Skip to content

Route remaining LLM jobs through contextual-orchestrator - #403

Merged
seonghobae merged 62 commits into
mainfrom
cursor/orchestrator-llm-gateway-c28f
Aug 17, 2026
Merged

Route remaining LLM jobs through contextual-orchestrator#403
seonghobae merged 62 commits into
mainfrom
cursor/orchestrator-llm-gateway-c28f

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

Noema routes remaining model-backed jobs through one bounded contextual-orchestrator gateway contract rather than provider/model fallback lists in this repository.

Current exact state

  • branch: cursor/orchestrator-llm-gateway-c28f
  • exact head: 85626a736a9b7a6691ff505ed5bbbae631b6fe19
  • independently resolved protected/live base: 8fa25716df43d915aaa1ce3c7a0470d765cf50ca
  • exact ancestry: head is 62 commits ahead / 0 behind current protected main; merge base equals current protected main.
  • Draft remains intentional.
  • exact-head application CI 32024140060: queued / non-passing until terminal success.
  • exact-head reviewer-ci 32024140064: queued / non-passing until terminal success.
  • exact-head central Security Scan 32024140096: queued / non-passing until terminal success.
  • unresolved review threads: 0 at this exact head.

Predecessor-head success does not transfer to this head. Mergeability alone is not merge readiness.

What this PR changes

  • Defines one HTTPS /v1 contextual-orchestrator gateway and /healthz identity boundary.
  • Rejects direct provider hosts, credentials/query/fragment URL material, sequential model-candidate routing, and hostnames that canonicalize to the empty string.
  • Keeps provider selection and provider credentials outside Noema.
  • Keeps preflight secret-free: only non-secret gateway URL/model configuration is read before the credential-consuming model step.
  • Routes Noema model-backed consumers through the shared gateway contract.
  • Adds bounded/fail-closed health-response handling and acquisition data-room evidence for the gateway contract.
  • Measures the gateway verifier/library/catalog in the repository's exact 100% owned-production coverage gate.

Exact application-CI RCA and repairs

The predecessor exact head c8b18ffbfb55343d59947a23960fbff5bc6ad920 failed application CI 32020525532 because parseOrchestratorGatewayUrl("https://./v1") did not reject a hostname that became empty after trailing-dot canonicalization. The existing regression test/orchestrator-gateway-trailing-dot-host.test.ts was already RED on that exact head.

Commit c419f18029e44746094b4c4917ae97a4e8890728 applies the smallest production fix: after lowercasing and removing trailing dots, an empty canonical hostname now fails with the existing absolute-HTTPS-URL error contract. On that head all 1,895 tests passed, including the formerly failing trailing-dot-host regression, but the global 100% coverage gate remained RED at 99.97% statements/lines and 99.96% branches. Exact coverage output isolated the only uncovered production line to scripts/lib/orchestrator-gateway.mjs:375, the oversized arrayBuffer() fallback boundary.

Commit 85626a736a9b7a6691ff505ed5bbbae631b6fe19 adds a realistic non-streaming response regression with no trusted Content-Length: a 65,537-byte fallback body must fail closed after one materialization. This covers the exact residual branch without lowering thresholds or adding V8 exclusions.

The latest exact-head CI/reviewer/Security runs are still queued, so this is a GREEN candidate, not verified completion. If application CI remains red, inspect the exact new failure before any further source/test mutation.

Dependency boundary

ContextualWisdomLab/contextual-orchestrator remains a read-only source dependency to this Noema writer. This PR consumes its published gateway identity/routing contract without moving provider-selection authority or provider credentials into Noema.

Merge boundary

Do not mark Ready or merge until the unchanged exact head has terminal-success application CI plus every applicable live central Security/review/governance gate and zero valid unresolved findings. No gate is weakened or bypassed.

