fix: verify Noema GitHub App identity

docs/doctoring/noema-orchestrator-free-zdr.md

@@ -67,3 +67,10 @@ Noema resolves target visibility with its repository-scoped reviewer token.
 Private/internal targets require an attested ZDR-only `orchestrator/free`
 catalog. Missing visibility, malformed policy input, or an empty ZDR pool fails
 the required review; it never falls back to a non-ZDR provider.
+
+## Independent review contract
+
+Noema reviews each current head without waiting for an OpenCode approval,
+review-thread resolution, or other check conclusions. All trigger types share
+one repository-and-PR concurrency key, and the reviewer fails closed when its
+identity or substantive LLM summary cannot be verified.

scripts/ci/noema_review_gate.py

@@ -189,11 +189,18 @@ def existing_noema_review(pr: dict[str, Any], actor: str) -> bool:
 
 
 def current_actor() -> str:
-    """Return the login for the active gh token, or empty string on failure."""
-    try:
-        return run(["gh", "api", "user", "--jq", ".login"]).strip()
-    except Exception:
-        return ""
+    """Return the verified user or GitHub App bot login for the active token."""
+    for args, suffix in (
+        (["gh", "api", "user", "--jq", ".login"], ""),
+        (["gh", "api", "/installation", "--jq", ".app_slug"], "[bot]"),
+    ):
+        try:
+            identity = run(args).strip()
+        except Exception:
+            continue
+        if identity:
+            return f"{identity}{suffix}"
+    return ""
 
 
 def fetch_diff(repo: str, number: int) -> tuple[str, bool]:

tests/test_noema_review_gate.py

@@ -119,6 +119,14 @@ def test_current_actor_fetch_diff_and_json_extraction(monkeypatch):
     monkeypatch.setattr(noema, "run", lambda *args, **kwargs: (_ for _ in ()).throw(RuntimeError("no gh")))
     assert noema.current_actor() == ""
 
+    def app_identity(args, **kwargs):
+        if args[2] == "user":
+            return ""
+        return "cwl-noema-review\n"
+
+    monkeypatch.setattr(noema, "run", app_identity)
+    assert noema.current_actor() == "cwl-noema-review[bot]"
+
     monkeypatch.setattr(noema, "run", lambda *args, **kwargs: "x" * (noema.MAX_DIFF_CHARS + 5))
     diff, truncated = noema.fetch_diff("owner/repo", 1)
     assert truncated