fix(ci): restore evidence-only review admission

[seonghobae]

Current owner state — 2026-09-14

This PR remains the canonical central .github writer for review-sidecar admission/preflight. It is Draft / not merge-ready. Protected main is 91be6442906c7b6b4f600272c953699708394327; ordinary non-force reconciliation #2197 merged that protected delta into this branch. Current exact head is db3d648c905d283f03fc16fbc9891ba76edd56b8, direct base main@91be6442906c7b6b4f600272c953699708394327, open/mergeable/Draft. No predecessor check or review evidence transfers to this head.

Source contract

The launcher sends one provider-default semantic compatibility observation per evidence-eligible route. Central CI does not author max_tokens, temperature, token escalation, inference retry budgets, provider/model/group preference, or a paid fallback path. Reasoning-only / length-exhausted / malformed / transport-failed observations are bounded rejection evidence and do not allocate another model call. Both preflight and serving clients keep timeout=None and max_retries=0.

Independent provider-account lanes may progress concurrently while routes sharing one credential/account remain serialized; completion order is restored to deterministic catalog order and does not become routing preference. The shell provisioner no longer performs a second /v1/chat/completions replay after launcher preflight and no longer owns temperature, max_tokens, or REVIEW_PREFLIGHT_GATEWAY_MAX_ATTEMPTS. /healthz plus persisted route evidence form the provisioning readiness boundary; the actual review consumer is the first post-provisioning gateway workload.

Historical fixed-token/escalation/paid-fallback/gateway-retry tests are retired structurally rather than hidden by name/prefix filtering. Purpose-complete source-rewriting workflow/trigger/repair-driver machinery remains absent. ADR-0029 remains explicitly Superseded.

Hosted RED and prerequisite ownership

Exact-head Runtime Quality 34826203993 is now terminal FAILURE on a real GitHub-hosted runner. Job 103918848911 checked out exact db3d648c... successfully, then failed in Verify scheduler and contextual-orchestrator review-repair contracts during pytest collection. The review-repair suite intentionally invokes repository-wide collection while the Noema document dependency install was skipped for this changed-path selection; eleven Noema-related test modules then failed import because scripts/ci/noema_review_document.py requires defusedxml and that dependency was absent.

This is a valid workflow/dependency RED, not evidence that the repaired provider-default sidecar contract regressed. The causal dependency predicate is already canonically owned by #2170: its retained full-suite repair makes scheduler/review-repair execution install the Noema document hashed dependency lock because unscoped collection imports that path. Duplicating the same predicate here would create competing central writers and a mutable sibling dependency.

Therefore the integration order for this lane is: #2170 reaches protected main normally → ordinary/non-force reconcile this branch onto that new protected tip → reacquire all exact-head Runtime Quality/security/CodeQL/review evidence. No direct #1629 copy of #2170's repair is authorized.

On current db3d648c..., SAST 34826203960 is terminal SUCCESS; Security 34826203937, Python Security 34826203915, and CodeQL 34826203973 remain queued. Those results become historical after the required reconciliation. State: SIDECAR_SOURCE_REPAIRED / CURRENT_MAIN_RECONCILED / HOSTED_RED_CONFIRMS_#2170_PREREQUISITE / DRAFT.

Ownership and merge boundary

• feat: add read-only Actions queue health evidence #1150/ops: diagnose and bound organization GitHub Actions queue starvation #712 own read-only queue observation/classification/SLO evidence.
• Removing the implicit 90 s model timeout leaves review runner occupancy unbounded — needs an admission/continuation bound first #2139/docs(adr): bound review runner occupancy by progress, not elapsed inference time #2140 own progress/idle continuation and runner-reclamation semantics; any bound must be progress/idle based, never a total model elapsed-time cutoff.
• fix(autofix): route Required OpenCode coverage failures to RCA #2170 owns the review-repair full-suite dependency-install predicate proven necessary by the exact-head Runtime Quality RED above.
• contextual-orchestrator#1106 plus the immutable release lane own final provider discovery/credential/routing/TTC architecture. Central CI consumes the released boundary rather than becoming a second provider-policy owner.

