feat(perf): attest exact product performance evidence

.github/actions/noema-review/two_phase.py

@@ -167,16 +167,20 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     changed_files = gate.fetch_changed_files(repo, number)
     changed_paths = tuple(file_path for file_path, _status in changed_files)
     review_context = gate.build_review_context(repo, number, pull_request, changed_files)
-    verdict = gate.call_llm(
-        repo,
-        number,
-        pull_request,
-        diff,
-        truncated,
-        expected,
-        review_context,
-        changed_paths,
-    )
+    try:
+        verdict = gate.call_llm(
+            repo,
+            number,
+            pull_request,
+            diff,
+            truncated,
+            expected,
+            review_context,
+            changed_paths,
+        )
+    except gate.NoemaTransportError as exc:
+        _emit_transport_capacity_outputs(exc, expected_head=expected)
+        raise
 
     _write_envelope(
         path,
@@ -196,6 +200,45 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     return 0
 
 
+def _emit_transport_capacity_outputs(
+    exc: gate.NoemaTransportError,
+    *,
+    expected_head: str,
+) -> None:
+    """Publish typed capacity evidence for the workflow's bounded re-dispatch step."""
+    retry_attempt = gate.current_transport_retry_attempt()
+    delay = gate.transport_redispatch_delay_seconds(
+        transport_retry_attempt=retry_attempt,
+        head_sha=expected_head,
+        retry_after_seconds=exc.retry_after_seconds,
+    )
+    eligible = bool(exc.capacity_unavailable and delay is not None)
+    outputs = {
+        "transport_capacity_unavailable": "true" if exc.capacity_unavailable else "false",
+        "transport_retry_eligible": "true" if eligible else "false",
+        "prepared": "false",
+    }
+    if type(exc.http_status) is int:
+        outputs["transport_http_status"] = str(exc.http_status)
+    if type(exc.provider_attempt_count) is int:
+        outputs["provider_attempt_count"] = str(exc.provider_attempt_count)
+    if delay is not None:
+        outputs["transport_retry_delay_seconds"] = str(delay)
+        outputs["transport_retry_next_attempt"] = str(retry_attempt + 1)
+    gate.append_github_output(outputs)
+    if eligible:
+        print(
+            "::notice::Noema provider capacity unavailable after gateway failover; "
+            f"bounded continuation re-dispatch is eligible in {delay}s "
+            f"(attempt {retry_attempt + 1}/{gate.MAX_TRANSPORT_REDISPATCH_ATTEMPTS})."
+        )
+    elif exc.capacity_unavailable:
+        print(
+            "::error::Noema provider capacity unavailable after gateway failover; "
+            "automatic re-dispatch budget is exhausted. Review remains required."
+        )
+
+
 def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> int:
     """Publish a prepared verdict only with fresh exact-head/base reviewer authority."""
     expected = _canonical_head(expected_head)

.github/workflows/actions-queue-health.yml

@@ -0,0 +1,55 @@
+name: GitHub Actions queue health
+
+on:
+  schedule:
+    - cron: "7 * * * *"
+
+concurrency:
+  group: github-actions-queue-health
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  collect:
+    name: Collect exact-head queue evidence
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout trusted queue-health source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Collect read-only repository and runner evidence
+        env:
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}
+        run: |
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN is required for cross-repository queue reads."
+            exit 1
+          fi
+          echo "::add-mask::$GH_TOKEN"
+          python3 scripts/ci/actions_queue_health.py \
+            --allowlist config/actions_queue_health_repositories.json \
+            --output-json "$RUNNER_TEMP/actions-queue-health.json" \
+            --output-html "$RUNNER_TEMP/actions-queue-health.html"
+
+      - name: Upload queue-health evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: github-actions-queue-health-${{ github.run_id }}
+          path: |
+            ${{ runner.temp }}/actions-queue-health.json
+            ${{ runner.temp }}/actions-queue-health.html
+          if-no-files-found: error

