fix(noema): replace conflicted OIDC envelope repair

[seonghobae]

Replacement purpose

Rebuild the Noema OIDC response-envelope repair from exact protected main 1131b1bbafb24e455fc8619cdf316813e8721861 because predecessor PR #820 is conflicted and no longer descends from current protected main. Preserve #820 and its development history unchanged until this replacement proves the same bounded contract.

No checks, reviews, approvals, comments, or synthetic merge evidence from #820 transfer to this replacement.

Test-first evidence

• Exact RED head: ad362b633031d85aa5af0c8b502a583a77f7795a.
• The RED head added only tests/test_noema_oidc_exchange_contract.py; inherited noema-review.yml still read the nonexistent top-level .token.
• Production repair head 35b3c20633073a384d681b062120bc8994c75ca6 implemented the stable envelope contract without changing reviewer authority.
• Doctoring head 6fc96a7ce37d649f2843768c66826ec30e15e109 recorded the failure model, rollback, interoperability boundary, and APA 7 primary references.
• Current exact head: 12f52c50fc1d6aa83278e01ba3d1c28760982999, adding only the authoritative [Unreleased] changelog evidence after the production repair.

Any workflow, review, approval, or status from an earlier head is historical only.

Bounded repair

• require Noema's stable ok: true + object-valued data success envelope;
• require non-empty data.token, exact target repository identity, non-empty workflow-source metadata, and non-empty expiry metadata;
• extract only .data.token after the complete envelope validates;
• mask the token immediately and never echo the raw response;
• preserve GitHub App/PAT fallbacks, reviewer identities, credentials, model routing, NVIDIA NIM behavior, permissions, branch protection, merge authority, release authority, and deployment authority;
• document RFC 8259 and NIST SSDF evidence in docs/doctoring/noema-oidc-exchange-envelope.md and record the repair under CHANGELOG.md.

Current gate state

Exact-head workflows and review surfaces are authoritative only for 12f52c50fc1d6aa83278e01ba3d1c28760982999. Queued, pending, cancelled, skipped-required, absent, failed, predecessor-head, stale-base, status-only, author-only, or synthetic-merge evidence is not acceptance.

Keep Draft until the exact final head passes focused and complete central tests, 100% production statement/branch/public-docstring gates, all required security and supply-chain workflows, exact-head automated review, zero unresolved valid findings, qualifying independent non-author approval, and branch protection without bypass.

Supersession boundary

Do not close predecessor #820 merely because this replacement exists. Close #820 as superseded only after this replacement demonstrates successful exact-current-head validation and retains the same bounded four-file effective repair from current protected main; no #820 evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ad30330e-ef29-42fc-a07a-ff2e7f15b720

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Reconcile this replacement Noema OIDC-envelope repair onto current protected main without rewriting history. Exact PR head is 12f52c50fc1d6aa83278e01ba3d1c28760982999; current protected main tip is 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. The exact noema-review.yml blob is b85e53c4919497b8eb255ad003df35ce33b4be60 on the PR head and 59b25e343444d0b97fc1c7ba33cb15543dd70102 on current main. Do not write if any of those identities has moved.

Use a trusted checkout and normally merge exact protected main into this existing replacement branch. Resolve conflicts only by preserving every newer protected-main behavior plus this four-file bounded contract:

• accept Noema OIDC exchange only when the response is a valid ok: true object with object-valued data, non-empty data.token, exact target repository identity, non-empty workflow-source metadata, and non-empty expiry metadata;
• extract only .data.token after the complete envelope validates, mask it immediately, and never emit the raw response;
• preserve GitHub App/PAT fallbacks, reviewer identities, reviewer credential names/scopes, model/NVIDIA NIM routing, permissions, merge/release authority, branch protection, and all current-main security boundaries.

Do not force-push, use -X ours/-X theirs, create temporary/self-modifying/write-capable workflows, or close predecessor #820 until this replacement proves the same effective repair on the current base. After reconciliation rerun the focused Noema envelope contract, complete central suite and Strix quick gate, exact 100% production statement/branch/public-docstring gates, and all current-head security/supply-chain checks. Keep Draft until automated review and qualifying independent approval are current and clean; do not merge or synthesize approval.

[seonghobae]

Current-main replacement is now PR #834 at exact head 97276da73c3b5d7312ce01eb88f8260ff75f3930, rebuilt directly from protected main 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba after comparing the stale base to current main and confirming intervening changes were unrelated to noema-review.yml except the shared changelog. Treat this #822 branch as read-only historical provenance while #834 validates. No check, review, approval, or synthetic-merge evidence transfers. Close #822 as superseded only after #834 proves its own exact-head gates and bounded four-file equivalence.