Migrate OpenCode review model pool off GitHub Models before 2026-07-30 retirement

[seonghobae]

Problem

GitHub Models is fully retired on 2026-07-30 (changelog). Org-attributed inference for ContextualWisdomLab is already cut off (since ~2026-07-25T00:26Z): POST https://models.github.ai/orgs/ContextualWisdomLab/inference/chat/completions returns 403 with Sunset: Thu, 30 Jul 2026 00:00:00 GMT and a deprecation Link header. User-attributed inference still returns 200, but that also dies on Jul 30.

Consequences observed today:

• Every opencode-review repository_dispatch run org-wide fails with OPENCODE_MODEL_POOL_OUTCOME: exhausted → MODEL_OUTPUT_UNAVAILABLE (e.g. runs 30150610014, 30150959330, 30151278716 in .github). All PR merges are blocked because the required review cannot produce approval evidence.
• The org secret STRIX_GITHUB_MODELS_TOKEN was failing 401/403 and masking the || github.token fallback; the dead secret was deleted 2026-07-25. The fallback engages now but is equally rejected (Actions tokens attribute to the org).
• Remaining pool providers need billing: OpenAI (insufficient_quota), OpenRouter (HTTP 402 credit-exhausted).

Immediate mitigation (any one restores reviews now)

1. Top up OpenRouter credits (pool falls through automatically), or
2. Restore OpenAI quota, or
3. Stopgap until Jul 30 only: fine-grained PAT with Models read set as org secret STRIX_GITHUB_MODELS_TOKEN.

Migration work (before 2026-07-30)

• Remove/replace the github-models provider block in opencode.jsonc (line ~87 "apiKey": "{env:STRIX_GITHUB_MODELS_TOKEN}") and the embedded copies in .github/workflows/opencode-review.yml (~line 3325) and .github/workflows/pr-review-autofix.yml (~line 277) in ContextualWisdomLab/.github.
• Update the model pool candidate list so github-models/* entries are removed (they burn 8 of every 10 pool attempts today and guarantee slower exhaustion).
• Update strix.yml GitHub Models routing (provider_mode == 'github_models', GITHUB_MODELS_FALLBACK_TOKEN, "STRIX_GITHUB_MODELS_TOKEN is required" gates) to a supported provider (changelog suggests Microsoft Foundry / Copilot).
• Update contract tests that pin the token expressions: scripts/ci/test_strix_quick_gate.sh (lines ~312–317, ~584–585, ~3820, ~5262) and scripts/ci/strix_quick_gate.sh (~3605, ~3620).
• Update sibling-repo opencode.jsonc copies (naruon, scopeweave, newsdom-api, bandscope, pg-erd-cloud, codec-carver) and noema central-review.yml NOEMA_FALLBACK_LLM_API_KEY.
• Update prose/docs: docs/org-required-workflow-rollout.md (model token posture, line ~42), PR_GOVERNANCE_AUDIT.md if it references GitHub Models, AGENTS.md notes in naruon.
• Decide replacement default route (Microsoft Foundry per changelog, or OpenRouter/OpenAI as primary) and wire budget monitoring so credit exhaustion pages a human before reviews stall.

Evidence trail

Full diagnosis on #618 (comment 5077949855): provider failure classes, run IDs, before/after fallback signatures.

[seonghobae]

Day-of-cutoff status (2026-07-30) — provider is now the sole org-wide merge blocker

Two things changed since this issue was filed (07-25):

1. The GitHub Models retirement is now in effect. Mitigation option 3 (stopgap fine-grained PAT with models: read as STRIX_GITHUB_MODELS_TOKEN) no longer works as of today — user-attributed inference dies with the org-attributed path. Only these remain to restore reviews immediately, no code change required (self-healing per #628):

• Top up OpenRouter credits (pool falls through automatically), or
• Restore OpenAI quota, or
• Provision a supported replacement provider and wire it (the migration checklist in this issue), e.g. OpenCode Zen / Microsoft Foundry. This one does need a new org secret + one bootstrap admin-merge because of the review-gate chicken-and-egg.

