fix(nim): refresh hosted access evidence before security stack

[seonghobae]

Problem

Protected main@2e414d15ba58f28597751b625a8a2f00fc9fadcf still carries hosted NVIDIA NIM access evidence whose fail-closed valid_until_date ended on 2026-09-04. This is now an executable prerequisite failure, not a documentation-only stale date.

Repository Security and Quality run 33923471573 on #1066 exact head 51c8824e219c887425d2e7147e87f088d5f1a77d successfully materialized the stacked-PR workflow and checked out merge commit 2d283f75793ecdb760d24c966bed7b4e075af741, but Tests and package quality job 101186730296 failed with 5 failed, 3390 passed, 2 skipped. All five failures are causally upstream of #1066's two-file CI delta: _require_current_actual_cost_evidence() now raises BenchmarkContractError: reviewed NVIDIA hosted-endpoint cost evidence expired; re-review official terms before the tests reach their intended malformed-response / missing-credential / offline-live contracts.

Fresh primary-source review

Reviewed 2026-09-05 against NVIDIA's official Run NIM Anywhere documentation:

https://docs.api.nvidia.com/nim/docs/run-anywhere

The current page states that NVIDIA Developer Program members have free access to NIM API endpoints for prototyping, distinguishes research/development/testing access from production, and says production requires NVIDIA AI Enterprise. This PR does not infer a production model price, deployed capacity, support entitlement, or general zero-cost production use.

Minimal foundation repair

Exact head b0bd71dfa5d6ca065052bc951ad9c9209b88413b is a direct child of protected main and carries exactly the six reviewed NIM-evidence blobs already present in trusted successor #1068:

• CHANGELOG.md
• contextual_orchestrator/nim_benchmark.py
• docs/doctoring/nim-benchmark-evidence-grade.md
• docs/nim_benchmark.md
• docs/product-technical-gap-baseline.md
• tests/test_nim_benchmark_release_acceptance.py

The evidence source becomes Run NIM Anywhere, reviewed_at_date=2026-09-05, and the bounded re-review horizon becomes valid_until_date=2026-10-04. Existing future-date, wrong-source, zero-cost-scope, and expiry fail-closed contracts remain in force.

This PR is deliberately placed before #1066. Putting the evidence refresh into #1066 would contaminate its two-file security-workflow scope; leaving it only in child #1068 makes #1066's full suite deterministically fail before the child can merge. After this foundation reaches protected main, #1066 must non-force restack on the new main and rerun; #1068 can then be reconciled and reduced/closed only after semantic/test/doc equivalence is verified.

Acceptance

Keep Draft until one unchanged exact head has terminal applicable test, security, CodeQL, SAST, fuzz, review, SBOM/provenance evidence. No date extension without a fresh primary-source review, no predecessor-check transfer, no force push, destructive rebase, self-approval, no-op retrigger, admin bypass, or gate weakening.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

승계 확인: 이 PR의 delta는 #1068이 완전히 담고 있습니다 (단, #1073이 아닙니다)

다른 세션의 레인 조정에서 이 PR이 "#1073(a080297d)이 이미 반영했으니 supersession 코멘트 후 닫자"고 제안됐습니다. 결론(정리 대상)은 맞지만 근거는 틀렸습니다. 트리 대조 결과를 남깁니다.

#1073은 이 PR을 승계하지 않습니다

main의 현재 내용입니다:

$ git show origin/main:contextual_orchestrator/nim_benchmark.py | sed -n '115,118p'
    "source_title": "NVIDIA NIM General FAQ",
    "source_url": "https://docs.api.nvidia.com/nim/docs/product",
    "reviewed_at_date": "2026-09-05",
    "valid_until_date": "2026-10-05",

이 PR이 제안하는 것은 인용 출처의 교체입니다 — NVIDIA NIM General FAQ / /nim/docs/product → Run NIM Anywhere / /nim/docs/run-anywhere, 그리고 검증기(:2538)와 에러 문구까지 함께. main에 run-anywhere는 0건이고, #1073이 바꾼 것은 날짜 두 줄뿐입니다. 즉 이 PR의 고유 delta는 main에 없습니다.

