ContextualWisdomLab · seonghobae · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
@@ -8,7 +8,7 @@ on:
     # DiagramWeave (12), pg-erd-cloud (13), mhtml-etl-gateway (14),
     # html4tree (15), nonnest2 (16), orchestrator (17), newsdom-api (18),
     # noema (19), github (21), Clearfolio (23), accounting-information-platform (27),
-    # Keyverse (29), Scopeweave (31), contextual-orchestrator (34), DiskSage (37), Appguardrail (41),
+    # Keyverse (29), Scopeweave (31), DiskSage (37), Appguardrail (41),
     # governance-risk-compliance (43), Inkspan (47), fast-mlsirm (49),
     # BandScope (53), orgmetra (58), and semantic-data-portal (59).
     - cron: "2 * * * *"

@@ -16,9 +16,6 @@ permissions:
 
 jobs:
   dispatch-review-repair:
-    permissions:
-      contents: read
-      id-token: write
     uses: ./.github/workflows/pr-review-fix-scheduler.yml
     with:
       target_repository: ContextualWisdomLab/disksage

@@ -7,7 +7,6 @@ on:
       - scripts/ci/pr_review_fix_scheduler.py
       - .github/workflows/pr-review-autofix.yml
       - .github/workflows/bandscope-hourly-review-repair.yml
-      - .github/workflows/contextual-orchestrator-hourly-review-repair.yml
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
@@ -31,7 +30,6 @@ on:
       - tests/test_orgmetra_hourly_review_caller.py
       - tests/test_originweave_hourly_review_caller.py
       - tests/test_quarantine_sandbox_hourly_review_caller.py
-      - tests/test_contextual_orchestrator_hourly_review_caller.py
       - tests/test_afipc_hourly_review_caller.py
       - tests/test_hourly_autofix_context_quality_gate.py
       - tests/test_pr_review_conflict_scope.py
@@ -58,15 +56,13 @@ on:
       - docs/doctoring/orgmetra-hourly-review-caller.md
       - docs/doctoring/originweave-hourly-review-caller.md
       - docs/doctoring/quarantine-sandbox-hourly-review-caller.md
-      - docs/doctoring/contextual-orchestrator-hourly-review-caller.md
       - docs/doctoring/afipc-hourly-review-caller.md
   push:
     paths:
       - .github/workflows/pr-review-fix-scheduler.yml
       - scripts/ci/pr_review_fix_scheduler.py
       - .github/workflows/pr-review-autofix.yml
       - .github/workflows/bandscope-hourly-review-repair.yml
-      - .github/workflows/contextual-orchestrator-hourly-review-repair.yml
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
@@ -90,7 +86,6 @@ on:
       - tests/test_orgmetra_hourly_review_caller.py
       - tests/test_originweave_hourly_review_caller.py
       - tests/test_quarantine_sandbox_hourly_review_caller.py
-      - tests/test_contextual_orchestrator_hourly_review_caller.py
       - tests/test_afipc_hourly_review_caller.py
       - tests/test_hourly_autofix_context_quality_gate.py
       - tests/test_pr_review_conflict_scope.py
@@ -117,7 +112,6 @@ on:
       - docs/doctoring/orgmetra-hourly-review-caller.md
       - docs/doctoring/originweave-hourly-review-caller.md
       - docs/doctoring/quarantine-sandbox-hourly-review-caller.md
-      - docs/doctoring/contextual-orchestrator-hourly-review-caller.md
       - docs/doctoring/afipc-hourly-review-caller.md
 
 permissions:
@@ -176,7 +170,6 @@ jobs:
             tests/test_orgmetra_hourly_review_caller.py \
             tests/test_originweave_hourly_review_caller.py \
             tests/test_quarantine_sandbox_hourly_review_caller.py \
-            tests/test_contextual_orchestrator_hourly_review_caller.py \
             tests/test_afipc_hourly_review_caller.py \
             tests/test_pr_review_conflict_scope_control_files.py \
             tests/test_hourly_autofix_context_quality_gate.py \

