From 689b953f4a329bd17f5dc93bfb8e583e05d9e89b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 17 Aug 2026 20:18:46 +0900 Subject: [PATCH 1/6] feat(automation): run nonnest2 hourly NVIDIA NIM review repair Add a thin minute-16 caller for ContextualWisdomLab/nonnest2 on protected master. The caller maps only established scheduler credentials, grants job-scoped OIDC, and leaves NVIDIA_NIM_API_KEY on the reusable worker. --- .../hourly-nvidia-nim-review-repair.yml | 7 + .../nonnest2-hourly-review-repair.yml | 37 ++++ AGENTS.md | 1 + ARCHITECTURE.md | 7 + CHANGELOG.md | 1 + CLAUDE.md | 3 + .../nonnest2-hourly-review-caller.md | 140 +++++++++++++++ tests/test_nonnest2_hourly_review_caller.py | 166 ++++++++++++++++++ 8 files changed, 362 insertions(+) create mode 100644 .github/workflows/nonnest2-hourly-review-repair.yml create mode 100644 docs/doctoring/nonnest2-hourly-review-caller.md create mode 100644 tests/test_nonnest2_hourly_review_caller.py diff --git a/.github/workflows/hourly-nvidia-nim-review-repair.yml b/.github/workflows/hourly-nvidia-nim-review-repair.yml index 5fb02ea17..869174372 100644 --- a/.github/workflows/hourly-nvidia-nim-review-repair.yml +++ b/.github/workflows/hourly-nvidia-nim-review-repair.yml @@ -10,11 +10,13 @@ on: - .github/workflows/disksage-hourly-review-repair.yml - .github/workflows/fast-mlsirm-hourly-review-repair.yml - .github/workflows/hourly-nvidia-nim-review-repair.yml + - .github/workflows/nonnest2-hourly-review-repair.yml - scripts/ci/pr_review_conflict_scope.py - scripts/ci/pr_review_autofix_context.py - tests/test_disksage_hourly_review_caller.py - tests/test_fast_mlsirm_hourly_review_caller.py - tests/test_hourly_scheduler_runtime_budget.py + - tests/test_nonnest2_hourly_review_caller.py - tests/test_hourly_autofix_context_quality_gate.py - tests/test_pr_review_conflict_scope.py - tests/test_pr_review_conflict_scope_control_files.py @@ -33,6 +35,7 @@ on: - docs/doctoring/disksage-hourly-review-caller.md - docs/doctoring/fast-mlsirm-hourly-review-caller.md - docs/doctoring/hourly-nvidia-nim-autofix.md + - docs/doctoring/nonnest2-hourly-review-caller.md push: paths: - .github/workflows/pr-review-fix-scheduler.yml @@ -42,11 +45,13 @@ on: - .github/workflows/disksage-hourly-review-repair.yml - .github/workflows/fast-mlsirm-hourly-review-repair.yml - .github/workflows/hourly-nvidia-nim-review-repair.yml + - .github/workflows/nonnest2-hourly-review-repair.yml - scripts/ci/pr_review_conflict_scope.py - scripts/ci/pr_review_autofix_context.py - tests/test_disksage_hourly_review_caller.py - tests/test_fast_mlsirm_hourly_review_caller.py - tests/test_hourly_scheduler_runtime_budget.py + - tests/test_nonnest2_hourly_review_caller.py - tests/test_hourly_autofix_context_quality_gate.py - tests/test_pr_review_conflict_scope.py - tests/test_pr_review_conflict_scope_control_files.py @@ -65,6 +70,7 @@ on: - docs/doctoring/disksage-hourly-review-caller.md - docs/doctoring/fast-mlsirm-hourly-review-caller.md - docs/doctoring/hourly-nvidia-nim-autofix.md + - docs/doctoring/nonnest2-hourly-review-caller.md permissions: contents: read @@ -115,6 +121,7 @@ jobs: tests/test_disksage_hourly_review_caller.py \ tests/test_fast_mlsirm_hourly_review_caller.py \ tests/test_hourly_scheduler_runtime_budget.py \ + tests/test_nonnest2_hourly_review_caller.py \ tests/test_pr_review_conflict_scope_control_files.py \ tests/test_hourly_autofix_context_quality_gate.py \ tests/test_pr_review_conflict_scope_git_executable.py \ diff --git a/.github/workflows/nonnest2-hourly-review-repair.yml b/.github/workflows/nonnest2-hourly-review-repair.yml new file mode 100644 index 000000000..d43290fa0 --- /dev/null +++ b/.github/workflows/nonnest2-hourly-review-repair.yml @@ -0,0 +1,37 @@ +name: nonnest2 Hourly Review Repair + +on: + schedule: + # Minute 16 avoids pg-llm-batch (1), aFIPC (2), kaefa (3), LineageWeave (4), + # codec-carver (5), life-os (6), Wardnet (7), mightyETL (8), + # psychometrics-commons (9), OriginWeave (10), naruon (11), + # DiagramWeave (12), pg-erd-cloud (13), mhtml-etl-gateway (14), + # html4tree (15), orchestrator (17), noema (19), Clearfolio (23), + # Keyverse (29), Scopeweave (31), DiskSage (37), Appguardrail (41), + # newsdom-api (43), Inkspan (47), fast-mlsirm (49), BandScope (53), + # and semantic-data-portal (59). + - cron: "16 * * * *" + +concurrency: + group: nonnest2-hourly-review-repair + # A later heartbeat must not cancel an in-flight Vuong or fit RCA. + cancel-in-progress: false + +permissions: + contents: read + +jobs: + dispatch-review-repair: + permissions: + contents: read + id-token: write + uses: ./.github/workflows/pr-review-fix-scheduler.yml + with: + target_repository: ContextualWisdomLab/nonnest2 + base_branch: master + max_prs: "50" + max_dispatches: "1" + retry_hours: "2" + secrets: + PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }} + OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }} diff --git a/AGENTS.md b/AGENTS.md index 16f0981c0..e748a923a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -5,3 +5,4 @@ Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md). Conflict-scope roots fail closed when the immediate parent directory is a symbolic link. +nonnest2 hourly NVIDIA NIM repair is a thin caller at minute 16. See [`docs/doctoring/nonnest2-hourly-review-caller.md`](docs/doctoring/nonnest2-hourly-review-caller.md). diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 6fe6621b6..0a2d2e73f 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -25,6 +25,13 @@ flowchart LR Products -->|"standalone or as module"| Buyer ``` +## nonnest2 hourly caller + +`nonnest2-hourly-review-repair.yml` is a thin, read-only caller at minute +16. It names `ContextualWisdomLab/nonnest2` and protected `master`, maps +only established scheduler credentials, and grants job-scoped +`id-token: write`. The reusable engine stays product-neutral. + ## Hourly NVIDIA NIM repair gate ```mermaid diff --git a/CHANGELOG.md b/CHANGELOG.md index 1de9130a5..a9d84b724 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ Semantic Versioning where the repository publishes a release. ### Added +- Added a dedicated nonnest2 hourly caller that invokes the product-neutral central scheduler with the exact repository, protected `master` branch, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, job-scoped OIDC, and only the established scheduler credentials. - Added a trusted pull-request comment router for `@cwl-noema-review` and review-only `@opencode-agent` dispatches, with an organization sweep, exact-head receipts, repository allowlisting, fixed runners, immutable checkout pins, and a permanent 100% statement/branch/docstring quality gate. - Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence. - Added a permanent exact-head contract workflow for the hourly review-repair scheduler, immutable reusable-workflow source, NVIDIA NIM model boundary, credential isolation, and fail-closed unattended-agent permissions. diff --git a/CLAUDE.md b/CLAUDE.md index 7127d3c1c..7c12bea52 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -114,6 +114,9 @@ repeatable compile command. without running the test suite will break CI. - **100% coverage and 100% docstrings on `scripts/ci/`** are hard gates, not aspirations. New helper code needs matching tests and docstrings. +- **Product hourly callers** stay thin. Do not hard-code nonnest2, naruon, or Keyverse + into `pr-review-fix-scheduler.yml`. The model credential remains `NVIDIA_NIM_API_KEY` + on the worker, never `COPILOT_GITHUB_TOKEN`. - **`pull_request_target` trust boundary.