fix(noema): batch sidecar route preflight

.github/workflows/security-scan.yml

@@ -339,8 +339,22 @@ jobs:
 
           echo "DEPENDENCY_REVIEW_SUPPORT repository=${REPOSITORY} visibility=${repository_visibility} base_sha=${BASE_SHA} head_sha=${HEAD_SHA} http_status=${http_status} curl_exit=${curl_status}"
 
-          if [ "$curl_status" -ne 0 ] || [ "$http_status" != "200" ]; then
-            echo "::error::Dependency review evidence unavailable for ${REPOSITORY} at exact base ${BASE_SHA} and head ${HEAD_SHA}: HTTP ${http_status}; curl exit ${curl_status}. Verify dependency-graph/security configuration and GitHub service behavior, then rerun. Failing closed."
+          evidence_state="complete"
+          unavailable_reason="none"
+          if [ "$curl_status" -ne 0 ]; then
+            evidence_state="unavailable"
+            unavailable_reason="transport"
+          elif [ "$http_status" = "403" ]; then
+            evidence_state="unavailable"
+            unavailable_reason="api_authorization"
+          elif [ "$http_status" != "200" ]; then
+            evidence_state="unavailable"
+            unavailable_reason="api_response"
+          fi
+          echo "DEPENDENCY_REVIEW_EVIDENCE state=${evidence_state} reason=${unavailable_reason} repository=${REPOSITORY} visibility=${repository_visibility} http_status=${http_status} curl_exit=${curl_status}"
+
+          if [ "$evidence_state" != "complete" ]; then
+            echo "::error::Dependency review evidence unavailable for ${REPOSITORY} at exact base ${BASE_SHA} and head ${HEAD_SHA}: classification ${unavailable_reason}; HTTP ${http_status}; curl exit ${curl_status}. This is not a vulnerability-free result. Verify dependency-graph/security configuration and GitHub service behavior, then rerun. Failing closed."
             exit 1
           fi
 

.github/workflows/strix.yml

@@ -171,11 +171,12 @@ jobs:
     # standing operating directive accepts that central OpenCode/Strix/Noema
     # scans may take more than two hours per model (docs/product-goal-directive.md).
     # The scanner gets a 150-minute process budget and a 155-minute total
-    # retry budget; the 170-minute step and 200-minute job leave deterministic
-    # time to preserve partial reports and publish a concrete failure reason.
+    # retry budget. Three one-hour sidecar preflight attempts plus the
+    # 170-minute scan step fit within this six-hour job with ten minutes left
+    # to preserve partial reports and publish a concrete failure reason.
     # Hitting any cap is fail-closed and never turns an incomplete scan into
     # an approval.
-    timeout-minutes: 200
+    timeout-minutes: 360
     runs-on: ubuntu-latest
     # Least-privilege token scoped to this job (Scorecard alert #43): the scan
     # exchanges an OIDC token (id-token) and publishes same-repo status evidence
@@ -565,8 +566,10 @@ jobs:
               ;;
           esac
           strix_model="$(printf '%s' "$STRIX_MODEL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
-          echo "strix_model=$strix_model" >> "$GITHUB_OUTPUT"
-          echo 'enabled=true' >> "$GITHUB_OUTPUT"
+          {
+            echo "strix_model=$strix_model"
+            echo 'enabled=true'
+          } >> "$GITHUB_OUTPUT"
           echo 'provider_mode=contextual_orchestrator' >> "$GITHUB_OUTPUT"
 
       - name: Provision contextual-orchestrator Strix sidecar

docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md

@@ -24,7 +24,7 @@ all five, and auto-optimize routing by cost.
 