No self-approval, administrator bypass, stale evidence transfer, no-op wake commit, blind rerun, provider/paid fallback hard-code, timeout rollback, synthetic status, gate weakening, force update, or destructive rebase is authorized.

[coderabbitai]

📝 Walkthrough

Walkthrough

Strix의 free admission 정책이 증거 기반으로 정리되었습니다. 런처는 free 풀과 one-shot preflight를 사용합니다. 카탈로그는 legacy 제한값과 priority를 적용하지 않습니다. Provider-account별 preflight 동시성과 관련 회귀 테스트, 문서, 수리 자동화가 추가되었습니다.

Changes

증거 기반 admission

Layer / File(s)	Summary
Evidence 기반 카탈로그와 legacy 입력 처리 scripts/ci/contextual_orchestrator_review_policy.py, tests/test_contextual_orchestrator_*policy*, tests/test_contextual_orchestrator_agent_id_collisions.py	카탈로그는 비용·자격 증명·ZDR 증거만 사용합니다. limit과 account_cap은 무시하고 진단 플래그와 폐기 경고를 제공합니다. 정규화된 agent ID 충돌은 실패-폐쇄합니다. Bytez의 exact-zero meterPrice 증거를 보존합니다.

free 런타임 preflight

Layer / File(s)	Summary
free 풀과 one-shot preflight scripts/ci/contextual_orchestrator_review_launcher.py, scripts/ci/contextual_orchestrator_review_sidecar.sh, tests/test_contextual_orchestrator_review_transient_preflight.py, tests/test_contextual_orchestrator_central_free_only.py	런처와 sidecar는 free 풀만 허용합니다. Preflight 전송은 proxy_send_once와 max_retries=0을 사용합니다. 응답 증거가 있는 경우에만 후보별 escalation을 수행합니다.
Provider-account별 동시성 및 진단 회귀 tests/_contextual_orchestrator_review_runtime_preflight_cases.py, tests/test_contextual_orchestrator_review_preflight_concurrency.py, tests/test_contextual_orchestrator_review_no_heuristic_compute.py	독립 provider-account lane은 병렬로 probe합니다. 같은 계정의 route는 직렬화합니다. Gateway 오류, 응답 형식, sanitizer, fallback 정리, route 순서와 fail-closed 결과를 검증합니다.

수리 자동화와 실행 계약

Layer / File(s)	Summary
일회성 수리 스크립트와 workflow scripts/source_fix_1629_no_heuristic_compute*.py, .github/source-fix-1629-no-heuristic-compute.trigger, .github/workflows/source-fix-1629-no-heuristic-compute.yml	수리 스크립트가 launcher와 sidecar의 휴리스틱 구현을 provider-default 동작으로 치환합니다. Workflow가 수리 전후 테스트, lint, shell 검사, 정리와 push를 실행합니다.
정책·ADR·운영 문서 docs/doctoring/*, docs/adr/*, docs/product-technical-gap-baseline.md, docs/superpowers/plans/*	free_account_diversity를 진단 증거로 정의합니다. Admission과 readiness를 분리합니다. Provider-account lane 동시성, sidecar pin, Bytez evidence, exact-head 운영 조건을 기록합니다.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Discovery
  participant ReviewPolicy
  participant ReviewLauncher
  participant ProviderAccount
  Discovery->>ReviewPolicy: discovery rows와 비용·자격 증명 증거 전달
  ReviewPolicy-->>ReviewLauncher: admission된 catalog 반환
  ReviewLauncher->>ProviderAccount: provider-account lane별 preflight 전송
  ProviderAccount-->>ReviewLauncher: response evidence 또는 오류 반환
  ReviewLauncher-->>ReviewPolicy: preflight 결과를 catalog 순서로 기록

Loading

Merge Risk: 🟠 High · up to ba950

The current head still violates the evidence-only preflight contract, and the automated repair path can run against an unintended head or proceed from a false RED result while leaving partial changes. These issues should be resolved before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 85.63% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 160 functions across 18 files. (7 skipped: …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 저장소 작성 휴리스틱을 제거하고 evidence-only review admission을 복원하는 주요 변경 사항을 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/no-heuristic-review-admission-current-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

