fix: require JSON media type for orchestrator health - #697

Finding

Noema's contextual-orchestrator /healthz verifier bounds response bytes, normalizes locked reader acquisition, uses fatal UTF-8 and duplicate-key JSON admission, and requires the exact { status: "ok", service: "contextual-orchestrator" } identity. It did not validate the successful response media type before accepting those bytes. A reverse proxy, error page, or other non-JSON representation containing the same JSON-shaped text could therefore satisfy identity admission despite not being an application/json health document.

This lane changes only Noema-owned consumption/admission of contextual-orchestrator health evidence. It does not move service/provider/model routing, credentials, outbound authority, quarantine/security authority, release/deployment authority, or foreign domain truth into Noema.

Test-first RED

Test-only exact 27fefd8c23846841660199dcb86775c164715966 added hostile coverage requiring a valid identity document served as text/plain; charset=utf-8 to fail closed with the stable diagnostic contextual-orchestrator health response content-type is not application/json. It also pins acceptance of application/json; charset=utf-8 so ordinary media-type parameters remain valid.

Hosted application CI 34727039322 reproduced the defect after typecheck: release tests failed because the non-JSON representation was accepted as a valid contextual-orchestrator identity.

Causal repair and verification findings

The minimal source repair validates the successful response Content-Type media type before body consumption and preserves the 65,536-byte ceiling, optional caller-supplied deadline with no invented default timeout, fixed retained buffer, best-effort cancellation, reader-lock lifecycle, fatal UTF-8, duplicate-key/JSON admission, and exact orchestrator identity.

Exact 1f5b17eac160beb47735a91938f4fc50daba1491 exposed a separate test-fixture defect in hosted CI 34727236581: 20 existing tests used otherwise-valid health response doubles without a JSON media type, so the strengthened admission correctly failed before those tests reached their intended byte-bound, timeout, identity, or cleanup assertions. The repair updates only those fixtures to satisfy the now-explicit media contract; the production guard is not weakened.

Exact 81c96108c5401b80afc441135a5a40e1545e2df3 then passed all 4,768 tests, but application CI 34727550279 correctly rejected the head because the new async cancellation rejection callback at scripts/lib/orchestrator-gateway.mjs:344 was not executed and owned statement/function coverage fell below 100%. The final test repair makes response.body.cancel() reject asynchronously under a non-JSON response and proves the already-decided media-type failure remains authoritative. It also pins the missing-Content-Type fail-closed path.

Exact-head GREEN

Final exact is 1e0ac2eac6d3172468c842cae957079305c33a1d.

• application CI 34727701836: SUCCESS
• reviewer-ci 34727701829: SUCCESS
• Security Scan 34727701821: SUCCESS
• patch-validator-image 34727701818: SUCCESS

Inline review threads are empty. No gate weakening, force-push, destructive rebase, self-approval, provider fallback, or foreign authority duplication.

Summary by CodeRabbit

• 버그 수정

  • 오케스트레이터 상태 확인 응답이 application/json 형식인지 검증합니다.
  • JSON이 아닌 응답은 본문 처리를 중단하고 오류로 처리합니다.
  • application/json에 추가 매개변수가 포함된 형식은 계속 허용됩니다.

• 테스트

  • 잘못된 미디어 타입, 누락된 헤더, 응답 취소 실패 등 관련 시나리오를 추가로 검증합니다.