From cdae461a737be5d619281e6a0c2339485c961f4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:45:46 +0900 Subject: [PATCH 1/2] docs: retire superseded direct-NIM hotfix --- docs/nvidia-nim-opencode-hotfix.md | 53 ------------------------------ 1 file changed, 53 deletions(-) delete mode 100644 docs/nvidia-nim-opencode-hotfix.md diff --git a/docs/nvidia-nim-opencode-hotfix.md b/docs/nvidia-nim-opencode-hotfix.md deleted file mode 100644 index df8c193b28..0000000000 --- a/docs/nvidia-nim-opencode-hotfix.md +++ /dev/null @@ -1,53 +0,0 @@ -# NVIDIA NIM OpenCode model priority (hotfix) - -## Why - -OpenCode Agent failed to produce a usable review on the PR thread starting at -ContextualWisdomLab/fast-mlsirm#290 (`opencode-review` check **skipped**, no -`opencode-agent[bot]` review comment). Central review therefore prioritizes -**NVIDIA NIM** models as additional catalog candidates so the model pool can -still emit APPROVE / REQUEST_CHANGES when GitHub Models / free tiers stall. - -## Changes - -1. `opencode.jsonc` - - `enabled_providers`: `nvidia-nim` first, then `github-models` - - default `model` / `small_model` prefer NIM Nemotron / Llama 3.3 - - new OpenAI-compatible provider `nvidia-nim` → `https://integrate.api.nvidia.com/v1` - with `apiKey: {env:NVIDIA_API_KEY}` -2. `.github/workflows/opencode-review-dispatch.yml` - - `OPENCODE_MODEL_CANDIDATES` prefixes six NIM models before existing pool - - binds `NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}` -3. `scripts/ci/run_opencode_review_model_pool.sh` - - skips `nvidia-nim/*` when `NVIDIA_API_KEY` is unset (same pattern as OpenRouter) - -## Temporary permission bypass (hotfix only) - -For this merge-aid hotfix only: - -- Branch-protection / ruleset admin override may be used to land the central - `.github` change if required checks conflict during the hotfix window. -- **Do not** permanently weaken Security Scan, trivy-fs, osv-scan, or - CodeQL gates. -- **Do not** flip OpenCode agent `permission.edit` / `bash` from `deny` to - `allow` permanently; review agents remain read-only. -- Org secret `NVIDIA_API_KEY` must be set on ContextualWisdomLab for NIM pool - entries to execute; without it the pool falls through to prior candidates. - -## Rollback - -Remove the `nvidia-nim/*` prefixes from `OPENCODE_MODEL_CANDIDATES`, drop the -`nvidia-nim` provider block, and delete this note once GitHub Models / OpenCode -catalog reliability is restored. - -## Secret name - -Org secret is **`NVIDIA_NIM_API_KEY`**. Workflows bind it to process env `NVIDIA_API_KEY` -(fallback: `secrets.NVIDIA_API_KEY` if present) so `opencode.jsonc` `{env:NVIDIA_API_KEY}` resolves. - -## Large-repo OpenCode timeouts (~1 hour) - -Primary/default run timeouts and the dynamic queue timeout cap default to -**3600s** (hour-class) so large repositories are not cut off by the old 600s -default when env is unset. Free-tier failover remains capped at 600s. -Workflow-provided values (e.g. 5400s) still win over defaults. From 43d1f1c803a278aeeb2c3801a2ce69092154d35a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 05:46:44 +0900 Subject: [PATCH 2/2] docs: record NIM hotfix retirement boundary --- .../nvidia-nim-opencode-hotfix-retirement.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 docs/doctoring/nvidia-nim-opencode-hotfix-retirement.md diff --git a/docs/doctoring/nvidia-nim-opencode-hotfix-retirement.md b/docs/doctoring/nvidia-nim-opencode-hotfix-retirement.md new file mode 100644 index 0000000000..0036bf10c2 --- /dev/null +++ b/docs/doctoring/nvidia-nim-opencode-hotfix-retirement.md @@ -0,0 +1,21 @@ +# NVIDIA NIM OpenCode hotfix retirement + +## Decision + +The legacy direct-provider OpenCode hotfix is retired. Protected `main` now enables only the `contextual-orchestrator` provider in `opencode.jsonc`, with both normal and small-model review requests routed through `contextual-orchestrator/orchestrator/free`. Direct NVIDIA NIM provider selection is therefore not part of the OpenCode review contract. + +The removed `docs/nvidia-nim-opencode-hotfix.md` described a superseded architecture: direct `nvidia-nim` provider configuration, `NVIDIA_API_KEY` binding, and an administrator-bypass hotfix window. Keeping that document beside the current gateway-only configuration created an operational contradiction and could mislead a maintainer into restoring a retired direct-provider path. + +## Current authority boundary + +- `ContextualWisdomLab/.github` owns the review workflows and gateway integration. +- `opencode.jsonc` enables only `contextual-orchestrator` and denies direct-provider fallback. +- NVIDIA NIM credentials may be registered into contextual-orchestrator's provider-discovery boundary; they are not an OpenCode provider credential or a direct workflow model binding. +- The write-capable scheduled autofix path follows the same gateway-only boundary documented in `docs/doctoring/hourly-nvidia-nim-autofix.md` and ADR-0003. +- Queue-saturation administrator bypass, when separately proven under the current control-plane contract, is an admission-recovery mechanism and must not be documented as a provider-specific hotfix permission. + +## Verification + +This record was created from protected `main@81b6f20d7f701bd2e50642ab107ab0f187ae6dc9`. At that revision, `opencode.jsonc` declares `enabled_providers: ["contextual-orchestrator"]`, uses `contextual-orchestrator/orchestrator/free`, and contains no live `nvidia-nim` provider block. The existing `docs/doctoring/hourly-nvidia-nim-autofix.md` already records the corrected gateway-only provider contract. + +No runtime source, credential, model-selection rule, security threshold, branch-protection rule, or review authority is changed by this documentation cleanup. \ No newline at end of file