@@ -7,7 +7,7 @@ on:
     # psychometrics-commons (9), OriginWeave (10), naruon (11),
     # DiagramWeave (12), pg-erd-cloud (13), mhtml-etl-gateway (14),
     # html4tree (15), orchestrator (17), noema (19), Clearfolio (23),
-    # Keyverse (29), Scopeweave (31), contextual-orchestrator (34), DiskSage (37), Appguardrail (41),
+    # Keyverse (29), Scopeweave (31), DiskSage (37), Appguardrail (41),
     # newsdom-api (43), Inkspan (47), fast-mlsirm (49), BandScope (53),
     # and semantic-data-portal (59).
     - cron: "16 * * * *"

@@ -4477,10 +4477,6 @@ jobs:
           # so the OpenRouter slots use cheap paid models billed against the
           # org's OpenRouter credits), then the full-size GPT-4.1 long-context
           # endpoint and provider-specific GPT/o3 fallbacks.
-          # The direct-OpenAI slot runs GPT-5.4: gpt-5.6-luna returns 404 on
-          # the OpenAI API (see a724582), so the pool keeps the newest VALID
-          # direct-OpenAI model instead of burning a candidate on a certain
-          # failure.
           OPENCODE_MODEL_CANDIDATES: "${{ needs.validate-pr-metadata.outputs.is_private == 'false' && 'nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5 nvidia-nim/nvidia/llama-3.1-nemotron-ultra-253b-v1 nvidia-nim/nvidia/nemotron-3-super-120b-a12b nvidia-nim/nvidia/nemotron-3-ultra-550b-a55b nvidia-nim/meta/llama-3.3-70b-instruct nvidia-nim/deepseek-ai/deepseek-v4-pro nvidia-nim/mistralai/codestral-22b-instruct-v0.1 opencode-free/nemotron-3-ultra-free opencode-free/deepseek-v4-flash-free opencode-free/north-mini-code-free opencode-free/laguna-s-2.1-free opencode-free/ling-3.0-flash-free opencode-free/big-pickle opencode-free/mimo-v2.5-free opencode-free/hy3-free opencode-free/minimax-m3-free opencode-free/glm-5-free opencode-free/kimi-k2.5-free opencode-free/qwen3.6-plus-free ' || '' }}opencode/gpt-5.6-terra github-models/deepseek/deepseek-v3-0324 openai/gpt-5.4 openrouter/deepseek/deepseek-v3.2 openrouter/qwen/qwen3-coder github-models/openai/gpt-4.1 github-models/openai/gpt-5 github-models/openai/gpt-5-chat github-models/openai/o3 github-models/deepseek/deepseek-r1-0528 github-models/deepseek/deepseek-r1"
           # One attempt per model, then fall through to the next model. Retrying
           # the SAME model 5x let a rate-limited/hung leader consume the whole

@@ -6,7 +6,7 @@ on:
     # codec-carver (5), life-os (6), Wardnet (7), mightyETL (8),
     # psychometrics-commons (9), naruon (11), pg-erd-cloud (13),
     # orchestrator (17), noema (19), Clearfolio (23), Keyverse (29),
-    # Scopeweave (31), contextual-orchestrator (34), DiskSage (37), Appguardrail (41), newsdom-api (43),
+    # Scopeweave (31), DiskSage (37), Appguardrail (41), newsdom-api (43),
     # Inkspan (47), fast-mlsirm (49), BandScope (53), and
     # semantic-data-portal (59).
     - cron: "10 * * * *"

@@ -693,10 +693,7 @@ jobs:
           echo "LLM_API_BASE_FILE=$llm_api_base_file" >> "$GITHUB_ENV"
 
