/api.html - -NVIDIA Corporation. (n.d.-c). *NVIDIA / nemotron-3-nano-30b-a3b*. NVIDIA API -Catalog. Retrieved August 7, 2026, from -https://docs.api.nvidia.com/nim/re/reference/nvidia-nemotron-3-nano-30b-a3b - OpenCode. (2026a). *Permissions*. https://opencode.ai/docs/permissions OpenCode. (2026b, July 28). *Providers*. https://opencode.ai/docs/providers From cd063bb0cf9c223bd9f6bd1a3f831f0b9e69599f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:13:17 +0900 Subject: [PATCH 21/29] ci(review): track repair identity evidence documents --- .../contextual-orchestrator-review-repair-quality.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/contextual-orchestrator-review-repair-quality.yml b/.github/workflows/contextual-orchestrator-review-repair-quality.yml index 2cad4b9760..fc09887103 100644 --- a/.github/workflows/contextual-orchestrator-review-repair-quality.yml +++ b/.github/workflows/contextual-orchestrator-review-repair-quality.yml @@ -36,6 +36,9 @@ on: - tests/test_contextual_orchestrator_review_sidecar_contract.py - docs/doctoring/contextual-orchestrator-vendored-sidecar.md - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md + - docs/doctoring/review-repair-quality-workflow-identity.md + - docs/product-technical-gap-baseline.md + - CHANGELOG.md - tests/test_bandscope_hourly_review_caller.py - tests/test_disksage_hourly_review_caller.py - tests/test_inkspan_hourly_review_caller.py @@ -110,6 +113,9 @@ on: - tests/test_contextual_orchestrator_review_sidecar_contract.py - docs/doctoring/contextual-orchestrator-vendored-sidecar.md - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md + - docs/doctoring/review-repair-quality-workflow-identity.md + - docs/product-technical-gap-baseline.md + - CHANGELOG.md - tests/test_bandscope_hourly_review_caller.py - tests/test_disksage_hourly_review_caller.py - tests/test_inkspan_hourly_review_caller.py @@ -236,4 +242,4 @@ jobs: tests/test_pr_review_autofix_context_head_binding.py \ tests/test_pr_review_autofix_nvidia_nim_contract.py \ tests/test_pr_review_autofix_writer_security_contract.py - git diff --check + git diff --check \ No newline at end of file From 6774ed0b09e7aa86ee9897bb7d7f19278b0859b3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:18:24 +0900 Subject: [PATCH 22/29] test(review): drain fake dispatch stdin --- tests/test_opencode_required_verdict_regression.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/test_opencode_required_verdict_regression.py b/tests/test_opencode_required_verdict_regression.py index 8f8047ff10..0e5d30805b 100644 --- a/tests/test_opencode_required_verdict_regression.py +++ b/tests/test_opencode_required_verdict_regression.py @@ -173,6 +173,7 @@ def test_scheduler_wake_reuses_trusted_receipt_predicate( elif [[ "$*" == *"/pulls/7/reviews"* ]]; then printf '[%s]' "$FAKE_REVIEWS" elif [[ "$*" == *"repos/ContextualWisdomLab/.github/dispatches"* ]]; then + cat >/dev/null printf 'dispatch\n' >>"$DISPATCH_CALLS" fi """, From 50bcca89fe20888232f8670f168358d48a323418 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:23:40 +0900 Subject: [PATCH 23/29] fix(ci): preserve review-repair workflow identity --- .../hourly-nvidia-nim-review-repair.yml | 250 ++++++++++++++++++ 1 file changed, 250 insertions(+) create mode 100644 .github/workflows/hourly-nvidia-nim-review-repair.yml diff --git a/.github/workflows/hourly-nvidia-nim-review-repair.yml b/.github/workflows/hourly-nvidia-nim-review-repair.yml new file mode 100644 index 0000000000..5cd0b096f6 --- /dev/null +++ b/.github/workflows/hourly-nvidia-nim-review-repair.yml @@ -0,0 +1,250 @@ +name: Contextual Orchestrator Review Repair Quality CI + +# Compatibility boundary: keep this historical file path so the existing GitHub +# Actions workflow registry identity is updated in place instead of leaving an +# orphaned enabled workflow ID. The display name and executable responsibility +# are authoritative: this is a read-only PR/push quality gate, not an hourly +# writer and not a direct NVIDIA NIM executor. +# +# Hourly execution is owned by the thin product callers and the reusable +# scheduler; write-capable repair is owned by pr-review-autofix.yml, whose model +# execution is routed through contextual-orchestrator/orchestrator/free. +on: + pull_request: + paths: + - .github/workflows/pr-review-fix-scheduler.yml + - scripts/ci/pr_review_fix_scheduler.py + - .github/workflows/pr-review-autofix.yml + - .github/workflows/bandscope-hourly-review-repair.yml + - .github/workflows/contextual-orchestrator-hourly-review-repair.yml + - .github/workflows/clearfolio-hourly-review-repair.yml + - .github/workflows/disksage-hourly-review-repair.yml + - .github/workflows/inkspan-hourly-review-repair.yml + - .github/workflows/lineageweave-hourly-review-repair.yml + - .github/workflows/fast-mlsirm-hourly-review-repair.yml + - .github/workflows/github-hourly-review-repair.yml + - .github/workflows/governance-risk-compliance-hourly-review-repair.yml + - .github/workflows/hourly-nvidia-nim-review-repair.yml + - .github/workflows/nonnest2-hourly-review-repair.yml + - .github/workflows/orgmetra-hourly-review-repair.yml + - .github/workflows/originweave-hourly-review-repair.yml + - .github/workflows/quarantine-sandbox-hourly-review-repair.yml + - .github/workflows/afipc-hourly-review-repair.yml + - scripts/ci/pr_review_conflict_scope.py + - scripts/ci/pr_review_autofix_context.py + - scripts/ci/zdr_policy.py + - scripts/ci/contextual_orchestrator_review_policy.py + - scripts/ci/contextual_orchestrator_review_launcher.py + - scripts/ci/contextual_orchestrator_review_sidecar.sh + - tests/test_zdr_policy.py + - tests/test_contextual_orchestrator_review_policy.py + - tests/test_contextual_orchestrator_review_sidecar_contract.py + - docs/doctoring/contextual-orchestrator-vendored-sidecar.md + - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md + - docs/doctoring/review-repair-quality-workflow-identity.md + - docs/product-technical-gap-baseline.md + - CHANGELOG.md + - tests/test_bandscope_hourly_review_caller.py + - tests/test_disksage_hourly_review_caller.py + - tests/test_inkspan_hourly_review_caller.py + - tests/test_lineageweave_hourly_review_caller.py + - tests/test_fast_mlsirm_hourly_review_caller.py + - tests/test_github_hourly_conflict_repair.py + - tests/test_governance_risk_compliance_hourly_review_caller.py + - tests/test_hourly_scheduler_runtime_budget.py + - tests/test_nonnest2_hourly_review_caller.py + - tests/test_orgmetra_hourly_review_caller.py + - tests/test_originweave_hourly_review_caller.py + - tests/test_quarantine_sandbox_hourly_review_caller.py + - tests/test_contextual_orchestrator_hourly_review_caller.py + - tests/test_afipc_hourly_review_caller.py + - tests/test_hourly_autofix_context_quality_gate.py + - tests/test_pr_review_conflict_scope.py + - tests/test_pr_review_conflict_scope_control_files.py + - tests/test_pr_review_conflict_scope_git_executable.py + - tests/test_pr_review_conflict_scope_ignored_paths.py + - tests/test_pr_review_conflict_scope_symlink_targets.py + - tests/test_pr_review_fix_hourly_contract.py + - tests/test_pr_review_fix_scheduler.py + - tests/test_pr_review_fix_scheduler_source_pin.py + - tests/test_pr_review_autofix_context_head_binding.py + - tests/test_pr_review_autofix_nvidia_nim_contract.py + - tests/test_pr_review_autofix_writer_security_contract.py + - docs/automation/hourly-review-repair.md + - docs/doctoring/bandscope-hourly-review-caller.md + - docs/doctoring/clearfolio-hourly-review-caller.md + - docs/doctoring/conflict-control-evidence-isolation.md + - docs/doctoring/disksage-hourly-review-caller.md + - docs/doctoring/inkspan-hourly-review-caller.md + - docs/doctoring/lineageweave-hourly-review-caller.md + - docs/doctoring/fast-mlsirm-hourly-review-caller.md + - docs/doctoring/github-hourly-conflict-repair.md + - docs/doctoring/governance-risk-compliance-hourly-review-caller.md + - docs/doctoring/hourly-nvidia-nim-autofix.md + - docs/doctoring/nonnest2-hourly-review-caller.md + - docs/doctoring/orgmetra-hourly-review-caller.md + - docs/doctoring/originweave-hourly-review-caller.md + - docs/doctoring/quarantine-sandbox-hourly-review-caller.md + - docs/doctoring/contextual-orchestrator-hourly-review-caller.md + - docs/doctoring/afipc-hourly-review-caller.md + push: + paths: + - .github/workflows/pr-review-fix-scheduler.yml + - scripts/ci/pr_review_fix_scheduler.py + - .github/workflows/pr-review-autofix.yml + - .github/workflows/bandscope-hourly-review-repair.yml + - .github/workflows/contextual-orchestrator-hourly-review-repair.yml + - .github/workflows/clearfolio-hourly-review-repair.yml + - .github/workflows/disksage-hourly-review-repair.yml + - .github/workflows/inkspan-hourly-review-repair.yml + - .github/workflows/lineageweave-hourly-review-repair.yml + - .github/workflows/fast-mlsirm-hourly-review-repair.yml + - .github/workflows/github-hourly-review-repair.yml + - .github/workflows/governance-risk-compliance-hourly-review-repair.yml + - .github/workflows/hourly-nvidia-nim-review-repair.yml + - .github/workflows/nonnest2-hourly-review-repair.yml + - .github/workflows/orgmetra-hourly-review-repair.yml + - .github/workflows/originweave-hourly-review-repair.yml + - .github/workflows/quarantine-sandbox-hourly-review-repair.yml + - .github/workflows/afipc-hourly-review-repair.yml + - scripts/ci/pr_review_conflict_scope.py + - scripts/ci/pr_review_autofix_context.py + - scripts/ci/zdr_policy.py + - scripts/ci/contextual_orchestrator_review_policy.py + - scripts/ci/contextual_orchestrator_review_launcher.py + - scripts/ci/contextual_orchestrator_review_sidecar.sh + - tests/test_zdr_policy.py + - tests/test_contextual_orchestrator_review_policy.py + - tests/test_contextual_orchestrator_review_sidecar_contract.py + - docs/doctoring/contextual-orchestrator-vendored-sidecar.md + - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md + - docs/doctoring/review-repair-quality-workflow-identity.md + - docs/product-technical-gap-baseline.md + - CHANGELOG.md + - tests/test_bandscope_hourly_review_caller.py + - tests/test_disksage_hourly_review_caller.py + - tests/test_inkspan_hourly_review_caller.py + - tests/test_lineageweave_hourly_review_caller.py + - tests/test_fast_mlsirm_hourly_review_caller.py + - tests/test_github_hourly_conflict_repair.py + - tests/test_governance_risk_compliance_hourly_review_caller.py + - tests/test_hourly_scheduler_runtime_budget.py + - tests/test_nonnest2_hourly_review_caller.py + - tests/test_orgmetra_hourly_review_caller.py + - tests/test_originweave_hourly_review_caller.py + - tests/test_quarantine_sandbox_hourly_review_caller.py + - tests/test_contextual_orchestrator_hourly_review_caller.py + - tests/test_afipc_hourly_review_caller.py + - tests/test_hourly_autofix_context_quality_gate.py + - tests/test_pr_review_conflict_scope.py + - tests/test_pr_review_conflict_scope_control_files.py + - tests/test_pr_review_conflict_scope_git_executable.py + - tests/test_pr_review_conflict_scope_ignored_paths.py + - tests/test_pr_review_conflict_scope_symlink_targets.py + - tests/test_pr_review_fix_hourly_contract.py + - tests/test_pr_review_fix_scheduler.py + - tests/test_pr_review_fix_scheduler_source_pin.py + - tests/test_pr_review_autofix_context_head_binding.py + - tests/test_pr_review_autofix_nvidia_nim_contract.py + - tests/test_pr_review_autofix_writer_security_contract.py + - docs/automation/hourly-review-repair.md + - docs/doctoring/bandscope-hourly-review-caller.md + - docs/doctoring/clearfolio-hourly-review-caller.md + - docs/doctoring/conflict-control-evidence-isolation.md + - docs/doctoring/disksage-hourly-review-caller.md + - docs/doctoring/inkspan-hourly-review-caller.md + - docs/doctoring/lineageweave-hourly-review-caller.md + - docs/doctoring/fast-mlsirm-hourly-review-caller.md + - docs/doctoring/github-hourly-conflict-repair.md + - docs/doctoring/governance-risk-compliance-hourly-review-caller.md + - docs/doctoring/hourly-nvidia-nim-autofix.md + - docs/doctoring/nonnest2-hourly-review-caller.md + - docs/doctoring/orgmetra-hourly-review-caller.md + - docs/doctoring/originweave-hourly-review-caller.md + - docs/doctoring/quarantine-sandbox-hourly-review-caller.md + - docs/doctoring/contextual-orchestrator-hourly-review-caller.md + - docs/doctoring/afipc-hourly-review-caller.md + +permissions: + contents: read + +concurrency: + group: contextual-orchestrator-review-repair-quality-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + contract: + name: Scheduler, contextual-orchestrator, writer, and conflict-scope contracts + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout exact source revision + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.12" + - name: Install hash-locked test tooling + run: >- + python -m pip install --disable-pip-version-check --require-hashes + -r requirements-opencode-review-ci-hashes.txt + - name: Verify scheduler and contextual-orchestrator review-repair contracts + run: | + set -euo pipefail + python -m pytest -q \ + --cov=scripts.ci.pr_review_conflict_scope \ + --cov=scripts.ci.pr_review_autofix_context \ + --cov=scripts.ci.zdr_policy \ + --cov=scripts.ci.contextual_orchestrator_review_policy \ + --cov-branch \ + --cov-fail-under=100 + python -m interrogate \ + --fail-under 100 \ + scripts/ci/pr_review_conflict_scope.py \ + scripts/ci/pr_review_autofix_context.py \ + scripts/ci/zdr_policy.py \ + scripts/ci/contextual_orchestrator_review_policy.py \ + scripts/ci/contextual_orchestrator_review_launcher.py + python -m compileall -q \ + scripts/ci/pr_review_conflict_scope.py \ + scripts/ci/pr_review_autofix_context.py \ + tests/test_pr_review_conflict_scope.py \ + scripts/ci/zdr_policy.py \ + scripts/ci/contextual_orchestrator_review_policy.py \ + scripts/ci/contextual_orchestrator_review_launcher.py \ + tests/test_zdr_policy.py \ + tests/test_contextual_orchestrator_review_policy.py \ + tests/test_contextual_orchestrator_review_sidecar_contract.py \ + tests/test_bandscope_hourly_review_caller.py \ + tests/test_disksage_hourly_review_caller.py \ + tests/test_inkspan_hourly_review_caller.py \ + tests/test_lineageweave_hourly_review_caller.py \ + tests/test_fast_mlsirm_hourly_review_caller.py \ + tests/test_github_hourly_conflict_repair.py \ + tests/test_governance_risk_compliance_hourly_review_caller.py \ + tests/test_hourly_scheduler_runtime_budget.py \ + tests/test_nonnest2_hourly_review_caller.py \ + tests/test_orgmetra_hourly_review_caller.py \ + tests/test_originweave_hourly_review_caller.py \ + tests/test_quarantine_sandbox_hourly_review_caller.py \ + tests/test_contextual_orchestrator_hourly_review_caller.py \ + tests/test_afipc_hourly_review_caller.py \ + tests/test_pr_review_conflict_scope_control_files.py \ + tests/test_hourly_autofix_context_quality_gate.py \ + tests/test_pr_review_conflict_scope_git_executable.py \ + tests/test_pr_review_conflict_scope_ignored_paths.py \ + tests/test_pr_review_conflict_scope_symlink_targets.py \ + tests/test_pr_review_fix_hourly_contract.py \ + tests/test_pr_review_fix_scheduler.py \ + tests/test_pr_review_fix_scheduler_source_pin.py \ + tests/test_pr_review_autofix_context_head_binding.py \ + tests/test_pr_review_autofix_nvidia_nim_contract.py \ + tests/test_pr_review_autofix_writer_security_contract.py + git diff --check \ No newline at end of file From 408d198cd72bc9e9aee1a7b11899866269e47f33 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:24:13 +0900 Subject: [PATCH 24/29] refactor(ci): keep stable review quality workflow path --- ...ual-orchestrator-review-repair-quality.yml | 245 ------------------ tests/test_afipc_hourly_review_caller.py | 4 +- tests/test_bandscope_hourly_review_caller.py | 4 +- ...xtual_orchestrator_hourly_review_caller.py | 4 +- tests/test_disksage_hourly_review_caller.py | 4 +- .../test_fast_mlsirm_hourly_review_caller.py | 4 +- ...ce_risk_compliance_hourly_review_caller.py | 4 +- ...est_hourly_autofix_context_quality_gate.py | 4 +- tests/test_inkspan_hourly_review_caller.py | 4 +- .../test_lineageweave_hourly_review_caller.py | 4 +- tests/test_nonnest2_hourly_review_caller.py | 4 +- tests/test_orgmetra_hourly_review_caller.py | 4 +- .../test_originweave_hourly_review_caller.py | 4 +- ..._pr_review_conflict_scope_control_files.py | 7 +- tests/test_pr_review_fix_hourly_contract.py | 42 ++- ...quarantine_sandbox_hourly_review_caller.py | 4 +- 16 files changed, 66 insertions(+), 280 deletions(-) delete mode 100644 .github/workflows/contextual-orchestrator-review-repair-quality.yml diff --git a/.github/workflows/contextual-orchestrator-review-repair-quality.yml b/.github/workflows/contextual-orchestrator-review-repair-quality.yml deleted file mode 100644 index fc09887103..0000000000 --- a/.github/workflows/contextual-orchestrator-review-repair-quality.yml +++ /dev/null @@ -1,245 +0,0 @@ -name: Contextual Orchestrator Review Repair Quality CI - -# This is a read-only PR/push quality gate for the central review-repair control -# plane. Hourly execution is owned by the thin product callers and the reusable -# scheduler; write-capable repair is owned by pr-review-autofix.yml, whose model -# execution is routed through contextual-orchestrator/orchestrator/free. -on: - pull_request: - paths: - - .github/workflows/pr-review-fix-scheduler.yml - - scripts/ci/pr_review_fix_scheduler.py - - .github/workflows/pr-review-autofix.yml - - .github/workflows/bandscope-hourly-review-repair.yml - - .github/workflows/contextual-orchestrator-hourly-review-repair.yml - - .github/workflows/clearfolio-hourly-review-repair.yml - - .github/workflows/disksage-hourly-review-repair.yml - - .github/workflows/inkspan-hourly-review-repair.yml - - .github/workflows/lineageweave-hourly-review-repair.yml - - .github/workflows/fast-mlsirm-hourly-review-repair.yml - - .github/workflows/github-hourly-review-repair.yml - - .github/workflows/governance-risk-compliance-hourly-review-repair.yml - - .github/workflows/contextual-orchestrator-review-repair-quality.yml - - .github/workflows/nonnest2-hourly-review-repair.yml - - .github/workflows/orgmetra-hourly-review-repair.yml - - .github/workflows/originweave-hourly-review-repair.yml - - .github/workflows/quarantine-sandbox-hourly-review-repair.yml - - .github/workflows/afipc-hourly-review-repair.yml - - scripts/ci/pr_review_conflict_scope.py - - scripts/ci/pr_review_autofix_context.py - - scripts/ci/zdr_policy.py - - scripts/ci/contextual_orchestrator_review_policy.py - - scripts/ci/contextual_orchestrator_review_launcher.py - - scripts/ci/contextual_orchestrator_review_sidecar.sh - - tests/test_zdr_policy.py - - tests/test_contextual_orchestrator_review_policy.py - - tests/test_contextual_orchestrator_review_sidecar_contract.py - - docs/doctoring/contextual-orchestrator-vendored-sidecar.md - - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md - - docs/doctoring/review-repair-quality-workflow-identity.md - - docs/product-technical-gap-baseline.md - - CHANGELOG.md - - tests/test_bandscope_hourly_review_caller.py - - tests/test_disksage_hourly_review_caller.py - - tests/test_inkspan_hourly_review_caller.py - - tests/test_lineageweave_hourly_review_caller.py - - tests/test_fast_mlsirm_hourly_review_caller.py - - tests/test_github_hourly_conflict_repair.py - - tests/test_governance_risk_compliance_hourly_review_caller.py - - tests/test_hourly_scheduler_runtime_budget.py - - tests/test_nonnest2_hourly_review_caller.py - - tests/test_orgmetra_hourly_review_caller.py - - tests/test_originweave_hourly_review_caller.py - - tests/test_quarantine_sandbox_hourly_review_caller.py - - tests/test_contextual_orchestrator_hourly_review_caller.py - - tests/test_afipc_hourly_review_caller.py - - tests/test_hourly_autofix_context_quality_gate.py - - tests/test_pr_review_conflict_scope.py - - tests/test_pr_review_conflict_scope_control_files.py - - tests/test_pr_review_conflict_scope_git_executable.py - - tests/test_pr_review_conflict_scope_ignored_paths.py - - tests/test_pr_review_conflict_scope_symlink_targets.py - - tests/test_pr_review_fix_hourly_contract.py - - tests/test_pr_review_fix_scheduler.py - - tests/test_pr_review_fix_scheduler_source_pin.py - - tests/test_pr_review_autofix_context_head_binding.py - - tests/test_pr_review_autofix_nvidia_nim_contract.py - - tests/test_pr_review_autofix_writer_security_contract.py - - docs/automation/hourly-review-repair.md - - docs/doctoring/bandscope-hourly-review-caller.md - - docs/doctoring/clearfolio-hourly-review-caller.md - - docs/doctoring/conflict-control-evidence-isolation.md - - docs/doctoring/disksage-hourly-review-caller.md - - docs/doctoring/inkspan-hourly-review-caller.md - - docs/doctoring/lineageweave-hourly-review-caller.md - - docs/doctoring/fast-mlsirm-hourly-review-caller.md - - docs/doctoring/github-hourly-conflict-repair.md - - docs/doctoring/governance-risk-compliance-hourly-review-caller.md - - docs/doctoring/hourly-nvidia-nim-autofix.md - - docs/doctoring/nonnest2-hourly-review-caller.md - - docs/doctoring/orgmetra-hourly-review-caller.md - - docs/doctoring/originweave-hourly-review-caller.md - - docs/doctoring/quarantine-sandbox-hourly-review-caller.md - - docs/doctoring/contextual-orchestrator-hourly-review-caller.md - - docs/doctoring/afipc-hourly-review-caller.md - push: - paths: - - .github/workflows/pr-review-fix-scheduler.yml - - scripts/ci/pr_review_fix_scheduler.py - - .github/workflows/pr-review-autofix.yml - - .github/workflows/bandscope-hourly-review-repair.yml - - .github/workflows/contextual-orchestrator-hourly-review-repair.yml - - .github/workflows/clearfolio-hourly-review-repair.yml - - .github/workflows/disksage-hourly-review-repair.yml - - .github/workflows/inkspan-hourly-review-repair.yml - - .github/workflows/lineageweave-hourly-review-repair.yml - - .github/workflows/fast-mlsirm-hourly-review-repair.yml - - .github/workflows/github-hourly-review-repair.yml - - .github/workflows/governance-risk-compliance-hourly-review-repair.yml - - .github/workflows/contextual-orchestrator-review-repair-quality.yml - - .github/workflows/nonnest2-hourly-review-repair.yml - - .github/workflows/orgmetra-hourly-review-repair.yml - - .github/workflows/originweave-hourly-review-repair.yml - - .github/workflows/quarantine-sandbox-hourly-review-repair.yml - - .github/workflows/afipc-hourly-review-repair.yml - - scripts/ci/pr_review_conflict_scope.py - - scripts/ci/pr_review_autofix_context.py - - scripts/ci/zdr_policy.py - - scripts/ci/contextual_orchestrator_review_policy.py - - scripts/ci/contextual_orchestrator_review_launcher.py - - scripts/ci/contextual_orchestrator_review_sidecar.sh - - tests/test_zdr_policy.py - - tests/test_contextual_orchestrator_review_policy.py - - tests/test_contextual_orchestrator_review_sidecar_contract.py - - docs/doctoring/contextual-orchestrator-vendored-sidecar.md - - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md - - docs/doctoring/review-repair-quality-workflow-identity.md - - docs/product-technical-gap-baseline.md - - CHANGELOG.md - - tests/test_bandscope_hourly_review_caller.py - - tests/test_disksage_hourly_review_caller.py - - tests/test_inkspan_hourly_review_caller.py - - tests/test_lineageweave_hourly_review_caller.py - - tests/test_fast_mlsirm_hourly_review_caller.py - - tests/test_github_hourly_conflict_repair.py - - tests/test_governance_risk_compliance_hourly_review_caller.py - - tests/test_hourly_scheduler_runtime_budget.py - - tests/test_nonnest2_hourly_review_caller.py - - tests/test_orgmetra_hourly_review_caller.py - - tests/test_originweave_hourly_review_caller.py - - tests/test_quarantine_sandbox_hourly_review_caller.py - - tests/test_contextual_orchestrator_hourly_review_caller.py - - tests/test_afipc_hourly_review_caller.py - - tests/test_hourly_autofix_context_quality_gate.py - - tests/test_pr_review_conflict_scope.py - - tests/test_pr_review_conflict_scope_control_files.py - - tests/test_pr_review_conflict_scope_git_executable.py - - tests/test_pr_review_conflict_scope_ignored_paths.py - - tests/test_pr_review_conflict_scope_symlink_targets.py - - tests/test_pr_review_fix_hourly_contract.py - - tests/test_pr_review_fix_scheduler.py - - tests/test_pr_review_fix_scheduler_source_pin.py - - tests/test_pr_review_autofix_context_head_binding.py - - tests/test_pr_review_autofix_nvidia_nim_contract.py - - tests/test_pr_review_autofix_writer_security_contract.py - - docs/automation/hourly-review-repair.md - - docs/doctoring/bandscope-hourly-review-caller.md - - docs/doctoring/clearfolio-hourly-review-caller.md - - docs/doctoring/conflict-control-evidence-isolation.md - - docs/doctoring/disksage-hourly-review-caller.md - - docs/doctoring/inkspan-hourly-review-caller.md - - docs/doctoring/lineageweave-hourly-review-caller.md - - docs/doctoring/fast-mlsirm-hourly-review-caller.md - - docs/doctoring/github-hourly-conflict-repair.md - - docs/doctoring/governance-risk-compliance-hourly-review-caller.md - - docs/doctoring/hourly-nvidia-nim-autofix.md - - docs/doctoring/nonnest2-hourly-review-caller.md - - docs/doctoring/orgmetra-hourly-review-caller.md - - docs/doctoring/originweave-hourly-review-caller.md - - docs/doctoring/quarantine-sandbox-hourly-review-caller.md - - docs/doctoring/contextual-orchestrator-hourly-review-caller.md - - docs/doctoring/afipc-hourly-review-caller.md - -permissions: - contents: read - -concurrency: - group: contextual-orchestrator-review-repair-quality-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -jobs: - contract: - name: Scheduler, contextual-orchestrator, writer, and conflict-scope contracts - runs-on: ubuntu-24.04 - timeout-minutes: 20 - steps: - - name: Harden runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 - with: - egress-policy: audit - - name: Checkout exact source revision - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: ${{ github.event.pull_request.head.sha || github.sha }} - persist-credentials: false - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.12" - - name: Install hash-locked test tooling - run: >- - python -m pip install --disable-pip-version-check --require-hashes - -r requirements-opencode-review-ci-hashes.txt - - name: Verify scheduler and contextual-orchestrator review-repair contracts - run: | - set -euo pipefail - python -m pytest -q \ - --cov=scripts.ci.pr_review_conflict_scope \ - --cov=scripts.ci.pr_review_autofix_context \ - --cov=scripts.ci.zdr_policy \ - --cov=scripts.ci.contextual_orchestrator_review_policy \ - --cov-branch \ - --cov-fail-under=100 - python -m interrogate \ - --fail-under 100 \ - scripts/ci/pr_review_conflict_scope.py \ - scripts/ci/pr_review_autofix_context.py \ - scripts/ci/zdr_policy.py \ - scripts/ci/contextual_orchestrator_review_policy.py \ - scripts/ci/contextual_orchestrator_review_launcher.py - python -m compileall -q \ - scripts/ci/pr_review_conflict_scope.py \ - scripts/ci/pr_review_autofix_context.py \ - tests/test_pr_review_conflict_scope.py \ - scripts/ci/zdr_policy.py \ - scripts/ci/contextual_orchestrator_review_policy.py \ - scripts/ci/contextual_orchestrator_review_launcher.py \ - tests/test_zdr_policy.py \ - tests/test_contextual_orchestrator_review_policy.py \ - tests/test_contextual_orchestrator_review_sidecar_contract.py \ - tests/test_bandscope_hourly_review_caller.py \ - tests/test_disksage_hourly_review_caller.py \ - tests/test_inkspan_hourly_review_caller.py \ - tests/test_lineageweave_hourly_review_caller.py \ - tests/test_fast_mlsirm_hourly_review_caller.py \ - tests/test_github_hourly_conflict_repair.py \ - tests/test_governance_risk_compliance_hourly_review_caller.py \ - tests/test_hourly_scheduler_runtime_budget.py \ - tests/test_nonnest2_hourly_review_caller.py \ - tests/test_orgmetra_hourly_review_caller.py \ - tests/test_originweave_hourly_review_caller.py \ - tests/test_quarantine_sandbox_hourly_review_caller.py \ - tests/test_contextual_orchestrator_hourly_review_caller.py \ - tests/test_afipc_hourly_review_caller.py \ - tests/test_pr_review_conflict_scope_control_files.py \ - tests/test_hourly_autofix_context_quality_gate.py \ - tests/test_pr_review_conflict_scope_git_executable.py \ - tests/test_pr_review_conflict_scope_ignored_paths.py \ - tests/test_pr_review_conflict_scope_symlink_targets.py \ - tests/test_pr_review_fix_hourly_contract.py \ - tests/test_pr_review_fix_scheduler.py \ - tests/test_pr_review_fix_scheduler_source_pin.py \ - tests/test_pr_review_autofix_context_head_binding.py \ - tests/test_pr_review_autofix_nvidia_nim_contract.py \ - tests/test_pr_review_autofix_writer_security_contract.py - git diff --check \ No newline at end of file diff --git a/tests/test_afipc_hourly_review_caller.py b/tests/test_afipc_hourly_review_caller.py index c3ddda3fe8..bfcaa5d8e3 100644 --- a/tests/test_afipc_hourly_review_caller.py +++ b/tests/test_afipc_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/afipc-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/afipc-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -163,4 +163,4 @@ def test_focused_quality_workflow_tracks_afipc_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths \ No newline at end of file + assert doctoring not in compileall_paths diff --git a/tests/test_bandscope_hourly_review_caller.py b/tests/test_bandscope_hourly_review_caller.py index 4a4fdbd1e6..3c8d96cbfb 100644 --- a/tests/test_bandscope_hourly_review_caller.py +++ b/tests/test_bandscope_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/bandscope-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/bandscope-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def _read(path: Path) -> str: @@ -84,4 +84,4 @@ def test_focused_quality_workflow_tracks_bandscope_contracts() -> None: assert quality.count(".github/workflows/bandscope-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/bandscope-hourly-review-caller.md") == 2 - assert quality.count("tests/test_bandscope_hourly_review_caller.py") == 3 \ No newline at end of file + assert quality.count("tests/test_bandscope_hourly_review_caller.py") == 3 diff --git a/tests/test_contextual_orchestrator_hourly_review_caller.py b/tests/test_contextual_orchestrator_hourly_review_caller.py index 8b942a28f3..204ed52887 100644 --- a/tests/test_contextual_orchestrator_hourly_review_caller.py +++ b/tests/test_contextual_orchestrator_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/contextual-orchestrator-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/contextual-orchestrator-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -85,4 +85,4 @@ def test_focused_quality_workflow_tracks_contextual_orchestrator_contracts() -> ) == 2 assert quality.count( "tests/test_contextual_orchestrator_hourly_review_caller.py" - ) == 3 \ No newline at end of file + ) == 3 diff --git a/tests/test_disksage_hourly_review_caller.py b/tests/test_disksage_hourly_review_caller.py index 66bc5b65f3..5ad14b2488 100644 --- a/tests/test_disksage_hourly_review_caller.py +++ b/tests/test_disksage_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/disksage-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/disksage-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def _read(path: Path) -> str: @@ -73,4 +73,4 @@ def test_focused_quality_workflow_tracks_disksage_caller_contracts() -> None: assert quality.count(".github/workflows/disksage-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/disksage-hourly-review-caller.md") == 2 - assert quality.count("tests/test_disksage_hourly_review_caller.py") == 3 \ No newline at end of file + assert quality.count("tests/test_disksage_hourly_review_caller.py") == 3 diff --git a/tests/test_fast_mlsirm_hourly_review_caller.py b/tests/test_fast_mlsirm_hourly_review_caller.py index 862ea0ee22..1fd0965860 100644 --- a/tests/test_fast_mlsirm_hourly_review_caller.py +++ b/tests/test_fast_mlsirm_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/fast-mlsirm-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/fast-mlsirm-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def _read(path: Path) -> str: @@ -77,4 +77,4 @@ def test_focused_quality_workflow_tracks_fast_mlsirm_contracts() -> None: assert quality.count(".github/workflows/fast-mlsirm-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/fast-mlsirm-hourly-review-caller.md") == 2 - assert quality.count("tests/test_fast_mlsirm_hourly_review_caller.py") == 3 \ No newline at end of file + assert quality.count("tests/test_fast_mlsirm_hourly_review_caller.py") == 3 diff --git a/tests/test_governance_risk_compliance_hourly_review_caller.py b/tests/test_governance_risk_compliance_hourly_review_caller.py index 507bb7bdd9..4b0fb4f93e 100644 --- a/tests/test_governance_risk_compliance_hourly_review_caller.py +++ b/tests/test_governance_risk_compliance_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/governance-risk-compliance-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/governance-risk-compliance-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def _read(path: Path) -> str: @@ -81,4 +81,4 @@ def test_focused_quality_workflow_tracks_grc_contracts() -> None: assert quality.count( "docs/doctoring/governance-risk-compliance-hourly-review-caller.md" ) == 2 - assert quality.count("tests/test_governance_risk_compliance_hourly_review_caller.py") == 3 \ No newline at end of file + assert quality.count("tests/test_governance_risk_compliance_hourly_review_caller.py") == 3 diff --git a/tests/test_hourly_autofix_context_quality_gate.py b/tests/test_hourly_autofix_context_quality_gate.py index fd16fcca94..4d3f06a8d6 100644 --- a/tests/test_hourly_autofix_context_quality_gate.py +++ b/tests/test_hourly_autofix_context_quality_gate.py @@ -12,7 +12,7 @@ from scripts.ci import pr_review_autofix_context as context -WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def test_context_helper_is_part_of_the_focused_exact_head_quality_gate() -> None: @@ -202,4 +202,4 @@ def fake_run(argv, **_kwargs): ) assert exit_info.value.code == 0 - assert output.is_file() \ No newline at end of file + assert output.is_file() diff --git a/tests/test_inkspan_hourly_review_caller.py b/tests/test_inkspan_hourly_review_caller.py index f40ad3967f..fb8f903694 100644 --- a/tests/test_inkspan_hourly_review_caller.py +++ b/tests/test_inkspan_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/inkspan-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/inkspan-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def _read(path: Path) -> str: @@ -74,4 +74,4 @@ def test_focused_quality_workflow_tracks_inkspan_caller_contracts() -> None: assert quality.count(".github/workflows/inkspan-hourly-review-repair.yml") == 2 assert quality.count("docs/doctoring/inkspan-hourly-review-caller.md") == 2 - assert quality.count("tests/test_inkspan_hourly_review_caller.py") == 3 \ No newline at end of file + assert quality.count("tests/test_inkspan_hourly_review_caller.py") == 3 diff --git a/tests/test_lineageweave_hourly_review_caller.py b/tests/test_lineageweave_hourly_review_caller.py index 03ff565795..fb7b8ba8cc 100644 --- a/tests/test_lineageweave_hourly_review_caller.py +++ b/tests/test_lineageweave_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/lineageweave-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/lineageweave-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -69,4 +69,4 @@ def test_lineageweave_doctoring_keeps_product_and_review_claims_separate() -> No "copilot_github_token", "apa 7th references", ): - assert contract in doctoring \ No newline at end of file + assert contract in doctoring diff --git a/tests/test_nonnest2_hourly_review_caller.py b/tests/test_nonnest2_hourly_review_caller.py index cb9d4a81fe..0830c08704 100644 --- a/tests/test_nonnest2_hourly_review_caller.py +++ b/tests/test_nonnest2_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/nonnest2-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/nonnest2-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -163,4 +163,4 @@ def test_focused_quality_workflow_tracks_nonnest2_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths \ No newline at end of file + assert doctoring not in compileall_paths diff --git a/tests/test_orgmetra_hourly_review_caller.py b/tests/test_orgmetra_hourly_review_caller.py index d6c0e0c678..9b5b85f485 100644 --- a/tests/test_orgmetra_hourly_review_caller.py +++ b/tests/test_orgmetra_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/orgmetra-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/orgmetra-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") def _read(path: Path) -> str: @@ -102,4 +102,4 @@ def test_focused_quality_workflow_tracks_orgmetra_contracts() -> None: compileall_start = quality.index("python -m compileall -q \\") compileall_end = quality.index("git diff --check", compileall_start) compileall = quality[compileall_start:compileall_end] - assert contract in compileall \ No newline at end of file + assert contract in compileall diff --git a/tests/test_originweave_hourly_review_caller.py b/tests/test_originweave_hourly_review_caller.py index c9854c4047..11b3353786 100644 --- a/tests/test_originweave_hourly_review_caller.py +++ b/tests/test_originweave_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/originweave-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/originweave-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -163,4 +163,4 @@ def test_focused_quality_workflow_tracks_originweave_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths \ No newline at end of file + assert doctoring not in compileall_paths diff --git a/tests/test_pr_review_conflict_scope_control_files.py b/tests/test_pr_review_conflict_scope_control_files.py index 2b657e5599..3fd7f8e81d 100644 --- a/tests/test_pr_review_conflict_scope_control_files.py +++ b/tests/test_pr_review_conflict_scope_control_files.py @@ -18,10 +18,7 @@ REPOSITORY_ROOT = Path(__file__).resolve().parents[1] QUALITY_WORKFLOW = ( - REPOSITORY_ROOT - / ".github" - / "workflows" - / "contextual-orchestrator-review-repair-quality.yml" + REPOSITORY_ROOT / ".github" / "workflows" / "hourly-nvidia-nim-review-repair.yml" ) CONTRACT_PATH = "tests/test_pr_review_conflict_scope_control_files.py" DOCTORING_PATH = "docs/doctoring/conflict-control-evidence-isolation.md" @@ -114,4 +111,4 @@ def test_control_evidence_contract_cannot_bypass_its_quality_workflow() -> None: assert trigger_block.count(CONTRACT_PATH) == 2 assert trigger_block.count(DOCTORING_PATH) == 2 - assert CONTRACT_PATH in workflow[workflow.index("python -m compileall -q") :] \ No newline at end of file + assert CONTRACT_PATH in workflow[workflow.index("python -m compileall -q") :] diff --git a/tests/test_pr_review_fix_hourly_contract.py b/tests/test_pr_review_fix_hourly_contract.py index 6e87bd2778..a31562550c 100644 --- a/tests/test_pr_review_fix_hourly_contract.py +++ b/tests/test_pr_review_fix_hourly_contract.py @@ -14,9 +14,7 @@ _REUSABLE_WORKFLOW = Path(".github/workflows/pr-review-fix-scheduler.yml") _AUTOFIX_WORKFLOW = Path(".github/workflows/pr-review-autofix.yml") _CLEARFOLIO_CALLER = Path(".github/workflows/clearfolio-hourly-review-repair.yml") -_CONTRACT_WORKFLOW = Path( - ".github/workflows/contextual-orchestrator-review-repair-quality.yml" -) +_CONTRACT_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") _AUTOMATION_GUIDE = Path("docs/automation/hourly-review-repair.md") @@ -317,4 +315,40 @@ def test_external_review_wait_is_not_invented_into_a_code_repair() -> None: assert scheduler.needs_rca_repair(_current_head_change_request(body)) == ( False, (), - ) \ No newline at end of file + ) + + +def test_rca_dispatch_carries_an_explicit_worker_mode(monkeypatch) -> None: + """The exact-head dispatch distinguishes failed-check RCA from ordinary review repair.""" + captured: dict[str, str | None] = {} + + def fake_run(args: list[str], *, stdin: str | None = None) -> str: + captured["stdin"] = stdin + return "" + + monkeypatch.setattr(scheduler, "run", fake_run) + monkeypatch.setattr(scheduler, "live_head_matches", lambda _repo, _pr: True) + pr = _current_head_change_request("Failed check evidence reports Strix failed.") + + scheduler.dispatch_autofix( + "owner/repo", + pr, + workflow="pr-review-autofix.yml", + workflow_repository="ContextualWisdomLab/.github", + dry_run=False, + repair_mode="rca", + ) + + payload = json.loads(captured["stdin"] or "{}") + assert payload["client_payload"]["repair_mode"] == "rca" + + +def test_rca_worker_collects_failed_check_evidence_before_editing() -> None: + """RCA mode receives redacted logs and a separately sealed edit scope.""" + workflow = _read(_AUTOFIX_WORKFLOW) + + assert "REPAIR_MODE" in workflow + assert "collect_failed_check_evidence.sh" in workflow + assert "pr-review-autofix-failed-check-evidence.md" in workflow + assert "--repair-mode \"$REPAIR_MODE\"" in workflow + assert "--failed-check-evidence" in workflow diff --git a/tests/test_quarantine_sandbox_hourly_review_caller.py b/tests/test_quarantine_sandbox_hourly_review_caller.py index 97c651b345..1755bb5e77 100644 --- a/tests/test_quarantine_sandbox_hourly_review_caller.py +++ b/tests/test_quarantine_sandbox_hourly_review_caller.py @@ -5,7 +5,7 @@ CALLER = Path(".github/workflows/quarantine-sandbox-hourly-review-repair.yml") DOCTORING = Path("docs/doctoring/quarantine-sandbox-hourly-review-caller.md") -QUALITY_WORKFLOW = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") @@ -176,4 +176,4 @@ def test_focused_quality_workflow_tracks_sandbox_contracts() -> None: assert contract in push_paths assert contract in compileall_paths assert caller not in compileall_paths - assert doctoring not in compileall_paths \ No newline at end of file + assert doctoring not in compileall_paths From a3a9b51288dd6e6f3d197acbc20bf4076ca50b70 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:24:37 +0900 Subject: [PATCH 25/29] test(review): preserve workflow registry identity --- tests/test_hourly_scheduler_runtime_budget.py | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/tests/test_hourly_scheduler_runtime_budget.py b/tests/test_hourly_scheduler_runtime_budget.py index cfe0484c48..d6162edc2f 100644 --- a/tests/test_hourly_scheduler_runtime_budget.py +++ b/tests/test_hourly_scheduler_runtime_budget.py @@ -6,8 +6,10 @@ REUSABLE = Path(".github/workflows/pr-review-fix-scheduler.yml") CLEARFOLIO = Path(".github/workflows/clearfolio-hourly-review-repair.yml") DISKSAGE = Path(".github/workflows/disksage-hourly-review-repair.yml") -QUALITY = Path(".github/workflows/contextual-orchestrator-review-repair-quality.yml") -LEGACY_QUALITY = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +QUALITY = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +REPLACEMENT_QUALITY = Path( + ".github/workflows/contextual-orchestrator-review-repair-quality.yml" +) def _read(path: Path) -> str: @@ -49,14 +51,16 @@ def test_quality_gate_tracks_runtime_budget_contract() -> None: def test_review_repair_quality_workflow_has_truthful_identity() -> None: - """Keep contract CI distinct from the hourly writer and retired direct-NIM design.""" + """Keep the stable workflow ID while retiring its direct-NIM identity.""" assert QUALITY.is_file() - assert not LEGACY_QUALITY.exists() + assert not REPLACEMENT_QUALITY.exists() quality = _read(QUALITY) assert quality.startswith("name: Contextual Orchestrator Review Repair Quality CI\n") assert "schedule:" not in quality assert "name: Hourly NVIDIA NIM Review Repair" not in quality assert "Hourly cadence, immutable source, NIM credential, and conflict scope" not in quality + assert "existing GitHub Actions workflow registry identity" in quality assert ".github/workflows/pr-review-autofix.yml" in quality - assert "tests/test_pr_review_autofix_nvidia_nim_contract.py" in quality + assert "contextual-orchestrator/orchestrator/free" in quality + assert "tests/test_pr_review_autofix_nvidia_nim_contract.py" in quality \ No newline at end of file From 2f30a601b89b31b391b0fc871d0d52a78042f8d3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:25:08 +0900 Subject: [PATCH 26/29] docs(review): preserve Actions registry