** The required review workflows run the *base branch's* trusted scripts. A PR that edits the trusted review workflows can fail its own checks until the base branch catches up; a same-head manual `workflow_dispatch` Strix run may supply review evidence diff --git a/docs/doctoring/nonnest2-hourly-review-caller.md b/docs/doctoring/nonnest2-hourly-review-caller.md new file mode 100644 index 000000000..eba36c787 --- /dev/null +++ b/docs/doctoring/nonnest2-hourly-review-caller.md @@ -0,0 +1,140 @@ +# nonnest2 hourly review-repair caller + +검토 기준일: **2026-08-17** + +## Decision + +ContextualWisdomLab operates one protected hourly caller for +`ContextualWisdomLab/nonnest2` (R package that compares non-nested model +fit and distinguishability via Vuong tests). The caller runs at minute +16, delegates to the product-neutral central review-fix scheduler, +inspects at most 50 open pull requests targeting protected `master`, and +dispatches at most one bounded repair per heartbeat. + +A paying buyer of psychometric model comparison would feel live nonnest2 +pull requests stalling while hourly NVIDIA NIM repair scanned only +Clearfolio, DiskSage, and fast-mlsirm. Live heads such as +ContextualWisdomLab/nonnest2#89 (exported-function input validation), +ContextualWisdomLab/nonnest2#86 (main-function input validation), +ContextualWisdomLab/nonnest2#84 (call-stack leak on unvalidated errors), +and ContextualWisdomLab/nonnest2#90 (vapply matrix-row bound) target +`master` and never enter those other callers. + +The caller does not implement review or mutation logic itself. nonnest2 +remains standalone; fast-mlsirm and kaefa consume Vuong comparisons +without owning the R runtime. Privileged automation stays in +`ContextualWisdomLab/.github`. + +## Root-cause analysis and remediation feasibility + +The reusable worker performs exact-head root-cause analysis and tests +remediation feasibility before it edits. The reusable worker must: + +1. Refetch the exact live head, base, reviews, checks, changed paths, and + writer state. +2. Establish the causal chain rather than repeat the terminal symptom. +3. Enumerate materially distinct minimal remedies. +4. Reject remedies that lack writer authority, cross sealed paths, require + unavailable credentials or protected-setting changes, violate stack + order, cannot be verified, or do not alter the diagnosed cause. +5. Dispatch at most one feasible repair. Otherwise leave the tree + unchanged. + +A queued or pending check remains a merge blocker but is not itself a +code finding. The independent non-author approval remains an external +authorization gate and is never synthesized by the repair worker. The +worker cannot approve, merge, release, resolve review findings by +inference, change protection, or manufacture passing checks. + +## Cadence and concurrency + +The caller uses a single concurrency group and `cancel-in-progress: false`. +This preserves an in-flight bounded RCA instead of discarding Vuong +evidence when the next hourly heartbeat arrives. The reusable scheduler +cancels only its own superseded short queue scan. + +The caller sets a **two-hour same-head retry floor**. Central OpenCode and +NVIDIA NIM work, plus validation or log-likelihood analysis, can +legitimately approach two hours. An hourly redispatch of the same +unchanged head would create duplicate writer pressure rather than faster +remediation. + +GitHub scheduled workflows can be delayed under load and execute only +from the default branch. The cron expression is a heartbeat, not a +real-time SLA. + +## Credential and model boundary + +The caller keeps workflow `GITHUB_TOKEN` at `contents: read` and grants +the reusable job `id-token: write` so the central scheduler can mint the +OpenCode GitHub App token from GitHub OIDC when the mapped PAT is absent +(GitHub, n.d.