chore: refresh org SBOM inventory

.github/actions/noema-review/two_phase.py

@@ -167,16 +167,20 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     changed_files = gate.fetch_changed_files(repo, number)
     changed_paths = tuple(file_path for file_path, _status in changed_files)
     review_context = gate.build_review_context(repo, number, pull_request, changed_files)
-    verdict = gate.call_llm(
-        repo,
-        number,
-        pull_request,
-        diff,
-        truncated,
-        expected,
-        review_context,
-        changed_paths,
-    )
+    try:
+        verdict = gate.call_llm(
+            repo,
+            number,
+            pull_request,
+            diff,
+            truncated,
+            expected,
+            review_context,
+            changed_paths,
+        )
+    except gate.NoemaTransportError as exc:
+        _emit_transport_capacity_outputs(exc, expected_head=expected)
+        raise
 
     _write_envelope(
         path,
@@ -196,6 +200,45 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     return 0
 
 
+def _emit_transport_capacity_outputs(
+    exc: gate.NoemaTransportError,
+    *,
+    expected_head: str,
+) -> None:
+    """Publish typed capacity evidence for the workflow's bounded re-dispatch step."""
+    retry_attempt = gate.current_transport_retry_attempt()
+    delay = gate.transport_redispatch_delay_seconds(
+        transport_retry_attempt=retry_attempt,
+        head_sha=expected_head,
+        retry_after_seconds=exc.retry_after_seconds,
+    )
+    eligible = bool(exc.capacity_unavailable and delay is not None)
+    outputs = {
+        "transport_capacity_unavailable": "true" if exc.capacity_unavailable else "false",
+        "transport_retry_eligible": "true" if eligible else "false",
+        "prepared": "false",
+    }
+    if type(exc.http_status) is int:
+        outputs["transport_http_status"] = str(exc.http_status)
+    if type(exc.provider_attempt_count) is int:
+        outputs["provider_attempt_count"] = str(exc.provider_attempt_count)
+    if delay is not None:
+        outputs["transport_retry_delay_seconds"] = str(delay)
+        outputs["transport_retry_next_attempt"] = str(retry_attempt + 1)
+    gate.append_github_output(outputs)
+    if eligible:
+        print(
+            "::notice::Noema provider capacity unavailable after gateway failover; "
+            f"bounded continuation re-dispatch is eligible in {delay}s "
+            f"(attempt {retry_attempt + 1}/{gate.MAX_TRANSPORT_REDISPATCH_ATTEMPTS})."
+        )
+    elif exc.capacity_unavailable:
+        print(
+            "::error::Noema provider capacity unavailable after gateway failover; "
+            "automatic re-dispatch budget is exhausted. Review remains required."
+        )
+
+
 def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> int:
     """Publish a prepared verdict only with fresh exact-head/base reviewer authority."""
     expected = _canonical_head(expected_head)

.github/actions/orchestrator-free-sidecar/action.yml

@@ -6,9 +6,9 @@ inputs:
     required: false
     default: "false"
   catalog_limit:
-    description: Maximum discovered route catalog size for the sidecar preflight.
+    description: Maximum discovered route catalog size for the sidecar preflight (a candidate list probed lazily to a readiness target, ADR-0029).
     required: false
-    default: "12"
+    default: "24"
   catalog_account_cap:
     description: Maximum routes admitted from one credential account.
     required: false

.github/workflows/actions-queue-health.yml

@@ -0,0 +1,55 @@
+name: GitHub Actions queue health
+
+on:
+  schedule:
+    - cron: "7 * * * *"
+
+concurrency:
+  group: github-actions-queue-health
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  collect:
+    name: Collect exact-head queue evidence
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout trusted queue-health source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Collect read-only repository and runner evidence
+        env:
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}
+        run: |
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN is required for cross-repository queue reads."
+            exit 1
+          fi
+          echo "::add-mask::$GH_TOKEN"
+          python3 scripts/ci/actions_queue_health.py \
+            --allowlist config/actions_queue_health_repositories.json \
+            --output-json "$RUNNER_TEMP/actions-queue-health.json" \
+            --output-html "$RUNNER_TEMP/actions-queue-health.html"
+
+      - name: Upload queue-health evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: github-actions-queue-health-${{ github.run_id }}
+          path: |
+            ${{ runner.temp }}/actions-queue-health.json
+            ${{ runner.temp }}/actions-queue-health.html
+          if-no-files-found: error