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -29,10 +29,13 @@ on:
       - "docs/doctoring/strix-legal-git-paths.md"
       - "docs/doctoring/strix-model-behavior-error.md"
       - "docs/doctoring/strix-quality-timeout-fixtures.md"
+      - "docs/doctoring/strix-evidence-binding-2159-2168.md"
       - "scripts/ci/strix_quick_gate.sh"
+      - "scripts/ci/strix_evidence_binding.py"
       - "scripts/ci/test_strix_quick_gate.sh"
       - "tests/test_docs_only_pr_runner_admission.py"
       - "tests/test_strix_changed_path_policy.py"
+      - "tests/test_strix_evidence_binding.py"
       - "tests/test_strix_model_behavior_error.py"
       - "tests/test_strix_nvidia_nim_not_found_fallback.py"
       - "tests/test_strix_workflow_dependency_hashes.py"
@@ -210,10 +213,13 @@ jobs:
               docs/doctoring/strix-legal-git-paths.md|\
               docs/doctoring/strix-model-behavior-error.md|\
               docs/doctoring/strix-quality-timeout-fixtures.md|\
+              docs/doctoring/strix-evidence-binding-2159-2168.md|\
               scripts/ci/strix_quick_gate.sh|\
+              scripts/ci/strix_evidence_binding.py|\
               scripts/ci/test_strix_quick_gate.sh|\
               tests/test_docs_only_pr_runner_admission.py|\
               tests/test_strix_changed_path_policy.py|\
+              tests/test_strix_evidence_binding.py|\
               tests/test_strix_model_behavior_error.py|\
               tests/test_strix_nvidia_nim_not_found_fallback.py|\
               tests/test_strix_workflow_dependency_hashes.py|\
@@ -343,7 +349,7 @@ jobs:
         if: steps.affected_suites.outputs.noema == 'true' || steps.affected_suites.outputs.opencode == 'true' || steps.affected_suites.outputs.review_repair == 'true' || steps.affected_suites.outputs.exact_artifact == 'true'
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
-          -r requirements-opencode-review-ci-hashes.txt
+          -r requirements-opencode-review-ci-hashes.txt -r requirements-noema-document-ci-hashes.txt
 
       - name: Install exact Noema document dependencies
         if: steps.affected_suites.outputs.noema == 'true'
@@ -394,13 +400,16 @@ jobs:
           python -m pytest -q \
             tests/test_docs_only_pr_runner_admission.py \
             tests/test_strix_changed_path_policy.py \
+            tests/test_strix_evidence_binding.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \
             tests/test_strix_quality_timeout_fixture_budget.py
           bash scripts/ci/test_strix_quick_gate.sh
           python -m compileall -q \
+            scripts/ci/strix_evidence_binding.py \
             tests/test_strix_changed_path_policy.py \
+            tests/test_strix_evidence_binding.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \

.github/workflows/codeql-pr.yml

@@ -237,17 +237,35 @@ jobs:
           ')"
           if [[ "$run_id" =~ ^[1-9][0-9]*$ ]]; then
             jobs_json="$(gh api --paginate --slurp "repos/ContextualWisdomLab/.github/actions/runs/${run_id}/jobs")"
-            job_conclusion="$(printf '%s' "$jobs_json" | jq -r --arg name "$expected_job" '
+            dispatch_job="$(printf '%s' "$jobs_json" | jq -c --arg name "$expected_job" '
               [.[] | .jobs[] | select(.name == $name)]
-              | if length == 1 then .[0].conclusion else empty end
+              | if length == 1 then .[0] else empty end
             ')"
-            case "$job_conclusion" in
-              success|failure)
-                echo "verdict=${job_conclusion}" >>"$GITHUB_OUTPUT"
-                echo "Found completed CodeQL dispatch scan job for ${LANGUAGE}: ${job_conclusion}."
-                exit 0
-                ;;
-            esac
+            if [ -n "$dispatch_job" ]; then
+              gate_conclusion="$(printf '%s' "$dispatch_job" | jq -r '
+                (.steps[]? | select(.name == "Enforce CodeQL Medium+ SARIF gate") | .conclusion) // empty
+              ')"
+              case "$gate_conclusion" in
+                success)
+                  echo "verdict=success" >>"$GITHUB_OUTPUT"
+                  echo "Found completed CodeQL dispatch scan gate for ${LANGUAGE}: success."
+                  exit 0
+                  ;;
+                failure|cancelled|skipped)
+                  echo "verdict=failure" >>"$GITHUB_OUTPUT"
+                  echo "Found completed CodeQL dispatch scan gate for ${LANGUAGE}: failure."
+                  exit 0
+                  ;;
+              esac
+              job_conclusion="$(printf '%s' "$dispatch_job" | jq -r '.conclusion // empty')"
+              case "$job_conclusion" in
+                success)
+                  echo "verdict=success" >>"$GITHUB_OUTPUT"
+                  echo "Found completed CodeQL dispatch scan job for ${LANGUAGE}: success."
+                  exit 0
+                  ;;
+              esac
+            fi
           fi
 
           if [ "$RUN_ATTEMPT" != "1" ]; then