-c). It maps only `PR_REVIEW_MERGE_TOKEN` and +`OPENCODE_APPROVE_TOKEN`. It never uses `secrets: inherit`, receives +`NVIDIA_NIM_API_KEY`, or introduces `COPILOT_GITHUB_TOKEN`. CWE-250 +forbids executing the caller with write or model privileges it does not +need (MITRE, 2026). + +Model execution remains inside the central worker. The model credential +is the GitHub Secret `NVIDIA_NIM_API_KEY`; the caller does not receive or +forward it. + +Before protected-master activation, the repository variable +`OPENCODE_REPOSITORY_DISPATCH_TARGETS` must contain the exact +`ContextualWisdomLab/nonnest2` target. Missing or mismatched +configuration fails before mutation credential materialization. + +## Security, standalone operation, and modularity + +The caller adds no nonnest2 runtime dependency, database object, network +endpoint, tenant authority, or product credential. nonnest2 continues to +run as a standalone R package. fast-mlsirm, kaefa, and other CWL +services may consume its tests, but they cannot weaken its exact-head, +approval, or security gates. + +## Verification and rollback + +Machine-checkable contracts require the exact target/base, minute 16 +cadence, non-cancelling single-flight group, one dispatch, two-hour +retry floor, explicit secret mapping, read-only contents plus job-scoped +`id-token: write`, focused path-filter coverage, and absence of model or +Copilot credentials. Independent `pull_request`, `push`, and `compileall` +path blocks must each name the caller, doctoring, or contract they own. + +After source integration, closure requires a scheduled or manual +protected-master consumer run proving the exact nonnest2 repository and +`master` base. Source checks alone are not protected-master operational acceptance. +Merge still requires zero unresolved valid findings and a +qualifying independent non-author approval. + +Rollback removes the nonnest2 caller, its focused test, doctoring, and +central path-filter/documentation entries. It must not remove scheduler +dispatch validation or affect independent product callers. + +## APA 7th references + +GitHub, Inc. (n.d.-a). *Events that trigger workflows*. GitHub Docs. +Retrieved August 17, 2026, from +https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule + +GitHub, Inc. (n.d.-b). *Reuse workflows*. GitHub Docs. Retrieved August +17, 2026, from +https://docs.github.com/en/actions/how-tos/sharing-automations/reuse-workflows + +GitHub, Inc. (n.d.-c). *Automatic token authentication*. GitHub Docs. +Retrieved August 17, 2026, from +https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token + +MITRE. (2026). *CWE-250: Execution with unnecessary privileges*. +https://cwe.mitre.org/data/definitions/250.html + +National Institute of Standards and Technology. (2022). *Secure software +development framework (SSDF) version 1.1: Recommendations for mitigating +the risk of software vulnerabilities* (NIST Special Publication 800-218). +https://doi.org/10.6028/NIST.SP.800-218 + +NVIDIA. (n.d.). *NVIDIA NIM for large language models documentation*. +Retrieved August 17, 2026, from +https://docs.nvidia.com/nim/large-language-models/latest/ + +OpenCode. (n.d.). *OpenCode documentation*. Retrieved August 17, 2026, +from https://opencode.ai/docs/ diff --git a/tests/test_nonnest2_hourly_review_caller.py b/tests/test_nonnest2_hourly_review_caller.py new file mode 100644 index 