.github/workflows/agent-mention-noema-dispatch.yml

@@ -8,15 +8,26 @@ on:
   repository_dispatch:
     types: [agent-mention-noema]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -8,15 +8,26 @@ on:
   repository_dispatch:
     types: [agent-mention-opencode]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -11,21 +11,31 @@ on:
       - "tests/test_noema_two_phase_handoff.py"
       - "tests/test_noema_refreshed_app_identity.py"
       - "tests/test_noema_token_lifetime_stale_run_contract.py"
+      - "scripts/ci/noema_review_document.py"
+      - "scripts/ci/noema_hwp_mcp_reader.mjs"
+      - "scripts/ci/noema-document-reader/package.json"
+      - "scripts/ci/noema-document-reader/package-lock.json"
+      - "tests/test_noema_document_review_context.py"
       - "docs/doctoring/noema-review-token-lifetime.md"
       - "docs/product-technical-gap-baseline.md"
       - ".github/workflows/opencode-review-dispatch.yml"
       - "scripts/ci/ensure_rust_llvm19.sh"
       - "tests/test_opencode_rust_coverage_toolchain_contract.py"
+      - "scripts/ci/materialize_base_javascript_packages.py"
+      - "tests/test_javascript_materializer_docstrings.py"
       - "tests/test_pr_review_autofix_nvidia_nim_contract.py"
       - "docs/doctoring/opencode-rust-coverage-runtime-boundary.md"
       - ".github/workflows/strix.yml"
       - "docs/doctoring/strix-legal-git-paths.md"
       - "docs/doctoring/strix-model-behavior-error.md"
       - "docs/doctoring/strix-quality-timeout-fixtures.md"
+      - "docs/doctoring/strix-evidence-binding-2159-2168.md"
       - "scripts/ci/strix_quick_gate.sh"
+      - "scripts/ci/strix_evidence_binding.py"
       - "scripts/ci/test_strix_quick_gate.sh"
       - "tests/test_docs_only_pr_runner_admission.py"
       - "tests/test_strix_changed_path_policy.py"
+      - "tests/test_strix_evidence_binding.py"
       - "tests/test_strix_model_behavior_error.py"
       - "tests/test_strix_nvidia_nim_not_found_fallback.py"
       - "tests/test_strix_workflow_dependency_hashes.py"
@@ -101,6 +111,8 @@ on:
       - "docs/doctoring/exact-artifact-sbom-quality-runner-consolidation-20260903.md"
       - "CHANGELOG.d/20260903-exact-artifact-quality-runner-consolidation.md"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-noema-document-ci.txt"
+      - "requirements-noema-document-ci-hashes.txt"
 
 # PR validation only: a new head cancels only an older run of this workflow
 # for the same repository and pull request.
@@ -136,7 +148,9 @@ jobs:
         with:
           python-version: "3.14"
           cache: pip
-          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+          cache-dependency-path: |
+            requirements-opencode-review-ci-hashes.txt
+            requirements-noema-document-ci-hashes.txt
 
