Integrate Experiential Labs KV source into canonical review bootstrap

[seonghobae]

Experiential Labs review integration handoff

CO PR: ContextualWisdomLab/contextual-orchestrator#1145
User credential: EXPERIENTAL_LABS_API_KEY (exact registered spelling).

Read-only local central snapshot: ContextualWisdomLab/.github at
58e63c2. Current remote contents could not be
verified: REST returned HTTP403 rate limit on 2026-09-12T14:18:40Z,
request B7CA:74260:577857:7DD2DD:6AA55F40. Do not present this snapshot as current.

Observed integration boundaries:

• .github/workflows/noema-review.yml transports five provider secrets into
  contextual_orchestrator_review_sidecar.sh, but not the new optional key.
• sidecar.sh checks the same five-name bootstrap list before launch.
• contextual_orchestrator_review_policy.py rejects unknown provider names
  before source-identity and free/ZDR admission; its duplicated registry must
  consume the canonical CO contract or receive a coordinated minimal update.
• The explicit ZDR policy table must not invent an Experiential attestation.
  Official catalog retention is not enforcement; organization require-ZDR
  policy and applicable no-training/retention evidence remain unverified.
• Pricing schema of authenticated /v1/models is incompletely documented.
  CO retains unknown cost rather than considering BYOK, credits or allowance
  free. No paid inference was authorized or performed.

Owner next action: revalidate latest central head and active writer scope after
API reset, link to the existing integration issue or create one if none exists,
then coordinate secret transport and canonical readiness contract adoption.
The consumer stays gateway-token + orchestrator/free. Do not rerun the failed
consumer and claim repair before the adopted provider can pass actual free/ZDR
admission. Local contract tests are not live organization policy proof.

Run34696894945 evidence only identifies Bytez HTTP500 followed by PolicyError;
that ordering does not establish Bytez as the sole cause of policy failure.

Reproduction and acceptance

Executed the actual parse_discovery_report function from the read-only local
snapshot with an Experiential row carrying unknown prices and is_free=False.
It raises PolicyError: provider 'experiential_labs' is not registered in the ZDR policy table before candidate admission. No inference or secret access was
involved. This is a confirmed local integration rejection, not proof of the
current hosted source behavior.

Acceptance: accepted provider identity survives report normalization; absent
privacy/price evidence still excludes serving; configured optional Secret reaches
KV; paid routes remain excluded; real organization ZDR policy and catalog prices
are verified before the motivating private-review rerun is called repaired.

Owner: central review/bootstrap maintainers, coordinated with CO PR1145.
Next investigation checkpoint: 2026-09-13, to revalidate the live central source
and identify the delegated integration slice. This next-day checkpoint follows
an active private-review failure and is not a promise of deployment completion.

[seonghobae]

Current-source refresh, 2026-09-13: canonical .github main is fb17ef556f94f673234aa557254ae52779e9a7b0. Read the exact-head scripts/ci/zdr_policy.py and contextual_orchestrator_review_policy.py: the provider credential/base URL maps still omit Experiential, and parse_discovery_report rejects unknown provider names. The previously recorded integration gap remains present in current source.

Consumer PR10 is now a1cd5bc6783c6510dfcf937f523c733366e82213. Noema run34700409452 uses CO 414f22973658c4ddc3d4320fcf7acd9b4e8ba991, then exits before healthz with discovery_diagnostics_complete / PolicyError. The exposed log is not sufficient to establish the underlying discovery cause or that adding Experiential alone cures it. Bootstrap run34700409497 separately fails reading evidence/reviewer_response_draft.hwpx as UTF-8; provider support does not repair that failure.

CO PR1145 remains Draft and unmerged. Provider identity/optional KV support is implemented, but actual Experiential privacy attestation, organization require-ZDR enforcement, free-price admission and durable pool activation are not established. A reproduced cross-provider model-ID privacy inference is being referred to owner PR971; an OpenRouter model match cannot establish Experiential endpoint retention behavior.