Summary by CodeRabbit

  • 새 기능

    • LLM 작업을 단일 contextual-orchestrator 게이트웨이로 라우팅합니다.
    • 게이트웨이 계약, 상태 확인, 보안 설정 검증 및 OpenCode 연동을 추가했습니다.
    • 시간별 제품 개발 흐름이 단일 세션 기반으로 개선되었습니다.
  • 개선

    • CI가 최신 base 브랜치 기준으로 변경 사항과 잠금 파일을 검증합니다.
    • 직접 공급자 호출과 순차 모델 폴백을 차단합니다.
    • 게이트웨이 장애나 필수 설정 누락 시 안전하게 실행을 중단합니다.
  • 문서

    • 게이트웨이 운영, 소비자 계약, 제품 개발 및 검토 절차 문서를 업데이트했습니다.

Point hourly product development at the same gateway contract as
review and remove sequential NIM model-candidate failover from Noema.
Provider keys stay in the orchestrator KV.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
@coderabbitai

coderabbitai Bot commented Aug 16, 2026

Copy link
Copy Markdown

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8267b632-b0ff-483e-957c-91b87bef522c

📥 Commits

Reviewing files that changed from the base of the PR and between 8fa2571 and 85626a7.

📒 Files selected for processing (47)
  • .github/workflows/central-review.yml
  • .github/workflows/ci.yml
  • .github/workflows/hourly-product-development.yml
  • AGENTS.md
  • CHANGELOG.md
  • CLAUDE.md
  • README.md
  • contracts/orchestrator-gateway.json
  • docs/buyer-due-diligence-index.md
  • docs/contextual-orchestrator-reviewer-cutover.md
  • docs/doctoring/atomic-product-publisher-lease.md
  • docs/doctoring/hourly-nim-opencode-development.md
  • docs/doctoring/hourly-product-development-prerequisites.md
  • docs/library-boundary-decision.md
  • docs/operations/hourly-product-development-prerequisites.md
  • docs/operations/hourly-product-development.md
  • docs/orchestrator-gateway-consumer-contract.md
  • reviewer/README.md
  • reviewer/noema_reviewer/config.py
  • reviewer/tests/test_central_review_workflow.py
  • reviewer/tests/test_config.py
  • scripts/acquisition-data-room-integrity-audit.mjs
  • scripts/acquisition-data-room-manifest-secure.mjs
  • scripts/lib/acquisition-data-room-catalog.mjs
  • scripts/lib/orchestrator-gateway.mjs
  • scripts/verify-orchestrator-gateway.mjs
  • test/acquisition-data-room-catalog.test.ts
  • test/ci-exact-head-contract.test.ts
  • test/helpers/hourly-workflow.ts
  • test/hourly-product-development-final-candidate-cleanup.test.ts
  • test/hourly-product-development-nim-shell-isolation.test.ts
  • test/hourly-product-development-publication-prerequisite.test.ts
  • test/hourly-product-development-workflow.test.ts
  • test/orchestrator-gateway-acquisition-catalog.test.ts
  • test/orchestrator-gateway-body-timeout.test.ts
  • test/orchestrator-gateway-bounded-healthz.test.ts
  • test/orchestrator-gateway-contract.test.ts
  • test/orchestrator-gateway-json-integrity.test.ts
  • test/orchestrator-gateway-process-cli-stdio.test.ts
  • test/orchestrator-gateway-residual-coverage.test.ts
  • test/orchestrator-gateway-routing-alias.test.ts
  • test/orchestrator-gateway-secret-source.test.ts
  • test/orchestrator-gateway-stream-bound.test.ts
  • test/orchestrator-gateway-trailing-dot-host.test.ts
  • test/package-manager-reproducibility.test.ts
  • test/package-manager-review-contract.test.ts
  • vitest.config.ts

📝 Walkthrough

Walkthrough

Noema의 리뷰 및 시간별 제품 개발 흐름을 contextual-orchestrator 게이트웨이로 전환했습니다. 게이트웨이 계약과 검증 CLI를 추가하고, 모델 fallback을 제거했습니다. CI는 live base SHA를 사용하며, 게이트웨이 증빙을 데이터룸 카탈로그에 등록합니다.

