fix(routing): select concrete free model groups

[seonghobae]

Current owner state

This remains the broad trusted owner lane for concrete orchestrator/free grouping, provider discovery/routing, endpoint lifecycle, durable bootstrap identity and related routing behavior. It is Draft and not merge-ready.

• protected main: 414f22973658c4ddc3d4320fcf7acd9b4e8ba991
• current exact head: 838cbcb77218f6a87c9ec222b5a26b0c9066ec3f
• merge base: protected main itself
• ancestry: ahead 126 / behind 0
• GitHub mergeability: mergeable
• publication: normal non-force two-parent merge; no rebase or force push

2026-09-07 durable selection-order repair

External thread PRRT_kwDOTB3CTs6elTYC was causal: durable bootstrap converted the selector result to a set and returned alphabetically sorted persisted IDs, while the ephemeral report preserved cost/model-group order. RED commit 98aed1a811cb894881b4c9aeb20de4f0b00fb634 adds a two-model durable-pool oracle whose selected order is deliberately opposite lexical agent-ID order. Successor d469085df5cf6db4cf57cd6da43569f77920c463 keeps set membership for fail-closed collision/withdrawal checks but separately records, activates, and reports resolved persisted IDs in selector order. It adds no ranking, provider quota, timeout, or dependency.

Exact-head Security and Quality run 34068287994 is terminal GREEN: unchanged full suite/package quality, Hypothesis/Atheris fuzzing, CodeQL, dependency audit and SBOM all succeeded. Code Quality 34068286556 is also GREEN. Remaining SAST, compatibility CodeQL, Security Scan, Noema, OpenCode and Strix lanes are current-head but still queued, so this PR remains Draft.

Restack and hosted-RED repair

The previous head df587e1704ecd12e355b4d1a70facb387a4648cb diverged from 13 protected descendants. The successor preserves both histories. The six paths changed on both sides were merged with exact base 212ff437dc297613289dba2e6064ade9942e07d8: five were conflict-free, while the setup-node block in .github/workflows/opencode-hourly-loop.yml required the explicit resolution recorded below. All 29 main-only path deltas, including security/test/docs changes and deletion of obsolete ci.yml/fuzz.yml, were inherited from protected main.

Tests run 33667736989, job 100373515693 had reported 7 failed, 3439 passed, 2 skipped. This successor repairs those failures without weakening production behavior:

1. tests/test_admin_contract.py inherits protected main's json, shutil, and subprocess imports.
2. Four synthetic OpenRouter ZDR batch fixtures inject the already-defined deterministic _ExactTestCounter; production remains fail-closed when authoritative token sizing is unavailable.
3. The two durable bootstrap identity fixtures now call sync_discovered_agents before restart. TaskOrchestrator construction intentionally remains free of an implicit persistence side effect.

Restack commit 8b05b831… initially produced push run 34065942588 with failure and zero jobs because one unresolved three-way marker remained around actions/setup-node; 521e613… removed that artifact while preserving the immutable setup-node v7 pin and bounded non-model setup timeout. 6ddc6b4… then closed the vacuous direct-check path by giving both bootstrap identity fixtures real pytest entry points and registering both in README. Its hosted Tests run 34066167599, job 101575237781 exposed a single publication defect behind 325 collection errors: orchestrator.py had been truncated to 600,060 bytes and contained NUL bytes. Current successor 1e59d4f… restores the complete 792,692-byte merged blob; the GitHub content API reports no NUL characters. Fresh SAST 34066349130, CodeQL 34066349112, merge scheduler 34066348028, Strix 34066348040, OpenCode 34066348094, Noema 34066348025, Security/Quality 34066349029, Security Scan 34066349074, and Code Quality 34066347141 runs materialized for this exact head. Code Quality is terminal GREEN; the Security/Quality CodeQL+supply-chain+SBOM job is terminal GREEN; its unchanged full-suite and coverage-guided fuzz jobs are still executing. The other exact-head lanes remain queued/pending. Predecessor results do not authorize this head.