Next owner action: coordinate the exact secret/identity registration slice and obtain endpoint-specific privacy/price evidence, then validate the released CO adoption and consumer startup. Internal next review: 2026-09-14, reflecting the ongoing private review failure. This is an investigation checkpoint, not a release promise. No consumer rerun or paid inference was performed.

[seonghobae]

Existing adoption work found: PR #2137 at 3d39fe7cec56a0c932d99f7ec0cbed88107efdbb advances the review sidecar from CO414f to CO012bea and adds an unattested-provider row filter. Source/test review confirms mixed known/unknown providers are covered without granting unknown providers ZDR. Reuse that owner path rather than duplicate its pin update. This is source review, not a new hosted validation or merger claim.

CO #1145 is not in 012bea. Even after #2137, Experiential still needs its provider contract and organization evidence adopted deliberately. Live official docs confirm require-ZDR is an organization data-control setting; /v1/models does not expose the retention verdict. Public /api/models retention filters returned 42 zdr_all_rungs models and 80 zdr_enforceable models on 2026-09-13, but all inspected available_to_org values were null. Public catalog availability is not organization free/ZDR admission. Organization setting confirmation is pending.

No dispatch was attempted against the Experiential PR: existing provider-catalog-sync is main-only, uses the production environment and can refresh durable KV. Its guard was preserved. Continue the coordinated released-owner adoption and authenticated catalog/privacy validation path; do not count public GETs as live inference acceptance.

[seonghobae]

Current CO implementation: PR1145@a2f576be4e1cefd0293299dcc9d814b433836b4c rejects conflicting ZDR evidence in discovery tags, persisted catalog restoration and request filtering. It also rejects Experiential promotional metadata at shared free-pool selection and durable/capability free routing: zero advertised prices cannot guarantee that a waterfall will not spend credits. Ordinary routing remains available. 208 focused tests passed; local full PR1145/1162/1163 integration passed 311 tests. Neither result is hosted release or consumer acceptance.

Authentication prerequisite resolved by the user on 2026-09-13. Authenticated organization UI shows Private mode enabled: prompt/response content is not captured, while usage metadata remains recorded. The documented /settings/data-controls route returns 404 even after login. Therefore prompt capture configuration is verified, but upstream require-ZDR enforcement is still unverified. Luna's model page shows a free tier plus paid fallback rungs and organization-wide credit overflow enabled. A button mistaken for a menu was inadvertently toggled off during inspection, disclosed and restored immediately to its original enabled state; visible UI confirmed restoration. No credentials were extracted and no inference request occurred.

Remaining acceptance: provider-supported organization require-ZDR control and applicable deployment/waterfall evidence, an enforceable free-only route, current-head hosted checks/review, immutable release and consumer adoption. Root CO agent owns this investigation; this is not delegated to an absent ZDR owner. The provider metadata/capture controls are not substitutes for request enforcement.

Browser diagnostics remain unresolved: prior Turnstile target-origin mismatch/opaque NaN warnings and blocked analytics requests were observed; further warnings accumulated in the authenticated browser and are not yet fully classified. No suppression or challenge/network bypass. Integration maintainer owns sanitized reproduction; provider owns its browser implementation. Next investigation and provider-control discrepancy review: 2026-09-14, because these affect active private-review acceptance. Registration is not resolution; completion requires verification of the actual controls and original diagnostic conditions.

Authenticated model-page console was read in full at the next checkpoint: 118 messages, comprising 96 unused-preload warnings for /_next/static/chunks/27pxt-rohx60b.css and 22 refused PostHog resource requests (19 ingestion-host, 3 assets-host). These are provider page resource/analytics diagnostics, distinct from the earlier sign-in Turnstile warnings. The raw local log is retained without copying request URLs or credentials into this issue. This classifies the accumulated messages; it does not resolve the preload configuration or blocked analytics behavior. Existing next investigation date remains 2026-09-14.