fix(ci): group review catalog admission/diversity by outage domain, not account

CHANGELOG.md

@@ -24,6 +24,35 @@ Semantic Versioning where the repository publishes a release.
   still named the removed `free_family_diversity` evidence field instead of
   its `free_account_diversity` replacement, which could send future
   monitoring work looking for a field that no longer exists.
+- `scripts/ci/contextual_orchestrator_review_policy.py`'s catalog admission
+  cap and diversity evidence no longer conflate "independent credential
+  account" with "independent outage domain": `nvidia_nim`/`nvidia_nim_sub`
+  are independent accounts (may expose different models) but share one
+  physical upstream endpoint (`https://integrate.api.nvidia.com/v1`), so
+  they now share one admission-cap budget and count as one outage domain. A
+  new `free_outage_domain_diversity` report field (additive, alongside the
+  existing `free_account_diversity`) reflects this for callers deciding
+  whether a single provider outage could empty the free catalog. Outage-
+  domain grouping normalizes each row's `base_url` first (lowercasing
+  scheme/host, dropping an explicit default port, stripping a trailing
+  slash, and never raising even on a malformed IPv6-bracket URL), so a
+  formatting difference alone cannot split one physical endpoint into two
+  domains. Within a shared domain, the admission cap's bounded slots are
+  now split round-robin across the domain's contending accounts instead of
+  being consumed entirely by whichever account's rows happen to sort first
+  -- fixing a narrower starvation bug the outage-domain grouping itself
+  introduced (one credential could otherwise get zero admissions from a
+  shared domain even with rows available and cap budget nominally unused
+  by it). That fairness reordering is now strictly scoped to one admission-
+  priority tier (cost tier + ZDR status) at a time, never across tiers --
+  an earlier revision grouped a whole outage domain's rows into one block
+  regardless of tier, which could drag a lower-priority route (paid,
+  non-ZDR) ahead of a higher-priority route (free, ZDR) belonging to a
+  different domain, sometimes dropping a free route for a paid one under a
+  tight catalog limit. IPv6 host normalization now re-brackets a
+  colon-bearing host before appending a port, so an explicit-port address
+  (`[::1]:8443`) and an unrelated literal that merely contains the same
+  digits (`[::1:8443]`) no longer collapse to one outage domain.
 - Noema, Strix, and OpenCode review sidecars now vendor contextual-orchestrator
   at `c107e3e52371993aa9c326fcc245e01c41fc3850` and treat every KV credential
   as an independent discovery account. Same-vendor credentials no longer

docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md

@@ -190,6 +190,29 @@ all five, and auto-optimize routing by cost.
   amendment" (above) are closed, without requiring a manual re-audit.
   `docs/doctoring/contextual-orchestrator-strix-free-diversity-evidence.md`
   records that PR's own reasoning trail.
+- **2026-08-31 correction: account diversity is not outage-domain diversity.**
+  Review during this session found that #1468 (above), in correctly stopping
+  `nvidia_nim`/`nvidia_nim_sub` from being treated as one *model-catalog*
+  family, also let `free_account_diversity` and the catalog's admission cap
+  treat them as two fully independent *outage domains* — they are not: both
+  resolve to the identical `https://integrate.api.nvidia.com/v1` upstream
+  (see `PROVIDER_BASE_URLS` in `scripts/ci/zdr_policy.py`, and that table's
+  own `nvidia_nim_sub` ZDR-scope note). Conflating the two meant a discovery
+  report whose only free routes were these two credentials reported
+  `free_account_diversity == 2` — falsely reassuring for exactly the decision
+  this evidence exists to support (would a single physical outage empty the
+  free catalog) — and the admission cap let the pair jointly consume up to
+  twice its intended per-domain budget, crowding out a genuinely independent
+  provider even when one had free routes available.
+  `contextual_orchestrator_review_policy.py` now reports a second, distinct
+  field, `free_outage_domain_diversity`, grouped by each row's own `base_url`
+  evidence rather than a second hand-maintained provider-name table, and the
+  admission cap (`account_cap`; the name predates this fix and is kept for
+  CLI/environment stability) groups by outage domain, not by credential. A
+  caller deciding whether Strix can safely rely on a strict `orchestrator/free`
+  pool without the `orchestrator/auto` paid fallback (open PR #1437) should
+  read `free_outage_domain_diversity`, not `free_account_diversity`, for that
+  specific decision.
 - **2026-08-31 amendment: Noema reviews independently of OpenCode.** Noema no
   longer waits for an OpenCode approval, review-thread state, or other check
   conclusions before calling the gateway and submitting its current-head

