Route hourly LLM-calling workflow through contextual-orchestrator (orchestrator/free) in `.github/workflows/hourly-product-development.yml`

[seonghobae]

Gap

Protected main@87c4daa1830bac5a5228b6036752ad5633232085 still runs .github/workflows/hourly-product-development.yml through a repository-local NVIDIA NIM broker. Fresh repository search shows the model-backed path still materializes NIM_UPSTREAM_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}, while AGENTS/README/TRD/TEST_STRATEGY/ADR/UML and repository-contract tests still describe or positively require that provider-specific boundary. OriginWeave contains no current orchestrator/free contract.

This duplicates model-provider/key discovery and routing authority in the browser runtime. OriginWeave owns its deterministic hourly/browser gates, isolated workspace, and caller-side evidence/admission contract; ContextualWisdomLab/contextual-orchestrator owns provider discovery, capability routing/failover, and orchestrator/free. Deterministic browser/policy/security authority must remain outside the LLM path.

This is not authorization to copy contextual-orchestrator source, consume a mutable sibling head, rename one secret, or substitute a model string while retaining the provider-specific broker.

Current owner dependency

The repository-local broker exposes generation-bound causal evidence used by the retry loop, including request counters and typed distinctions for authentication rejection (401/403), rate limiting (429), provider/transport failure, and model/tool failure. Removing it without an equivalent public owner contract would weaken fail-closed operability.

The canonical prerequisite remains ContextualWisdomLab/contextual-orchestrator#1016, which is open and explicitly owns the bounded request-correlated provider/routing outcome surface for long orchestrator/free tool sessions.

Fresh owner-path verification on 2026-09-08:

• contextual-orchestrator protected main@414f22973658c4ddc3d4320fcf7acd9b4e8ba991 implements/documents orchestrator/free, but the repository currently has no GitHub Release; ADR 0007 for the hourly orchestrator/free pin is still Proposed. OriginWeave therefore must not treat mutable CO main as a released dependency.
• central ContextualWisdomLab/.github@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db already demonstrates the intended authority split for review agents: OpenCode/Noema/Strix use the contextual-orchestrator sidecar and contextual-orchestrator/orchestrator/free, with no direct NVIDIA model candidate in the active dispatch contract.
• the central CI-duplication audit classifies repository hourly-product-development.yml workflows as NOT_SAFE to consolidate wholesale. The repair must therefore preserve OriginWeave-specific deterministic gates locally and centralize only the provider/gateway segment behind an approved immutable owner boundary.

If no released or immutable exact-SHA central gateway/reusable boundary exists for that segment when #1016 lands, the missing reusable boundary is a .github/contextual-orchestrator prerequisite. OriginWeave remains fail closed until it is published; do not vendor mutable owner source.

Required RED → repair sequence

1. Re-read protected OriginWeave and the exact owner contracts. Do not edit the leaf workflow from a writer that lacks .github/** authority.
2. Add a repository-contract RED proving every model-backed GitHub Actions path uses only the approved central gateway token and orchestrator/free; the OriginWeave caller must contain no NVIDIA_NIM_API_KEY, NIM_UPSTREAM_API_KEY, provider/model/group selection, or paid fallback authority.
3. Preserve the broker’s useful causal semantics by consuming the released/versioned #1016 outcome contract through a narrow ACL/adapter: distinguish at least auth rejection (401/403), rate limiting (429), transport/provider unavailability, selected/attempted/served candidate identity, caller cancellation/deadline, and structured model/tool failure where the owner contract supplies them.
4. Replace only the provider/bootstrap/routing segment with an approved immutable central gateway adapter or exact-SHA reusable boundary. Keep deterministic pre-model admission, browser security, workspace isolation, and non-model product gates local.
5. Capability absence or policy incompatibility fails closed and is repaired in the canonical owner; OriginWeave must not add direct provider fallback.
6. Update AGENTS, README, TRD, TEST_STRATEGY, DATA_GOVERNANCE, ADR 0009/0109 or their superseding ADRs, UML, CHANGELOG, and repository tests so documentation and executable contracts agree.
7. Verify the exact consumer head with repository-native contracts/security and applicable central required workflows. A queued, skipped, predecessor, status-only, synthetic, or model-only result is not acceptance.

Model/session semantics that must survive migration

• GitHub Actions model route is fixed to orchestrator/free; no provider, provider group, paid fallback, or repository-authored model candidate list.
• Model timeout defaults to null. User cancellation, provider end, and an explicitly authorized administrative timeout remain distinct terminal causes; elapsed time alone must not terminate reasoning/stream/tool-call work.
• Long OpenCode/Noema/Strix-style tool sessions remain permitted when policy allows them.
• The agent workspace receives no raw provider credential or provider response body. Provider bootstrap secrets, if required by deployment, remain inside the trusted contextual-orchestrator gateway boundary.
• Browser capability, deterministic policy, approvals, origin/destination authority, secrets, and Git/GitHub write authority are never granted by model output or by the gateway migration.