000000000..0830c0870 --- /dev/null +++ b/tests/test_nonnest2_hourly_review_caller.py @@ -0,0 +1,166 @@ +"""Contract tests for nonnest2's bounded hourly review-repair caller.""" + +from pathlib import Path + + +CALLER = Path(".github/workflows/nonnest2-hourly-review-repair.yml") +DOCTORING = Path("docs/doctoring/nonnest2-hourly-review-caller.md") +QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml") +SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml") + + +def _read(path: Path) -> str: + """Return one repository contract file as UTF-8 text.""" + return path.read_text(encoding="utf-8") + + +def _yaml_path_entries(block: str) -> set[str]: + """Return dashed YAML path entries from one trigger or compileall block.""" + entries: set[str] = set() + for raw_line in block.splitlines(): + stripped = raw_line.strip() + if stripped.startswith("- "): + entries.add(stripped[2:].strip()) + elif stripped.startswith("tests/") or stripped.startswith("scripts/"): + entries.add(stripped.rstrip(" \\")) + return entries + + +def _trigger_path_block(quality: str, trigger: str) -> str: + """Return the dashed path list under one named workflow trigger.""" + marker = f" {trigger}:\n paths:\n" + start = quality.index(marker) + len(marker) + lines: list[str] = [] + for line in quality[start:].splitlines(): + if line.startswith(" - "): + lines.append(line) + continue + if line.strip() == "": + continue + break + return "\n".join(lines) + + +def _compileall_block(quality: str) -> str: + """Return the compileall argument list from the focused quality job.""" + marker = "python -m compileall -q \\" + start = quality.index(marker) + remainder = quality[start:] + end = remainder.find("\n git ") + return remainder if end < 0 else remainder[:end] + + +def test_nonnest2_caller_is_hourly_bounded_and_non_cancelling() -> None: + """nonnest2 receives one realistic Vuong-test repair without cancellation.""" + caller = _read(CALLER) + + assert 'cron: "16 * * * *"' in caller + assert "group: nonnest2-hourly-review-repair" in caller + assert "cancel-in-progress: false" in caller + assert "uses: ./.github/workflows/pr-review-fix-scheduler.yml" in caller + assert "target_repository: ContextualWisdomLab/nonnest2" in caller + assert "base_branch: master" in caller + assert 'max_prs: "50"' in caller + assert 'max_dispatches: "1"' in caller + assert 'retry_hours: "2"' in caller + + +def test_nonnest2_caller_preserves_oidc_and_explicit_secret_scope() -> None: + """The queue scanner maps established credentials without model secrets.""" + caller = _read(CALLER) + workflow_scope, jobs_scope = caller.split("\njobs:\n", maxsplit=1) + + assert "\npermissions:\n contents: read\n" in workflow_scope + assert ( + "\n permissions:\n contents: read\n id-token: write\n" + in jobs_scope + ) + assert "PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}" in caller + assert "OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}" in caller + assert "secrets: inherit" not in caller + assert "NVIDIA_NIM_API_KEY" not in caller + assert "COPILOT_GITHUB_TOKEN" not in caller + for forbidden in ( + "actions: write", + "contents: write", + "issues: write", + "pull-requests: write", + "statuses: write", + ): + assert forbidden not in caller + + +def test_nonnest2_target_is_not_hard_coded_in_shared_scheduler() -> None: + """Product identity remains in the thin caller rather than the engine.""" + assert "ContextualWisdomLab/nonnest2" not in _read(SCHEDULER) + + +def test_nonnest2_doctoring_records_vuong_activation_and_credentials() -> None: + """Operators retain target-allowlist, Vuong tests, and approval prerequisites.""" + doctoring = _read(DOCTORING) + + for phrase in ( + "ContextualWisdomLab/nonnest2", + "OPENCODE_REPOSITORY_DISPATCH_TARGETS", + "independent non-author approval", + "NVIDIA_NIM_API_KEY", + "COPILOT_GITHUB_TOKEN", + "id-token: write", + "two-hour same-head retry floor", + "root-cause analysis", + "remediation feasibility", + "protected-master operational acceptance", + "APA 7th references", + "ContextualWisdomLab/nonnest2#89", + "ContextualWisdomLab/nonnest2#86", + "ContextualWisdomLab/nonnest2#84", + "ContextualWisdomLab/nonnest2#90", + ): + assert phrase in doctoring + + +def test_path_block_helpers_keep_trigger_and_compileall_sets_disjoint() -> None: + """A path listed only under push or compileall must not satisfy pull_request.""" + quality = ( + "on:\n" + " pull_request:\n" + " paths:\n" + " - .github/workflows/nonnest2-hourly-review-repair.yml\n" + " push:\n" + " paths:\n" + " - docs/doctoring/nonnest2-hourly-review-caller.md\n" + " python -m compileall -q \\\n" + " tests/test_nonnest2_hourly_review_caller.py\n" + " git diff --check\n" + ) + + pull_request_paths = _yaml_path_entries(_trigger_path_block(quality, "pull_request")) + push_paths = _yaml_path_entries(_trigger_path_block(quality, "push")) + compileall_paths = _yaml_path_entries(_compileall_block(quality)) + + assert pull_request_paths == {".github/workflows/nonnest2-hourly-review-repair.yml"} + assert push_paths == {"docs/doctoring/nonnest2-hourly-review-caller.md"} + assert compileall_paths == {"tests/test_nonnest2_hourly_review_caller.py"} + assert "docs/doctoring/nonnest2-hourly-review-caller.md" not in pull_request_paths + assert ".github/workflows/nonnest2-hourly-review-repair.yml" not in compileall_paths + + +def test_focused_quality_workflow_tracks_nonnest2_contracts() -> None: + """Caller, test, and doctoring edits always rerun the focused gate.""" + quality = _read(QUALITY_WORKFLOW) + pull_request_paths = _yaml_path_entries(_trigger_path_block(quality, "pull_request")) + push_paths = _yaml_path_entries(_trigger_path_block(quality, "push")) + compileall_paths = _yaml_path_entries(_compileall_block(quality)) + caller = ".github/workflows/nonnest2-hourly-review-repair.yml" + doctoring = "docs/doctoring/nonnest2-hourly-review-caller.md" + contract = "tests/test_nonnest2_hourly_review_caller.py" + + assert caller in pull_request_paths + assert doctoring in pull_request_paths + assert contract in pull_request_paths + assert caller in push_paths + assert doctoring in push_paths + assert contract in push_paths + assert contract in compileall_paths + assert caller not in compileall_paths + assert doctoring not in compileall_paths From a22af10a78b494a375a55ff960938fe6f9b371c5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 19:04:20 -0700 Subject: [PATCH 2/6] fix(ci): resolve nonnest2 caller conflict with current main --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index e748a923a..bd6a96a11 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -5,4 +5,5 @@ Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md). Conflict-scope roots fail closed when the immediate parent directory is a symbolic link. +OriginWeave hourly NVIDIA NIM repair is a thin caller at minute 10. See [`docs/doctoring/originweave-hourly-review-caller.md`](docs/doctoring/originweave-hourly-review-caller.md). nonnest2 hourly NVIDIA NIM repair is a thin caller at minute 16. See [`docs/doctoring/nonnest2-hourly-review-caller.md`](docs/doctoring/nonnest2-hourly-review-caller.md). From d4af1aee975c833d132fa1d7bdabc7b67ce85cf6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 19:04:43 -0700 Subject: [PATCH 3/6] fix(ci): preserve current architecture while adding nonnest2 caller --- ARCHITECTURE.