feat(automation): run pg-erd-cloud hourly NVIDIA NIM review repair

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -16,6 +16,7 @@ on:
       - .github/workflows/nonnest2-hourly-review-repair.yml
       - .github/workflows/orgmetra-hourly-review-repair.yml
       - .github/workflows/originweave-hourly-review-repair.yml
+      - .github/workflows/pg-erd-cloud-hourly-review-repair.yml
       - .github/workflows/quarantine-sandbox-hourly-review-repair.yml
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
@@ -29,6 +30,7 @@ on:
       - tests/test_orgmetra_hourly_review_caller.py
       - tests/test_originweave_hourly_review_caller.py
       - tests/test_quarantine_sandbox_hourly_review_caller.py
+      - tests/test_pg_erd_cloud_hourly_review_caller.py
       - tests/test_hourly_autofix_context_quality_gate.py
       - tests/test_pr_review_conflict_scope.py
       - tests/test_pr_review_conflict_scope_control_files.py
@@ -54,6 +56,7 @@ on:
       - docs/doctoring/orgmetra-hourly-review-caller.md
       - docs/doctoring/originweave-hourly-review-caller.md
       - docs/doctoring/quarantine-sandbox-hourly-review-caller.md
+      - docs/doctoring/pg-erd-cloud-hourly-review-caller.md
   push:
     paths:
       - .github/workflows/pr-review-fix-scheduler.yml
@@ -69,6 +72,7 @@ on:
       - .github/workflows/nonnest2-hourly-review-repair.yml
       - .github/workflows/orgmetra-hourly-review-repair.yml
       - .github/workflows/originweave-hourly-review-repair.yml
+      - .github/workflows/pg-erd-cloud-hourly-review-repair.yml
       - .github/workflows/quarantine-sandbox-hourly-review-repair.yml
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
@@ -82,6 +86,7 @@ on:
       - tests/test_orgmetra_hourly_review_caller.py
       - tests/test_originweave_hourly_review_caller.py
       - tests/test_quarantine_sandbox_hourly_review_caller.py
+      - tests/test_pg_erd_cloud_hourly_review_caller.py
       - tests/test_hourly_autofix_context_quality_gate.py
       - tests/test_pr_review_conflict_scope.py
       - tests/test_pr_review_conflict_scope_control_files.py
@@ -107,6 +112,7 @@ on:
       - docs/doctoring/orgmetra-hourly-review-caller.md
       - docs/doctoring/originweave-hourly-review-caller.md
       - docs/doctoring/quarantine-sandbox-hourly-review-caller.md
+      - docs/doctoring/pg-erd-cloud-hourly-review-caller.md
 
 permissions:
   contents: read
@@ -164,6 +170,7 @@ jobs:
             tests/test_orgmetra_hourly_review_caller.py \
             tests/test_originweave_hourly_review_caller.py \
             tests/test_quarantine_sandbox_hourly_review_caller.py \
+            tests/test_pg_erd_cloud_hourly_review_caller.py \
             tests/test_pr_review_conflict_scope_control_files.py \
             tests/test_hourly_autofix_context_quality_gate.py \
             tests/test_pr_review_conflict_scope_git_executable.py \

.github/workflows/pg-erd-cloud-hourly-review-repair.yml

@@ -0,0 +1,32 @@
+name: pg-erd-cloud Hourly Review Repair
+
+on:
+  schedule:
+    # Minute 13 avoids Clearfolio (23), DiskSage (37), fast-mlsirm (49),
+    # BandScope (53), naruon (11), Inkspan (47), orchestrator (17),
+    # Wardnet (7), Keyverse (29), and codec-carver (5).
+    - cron: "13 * * * *"
+
+concurrency:
+  group: pg-erd-cloud-hourly-review-repair
+  # A later heartbeat must not cancel an in-flight ERD RCA or repair.
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch-review-repair:
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/pr-review-fix-scheduler.yml
+    with:
+      target_repository: ContextualWisdomLab/pg-erd-cloud
+      base_branch: main
+      max_prs: "50"
+      max_dispatches: "1"
+      retry_hours: "2"
+    secrets:
+      PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
+      OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}

ARCHITECTURE.md

@@ -39,6 +39,13 @@ only established scheduler credentials, and grants job-scoped
 only established scheduler credentials, and grants job-scoped
 `id-token: write`. The reusable engine stays product-neutral.
 
+## pg-erd-cloud hourly caller
+
+`pg-erd-cloud-hourly-review-repair.yml` is a thin, read-only caller at minute
+13. It names `ContextualWisdomLab/pg-erd-cloud` and protected `main`, maps
+only established scheduler credentials, and grants job-scoped
+`id-token: write`. The reusable engine stays product-neutral.
+
 ## Hourly NVIDIA NIM repair gate
 
 ```mermaid

CHANGELOG.md

@@ -11,6 +11,7 @@ Semantic Versioning where the repository publishes a release.
 - Added an hourly organization commercial-readiness coordinator that discovers writable repositories, honors enabled dedicated writer leases and fully paginated live writer runs, refetches exact repository/workflow/run/PR state before dispatch, rotates bounded review-repair and opt-in NVIDIA OpenCode product-development targets, fails nonzero on fleet-wide inspection or dispatch outages, retains three-day JSON receipts, and keeps the existing 15-minute merge scheduler authoritative.
 - Added a dedicated Quarantine Sandbox Runtime hourly caller at minute 14 that targets protected `develop`, dispatches at most one exact-head repair, applies a two-hour same-head retry floor, preserves non-cancelling single-flight execution, and maps only the established scheduler credentials with job-scoped OIDC.
 - Added a dedicated OriginWeave hourly caller that invokes the product-neutral central scheduler with the exact repository, protected `main` branch, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, job-scoped OIDC, and only the established scheduler credentials.
+- Added a dedicated pg-erd-cloud hourly caller that invokes the product-neutral central scheduler with the exact repository, protected `main` branch, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, job-scoped OIDC, and only the established scheduler credentials.
 - Added a trusted pull-request comment router for `@cwl-noema-review` and review-only `@opencode-agent` dispatches, with an organization sweep, exact-head receipts, repository allowlisting, fixed runners, immutable checkout pins, and a permanent 100% statement/branch/docstring quality gate.
 - Added an organization-owned reusable exact-artifact SBOM attestation boundary that validates inert six-file wheel/sdist evidence, binds CycloneDX 1.7 predicates to exact SHA-256 subjects, signs through least-privilege GitHub artifact attestations, and exports online and offline verification bundles.
 - Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence.

CLAUDE.md

@@ -118,7 +118,7 @@ repeatable compile command.
   without running the test suite will break CI.
 - **100% coverage and 100% docstrings on `scripts/ci/`** are hard gates, not aspirations. New helper
   code needs matching tests and docstrings.
-- **Product hourly callers** stay thin. Do not hard-code OriginWeave, naruon, or Keyverse
+- **Product hourly callers** stay thin. Do not hard-code pg-erd-cloud, naruon, or Keyverse
   into `pr-review-fix-scheduler.yml`. The model credential remains `NVIDIA_NIM_API_KEY`
   on the worker, never `COPILOT_GITHUB_TOKEN`.
 - **`pull_request_target` trust boundary.** The required review workflows run the *base branch's*

docs/doctoring/pg-erd-cloud-hourly-review-caller.md

@@ -0,0 +1,137 @@
+# pg-erd-cloud hourly review-repair caller
+
+검토 기준일: **2026-08-17**
+
+## Decision
+
+ContextualWisdomLab operates one protected hourly caller for
+`ContextualWisdomLab/pg-erd-cloud` (cloud-erd.app — ERD workspace for
+developers and data architects). The caller runs at minute 13, delegates
+to the product-neutral central review-fix scheduler, inspects at most 50
+open pull requests targeting protected `main`, and dispatches at most one
+bounded repair per heartbeat.
+
+A paying buyer of the ERD workspace would feel live pg-erd-cloud pull
+requests stalling while hourly NVIDIA NIM repair scanned only Clearfolio,
+DiskSage, and fast-mlsirm. Live heads such as
+ContextualWisdomLab/pg-erd-cloud#916 (control-character insertion),
+#918 (schema-field validation), and #919 (handle-id generation) target
+`main` and never enter those other callers.
+
+The caller does not implement review or mutation logic itself.
