Route remaining LLM jobs through contextual-orchestrator

.github/workflows/central-review.yml

@@ -442,59 +442,7 @@ jobs:
           NOEMA_LLM_MAX_RETRIES: ${{ vars.NOEMA_LLM_MAX_RETRIES || '1' }}
         run: |
           set -euo pipefail
-          python - <<'PY'
-          import json
-          import os
-          from urllib.parse import urlsplit, urlunsplit
-          from urllib.request import Request, urlopen
-
-          api_url = os.environ.get("NOEMA_LLM_API_URL", "").strip()
-          api_key = os.environ.get("NOEMA_LLM_API_KEY", "").strip()
-          try:
-              parsed = urlsplit(api_url)
-              if parsed.scheme != "https" or not parsed.hostname:
-                  raise ValueError("NOEMA_LLM_API_URL must be an absolute HTTPS URL")
-              if parsed.username or parsed.password or parsed.query or parsed.fragment:
-                  raise ValueError(
-                      "NOEMA_LLM_API_URL must not contain credentials, query, or fragment"
-                  )
-              if parsed.hostname.lower() in {
-                  "api.openai.com",
-                  "models.github.ai",
-                  "openrouter.ai",
-              }:
-                  raise ValueError(
-                      "Noema production review must use contextual-orchestrator, "
-                      "not a direct model provider"
-                  )
-              path = parsed.path.rstrip("/")
-              if not path.endswith("/v1"):
-                  raise ValueError("NOEMA_LLM_API_URL must end in /v1")
-              if not api_key:
-                  raise ValueError("NOEMA_LLM_API_KEY is not configured")
-              health_path = f"{path[:-3]}/healthz" or "/healthz"
-              health_url = urlunsplit(
-                  (parsed.scheme, parsed.netloc, health_path, "", "")
-              )
-              request = Request(
-                  health_url,
-                  headers={"Accept": "application/json", "User-Agent": "noema-reviewer"},
-              )
-              with urlopen(request, timeout=15) as response:  # noqa: S310 - trusted org variable
-                  raw = response.read(65_537)
-              if len(raw) > 65_536:
-                  raise ValueError("contextual-orchestrator health response is too large")
-              health = json.loads(raw)
-              if health.get("status") != "ok" or health.get("service") != "contextual-orchestrator":
-                  raise ValueError(
-                      "NOEMA_LLM_API_URL did not identify contextual-orchestrator"
-                  )
-          except Exception as exc:
-              print(f"::error::Noema contextual-orchestrator preflight failed: {exc}")
-              raise SystemExit(1) from exc
-
-          print("Verified contextual-orchestrator gateway identity.")
-          PY
+          node scripts/verify-orchestrator-gateway.mjs
           printf 'Noema provider contract: gateway=contextual-orchestrator primary=%s timeout=%ss retries=%s.\n' \
             "${NOEMA_LLM_MODEL:-missing}" "${NOEMA_LLM_REQUEST_TIMEOUT_SECONDS:-missing}" \
             "${NOEMA_LLM_MAX_RETRIES:-missing}"

.github/workflows/ci.yml

@@ -56,11 +56,11 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           NOEMA_PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          NOEMA_PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          NOEMA_EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
-          if [[ ! "$NOEMA_PR_BASE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
-            printf '::error::Invalid pull-request base SHA.\n'
+          if [[ ! "$NOEMA_EXPECTED_HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            printf '::error::Invalid expected head SHA.\n'
             exit 1
           fi
           if [ -z "$NOEMA_PR_BASE_REF" ]; then
@@ -80,28 +80,25 @@ jobs:
             printf '::error::Live pull-request base ref did not resolve to a full commit SHA.\n'
             exit 1
           fi
-          if [ "$live_base_sha" != "$NOEMA_PR_BASE_SHA" ]; then
-            printf '::error::Pull-request base branch advanced from %s to %s.\n' \
-              "$NOEMA_PR_BASE_SHA" "$live_base_sha"
+          if ! git merge-base --is-ancestor "$live_base_sha" "$NOEMA_EXPECTED_HEAD_SHA"; then
+            printf '::error::Pull-request head does not contain the current live base %s.\n' "$live_base_sha"
             exit 1
           fi
-          test "$live_base_sha" = "$NOEMA_PR_BASE_SHA"
+          printf 'NOEMA_LIVE_BASE_SHA=%s\n' "$live_base_sha" >> "$GITHUB_ENV"
 
       - name: verify lockfile change control
         if: github.event_name == 'pull_request'
         shell: bash
-        env:
-          NOEMA_PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           set -euo pipefail
-          if [[ ! "$NOEMA_PR_BASE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
-            printf '::error::Invalid pull-request base SHA.\n'
+          if [[ ! "$NOEMA_LIVE_BASE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            printf '::error::Invalid live pull-request base SHA.\n'
             exit 1
           fi
           base_lock="$RUNNER_TEMP/noema-package-lock-base.json"
-          git show "${NOEMA_PR_BASE_SHA}:package-lock.json" >"$base_lock"
+          git show "${NOEMA_LIVE_BASE_SHA}:package-lock.json" >"$base_lock"
           NOEMA_LOCKFILE_BASE_PATH="$base_lock" \
-          NOEMA_LOCKFILE_BASE_SHA="$NOEMA_PR_BASE_SHA" \
+          NOEMA_LOCKFILE_BASE_SHA="$NOEMA_LIVE_BASE_SHA" \
           node --input-type=module <<'NODE'
           import { runLockfileChangeControl } from "./scripts/lockfile-change-control.mjs";
 
@@ -127,11 +124,10 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           NOEMA_PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          NOEMA_PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
           set -euo pipefail
-          if [[ ! "$NOEMA_PR_BASE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
-            printf '::error::Invalid pull-request base SHA.\n'
+          if [[ ! "$NOEMA_LIVE_BASE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            printf '::error::Initial live pull-request base SHA is unavailable.\n'
             exit 1
           fi
           if [ -z "$NOEMA_PR_BASE_REF" ]; then
@@ -151,9 +147,9 @@ jobs:
             printf '::error::Live pull-request base ref did not resolve to a full commit SHA.\n'
             exit 1
           fi
-          if [ "$live_base_sha" != "$NOEMA_PR_BASE_SHA" ]; then
+          if [ "$live_base_sha" != "$NOEMA_LIVE_BASE_SHA" ]; then
             printf '::error::Pull-request base branch advanced during verification from %s to %s.\n' \
-              "$NOEMA_PR_BASE_SHA" "$live_base_sha"
+              "$NOEMA_LIVE_BASE_SHA" "$live_base_sha"
             exit 1
           fi
-          test "$live_base_sha" = "$NOEMA_PR_BASE_SHA"
+          test "$live_base_sha" = "$NOEMA_LIVE_BASE_SHA"