fix(noema): remove caller repair deadline and duplicate model call

.github/workflows/source-fix-pr1672-single-request-v2.yml

@@ -0,0 +1,106 @@
+name: Source Fix PR 1672 Single Request V2
+
+on:
+  push:
+    branches:
+      - fix/noema-repair-attempt-telemetry
+    paths:
+      - scripts/ci/source_fix_pr1672_v2.py
+      - .github/workflows/source-fix-pr1672-single-request-v2.yml
+
+concurrency:
+  group: source-fix-pr1672-v2-${{ github.repository }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  materialize:
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout exact writer head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Revalidate exact writer head
+        shell: bash
+        run: |
+          set -euo pipefail
+          remote_head="$(git ls-remote origin refs/heads/fix/noema-repair-attempt-telemetry | cut -f1)"
+          test -n "$remote_head"
+          test "$remote_head" = "$GITHUB_SHA"
+          test -e scripts/ci/source_fix_pr1672_v2.py
+          test -e scripts/ci/source_fix_pr1672_single_request.py
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+
+      - name: Install hash-verified test toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --require-hashes -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Materialize owner repair and replace stale retry tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          env -u GH_TOKEN -u GITHUB_TOKEN python scripts/ci/source_fix_pr1672_v2.py
+          python -m py_compile scripts/ci/noema_review_gate.py .github/actions/noema-review/two_phase.py
+          python -m py_compile tests/test_noema_review_gate.py tests/test_noema_repair_attempt_telemetry.py
+          git diff --check
+
+      - name: Verify focused single-request contracts
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pytest \
+            tests/test_noema_repair_has_no_fixed_wall_clock_deadline.py \
+            tests/test_noema_repair_attempt_telemetry.py \
+            tests/test_noema_model_output_failure_classification.py \
+            tests/test_noema_review_gate.py \
+            tests/test_noema_review_orchestrator_ssrf.py \
+            -q
+
+      - name: Verify full repository Python contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m coverage run -m pytest tests -q
+          python -m coverage report --show-missing
+          python -m interrogate -c pyproject.toml scripts/ci
+          python -m compileall -q scripts tests .github/actions/noema-review
+          git diff --check
+
+      - name: Publish only after fresh remote-head validation
+        env:
+          WORKFLOW_PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${WORKFLOW_PUSH_TOKEN:-}" ]; then
+            echo "::error::PR_REVIEW_MERGE_TOKEN with workflow-file write permission is required for this self-retiring publication; refusing github.token publication."
+            exit 1
+          fi
+          test ! -e scripts/ci/source_fix_pr1672_v2.py
+          test ! -e scripts/ci/source_fix_pr1672_single_request.py
+          test ! -e .github/workflows/source-fix-pr1672-single-request-v2.yml
+          test ! -e .github/workflows/source-fix-pr1672-single-request.yml
+          remote_head="$(git ls-remote origin refs/heads/fix/noema-repair-attempt-telemetry | cut -f1)"
+          test "$remote_head" = "$GITHUB_SHA"
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+          git add -A
+          git diff --cached --check
+          git commit -m "fix(noema): delegate repair ownership to orchestrator"
+          remote_head="$(git ls-remote origin refs/heads/fix/noema-repair-attempt-telemetry | cut -f1)"
+          test "$remote_head" = "$GITHUB_SHA"
+          git remote set-url origin "https://x-access-token:${WORKFLOW_PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git push origin HEAD:refs/heads/fix/noema-repair-attempt-telemetry