+pg-erd-cloud remains standalone; naruon does not own its schema canvas.
+Privileged automation stays in `ContextualWisdomLab/.github`.
+
+## Root-cause analysis and remediation feasibility
+
+The reusable worker performs exact-head root-cause analysis and tests
+remediation feasibility before it edits. The reusable worker must:
+
+1. Refetch the exact live head, base, reviews, checks, changed paths, and
+   writer state.
+2. Establish the causal chain rather than repeat the terminal symptom.
+3. Enumerate materially distinct minimal remedies.
+4. Reject remedies that lack writer authority, cross sealed paths, require
+   unavailable credentials or protected-setting changes, violate stack
+   order, cannot be verified, or do not alter the diagnosed cause.
+5. Dispatch at most one feasible repair. Otherwise leave the tree
+   unchanged.
+
+A queued or pending check remains a merge blocker but is not itself a
+code finding. The independent non-author approval remains an external
+authorization gate and is never synthesized by the repair worker. The
+worker cannot approve, merge, release, resolve review findings by
+inference, change protection, or manufacture passing checks.
+
+## Cadence and concurrency
+
+The caller uses a single concurrency group and `cancel-in-progress: false`.
+This preserves an in-flight bounded RCA instead of discarding ERD
+evidence when the next hourly heartbeat arrives. The reusable scheduler
+cancels only its own superseded short queue scan.
+
+The caller sets a **two-hour same-head retry floor**. Central OpenCode and
+NVIDIA NIM work, plus schema-canvas or control-character analysis, can
+legitimately approach two hours. An hourly redispatch of the same
+unchanged head would create duplicate writer pressure rather than faster
+remediation.
+
+GitHub scheduled workflows can be delayed under load and execute only
+from the default branch. The cron expression is a heartbeat, not a
+real-time SLA.
+
+## Credential and model boundary
+
+The caller keeps workflow `GITHUB_TOKEN` at `contents: read` and grants
+the reusable job `id-token: write` so the central scheduler can mint the
+OpenCode GitHub App token from GitHub OIDC when the mapped PAT is absent
+(GitHub, n.d.-c). It maps only `PR_REVIEW_MERGE_TOKEN` and
+`OPENCODE_APPROVE_TOKEN`. It never uses `secrets: inherit`, receives
+`NVIDIA_NIM_API_KEY`, or introduces `COPILOT_GITHUB_TOKEN`. CWE-250
+forbids executing the caller with write or model privileges it does not
+need (MITRE, 2026).
+
+Model execution remains inside the central worker. The model credential
+is the GitHub Secret `NVIDIA_NIM_API_KEY`; the caller does not receive or
+forward it.
+
+Before protected-main activation, the repository variable
+`OPENCODE_REPOSITORY_DISPATCH_TARGETS` must contain the exact
+`ContextualWisdomLab/pg-erd-cloud` target. Missing or mismatched
+configuration fails before mutation credential materialization.
+
+## Security, standalone operation, and modularity
+
+The caller adds no pg-erd-cloud runtime dependency, database object,
+network endpoint, tenant authority, or product credential. pg-erd-cloud
+continues to run as a standalone ERD workspace. Naruon and other CWL
+services may consume exported diagrams, but they cannot weaken its
+exact-head, approval, or security gates.
+
+## Verification and rollback
+
+Machine-checkable contracts require the exact target/base, minute 13
+cadence, non-cancelling single-flight group, one dispatch, two-hour
+retry floor, explicit secret mapping, read-only contents plus job-scoped
+`id-token: write`, focused path-filter coverage, and absence of model or
+Copilot credentials. Independent `pull_request`, `push`, and `compileall`
+path blocks must each name the caller, doctoring, or contract they own.
+
+After source integration, closure requires a scheduled or manual
+protected-main consumer run proving the exact pg-erd-cloud repository and
+`main` base. Source checks alone are not protected-main operational acceptance.
+Merge still requires zero unresolved valid findings and a
+qualifying independent non-author approval.
+
+Rollback removes the pg-erd-cloud caller, its focused test, doctoring, and
