Private-target review pool is three OpenRouter free ZDR routes; a single 429 burst fails every review closed

[seonghobae]

Observed

After #2146 (ZDR feed keyed by model_id) reached main (64f483db9d052322c65bcdf1675d66138156f306), the private consumer ContextualWisdomLab/late-life-anxiety-reanalysis PR #10 (head a1cd5bc6783c6510dfcf937f523c733366e82213) was reopened. noema-review run 34738383583 / job 103673946748 (2026-09-13 04:50 UTC) now gets past catalog admission and fails at preflight instead. Artifact noema-sidecar-evidence 10311872313, contextual-orchestrator-preflight.json:

candidate_count: 3, probed_count: 3, rejected_count: 3, ready_count: 0, target_ready: 8, account_skip_after_429: 2
openrouter inclusionai/ling-3.0-flash-fin:free   rejected HTTPError 429 attempts=1
openrouter inclusionai/ling-3.0-flash-sante:free rejected HTTPError 429 attempts=1
openrouter inclusionai/ling-3.0-flash-vl:free    rejected HTTPError 429 attempts=1

Sanitized stderr also shows provider_discovery_failed provider=bytez code=http_status_500 (pre-existing, #1915). strix run 34738383616 fails the same way.

Why this is a pool/contract gap, not the #2146 defect

With CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR=true (every private/internal target per ADR-0003), the only routes that can ever be attested are OpenRouter feed entries that are also free. Today's feed intersected with discovery yields exactly these three Novita-served :free models, all on the single OPENROUTER_API_KEY account. nvidia_nim/nvidia_nim_sub are affirmatively not ZDR; bytez is unattested. One 429 burst on OpenRouter's free tier therefore rejects every candidate, account_skip_after_429 retires the only account, and the run fails closed with no retry, so private repositories effectively cannot get a hosted review even though the policy path is now correct.

Next action (owner: central review sidecar / launcher; CO for provider adds)

1. Decide whether the launcher preflight may honor OpenRouter's Retry-After / rate-limit reset on 429 when the remaining candidate set is a single account (a provider-stated wait, not an arbitrary retry budget), and measure the runner-time cost against the current queue saturation (ops: diagnose and bound organization GitHub Actions queue starvation #712, Actions queue saturation: 120 open PRs + self-amplifying scheduler block all org merges (pg-erd-cloud: 0 merges since 2026-08-20) #1531). Deliverable: ADR-0003 amendment + RED/GREEN preflight test with a controllable 429→200 double.
2. Widen the attested ZDR free pool: track Integrate Experiential Labs KV source into canonical review bootstrap #2119 (Experiential Labs, needs endpoint-specific attestation) and the CO pin advance chore(ci): advance the vendored orchestrator pin to 012beaac and guard unattested providers #2137 (fix(discovery): recover usable Bytez chat models), and re-census the feed∩discovery set after each.
3. Until 1 or 2 lands, private consumer PRs need the operator infra-exception path documented in guideline §11 for the three sidecar reviews only; substantive gates (bootstrap, scan-pr-queue, CodeQL, SAST) now run on those heads.

Internal review date: 2026-09-15 (two days, because the manuscript PR is blocked on review capacity only). This date is a next-action deadline, not a fix promise.

Refs #2146, #2122, #2119, #2137, #1915, ContextualWisdomLab/late-life-anxiety-reanalysis#10.

[seonghobae]

Additional occurrence (public target, so not ZDR-gated but same 429 burst class): .github PR #2155 head 3452ed560, noema-review job 103714113314 (2026-09-13 ~11:10Z) — 12 HTTPError entries, 9 with http_status: 429, no verdict published. Recording here rather than opening a new issue; the run is left for the daily repair re-dispatch.

[seonghobae]

Fresh measurement, 2026-09-16..21, from the CO lead. Source: 89 noema-review runs with noema-sidecar-evidence artifacts across 8 org repos, read-only.

• 17 of 89 runs (19 %) failed at sidecar preflight (review sidecar preflight failed, ready_count: 0), before any review request reached the gateway.
• All 17 were private targets (late-life-anxiety-reanalysis 15, gyeot 2) with CONTEXTUAL_ORCHESTRATOR_REQUIRE_ZDR=true.
  • Every failing pool was OpenRouter-only, with 4–5 candidates (13 runs with 5, 4 runs with 4).
  • Every candidate was rejected with HTTP 429 (preflight_route_rejected provider=openrouter ... http_status=429).
• Example: late-life-anxiety-reanalysis PR 🛡️ Sentinel: [HIGH] 정보 노출 및 명령어 삽입 방지를 위한 보안 강화 #218 (head e2393877, a HWPX supplement PR). Job 106085557453 failed after 3 min with sidecar exited before healthz (status 1). Its bytez discovery also returned HTTP 500, so the pool had no other source.
• Because the failure happens in the provisioning step, it is outside the ADR-0031 bounded transport re-dispatch. The review never runs.
• Impact on the document lane: research document PRs (DOCX/HWPX) in private research repos currently stop here, so the binary-document review path (.github#2330, CO#1220) cannot be exercised until this is resolved. PR Update central workflow rollout ledger #236 (51/100 binary files) is still queued.

Remaining gap: the pool is still 4–5 OpenRouter free ZDR routes, and an all-429 preflight still ends the review. The issue is unassigned with no linked PR. I have asked the .github lead to assign an owner. Evidence is kept in the CO lead worktree under CO-LEAD-EVIDENCE-20260920/research-support-20260921/doc-review-path-failure-20260922/.

[seonghobae]

Option (a) is up as #2339 (head ccb3e93).

When a sidecar preflight fails with every probed route rejected or deferred on an integer HTTP 429, and none ready, it is now classified as provider capacity. It goes through ADR-0031's existing bounded re-dispatch: same attempt counter, same bound of 2, same delay function, and Retry-After is honored only when it is within [1, 300]. Any other preflight evidence keeps the plain failure. The job still fails and review remains required.

Not changed: ZDR policy, candidate pools, timeouts. Strix fails the same way and is a follow-up.