.github/workflows/source-fix-pr1672-single-request-v3.yml

@@ -0,0 +1,130 @@
+name: Source Fix PR 1672 Single Request V3
+# Exact-head retrigger 2026-09-02C: preserve this one-shot only until the validated owner repair commits.
+
+on:
+  push:
+    branches:
+      - fix/noema-repair-attempt-telemetry
+    paths:
+      - scripts/ci/source_fix_pr1672_v3.py
+      - tests/test_noema_model_output_edge_coverage.py
+      - .github/workflows/source-fix-pr1672-single-request-v3.yml
+
+concurrency:
+  group: source-fix-pr1672-v3-${{ github.repository }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  materialize:
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout exact writer head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Revalidate exact writer head
+        shell: bash
+        run: |
+          set -euo pipefail
+          remote_head="$(git ls-remote origin refs/heads/fix/noema-repair-attempt-telemetry | cut -f1)"
+          test "$remote_head" = "$GITHUB_SHA"
+          test -e scripts/ci/source_fix_pr1672_v3.py
+          test -e scripts/ci/source_fix_pr1672_v2.py
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+
+      - name: Install hash-verified test toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --require-hashes -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Materialize normalized owner repair
+        shell: bash
+        run: |
+          set -euo pipefail
+          env -u GH_TOKEN -u GITHUB_TOKEN python scripts/ci/source_fix_pr1672_v3.py
+          python -m py_compile scripts/ci/noema_review_gate.py .github/actions/noema-review/two_phase.py
+          python -m py_compile tests/test_noema_review_gate.py tests/test_noema_repair_attempt_telemetry.py tests/test_noema_model_output_edge_coverage.py
+          git diff --check
+
+      - name: Verify focused single-request contracts
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pytest \
+            tests/test_noema_repair_has_no_fixed_wall_clock_deadline.py \
+            tests/test_noema_repair_attempt_telemetry.py \
+            tests/test_noema_model_output_failure_classification.py \
+            tests/test_noema_model_output_edge_coverage.py \
+            tests/test_noema_review_gate.py \
+            tests/test_noema_review_orchestrator_ssrf.py \
+            -q
+
+      - name: Verify full repository Python contract
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m coverage run -m pytest tests -q
+          if ! python -m coverage report --show-missing; then
+            echo '::group::Exact Noema source around uncovered lines'
+            nl -ba scripts/ci/noema_review_gate.py | sed -n '980,1070p;1280,1320p'
+            echo '::endgroup::'
+            exit 2
+          fi
+          python -m interrogate -c pyproject.toml scripts/ci
+          python -m compileall -q scripts tests .github/actions/noema-review
+          git diff --check
+
+      - name: Publish only after fresh remote-head validation
+        env:
+          WORKFLOW_PUSH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${WORKFLOW_PUSH_TOKEN:-}" ]; then
+            echo "::error::PR_REVIEW_MERGE_TOKEN with workflow-file write permission is required for this self-retiring publication; refusing weaker fallback credentials."
+            exit 1
+          fi
+          test ! -e scripts/ci/source_fix_pr1672_v3.py
+          test ! -e scripts/ci/source_fix_pr1672_v2.py
+          test ! -e scripts/ci/source_fix_pr1672_single_request.py
+          test ! -e .github/workflows/source-fix-pr1672-single-request-v3.yml
+          test ! -e .github/workflows/source-fix-pr1672-single-request-v2.yml
+          test ! -e .github/workflows/source-fix-pr1672-single-request.yml
+          test ! -e scripts/ci/source_fix_pr1714_no_model_job_timeout.py
+          test ! -e scripts/ci/source_fix_pr1715_no_model_job_timeout.py
+          test ! -e .github/workflows/source-fix-pr1714-no-model-job-timeout.yml
+          test ! -e .github/workflows/source-fix-pr1715-no-model-job-timeout.yml
+          remote_head="$(git ls-remote origin refs/heads/fix/noema-repair-attempt-telemetry | cut -f1)"
+          test "$remote_head" = "$GITHUB_SHA"
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+          git add -A
+          git diff --cached --check
+          git commit -m "fix(noema): delegate repair ownership to orchestrator"
+          remote_head="$(git ls-remote origin refs/heads/fix/noema-repair-attempt-telemetry | cut -f1)"
+          test "$remote_head" = "$GITHUB_SHA"
+          git remote set-url origin "https://github.com/${GITHUB_REPOSITORY}.git"
+          askpass="$RUNNER_TEMP/pr1672-git-askpass.sh"
+          cat > "$askpass" <<'EOF'
+          #!/bin/sh
+          case "$1" in
+            *Username*) printf '%s\n' 'x-access-token' ;;
+            *Password*) printf '%s\n' "$WORKFLOW_PUSH_TOKEN" ;;
+            *) exit 1 ;;
+          esac
+          EOF
+          chmod 700 "$askpass"
+          GIT_ASKPASS="$askpass" GIT_TERMINAL_PROMPT=0 git push origin HEAD:refs/heads/fix/noema-repair-attempt-telemetry
+          rm -f "$askpass"