       - name: Select affected contract suites
         id: affected_suites
@@ -179,23 +193,33 @@ jobs:
               tests/test_noema_two_phase_handoff.py|\
               tests/test_noema_refreshed_app_identity.py|\
               tests/test_noema_token_lifetime_stale_run_contract.py|\
+              scripts/ci/noema_review_document.py|\
+              scripts/ci/noema_hwp_mcp_reader.mjs|\
+              scripts/ci/noema-document-reader/package.json|\
+              scripts/ci/noema-document-reader/package-lock.json|\
+              tests/test_noema_document_review_context.py|\
               docs/doctoring/noema-review-token-lifetime.md)
                 noema_suite=true
                 ;;
               .github/workflows/opencode-review-dispatch.yml|\
               scripts/ci/ensure_rust_llvm19.sh|\
               tests/test_opencode_rust_coverage_toolchain_contract.py|\
+              scripts/ci/materialize_base_javascript_packages.py|\
+              tests/test_javascript_materializer_docstrings.py|\
               docs/doctoring/opencode-rust-coverage-runtime-boundary.md)
                 opencode_suite=true
                 ;;
               .github/workflows/strix.yml|\
               docs/doctoring/strix-legal-git-paths.md|\
               docs/doctoring/strix-model-behavior-error.md|\
               docs/doctoring/strix-quality-timeout-fixtures.md|\
+              docs/doctoring/strix-evidence-binding-2159-2168.md|\
               scripts/ci/strix_quick_gate.sh|\
+              scripts/ci/strix_evidence_binding.py|\
               scripts/ci/test_strix_quick_gate.sh|\
               tests/test_docs_only_pr_runner_admission.py|\
               tests/test_strix_changed_path_policy.py|\
+              tests/test_strix_evidence_binding.py|\
               tests/test_strix_model_behavior_error.py|\
               tests/test_strix_nvidia_nim_not_found_fallback.py|\
               tests/test_strix_workflow_dependency_hashes.py|\
@@ -206,6 +230,10 @@ jobs:
                 noema_suite=true
                 opencode_suite=true
                 ;;
+              requirements-noema-document-ci.txt|\
+              requirements-noema-document-ci-hashes.txt)
+                noema_suite=true
+                ;;
               .github/workflows/pr-review-merge-scheduler.yml)
                 queue_suite=true
                 review_repair_suite=true
@@ -321,7 +349,13 @@ jobs:
         if: steps.affected_suites.outputs.noema == 'true' || steps.affected_suites.outputs.opencode == 'true' || steps.affected_suites.outputs.review_repair == 'true' || steps.affected_suites.outputs.exact_artifact == 'true'
         run: >-
           python -m pip install --disable-pip-version-check --require-hashes
-          -r requirements-opencode-review-ci-hashes.txt
+          -r requirements-opencode-review-ci-hashes.txt -r requirements-noema-document-ci-hashes.txt
+
+      - name: Install exact Noema document dependencies
+        if: steps.affected_suites.outputs.noema == 'true'
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes --no-deps
+          -r requirements-noema-document-ci-hashes.txt
 
       - name: Verify Noema token-lifetime contracts
         if: steps.affected_suites.outputs.noema == 'true'
@@ -331,13 +365,15 @@ jobs:
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
             tests/test_noema_refreshed_app_identity.py \
-            tests/test_noema_token_lifetime_stale_run_contract.py
+            tests/test_noema_token_lifetime_stale_run_contract.py \
+            tests/test_noema_document_review_context.py
           python -m compileall -q \
             .github/actions/noema-review/two_phase.py \
             tests/test_noema_reviewer_token_lifetime.py \
             tests/test_noema_two_phase_handoff.py \
             tests/test_noema_refreshed_app_identity.py \
-            tests/test_noema_token_lifetime_stale_run_contract.py
+            tests/test_noema_token_lifetime_stale_run_contract.py \
+            tests/test_noema_document_review_context.py
 
       - name: Verify OpenCode Rust coverage toolchain contract
         if: steps.affected_suites.outputs.opencode == 'true'
@@ -346,6 +382,13 @@ jobs:
           python -m pytest -q tests/test_opencode_rust_coverage_toolchain_contract.py
           python -m compileall -q tests/test_opencode_rust_coverage_toolchain_contract.py
 
+      - name: Verify JavaScript materializer documentation contract
+        if: steps.affected_suites.outputs.opencode == 'true'
+        run: |
+          set -euo pipefail
+          python -m pytest -q tests/test_javascript_materializer_docstrings.py
+          python -m compileall -q scripts/ci/materialize_base_javascript_packages.py tests/test_javascript_materializer_docstrings.py
+
       - name: Verify exact-head path policy and syntax
         if: steps.affected_suites.outputs.strix == 'true'
         env:
@@ -357,13 +400,16 @@ jobs:
           python -m pytest -q \
             tests/test_docs_only_pr_runner_admission.py \
             tests/test_strix_changed_path_policy.py \
+            tests/test_strix_evidence_binding.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \
             tests/test_strix_quality_timeout_fixture_budget.py
           bash scripts/ci/test_strix_quick_gate.sh
           python -m compileall -q \
+            scripts/ci/strix_evidence_binding.py \
             tests/test_strix_changed_path_policy.py \
+            tests/test_strix_evidence_binding.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \
@@ -425,7 +471,8 @@ jobs:
         run: |
           python -m coverage run \
             --branch \
-            -m pytest --import-mode=importlib tests/test_organization_commercial_readiness_loop*.py -q
+            -m pytest --import-mode=importlib \
+            tests/test_organization_commercial_readiness_loop*.py -q
           python -m coverage report \
             --include='scripts/ci/organization_commercial_readiness_loop.py' \
             --show-missing \