Acceptance

1. contextual-orchestrator#1016 is protected and published through an immutable versioned contract suitable for a long tool-bearing orchestrator/free caller.
2. OriginWeave consumes that released contract through a versioned ACL/adapter or an approved central exact-SHA reusable gateway boundary; it does not consume mutable sibling source.
3. .github/workflows/hourly-product-development.yml has no direct NVIDIA/provider credential materialization or direct provider/model/group/paid-fallback selection in the OriginWeave-owned caller.
4. orchestrator/free plus the approved gateway credential boundary is the only model-backed Actions route.
5. Existing deterministic non-model gates still execute without model credentials; model/gateway unavailability fails only the model-backed lane and does not weaken browser/security policy.
6. Contract tests cover gateway pin/version, route id, secret boundary, direct-provider absence, bounded owner outcome evidence, cancellation/end/timeout semantics, and fail-closed capability absence.
7. README/AGENTS/TRD/TEST_STRATEGY/DATA_GOVERNANCE/ADR/UML/CHANGELOG are code-current and no longer claim the repository-local provider broker as canonical authority.
8. Exact-head repository CI, 100% owned-production coverage where applicable, security and current central merge gates pass without gate weakening.
9. This migration does not claim [Product Gap] Complete the first real Chromium agent vertical slice #28, [Product Gap] Publish a stable BAP/MCP runtime API with resumable task lifecycle #200, or a product release complete.

Protected-main AGENTS currently forbids this scheduled product writer from mutating .github/**; workflow source changes require the authorized workflow-owner path. Keep this issue open until both the immutable owner prerequisite and the exact-head OriginWeave migration are complete.

[seonghobae]

Investigated; staying tracked (not migrating blind this pass)

Cloned OriginWeave fresh and read .github/workflows/hourly-product-development.yml
end to end (945 lines), plus the reference pattern in ContextualWisdomLab/.github
(scripts/ci/contextual_orchestrator_review_sidecar.sh, pr-review-autofix.yml)
and ContextualWisdomLab/contextual-orchestrator's own opencode-hourly-loop.yml.
Confirmed the lead: OPENCODE_MODEL_CANDIDATES (3 nvidia-nim/... model ids) and a
loopback broker hardcoded to HOST = "integrate.api.nvidia.com" on 127.0.0.1:8765.

This isn't a model-string swap. Two concrete, repo-specific things sit on top of the
direct NVIDIA call and would either break or silently lose fidelity under the proven
sidecar pattern:

1. Per-attempt causal provider telemetry the retry loop depends on.
The broker's /statusz endpoint tracks generation-bound request_counter /
last_auth_rejected_request (401/403) / last_rate_limited_request (429) so the
workflow's own fallback loop (for model in $OPENCODE_MODEL_CANDIDATES) can
classify each attempt as provider_auth_rejected, provider_rate_limited,
credential_broker_unavailable, model_timeout, or model_or_tool_failure and
decide per ADR-0009 whether cross-model fallback is feasible. This is a binding
ADR decision (docs/adr/0009-hourly-agent-credential-boundary.md, "Retry decisions
require causal provider evidence"), with an explicit "Alternatives rejected" entry:
"Use broker /healthz alone to authorize model fallback. Rejected because process
liveness does not prove provider authentication, authorization, or capacity."
The vendored contextual-orchestrator sidecar's caller-visible surface is exactly
that: /healthz plus a single /v1/chat/completions preflight, with the 401/429
provider-outcome handling internalized inside the gateway's own multi-provider
routing (that's the point of orchestrator/free auto-discovery/fallback — it's
opaque to the caller by design). Swapping the broker for the gateway without
replacing this telemetry would either break contract tests outright or require
silently discarding the causal-RCA distinction ADR-0009 requires.

This is pinned by ~340 lines of existing contract tests, not just prose:
tests/test_provider_retry_feasibility_contract.py (asserts /statusz,
"last_auth_rejected_request", cause=provider_auth_rejected,
cause=provider_rate_limited, ordering vs. model_or_tool_failure) and
tests/test_hourly_provider_success_contract.py (pins the broker's own source,
including the 127.0.0.1:8765 bind). tests/test_hourly_product_development_contract.py
additionally pins the integrate.api.nvidia.com:443 Harden Runner allowlist entry
and the exact OPENCODE_MODEL_CANDIDATES loop structure.

