feat: route autofix through contextual orchestrator

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -39,7 +39,7 @@ on:
       - tests/test_pr_review_fix_scheduler.py
       - tests/test_pr_review_fix_scheduler_source_pin.py
       - tests/test_pr_review_autofix_context_head_binding.py
-      - tests/test_pr_review_autofix_nvidia_nim_contract.py
+      - tests/test_pr_review_autofix_contextual_orchestrator_contract.py
       - tests/test_pr_review_autofix_writer_security_contract.py
       - docs/automation/hourly-review-repair.md
       - docs/doctoring/bandscope-hourly-review-caller.md
@@ -49,7 +49,7 @@ on:
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
       - docs/doctoring/github-hourly-conflict-repair.md
       - docs/doctoring/governance-risk-compliance-hourly-review-caller.md
-      - docs/doctoring/hourly-nvidia-nim-autofix.md
+      - docs/doctoring/contextual-orchestrator-autofix.md
       - docs/doctoring/nonnest2-hourly-review-caller.md
       - docs/doctoring/orgmetra-hourly-review-caller.md
       - docs/doctoring/originweave-hourly-review-caller.md
@@ -92,7 +92,7 @@ on:
       - tests/test_pr_review_fix_scheduler.py
       - tests/test_pr_review_fix_scheduler_source_pin.py
       - tests/test_pr_review_autofix_context_head_binding.py
-      - tests/test_pr_review_autofix_nvidia_nim_contract.py
+      - tests/test_pr_review_autofix_contextual_orchestrator_contract.py
       - tests/test_pr_review_autofix_writer_security_contract.py
       - docs/automation/hourly-review-repair.md
       - docs/doctoring/bandscope-hourly-review-caller.md
@@ -102,7 +102,7 @@ on:
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
       - docs/doctoring/github-hourly-conflict-repair.md
       - docs/doctoring/governance-risk-compliance-hourly-review-caller.md
-      - docs/doctoring/hourly-nvidia-nim-autofix.md
+      - docs/doctoring/contextual-orchestrator-autofix.md
       - docs/doctoring/nonnest2-hourly-review-caller.md
       - docs/doctoring/orgmetra-hourly-review-caller.md
       - docs/doctoring/originweave-hourly-review-caller.md
@@ -117,7 +117,7 @@ concurrency:
 
 jobs:
   contract:
-    name: Hourly cadence, immutable source, NIM credential, and conflict scope
+    name: Hourly cadence, immutable source, gateway credential, and conflict scope
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
@@ -138,7 +138,7 @@ jobs:
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
           -r requirements-opencode-review-ci-hashes.txt
-      - name: Verify hourly scheduler and NVIDIA NIM autofix contracts
+      - name: Verify hourly scheduler and contextual-orchestrator autofix contracts
         run: |
           set -euo pipefail
           python -m pytest -q \
@@ -173,6 +173,6 @@ jobs:
             tests/test_pr_review_fix_scheduler.py \
             tests/test_pr_review_fix_scheduler_source_pin.py \
             tests/test_pr_review_autofix_context_head_binding.py \
-            tests/test_pr_review_autofix_nvidia_nim_contract.py \
+            tests/test_pr_review_autofix_contextual_orchestrator_contract.py \
             tests/test_pr_review_autofix_writer_security_contract.py
           git diff --check