+central path-filter/documentation entries. It must not remove scheduler
+dispatch validation or affect independent product callers.
+
+## APA 7th references
+
+GitHub, Inc. (n.d.-a). *Events that trigger workflows*. GitHub Docs.
+Retrieved August 17, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule
+
+GitHub, Inc. (n.d.-b). *Reuse workflows*. GitHub Docs. Retrieved August
+17, 2026, from
+https://docs.github.com/en/actions/how-tos/sharing-automations/reuse-workflows
+
+GitHub, Inc. (n.d.-c). *Automatic token authentication*. GitHub Docs.
+Retrieved August 17, 2026, from
+https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+
+MITRE. (2026). *CWE-250: Execution with unnecessary privileges*.
+https://cwe.mitre.org/data/definitions/250.html
+
+National Institute of Standards and Technology. (2022). *Secure software
+development framework (SSDF) version 1.1: Recommendations for mitigating
+the risk of software vulnerabilities* (NIST Special Publication 800-218).
+https://doi.org/10.6028/NIST.SP.800-218
+
+NVIDIA. (n.d.). *NVIDIA NIM for large language models documentation*.
+Retrieved August 17, 2026, from
+https://docs.nvidia.com/nim/large-language-models/latest/
+
+OpenCode. (n.d.). *OpenCode documentation*. Retrieved August 17, 2026,
+from https://opencode.ai/docs/

requirements-pip-audit-ci-hashes.txt

@@ -213,9 +213,9 @@ packaging==26.2 \
     # via
     #   pip-audit
     #   pip-requirements-parser
-pip==26.1.2 \
-    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
-    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
+pip==26.2.1 \
+    --hash=sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e \
+    --hash=sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f
     # via pip-api
 pip-api==0.0.34 \
     --hash=sha256:8b2d7d7c37f2447373aa2cf8b1f60a2f2b27a84e1e9e0294a3f6ef10eb3ba6bb \

scripts/ci/test_strix_quick_gate.sh

@@ -1506,8 +1506,8 @@ assert_pr_review_merge_scheduler_uses_github_actions_bot_token() {
 	assert_file_contains "$workflow_file" "github.event_name == 'pull_request_target' && format('pr-{0}', github.event.pull_request.number)" "scheduler scopes pull_request_target concurrency to the active PR"
 	assert_file_contains "$workflow_file" "github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number && format('pr-{0}', github.event.workflow_run.pull_requests[0].number)" "scheduler scopes workflow_run concurrency to the completed review PR"
 	assert_file_contains "$workflow_file" "github.event_name == 'schedule' && format('schedule-{0}', github.event.schedule)" "scheduler isolates the 15-minute organization sweep from the separate 30-minute scheduled scan"
-	assert_file_contains "$workflow_file" "github.event_name == 'repository_dispatch' && github.run_id" "scheduler keeps manual queue scans isolated per run"
-	assert_file_contains "$workflow_file" "cancel-in-progress: \${{ github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review' || github.event_name == 'repository_dispatch' }}" "scheduler cancels stale PR/review/manual queue scans instead of accumulating merge/update attempts"
+	assert_file_contains "$workflow_file" "github.event_name == 'repository_dispatch' && format('repo-dispatch-{0}', github.repository)" "scheduler keeps manual queue scans isolated per repository dispatch target"
+	assert_file_contains "$workflow_file" "cancel-in-progress: \${{ github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review' || github.event_name == 'repository_dispatch' || (github.event_name == 'workflow_run' && !github.event.workflow_run.pull_requests[0].number) }}" "scheduler cancels stale PR/review/manual queue scans instead of accumulating merge/update attempts"
 	assert_file_contains "$workflow_file" "timeout-minutes: 60" "organization sweep has enough headroom to finish the complete repository walk"
 	assert_file_contains "$workflow_file" "ORG_SWEEP_TRIGGER_REVIEWS: \${{ github.event_name == 'schedule' ||" "scheduled organization sweeps retry missing current-head OpenCode reviews"
 	assert_file_contains "$workflow_file" "ORG_SWEEP_ENABLE_AUTO_MERGE: \${{ github.event_name == 'schedule' ||" "scheduled organization sweeps merge approved current heads"