docs/product-goal-directive.md

@@ -66,7 +66,7 @@ Per this file's own conflict policy above: this note is the resolution, and `doc
 
 **Note (flagged by CodeRabbit on this PR, 2026-08-30):** section 8's quoted text describes `contextual-orchestrator`'s general product capability — broad model/modality support and all-five-secret auto model discovery as a *design principle for the orchestrator itself*. It does not specify, and must not be read as overriding, which pool each CI consumer routes through: that is governed exclusively by `docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md` and its doctoring records — `OpenCode` and `Noema` use the fail-closed, ZDR-prioritized `orchestrator/free` pool; only `Strix` security analysis uses the provider-diverse `orchestrator/auto` pool; private/internal review targets require an attested ZDR-only catalog and never fall back to a non-ZDR provider. Do not loosen any CI consumer's pool or credential scope on the strength of this section's general wording alone.
 
-**Note (2026-08-30, superseded by the merged pin flip — see the correction below):** an earlier draft of this note said Strix stayed on `orchestrator/auto` pending `free_family_diversity` reaching `>= 2`. That is no longer true and must not be read as current: `.github/workflows/strix.yml` now hardcodes `STRIX_MODEL`/`CONTEXTUAL_ORCHESTRATOR_POOL` to `orchestrator/free` and fails closed on any other value, and ADR-0003's 2026-08-30 amendment records the owner's decision to accept the residual single-outage-domain risk immediately rather than wait for the evidence-gated threshold this note originally described. `free_account_diversity` (`scripts/ci/contextual_orchestrator_review_policy.py`; renamed from `free_family_diversity` once every KV credential became an independent discovery account rather than being grouped into a vendor "family", see #1468) remains useful as ongoing monitoring evidence for that accepted risk, not as a gate blocking the pin.
+**Note (2026-08-30, superseded by the merged pin flip — see the correction below):** an earlier draft of this note said Strix stayed on `orchestrator/auto` pending `free_family_diversity` reaching `>= 2`. That is no longer true and must not be read as current: `.github/workflows/strix.yml` now hardcodes `STRIX_MODEL`/`CONTEXTUAL_ORCHESTRATOR_POOL` to `orchestrator/free` and fails closed on any other value, and ADR-0003's 2026-08-30 amendment records the owner's decision to accept the residual single-outage-domain risk immediately rather than wait for the evidence-gated threshold this note originally described. `free_account_diversity` (`scripts/ci/contextual_orchestrator_review_policy.py`; renamed from `free_family_diversity` once every KV credential became an independent discovery account rather than being grouped into a vendor "family", see #1468) remains useful as ongoing monitoring evidence for that accepted risk, not as a gate blocking the pin. **Correction (2026-08-31):** for *this specific* single-outage-domain risk, read `free_outage_domain_diversity`, not `free_account_diversity` — #1468's rename correctly made every KV credential an independent *account*, but `nvidia_nim`/`nvidia_nim_sub` remain one *outage domain* (both resolve to the identical `https://integrate.api.nvidia.com/v1` upstream), so `free_account_diversity` alone can read `2` for a catalog that is, in fact, still exposed to a single provider outage. `free_outage_domain_diversity` is the field that actually answers this note's question.
 
 ## 9. Reference libraries, tool invocations, and ecosystem repositories