2. The coverage-evidence root cause is fixed and verified. #657 makes the offline coverage sandbox discover hash-pinned base locks by content instead of an exact-basename whitelist. On the current head d262e446 the run reports COVERAGE_EVIDENCE_RESULT: success — the only failing signal is OPENCODE_MODEL_POOL_OUTCOME: exhausted. This matters for the recovery plan: before #657, restoring a provider would still have left keyverse / semantic-data-portal failing at ModuleNotFoundError in the sandbox (empty base deps), so the review would fail on coverage evidence even with a working model. After #657, restoring any provider cascade-heals the whole backlog cleanly.

Bootstrap note

#657 itself (and the 5 sibling base-fix PRs it unblocks) cannot self-merge while every provider is exhausted — the required opencode-review check has no model to produce APPROVE evidence, and the ruleset (non-pusher approval + passing opencode-review) correctly blocks a force-merge. The cleanest sequence once a provider is available:

1. Restore a provider (option 1/2 above = zero code), or admin-merge fix(review): materialize base coverage locks by content, not exact filename (org-backlog root cause) #657 to land the coverage fix first.
2. The :00/:30 repo and :15/:45 org scheduled scans auto-redispatch the stale reviews; approved heads then auto-merge.

I can implement the full OpenCode Zen migration (opencode.jsonc + the embedded workflow provider blocks + strix routing + contract tests + sibling copies + docs, per the checklist above) on request — it just needs the human decision on the replacement provider and its secret, since I can neither set org secrets nor bypass the ruleset.

---

Generated by Claude Code

[seonghobae]

Current-head Strix evidence update (2026-08-01)

The provider migration remains active and now has exact current-head evidence from .github#687 at cf51e0481c75b6ac4b9abec1d7a4f2d29aa2ced9.

• Workflow run: https://github.com/ContextualWisdomLab/.github/actions/runs/30677113527 (job 91306582553)
• Artifact: strix-reports, artifact id 8810954014
• Structured run.json: status=failed, scan_mode=quick, 4 requests, 17,674 total tokens.
• No structured vulnerability report artifact was produced. The console UI printed Vulnerabilities 0, but the gate correctly logged that this is incomplete evidence after provider failure and must not be described as a clean Strix scan.
• Attempts 1-3: NVIDIA NIM 429 Too Many Requests.
• Attempts 4-5: GitHub Models 410 github_models_retirement_brownout for openai/o3 and openai/gpt-5-chat.
• The outer required check concluded success only through the documented backend-unavailable neutral-skip path, consistent with the policy that uncontrollable provider outages are not merge blockers. Independent Trivy, OSV, dependency-review, pip-audit, Bandit, Semgrep, Gitleaks, CodeQL, and uploaded SARIF evidence for the same head all reported zero findings.

Governance classification: high-sensitivity provider-routing debt, not a source vulnerability and not clean Strix evidence. Remove the retired github_models/* fallback and wire a supported provider as tracked by this issue.

[seonghobae]

Current-head OpenCode canary update (2026-08-01)

The central provider/receipt cascade was exercised end-to-end against ContextualWisdomLab/naruon#1206 at exact head 0ce9d0c215bd7b341a129e362ca05cc94cdbfbe6.