Changes

게이트웨이 계약과 검증

Layer / File(s) Summary
게이트웨이 계약 및 검증 구현
contracts/orchestrator-gateway.json, scripts/lib/orchestrator-gateway.mjs, scripts/verify-orchestrator-gateway.mjs
HTTPS /v1 URL, 단일 routing alias, 전용 API 키, provider 제한, /healthz 검증, OpenCode 설정 생성을 추가했습니다.
검증 경계 테스트
test/orchestrator-gateway-*.test.ts, vitest.config.ts
URL, 모델, secret source, 응답 크기, UTF-8, 중복 JSON 키, timeout, CLI 표준 입출력과 fail-closed 동작을 검증합니다.

리뷰어와 시간별 실행 흐름

Layer / File(s) Summary
리뷰어 단일 모델 구성
reviewer/noema_reviewer/config.py, reviewer/tests/*, reviewer/README.md
내부 fallback 설정과 FallbackModel을 제거하고 단일 OpenAIChatModel 및 contextual-orchestrator routing alias를 사용합니다.
시간별 제품 개발 워크플로
.github/workflows/central-review.yml, .github/workflows/hourly-product-development.yml, test/hourly-*
게이트웨이 사전 검증 후 단일 OpenCode 세션을 실행합니다. API 키는 실행 단계에만 전달합니다.
운영 계약과 문서
AGENTS.md, README.md, docs/*, CHANGELOG.md, CLAUDE.md
Noema와 naruon의 게이트웨이 소비자 계약, provider key 저장 위치, 운영 절차와 전환 내용을 갱신했습니다.

CI base 검증

Layer / File(s) Summary
Live base SHA 고정
.github/workflows/ci.yml, test/ci-exact-head-contract.test.ts, test/package-manager-*.test.ts
현재 원격 base가 PR head의 조상인지 확인하고 NOEMA_LIVE_BASE_SHA를 사용해 lockfile과 base drift를 검증합니다.

데이터룸 증빙

Layer / File(s) Summary
게이트웨이 계약 카탈로그 등록
scripts/lib/acquisition-data-room-catalog.mjs, scripts/acquisition-data-room-*.mjs, test/*acquisition-data-room*, docs/buyer-due-diligence-index.md
게이트웨이 계약과 소비자 문서를 불변 product 항목으로 추가하고 감사·매니페스트 경로에 전달합니다.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant VerifyCLI
  participant Gateway
  participant OpenCode
  Workflow->>VerifyCLI: 게이트웨이 URL과 모델 검증
  VerifyCLI->>Gateway: 인증 없는 /healthz 요청
  Gateway-->>VerifyCLI: 서비스 식별 응답
  VerifyCLI->>OpenCode: 단일 gateway 설정 기록
  Workflow->>OpenCode: 전용 API 키로 세션 실행
Loading

Possibly related PRs

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/orchestrator-llm-gateway-c28f

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Point leftover reviewer FallbackModel settings at a fail-closed error and
cover the shared orchestrator gateway CLI entry so Noema no longer tries
the next model itself.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
@cursor cursor Bot changed the title Route remaining Noema LLM jobs through contextual-orchestrator Route remaining LLM jobs through contextual-orchestrator Aug 16, 2026
cursoragent and others added 26 commits August 16, 2026 16:52
Keep the orchestrator gateway contract at 100% coverage after the
entrypoint extraction.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
The decorator was sitting on the complete-bundle test and broke collection.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Expose the secret-free gateway contract so ContextualWisdomLab/naruon can
run Noema as a judgments-and-decisions agent without copying OpenCode or
provider keys. naruon wiring stays a separate repository PR.

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Preserve the protected-main workflow-registry disablement implementation and coverage while retaining the orchestrator gateway cutover; merge coverage ownership without dropping either production script.
@seonghobae seonghobae closed this Aug 17, 2026
@seonghobae seonghobae reopened this Aug 17, 2026
@seonghobae
seonghobae marked this pull request as ready for review August 17, 2026 11:21
@cursor

cursor Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@seonghobae
seonghobae merged commit 29a64e1 into main Aug 17, 2026
15 of 16 checks passed
@seonghobae
seonghobae deleted the cursor/orchestrator-llm-gateway-c28f branch August 17, 2026 11:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants