fix(ci): enforce no-heuristic orchestrator/free execution

[seonghobae]

Superseded by #535

This branch proved several no-heuristics defects, but its attempted completion path introduced a temporary self-modifying source writer (source-fix workflow/trigger/script), which violates Noema's single-writer lease. That mechanism has now been removed from this branch and a regression (test/no-temporary-self-modifying-writer.test.ts) records the prohibition.

The canonical implementation lane is #535. It already owns the broader orchestrator/free migration, the process-boundary compatibility ACL for the historical contextual-orchestrator bootstrap value, removal of Noema-local inference retry/timeout allocation, request-level ZDR plumbing in the reviewer, severity-independent deterministic gates, and the related documentation/contract changes.

Before closing this duplicate lane, the remaining unique workflow/control defects were transferred to #535 as an explicit RED contract in test/no-heuristic-workflow-authority.test.ts: central-review must request orchestrator/free directly, must not allocate local model timeout/retry policy, must derive ZDR from live repository visibility, hourly OpenCode must fail closed when private-request ZDR cannot be attested, scanner severity/confidence must not become local review authority, and the gateway must not invent a default health deadline.

No predecessor check/review evidence from this branch transfers to #535. #535 remains Draft and must satisfy its own exact-head RED→production repair→GREEN and normal protected gates before merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}