chore: refresh org SBOM inventory

.github/actions/noema-review/two_phase.py

@@ -167,16 +167,20 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     changed_files = gate.fetch_changed_files(repo, number)
     changed_paths = tuple(file_path for file_path, _status in changed_files)
     review_context = gate.build_review_context(repo, number, pull_request, changed_files)
-    verdict = gate.call_llm(
-        repo,
-        number,
-        pull_request,
-        diff,
-        truncated,
-        expected,
-        review_context,
-        changed_paths,
-    )
+    try:
+        verdict = gate.call_llm(
+            repo,
+            number,
+            pull_request,
+            diff,
+            truncated,
+            expected,
+            review_context,
+            changed_paths,
+        )
+    except gate.NoemaTransportError as exc:
+        _emit_transport_capacity_outputs(exc, expected_head=expected)
+        raise
 
     _write_envelope(
         path,
@@ -196,6 +200,45 @@ def prepare_verdict(repo: str, number: int, expected_head: str, path: Path) -> i
     return 0
 
 
+def _emit_transport_capacity_outputs(
+    exc: gate.NoemaTransportError,
+    *,
+    expected_head: str,
+) -> None:
+    """Publish typed capacity evidence for the workflow's bounded re-dispatch step."""
+    retry_attempt = gate.current_transport_retry_attempt()
+    delay = gate.transport_redispatch_delay_seconds(
+        transport_retry_attempt=retry_attempt,
+        head_sha=expected_head,
+        retry_after_seconds=exc.retry_after_seconds,
+    )
+    eligible = bool(exc.capacity_unavailable and delay is not None)
+    outputs = {
+        "transport_capacity_unavailable": "true" if exc.capacity_unavailable else "false",
+        "transport_retry_eligible": "true" if eligible else "false",
+        "prepared": "false",
+    }
+    if type(exc.http_status) is int:
+        outputs["transport_http_status"] = str(exc.http_status)
+    if type(exc.provider_attempt_count) is int:
+        outputs["provider_attempt_count"] = str(exc.provider_attempt_count)
+    if delay is not None:
+        outputs["transport_retry_delay_seconds"] = str(delay)
+        outputs["transport_retry_next_attempt"] = str(retry_attempt + 1)
+    gate.append_github_output(outputs)
+    if eligible:
+        print(
+            "::notice::Noema provider capacity unavailable after gateway failover; "
+            f"bounded continuation re-dispatch is eligible in {delay}s "
+            f"(attempt {retry_attempt + 1}/{gate.MAX_TRANSPORT_REDISPATCH_ATTEMPTS})."
+        )
+    elif exc.capacity_unavailable:
+        print(
+            "::error::Noema provider capacity unavailable after gateway failover; "
+            "automatic re-dispatch budget is exhausted. Review remains required."
+        )
+
+
 def publish_verdict(repo: str, number: int, expected_head: str, path: Path) -> int:
     """Publish a prepared verdict only with fresh exact-head/base reviewer authority."""
     expected = _canonical_head(expected_head)

.github/actions/orchestrator-free-sidecar/action.yml

@@ -6,9 +6,9 @@ inputs:
     required: false
     default: "false"
   catalog_limit:
-    description: Maximum discovered route catalog size for the sidecar preflight.
+    description: Maximum discovered route catalog size for the sidecar preflight (a candidate list probed lazily to a readiness target, ADR-0029).
     required: false
-    default: "12"
+    default: "24"
   catalog_account_cap:
     description: Maximum routes admitted from one credential account.
     required: false
@@ -23,9 +23,16 @@ runs:
         ref: ${{ github.action_ref }}
         path: ${{ runner.temp }}/cwl-control-plane
         persist-credentials: false
+    - name: Set up lock-compatible sidecar Python
+      id: sidecar_python
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      with:
+        python-version: "3.12"
+        update-environment: false
     - name: Provision contextual-orchestrator orchestrator/free
       shell: bash --noprofile --norc -e -o pipefail {0}
       env:
+        SIDECAR_PYTHON: ${{ steps.sidecar_python.outputs.python-path }}
         CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR: ${{ inputs.require_zdr }}
         ORCHESTRATOR_CATALOG_LIMIT: ${{ inputs.catalog_limit }}
         ORCHESTRATOR_CATALOG_ACCOUNT_CAP: ${{ inputs.catalog_account_cap }}