       - name: Prepare GitHub Models fallback credentials
-        # github_models is included because its STRIX_FALLBACK_MODELS chain
-        # ends in openai-direct/gpt-5.4, which needs the direct-OpenAI key and
-        # API base to authenticate and route after the primary is exhausted.
-        if: steps.gate.outputs.provider_mode == 'openai_direct' || steps.gate.outputs.provider_mode == 'openrouter' || steps.gate.outputs.provider_mode == 'nvidia_nim' || steps.gate.outputs.provider_mode == 'github_models'
+        if: steps.gate.outputs.provider_mode == 'openai_direct' || steps.gate.outputs.provider_mode == 'openrouter' || steps.gate.outputs.provider_mode == 'nvidia_nim'
         env:
           GITHUB_MODELS_FALLBACK_TOKEN: ${{ secrets.STRIX_GITHUB_MODELS_TOKEN || github.token }}
           OPENAI_FALLBACK_KEY: ${{ secrets.STRIX_OPENAI_API_KEY || secrets.OPENAI_API_KEY }}
@@ -728,9 +725,6 @@ jobs:
             openai_fallback_key_file="$RUNNER_TEMP/openai_fallback_key.txt"
             printf '%s' "$openai_trimmed" > "$openai_fallback_key_file"
             echo "STRIX_OPENAI_FALLBACK_KEY_FILE=$openai_fallback_key_file" >> "$GITHUB_ENV"
-            openai_fallback_api_base_file="$RUNNER_TEMP/openai_fallback_api_base.txt"
-            printf '%s' 'https://api.openai.com/v1' > "$openai_fallback_api_base_file"
-            echo "STRIX_OPENAI_FALLBACK_API_BASE_FILE=$openai_fallback_api_base_file" >> "$GITHUB_ENV"
           fi
 
       - name: Prepare Vertex AI credentials
@@ -863,7 +857,6 @@ jobs:
           STRIX_GITHUB_MODELS_API_BASE_FILE: ${{ env.STRIX_GITHUB_MODELS_API_BASE_FILE }}
           STRIX_GITHUB_MODELS_KEY_FILE: ${{ env.STRIX_GITHUB_MODELS_KEY_FILE }}
           STRIX_OPENAI_FALLBACK_KEY_FILE: ${{ env.STRIX_OPENAI_FALLBACK_KEY_FILE }}
-          STRIX_OPENAI_FALLBACK_API_BASE_FILE: ${{ env.STRIX_OPENAI_FALLBACK_API_BASE_FILE }}
           STRIX_FAIL_ON_PROVIDER_SIGNAL: "1"
           STRIX_VERTEX_FALLBACK_MODELS: ""
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
@@ -889,17 +882,6 @@ jobs:
           export "STRIX_PROCESS_${budget_suffix}_SECONDS=$process_budget_seconds"
           export "STRIX_TOTAL_${budget_suffix}_SECONDS=5700"
 
