fix(ci): restore evidence-only review admission

docs/adr/0005-sidecar-preflight-token-budget.md

@@ -14,12 +14,37 @@ OpenRouter ZDR lookup, DNS/TLS setup, and local `/healthz` checks.
 ## Superseding decision
 
 ADR 0003 governs these operations. Inference, initial ping/preflight, warmup,
-retry/repair, provider discovery, OpenRouter ZDR lookup, DNS/TLS setup, and local
-health checks have no fixed wall-clock timeout. Work ends only through an
-operator action or cancellation of an obsolete PR head.
+provider discovery, OpenRouter ZDR lookup, DNS/TLS setup, and local health checks
+have no repository-authored total model deadline. Explicit user cancellation,
+provider termination, obsolete-head cancellation and administrative termination
+remain distinct lifecycle events.
 
-Response validation remains fail closed. Token-budget diagnostics may explain
-empty or truncated output, but they do not impose a wall-clock deadline.
+Central review preflight is evidence-only. Each admitted route receives one
+provider-default semantic observation. The central repository does not author
+`max_tokens`, `temperature`, inference retry counts or semantic token
+escalation. A reasoning-only, length-exhausted, malformed or transport-failed
+response is bounded rejection evidence and does not allocate another model call.
+The shell provisioner does not replay a second live `/v1/chat/completions`
+request after launcher preflight; `/healthz` plus the persisted per-route report
+form the readiness boundary before the real review consumer exercises the
+OpenAI-compatible endpoint.
 
-The former attempt counts, retry ceilings, and timeout values in this ADR are
-historical evidence only and must not be restored.
+The former token budgets, attempt counts, retry ceilings and timeout values in
+this ADR are historical evidence only and must not be restored.
+
+## 2026-09-02 startup-latency amendment
+
+Admission evidence and runtime readiness are distinct. The central free-only
+catalog retains every evidence-eligible route. Startup probes independent
+provider-account lanes concurrently, while routes sharing one provider account
+remain serialized to avoid a same-credential burst. Each route still receives
+exactly one provider-default observation, and published evidence is restored to
+deterministic input order, so completion timing cannot become routing
+preference. Concurrency changes no route membership, priority, cost/ZDR
+decision, provider preference or compute allocation.
+
+The regression uses a synchronization barrier across independent
+provider-account lanes rather than a wall-clock threshold. It proves those
+lanes can enter probing before either lane is allowed to complete and
+deliberately does not claim simultaneous probing of routes that share one
+provider account.