 1. **Vendoring, pinned**: `scripts/ci/contextual_orchestrator_review_sidecar.sh`
    clones `ContextualWisdomLab/contextual-orchestrator` at an exact SHA
-   (`8cd99f139915131ba0239bce12a5d6a5fd85394e` today) into `RUNNER_TEMP`. The
+   (`ab7a813a69dae19541dc2888acd50c4ce37b29b7` today) into `RUNNER_TEMP`. The
    source's `requirements.lock` is installed with `--require-hashes` and
    `--no-deps`, so dependency resolution cannot silently move the reviewed
    runtime.
@@ -43,17 +43,21 @@ all five, and auto-optimize routing by cost.
    price-attested; a partial price vector, malformed numeric value, conflicting
    free marker, or missing currency for a published vector fails closed. The gateway's
    `orchestrator/free` virtual id fails closed (`400 invalid_model`) unless an
-   enabled zero-cost agent exists. Strix uses `orchestrator/auto`; its catalog
+   enabled zero-cost agent exists. Strix originally used `orchestrator/auto`
+   (superseded by the 2026-08-30 amendment below: Strix now uses
+   `orchestrator/free`, like OpenCode and Noema); the `auto` pool's catalog
    may admit priced routes only through this evidence-bearing
    policy, never through a direct-provider model identifier.
    The auto pool probes the free catalog first. Only when every selected free
    route rejects the real runtime request contract does it rebuild once from
    fully price-attested routes and record the rejected primary attempt. This is
    evidence-triggered failover, not an arbitrary free/paid mixing ratio.
-   Both stages share one twelve-route startup budget: no more than eight routes
-   enter the free primary stage and only its remaining capacity may enter priced
-   fallback. Full discovery counts remain in policy evidence, and the transient
-   priced catalog is removed immediately after loading.
+   Both stages share one 24-route startup budget: no more than eight routes
+   enter the free primary stage and only the remaining capacity (at most sixteen
+   routes) may enter the price-attested fallback when the `auto` pool is in use.
+   The `free` pool never admits priced fallback. Full discovery counts remain in
+   policy evidence, and the transient priced catalog is removed immediately
+   after loading.
 3. **ZDR-first within each cost tier**: `scripts/ci/zdr_policy.py` defines ZDR
    the way OpenRouter does ("a provider will not store your data for any period
    of time"; zero retention also implies no training) and is deliberately
@@ -73,21 +77,42 @@ all five, and auto-optimize routing by cost.
    credential-account-diverse agents catalog, capped in size, in the
    orchestrator's own `ModelAgent` schema. Every KV credential is an independent
    account; vendor or endpoint identity does not imply model equivalence. Only
-   explicit `model_group` membership may share routing evidence.
+   explicit `model_group` membership may share routing evidence. The sidecar
+   defaults the per-account cap to `contextual_orchestrator_review_policy`'s
+   own `DEFAULT_ACCOUNT_CAP` (4), never to the total preflight-route budget: an
+   earlier version of this ADR described defaulting the cap to the same
+   24-route total budget "so a single provider's catalog is not truncated,"
+   but that was a real, live-evidenced bug (ContextualWisdomLab/.github#1415)
+   — it silently disabled per-account diversification and let two
+   rate-limited NVIDIA NIM credentials sharing one upstream jointly occupy an
+   entire 12-slot preflight batch. `ORCHESTRATOR_CATALOG_ACCOUNT_CAP` remains
+   an explicit operator override. (2026-08-31 correction: that "defaults to
+   4" claim was true of the Python launcher's own fallback but not, until
+   this date, of the shell sidecar — `contextual_orchestrator_review_sidecar.sh`
+   still unconditionally exported a leftover literal `8` default whenever no
+   operator override was set, which meant the launcher's own env-unset
+   fallback branch could never actually run in production and every real run
+   got a cap of 8, not 4. The shell now derives its default the same way the
+   startup watchdog seconds below are derived: by reading
+   `contextual_orchestrator_review_policy.DEFAULT_ACCOUNT_CAP` at runtime
+   instead of hard-coding a numeric literal, so shell, Python, and this ADR
+   describe one real number.)
 4. **Wiring**: `pr-review-autofix.yml` and the Required OpenCode dispatch
    provision the sidecar with the five secrets before OpenCode runs and point
    every model/diagnosis candidate at `contextual-orchestrator/orchestrator/free`;
    the generated dispatch config contains only the gateway provider. The shared
    `opencode.jsonc` default `model`/`small_model` is the same gateway route.
    `noema-review.yml` retains `orchestrator/free`. `strix.yml` provisions the
-   same sidecar and uses the loopback chat-completions/API-compatible URL with
-   `orchestrator/auto`: the 2026-08-29 exact-head DiskSage scan proved that four
+   same sidecar and originally used the loopback chat-completions/API-compatible
+   URL with `orchestrator/auto` (superseded by the 2026-08-30 amendment below:
+   `strix.yml` now defaults to `orchestrator/free`, like OpenCode and Noema):
+   the 2026-08-29 exact-head DiskSage scan proved that four
    discovered free routes all shared the OpenRouter outage domain, which the
-   gateway correctly collapsed to one provider attempt. Strix therefore uses
+   gateway correctly collapsed to one provider attempt. Strix therefore used
    the provider-diverse pool supplied by all five configured credentials.
    Provider diversity and cost-evidence classification remain delegated to the
    gateway rather than embedding a second routing policy in GitHub Actions.
-   Strix has no external fallback and private targets pass visibility through
+   Strix had no external fallback under `auto` and private targets pass visibility through
    to the gateway's ZDR requirement. Noema reviewer identity remains
    `NOEMA_REVIEW_TOKEN` / GitHub App / OIDC and is still never `github.token`;
    Autofix mutation still requires `PR_REVIEW_MERGE_TOKEN` /
@@ -108,15 +133,40 @@ all five, and auto-optimize routing by cost.
 
