docs: confirm review pipeline already routes through orchestrator/free, not NIM directly

[seonghobae]

Summary

This cycle's directive specifically targeted getting Noema/OpenCode review/tag/PR-conflict auto-resolution and Strix security review routed through contextual-orchestrator's orchestrator/free, with direct NVIDIA NIM communication called out as a removal target ("free+ZDR 조합도 해결 못 하는데 유료 모델 포함 auto는 의미 없다").

An audit of the central review pipeline found no violation — this is already implemented:

• opencode.jsonc declares enabled_providers: ["contextual-orchestrator"] only; model/small_model are pinned to contextual-orchestrator/orchestrator/free. No nvidia-nim provider block exists (already removed 2026-08-31).
• .github/workflows/opencode-review-dispatch.yml's OPENCODE_MODEL_CANDIDATES names only contextual-orchestrator/orchestrator/free — no paid or auto-selected candidate is dispatched.
• scripts/ci/contextual_orchestrator_review_sidecar.sh (the vendored gateway pr-review-autofix.yml provisions for Noema/OpenCode/Strix repair) only forwards NVIDIA_NIM_API_KEY/NVIDIA_NIM_API_KEY_SUB as bootstrap KV credentials for the vendored orchestrator's own model discovery. The actual review completion call targets the sidecar's own loopback endpoint with CONTEXTUAL_ORCHESTRATOR_POOL hard-locked to free. No .github-side HTTP client calls a NIM endpoint directly.
• A prior direct-HTTP NIM resolver was already removed 2026-08-30 after confirming zero callers; remaining nvidia-nim-branch dead code in run_opencode_review_model_pool.sh is inert and contract-test-pinned as absent from workflow files.
• Noema's own repo is architecturally clean by construction: it's an OIDC-to-installation-token credential broker, not an LLM caller, and holds no upstream provider keys.

Correction, 2026-09-05: this PR's own framing above was too broad. See docs/product-technical-gap-baseline.md's corrected 2026-09-05 entry: the model-selection/logical-routing layer audited above is confirmed correct, but the sidecar/egress infrastructure layer (scripts/ci/contextual_orchestrator_review_sidecar.sh) is not yet the thin, secrets-free gateway call this framing implied — it still injects all five raw provider secrets, clones and builds contextual-orchestrator fresh on the calling runner per invocation, and runs discovery in-process there. Tracked by #1759 and contextual-orchestrator#1041 comment 5550412102.

This PR is documentation-only: it records the audit findings (both the original and the correction) in docs/product-technical-gap-baseline.md (with the full audit trail and citations) and CHANGELOG.md, and separately corrects a stale gap-baseline note — a test flagged "not yet fixed" on 2026-09-04 (test_review_fix_caller_runs_once_each_hour, hourly vs. daily-cron staleness) was in fact fixed by #1877 the same day (renamed to test_review_fix_caller_keeps_the_github_daily_recovery_slot), confirmed live on current main (re-verified again during this PR's second merge-conflict resolution).

No code, workflow, or test files changed.

Test plan

• PYTHONPATH=. python3 -m pytest tests/test_product_technical_gap_baseline.py tests/test_pr_review_autofix_nvidia_nim_contract.py tests/test_noema_review_gate.py tests/test_required_review_runner_image_contract.py -q — 144 passed
• Verified live on origin/main (8272e4f9) that test_review_fix_caller_keeps_the_github_daily_recovery_slot exists and the old test_review_fix_caller_runs_once_each_hour symbol is gone
• Full suite post-merge-conflict-resolution: 2893 passed, 1 skipped, 21 subtests passed

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01KPmJErfkcHer4UVEgrQxUX

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head documentation blocker (freshly refetched at 0847c4424e7067b0dedd9ffcdbc9cb62780b897d over protected main@6d7fbebec8aec31d88a30a36e71ca5b3925d241d):

The statement that the review pipeline is already fully routed through contextual-orchestrator and needs no code change is too broad for Strix. The logical model identifier is now contextual-orchestrator/orchestrator/free, but protected .github/workflows/strix.yml still injects five raw provider secrets into scripts/ci/contextual_orchestrator_review_sidecar.sh; that script requires at least one provider secret, clones CO source at runtime, and performs provider discovery locally. The Strix job also remains harden-runner egress-policy: audit.

NewsDOM #682's exact predecessor run 32638076034 / job 97190711585 proves why this distinction matters: the old workflow directly selected NVIDIA, received HTTP 429, and attempted NVIDIA/OpenAI fallbacks. Current main improves the logical route but does not yet establish the requested released gateway-token-only, block-mode egress boundary.

Please keep this PR Draft and do not characterize the dependency as complete. Canonical implementation/dependency tracking is now:

• central: Migrate Strix/OpenCode/Noema/autofix sidecar steps to the orchestrator-free-sidecar composite action #1759, updated with exact current evidence and migration order;
• contextual-orchestrator: issue fix(security): fail closed when dependency-review compare is unavailable #1041 comment 5550412102, requiring an immutable released gateway/client/schema/egress contract.

This is a source/architecture finding, not a request for a source-neutral rerun or a NewsDOM change.

[seonghobae]

Confirmed — independently re-verified all three points against exact file:line evidence (.github/workflows/strix.yml:745-758 for the five injected provider secrets, scripts/ci/contextual_orchestrator_review_sidecar.sh lines 51-63/91-98 for the runtime clone-and-build, lines 108-109 and 316-328 for in-process local discovery, strix.yml:365-367 for harden-runner egress-policy: audit) and they all held up.

Pushed 50de5f63 correcting docs/product-technical-gap-baseline.md's entry and its matching CHANGELOG.md entry: the model-selection/logical-routing layer (opencode.jsonc, opencode-review-dispatch.yml) is still accurately described as correct, but the "Confirmed already implemented; no code change needed" framing is removed and replaced with an explicit split — the sidecar/egress infrastructure layer that Strix (and the other three #1759 consumers) actually run on is not yet complete, with the same evidence you cited and the same #1759 / contextual-orchestrator#1041 comment 5550412102 tracking links. Keeping this PR Draft as requested.

---

Generated by Claude Code