fix(security): upgrade patch validator and bind gateway endpoints

.github/workflows/acquisition-readiness-scan.yml

@@ -26,15 +26,15 @@ jobs:
       - name: setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: verify package-manager toolchain
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
 
       - name: verify tracked acquisition source before evidence generation
         shell: bash

.github/workflows/cd.yml

@@ -64,15 +64,15 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: Verify deployment package-manager toolchain
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
 
       - name: Verify immutable release and exact source identity
         id: identity

.github/workflows/central-review.yml

@@ -491,6 +491,7 @@ jobs:
           PYTHONPATH: ${{ github.workspace }}/reviewer:${{ github.workspace }}/packages/noema-core/src
           NOEMA_REVIEW_TOKEN_SOURCE: noema-github-app
           NOEMA_LLM_API_URL: ${{ vars.NOEMA_LLM_API_URL }}
+          NOEMA_LLM_API_URL_ALLOWLIST_JSON: ${{ vars.NOEMA_LLM_API_URL_ALLOWLIST_JSON }}
           NOEMA_LLM_MODEL: orchestrator/free
           # Dedicated inference token for contextual-orchestrator. Upstream
           # provider credentials stay inside the orchestrator credential KV.

.github/workflows/ci.yml

@@ -44,15 +44,15 @@ jobs:
       - name: setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: verify package-manager toolchain
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
 
       - name: verify live pull-request base before lockfile control
         if: github.event_name == 'pull_request'

.github/workflows/hourly-commercial-readiness.yml

@@ -135,15 +135,15 @@ jobs:
       - name: setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: verify package-manager toolchain
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
 
       - name: install lockfile dependencies
         run: npm ci --legacy-peer-deps=false --install-links=false

.github/workflows/hourly-product-development.yml

@@ -54,6 +54,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           ORCHESTRATOR_KEY_CONFIGURED: ${{ secrets.NOEMA_LLM_API_KEY != '' }}
           ORCHESTRATOR_URL_CONFIGURED: ${{ vars.NOEMA_LLM_API_URL != '' }}
+          ORCHESTRATOR_ALLOWLIST_CONFIGURED: ${{ vars.NOEMA_LLM_API_URL_ALLOWLIST_JSON != '' }}
           MAINTAINER_APP_CLIENT_ID_CONFIGURED: ${{ vars.NOEMA_MAINTAINER_APP_CLIENT_ID != '' }}
           MAINTAINER_APP_PRIVATE_KEY_CONFIGURED: ${{ secrets.NOEMA_MAINTAINER_APP_PRIVATE_KEY != '' }}
         run: |
@@ -82,7 +83,8 @@ jobs:
           fi
 
           if { [ "$ORCHESTRATOR_KEY_CONFIGURED" != "true" ] \
-            || [ "$ORCHESTRATOR_URL_CONFIGURED" != "true" ]; } \
+            || [ "$ORCHESTRATOR_URL_CONFIGURED" != "true" ] \
+            || [ "$ORCHESTRATOR_ALLOWLIST_CONFIGURED" != "true" ]; } \
             && [ "$DRY_RUN" != "true" ]; then
             {
               echo "dispatch=false"
@@ -245,6 +247,7 @@ jobs:
         shell: bash
         env:
           NOEMA_LLM_API_URL: ${{ vars.NOEMA_LLM_API_URL }}
+          NOEMA_LLM_API_URL_ALLOWLIST_JSON: ${{ vars.NOEMA_LLM_API_URL_ALLOWLIST_JSON }}
           NOEMA_LLM_MODEL: orchestrator/free
         run: |
           set -euo pipefail

.github/workflows/maintainer-app-readiness.yml

@@ -66,13 +66,13 @@ jobs:
       - name: setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
 
       - name: verify Node.js runtime
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
+          test "$(node --version)" = "v24.21.0"
 
       - name: audit active main governance
         id: governance

.github/workflows/patch-validator-image.yml

@@ -100,10 +100,10 @@ jobs:
             url="$2"
             timeout --signal=TERM --kill-after=30s 5m \
               curl --proto '=https' --proto-redir '=https' --tlsv1.2 --location --fail --silent --show-error \
-                --retry 3 \
+                --retry 7 \
                 --retry-all-errors \
-                --retry-delay 2 \
-                --retry-max-time 90 \
+                --retry-delay 0 \
+                --retry-max-time 240 \
                 --connect-timeout 20 \
                 --max-time 180 \
                 --output "$destination" "$url"
@@ -138,15 +138,15 @@ jobs:
       - name: Set up exact dependency materialization toolchain
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: Materialize exact patch-validator dependencies
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
 
           deps_dir="$RUNNER_TEMP/patch-validator-deps"
           rm -rf "$deps_dir"
@@ -220,7 +220,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          test "$(docker run --rm --pull=never --entrypoint=/nodejs/bin/node "$IMAGE_TAG" --version)" = "v24.19.0"
+          test "$(docker run --rm --pull=never --entrypoint=/nodejs/bin/node "$IMAGE_TAG" --version)" = "v24.21.0"
 
       - name: Inspect exact image metadata and exclude dynamic runtime payloads
         shell: bash

.github/workflows/private-vulnerability-reporting-audit.yml

@@ -33,7 +33,7 @@ jobs:
       - name: setup node without repository token
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           token: ""
 
       - name: verify exact checkout
@@ -93,7 +93,7 @@ jobs:
       - name: setup node without repository token
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           token: ""
 
       - name: verify exact checkout

.github/workflows/readiness-scan.yml

@@ -33,15 +33,15 @@ jobs:
       - name: setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: verify package-manager toolchain
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
 
       - name: install
         run: npm ci --legacy-peer-deps=false --install-links=false

.github/workflows/release-evidence.yml

@@ -65,15 +65,15 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: Verify package-manager toolchain
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
 
       - name: Verify tag, commit, and package version binding
         id: identity
@@ -154,15 +154,15 @@ jobs:
       - name: Set up Node.js for sterile materialization
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "24.19.0"
+          node-version: "24.21.0"
           cache: npm
 
       - name: Verify sterile materialization toolchain and source identity
         shell: bash
         run: |
           set -euo pipefail
-          test "$(node --version)" = "v24.19.0"
-          test "$(npm --version)" = "11.17.0"
+          test "$(node --version)" = "v24.21.0"
+          test "$(npm --version)" = "11.19.0"
           test "$(git rev-parse HEAD)" = "$RELEASE_COMMIT_SHA"
           test "$(git rev-parse "${RELEASE_TAG}^{commit}")" = "$RELEASE_COMMIT_SHA"
           package_version="$(node --input-type=module -e "import packageJson from './package.json' with { type: 'json' }; process.stdout.write(packageJson.version)")"

AGENTS.md

@@ -92,6 +92,11 @@ Worker (npm + `wrangler.toml`); tests run under Vitest.
   `NOEMA_LLM_MODEL` is the canonical routing alias `orchestrator/free`
   (fail-closed zero-cost pool, ZDR-first), and `NOEMA_LLM_API_KEY` is a
   dedicated gateway inference token.
+- `NOEMA_LLM_API_URL_ALLOWLIST_JSON` is a non-empty JSON array of exact
+  released contextual-orchestrator `/v1` endpoints. The selected URL must be
+  an exact member before Noema emits credential-bearing configuration. Array
+  order never selects, retries, or falls back across endpoints; `/healthz`
+  self-identification is liveness evidence, not endpoint authority.
 - The reusable, secret-free copy is `contracts/orchestrator-gateway.json`
   (`node scripts/verify-orchestrator-gateway.mjs --print-contract`). Narrative:
   `docs/orchestrator-gateway-consumer-contract.md`. Validation helpers live in