 ## Consequences
 
+- **Bounded discovery preflight (2026-08-29):** the sidecar probes at most 24
+  selected routes in concurrent batches of four and stops after the first batch
+  with a usable text route. This preserves a finite startup budget while
+  allowing a rejected first catalog slice to fall through to later discovered
+  routes. The intentional oversized-body contract probe captures its expected
+  413 diagnostic locally so it cannot be mistaken for provider discovery
+  failure. Exhausting every bounded batch still fails closed before healthz.
+
+- **Separate startup and serving budgets (2026-08-30):** route admission keeps
+  the ten-second timeout so unavailable providers cannot delay healthz, while
+  the serving `ModelClient` uses the Noema gate's 9,600-second review budget.
+  Both phases keep zero retries and the same bounded request policy; the
+  launcher test verifies the two constructed client configurations separately.
+
+- **Direct gateway requests (2026-08-30):** the sidecar's startup request and
+  Noema request select explicit `route` orchestration so they validate and use
+  the direct virtual-pool path without invoking auto-mode triage. The Noema
+  change is limited to the exact process-local sidecar origin; external
+  OpenAI-compatible URLs retain their original payload. Provider response
+  validation and fail-closed non-200 handling are unchanged.
+
 - The autofix/OpenCode review paths no longer hard-code any provider base URL
   or model id; upstream model selection is delegated to the orchestrator's
-  discovery under the zero-cost pool. Strix uses the separately governed auto
-  pool without treating absent price metadata as either free or paid-route
-  evidence.
-- Strix delegates selection to `orchestrator/auto`. Its correctness-first pool
-  remains distinct from the zero-cost OpenCode/Noema pool, while private-target
-  ZDR admission remains fail-closed. Unknown-cost routes remain auditable but
-  ineligible; free and fully price-attested routes are the only review routes.
+  discovery under the zero-cost pool. Strix originally used the separately
+  governed auto pool (superseded by the 2026-08-30 amendment below: Strix now
+  uses the same zero-cost pool as OpenCode/Noema) without treating absent
+  price metadata as either free or paid-route evidence.
+- Under `orchestrator/auto`, selection is delegated to the gateway's
+  correctness-first pool, distinct from the zero-cost OpenCode/Noema pool,
+  while private-target ZDR admission remains fail-closed. Unknown-cost routes
+  remain auditable but ineligible; free and fully price-attested routes are
+  the only review routes. (This paragraph describes the `auto` pool mode
+  itself, which still exists for any caller that opts into it explicitly —
+  see the 2026-08-30 amendment below for why Strix no longer does.)
 - Workers need egress to the five provider model-list hosts and, when reachable,
   `https://openrouter.ai/api/v1/endpoints/zdr`; the feed failure path is
   graceful (static table).