.github/workflows/pr-review-autofix.yml

@@ -279,9 +279,9 @@ jobs:
           EOF
           jq -n --arg workspace "$TARGET_WORKSPACE" '{
             "$schema": "https://opencode.ai/config.json",
-            "model": "nvidia-nim/mistralai/mistral-small-4-119b-2603",
-            "small_model": "nvidia-nim/nvidia/nemotron-3-nano-30b-a3b",
-            "enabled_providers": ["nvidia-nim"],
+            "model": "contextual-orchestrator/contextual-orchestrator",
+            "small_model": "contextual-orchestrator/contextual-orchestrator",
+            "enabled_providers": ["contextual-orchestrator"],
             "permission": {
               "edit": {
                 "*": "allow",
@@ -306,7 +306,7 @@ jobs:
               "ci-autofix": {
                 "description": "Conservative CI pull request review autofix agent",
                 "mode": "primary",
-                "model": "nvidia-nim/mistralai/mistral-small-4-119b-2603",
+                "model": "contextual-orchestrator/contextual-orchestrator",
                 "reasoningEffort": "high",
                 "prompt": "{file:./autofix-prompt.md}",
                 "steps": 12,
@@ -333,32 +333,23 @@ jobs:
               }
             },
             "provider": {
-              "nvidia-nim": {
+              "contextual-orchestrator": {
                 "npm": "@ai-sdk/openai-compatible",
-                "name": "NVIDIA NIM",
+                "name": "Contextual Orchestrator",
                 "options": {
-                  "baseURL": "https://integrate.api.nvidia.com/v1",
-                  "apiKey": "{env:NVIDIA_API_KEY}"
+                  "baseURL": "{env:CONTEXTUAL_ORCHESTRATOR_BASE_URL}",
+                  "apiKey": "{env:CONTEXTUAL_ORCHESTRATOR_TOKEN}",
+                  "headers": {
+                    "X-Contextual-Orchestrator-Tool-Loop": "v1"
+                  }
                 },
                 "models": {
-                  "mistralai/mistral-small-4-119b-2603": {
-                    "name": "Mistral Small 4 119B 2603",
-                    "tool_call": true,
-                    "reasoning": true,
-                    "options": {
-                      "reasoningEffort": "high"
-                    },
-                    "limit": {
-                      "context": 128000,
-                      "output": 4096
-                    }
-                  },
-                  "nvidia/nemotron-3-nano-30b-a3b": {
-                    "name": "Nemotron 3 Nano 30B A3B",
+                  "contextual-orchestrator": {
+                    "name": "Contextual Orchestrator (auto-routed)",
                     "tool_call": true,
                     "reasoning": true,
                     "limit": {
-                      "context": 128000,
+                      "context": 200000,
                       "output": 32768
                     }
                   }
@@ -370,16 +361,43 @@ jobs:
       - name: Run OpenCode review autofix
         if: env.RESOLVE_CONFLICT != 'true'
         env:
-          NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
-          MODEL: nvidia-nim/mistralai/mistral-small-4-119b-2603
+          CONTEXTUAL_ORCHESTRATOR_BASE_URL: ${{ vars.CONTEXTUAL_ORCHESTRATOR_BASE_URL }}
+          CONTEXTUAL_ORCHESTRATOR_TOKEN: ${{ secrets.CONTEXTUAL_ORCHESTRATOR_TOKEN }}
+          MODEL: contextual-orchestrator/contextual-orchestrator
           SHARE: "false"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
           OPENCODE_AUTOFIX_WORKDIR: ${{ runner.temp }}/opencode-autofix-project
         run: |
           set -euo pipefail
-          if [ -z "${NVIDIA_API_KEY:-}" ]; then
-            echo "::error::NVIDIA_NIM_API_KEY is required for scheduled OpenCode autofix."
+          if [ -z "${CONTEXTUAL_ORCHESTRATOR_BASE_URL:-}" ] ||
+            [ -z "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" ]; then
+            echo "::error::CONTEXTUAL_ORCHESTRATOR_BASE_URL and CONTEXTUAL_ORCHESTRATOR_TOKEN are required for scheduled OpenCode autofix."
+            exit 1
+          fi
+          python3 - "$CONTEXTUAL_ORCHESTRATOR_BASE_URL" <<'PY'
+          import sys
+          from urllib.parse import urlparse
+
+          parsed = urlparse(sys.argv[1])
+          if (
+              parsed.scheme != "https"
+              or not parsed.hostname
+              or parsed.username
+              or parsed.password
+              or parsed.query
+              or parsed.fragment
+          ):
+              raise SystemExit("CONTEXTUAL_ORCHESTRATOR_BASE_URL must be an HTTPS URL without credentials or query data")
+          PY
+          models_response="$(curl -fsS \
+            --connect-timeout 10 \
+            --max-time 30 \
+            -H "Authorization: Bearer ${CONTEXTUAL_ORCHESTRATOR_TOKEN}" \
+            "${CONTEXTUAL_ORCHESTRATOR_BASE_URL%/}/models")"
+          if ! jq -e '(.data | type == "array") and ([.data[]? | select((.id? | type) == "string" and (.id | length > 0))] | length >= 1)' \
+              >/dev/null <<<"$models_response"; then
+            echo "::error::Contextual Orchestrator gateway returned no discovered models."
             exit 1
           fi
           prompt_file="${RUNNER_TEMP}/opencode-autofix-prompt.md"
@@ -542,11 +560,12 @@ jobs:
       - name: Merge base branch and resolve conflicts with OpenCode
         if: env.RESOLVE_CONFLICT == 'true'
         env:
-          NVIDIA_API_KEY: ${{ secrets.NVIDIA_NIM_API_KEY }}
+          CONTEXTUAL_ORCHESTRATOR_BASE_URL: ${{ vars.CONTEXTUAL_ORCHESTRATOR_BASE_URL }}
+          CONTEXTUAL_ORCHESTRATOR_TOKEN: ${{ secrets.CONTEXTUAL_ORCHESTRATOR_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token }}
           GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.target_app_token.outputs.token }}
           MUTATION_CREDENTIAL_AVAILABLE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '' || steps.target_app_token.outputs.available == 'true' }}
-          MODEL: nvidia-nim/mistralai/mistral-small-4-119b-2603
+          MODEL: contextual-orchestrator/contextual-orchestrator
           SHARE: "false"
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
           NO_COLOR: "1"
@@ -557,10 +576,6 @@ jobs:
             echo "::error::Conflict-resolution mutation requires PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or the exchanged OpenCode app token; github.token remains read-only."
             exit 1
           fi
-          if [ -z "${NVIDIA_API_KEY:-}" ]; then
-            echo "::error::NVIDIA_NIM_API_KEY is required for scheduled OpenCode autofix."
-            exit 1
-          fi
           cd "$TARGET_WORKSPACE"
 
