fix(nim): preserve current hosted-access evidence on trusted branch

[seonghobae]

Outcome

Carries the complete effective delta from fork PR #1063 onto a trusted base-repository branch. A fresh exact-head failure in prerequisite #1066 has now exposed that the NIM evidence refresh must be integrated before the security-workflow stack rather than only as its child.

Current lineage

• predecessor fork: fix(nim): refresh hosted access evidence #1063 at efd8032a6902c2a7499be9ff921628fab491daeb
• current child/trusted head: 0cdc0307f0fd9f368f89eba3036c5538edbefb72
• current stacked base: ci(security): materialize stacked-PR validation on trusted branch #1066 51c8824e219c887425d2e7147e87f088d5f1a77d
• protected main: 2e414d15ba58f28597751b625a8a2f00fc9fadcf
• new foundation successor: fix(nim): refresh hosted access evidence before security stack #1069 b0bd71dfa5d6ca065052bc951ad9c9209b88413b, direct child of protected main

#1068 remains a valid trusted copy of the six NIM evidence blobs, but its stack position is no longer sufficient. #1066's repository Security and Quality run 33923471573, job 101186730296, executed on a real GitHub-hosted runner and failed 5 failed, 3390 passed, 2 skipped because protected main's evidence expired after 2026-09-04. That failure occurs before this child branch can contribute its refreshed evidence.

Fresh official NVIDIA Run NIM Anywhere documentation was re-reviewed on 2026-09-05 and still states free hosted NIM API endpoint access for NVIDIA Developer Program prototyping while distinguishing production NVIDIA AI Enterprise licensing. #1069 therefore carries the same six reviewed evidence/test/doc blobs from this branch onto a clean main child without #1066's security-workflow ancestry.

Repair order

1. fix(nim): refresh hosted access evidence before security stack #1069 obtains exact-head gates and merges normally to protected main.
2. ci(security): materialize stacked-PR validation on trusted branch #1066 non-force restacks on the new protected main and reruns its two-file security-workflow contract.
3. This branch is then reconciled against the new ci(security): materialize stacked-PR validation on trusted branch #1066 descendant. If fix(nim): refresh hosted access evidence before security stack #1069 has fully inherited every valid semantic/test/doc delta from fix(nim): refresh hosted access evidence #1063/fix(nim): preserve current hosted-access evidence on trusted branch #1068, the resulting effective NIM delta should be empty and fix(nim): preserve current hosted-access evidence on trusted branch #1068 may be closed only as verified-successor lineage; otherwise retain and repair the residual delta.
4. Fork fix(nim): refresh hosted access evidence #1063 remains open until protected-main equivalence through the trusted successor is verified.

Evidence boundary

The six NIM files here are unchanged from the reviewed refresh: CHANGELOG.md, contextual_orchestrator/nim_benchmark.py, two NIM evidence docs, docs/product-technical-gap-baseline.md, and tests/test_nim_benchmark_release_acceptance.py. They preserve only time-bounded prototype-access evidence through 2026-10-04; no production price, licensing, support, or deployed-capacity claim is inferred.

Keep Draft. Historical checks do not transfer across the reordered stack, and no force push, destructive rebase, self-approval, no-op retrigger, admin bypass, or gate weakening is valid acceptance evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

이 PR은 #1073으로 대체되지 않았습니다 — 충돌 해소 완료

다른 세션의 레인 조정에서 이 PR이 "NIM 비용 근거 갱신 PR의 여섯 번째 중복이며 #1073(a080297d)이 이미 main에 반영했으니 supersession 코멘트 후 닫자"는 제안이 나왔습니다. 트리 대조 결과 그 판단은 이 PR에는 해당하지 않습니다.

main이 실제로 갖고 있는 것

$ git show origin/main:contextual_orchestrator/nim_benchmark.py | grep -n 'docs.api.nvidia.com'
116:    "source_url": "https://docs.api.nvidia.com/nim/docs/product",
2538:    if evidence["source_url"] != "https://docs.api.nvidia.com/nim/docs/product":

$ git grep -c 'nim/docs/run-anywhere' origin/main -- contextual_orchestrator/nim_benchmark.py
0

#1073이 실제로 바꾼 것 — 날짜 두 줄뿐

-    "reviewed_at_date": "2026-08-05",     +    "reviewed_at_date": "2026-09-05",
-    "valid_until_date": "2026-09-04",     +    "valid_until_date": "2026-10-05",

출처 문서는 건드리지 않았습니다.