실제 승계자는 #1068입니다

$ git show origin/codex/nim-evidence-successor:contextual_orchestrator/nim_benchmark.py
115:    "source_title": "Run NIM Anywhere",
116:    "source_url": "https://docs.api.nvidia.com/nim/docs/run-anywhere",
118:    "valid_until_date": "2026-10-05",
2538:    if evidence["source_url"] != ".../nim/docs/run-anywhere":

출처 교체와 검증기 갱신이 그대로 들어 있습니다. 그리고 파일 집합이 상위 집합입니다:

$ comm -23 <(#1063 파일들) <(#1068 파일들)
(비어 있음 — 이 PR은 #1068의 부분집합)

#1068만 추가로 갖는 것:
  .github/workflows/security.yml
  tests/test_repository_security_metadata.py

한 가지 차이는 #1068 쪽이 옳습니다

이 PR은 valid_until_date를 2026-10-04로 두는데, 기존 관례가 reviewed_at + 30일입니다(직전 값: 2026-08-05 → 2026-09-04). 2026-09-05 + 30 = 2026-10-05이므로 이 PR의 10-04는 하루 어긋난 값이고, #1068은 10-05를 채택했습니다. 그 선택은 테스트가 강제하기도 합니다 — 충돌났던 mutation은 match="validity precedes"를 노리는데, valid_until=10-05에서는 이 PR 쪽 mutation(reviewed_at=10-05)이 10-05 < 10-05 = False라 예외가 발생하지 않습니다.

#1069와 #1063은 서로 완전히 동일합니다

$ git diff pr1063 pr1069
(출력 없음 — 두 PR의 트리가 동일)

파일 목록·행수(6 파일, +20/-15)까지 같습니다. 둘 중 하나만 남겨도 잃는 것이 없습니다.

정리

이 PR의 유효 delta는 #1068이 완전히 승계했고, 날짜 하나는 #1068 쪽이 관례에 맞게 교정했습니다. #1068은 충돌 해소를 마치고 검증까지 통과한 상태입니다(31e3c4da, 3396 passed).

AGENTS.md의 "Verifying a 'superseded — closing' claim" 규율에 따라 닫는 것은 소유자 판단에 맡깁니다. 위 대조가 승계 근거이고, 근거로 지목됐던 #1073은 승계자가 아니라는 점만 정정해 둡니다.

[seonghobae]

Adjudication evidence (host 1 session, 2026-09-06 KST; full report with commands in #1080). Nothing here closes, flips, or retargets anything — the decision is the opener's.

Byte-identical to #1063 (same 128-line three-dot patch; cmp equal; merge-tree between the two clean). Of the pair, this same-repo head is the one that can carry review evidence; #1063 is a fork head.

Dirty vs main@a080297d in four files (nim_benchmark.py, docs/nim_benchmark.md, docs/doctoring/nim-benchmark-evidence-grade.md, tests/test_nim_benchmark_release_acceptance.py — #1073), and the patch would regress valid_until 10-05 → 10-04, so the body's premise (main's evidence expired) no longer holds. The claim that #1068 supersedes this PR is unverified (reverse-apply fails both ways on the date lines); the report lists the tree-level check to run after #1068 lands. Draft hold in the body respected.

[seonghobae]

Superseded by protected main

Restack probe onto current origin/main (b1352648, includes #1092 and #1136) confirms this PR's hosted NIM access-evidence refresh is already present on main via ancestor 9928e4ab (ACTUAL_COST_EVIDENCE: Run NIM Anywhere / reviewed_at_date=2026-09-05 / valid_until_date=2026-10-04).

Faithful conflict resolution (CHANGELOG keep-main; remaining files auto-merged with zero delta) yields a tree identical to origin/main. Per restack policy, not force-pushing head==base.

Focused NIM access/evidence tests on main tip: 179 passed (tests/test_nim_benchmark_release_acceptance.py + tests/test_nim_benchmark.py).

Closing as superseded-by-main. No admin-merge.

[seonghobae]

Closing as superseded-by-main: evidence refresh already on origin/main@b1352648 via 9928e4a; restacked tree equals base.