fix(ci): delegate hourly LLM routing to released orchestrator

AGENTS.md

@@ -15,14 +15,14 @@ TEPP is the Temporal Event Psychometrics Platform: a multilingual, temporal, rel
 7. Multilingual measurement uses one shared latent semantic space. Language-specific morphology and lexical emissions may vary, but equivalent meanings must be aligned and tested for measurement invariance.
 8. Production line and branch coverage are 100%. All public modules, traits, structs, enums, functions, methods, error variants, configuration fields, and safety contracts have complete docstrings.
 9. Scientific acceptance requires realistic synthetic truth: parameter recovery, RMSE, bias, interval coverage, temporal ordering, graph recovery, invariance, and CPU/GPU parity. Skipped or ignored GPU tests are not evidence.
-10. LLM live tests use `NVIDIA_NIM_API_KEY`. `COPILOT_GITHUB_TOKEN` is prohibited. Existing independent review-agent credentials must not be repurposed.
-11. LLM orchestration allocates test-time computation between direct routing and deeper multi-agent workflows. Workflow depth, decomposition, access lists, recursion, role-specific reasoning effort, verification/adjudication, and comparable-budget ablations are recorded. LLM output never replaces deterministic/statistical scientific authority.
+10. Every semantic LLM operation and every model-backed GitHub Actions workflow goes through a released, versioned `contextual-orchestrator` contract. Actions use the `orchestrator/free` route through the gateway credential only; TEPP must not select a provider/model/group, declare a paid fallback, call providers directly, or consume provider API keys such as NVIDIA NIM, OpenRouter, OpenAI, or Bytez credentials. If the released orchestrator contract cannot supply the required capability, fail closed and repair the canonical owner before consumer adoption. `COPILOT_GITHUB_TOKEN` is prohibited. Independent review-agent credentials must not be repurposed as execution credentials.
+11. LLM orchestration allocates test-time computation between direct routing and deeper multi-agent workflows. Workflow depth, decomposition, access lists, recursion, role-specific reasoning effort, verification/adjudication, and comparable-budget ablations are recorded. LLM output never replaces deterministic/statistical scientific authority. Model timeout defaults must not terminate reasoning/stream/tool-call work merely because elapsed time is long; user cancellation, provider termination, and explicit administrative limits remain distinct outcomes.
 12. Database object names contain at least two words and use `snake_case` by default. CamelCase or PascalCase is permitted only where language conventions require it.
 13. Every scientific or standards claim is traced to an authoritative primary source and cited in APA 7th style in `docs/research/`.
 14. Changes that alter latent-variable meaning, temporal semantics, event ontology, multilingual invariance, estimator targets, privacy authority, or service authority require an ADR and a PRD version change when the approved product/measurement target changes.
 15. Do not blanket-mask PII when doing so destroys valid authorship, temporal, longitudinal, event, entity-role, or multiple-membership measurement. Use purpose-bound authorization, opaque analytical identifiers, separately protected identity mapping, encryption, selective disclosure, retention/deletion, and auditable privileged access.
 16. Design toward CSAP and SOC 2 evidence readiness and align AI governance with current published ISO/NIST guidance where applicable, but never claim certification, attestation, conformance, or legal sufficiency without external evidence.
-17. Preserve standalone operation and modular MSA composition. `naruon`, `contextual-orchestrator`, and other CWL services integrate through versioned APIs/artifacts; no direct cross-service application-table access is permitted.
+17. Preserve standalone operation and modular MSA composition. `naruon`, `contextual-orchestrator`, and other CWL services integrate only through released/versioned APIs or immutable artifacts plus explicit ACLs; no direct cross-service application-table access or mutable sibling-head dependency is permitted.
 18. Documents, external metadata, serialized payloads, model checkpoints, and LLM outputs are untrusted until their owning boundary validates identity, provenance, size/depth, authorization, and scientific semantics.
 19. Figma/Product Design becomes authoritative only for a stable product interaction contract; UI design never overrides the PRD, data model, numerical/scientific contract, or protected-main implementation truth.
 

CHANGELOG.md

@@ -38,6 +38,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ## [Unreleased]
 
+- Hourly contextual-orchestrator bootstrap now admits only discovery rows whose provider-reported prompt and completion token prices are both present and exactly `0.0` before cheapest ranking. Paid, partial, missing, and fully unpriced rows stay out of the general-chat pool; an empty explicitly-free pool fails closed with no paid fallback. Secret-free discovery evidence records admitted free candidates and excluded non-free candidates. ADR 0017 and the hourly runbook document the same boundary. The checksum-pinned contextual-orchestrator revision is unchanged; unknown price is not treated as free.
+
 - `event_core` adds bounded Allen interval-consistency classification, atomic path-consistency closure, contradiction/resource refusals, and an explicit dependency-error fallback without claiming unrestricted global satisfiability.
 