2026-09-07 ambiguous bootstrap-admission repair

External thread PRRT_kwDOTB3CTs6eh3BQ remained causal: both bootstrap
selectors let lexical provider/model identity decide a bounded cutoff when
price evidence was equal or incomplete. Test-only RED
eeb9cc1bafe579032ab48778fa08c24e0b3f0aa1 produced exact-head Security and
Quality run 34071330949, job 101589111271: the two new contracts failed
with DID NOT RAISE, and the unchanged remainder was 3490 passed, 2 skipped.

GREEN implementation 575148b9df50b4e3840bc25f4fba1367d8f6a654 retains explicit
provider/model-group availability constraints but rejects a selected/excluded
capacity boundary sharing the same comparable-cost or unknown-price state.
The error tells operators to supply comparable price evidence or include the
entire tied class. It adds no score, weight, quota, fuzzy identity, or learned
quality claim. The doctoring record now distinguishes direct provider
bootstrap's model-group contract from the discovery CLI's additional
provider-spread contract; ADR 0032 is demoted to Proposed while protected
delivery remains pending. Successor 50b0c869571f361865efd22c7c596fda978679e8 adds the corresponding equal-known-price edge cases without changing production. Exact-head Security/Quality 34072366669, SAST 34072366670, CodeQL 34072366652, and Security Scan 34072366665 have materialized but are not yet terminal. Both related review threads remain open until current-head focused/full evidence succeeds.

2026-09-08 unmodeled diversity-decision repair

Review thread PRRT_kwDOTB3CTs6eh3BQ remained causal after the
equal/incomplete-price repair: the two hand-authored diversity passes could
still let a distinct provider/model-group label displace a lower-cost
candidate. The same passes could also reorder a complete candidate pool,
making the label an undocumented routing utility.

RED fixtures first failed with DID NOT RAISE for both selectors at the
bounded cutoff and complete-pool ordering boundaries. Successor
7206c5f6b62d654706961da793a70fca16ce03c8 rejects bounded displacement;
838cbcb77218f6a87c9ec222b5a26b0c9066ec3f also rejects full-pool
reordering. Both compare the diversity proposal with the price-evidenced
candidate sequence and fail closed on any difference until an explicit
decision model supplies utility evidence. No provider quota, outage weight,
lexical tie-break, learned score, timeout, or fallback was added.

Exact-tree local verification is 133 passed across all direct selector
consumers, review-gateway integration, and CLI admission coverage; Python
compileall and git diff --check pass. The local runtime did not provide
Ruff, so fresh hosted lint/full-suite/security/model-review Checks remain
mandatory and predecessor GREEN does not transfer. Gap baseline, doctoring,
CLI help, and CHANGELOG are aligned to the Proposed/fail-closed boundary.
The PR stays Draft.

Preserved valid direction

The branch still owns valid repaired behavior that must survive review: purpose-complete self-modifying source-fix machinery stays absent; endpoint-race/process-exit cleanup contracts; bounded provider-embedding worker shutdown; durable bootstrap/catalog identity; provider discovery and free-pool evidence boundaries; default inference timeout null; separation of user cancellation, provider termination, audited administrative timeout and infrastructure loss.

GitHub Actions consumers request only orchestrator/free. Provider/model/group/credential discovery, free/privacy/capability admission, serving order and failover remain contextual-orchestrator authority. OpenAI integration may remain globally available while OpenAI-derived candidates remain excluded from the free pool under the current policy. Private candidates require ZDR admission.

Still-live owner RED

• Manual bootstrap admission is repaired through 838cbcb77218f6a87c9ec222b5a26b0c9066ec3f; keep the separate migration thread open until exact-head hosted verification and consumer review prove it.
• Hourly model-backed work still needs durable/resumable execution semantics. A leaf finite wall-clock model timeout is not a substitute for checkpoint/re-dispatch.
• Provider/model-group diversity and migration semantics need exact-head revalidation.
• Two valid unresolved review threads remain: hourly resumability/queueing and diversity-migration semantics. Durable selection order and manual diversity admission are repaired, but fresh exact-head hosted proof is still required. Outdated location alone is not resolution.