identity in RCA --- ...review-repair-quality-workflow-identity.md | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/docs/doctoring/review-repair-quality-workflow-identity.md b/docs/doctoring/review-repair-quality-workflow-identity.md index e8efe913b8..2fe4b01ac9 100644 --- a/docs/doctoring/review-repair-quality-workflow-identity.md +++ b/docs/doctoring/review-repair-quality-workflow-identity.md @@ -6,7 +6,7 @@ Recorded 2026-09-01 against protected `ContextualWisdomLab/.github` `main@b4f7b0 ## Incident -The central workflow `.github/workflows/hourly-nvidia-nim-review-repair.yml` was named **Hourly NVIDIA NIM Review Repair**, but the executable source contradicted both halves of that identity: +The central workflow at `.github/workflows/hourly-nvidia-nim-review-repair.yml` was named **Hourly NVIDIA NIM Review Repair**, but the executable source contradicted both halves of that identity: - it had no `schedule` trigger and therefore did not own an hourly writer cadence; - it had read-only `contents: read` permission and executed only repository contract tests, coverage, docstring checks, `compileall`, and `git diff --check`; @@ -21,15 +21,19 @@ The repository conflated three separate responsibilities under one historical la 1. **Cadence ownership** — thin product-specific `*-hourly-review-repair.yml` callers own schedules. 2. **Repair execution** — `pr-review-fix-scheduler.yml` selects bounded work and `pr-review-autofix.yml` owns the write-capable exact-head repair worker. -3. **Contract verification** — the former `hourly-nvidia-nim-review-repair.yml` is a PR/push-only read-only quality gate. +3. **Contract verification** — `.github/workflows/hourly-nvidia-nim-review-repair.yml` is a PR/push-only read-only quality gate. -When direct NVIDIA NIM execution was retired in favor of ADR-0003's contextual-orchestrator gateway, responsibility (2) was migrated but responsibility (3)'s filename, display name, job name, and dependent test paths were not. The result was executable metadata that suggested a scheduled direct-provider writer where none existed. +When direct NVIDIA NIM execution was retired in favor of ADR-0003's contextual-orchestrator gateway, responsibility (2) was migrated but responsibility (3)'s display identity and explanatory contract were not. The result was executable metadata that suggested a scheduled direct-provider writer where none existed. + +A second lifecycle defect became visible during repair. GitHub retains workflow registry identities after YAML paths disappear; this repository already tracks that control-plane fact in #1026. Creating a replacement workflow path and deleting the historical path would therefore create a new workflow ID while risking an orphaned old ID. That is not a safe rename. ## Repair -PR #1573 renames the quality gate to `.github/workflows/contextual-orchestrator-review-repair-quality.yml` with display name **Contextual Orchestrator Review Repair Quality CI**. It remains PR/push-only and read-only. No second scheduler is added. +PR #1573 keeps the historical path `.github/workflows/hourly-nvidia-nim-review-repair.yml` as a **registry-identity compatibility boundary** while changing the workflow itself to the truthful display name **Contextual Orchestrator Review Repair Quality CI**. The workflow remains PR/push-only and `contents: read`; no hourly schedule or second writer is added. + +The path is deliberately not customer or architecture terminology. The display name, comments, job name, tests, and doctoring carry the current responsibility. No replacement `.github/workflows/contextual-orchestrator-review-repair-quality.yml` remains in the final tree. -All executable test references move to the new path. The underlying writer remains unchanged: +The underlying writer remains unchanged: ```text hourly product caller @@ -42,11 +46,13 @@ hourly product caller The sidecar continues to register the existing five provider credentials (`BYTEZ_API_KEY`, `NVIDIA_NIM_API_KEY`, `NVIDIA_NIM_API_KEY_SUB`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY`) into its process-local provider registry. Provider keys are not promoted to workflow identity and no direct-provider fallback is introduced. -## TDD evidence +## TDD and hosted evidence -The first PR commit, `6279b0c8fe7f41f2ec61be728da41d9c2c599e84`, changed `tests/test_hourly_scheduler_runtime_budget.py` before the implementation. It required the new quality-workflow path and rejected the legacy path/name. On that exact tree the required new file did not exist, so the contract was deterministically RED; GitHub materialized predecessor run `33489785044` from the legacy workflow while the fleet was queued. +The first PR commit, `6279b0c8fe7f41f2ec61be728da41d9c2c599e84`, changed `tests/test_hourly_scheduler_runtime_budget.py` before implementation and rejected the old display identity. Its initial hypothesis also required a new path. That source-level RED correctly exposed the identity defect, but the later workflow-lifecycle inspection showed that deleting the old path would violate the repository's own orphan-workflow governance boundary. The test was refined rather than preserving an unsafe implementation hypothesis: it now requires the stable historical path, forbids a replacement path, and requires the contextual-orchestrator display/worker contract. -The GREEN implementation then created the new workflow, deleted the legacy workflow, and migrated every executable `QUALITY_WORKFLOW`/contract reference. Exact-head hosted run `33490614440` materialized under the new workflow name, proving GitHub recognizes the replacement workflow identity. Terminal test evidence remains authoritative only after the unchanged exact head finishes. +An intermediate replacement-path implementation produced hosted run `33491072818`. The workflow itself materialized and executed 2,253 passing tests with 100% reported production coverage, but one existing fake-dispatch fixture failed with bash exit 141/SIGPIPE because the fake `gh` process did not drain `--input -`. That is independent of the workflow identity repair. PR #1573 incorporates the exact one-line fixture root repair from closed #1561 (`cat >/dev/null`) while leaving production dispatch behavior unchanged. + +All intermediate replacement-path runs are predecessor evidence only. Final acceptance requires exact-current-head execution through the preserved workflow registry identity and terminal success; queued, pending, skipped, cancelled, or predecessor evidence is non-passing. ## Security and governance boundary @@ -54,16 +60,19 @@ The GREEN implementation then created the new workflow, deleted the legacy workf - No direct NVIDIA NIM HTTP endpoint or hard-coded provider model is introduced. - The quality workflow remains `contents: read` only. - The write-capable worker remains exact-head-bound and governed by its existing sealed path, revalidation, credential stripping, and protected push contracts. +- The stable workflow path avoids manufacturing an untracked orphan Actions identity. - Queued, pending, skipped, cancelled, predecessor-head, or stale evidence is not treated as passing. ## Rollback -Rollback is a normal revert of the workflow rename and dependent path references only after proving that doing so does not reintroduce misleading provider/cadence