fix(ci): align review-repair quality gate with contextual orchestrator

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -1,5 +1,14 @@
-name: Hourly NVIDIA NIM Review Repair
+name: Contextual Orchestrator Review Repair Quality CI
 
+# Compatibility boundary: keep this historical file path so the existing GitHub
+# Actions workflow registry identity is updated in place instead of leaving an
+# orphaned enabled workflow ID. The display name and executable responsibility
+# are authoritative: this is a read-only PR/push quality gate, not an hourly
+# writer and not a direct NVIDIA NIM executor.
+#
+# Hourly execution is owned by the thin product callers and the reusable
+# scheduler; write-capable repair is owned by pr-review-autofix.yml, whose model
+# execution is routed through contextual-orchestrator/orchestrator/free.
 on:
   pull_request:
     paths:
@@ -32,6 +41,9 @@ on:
       - tests/test_contextual_orchestrator_review_sidecar_contract.py
       - docs/doctoring/contextual-orchestrator-vendored-sidecar.md
       - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
+      - docs/doctoring/review-repair-quality-workflow-identity.md
+      - docs/product-technical-gap-baseline.md
+      - CHANGELOG.md
       - tests/test_bandscope_hourly_review_caller.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_inkspan_hourly_review_caller.py
@@ -106,6 +118,9 @@ on:
       - tests/test_contextual_orchestrator_review_sidecar_contract.py
       - docs/doctoring/contextual-orchestrator-vendored-sidecar.md
       - docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
+      - docs/doctoring/review-repair-quality-workflow-identity.md
+      - docs/product-technical-gap-baseline.md
+      - CHANGELOG.md
       - tests/test_bandscope_hourly_review_caller.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_inkspan_hourly_review_caller.py
@@ -154,12 +169,12 @@ permissions:
   contents: read
 
 concurrency:
-  group: hourly-nvidia-nim-review-repair-${{ github.event.pull_request.number || github.ref }}
+  group: contextual-orchestrator-review-repair-quality-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
   contract:
-    name: Hourly cadence, immutable source, NIM credential, and conflict scope
+    name: Scheduler, contextual-orchestrator, writer, and conflict-scope contracts
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
@@ -180,7 +195,7 @@ jobs:
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
           -r requirements-opencode-review-ci-hashes.txt
-      - name: Verify hourly scheduler and NVIDIA NIM autofix contracts
+      - name: Verify scheduler and contextual-orchestrator review-repair contracts
         run: |
           set -euo pipefail
           python -m pytest -q \
@@ -232,4 +247,4 @@ jobs:
             tests/test_pr_review_autofix_context_head_binding.py \
             tests/test_pr_review_autofix_nvidia_nim_contract.py \
             tests/test_pr_review_autofix_writer_security_contract.py
-          git diff --check
+          git diff --check

ARCHITECTURE.md

@@ -48,15 +48,15 @@ only established scheduler credentials, and grants job-scoped
 only established scheduler credentials, and grants job-scoped
 `id-token: write`. The reusable engine stays product-neutral.
 
-## Hourly NVIDIA NIM repair gate
+## Hourly contextual-orchestrator repair gate
 
 ```mermaid
 flowchart TD
   Hour["Hourly product caller"]
   Sched["Central reusable scheduler"]
   Bind{"Exact-head, same-repo, writer authority, sealed paths?"}
   Worker["repository_dispatch worker at github.sha"]
-  NIM["NVIDIA NIM repair model"]
+  Gateway["contextual-orchestrator sidecar: orchestrator/free"]
   Recheck{"Post-edit exact-head revalidation?"}
   Push["Push same-repository head"]
   Hold["Leave the tree unchanged"]
@@ -65,15 +65,17 @@ flowchart TD
   Sched --> Bind
   Bind -->|"no"| Hold
   Bind -->|"yes"| Worker
-  Worker --> NIM
-  NIM --> Recheck
+  Worker --> Gateway
+  Gateway --> Recheck
   Recheck -->|"no"| Hold
   Recheck -->|"yes"| Push
 ```
 
 The worker checks out helpers at `${{ github.sha }}` so a later default-branch
-push cannot replace privileged scripts after dispatch (CWE-367). Repair binds
-`NVIDIA_NIM_API_KEY`, never `COPILOT_GITHUB_TOKEN`.
+push cannot replace privileged scripts after dispatch (CWE-367). Repair provisions the vendored
+contextual-orchestrator gateway sidecar (ADR-0003), which auto-discovers upstream models from five
+KV-registered provider secrets including `NVIDIA_NIM_API_KEY`; it never binds one provider
+directly, and never uses `COPILOT_GITHUB_TOKEN`.
 