Promotion contract

Before Ready or ordinary protected merge:

1. rerun the seven focused regressions on this exact head and repair any residual causal defect;
2. run the complete unchanged-head suite plus docstring/test/edge contracts;
3. require every live protected context on this SHA, including Hypothesis, Atheris, CodeQL, Python supply chain, dependency review, OSV, Trivy, Scorecard, coverage evidence, OpenCode review, Strix and PR-queue scan;
4. resolve only findings proven obsolete or repaired on the current source and obtain qualifying independent review;
5. keep ADR/PRD/ARCHITECTURE/CHANGELOG/product-gap evidence aligned with the resulting tree.

No force push, destructive rebase, stale-tree overlay, source-neutral retrigger, predecessor-evidence transfer, self-approval, administrator bypass or gate weakening is acceptance evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

모델 검색과 부트스트랩이 모델 그룹 및 fingerprint ID를 사용합니다. 공급자 호출은 선택적 타임아웃과 명시적 취소를 지원합니다. OpenRouter ZDR 라우팅, 임베딩 실패 기록, readiness 동시성, 레거시 에이전트 동기화 및 관련 회귀 검증을 갱신합니다.

Changes

모델 검색 및 부트스트랩

Layer / File(s)	Summary
모델 그룹 식별 및 검색 제한 contextual_orchestrator/model_discovery.py, contextual_orchestrator/conventions.py, contextual_orchestrator/provider_bootstrap.py	모델 그룹과 SHA-256 기반 agent ID를 추가했습니다. 레거시 ID 재사용을 지원합니다. provider별 discovery deadline과 openrouter/free 제외를 적용합니다.
부트스트랩 선택 및 동기화 contextual_orchestrator/provider_bootstrap.py, contextual_orchestrator/provider_catalog_bootstrap.py, contextual_orchestrator/__main__.py, tests/test_*bootstrap*, tests/test_discover_models_cli.py	provider 및 model group 다양성을 순서대로 적용합니다. 운영자 관리 에이전트와의 ID 충돌을 거부합니다. 선택된 모델을 동기화 후 다시 매칭합니다.

공급자 취소 및 readiness

Layer / File(s)	Summary
취소 가능한 공급자 호출 contextual_orchestrator/orchestrator.py, contextual_orchestrator/endpoint_race.py, tests/test_endpoint_race.py, tests/test_local_mlx.py	DNS, TCP, 소켓 종료까지 공급자 취소를 확장했습니다. race loser 결과를 세분화해 기록합니다.
무기한 probe 및 readiness 갱신 contextual_orchestrator/orchestrator.py, README.md, contextual_orchestrator/api_contract.py, tests/test_local_mlx.py	기본 probe 및 연결 타임아웃을 선택 사항으로 변경했습니다. 동시 refresh에는 refresh_in_progress를 반환합니다.

ZDR 라우팅 및 임베딩

Layer / File(s)	Summary
OpenRouter ZDR 요청 보정 contextual_orchestrator/orchestrator.py, contextual_orchestrator/batch_routing.py, contextual_orchestrator/cost_router.py, tests/test_orchestrator_client_boundaries.py	OpenRouter의 실제 base_url을 기준으로 provider를 식별합니다. zdr_only 범위에서 모든 주요 전송 경로와 Batch JSONL에 provider.zdr=true를 적용합니다.
임베딩 실행 및 실패 상태 contextual_orchestrator/server.py, contextual_orchestrator/cost_router.py, contextual_orchestrator/batch_routing.py, tests/test_batch_embeddings.py, tests/test_provider_embedding_batch_backend.py	무기한 실행과 고정 claim lease를 분리합니다. 불완전한 결과와 terminal batch 상태를 embedding failure로 기록합니다. 복구된 ZDR batch의 현재 태그를 재검증합니다.