2. Workload shape the proven pattern hasn't been validated for.
Every existing orchestrator/free adopter in the org is a short, "bash": "deny"
review/verification agent (the four .github review workflows) or uses
orchestrator/auto rather than /free for its own repo-maintenance work
(contextual-orchestrator's opencode-hourly-loop.yml, which deliberately isn't
/free — .github's sidecar script hard-rejects any pool other than free for
review workflows specifically). OriginWeave's hourly loop is a up-to-35-minute
(OPENCODE_RUN_TIMEOUT_SECONDS=2100), "bash": "allow" autonomous TDD session
(cargo build/test/clippy/coverage, iterative RCA-driven repair) run under strict
OS-level network isolation (UID 65532 + iptables egress block to loopback-only)
that only works because the model traffic is proxied through one local broker on
one port. There's no existing evidence in this org that orchestrator/free is
proven for a session this long and this tool-privileged; that's a materially
different risk profile than the short review completions the pattern has actually
shipped for twice.

What would make this safe to migrate

• contextual-orchestrator's gateway (or the vendored sidecar) exposing equivalent
  generation-bound, per-attempt provider-outcome telemetry the workflow can consume
  for its own retry decision — or an explicit, reviewed decision that the gateway's
  internal routing supersedes ADR-0009's caller-visible RCA requirement (that's an
  ADR change, not an implementation detail, since ADR-0009's "Alternatives rejected"
  section directly forecloses trusting /healthz-only liveness for fallback).
• An explicit owner/architecture call that orchestrator/free (vs. /auto, or a
  new pool) is intended for long, bash: allow, tool-heavy autonomous coding
  sessions, not just short review completions — since no repo in the org currently
  runs that shape against /free.
• Once those are settled, tests/test_provider_retry_feasibility_contract.py,
  tests/test_hourly_provider_success_contract.py, and the two other contract
  files above updated deliberately to the new contract, not left broken or
  silently loosened.

Leaving this open with these findings rather than shipping a guess that either
fails CI's own contract tests or quietly drops the causal-RCA fallback guarantee
ADR-0009 was written to require.

[seonghobae]

Fresh owner-boundary follow-up: I rechecked the direct broker contract instead of replacing it blindly. The current workflow's provider-specific /statusz evidence is not just liveness; ADR-0009 and the existing contract tests consume generation-bound auth/rate-limit/provider outcome evidence for retry feasibility. The current contextual-orchestrator migration path must therefore preserve that causal evidence rather than silently downgrade it to /healthz.

I also found existing contextual-orchestrator owner work that materially narrows the gap: #977 adds inference-scoped /v1/provider_readiness, #993 keeps explicit orchestrator/free on the single-worker route path for long prompts, and #1013 moves contextual-orchestrator's own hourly OpenCode loop to /free. None of those PR bodies alone proves that the leaf can correlate 401/403/429 and attempted/served route evidence to each long tool-bearing attempt.

Opened the missing owner contract as ContextualWisdomLab/contextual-orchestrator#1016 with RED/GREEN acceptance for bounded secret-safe per-request provider/routing outcome evidence, tool-bearing /free fallback, long-session validation, and a versioned consumer contract. OriginWeave should consume that owner contract through its workflow adapter once protected/released; it should not copy provider-routing internals or weaken ADR-0009 to make the migration easier.

Until that owner contract exists, this issue remains a real routing-policy violation and an integration blocker, not permission for direct-provider calls to become accepted architecture.

[seonghobae]

Fresh canonical-owner dependency audit, 2026-09-07 KST. contextual-orchestrator#1016 remains open, so OriginWeave must not migrate the hourly workflow yet. Owner PR contextual-orchestrator#1049 has advanced to exact head 13e8c29c118fb59da7bbb1206ecee5cfc5f46564: it now adds the missing real upstream HTTP 500 failover acceptance fixture, while current source Security and Quality 34074096528, Security Scan 34074096499, and SAST 34074096474 are terminal success; CodeQL PR 34074096521 remains terminal failure and therefore is not protected/released acceptance.

More importantly, #1049 still does not close the consumer contract required here. Its bounded selected/attempted candidate receipt is attached to terminal error evidence; a successful fallback still returns the upstream success body directly, so an OriginWeave caller receives no versioned request-correlated selected/attempted/served receipt. Caller cancellation/deadline is also not represented by the published consumer surface. Those are exactly the remaining #1016 acceptance items identified by the owner itself.

OriginWeave action remains fail-closed and unchanged: do not copy provider routing, infer served provenance from a model string, weaken ADR-0009, or edit the scheduled workflow from this product-writer lane. Resume #276 only after #1016 yields a protected/released versioned outcome contract for both success and failure, then consume it through the authorized workflow-owner path and regenerate exact-head long tool-session evidence with orchestrator/free.