 - `psychometric_core` recovers the Driver, Oud, and Voelkle (2017, Table 2, p. 12 `MANIFESTTRAITVAR`; §7.1, p. 19; p. 16 `MANIFESTTRAITVARstd`; footnote 4; 2017-era ctsem `summary.ctsemFit.R`; JSS PDF re-opened 2026-08-27T14:20Z from https://www.jstatsoft.org/index.php/jss/article/download/v077i05/1104) scalar standardised manifest-trait variance on current main after `0ce16e8` dropped the pre-consolidation code while research notes already named the map (register items 83–84). Table 2 names `MANIFESTTRAITVAR` `Ψ_τ` the additional time-invariant variance-covariance on the measurement level and sets it `NULL` when there is no manifest trait. Equation 5 writes `Γ ~ N(τ, Ψ)` and names that covariance the manifest traits. Section 7.1 names manifest traits stable individual differences in indicator levels, distinct from process-level `TRAITVAR` `φ_ξ`. Page 16 prints standardised matrices with the suffix `std` when appropriate. The printed example on p. 16 is `discreteDRIFTstd`, not `MANIFESTTRAITVARstd`. Footnote 4 standardises using only the relevant variance, not the total. The relevant variance for that named indicator-level correlation is `MANIFESTTRAITVAR`, not process-level `TRAITVAR` and not residual `MANIFESTVAR` `θ`. The 2017-era source forms `MANIFESTTRAITVARstd` only when `MANIFESTTRAITVAR != 0`, as `solve(sqrt(diag(MANIFESTTRAITVAR) + ridging)) %&% MANIFESTTRAITVAR` when `verbose = TRUE`. OpenMx `%&%` is `t(A) %*% B %*% A`. Unlike `TRAITVARstd`, that formation adds `diag(c(ridging), n.manifest)`. The default `ridging = FALSE` adds 0, not `0.0001`; that ridge is a numerical hack and is not this exact map. The scalar correlation is `ψ / ψ = 1` after strictly positive `MANIFESTTRAITVAR`. Form strictly positive `ψ` first, then `1 / √ψ`, then `(1 / √ψ) ψ (1 / √ψ)`. Unstandardised `MANIFESTTRAITVAR` is defined for a zero trait; standardised `MANIFESTTRAITVAR` is not. Zero `MANIFESTTRAITVAR` skips forming `MANIFESTTRAITVARstd` in the 2017-era source and fails closed here. Indicator-level trait variance is an event-time structural quantity, so a non-event clock fails closed. `MANIFESTTRAITVAR` does not require stable `a < 0`. Distinct positive `ψ` recover the same 1. `trait / trait = 1` is `TRAITVARstd` and recovers the same number and remains a distinct named quantity. `θ` is `MANIFESTVAR` and is measurement error, not this correlation. Meredith (1993) remains unread (web search 2026-08-27T14:20Z: Springer/Cambridge Core paywalled; Unpaywall historically `is_oa: false`; Springer `content/pdf` is an HTML stub). Mislevy (1991, *Psychometrika, 56*, 177–196) remains unread on the same terms (DOI `10.1007/bf02294457`). Still not a Kalman filter, not a matrix `expm`, not ESEM estimation, not DSEM, and not ctsem estimation.

CONTRIBUTING.md

@@ -45,10 +45,11 @@ Use primary papers, international standards, official specifications, and offici
 
 - Treat all model output as untrusted structured input.
 - Preserve exact source spans and evidence identifiers.
-- Use `NVIDIA_NIM_API_KEY` for approved live tests.
-- Never use or introduce `COPILOT_GITHUB_TOKEN`.
-- Record provider, model, prompt hash, reasoning effort, workflow depth, tools/access list, seed where supported, latency, token usage, and cost.
-- Include direct-routing versus orchestrated and reasoning-effort ablations.
+- Route every semantic LLM operation and model-backed GitHub Actions workflow through a released, versioned `contextual-orchestrator` contract. GitHub Actions use only `orchestrator/free` through the contextual-orchestrator gateway credential.
+- Do not select or hard-code a provider, model, provider group, or paid fallback in TEPP, and do not expose provider API keys to TEPP workflows. If a released orchestrator contract cannot provide the required capability, fail closed and repair the canonical owner before adopting the change here.
+- Never use or introduce `COPILOT_GITHUB_TOKEN`, and never repurpose independent review-agent credentials as execution credentials.
+- Record the contextual-orchestrator release/contract identity, route, prompt hash, reasoning effort, workflow depth, tools/access list, seed where supported, latency, token usage, and cost. Record provider/model identity only when the released orchestrator returns it as execution provenance; it is evidence, not TEPP routing authority.
+- Include direct-routing versus orchestrated and reasoning-effort ablations where scientifically relevant. LLM output never replaces numerical estimation or scientific acceptance.
 
 ## Database naming