refactor(ddd): restore contextual-orchestrator ownership boundary

[seonghobae]

Scope

Restores the DDD/source-of-truth boundary between LineageWeave and ContextualWisdomLab/contextual-orchestrator.

LineageWeave owns product measurement/evidence policy and consumes the published orchestrator contract. Provider credentials, provider endpoints, model-agent bootstrap, provider/model discovery, routing and fallback remain in contextual-orchestrator.

Changes

• architectural fitness regression rejects LineageWeave-owned provider configuration or an embedded orchestrator runtime;
• removes docker/contextual-orchestrator/{Dockerfile,agents.json,start.py} and its obsolete bootstrap test;
• removes the local orchestrator Compose service; backend/MCP consume only externally supplied ORCHESTRATOR_BASE_URL / ORCHESTRATOR_API_KEY;
• removes provider/gateway settings from .env.example;
• Keyman and LLM channel-weight operator paths refuse provider-gateway credential fallbacks;
• ADR 0300, Context Map, ubiquitous-language and changelog evidence describe the consumer boundary;
• historical Vision doctoring no longer presents provider-gateway variables as current LineageWeave configuration.

Fail-closed behavior

With no contextual-orchestrator consumer endpoint/credential configured, model-backed channels remain unavailable rather than calling a provider directly. No provider key or provider URL is accepted as an orchestrator credential.

TDD / review evidence

The architecture-fitness RED began at 88ad120a22fd286306e0ba49e66eb2b670c22ebc; subsequent commits remove the causes. A documentation audit then found docs/doctoring/ACTUAL_RUNTIME_EVIDENCE_2026-08-19_VISION.md still described LLM_GATEWAY_API_URL / LLM_GATEWAY_API_KEY as current LineageWeave configuration; 379c44b0eb09bfb8b3aa087acd7b7729482a4360 corrected that statement while preserving the historical experiment.

Fresh ancestry review on 47ebceeffe1c8f5ceecc19a5768028b76c8605b5 found the branch six protected commits behind main at merge base b0e94aa2a6f7a943f96dc5c4f2fdecd0021978a1. Review 5118102878 records the wrong-base finding. RED 1f70eb57f77503db067b96c345c39795ab894ec4 first adopted the current executable workflow contract while the branch still carried stale workflow definitions. Repairs b008a4f4744a8917a31e1e6979ab8997e937cf02, 3780bfab8d6df9dadddabc6af7d85f5166b1a08c, and 6dbf089d7c6ac55e46def95bc6afddff9a087f1b adopted the exact protected Tests, PROV-O, and Ontology Pages Draft-admission contracts. Two-parent non-force convergence e5711282c48cc20d0a88fb56a9e382d500989c72 then joined the repaired tree to protected main@83eba56149eb802cd63642c507c324c9976ec78e without rewriting the ownership-boundary delta.

Exact live identity / governance

• protected base: main@83eba56149eb802cd63642c507c324c9976ec78e;
• exact current head: e5711282c48cc20d0a88fb56a9e382d500989c72;
• Draft/open/mechanically mergeable;
• exact-head repository-local Tests 33923013869 completed skipped, proving Draft admission is active without allocating the product test lane;
• exact-head Security 33923013891, SAST 33923013866, and CodeQL 33923013917 remain queued, so exact-head GREEN is not claimed;
• predecessor checks/reviews do not transfer and no qualifying independent approval is claimed.

Keep Draft until unchanged-current-head security/governance evidence is terminal-clean and the required independent review is present. Do not self-approve, bypass, weaken gates, or inherit predecessor evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head local evidence for 2368b9052f33c77c33b72ac87264efd4b7b9cbff:

• docker compose config --quiet passed; services no longer include an embedded orchestrator.
• Owner-boundary, DDD fitness, client/default, and documentation checks: 39 passed.
• Full collection: 1,889 passed, 17 skipped; 10 live API failures all reduce to the known migration-fixture drift already repaired on PR fix(voice): distinguish carrying and evidence exports #780.

This PR remains draft until #780 lands (or its exact fix is otherwise present) and current-head hosted checks/review are terminal. No provider credentials or production records were inspected.

[seonghobae]

Fresh ancestry review: this head still diverges from protected main at merge base b0e94aa… and is six protected commits behind. The protected-only delta is the repository-local Draft-admission workflow contract in .github/workflows/{tests,prov-o-contract,ontology-pages}.yml plus tests/test_tests_workflow_contract.py; those paths are disjoint from this PR's surviving contextual-orchestrator ownership-boundary delta. Treat the wrong base as a repair finding, not a close condition. I will first adopt the current executable workflow contract as a realistic RED against the stale workflow files, then adopt the exact protected workflow blobs and non-force converge this branch to main@83eba561…. Descendant #902/#915/#919 must then be advanced without force so their valid domain deltas remain stacked on the moved parent.