feat: add contextual review gateway bootstrap

[seonghobae]

Summary

• add a trusted CI sidecar entrypoint that bootstraps the five provider credentials into the process-local KV
• auto-discover available provider models, apply cost-ranked selection with unknown-price candidates retained only as fallback, and serve the authenticated OpenAI-compatible gateway
• isolate the review pool to general chat-capable models, fail closed when credentials, discovery, or selection are unavailable, and preserve loopback-only binding
• resolve the gateway bearer token from the credential KV after bootstrap; retain only an explicit --auth-token as a local-development override
• keep review capability tags factual and preserve cheapest-first routing after agent construction

Stack reconciliation

• Normal merge of contextual-orchestrator#770 exact head 6b603efeb9728d7c142f090153925948c0f1248f preserved the shared chat-capability boundary and provider-diverse, price-honest discovery selector instead of reintroducing the stale simpler ranking path.
• The resulting merge commit is 8d31fa50cc6de8ddc3e6b91576e7251c5aa7d914; fix(discovery): bootstrap an honest provider-diverse failover pool #770 remains independently reviewable and must satisfy its own protected merge gates.

Verification

• uv run --with pytest pytest tests/test_review_gateway.py tests/test_model_discovery.py tests/test_api_contract.py -q (37 passed)
• full repository suite: python -m pytest -q tests (1,566 passed in 9:48)
• focused review_gateway.py branch coverage: 100%
• Exact current head: 8d31fa50cc6de8ddc3e6b91576e7251c5aa7d914
• focused gateway/discovery/capability regression set: 148 passed
• CodeGraph index is healthy and up to date at the exact current head

This PR is intentionally limited to the gateway bootstrap and discovery-selection boundary; persistent production credentials remain the existing KV deployment concern.

---

Summary by CodeRabbit

• 새 기능

  • 채팅 전송 가능 여부와 일반 에이전트 사용 가능 여부를 구분합니다.
  • 임베딩·이미지·음성 등 비채팅 모델의 채팅 경로 사용을 차단합니다.
  • 모델 검색 시 기능 정보와 가격 검증을 강화하고, 제공자 다양성을 고려해 에이전트를 선택합니다.
  • 로컬 인증 리뷰 게이트웨이와 인증된 CLI 실행을 지원합니다.

• 버그 수정

  • 잘못되거나 불완전한 가격 정보를 무료 또는 최저가로 잘못 처리하지 않습니다.
  • 적절한 장애 조치 모델이 없을 때 명확한 오류를 표시합니다.
  • Passthrough 엔드포인트 경로를 일관되게 처리합니다.

• 문서

  • 모델 기능 격리 및 제공자 다양성 기반 라우팅 정책을 문서화했습니다.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 8d31fa50cc6de8ddc3e6b91576e7251c5aa7d914
• Workflow run: 32702062450
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 8d31fa50cc6de8ddc3e6b91576e7251c5aa7d914.

• Head SHA: 8d31fa50cc6de8ddc3e6b91576e7251c5aa7d914

• Workflow run: 32702062450

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (7 files)"]
  S1 --> I1["repository behavior"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["docs review"]
  Evidence --> S3["Test (10 files)"]
  S3 --> I3["regression suite"]
  I3 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V3["targeted test run"]

Loading

Merge Conflict Guidance

• Current merge state: DIRTY
• Base branch: main
• Head branch: feat/opencode-review-gateway
• Fix direction: merge or rebase origin/main into feat/opencode-review-gateway, resolve conflict markers in the changed files, rerun the focused checks, then push the same branch.
• Repair commands:

gh pr checkout 790 --repo ContextualWisdomLab/contextual-orchestrator
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:feat/opencode-review-gateway
# rebase path only: git push --force-with-lease origin HEAD:feat/opencode-review-gateway

[seonghobae]

Exact-head restack and verification audit\n\n- Repository: ContextualWisdomLab/contextual-orchestrator\n- Pull request: #790\n- Exact head SHA: 17a5e42b44f141fc085eea932671a7be62455b33\n- Exact base SHA: 315c9f05834df6df3a946de160db96f22c355e8b\n- Merge-result verification tree: merge commit 17a5e42b44f141fc085eea932671a7be62455b33 with parents 8d31fa50cc6de8ddc3e6b91576e7251c5aa7d914 and 315c9f05834df6df3a946de160db96f22c355e8b.\n- Conflict resolution: README test inventory, orchestrator retry/failover integration, and model-discovery capability tests were reconciled; no conflict markers remain.\n- Validated fix: explicit non-chat discovery catalogs are preserved for discovery/reporting, while agent_from_discovered remains chat-only and rejects embedding models before chat transport. Non-HTTPS discovery errors remain sanitized.\n- Local verification: full suite 1698 passed in 8:35; focused gateway/discovery/capability/fallback set 209 passed; python -m ruff check changed Python files; python -m compileall -q contextual_orchestrator tests; git diff --cached --check.\n- Security boundary: no secret values, no public bind change, no direct protected-branch push, no force push, no bypass, and no self-approval.\n- Hosted state: current-head Checks and substantive review restarted after the exact-head update; the predecessor's old success evidence is not reused.\n\nDecision: NORMAL_MERGE path; arm protected auto-merge and wait for current-head required Checks/review.

[seonghobae]

Merge-gate evidence (2026-08-25): All required checks green on current head (verified via check-runs); strix blocked externally by org-wide NVIDIA NIM quota exhaustion — documented external provider-capacity blocker, systemic serialization fix in ContextualWisdomLab/.github#1297.

[devin-ai-integration]

Devin Review found 0 new potential issues.

[seonghobae]

Merge-gate evidence (2026-08-25): Rebased onto current main (discovery/capability files taken from main's merged #768 state; gateway bootstrap + review-gateway tests preserved). Full local suite green (1856 tests). All required checks green except strix — org-wide NVIDIA NIM quota exhaustion (external provider-capacity blocker; serialization fix in ContextualWisdomLab/.github#1297).