feat(ai): add NVIDIA NIM live proposal conformance

[seonghobae]

Buyer-visible outcome

Operators receive reproducible, credential-free evidence showing when a strong single NVIDIA NIM route is sufficient and when bounded contextual-orchestrator workflows improve LifeOS proposal quality.

Implemented contract

• runs hourly and manually with one single-flight, two-hour bounded workflow
• uses only NVIDIA_NIM_API_KEY; no Copilot token or browser credential reaches the evaluator
• pins contextual-orchestrator to reviewed commit 6841b71935e0b7cb98fb52bcb4709cc5100c8d87
• installs only hash-locked orchestrator dependencies and executes the pinned checkout directly
• seeds the NVIDIA credential through the encrypted contextual-orchestrator KV bootstrap
• restricts orchestration to loopback and NVIDIA NIM egress to integrate.api.nvidia.com
• compares route-low, route-high, and bounded conduct-template profiles while recording unsupported profile cells explicitly
• varies reasoning effort, workflow depth, roles, decomposition, and access topology without optimizing for latency
• reuses the production proposal evaluator and realistic benign, grounding, operation-conformance, and prompt-injection fixtures
• retains only bounded counts, rates, deltas, token totals, orchestration measurements, exact commit SHAs, and limitations
• classifies missing credentials, missing model inventory, provider failures, malformed responses, and invalid configuration without retaining secrets or model text
• writes a restrictive temporary report, validates it, then atomically renames and uploads only credential-free JSON evidence
• keeps live-provider availability outside deterministic pull-request merge gates while fully testing the workflow and transport contracts

Verification evidence

• AI-service lint and TypeScript checks
• 100% statement, branch, function, and line coverage
• docstring coverage for every production declaration
• deterministic workflow, CLI, command, report, transport, and security regression tests
• realistic proposal-quality and prompt-injection evaluation cases
• AppGuardrail, Semgrep, Security Scan, Commercial Readiness, CI, and CodeRabbit on the exact final head
• current Fugu, Conductor, TRINITY, NIST, OWASP, and relevant API guidance documented with APA 7 references
• ARCHITECTURE.md, AGENTS.md, CLAUDE.md, CHANGELOG.md, operating guidance, capability evidence, design specification, and implementation plan updated

Merge gate

Merge only after all required checks pass on the exact current head and no actionable human, CodeRabbit, or security review findings remain.

Closes #116.

Refs #46, #21, #114, and #115.

Summary by CodeRabbit

• 새 기능

  • NVIDIA NIM 기반 AI 제안의 라이브 적합성 검증을 주기적 또는 수동으로 실행할 수 있습니다.
  • route 및 conduct 프로필별 품질 지표, 사용량, 오케스트레이션 관찰 결과와 기준선 대비 변화를 확인할 수 있습니다.
  • 검증 결과를 구조화된 JSON 보고서로 생성하고 안전하게 게시·보관합니다.
  • 모델 누락, 인증 문제, 제공자 장애 등 실패 상태를 명확한 결과로 기록합니다.

• 보안 및 안정성

  • 자격 증명과 민감한 제공자 정보가 보고서와 오류 메시지에 노출되지 않습니다.
  • 보고서 저장 중 오류 발생 시 불완전한 파일이 게시되지 않습니다.

• 문서화

  • 서비스 경계, AI 제안 안전성, 운영 및 검증 원칙을 문서화했습니다.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b732f949-28a3-4fbd-b16f-842781accd14

📥 Commits

Reviewing files that changed from the base of the PR and between 60abe10 and ba5f363.

📒 Files selected for processing (1)

• apps/ai-service/src/proposal-quality-live-invalid-configuration.test.ts

📝 Walkthrough

Walkthrough

NVIDIA NIM 기반 라이브 제안 적합성 평가를 추가했습니다. 새 모델 계약, bounded observation, 품질 보고서, 원자적 게시 CLI, 고정 GitHub Actions 워크플로, 운영 문서와 결정적 테스트를 포함합니다.