ownership. Do not restore a direct-NIM execution path, add a duplicate hourly schedule, or weaken the contextual-orchestrator fail-closed contract as part of rollback. +Rollback is a normal revert of the display/contract correction only after proving that doing so does not reintroduce misleading provider/cadence ownership. Do not delete/recreate the workflow path merely to rename it, restore a direct-NIM execution path, add a duplicate hourly schedule, or weaken the contextual-orchestrator fail-closed contract. ## References ContextualWisdomLab. (2026). *ADR-0003: Contextual-orchestrator vendored free/ZDR review routing*. `docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md`. +ContextualWisdomLab. (2026). *Inventory orphaned workflow identities* (Issue/PR #1026). GitHub repository governance evidence. + GitHub. (n.d.). *Workflow syntax for GitHub Actions*. GitHub Docs. https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions -GitHub. (n.d.). *Events that trigger workflows*. GitHub Docs. https://docs.github.com/actions/using-workflows/events-that-trigger-workflows +GitHub. (n.d.). *Events that trigger workflows*. GitHub Docs. https://docs.github.com/actions/using-workflows/events-that-trigger-workflows \ No newline at end of file From f7ce11166ae6887aac9c094837ae1ecd8394fc45 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 18:34:45 +0900 Subject: [PATCH 27/29] test(review): assert workflow registry semantics --- tests/test_hourly_scheduler_runtime_budget.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_hourly_scheduler_runtime_budget.py b/tests/test_hourly_scheduler_runtime_budget.py index d6162edc2f..bf24b15183 100644 --- a/tests/test_hourly_scheduler_runtime_budget.py +++ b/tests/test_hourly_scheduler_runtime_budget.py @@ -60,7 +60,7 @@ def test_review_repair_quality_workflow_has_truthful_identity() -> None: assert "schedule:" not in quality assert "name: Hourly NVIDIA NIM Review Repair" not in quality assert "Hourly cadence, immutable source, NIM credential, and conflict scope" not in quality - assert "existing GitHub Actions workflow registry identity" in quality + assert "registry identity is updated in place" in quality assert ".github/workflows/pr-review-autofix.yml" in quality assert "contextual-orchestrator/orchestrator/free" in quality - assert "tests/test_pr_review_autofix_nvidia_nim_contract.py" in quality \ No newline at end of file + assert "tests/test_pr_review_autofix_nvidia_nim_contract.py" in quality From dd6ed23153c65e7517f1f85bb7d4b895f327f3c8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:25:23 +0900 Subject: [PATCH 28/29] docs(architecture): align review and repair gateway boundary --- ARCHITECTURE.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 1af9c3d026..8038c3632e 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -137,11 +137,15 @@ sequenceDiagram - Logs and review receipts redact credential shapes (tokens, bearer values, known provider prefixes). They do not mask operational PII that the control plane must process. -- LLM and scheduled agents route through the vendored contextual-orchestrator gateway - (`contextual-orchestrator/orchestrator/free`), which auto-discovers upstream models from five - KV-registered provider secrets (Bytez, `NVIDIA_NIM_API_KEY` ×2, OpenRouter, OpenAI) rather than - binding any one of them directly. They never use `COPILOT_GITHUB_TOKEN`. Existing - review-agent key schemes stay unchanged. +- Every LLM-bearing review and scheduled-repair workflow routes model traffic + through the vendored contextual-orchestrator gateway. OpenCode and Noema remain + independent read-only verdict controls with their existing credential mappings, + while the write-capable scheduled repair worker uses + `contextual-orchestrator/orchestrator/free`; sharing the gateway does not merge + their credentials, privileges, or verdict authority. The gateway discovers + eligible upstream routes from the credentials actually available to that + workflow instead of binding a provider directly. None of these paths uses + `COPILOT_GITHUB_TOKEN`. - Rust remains the psychometric arithmetic owner. Repair never substitutes Python for scoring math. - Downloaded SBOM and distribution bytes are inert. The signing job does From b14118f792799b92abfa9367f1f3cdcbf3ab90d6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 1 Sep 2026 21:26:12 +0900 Subject: [PATCH 29/29] docs(automation): distinguish gateway config from provider availability --- docs/automation/hourly-review-repair.md | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/docs/automation/hourly-review-repair.md b/docs/automation/hourly-review-repair.md index 239ad430b1..8994a0fc10 100644 --- a/docs/automation/hourly-review-repair.md +++ b/docs/automation/hourly-review-repair.md @@ -16,11 +16,15 @@ engine**. requests. Every product caller, Orgmetra included, is provider-neutral by construction: the worker's model -boundary is the contextual-orchestrator gateway (ADR-0003). Provider keys (Bytez, NVIDIA NIM ×2, -OpenRouter, OpenAI) stay in the sidecar's process-local KV and automatic model discovery selects -upstream models behind the fail-closed `contextual-orchestrator/orchestrator/free` virtual model -id. A caller schedule is not evidence that gateway credentials, discovery, or a live OpenCode tool -loop are available; those facts require exact worker-run evidence. +boundary is the contextual-orchestrator gateway (ADR-0003). Available provider credentials (Bytez, +NVIDIA NIM primary/sub, OpenRouter, and the separately governed OpenAI credential) stay in the +sidecar's process-local registry; discovery selects only routes eligible for the requested virtual +model policy. An individual provider credential may be absent without making the gateway invalid. +For scheduled repair, the fail-closed `contextual-orchestrator/orchestrator/free` path proceeds with +remaining eligible providers and fails only when required gateway configuration is unavailable or +discovery yields no eligible free-tier route. A caller schedule is not evidence that gateway +configuration, discovery, or a live OpenCode tool loop are available; those facts require exact +worker-run evidence. Merge eligibility remains owned by the separate merge scheduler, branch protection, required checks, independent review, and unresolved-thread policy. @@ -202,9 +206,11 @@ organization-level queue inspection and bounded repair dispatch. When a scheduled run fails, classify the result before rerunning: - no actionable file-scoped feedback: expected no-op; -- missing any of the five gateway provider secrets (including `NVIDIA_NIM_API_KEY`) or the - sidecar's `CONTEXTUAL_ORCHESTRATOR_BASE_URL`/`CONTEXTUAL_ORCHESTRATOR_TOKEN_FILE`: central - secret configuration failure; +- missing required sidecar configuration (`CONTEXTUAL_ORCHESTRATOR_BASE_URL` or + `CONTEXTUAL_ORCHESTRATOR_TOKEN_FILE`): central gateway configuration failure; +- one or more individual provider credentials absent: continue discovery with + the credentials that are available; classify a model-admission failure only + if the requested policy has no eligible route after discovery; - head changed: safe optimistic-concurrency refusal; inspect the new head rather than retrying predecessor evidence; - out-of-scope or ignored-path change: treat as a security failure and preserve