chore(metadata): add public-surface desired state wave 2

.github/actions/noema-review/two_phase.py

@@ -167,20 +167,16 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     changed_files = gate.fetch_changed_files(repo, number)
     changed_paths = tuple(file_path for file_path, _status in changed_files)
     review_context = gate.build_review_context(repo, number, pull_request, changed_files)
-    try:
-        verdict = gate.call_llm(
-            repo,
-            number,
-            pull_request,
-            diff,
-            truncated,
-            expected,
-            review_context,
-            changed_paths,
-        )
-    except gate.StaleHeadDuringRepairRetryError:
-        print("Pull request head changed during model repair retry; verdict was not sealed.")
-        return 0
+    verdict = gate.call_llm(
+        repo,
+        number,
+        pull_request,
+        diff,
+        truncated,
+        expected,
+        review_context,
+        changed_paths,
+    )
 
     _write_envelope(
         path,

.github/actions/orchestrator-free-sidecar/action.yml

@@ -0,0 +1,40 @@
+name: Orchestrator free sidecar
+description: Provision the immutable contextual-orchestrator orchestrator/free gateway for a model-backed workflow.
+inputs:
+  require_zdr:
+    description: Require an attested Zero Data Retention route for private or internal content.
+    required: false
+    default: "false"
+  catalog_limit:
+    description: Maximum discovered route catalog size for the sidecar preflight (a candidate list probed lazily to a readiness target, ADR-0029).
+    required: false
+    default: "24"
+  catalog_account_cap:
+    description: Maximum routes admitted from one credential account.
+    required: false
+    default: "8"
+runs:
+  using: composite
+  steps:
+    - name: Checkout immutable central sidecar source
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        repository: ContextualWisdomLab/.github
+        ref: ${{ github.action_ref }}
+        path: ${{ runner.temp }}/cwl-control-plane
+        persist-credentials: false
+    - name: Provision contextual-orchestrator orchestrator/free
+      shell: bash --noprofile --norc -e -o pipefail {0}
+      env:
+        CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR: ${{ inputs.require_zdr }}
+        ORCHESTRATOR_CATALOG_LIMIT: ${{ inputs.catalog_limit }}
+        ORCHESTRATOR_CATALOG_ACCOUNT_CAP: ${{ inputs.catalog_account_cap }}
+      run: |
+        set -euo pipefail
+        control_plane="${RUNNER_TEMP}/cwl-control-plane"
+        sidecar="${control_plane}/scripts/ci/contextual_orchestrator_review_sidecar.sh"
+        if [ ! -f "$sidecar" ] || [ -L "$sidecar" ]; then
+          echo "::error::Immutable central contextual-orchestrator sidecar source is missing or symlinked."
+          exit 1
+        fi
+        bash "$sidecar"

.github/workflows/agent-mention-noema-dispatch.yml

@@ -9,9 +9,18 @@ on:
     types: [agent-mention-noema]
 
 concurrency:
-  group: agent-mention-noema-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
-  cancel-in-progress: false
-  queue: max
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -9,9 +9,18 @@ on:
     types: [agent-mention-opencode]
 
 concurrency:
-  group: agent-mention-opencode-${{ github.event.client_payload.agent_invocation_key || github.run_id }}
-  cancel-in-progress: false
-  queue: max
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
 
 permissions:
   contents: read

.github/workflows/agent-mention-router-quality-ci.yml

@@ -29,7 +29,7 @@ on:
       - "requirements-opencode-review-ci-hashes.txt"
 
 concurrency:
-  group: agent-mention-router-quality-${{ github.event.pull_request.number || github.ref }}
+  group: agent-mention-router-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 permissions:

.github/workflows/agent-mention-router.yml

@@ -27,8 +27,8 @@ jobs:
         || contains(github.event.comment.body, '/oc')
       )
     concurrency:
-      group: review-agent-mention-router-local-${{ github.repository }}
-      queue: max
+      group: review-agent-mention-router-local-${{ github.repository }}-${{ github.event.issue.number || github.run_id }}
+      cancel-in-progress: true
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions: