fix(ci): preserve AI review variable contract

.github/workflows/ai-review.yml

@@ -75,10 +75,9 @@ jobs:
       contents: read
     env:
       GITHUB_TOKEN: ${{ github.token }}
-      OPENAI_KEY: ${{ secrets.CLIPROXY_API_KEY }}
-      "OPENAI.API_BASE": http://127.0.0.1:8317/v1
-      "config.model": "gpt-5.4-mini"
-      "config.fallback_models": '["gpt-5.4-mini"]'
+      OPENAI_KEY: ${{ secrets.AI_REVIEW_API_KEY }}
+      "OPENAI.API_BASE": ${{ vars.AI_REVIEW_BASE_URL }}
+      "config.model": ${{ vars.AI_REVIEW_MODEL }}
       "github_action_config.auto_review": "true"
       "github_action_config.auto_describe": "false"
       "github_action_config.auto_improve": "false"

.pr_agent.toml

@@ -1,6 +1,4 @@
 [config]
-model = "gpt-5.4-mini"
-fallback_models = ["gpt-5.4-mini"]
 git_provider = "github"
 publish_output = true
 publish_output_progress = false

CONTRIBUTING.md

@@ -84,8 +84,8 @@ CCS PR review no longer depends on `anthropics/claude-code-action`. The reposito
 - PR-Agent reviews run on the existing self-hosted `cliproxy` runner.
 - Use `/review` on the PR when you need a fresh pass after follow-up commits.
 - Only the trusted `/review` comment path is enabled on the privileged self-hosted runner.
-- Keep repository-level model choice and reviewer instructions in the root `.pr_agent.toml`.
-- Keep automation wiring in `ai-review.yml`, using the workflow env for `OPENAI.*` and `github_action_config.*` settings rather than `.pr_agent.toml`.
+- Keep repository-level reviewer instructions in the root `.pr_agent.toml`.
+- Keep runtime wiring and defaults in `ai-review.yml`, which still maps the existing `AI_REVIEW_BASE_URL`, `AI_REVIEW_MODEL`, and `AI_REVIEW_API_KEY` integrations onto PR-Agent's `OPENAI.*` and `config.*` settings.
 - If you change review defaults, update the workflow or `.pr_agent.toml` alongside the contributor or architecture docs in the same PR.
 
 Example:

docs/system-architecture/index.md

@@ -19,7 +19,7 @@ Dashboard localization (i18n) architecture and contributor workflow are document
 
 CCS v7.34 adds Image Analysis Hook for vision model proxying through CLIProxy with automatic injection for all profile types.
 CCS v7.67 adds a native structured logging lane for CCS-owned runtime events, backed by `src/services/logging/`, bounded JSONL files under `~/.ccs/logs/`, and a dedicated dashboard `/logs` route.
-CCS PR review now uses PR-Agent in GitHub Actions, with reviews running on the self-hosted `cliproxy` runner and repo-level guidance stored in `.pr_agent.toml`.
+CCS PR review now uses PR-Agent in GitHub Actions, with reviews running on the self-hosted `cliproxy` runner, existing `AI_REVIEW_*` workflow variables and secrets preserved as the runtime contract, and repo-level guidance stored in `.pr_agent.toml`.
 
 ```
 +===========================================================================+
@@ -418,7 +418,7 @@ See [Provider Flows](./provider-flows.md) → Authentication Flow section.
 
 ### PR Review Lane
 
-Automated pull request review stays in `.github/workflows/ai-review.yml`, but the workflow now runs PR-Agent instead of the old Claude action. Reviews run on the existing self-hosted `cliproxy` runner, while automation flags live in workflow env keys such as `OPENAI.*` and `github_action_config.*`, and repo-specific model or reviewer guidance lives in `.pr_agent.toml`.
+Automated pull request review stays in `.github/workflows/ai-review.yml`, but the workflow now runs PR-Agent instead of the old Claude action. Reviews run on the existing self-hosted `cliproxy` runner, while the workflow preserves the existing `AI_REVIEW_BASE_URL`, `AI_REVIEW_MODEL`, and `AI_REVIEW_API_KEY` contract by mapping those values into PR-Agent env keys such as `OPENAI.*`, `config.*`, and `github_action_config.*`. Repo-specific reviewer guidance lives in `.pr_agent.toml`.
 
 ```
 GitHub Actions `ai-review.yml`
@@ -436,8 +436,8 @@ CLIProxy
 Configured model from `.pr_agent.toml`
 ```
 
-- `ai-review.yml` owns automation wiring such as runner selection, PR-Agent action usage, and environment flags like `OPENAI.*` plus `github_action_config.*`.
-- `.pr_agent.toml` in the repo root owns model selection and review instructions for this repository.
+- `ai-review.yml` owns automation wiring such as runner selection, PR-Agent action usage, and runtime values mapped from `AI_REVIEW_*` into `OPENAI.*`, `config.*`, and `github_action_config.*`.
+- `.pr_agent.toml` in the repo root owns review instructions for this repository.
 - Contributors should treat PR-Agent comments and trusted `/review` reruns as the primary AI review path for PRs targeting CCS.
 
 ### Runtime Dependencies

tests/unit/scripts/github/ai-review-workflow.test.ts

@@ -22,16 +22,16 @@ describe('PR-Agent review lane migration', () => {
     expect(workflow).toContain('uses: qodo-ai/pr-agent');
     expect(workflow).toContain('OPENAI.API_BASE');
     expect(workflow).toContain('OPENAI_KEY');
-    expect(workflow).toContain('config.model');
+    expect(workflow).toContain('vars.AI_REVIEW_BASE_URL');
+    expect(workflow).toContain('vars.AI_REVIEW_MODEL');
+    expect(workflow).toContain('secrets.AI_REVIEW_API_KEY');
     expect(workflow).toContain('github_action_config.auto_review');
     expect(workflow).toContain("github.event.comment.body == '/review'");
     expect(workflow).toContain('github.event.comment.author_association');
     expect(workflow).not.toContain('uses: anthropics/claude-code-action@v1');
-    expect(workflow).not.toContain('AI_REVIEW_API_KEY');
 
     expect(config).toContain('[config]');
     expect(config).toContain('git_provider = "github"');
-    expect(config).toMatch(/\bmodel\s*=\s*"[^"\n]+"/);
     expect(config).toContain('[pr_reviewer]');
     expect(config).not.toContain('auto_review = true');
     expect(config).not.toContain('claude-code-action');