docs/adr/0005-sidecar-preflight-token-budget.md

@@ -46,15 +46,14 @@ Citations below pin to the exact reviewed blob at `main`'s
 2. **The shell script's own virtual-pool smoke request.** Once `/healthz` succeeds (a separate,
    already-completed budget — Layer 2 does not draw from Layer 1's 180s), the shell script sends one
    `POST /v1/chat/completions` with `"model":"orchestrator/free"` (the *virtual* pool id, not a
-   specific candidate) and its own fixed `max_tokens`, currently `4096`, under a **120-second**
-   `curl --max-time`. This 120s value is itself the outcome of a prior, real, evidenced fix in this
+   specific candidate) and its own fixed `max_tokens`, currently `4096`, under a **one-hour**
+   `curl --max-time`. The former 120s value was itself the outcome of a prior, real, evidenced fix in this
    exact file (raised from a too-tight 30s after live reproduction on
    `ContextualWisdomLab/contextual-orchestrator#921` showed a genuinely-healthy DeepSeek NIM route
    needing more than 30s to complete a real generation) — the comment there explicitly documents that
-   this required-workflow job budgets **120 minutes** total (`timeout-minutes` in
-   `strix.yml`/`noema-review.yml`) and that *"the org's own stated policy accepts multi-hour central
-   review latency in favor of accuracy over speed."* This ADR's design deliberately **does not shorten
-   that 120s value** — doing so would reintroduce the exact regression that prior fix corrected. The
+   these required-workflow jobs now budget up to **six hours** total and that *"the org's own stated
+   policy accepts multi-hour central review latency in favor of accuracy over speed."* The one-hour
+   bound removes the synthetic 120s failure while preserving finite retry and failover behavior. The
    correct fix for a hang, per Devin Review (see Decision §1), is a bounded *retry*, not a shorter
    *timeout*.
 