계약 및 운영 지원

Layer / File(s)	Summary
재시도·운영 문서 및 workflow docs/adr/*, docs/planning/adrs/*, CHANGELOG.md, CHANGELOG.d/*, docs/product-technical-gap-baseline.md, .github/workflows/*, docs/kv-credentials.md	기본 transport retry를 0으로 기록합니다. OpenRouter evidence 및 ZDR 정책을 갱신합니다. workflow 단계별 제한과 gateway 프로세스 상태 확인을 추가합니다.
회귀 계약 tests/test_pr971_review_quality_regressions.py, tests/test_provider_gateway_resilience.py, tests/test_openrouter_uptime.py, tests/test_embeddings_model_pool_http_honesty.py, tests/test_provider_error_taxonomy.py	discovery deadline, provider 오류 분류, uptime timeout, embedding failure, ZDR 정책 복원을 검증합니다.
임시 수리 자동화 .github/workflows/source-fix-971-live-review-quality.yml, scripts/ci/pr971_live_review_quality_repair.py	RED 테스트 실행, 소스 수리, GREEN 검증, traceability 갱신 및 수리 파일 삭제 순서를 정의합니다.

Estimated code review effort: 5 (Critical) | ~120 minutes

Merge Risk: 🔴 Critical · up to 03b62

The current head still relies on temporary source-rewriting machinery instead of committed production fixes, while provider discovery can wait indefinitely or leak background work and embedding and failover paths retain correctness and privacy risks. These issues can cause hangs, resource exhaustion, incorrect routing, or loss of privacy guarantees, so the PR is not merge-ready and should remain blocked.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 52.20% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 341 functions across 44 files. (3 skipped…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 구체적인 무료 모델 그룹을 선택하는 실제 변경 사항을 정확히 설명합니다. PR 전체 범위를 모두 포함하지 않지만 주요 라우팅 변경과 직접 관련됩니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 52.20% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 341 functions across 44 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch fix/model-group-timeout-openrouter

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/model-group-timeout-openrouter

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Routing contract: provider family is not a product grouping. Selection and measurement use model_group only. OpenRouter discovery retains concrete free model IDs such as vendor/model:free; the aggregate openrouter/free meta-router is excluded because contextual-orchestrator itself owns concrete-model selection, RPM/TPM measurement, and failover.

[seonghobae]

@jules Fresh exact-head review on df587e1704ecd12e355b4d1a70facb387a4648cb found a still-live availability contradiction in the canonical free-pool owner lane. The current code has a circuit breaker, but _eligible_for_role returns healthy or eligible; when every eligible member is still circuit-open it deliberately re-admits the known-open members. The same current branch hard-codes circuit_failure_threshold = 3 and circuit_reset_seconds = 30.0. That can make an all-saturated orchestrator/free request serially pay known-bad provider work again, and the two numeric decisions are hand-authored policy of the same class this PR already rejects for default retries/admission ordering.

This matters with the fleet's current measured consumer evidence: same-day model-backed Actions stalls have grown from roughly 649.5s to 1332.6s, 1462.9s, and 2161.9s while holding scarce job capacity. Do not 'fix' that by reintroducing a global model wall-clock timeout: #1053 correctly moves the default application model timeout to None, so active reasoning/streaming/tool work remains unbounded unless the caller/user/provider/admin terminates it. The repair belongs in provider-health/admission, not elapsed inference time.

Please repair this same branch by normal descendant after re-reading live main/head. RED/GREEN acceptance:

• if one or more eligible members are currently healthy, no circuit-open member may be invoked;
• if all eligible members are still open from fresh source-backed provider failures, fail closed with a typed pool-temporarily-unavailable outcome carrying only safe retry/eligibility evidence instead of probing every known-open member in series;
• after the health observation's governed expiry/recovery condition, the member becomes probe-eligible again, and a successful probe clears its failure state;
• keep provider 429/Retry-After, quota/auth/permanent refusal, transport failure, provider termination, and model-content/reasoning duration as distinct evidence classes; do not count explicit race-loser cancellation as provider failure;
• do not embed provider/model/group names or a paid fallback in consumers; orchestrator/free remains the only GitHub Actions selector;
• replace the unexplained 3/30 literals with explicit configurable/evidence-governed policy or document an accepted standard/experiment that justifies them; configuration must preserve fail-closed bounds and deterministic tests;
• add deterministic concurrent-request/herd regressions so a fresh open state prevents duplicate known-bad attempts, all-open requests do not fan out or serialize through the open set, and recovery does not permanently starve a provider.