docs/doctoring/pr1629-admission-handoff-20260902.md

@@ -0,0 +1,11 @@
+# PR #1629 exact-head admission handoff
+
+The original one-shot review-admission repair completed its source mutation and focused regression on the writer branch, then published commit `56cf1db7a26dfe4d9a69687796ff8d31f0457270`. That earlier increment changed review startup from serial full-catalog preflight to concurrent readiness probing while preserving catalog-order evidence and route-local token-budget escalation. Fresh exact-head review then identified a second startup defect: per-route fan-out allowed every model sharing one provider credential to probe simultaneously, recreating the shared-key 429 storm already recorded in the product-technical baseline. The permanent regression now distinguishes admission cardinality from transport concurrency. All evidence-eligible routes remain admitted, but preflight execution is partitioned by the same provider-account identity used by `contextual_orchestrator_review_policy.provider_account`: independent provider accounts progress concurrently, routes sharing one account are probed serially, and outcomes are restored to original catalog order before any evidence or viable-route list is emitted. This introduces no fixed route cap, rank, shared escalation quota, or completion-order authority.
+
+A later external review demonstrated a distinct authority defect: the central launcher interpreted a transient failure classification as permission to allocate one extra identical model request through `ModelClient.proxy_send()`. Failure taxonomy proves the observed kind of failure but does not establish a repository-specific numeric retry budget. The writer branch therefore now uses `proxy_send_once()` for every semantic preflight payload, omits `transport_retry_budget`, and constructs both preflight and serving `ModelClient` instances with `max_retries=0`. Response-proven token starvation may still cause one second *different* payload with the established larger token budget; that semantic escalation is not a transport replay.
+
+The causal production repair was applied directly on the owner branch rather than waiting on the stalled source-fix workflow. The broader regression corpus was updated in the same history: transient 502 and permanent 401 failures each prove exactly one provider send, token-starvation escalation proves exactly two distinct one-shot payloads, and both runtime ModelClient constructors prove `timeout=None` plus `max_retries=0`. The obsolete `.github/source-fix-1629-preflight-retry.trigger`, `.github/workflows/source-fix-1629-preflight-retry.yml`, and `scripts/source_fix_1629_preflight_retry.py` identities were then deleted from the candidate tree so the repair machinery cannot consume future workflow capacity or become a durable mutation mechanism.
+
+The earlier source publication used the repository-scoped Actions token only because workflow-starting publication credentials were unavailable. A token-authored push is not accepted as successor-head admission evidence because GitHub suppresses normal workflow chaining in that case. The current direct owner commits create ordinary pull-request successor heads and their evidence must be collected afresh. Do not transfer checks or reviews from any predecessor source-fix head.
+
+At the current integration boundary the PR remains non-mergeable against an advanced protected `main`. That integration state is independent of the one-shot transport repair and must be reconciled non-destructively; no force push, destructive rebase, self-approval, gate weakening, or stale-head evidence transfer is authorized. Merge eligibility requires an unchanged reconciled head, no temporary source-fix identity, terminal ordinary checks/reviews, and no still-valid substantive review finding.