.github/workflows/actions-queue-health.yml

@@ -0,0 +1,55 @@
+name: GitHub Actions queue health
+
+on:
+  schedule:
+    - cron: "7 * * * *"
+
+concurrency:
+  group: github-actions-queue-health
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  collect:
+    name: Collect exact-head queue evidence
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout trusted queue-health source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Collect read-only repository and runner evidence
+        env:
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}
+        run: |
+          if [ -z "${GH_TOKEN:-}" ]; then
+            echo "::error::PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN is required for cross-repository queue reads."
+            exit 1
+          fi
+          echo "::add-mask::$GH_TOKEN"
+          python3 scripts/ci/actions_queue_health.py \
+            --allowlist config/actions_queue_health_repositories.json \
+            --output-json "$RUNNER_TEMP/actions-queue-health.json" \
+            --output-html "$RUNNER_TEMP/actions-queue-health.html"
+
+      - name: Upload queue-health evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: github-actions-queue-health-${{ github.run_id }}
+          path: |
+            ${{ runner.temp }}/actions-queue-health.json
+            ${{ runner.temp }}/actions-queue-health.html
+          if-no-files-found: error

.github/workflows/agent-mention-noema-dispatch.yml

@@ -8,16 +8,27 @@ on:
   repository_dispatch:
     types: [agent-mention-noema]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-noema-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
-    runs-on: ubuntu-24.04
+    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-opencode-dispatch.yml

@@ -8,16 +8,27 @@ on:
   repository_dispatch:
     types: [agent-mention-opencode]
 
+concurrency:
+  # Workflow-level admission, for the same reason strix.yml, noema-review.yml,
+  # opencode-review.yml and opencode-review-dispatch.yml carry theirs at this level:
+  # a job-level group is never evaluated while the whole run waits behind the
+  # organization job ceiling, so a superseded mention keeps its queue slot until a
+  # runner frees up and only then cancels. At workflow level the older run is
+  # coalesced while both are still queued, which is where the slot is actually held.
+  # This workflow has a single job, so the group lives here and nowhere else --
+  # every workflow in this repository that carries a group at both levels
+  # (strix.yml, opencode-review-dispatch.yml) gives the two levels DIFFERENT names,
+  # because a job requesting the group its own run already holds would wait on itself.
+  group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   validate-and-forward:
     if: github.repository == 'ContextualWisdomLab/.github'
-    concurrency:
-      group: agent-mention-opencode-${{ github.event.client_payload.target_repository }}-${{ github.event.client_payload.pr_number || github.run_id }}
-      cancel-in-progress: true
-    runs-on: ubuntu-24.04
+    runs-on: ${{ github.repository == 'ContextualWisdomLab/.github' && endsWith(github.workflow_ref, '@refs/heads/main') && fromJSON('{"group":"CWL MCP remediation","labels":["self-hosted","linux","x64"]}') || fromJSON('["ubuntu-24.04"]') }}
     timeout-minutes: 5
     permissions:
       actions: read

.github/workflows/agent-mention-router.yml

@@ -29,7 +29,9 @@ jobs:
     concurrency:
       group: review-agent-mention-router-local-${{ github.repository }}-${{ github.event.issue.number || github.run_id }}
       cancel-in-progress: true
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 5
     permissions:
       actions: read
@@ -74,7 +76,9 @@ jobs:
     concurrency:
       group: review-agent-mention-router-sweep-${{ github.repository }}
       cancel-in-progress: false
-    runs-on: ubuntu-24.04
+    runs-on:
+      group: CWL central control
+      labels: [self-hosted, linux, x64]
     timeout-minutes: 15
     permissions:
       actions: read