Also update this PR's stale 'current exact head' prose after the causal repair; predecessor tests/reviews do not transfer. Keep Draft until the unchanged repaired head has exact tests/security/review/SBOM/provenance.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: df587e1704ecd12e355b4d1a70facb387a4648cb

[seonghobae]

Fresh fleet revalidation on current exact head df587e1704ecd12e355b4d1a70facb387a4648cb supersedes the stale head/base text in the PR body. GitHub now reports this PR as Draft. Current protected main is a080297d2546bb61e89520d637cabc202db331ec; comparison is diverged (ahead_by=122, behind_by=12, merge base 212ff437dc297613289dba2e6064ade9942e07d8). The 12 protected descendants are not discardable: they overlap this lane in model_discovery.py, orchestrator.py, the hourly OpenCode workflow/contracts, and tests/test_admin_contract.py, among other owner paths. Promotion therefore requires a conflict-aware normal descendant restack, not a stale-tree overlay or force rebase.

The last exact-head hosted full suite is also a real source/test RED, not merely queue starvation: Tests run 33667736989, job 100373515693 checked out the exact PR merge and finished 7 failed, 3439 passed, 2 skipped. One failure is a deterministic missing-import defect in tests/test_admin_contract.py (json is used without import; the same file later uses shutil and subprocess). Current protected main already contains all three imports, so that protected delta must be adopted during restack rather than independently reimplemented. Four embedding-batch tests fail closed because no authoritative tokenizer is available for text-embedding-3-small, and the two durable-bootstrap identity regressions still report generated IDs instead of the persisted legacy ID on this exact head. NIM coverage/docstrings/package smoke passed; Fuzz, OSV, Security Scan, SAST and Scorecard passed, while Security failed and CodeQL ended startup_failure.

Required GREEN: first reconcile all 12 protected descendants with a normal non-force descendant while preserving this PR's valid routing/endpoint/bootstrap deltas; then re-run the seven concrete failures and repair any residual current-tree defects causally; only after that regenerate the full exact-head required protection set (Hypothesis, Atheris, CodeQL, supply-chain/dependency/OSV/Trivy/Scorecard/coverage/OpenCode/Strix/scan-pr-queue) and current independent review. No predecessor result, stale merge commit, no-op retrigger, source overlay, self-approval, or gate weakening is acceptance evidence.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: df587e1704ecd12e355b4d1a70facb387a4648cb

[seonghobae]

Canonical-owner finding to integrate after the current exact-head writer completes (verified 2026-09-07): #972@876f1679cd44d7e9691b95344118bfe324e31287 admits supports_parallel_tool_calls=None/untagged agents into blind orchestrator/free, and its tests explicitly preserve [multi, unknown]. That conflicts with the binding missing-capability fail-closed rule. Preserve unknown rows in discovery/price inventory and non-tool/request-scoped routes, but require affirmative request-relevant capability evidence for the blind free pool. The same probe authors timeout=30.0, max_tokens=32, and temperature=0.0 as admission-affecting compute constants without cited standard/experiment/caller provenance. Full exact-head evidence and integration direction are recorded on #972 in comment 5563657095. Add RED contracts before source repair; do not replace these values with different constants or disturb the current 50b0c869571f361865efd22c7c596fda978679e8 verification run.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: 50b0c869571f361865efd22c7c596fda978679e8

[seonghobae]

Fresh canonical-boundary review at exact head 50b0c869571f361865efd22c7c596fda978679e8: issue #1106 now records the missing released orchestrator/free review-allocation contract and names this PR as the existing broad owner lane.

The current review_gateway.py correctly keeps global credential registration separate from the free-pool allowlist, excludes OpenAI only inside CO, accepts an ordered credential sequence, and retains every evidence-eligible candidate. Preserve those deltas.