• Scheduler run: https://github.com/ContextualWisdomLab/.github/actions/runs/30677734977
• Central review run: https://github.com/ContextualWisdomLab/.github/actions/runs/30677743465 (job 91308615124)
• Coverage source tree and coverage evidence both succeeded.
• The model pool ran for 66 minutes and reached the bounded 30-attempt ceiling.
• NVIDIA NIM candidates returned a mix of missing control JSON, provider/authentication failures, and bounded timeouts; the combined NIM budget stopped at approximately 900 seconds.
• OpenCode free candidates frequently produced review prose but failed the trusted receipt contract, including missing top-level control JSON, missing exact path/positive-line probe evidence, missing observed proof outcomes, or incomplete verification posture.
• OpenRouter candidates failed with credit-exhausted classification. Later OpenCode/OpenAI/GitHub Models candidates failed immediately and no candidate produced an accepted current-head control block.
• Final outcome: OPENCODE_MODEL_POOL_OUTCOME=exhausted and MODEL_OUTPUT_UNAVAILABLE. No APPROVE or REQUEST_CHANGES review was posted, preserving fail-closed review semantics.

This is not a clean review and not a source-code failure. It confirms that provider availability plus reliable structured-control compliance remain the active review-plane debt. A separate publication-capability defect discovered by the same canary is tracked in #691.

[seonghobae]

Additional current-head Strix provider evidence from naruon#1210 at 76c1c2df3c7f80b8a270864dea2ce63ec4fd86b0: run 30686711308, job 91333886096 attempted NVIDIA NIM and received HTTP 429, then attempted github_models/openai/o3 and github_models/openai/gpt-5-chat, both returning HTTP 410 github_models_retirement_brownout. No structured vulnerability report was produced; the gate explicitly logged that a displayed zero is incomplete evidence after provider failure and only then used the documented backend-unavailable neutral-skip path. This exact head independently has 0 open branch code-scanning alerts, 0 open Medium/High/Critical Dependabot alerts, 0 open secret-scanning alerts, and passing Trivy FS, OSV, dependency-review, Bandit, Semgrep, CodeQL, application tests, production build/image validation, coverage, lint, and typecheck evidence. Classification: provider-routing debt, not a clean Strix report and not a source defect.

[seonghobae]

Fresh protected-main runtime RCA — 2026-08-09 KST

Revalidated the live protected-main review plane rather than reusing the July/August-1 canaries.

• Protected main is still 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
• Current central OpenCode run 31265950492, opencode-review job 93139645486, successfully materialized source/coverage evidence and entered the model pool.
• The pool configured 13 candidates. After nvidia-nim/mistralai/mistral-small-4-119b-2603 consumed its bounded 180-second attempt and timed out, the next candidates still included retired GitHub Models entries such as github-models/openai/gpt-5, github-models/openai/gpt-5-chat, github-models/openai/o3, plus other github-models/* fallbacks.
• The same protected-main source still contains those github-models/* candidates after the July 30 retirement. This is therefore live routing debt, not merely historical documentation.

RCA

The root cause remains stale provider eligibility in the protected-main candidate pool: a permanently retired provider class is still eligible for runtime fallback after a live provider attempt fails. Even without relying on the later provider-specific failure text from this run, attempting a provider retired by contract cannot restore review availability and consumes bounded failover time/attempt budget.

Feasibility screening

1. Retry/top-up only: can improve NVIDIA/OpenRouter/OpenAI availability but cannot make retired GitHub Models viable. Reject as a migration fix.
2. Add invented/replacement credentials: rejected; this loop has no authority to create org secrets and credentials cannot resurrect a retired service.
3. Remove retired github-models/* candidates and update exact contracts: technically verifiable and causal, but the authoritative model-pool wrapper/tests are currently being modified on PR fix(opencode): allow governed free models for private repositories #830 under an active writer handoff. Starting a competing branch now would violate the repository-writer lease and create avoidable conflict on the same control-plane files.
4. Wait for fix(opencode): allow governed free models for private repositories #830 to reach a stable exact head, then replay the smallest retirement cleanup onto the resulting protected base: realistic. Acceptance must prove the retired provider prefix is absent from the executable pool/config and exact-head contracts, while supported fallback providers remain fail-closed and bounded.

No source write is being made from this issue while #830 owns the overlapping model-pool files. Re-evaluate immediately after #830 stabilizes/merges; do not close this issue until a protected-main run proves no retired GitHub Models candidate is attempted.