The two red checks that are not structural on this head (agent-review-runtime-quality, quality) are this PR's own contract, and they were red before today's merge with main:

• tests/test_contextual_orchestrator_review_no_heuristic_compute.py exists only on this branch. On the pushed head ba9500d4 and on the pre-merge tip a436bd41 (2026-09-02) the same 3 tests fail: test_preflight_contains_no_repository_authored_sampling_or_token_allocation (:55, forbidden_names.isdisjoint(assigned_names) is false — the launcher still assigns REVIEW_MAX_BODY_BYTES, REVIEW_MAX_OUTPUT_TOKENS, REVIEW_PREFLIGHT_BASE_TOKENS, …), test_budget_starvation_evidence_does_not_allocate_an_ad_hoc_second_model_call (:95, 2 calls, expected 1), and test_preflight_success_uses_provider_defaults_and_one_model_call (payload carries max_tokens: 16 etc.).
• The merge commit changed 0 lines of scripts/ci/contextual_orchestrator_review_launcher.py, and main has not touched that file since the merge-base 3f88e13a. The forbidden-name count in the launcher is 7 on main, 4 on this branch: the branch's commits removed 3 and the test forbids all 7.

So this is the PR's remaining work against its own oracle, not a resolution defect and not the gateway. The other red checks on this head (noema-review, the two CodeQL compatibility analysis shards) are the structural classes tracked on #1935 / #1929 / contextual-orchestrator#1045 and will not turn green from changes here.

[seonghobae]

Fresh governance reconciliation: current head is ba9500d, not the older a436bd4 snapshot in the body; the PR is mechanically non-mergeable and still carries temporary source-fix machinery. Its own merge boundary says it is not merge-ready and must be Draft-equivalent. The previously recorded GraphQL connector defect no longer blocks the transition, so I am aligning the actual lifecycle to Draft without altering, closing, or discarding any valid evidence-only review delta. Fresh exact-head repair/check/review evidence remains required.

[seonghobae]

2026-09-14 queue-saturation handoff from canonical #712/#1150: this PR's existing provider-account concurrency work is now directly relevant to a reproduced organization-level incident, but the branch is not mergeable completion evidence yet.

Fresh current facts: protected .github/main is 7f07029381a9ca770d0a68b7f3938dd652799d4d; this PR is still exact ba9500d473ecf0df845acd107b1b504349fca3e6, 77 commits ahead / 129 behind that protected tip and mechanically non-mergeable. It still carries .github/workflows/source-fix-1629-no-heuristic-compute.yml, the trigger, and repair-driver files that its own merge boundary says must be removed. Exact-head Agent Review Runtime Quality 33971621825 is a real owner RED: the runner checked out ba9500d... and failed specifically in Verify scheduler and contextual-orchestrator review-repair contracts; the existing owner note identifies the three no-heuristic failures in test_contextual_orchestrator_review_no_heuristic_compute.py. Those failures must be repaired, not bypassed.

Separately, #712 now shows why the valid concurrency delta matters operationally. After protected #2163 advanced review provisioning to CO 767e67fb... with the intentionally-null default model timeout, 31 current-head review jobs occupied hosted slots and long holders spent roughly 3.5–5+ hours in Provision contextual-orchestrator review sidecar; an org sample had 32 in-progress and 113 queued with no self-hosted runners. Restoring the historical 90-second model deadline is explicitly not the fix.

This branch already contains the right shape for one causal repair: independent provider-account lanes enter preflight concurrently, routes sharing the same account remain serial, and a synchronization-barrier test proves cross-account overlap without using elapsed-time thresholds. Preserve that valid delta. The required repair order is therefore: resolve this branch's own no-heuristic RED → remove purpose-complete source-fix machinery → ordinary/non-force reconcile current protected main while preserving the concurrency contracts → exact-head GREEN/review. Do not open a competing launcher/preflight writer merely to address #712. Longer-term provider admission/routing/TTC ownership still migrates to contextual-orchestrator#1106 and the immutable released gateway path tracked by #1759.