이 PR의 고유 delta

이 브랜치는 인용 출처 자체를 교체합니다 — "NVIDIA NIM General FAQ" / /nim/docs/product → "Run NIM Anywhere" / /nim/docs/run-anywhere — 그리고 검증기(:2538)까지 함께 바꿉니다. run-anywhere는 main에 0건입니다. 날짜 갱신 PR이 아닙니다.

세 번째 축도 있습니다: .github/workflows/security.yml (+19/-6), tests/test_repository_security_metadata.py (+20/-3) — stacked-PR 보안 검증. 이것도 main에 없습니다.

.github의 AGENTS.md "Verifying a 'superseded — closing' claim" 규율대로, 중복처럼 보이는 것만으로는 닫을 근거가 되지 않으며 승계는 트리로 확인해야 합니다. 이 PR의 delta는 승계되지 않았습니다.

충돌 해소 (31e3c4da)

main과의 충돌 4파일을 해소해 push했습니다. 원칙은 이 브랜치의 출처 + main의 날짜입니다.

• 출처는 이 브랜치 것을 유지 — main이 건드린 적 없는 이 PR의 고유 delta이고, main 쪽을 고르면 이 PR이 no-op이 됩니다.
• 날짜는 main 것(2026-10-05)을 채택 — 기존 관례가 reviewed_at + 30일(base: 08-05 → 09-04)이고, main의 10-05가 그 관례를 따릅니다. 이 브랜치의 10-04는 하루 어긋난 값이었습니다.

충돌 마커 밖에 있던 함정 두 가지를 기록해 둡니다.

1. nim_benchmark.py:2538의 검증기가 충돌 없이 이 브랜치 값(run-anywhere)으로 auto-merge된 상태에서 L116만 충돌로 남았습니다. 충돌 마커만 보고 L116에서 main의 /product를 골랐다면 모듈이 자기 기본 evidence를 거부하게 됩니다(_validate_actual_cost_evidence가 source_url을 하드코딩 리터럴과 비교).
2. CHANGELOG.md:25가 해소 후에도 2026-10-04로 남아 있었습니다. 이 브랜치만 건드린 파일이라 충돌 없이 병합됐고, 해소 후 바뀐 값 전수 grep이 아니면 잡히지 않습니다.

충돌났던 테스트 mutation은 양쪽이 같은 테스트(match="validity precedes")를 각자 자기 날짜에 맞춰 조정한 것이었습니다. valid_until=2026-10-05에서는 이 브랜치 쪽 mutation(reviewed_at=2026-10-05)이 10-05 < 10-05 = False가 되어 예외가 발생하지 않으므로, main 쪽 mutation을 채택했습니다.

검증

python3 -m pytest tests -q  →  3396 passed, 1 skipped
잔여 conflict marker 0 · 잔여 2026-10-04 0

#1069/#1063은 확인하지 않았으므로 그쪽 판단은 보류합니다. 이 PR은 닫히면 안 됩니다.

[seonghobae]

Adjudication evidence (host 1 session, 2026-09-06 KST; full report with commands in #1080). Nothing here closes, flips, or retargets anything — the decision is the opener's.

Only member of the #1063/#1069/#1068 trio that is clean on current main (git merge-tree --write-tree origin/main refs/pr/1068 rc 0); GitHub's dirty is a criss-cross artifact (two merge bases a080297d/51c8824e) — a fresh non-force merge of the base tip collapses it. Base is #1066's head, so retarget to main only after #1066 lands (the history carries #1066's security.yml commits). Stack root for #911 / #1032 / #1034 / #1046, which each conflict with main only in the four inherited NIM files — merging base tip 31e3c4da into them is the fix, not per-PR conflict work.

Stale: the gap-baseline citation of #1063's 9928e4ab … 3394 passed is not this head's evidence; the body's "land #1069 first" repair order is obsolete since #1073. The claim that this PR supersedes #1063/#1069 is unverified (their patches embed the date lines main changed) — prove it after landing. Draft hold respected.