-          # Recognized signals that the LLM backend was unavailable / starved.
-          # Defined before the gate loop so the bounded retry decision below
-          # can classify outcomes without duplicating the patterns later.
-          backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404|Error during penetration test: loginAsGuest failed after [0-9]+ attempts: curl exit 7: curl: \(7\) Failed to connect to 127\.0\.0\.1 port 48080'
-          model_behavior_error_signal='(^|[^A-Za-z0-9_])(agents|pydantic_ai|strix)(\.[A-Za-z_][A-Za-z0-9_]*)*\.ModelBehaviorError([^A-Za-z0-9_]|$)'
-          # Any evidence that a vulnerability was actually reported. Its presence
-          # forces a hard failure so real findings are NEVER downgraded. Keep the
-          # severity branch anchored away from identifiers so environment lines
-          # such as STRIX_FAIL_ON_MIN_SEVERITY do not look like findings.
-          reported_vulnerability_signal='Vulnerabilities[[:space:]]+[1-9]|(^|[^A-Za-z0-9_])severity[[:space:]]*:'
-
           # Capture the gate exit code plus its console output. The gate returns
           # exit 1 both for genuine blocking vulnerabilities AND for
           # LLM-backend-unavailable outcomes (GitHub Models "Too many requests"
@@ -908,68 +890,11 @@ jobs:
           # could not complete a scan. Provider failure is typed infrastructure
           # evidence, but remains non-passing because no authoritative complete
           # vulnerability result exists.
-          #
-          # A typed provider outage with no reported vulnerability finding is
-          # retried with bounded linear backoff inside this step so transient
-          # provider failures do not fail the required check on the first
-          # attempt. Genuine findings, configuration failures, and unexpected
-          # exit codes never retry; the deadline keeps every path inside the
-          # deterministic 120-minute job budget, and all-terminal outcomes
-          # remain fail-closed.
           strix_run_log="$RUNNER_TEMP/strix_gate_console.log"
-          : > "$strix_run_log"
-          strix_terminal_log="$strix_run_log"
           strix_rc=0
-          strix_gate_attempt=1
-          strix_gate_deadline=$(( SECONDS + 6000 ))
-          strix_gate_attempt_budget_var="STRIX_TOTAL_${budget_suffix}_SECONDS"
-          strix_gate_attempt_budget_seconds="${!strix_gate_attempt_budget_var:-$process_budget_seconds}"
           set +e
-          while : ; do
-            strix_attempt_log="$RUNNER_TEMP/strix_gate_console_attempt_${strix_gate_attempt}.log"
-            : > "$strix_attempt_log"
-            bash "$TRUSTED_STRIX_GATE" 2>&1 | tee "$strix_attempt_log"
-            strix_rc="${PIPESTATUS[0]}"
-            cat "$strix_attempt_log" >> "$strix_run_log"
-            strix_terminal_log="$strix_attempt_log"
-            if [ "$strix_rc" -eq 0 ]; then
-              break
-            fi
-            # Only exit-code 1 scan failures can be infrastructure outcomes.
-            if [ "$strix_rc" -ne 1 ]; then
-              break
-            fi
-            # Scope this attempt's retry decision to the log tail after the
-            # last pipeline-continuation marker, exactly like the terminal
-            # classification below: an already-exempted finding before the
-            # marker must not mask a retryable outage after it.
-            strix_retry_scope_log="$strix_terminal_log"
-            if grep -Fq 'allowing pipeline continuation' "$strix_terminal_log"; then
-              strix_retry_scope_log="$RUNNER_TEMP/strix_gate_console_tail.log"
-              awk '/allowing pipeline continuation/{buf=""; next} {buf=buf $0 "\n"} END{printf "%s", buf}' \
-                "$strix_terminal_log" > "$strix_retry_scope_log"
-            fi
-            # A reported vulnerability is authoritative evidence: never retry
-            # and never risk downgrading it.
-            if grep -Eiq "$reported_vulnerability_signal" "$strix_retry_scope_log"; then
-              break
-            fi
-            # Retry only recognized provider-outage / model-behavior classes.
-            if ! grep -Eiq "$backend_unavailable_signal" "$strix_retry_scope_log" \
-              && ! grep -Eq "$model_behavior_error_signal" "$strix_retry_scope_log"; then
-              break
-            fi
-            backoff_seconds=$(( ${STRIX_GATE_RETRY_BACKOFF_SECONDS:-90} * strix_gate_attempt ))
-            retry_reserve_seconds=$(( strix_gate_attempt_budget_seconds + backoff_seconds ))
-            remaining_seconds=$(( strix_gate_deadline - SECONDS ))
-            if [ "$strix_gate_attempt" -ge 3 ] || [ "$remaining_seconds" -lt "$retry_reserve_seconds" ]; then
-              echo "Provider-unavailable Strix attempt ${strix_gate_attempt} reached the bounded retry limit or the remaining job time budget (${remaining_seconds}s) is too small to retry; failing closed." >&2
-              break
-            fi
-            echo "Strix provider outage on attempt ${strix_gate_attempt}; retrying after ${backoff_seconds}s backoff." >&2
-            sleep "$backoff_seconds"
-            strix_gate_attempt=$(( strix_gate_attempt + 1 ))
-          done
+          bash "$TRUSTED_STRIX_GATE" 2>&1 | tee "$strix_run_log"
+          strix_rc="${PIPESTATUS[0]}"
           set -e
 