           # Merge the base branch into the detached head. A clean merge stays
@@ -589,7 +604,41 @@ jobs:
             exit 1
           fi
 
+          contextual_gateway_readiness() {
+          if [ -z "${CONTEXTUAL_ORCHESTRATOR_BASE_URL:-}" ] ||
+            [ -z "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" ]; then
+            echo "::error::CONTEXTUAL_ORCHESTRATOR_BASE_URL and CONTEXTUAL_ORCHESTRATOR_TOKEN are required for scheduled OpenCode autofix."
+            exit 1
+          fi
+          python3 - "$CONTEXTUAL_ORCHESTRATOR_BASE_URL" <<'PY'
+          import sys
+          from urllib.parse import urlparse
+
+          parsed = urlparse(sys.argv[1])
+          if (
+              parsed.scheme != "https"
+              or not parsed.hostname
+              or parsed.username
+              or parsed.password
+              or parsed.query
+              or parsed.fragment
+          ):
+              raise SystemExit("CONTEXTUAL_ORCHESTRATOR_BASE_URL must be an HTTPS URL without credentials or query data")
+          PY
+          models_response="$(curl -fsS \
+            --connect-timeout 10 \
+            --max-time 30 \
+            -H "Authorization: Bearer ${CONTEXTUAL_ORCHESTRATOR_TOKEN}" \
+            "${CONTEXTUAL_ORCHESTRATOR_BASE_URL%/}/models")"
+          if ! jq -e '(.data | type == "array") and ([.data[]? | select((.id? | type) == "string" and (.id | length > 0))] | length >= 1)' \
+              >/dev/null <<<"$models_response"; then
+            echo "::error::Contextual Orchestrator gateway returned no discovered models."
+            exit 1
+          fi
+          }
+
           if [ -n "$conflicted_files" ]; then
+            contextual_gateway_readiness
             conflicted_paths_file="${RUNNER_TEMP}/opencode-conflicted-files.zlist"
             conflict_scope_snapshot="${RUNNER_TEMP}/opencode-conflict-workspace-before.json"
             git diff --name-only -z --diff-filter=U >"$conflicted_paths_file"

