chore: refresh org SBOM inventory

.Jules/palette.md

@@ -1,3 +1,5 @@
-## 2024-05-20 - Repository without UI Codebase
-**Learning:** This repository is a GitHub organization profile consisting entirely of Markdown documentation and static assets, and does not contain an active UI or frontend application codebase.
-**Action:** Since there is no UI, no UX enhancements can be applied. Aborting UX enhancements and PR creation as per instructions.
+## 2026-09-29 - Product UI boundary confirmed
+
+**Learning:** This repository owns the ContextualWisdomLab GitHub Actions control plane, including production CI scripts, tests, workflows, and documentation. It does not own an interactive product UI or frontend application.
+
+**Action:** Do not invent product UI work in this repository. Improve the control-plane artifacts here and route reusable product UI work to its canonical product owner.

.github/actionlint.yaml

@@ -0,0 +1,8 @@
+# Source validation only; labels do not attest runtime isolation.
+self-hosted-runner:
+  labels:
+    - cwlab-ci-isolated
+    - cwlab-control
+    - cwl-hostile-workload
+    - selinux
+    - k-csap-isolated

.github/actions/noema-review/two_phase.py

@@ -156,6 +156,7 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
         return 0
     expected_base = _canonical_base(pull_request)
     actor = _reviewer_actor()
+    author = gate.require_distinct_pr_author(pull_request, actor)
     if pull_request.get("isDraft"):
         print("PR is draft; Noema verdict preparation skipped.")
         return 0
@@ -167,16 +168,20 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     changed_files = gate.fetch_changed_files(repo, number)
     changed_paths = tuple(file_path for file_path, _status in changed_files)
     review_context = gate.build_review_context(repo, number, pull_request, changed_files)
-    verdict = gate.call_llm(
-        repo,
-        number,
-        pull_request,
-        diff,
-        truncated,
-        expected,
-        review_context,
-        changed_paths,
-    )
+    try:
+        verdict = gate.call_llm(
+            repo,
+            number,
+            pull_request,
+            diff,
+            truncated,
+            expected,
+            review_context,
+            changed_paths,
+        )
+    except gate.NoemaTransportError as exc:
+        _emit_transport_capacity_outputs(exc, expected_head=expected)
+        raise
 
     _write_envelope(
         path,
@@ -186,6 +191,8 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number": number,
             "expected_head": expected,
             "expected_base": expected_base,
+            "reviewer_actor": actor,
+            "pull_request_author": author,
             "verdict": verdict,
         },
     )
@@ -196,6 +203,45 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     return 0
 
 
+def _emit_transport_capacity_outputs(
+    exc: gate.NoemaTransportError,
+    *,
+    expected_head: str,
+) -> None:
+    """Publish typed capacity evidence for the workflow's bounded re-dispatch step."""
+    retry_attempt = gate.current_transport_retry_attempt()
+    delay = gate.transport_redispatch_delay_seconds(
+        transport_retry_attempt=retry_attempt,
+        head_sha=expected_head,
+        retry_after_seconds=exc.retry_after_seconds,
+    )
+    eligible = bool(exc.capacity_unavailable and delay is not None)
+    outputs = {
+        "transport_capacity_unavailable": "true" if exc.capacity_unavailable else "false",
+        "transport_retry_eligible": "true" if eligible else "false",
+        "prepared": "false",
+    }
+    if type(exc.http_status) is int:
+        outputs["transport_http_status"] = str(exc.http_status)
+    if type(exc.provider_attempt_count) is int:
+        outputs["provider_attempt_count"] = str(exc.provider_attempt_count)
+    if delay is not None:
+        outputs["transport_retry_delay_seconds"] = str(delay)
+        outputs["transport_retry_next_attempt"] = str(retry_attempt + 1)
+    gate.append_github_output(outputs)
+    if eligible:
+        print(
+            "::notice::Noema provider capacity unavailable after gateway failover; "
+            f"bounded continuation re-dispatch is eligible in {delay}s "
+            f"(attempt {retry_attempt + 1}/{gate.MAX_TRANSPORT_REDISPATCH_ATTEMPTS})."
+        )
+    elif exc.capacity_unavailable:
+        print(
+            "::error::Noema provider capacity unavailable after gateway failover; "
+            "automatic re-dispatch budget is exhausted. Review remains required."
+        )
+
+
 def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> int:
     """Publish a prepared verdict only with fresh exact-head/base reviewer authority."""
     expected = _canonical_head(expected_head)
@@ -207,6 +253,8 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             "pull_request_number",
             "expected_head",
             "expected_base",
+            "reviewer_actor",
+            "pull_request_author",
             "verdict",
         }
         if set(payload) != required_keys:
@@ -234,6 +282,14 @@ def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
             print("Pull request base advanced after model review; stale prepared verdict was not published.")
             return 0
         actor = _reviewer_actor(allow_refreshed_app=True)
+        author = gate.require_distinct_pr_author(current_pull_request, actor)
+        if payload["pull_request_author"] != author:
+            raise RuntimeError("Noema pull request author changed after verdict preparation")
+        reviewer_actor = payload["reviewer_actor"]
+        if not isinstance(reviewer_actor, str) or not reviewer_actor.strip():
+            raise RuntimeError("Noema prepared reviewer actor is invalid")
+        if reviewer_actor.strip().casefold() != actor.strip().casefold():
+            raise RuntimeError("Noema refreshed reviewer actor differs from verdict preparation")
         if current_pull_request.get("isDraft"):
             print("PR became draft after model review; prepared verdict was not published.")
             return 0