 Product callers stagger Clearfolio at minute 23, DiskSage at minute 37, and
 fast-mlsirm at minute 49. Each caller is read-only, dispatches at most one
@@ -109,7 +111,7 @@ sequenceDiagram
   participant MS as Merge scheduler
 
   PR->>RW: pull_request_target on trusted base
-  RW->>OC: bounded evidence + NVIDIA NIM / OpenCode
+  RW->>OC: bounded evidence + contextual-orchestrator/orchestrator/free / OpenCode
   OC->>SV: PoC command in isolated copy
   SV-->>OC: redacted stdout/stderr + command metadata
   OC-->>PR: APPROVE or request changes
@@ -135,9 +137,15 @@ sequenceDiagram
 - Logs and review receipts redact credential shapes (tokens, bearer values,
   known provider prefixes). They do not mask operational PII that the
   control plane must process.
-- LLM and scheduled agents bind `NVIDIA_NIM_API_KEY` (env may be
-  `NVIDIA_API_KEY`). They never use `COPILOT_GITHUB_TOKEN`. Existing
-  review-agent key schemes stay unchanged.
+- Every LLM-bearing review and scheduled-repair workflow routes model traffic
+  through the vendored contextual-orchestrator gateway. OpenCode and Noema remain
+  independent read-only verdict controls with their existing credential mappings,
+  while the write-capable scheduled repair worker uses
+  `contextual-orchestrator/orchestrator/free`; sharing the gateway does not merge
+  their credentials, privileges, or verdict authority. The gateway discovers
+  eligible upstream routes from the credentials actually available to that
+  workflow instead of binding a provider directly. None of these paths uses
+  `COPILOT_GITHUB_TOKEN`.
 - Rust remains the psychometric arithmetic owner. Repair never substitutes
   Python for scoring math.
 - Downloaded SBOM and distribution bytes are inert. The signing job does

docs/automation/hourly-review-repair.md

@@ -12,13 +12,19 @@ engine**.
   contextual-orchestrator, Inkspan, or another CWL service with an explicit
   repository and base branch.
 - `pr-review-autofix.yml` is the bounded write-capable worker. It uses OpenCode
-  with NVIDIA NIM and does not approve or merge pull requests.
-
-Orgmetra's caller remains provider-neutral. The intended model boundary is the
-contextual-orchestrator gateway: provider keys stay in its KV registry and
-automatic model discovery selects upstream models. A caller schedule is not
-evidence that gateway credentials, discovery, or a live OpenCode tool loop are
-available; those facts require exact worker-run evidence.
+  routed through the vendored contextual-orchestrator gateway and does not approve or merge pull
+  requests.
+
+Every product caller, Orgmetra included, is provider-neutral by construction: the worker's model
+boundary is the contextual-orchestrator gateway (ADR-0003). Available provider credentials (Bytez,
+NVIDIA NIM primary/sub, OpenRouter, and the separately governed OpenAI credential) stay in the
+sidecar's process-local registry; discovery selects only routes eligible for the requested virtual
+model policy. An individual provider credential may be absent without making the gateway invalid.
+For scheduled repair, the fail-closed `contextual-orchestrator/orchestrator/free` path proceeds with
+remaining eligible providers and fails only when required gateway configuration is unavailable or
+discovery yields no eligible free-tier route. A caller schedule is not evidence that gateway
+configuration, discovery, or a live OpenCode tool loop are available; those facts require exact
+worker-run evidence.
 
 Merge eligibility remains owned by the separate merge scheduler, branch
 protection, required checks, independent review, and unresolved-thread policy.
@@ -43,9 +49,10 @@ The scheduled heartbeat is `23 * * * *`. Repository-scoped concurrency and
 not overlap its successor. At most one repair dispatch is created per run.
 
 The caller passes only the established `PR_REVIEW_MERGE_TOKEN` and
-`OPENCODE_APPROVE_TOKEN` scheduler credentials. It does not receive or forward
-`NVIDIA_NIM_API_KEY`; the model credential is scoped exclusively to the two
-OpenCode execution steps in the separately reviewed autofix worker.
+`OPENCODE_APPROVE_TOKEN` scheduler credentials. It does not receive or forward any of the five
+gateway provider secrets; those are scoped exclusively to the sidecar-provisioning step in the
+separately reviewed autofix worker (see
+[`docs/doctoring/hourly-nvidia-nim-autofix.md`](../doctoring/hourly-nvidia-nim-autofix.md)).
 
 ## Orgmetra execution contract
 
@@ -199,7 +206,11 @@ organization-level queue inspection and bounded repair dispatch.
 When a scheduled run fails, classify the result before rerunning:
 
 - no actionable file-scoped feedback: expected no-op;
-- missing `NVIDIA_NIM_API_KEY`: central secret configuration failure;
+- missing required sidecar configuration (`CONTEXTUAL_ORCHESTRATOR_BASE_URL` or
+  `CONTEXTUAL_ORCHESTRATOR_TOKEN_FILE`): central gateway configuration failure;
+- one or more individual provider credentials absent: continue discovery with
+  the credentials that are available; classify a model-admission failure only
+  if the requested policy has no eligible route after discovery;
 - head changed: safe optimistic-concurrency refusal; inspect the new head rather
   than retrying predecessor evidence;
 - out-of-scope or ignored-path change: treat as a security failure and preserve
@@ -225,8 +236,9 @@ Permanent tests prove:
 - the dispatch budget and same-head retry floor remain one;
 - caller and reusable-workflow secrets are explicit and never use
   `secrets: inherit`;
-- immutable source, NVIDIA-only model authentication, child-process credential
-  stripping, live-head guards, and independent reviewer identity remain intact;
+- immutable source, gateway-only model authentication (never a directly bound provider key),
+  child-process credential stripping, live-head guards, and independent reviewer identity remain
+  intact;
 - ordinary and conflict repair share the complete ignored-inclusive snapshot and
   NUL-delimited allowlist boundary;
 - the RCA and remediation-feasibility gate prevents speculative or