chore(ci): drive gate model from a repo variable, cheap 8B default

[drewstone]

Problem

Both surviving browser gates hardcode --model gpt-5.2. Changing the model — to cut cost or to revert a flaky experiment — takes a commit and a merge.

Two scope notes against the original request, found while verifying:

1. The two scheduled workflows are already gone. chore(ci): delete scheduled paid reliability workflows #140 (merged 2026-07-31) deleted nightly-reliability.yml and tier3-public-gate.yml. This PR covers the two survivors: tier1-gate.yml and tier2-staging-gate.yml.
2. Current spend on these gates is $0, not ~$50/mo. The repo has no OPENAI_API_KEY secret (repo secrets: NPM_TOKEN only; org secrets visible to this repo contain no OpenAI key either). Live runs prove it: tier1 "success" runs skip the gate step ("Run deterministic gate: skipped", e.g. run 30668895116). The dollar figures below are what the gates cost once someone re-adds a key — this PR makes that armed state cheap by default instead of $50/mo by default.

Change

Model comes from a repo Actions variable (not secret), defaulting cheap:

--model "${{ vars.BAD_CI_MODEL || 'groq/llama-3.1-8b-instant' }}"

groq/* model ids only resolve through an OpenAI-compatible router (the driver has no groq provider; its openai provider hits api.openai.com unless LLM_BASE_URL is set — the model swap alone would 404). So the gate step also wires the driver's proxy knob:

LLM_BASE_URL: ${{ vars.BAD_CI_LLM_BASE_URL || 'https://router.tangle.tools/v1' }}

Cost per workflow (when armed with a key)

Workflow	Trigger	On gpt-5.2	On 8B default	Today (no key)
tier2-staging-gate.yml	push + PR to main	~$40/mo	~$0.04/mo	$0 (skips)
tier1-gate.yml	push + PR to main	~$10/mo	~$0.01/mo	$0 (skips)
nightly-reliability.yml	—	deleted in #140	—	—
tier3-public-gate.yml	—	deleted in #140	—	—

8B estimate: groq llama-3.1-8b-instant is $0.05/M input, $0.08/M output — ~3 orders of magnitude under gpt-5.2. Precedent for the absolute number: bad-app's daily real-ui-gate.yml drives this same driver on the same model for ~$0.05/mo.

Precedent — same driver, same model, running today

• bad-app real-ui-gate.yml: daily, BAD_CI_LLM_MODEL: groq/llama-3.1-8b-instant through https://router.tangle.tools/v1 with the router key as OPENAI_API_KEY.
• agent-builder bad-prod-release.yml: daily production UI gate, exactly this pattern — BAD_MODEL: ${{ vars.BAD_MODEL || 'groq/llama-3.1-8b-instant' }}, BAD_BASE_URL: https://router.tangle.tools/v1, OPENAI_API_KEY: ${{ secrets.TANGLE_CI_ROUTER_KEY }}.

Revert / override — no commit, ever

Repo Settings → Secrets and variables → Actions → Variables:

• Gate flaky on 8B? Set BAD_CI_MODEL=gpt-5.2. Router serves OpenAI models too, so the base URL can stay put (with a router key in OPENAI_API_KEY).
• Direct OpenAI instead of the router? Also set BAD_CI_LLM_BASE_URL=https://api.openai.com/v1 and store a raw OpenAI key in OPENAI_API_KEY.
• Next run picks the new values up; deleting the variables restores the cheap defaults.

Model is a pure pass-through — verified

Checked every hop before touching the default: workflow --model → run-tier1-gate.mjs / run-tier2-repeat-gate.mjs → run-scenario-track.mjs → run-mode-baseline.mjs → CLI, where mergeConfig(fileConfig, cliOverrides) is last-wins, so the flag beats the scenario config's model: 'gpt-5.2'. Gate thresholds (pass rate, avg turns, avg duration) and reliability-scorecard.mjs are model-agnostic — no per-model calibrated baselines anywhere in the tier runners that would structurally false-red on a model switch.

Validation

• python3 -c "yaml.safe_load(...)" — both files parse.
• actionlint — clean on both files.
• git merge-tree origin/main HEAD — merges clean.

[tangletools]

✅ Auto-approved drewstone PR — dfaabe9b

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-03T18:04:31Z}