.github/actions/orchestrator-free-sidecar/action.yml

@@ -6,9 +6,9 @@ inputs:
     required: false
     default: "false"
   catalog_limit:
-    description: Maximum discovered route catalog size for the sidecar preflight.
+    description: Maximum discovered route catalog size for the sidecar preflight (a candidate list probed lazily to a readiness target, ADR-0029).
     required: false
-    default: "12"
+    default: "24"
   catalog_account_cap:
     description: Maximum routes admitted from one credential account.
     required: false
@@ -23,9 +23,16 @@ runs:
         ref: ${{ github.action_ref }}
         path: ${{ runner.temp }}/cwl-control-plane
         persist-credentials: false
+    - name: Set up lock-compatible sidecar Python
+      id: sidecar_python
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      with:
+        python-version: "3.12"
+        update-environment: false
     - name: Provision contextual-orchestrator orchestrator/free
       shell: bash --noprofile --norc -e -o pipefail {0}
       env:
+        SIDECAR_PYTHON: ${{ steps.sidecar_python.outputs.python-path }}
         CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR: ${{ inputs.require_zdr }}
         ORCHESTRATOR_CATALOG_LIMIT: ${{ inputs.catalog_limit }}
         ORCHESTRATOR_CATALOG_ACCOUNT_CAP: ${{ inputs.catalog_account_cap }}

.github/runner-images/law-ai-agent/Dockerfile

@@ -0,0 +1,8 @@
+FROM ghcr.io/actions/actions-runner@sha256:e5496277be5d09bc968b3d64911b74e219ac4a3f2edce956a3ecf9271bea1ef4
+USER root
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends postgresql-16 postgresql-client-16 libpq-dev python3-venv ca-certificates git curl \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+USER runner
+WORKDIR /home/runner

.github/workflows/actions-queue-health.yml

@@ -0,0 +1,57 @@
+name: GitHub Actions queue health
+
+on:
+  schedule:
+    - cron: "7 * * * *"
+
+concurrency:
+  group: github-actions-queue-health
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  collect:
+    name: Collect exact-head queue evidence
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && github.ref == 'refs/heads/main' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout trusted queue-health source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Collect read-only repository and runner evidence
+        env:
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}
+        run: |
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN is required for cross-repository queue reads."
+            exit 1
+          fi
+          echo "::add-mask::$GH_TOKEN"
+          python3 scripts/ci/actions_queue_health.py \
+            --allowlist config/actions_queue_health_repositories.json \
+            --output-json "$RUNNER_TEMP/actions-queue-health.json" \
+            --output-html "$RUNNER_TEMP/actions-queue-health.html"
+
+      - name: Upload queue-health evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: github-actions-queue-health-${{ github.run_id }}
+          path: |
+            ${{ runner.temp }}/actions-queue-health.json
+            ${{ runner.temp }}/actions-queue-health.html
+          if-no-files-found: error

.github/workflows/agent-mention-noema-dispatch.yml

@@ -8,16 +8,29 @@ on:
   repository_dispatch:
     types: [agent-mention-noema]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -8,16 +8,29 @@ on:
   repository_dispatch:
     types: [agent-mention-opencode]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).group }}
+      labels: ${{ (github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('{"group":"CWL CI isolated","labels":["self-hosted","linux","x64","cwlab-ci-isolated"]}')).labels }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-router-quality-ci.yml

@@ -13,7 +13,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
   push:
     branches: [main]
     paths:
@@ -26,7 +29,10 @@ on:
       - "scripts/ci/agent_mention_sweep.py"
       - "tests/test_agent_mention_*.py"
       - "tests/test_pr_review_fix_scheduler_coverage.py"
+      - "requirements-opencode-review-ci.txt"
+      - "requirements-noema-document-ci.txt"
       - "requirements-opencode-review-ci-hashes.txt"
+      - "scripts/ci/compile_opencode_review_lock.sh"
 
 concurrency:
   group: agent-mention-router-quality-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
@@ -40,7 +46,9 @@ env:
 
 jobs:
   quality:
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL CI isolated
+      labels: [self-hosted, linux, x64, cwlab-ci-isolated]
     timeout-minutes: 20
     steps:
       - name: Harden runner

.github/workflows/agent-mention-router.yml

@@ -29,7 +29,9 @@ jobs:
     concurrency:
       group: review-agent-mention-router-local-${{ github.repository }}-${{ github.event.issue.number || github.run_id }}
       cancel-in-progress: true
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 5
     permissions:
       actions: read
@@ -74,7 +76,9 @@ jobs:
     concurrency:
       group: review-agent-mention-router-sweep-${{ github.repository }}
       cancel-in-progress: false
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 15
     permissions:
       actions: read