AGENTS.md

@@ -3,8 +3,13 @@
 <!-- CWL-ENTRY -->
 > **Agents: read the master context FIRST.** Before any work, read [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md) (mission · naruon-as-platform + inter-component UML · cross-cutting disciplines · conventions · roadmap · current state), the live **GitHub Project #1** <https://github.com/orgs/ContextualWisdomLab/projects/1> (work/roadmap source of truth), the full spec **ContextualWisdomLab/naruon#974**, and operate the Project per [`docs/agent-github-project-protocol.md`](docs/agent-github-project-protocol.md). The repo/Project — not any private agent memory — is the source of truth.
 
-Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md).
+Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. The current write-capable repair boundary is the contextual-orchestrator gateway; the former NVIDIA NIM record is historical provenance in [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md), while the active contract is [`docs/doctoring/contextual-orchestrator-autofix.md`](docs/doctoring/contextual-orchestrator-autofix.md).
 Conflict-scope roots fail closed when the immediate parent directory is a symbolic link.
-OriginWeave hourly NVIDIA NIM repair is a thin caller at minute 10. See [`docs/doctoring/originweave-hourly-review-caller.md`](docs/doctoring/originweave-hourly-review-caller.md).
-nonnest2 hourly NVIDIA NIM repair is a thin caller at minute 16. See [`docs/doctoring/nonnest2-hourly-review-caller.md`](docs/doctoring/nonnest2-hourly-review-caller.md).
-The materialization contract is also covered by [`docs/doctoring/exact-artifact-sbom-attestation.md`](docs/doctoring/exact-artifact-sbom-attestation.md).
+OriginWeave hourly review repair is a thin caller at minute 10; its historical
+NVIDIA NIM-only worker description remains in the doctoring record. See
+[`docs/doctoring/originweave-hourly-review-caller.md`](docs/doctoring/originweave-hourly-review-caller.md).
+nonnest2 hourly review repair is a thin caller at minute 16; its historical
+NVIDIA NIM-only worker description remains in the doctoring record. See
+[`docs/doctoring/nonnest2-hourly-review-caller.md`](docs/doctoring/nonnest2-hourly-review-caller.md).
+The materialization contract is also covered by
+[`docs/doctoring/exact-artifact-sbom-attestation.md`](docs/doctoring/exact-artifact-sbom-attestation.md).

ARCHITECTURE.md

@@ -39,15 +39,15 @@ only established scheduler credentials, and grants job-scoped
 only established scheduler credentials, and grants job-scoped
 `id-token: write`. The reusable engine stays product-neutral.
 
-## Hourly NVIDIA NIM repair gate
+## Contextual-orchestrator hourly repair gate
 
 ```mermaid
 flowchart TD
   Hour["Hourly product caller"]
   Sched["Central reusable scheduler"]
   Bind{"Exact-head, same-repo, writer authority, sealed paths?"}
   Worker["repository_dispatch worker at github.sha"]
-  NIM["NVIDIA NIM repair model"]
+  Gateway["Contextual-orchestrator KV gateway\nautomatic model discovery"]
   Recheck{"Post-edit exact-head revalidation?"}
   Push["Push same-repository head"]
   Hold["Leave the tree unchanged"]
@@ -56,15 +56,17 @@ flowchart TD
   Sched --> Bind
   Bind -->|"no"| Hold
   Bind -->|"yes"| Worker
-  Worker --> NIM
-  NIM --> Recheck
+  Worker --> Gateway
+  Gateway --> Recheck
   Recheck -->|"no"| Hold
   Recheck -->|"yes"| Push
 ```
 
 The worker checks out helpers at `${{ github.sha }}` so a later default-branch
 push cannot replace privileged scripts after dispatch (CWE-367). Repair binds
-`NVIDIA_NIM_API_KEY`, never `COPILOT_GITHUB_TOKEN`.
+only the gateway URL and token for the two OpenCode execution steps; upstream
+provider credentials remain in the gateway KV, and `COPILOT_GITHUB_TOKEN` is
+never used.
 
 Product callers stagger Clearfolio at minute 23, DiskSage at minute 37, and
 fast-mlsirm at minute 49. Each caller is read-only, dispatches at most one
@@ -96,14 +98,21 @@ sequenceDiagram
   participant PR as Pull request
   participant RW as Required workflows
   participant OC as OpenCode reviewer
+  participant AF as Write-capable autofix worker
+  participant GW as contextual-orchestrator gateway
   participant SV as sandboxed_verify / web E2E
   participant MS as Merge scheduler
 
   PR->>RW: pull_request_target on trusted base
-  RW->>OC: bounded evidence + NVIDIA NIM / OpenCode
+  RW->>OC: bounded evidence + independent reviewer credential
   OC->>SV: PoC command in isolated copy
   SV-->>OC: redacted stdout/stderr + command metadata
   OC-->>PR: APPROVE or request changes
+  RW->>AF: exact-head repair context after changes requested
+  AF->>GW: bounded repair prompt with scoped gateway URL/token
+  GW-->>AF: bounded model output
+  AF->>SV: verify candidate edit in isolated copy
+  SV-->>AF: tests and changed-path evidence
   MS->>PR: merge only on current-head approval + green checks
 ```
 
@@ -117,9 +126,10 @@ sequenceDiagram
 - Logs and review receipts redact credential shapes (tokens, bearer values,
   known provider prefixes). They do not mask operational PII that the
   control plane must process.
-- LLM and scheduled agents bind `NVIDIA_NIM_API_KEY` (env may be
-  `NVIDIA_API_KEY`). They never use `COPILOT_GITHUB_TOKEN`. Existing
-  review-agent key schemes stay unchanged.
+- The write-capable LLM path binds only the contextual-orchestrator gateway
+  URL/token; provider keys remain in the gateway KV. It never uses
+  `COPILOT_GITHUB_TOKEN`, and the existing independent review-agent key scheme
+  stays unchanged.
 - Rust remains the psychometric arithmetic owner. Repair never substitutes
   Python for scoring math.
 - Downloaded SBOM and distribution bytes are inert. The signing job does
@@ -143,8 +153,9 @@ trusted `uv` exporter is downloaded from the literal GitHub Releases URL for
   — bot/agent exact-head review and merge procedure.
 - [`PR_GOVERNANCE_AUDIT.md`](PR_GOVERNANCE_AUDIT.md) — live review/merge
   contract.
-- [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md)
-  — current increment's repair-worker decision and APA 7th citations.
+- [`docs/doctoring/contextual-orchestrator-autofix.md`](docs/doctoring/contextual-orchestrator-autofix.md)
+  — current repair-worker decision and APA 7th citations; the NVIDIA NIM record
+  is historical provenance only.
 - [`docs/doctoring/fast-mlsirm-hourly-review-caller.md`](docs/doctoring/fast-mlsirm-hourly-review-caller.md)
   — product-specific psychometric repair heartbeat and scientific gates.
 - [`docs/doctoring/exact-artifact-sbom-attestation.md`](docs/doctoring/exact-artifact-sbom-attestation.md)