ci(cgc): stage central isolated self-hosted contract gates

[seonghobae]

Scope

Stage a CGC-specific reusable validation producer in the central .github repository. Fixed caller ContextualWisdomLab/context-graph-contracts; workflow_call only; isolated self-hosted group and labels with no hosted fallback. Preserve all five non-signing product gates from c2f9802e47c1722773f038a4c68be8d59bda6538, Python 3.11–3.14 matrix, exact action/uv pins and production 100% statement/branch coverage.

Private HOME/config/cache/environment, cleared inherited Python paths, guarded cleanup, installed Python/CLI -I, and a fail-closed required-result aggregate are included. Reusable concurrency is absent; the future caller owns concurrency. Protected-main signing remains separately admitted and product-owned.

Verified local scope

• Parent directly reran 35 focused tests, exit 0, and actionlint with an explicit custom-label catalog, exit 0; no ignore rules.
• Independent final reviewer APPROVE, source staging only, with matching before/after three-file hashes. It independently reran 35 tests, lifecycle controls and pipefail witnesses.
• Verdict SHA256: 178bb88c71472aea88b97f1a6ffd44f93b6a528319a3d97fcb3e8d91bff1dc7d.
• Repair worker recorded actual package/installed-wheel replay and product Python 3.14.7 gates: 794 passed, production 2168 statements / 660 branches at 100%. These are supporting local receipts, not remote execution.

Unresolved acceptance — no activation or bypass

• Full central suite: worker recorded 5190 passed, 9 failed / 4 skipped, with the same 9 reproduced on exact baseline. Central coverage is not cleared; focused tests do not supersede these failures.
• No product caller is activated. Caller must pin an actually published, reviewed producer revision; protected central availability, caller acceptance and actual runner admission remain separate.
• No runner/ACL/key/budget/protection changes, privileged pool borrowing, signing activation or merge bypass.
• Actual Linux matrix, Anchore SBOM, artifact transport, isolated runner execution and formal GitHub App review remain unverified.
• Independent reviewer noted documentation line 17 overstates upload eligibility: success() means successful preceding steps, not complete job success. Fresh diagnostic artifacts may survive a later failure; the required aggregate governs overall eligibility. This is a nonblocking wording correction, not a stale-artifact bypass.

Existing owner paths

Personal LiteLLM literal auto and independent Noema/OpenCode App publication: #2560. Global runner migration: #2565. Consumer admission: ContextualWisdomLab/linux-cluster-ops#326. This PR edits none of their shared model/relay/workflow paths. User is the sole maintainer; approval is conditional on substantive independent review, never author self-approval.

Related product stack: ContextualWisdomLab/context-graph-contracts#29 and ContextualWisdomLab/context-graph-contracts#30. This PR is source preparation, not completed migration, review activation, protected merge or release.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

중앙 전체 테스트 및 coverage 수리 게시: 현재 head af9f1da66e61ae540f29c31652c509c67eaf6529입니다. 통합 후보에서 실제 전체 실행은 5273 passed / 4 skipped / 40 subtests passed, exit 0입니다. 기존 설정과 측정 범위를 유지한 채 18211 statements 및 7490 branches 모두 100%로 통과했습니다. 변경은 테스트 파일 11개이며 production, workflow, model, routing, pyproject, OpenCode 설정은 변경하지 않았습니다. 독립 소스 리뷰 APPROVE binding SHA256: a9d2b12e70d68cd249de4050745ea52ea4f46c1dcf81b1b2c7b02157b57494bd. 커밋 전 새 파일의 마지막 빈 줄 1개만 제거했고 AST 동일성을 확인했습니다. 그 후 해당 모듈 36개 warning-fatal 테스트가 통과했습니다. 전체 실행은 이 EOF 정리 전 후보에 대한 로컬 증거이며, 새 head의 원격 CI 성공을 의미하지 않습니다. 원격 head readback은 일치합니다. 실제 self-hosted producer 실행, LiteLLM literal auto inference, 독립 App 승인 및 보호 대상 merge는 아직 미완입니다. skipped/Draft 리뷰는 승인으로 처리하지 않습니다.