refactor(ddd): restore contextual-orchestrator ownership boundary

[seonghobae]

Scope

Restores the DDD/source-of-truth boundary between LineageWeave and ContextualWisdomLab/contextual-orchestrator.

LineageWeave owns product measurement/evidence policy and consumes the published orchestrator contract. Provider credentials, provider endpoints, model-agent bootstrap, provider/model discovery, routing and fallback remain in contextual-orchestrator.

Changes

• architectural fitness regression rejects LineageWeave-owned provider configuration or an embedded orchestrator runtime;
• removes docker/contextual-orchestrator/{Dockerfile,agents.json,start.py} and its obsolete bootstrap test;
• removes the local orchestrator Compose service; backend/MCP consume only externally supplied ORCHESTRATOR_BASE_URL / ORCHESTRATOR_API_KEY;
• removes provider/gateway settings from .env.example;
• Keyman and LLM channel-weight operator paths refuse provider-gateway credential fallbacks;
• ADR 0300, Context Map, ubiquitous-language and changelog evidence describe the consumer boundary;
• historical Vision doctoring no longer presents provider-gateway variables as current LineageWeave configuration.

Fail-closed behavior

With no contextual-orchestrator consumer endpoint/credential configured, model-backed channels remain unavailable rather than calling a provider directly. No provider key or provider URL is accepted as an orchestrator credential.

TDD / review evidence

The architecture-fitness RED began at 88ad120a22fd286306e0ba49e66eb2b670c22ebc; subsequent commits remove the causes. A documentation audit then found docs/doctoring/ACTUAL_RUNTIME_EVIDENCE_2026-08-19_VISION.md still described LLM_GATEWAY_API_URL / LLM_GATEWAY_API_KEY as current LineageWeave configuration; 379c44b0eb09bfb8b3aa087acd7b7729482a4360 corrected that statement while preserving the historical 2026-08-19 experiment.

Protected main later advanced through #923 from 3f61c8242b9c02dec307a7396e83e28f7cdd9f3d to 0f1d44726cc8fd9fd05a4f9b91ec40ff6be8802d. The sole intervening delta is .github/workflows/tests.yml docs-only paths-ignore; this branch does not modify that workflow. The branch adopted the protected-main delta by ordinary two-parent merge commit 668e053c8e4cdc1b9092dba914e1cf796a683a45, preserving the ownership-boundary tree and avoiding force rewrite.

Exact live identity / governance

• protected base: main@0f1d44726cc8fd9fd05a4f9b91ec40ff6be8802d;
• exact current head: 668e053c8e4cdc1b9092dba914e1cf796a683a45;
• GitHub reports Draft/open/mechanically mergeable;
• exact-head OSV 33712534269, Tests 33712533872, SAST 33712533843, Scorecard 33712533851, and Security 33712533880 are queued and therefore non-passing;
• predecessor checks, including the earlier dependency-review HTTP 403 evidence, do not transfer to this new head;
• no qualifying formal approval is claimed for the changed head.

Keep Draft until unchanged-current-head security/governance evidence is terminal-clean and the required independent review is present. Do not self-approve, bypass, weaken gates, or inherit predecessor evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head local evidence for 2368b9052f33c77c33b72ac87264efd4b7b9cbff:

• docker compose config --quiet passed; services no longer include an embedded orchestrator.
• Owner-boundary, DDD fitness, client/default, and documentation checks: 39 passed.
• Full collection: 1,889 passed, 17 skipped; 10 live API failures all reduce to the known migration-fixture drift already repaired on PR fix(voice): distinguish carrying and evidence exports #780.

This PR remains draft until #780 lands (or its exact fix is otherwise present) and current-head hosted checks/review are terminal. No provider credentials or production records were inspected.