@@ -178,10 +177,10 @@ correctly caught in an earlier revision of this text):**
     treats it as Trigger A: retried up to `REVIEW_PREFLIGHT_GATEWAY_MAX_ATTEMPTS` times against a
     candidate the gateway is, by the same reasoning as the Trigger-B/route-diversity note below, more
     likely to repeat than diversify away from. **This does not change Layer 2's stated worst case**
-    (`REVIEW_PREFLIGHT_GATEWAY_MAX_ATTEMPTS × 120s` — this failure still consumes attempts from the
+    (`REVIEW_PREFLIGHT_GATEWAY_MAX_ATTEMPTS × 3600s` — this failure still consumes attempts from the
     same shared Trigger-A budget, not an additional one), but it does mean this specific failure
     typically consumes the *entire* retry budget before failing closed, rather than failing fast the
-    way a correctly-classified Trigger B would (one attempt, ~120s). A correct fix requires a
+    way a correctly-classified Trigger B would (one attempt, up to one hour). A correct fix requires a
     `contextual-orchestrator` change (a machine-readable field distinguishing the two
     `ProviderResponseError` cases through the `/v1/chat/completions` error boundary) — genuinely out of
     scope for this sidecar-only ADR and its stacked implementation PR. Fragile string-matching on the
@@ -337,22 +336,22 @@ retried once, unconditionally, would be a real, computed worst-case blowup again
   itself be exactly the unjustified heuristic this ADR's convergence principle already rejects.
   Tracked as `ContextualWisdomLab/.github#1458`; revisit if real hosted-run telemetry (already required
   below) shows a specific, evidenced bias worth correcting.
-- **Layer 2** (bounded only by the job's own 120-minute ceiling, per the org's stated "accuracy over
+- **Layer 2** (bounded by the caller job's ceiling, per the org's stated "accuracy over
   speed" policy already reasoned in this file — *not* by the 180s Layer 1 budget, which has already
-  completed by the time Layer 2 runs): keep the existing per-attempt timeout (**120s, unchanged** — not
-  shortened, per Context above) and the existing **`4096` budget, unchanged throughout — Layer 2 never
+  completed by the time Layer 2 runs): use a one-hour total-time timeout plus a 10-second connection
+  timeout. Keep the existing **`4096` budget, unchanged throughout — Layer 2 never
   escalates** (already proven working on a real hosted run, `contextual-orchestrator#921`; see Decision
   §1 for why an escalation tier was considered and dropped here). Allow up to
-  `REVIEW_PREFLIGHT_GATEWAY_MAX_ATTEMPTS = 3` total attempts, consumed only by Trigger A (transport
+  `REVIEW_PREFLIGHT_GATEWAY_MAX_ATTEMPTS = 3` total attempts (one for an explicitly pinned
+  single-candidate job), consumed only by Trigger A (transport
   failure/hang/non-2xx) — Trigger B (empty + either its `finish_reason == "length"` or
-  reasoning-without-content signature) is not retried at Layer 2 at all (Decision §1). **Worst case**:
-  3 × 120s = **360s (6 minutes)** —
-  explicit, bounded, and small relative to the job's 120-minute ceiling; the previous design's worst
-  case was already 120s for one unconditional attempt with no chance of recovery, so this trades a
-  bounded amount of additional worst-case latency for surviving exactly the transient-hang class of
-  failure reproduced live on this ADR's own PR.
-- **Initial values are reused precedent, not new guesses** (Devin Review's fourth finding): every
-  number above is either already deployed in this exact codebase today (`10s`, `120s`, `4096`, `12`)
+  reasoning-without-content signature) is not retried at Layer 2 at all (Decision §1). The job timeout
+  and per-attempt timeouts are fail-closed wall-clock bounds; a pinned candidate failure advances to
+  the next job instead of reporting curl's former synthetic 120-second transport failure.
+- **Initial values are derived or reused, not guesses** (Devin Review's fourth finding): the one-hour
+  attempt bound follows from the six-hour caller ceiling: three attempts plus the 170-minute Strix
+  workload consume 350 minutes and preserve ten minutes for cleanup. Other numbers are either already
+  deployed in this exact codebase today (`10s`, `4096`, `12`)
   or has direct external documentation backing it (`16` — the pre-#1436 value this codebase already
   ran with, and separately the floor OpenRouter's own schema documents: *"some providers enforce a
   minimum of 16"* for the deprecated `max_tokens` field). The two new counters
@@ -398,8 +397,9 @@ outcome already observed in production.**
   being wrong for a fixed token budget, or hanging/failing transiently, which is the actual shape of
   the problem — while keeping every worst case explicit and bounded rather than open-ended.
 - Layer 1's worst case would grow from ~120s to a computed 160s, still under its existing 180s
-  healthz-readiness ceiling. Layer 2's worst case would grow from a single 120s attempt with no
-  recovery path to up to 360s across bounded retries — small relative to the job's 120-minute ceiling
+  healthz-readiness ceiling. Layer 2 allows up to three one-hour attempts; the six-hour Strix caller
+  leaves ten minutes after that maximum plus its 170-minute scan step, while pinned Noema jobs use one
+  attempt before cross-job failover.
   and consistent with this file's own already-stated "accuracy over speed" policy.
 - Keeping Layer 2 (not just Layer 1) would mean the preflight still proves the actual consumer-facing
   `orchestrator/free` route works, not only that individual candidates can respond in isolation —