Changes

라이브 제안 적합성

Layer / File(s)	Summary
라이브 모델 및 제안 계약 apps/ai-service/src/contextual-orchestrator-*.ts, apps/ai-service/src/*live-model*.test.ts	공개 제안 스키마와 파서를 추가하고, loopback contextual-orchestrator 요청·응답·trace·usage를 검증합니다. 오류를 정해진 실패 코드로 분류합니다.
적합성 평가 및 보고서 검증 apps/ai-service/src/proposal-quality-live-conformance.ts, apps/ai-service/src/*conformance*.test.ts, apps/ai-service/src/proposal-quality-live-coverage.test.ts	여러 프로파일을 평가하고 기준선 델타, 사용량, 추천, 비가용 상태를 포함한 불변 JSON 보고서를 생성·검증합니다.
CLI 실행 및 원자적 보고서 게시 apps/ai-service/src/proposal-quality-live-command.ts, apps/ai-service/src/proposal-quality-live-cli.ts, apps/ai-service/package.json, apps/ai-service/src/*command*.test.ts, apps/ai-service/src/proposal-quality-live-cli.test.ts	환경과 모델 목록을 검증하고, 보고서를 0600 임시 파일에 기록한 뒤 재검증 후 원자적으로 게시합니다. CLI는 진입점에서만 실행되며 오류 시 고정 메시지와 종료 코드 1을 사용합니다.
고정 환경 라이브 워크플로 .github/workflows/ai-proposal-live-conformance.yml, apps/ai-service/src/proposal-quality-live-workflow.test.ts	예약·수동 실행, 고정 액션과 오케스트레이터 커밋, PostgreSQL KV 부트스트랩, NVIDIA 자격 증명 격리, loopback health check, 보고서 검증·업로드·정리를 구성합니다.
아키텍처 및 에이전트 운영 계약 AGENTS.md, ARCHITECTURE.md, CLAUDE.md, CHANGELOG.md, docs/superpowers/*, product/capabilities.json	서비스 경계, AI 제안 제한, 라이브 검증 규칙, 보안 통제, 설계 근거와 capability 증거를 문서화합니다.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant ProposalQualityLiveCommand
  participant ContextualOrchestratorLiveProposalModel
  participant ContextualOrchestrator
  participant NVIDIANIM
  GitHubActions->>ProposalQualityLiveCommand: 라이브 적합성 명령 실행
  ProposalQualityLiveCommand->>ContextualOrchestratorLiveProposalModel: 프로파일 평가 요청
  ContextualOrchestratorLiveProposalModel->>ContextualOrchestrator: loopback completion 요청
  ContextualOrchestrator->>NVIDIANIM: NVIDIA 모델 요청
  NVIDIANIM-->>ContextualOrchestrator: completion 응답
  ContextualOrchestrator-->>ContextualOrchestratorLiveProposalModel: completion과 bounded trace 반환
  ContextualOrchestratorLiveProposalModel-->>ProposalQualityLiveCommand: draft와 observation 반환
  ProposalQualityLiveCommand-->>GitHubActions: 검증된 JSON 보고서 게시

Loading

Possibly related PRs

• ContextualWisdomLab/life-os#114: 라이브 적합성 평가가 이 PR의 제안 스키마, completion 파서 및 transport 오류 계약을 재사용합니다.
• ContextualWisdomLab/life-os#115: 이 PR이 기존 proposal-quality 평가 경계를 확장해 NVIDIA NIM 라이브 적합성 실행을 연결합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 NVIDIA NIM 라이브 제안 적합성 기능 추가라는 변경의 핵심을 정확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	워크플로, 고정 커밋, 자격 증명 격리, 평가·보고서·실패 분류, 결정적 테스트와 문서화 요구사항을 구현했습니다.
Out of Scope Changes check	✅ Passed	변경 사항은 NVIDIA NIM 라이브 적합성 기능, 보안·검증 계약, 관련 문서와 capability 증거 범위에 포함됩니다.
Docstring Coverage	✅ Passed	Docstring coverage is 95.06% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/ai-nim-live-conformance

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.