           if [ "$strix_rc" -eq 0 ]; then
@@ -983,15 +908,24 @@ jobs:
             exit "$strix_rc"
           fi
 
+          # Recognized signals that the LLM backend was unavailable / starved.
+          backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404|Error during penetration test: loginAsGuest failed after [0-9]+ attempts: curl exit 7: curl: \(7\) Failed to connect to 127\.0\.0\.1 port 48080'
+          model_behavior_error_signal='(^|[^A-Za-z0-9_])(agents|pydantic_ai|strix)(\.[A-Za-z_][A-Za-z0-9_]*)*\.ModelBehaviorError([^A-Za-z0-9_]|$)'
+          # Any evidence that a vulnerability was actually reported. Its presence
+          # forces a hard failure so real findings are NEVER downgraded. Keep the
+          # severity branch anchored away from identifiers so environment lines
+          # such as STRIX_FAIL_ON_MIN_SEVERITY do not look like findings.
+          reported_vulnerability_signal='Vulnerabilities[[:space:]]+[1-9]|(^|[^A-Za-z0-9_])severity[[:space:]]*:'
+
           # An earlier out-of-scope/below-threshold finding may already have
           # been exempted by the trusted gate. Classify a later provider
           # outage from the tail after the last continuation marker, but keep
           # that incomplete later scan non-passing.
-          strix_neutralization_scope_log="$strix_terminal_log"
-          if grep -Fq 'allowing pipeline continuation' "$strix_terminal_log"; then
+          strix_neutralization_scope_log="$strix_run_log"
+          if grep -Fq 'allowing pipeline continuation' "$strix_run_log"; then
             strix_neutralization_scope_log="$RUNNER_TEMP/strix_gate_console_tail.log"
             awk '/allowing pipeline continuation/{buf=""; next} {buf=buf $0 "\n"} END{printf "%s", buf}' \
-              "$strix_terminal_log" > "$strix_neutralization_scope_log"
+              "$strix_run_log" > "$strix_neutralization_scope_log"
           fi
 
           # Classify provider/backend exhaustion only when no vulnerability

@@ -5,18 +5,7 @@ this file. The format follows Keep a Changelog, and versioned releases follow
 Semantic Versioning where the repository publishes a release.
 
 ## [Unreleased]
-- Route Strix cross-provider fallbacks to explicit direct-OpenAI models
-  (`openai-direct/...`) through the OpenAI inference endpoint instead of
-  inheriting a provider-specific primary base: the workflow now provisions
-  `STRIX_OPENAI_FALLBACK_API_BASE_FILE` (`https://api.openai.com/v1`), while
-  standalone caller-supplied `LLM_API_BASE_FILE` values remain honored for
-  OpenAI-compatible endpoints. Known GitHub Models, NVIDIA NIM, and OpenRouter
-  bases are never inherited, and LiteLLM uses native OpenAI defaults only when
-  no base is supplied. A non-https override fails configuration. This removes the NVIDIA-NIM-edge
-  `404 page not found` that made the contracted final fallback unreachable
-  after NIM exhaustion.
-- Align stale `gpt-5.6-luna` test expectations with the valid `gpt-5.4`
-  contract left behind by the earlier model rename.
+
 - Honor each trusted base project's exact, integrity-bearing pnpm
   `packageManager` specification in OpenCode coverage images through the pinned
   Node distribution's Corepack runtime, instead of admitting the specification