docs/superpowers/plans/2026-09-02-provider-preflight-resilience.md

@@ -0,0 +1,73 @@
+# Provider-Neutral Preflight Resilience Implementation Plan
+
+**Goal:** Keep central review preflight evidence-only and provider-neutral: one provider-default request per admitted route, no repository-authored token/sampling allocation, no inference retry budget, no fixed total model deadline, and concurrent progress across independently credentialed provider-account lanes.
+
+**Incident history:** DiagramWeave Actions run `33554858825`, job `100013111840` exposed an HTTP 502 on one discovered route and a long-running review path. The observed DeepSeek/NVIDIA NIM identity is incident evidence only; it is not a policy key. Later organization evidence in `.github#712` showed that review-sidecar provisioning could hold hosted runner slots for hours after the protected Contextual-Orchestrator client moved to an intentionally unbounded default model timeout. That operational evidence does not justify restoring a 90-second model deadline or inventing repository-local retry/token policy.
+
+**Ownership:**
+
+- `ContextualWisdomLab/contextual-orchestrator#1106` owns the generic free-pool admission, routing and test-time-compute contract; immutable released gateway/client/schema artifacts are the final shared boundary.
+- `ContextualWisdomLab/.github#1629` owns the central review launcher's temporary consumer-side admission/preflight behavior while that migration is incomplete.
+- `.github#2139/#2140` own progress/idle continuation and runner-occupancy semantics. A progress/idle control must not become a total elapsed inference deadline.
+- `.github#1150/#712` own read-only queue-health evidence and classification, not review-lane mutation.
+
+## Invariants
+
+- `ModelClient.timeout=None` means no hidden total wall-clock inference deadline for any model.
+- Explicit user cancellation, provider termination, stale-head cancellation and administrative workflow termination remain distinct lifecycle events.
+- Preflight sends one semantic provider-default request once. HTTP 502, 503, 429, timeout, connection reset and other transport outcomes remain evidence; they do not allocate another model call in the central launcher.
+- HTTP 400, 401, 403 and other permanent failures remain bounded rejection evidence under the owner taxonomy.
+- Central preflight does not author `max_tokens`, `temperature`, retry budgets, model-name allowlists or semantic token escalation. Token/sampling/TTC policy belongs to the Contextual-Orchestrator owner boundary.
+- `model`, `agent_id`, `provider_name`, `reasoning_effort_supported`, completion timing and discovery order do not decide inference deadlines or compute allocation.
+- A response containing reasoning but no usable content is rejected as observed evidence after the single provider-default request; it is not retried with a larger token budget.
+- Independent provider-account lanes may probe concurrently; routes sharing one provider account remain serialized. Published results return to catalog order, so completion timing cannot become routing preference.
+- The shell provisioner does not replay provider inference after launcher preflight. `/healthz` plus persisted route evidence prove startup readiness; the actual review consumer is the first post-provisioning live gateway workload.
+- Provider response bodies, prompts, exception messages, credentials and internal topology are not persisted in preflight evidence.
+- Queue/runner admission and repository source correctness are classified separately. A job with no runner and no executed steps is incomplete admission evidence, not source GREEN or RED.
+- Historical regression tests whose asserted behavior was fixed token allocation, semantic escalation, priced fallback or shell-level inference retry are retired structurally. Current test collection does not hide them through function-name or prefix suppression.
+
+## Task 1: One-shot provider-neutral regression
+
+**Files:**
+
+- `tests/test_contextual_orchestrator_review_no_heuristic_compute.py`
+- `tests/test_contextual_orchestrator_review_transient_preflight.py`
+- `tests/test_contextual_orchestrator_review_preflight_concurrency.py`
+- `tests/test_contextual_orchestrator_review_runtime_preflight.py`
+- `tests/_contextual_orchestrator_review_runtime_preflight_cases.py`
+
+- [x] Parameterize transient HTTP failure evidence across `reasoning_effort_supported = None, False, True` without model-name policy.
+- [x] Prove HTTP 401 remains single-attempt and terminal.
+- [x] Prove concurrency across independent provider-account lanes while same-account routes remain serialized.
+- [x] Prove the concurrency fixture itself does not inject `max_tokens` or `temperature`.
+- [x] Require a reasoning-only/content-less response to be rejected after one provider-default request.
+- [x] Remove launcher-side fixed token/sampling constants and semantic escalation.
+- [x] Remove the sidecar gateway inference replay and shell-local inference retry budget.
+- [x] Replace legacy function-name/prefix suppression with a current executable regression corpus; retain historical incidents in ADR/doctoring records instead of dormant test oracles.
+
+## Task 2: Progress and runner occupancy
+
+**Files / owners:** `.github#712`, `.github#1150`, `.github#2139/#2140`, `contextual-orchestrator#1106`.
+
+- [x] Preserve exact `{repo, PR, head, base, workflow, run, job, runner assignment}` identity when classifying queue delay.
+- [x] Preserve current-head review work rather than cancelling it merely to free capacity.
+- [ ] Bound avoidable provisioning occupancy structurally through provider-account concurrency and progress/idle semantics, not total inference duration.
+- [ ] Demonstrate that unrelated current-head required jobs regain hosted runner admission without changing leaf `runs-on`, weakening gates or synthesizing statuses.
+- [ ] Migrate provider probing/credential/routing authority to an immutable released Contextual-Orchestrator gateway contract and remove duplicated central policy.
+
+## Task 3: Exact-head verification
+
+Run the focused central contract suite on the unchanged final owner head:
+
+```bash
+python -m pytest -q \
+  tests/test_contextual_orchestrator_review_no_heuristic_compute.py \
+  tests/test_contextual_orchestrator_review_transient_preflight.py \
+  tests/test_contextual_orchestrator_review_runtime_preflight.py \
+  tests/test_contextual_orchestrator_review_preflight_concurrency.py \
+  tests/test_contextual_orchestrator_review_sidecar_contract.py
+```
+
+Then require normal repository CI, security, supply-chain and independent-review gates to reach terminal success on that same exact head. Queued, skipped, cancelled, predecessor-head or status-only results are not GREEN. The owner branch must contain no purpose-complete source-rewriting workflow, trigger or repair driver before protected integration.
+
+After the central owner repair is normally integrated and the Contextual-Orchestrator boundary is immutably released, verify an unchanged downstream review consumer. Close the incident only when that consumer obtains real runner assignment and terminal exact-head review evidence without local provider/model hard-coding, paid fallback or timeout rollback.