This head is not a complete #1106 repair: it still creates ModelClient(max_output_tokens=32768), gives all admitted agents priority=0, and relies on downstream selection without a request-scoped Fugu/Conductor/TRINITY allocation/provenance result. Therefore the protected leaf still cannot delete its duplicate probing/admission/fallback. Add no replacement count, timeout, token guess, weight or tie-break. The next owner change should be RED-first and fail closed when the required allocation/quality evidence is absent.

This is evidence/handoff only. The PR remains Draft with its existing unrelated unresolved findings and terminal CodeQL PR failure; no stale GREEN is promoted.

[seonghobae]

Exact-head CodeQL RCA for 838cbcb77218f6a87c9ec222b5a26b0c9066ec3f: central handler 34241908455 authenticated the exact contextual-orchestrator#971 head/base/required-run receipt and completed native scans for Python, JavaScript/TypeScript, and Actions with 0 Medium+ findings in every shard. All three handler jobs nevertheless failed after artifact publication because both the exchanged target App token and handler GITHUB_TOKEN received HTTP 403 while publishing status, then no credential with Actions write authority was available to rerun the exact failed compatibility jobs.

This is not a product-source or scan-result failure in #971, and rerunning the leaf jobs cannot create the missing cross-repository authority. Canonical owner .github#2040 is repairing target-repository status/wake credentials but now has its own handler-first deployment-order blocker documented at ContextualWisdomLab/.github#2040 (comment). Keep #971 Draft; preserve the current scan artifacts as diagnostic evidence only, and reacquire exact-head CodeQL after the ordinary owner release. The existing durable execution, provider-diversity, and no-heuristics review findings remain independent blockers.

[seonghobae]

Exact-head verification for d9c2f577 (docs-only, on top of 726911cf):

• Change: select_model_group_diverse_models docstring now states the consumer-migration contract (exact model_group + known cost over provider spread). No behavior change.
• Local: 63 passed (test_provider_bootstrap.py, test_discovery_bootstrap_selection.py, test_discover_models_cli.py incl. legacy-ID reuse, manual-agent non-activation, manual legacy-ID preservation).
• Required CI on this head: Tests and package quality, fuzzing, CodeQL/SBOM, noema-review, opencode-review, coverage-evidence, strix, scan-pr-queue — all SUCCESS. CodeRabbit: Review skipped: draft pull request.
• Review threads: replied with evidence on the open diversity-migration thread (3914523756); hourly-queue thread stays open as tracked gap per ADR 0032 no-elapsed-cutoff contract.
• Not mergeable from this lane: PR is Draft, and the 3 CodeQL compatibility analysis jobs fail repo-wide on every head today (VERDICT_STATE=pending, central rerun never arrives — same on 726911cf and 6 earlier heads). Both need owner/infra action outside this diff.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: d9c2f57701f6e7fe194582b510255759ffb30990

[seonghobae]

Read-only consumer handoff from fast-mlsirm#1800; no CO source mutation requested from the leaf writer.

Protected fast-mlsirm currently has stale architecture/ADR language that assigns model-backed GitHub calls directly to NVIDIA_NIM_API_KEY. The intended CWL boundary instead requires the leaf to request only orchestrator/free through a gateway token and leave provider/model/group/paid-fallback/key discovery here.

A fresh owner check shows contextual-orchestrator currently exposes no GitHub Releases, so fast-mlsirm cannot truthfully replace the stale provider-key contract with a released immutable CO dependency yet. Please preserve #971's orchestrator/free owner boundary and include, in the eventual immutable release path, a versioned API/client/schema contract suitable for leaf GitHub Actions: gateway-token auth, orchestrator/free request only, no provider/group requirement at the consumer, fail-closed capability mismatch, and stable response/error schema. Once that immutable owner artifact exists, fast-mlsirm#1800 can migrate its workflows/contracts without copying routing source or pinning a mutable PR head.

[opencode-agent]

Scheduled review-feedback autofix for this PR head.

• Head SHA: d9c2f57701f6e7fe194582b510255759ffb30990