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 4cfcac696..3e2e70b58 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -25,6 +25,13 @@ flowchart LR Products -->|"standalone or as module"| Buyer ``` +## OriginWeave hourly caller + +`originweave-hourly-review-repair.yml` is a thin, read-only caller at minute +10. It names `ContextualWisdomLab/OriginWeave` and protected `main`, maps +only established scheduler credentials, and grants job-scoped +`id-token: write`. The reusable engine stays product-neutral. + ## nonnest2 hourly caller `nonnest2-hourly-review-repair.yml` is a thin, read-only caller at minute From 599e73aeb42bc9cc6b632fec3e4436a8e36d2961 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 19:05:26 -0700 Subject: [PATCH 4/6] fix(ci): merge nonnest2 quality paths with current main --- .../hourly-nvidia-nim-review-repair.yml | 30 ++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/.github/workflows/hourly-nvidia-nim-review-repair.yml b/.github/workflows/hourly-nvidia-nim-review-repair.yml index 869174372..db7224f5a 100644 --- a/.github/workflows/hourly-nvidia-nim-review-repair.yml +++ b/.github/workflows/hourly-nvidia-nim-review-repair.yml @@ -6,17 +6,25 @@ on: - .github/workflows/pr-review-fix-scheduler.yml - scripts/ci/pr_review_fix_scheduler.py - .github/workflows/pr-review-autofix.yml + - .github/workflows/bandscope-hourly-review-repair.yml - .github/workflows/clearfolio-hourly-review-repair.yml - .github/workflows/disksage-hourly-review-repair.yml - .github/workflows/fast-mlsirm-hourly-review-repair.yml + - .github/workflows/github-hourly-review-repair.yml + - .github/workflows/governance-risk-compliance-hourly-review-repair.yml - .github/workflows/hourly-nvidia-nim-review-repair.yml - .github/workflows/nonnest2-hourly-review-repair.yml + - .github/workflows/originweave-hourly-review-repair.yml - scripts/ci/pr_review_conflict_scope.py - scripts/ci/pr_review_autofix_context.py + - tests/test_bandscope_hourly_review_caller.py - tests/test_disksage_hourly_review_caller.py - tests/test_fast_mlsirm_hourly_review_caller.py + - tests/test_github_hourly_conflict_repair.py + - tests/test_governance_risk_compliance_hourly_review_caller.py - tests/test_hourly_scheduler_runtime_budget.py - tests/test_nonnest2_hourly_review_caller.py + - tests/test_originweave_hourly_review_caller.py - tests/test_hourly_autofix_context_quality_gate.py - tests/test_pr_review_conflict_scope.py - tests/test_pr_review_conflict_scope_control_files.py @@ -30,28 +38,40 @@ on: - tests/test_pr_review_autofix_nvidia_nim_contract.py - tests/test_pr_review_autofix_writer_security_contract.py - docs/automation/hourly-review-repair.md + - docs/doctoring/bandscope-hourly-review-caller.md - docs/doctoring/clearfolio-hourly-review-caller.md - docs/doctoring/conflict-control-evidence-isolation.md - docs/doctoring/disksage-hourly-review-caller.md - docs/doctoring/fast-mlsirm-hourly-review-caller.md + - docs/doctoring/github-hourly-conflict-repair.md + - docs/doctoring/governance-risk-compliance-hourly-review-caller.md - docs/doctoring/hourly-nvidia-nim-autofix.md - docs/doctoring/nonnest2-hourly-review-caller.md + - docs/doctoring/originweave-hourly-review-caller.md push: paths: - .github/workflows/pr-review-fix-scheduler.yml - scripts/ci/pr_review_fix_scheduler.py - .github/workflows/pr-review-autofix.yml + - .github/workflows/bandscope-hourly-review-repair.yml - .github/workflows/clearfolio-hourly-review-repair.yml - .github/workflows/disksage-hourly-review-repair.yml - .github/workflows/fast-mlsirm-hourly-review-repair.yml + - .github/workflows/github-hourly-review-repair.yml + - .github/workflows/governance-risk-compliance-hourly-review-repair.yml - .github/workflows/hourly-nvidia-nim-review-repair.yml - .github/workflows/nonnest2-hourly-review-repair.yml + - .github/workflows/originweave-hourly-review-repair.yml - scripts/ci/pr_review_conflict_scope.py - scripts/ci/pr_review_autofix_context.py + - tests/test_bandscope_hourly_review_caller.py - tests/test_disksage_hourly_review_caller.py - tests/test_fast_mlsirm_hourly_review_caller.py + - tests/test_github_hourly_conflict_repair.py + - tests/test_governance_risk_compliance_hourly_review_caller.py - tests/test_hourly_scheduler_runtime_budget.py - tests/test_nonnest2_hourly_review_caller.py + - tests/test_originweave_hourly_review_caller.py - tests/test_hourly_autofix_context_quality_gate.py - tests/test_pr_review_conflict_scope.py - tests/test_pr_review_conflict_scope_control_files.py @@ -65,12 +85,16 @@ on: - tests/test_pr_review_autofix_nvidia_nim_contract.py - tests/test_pr_review_autofix_writer_security_contract.py - docs/automation/hourly-review-repair.md + - docs/doctoring/bandscope-hourly-review-caller.md - docs/doctoring/clearfolio-hourly-review-caller.md - docs/doctoring/conflict-control-evidence-isolation.md - docs/doctoring/disksage-hourly-review-caller.md - docs/doctoring/fast-mlsirm-hourly-review-caller.md + - docs/doctoring/github-hourly-conflict-repair.md + - docs/doctoring/governance-risk-compliance-hourly-review-caller.md - docs/doctoring/hourly-nvidia-nim-autofix.md - docs/doctoring/nonnest2-hourly-review-caller.md + - docs/doctoring/originweave-hourly-review-caller.md permissions: contents: read @@ -118,10 +142,14 @@ jobs: scripts/ci/pr_review_conflict_scope.py \ scripts/ci/pr_review_autofix_context.py \ tests/test_pr_review_conflict_scope.py \ + tests/test_bandscope_hourly_review_caller.py \ tests/test_disksage_hourly_review_caller.py \ tests/test_fast_mlsirm_hourly_review_caller.py \ + tests/test_github_hourly_conflict_repair.py \ + tests/test_governance_risk_compliance_hourly_review_caller.py \ tests/test_hourly_scheduler_runtime_budget.py \ tests/test_nonnest2_hourly_review_caller.py \ + tests/test_originweave_hourly_review_caller.py \ tests/test_pr_review_conflict_scope_control_files.py \ tests/test_hourly_autofix_context_quality_gate.py \ tests/test_pr_review_conflict_scope_git_executable.py \ @@ -133,4 +161,4 @@ jobs: tests/test_pr_review_autofix_context_head_binding.py \ tests/test_pr_review_autofix_nvidia_nim_contract.py \ tests/test_pr_review_autofix_writer_security_contract.py - git diff --check \ No newline at end of file + git diff --check From aacb0483001b044faf41046adefe8cd40fbe49a7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 19:05:58 -0700 Subject: [PATCH 5/6] chore(ci): reconcile changelog with current main --- CHANGELOG.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c1451d8bf..872968b36 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,8 @@ Semantic Versioning where the repository publishes a release. ### Added -- Added a dedicated nonnest2 hourly caller that invokes the product-neutral central scheduler with the exact repository, protected `master` branch, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, job-scoped OIDC, and only the established scheduler credentials. +- Added an hourly organization commercial-readiness coordinator that discovers writable repositories, honors enabled dedicated writer leases and fully paginated live writer runs, refetches exact repository/workflow/run/PR state before dispatch, rotates bounded review-repair and opt-in NVIDIA OpenCode product-development targets, fails nonzero on fleet-wide inspection or dispatch outages, retains three-day JSON receipts, and keeps the existing 15-minute merge scheduler authoritative. +- Added a dedicated OriginWeave hourly caller that invokes the product-neutral central scheduler with the exact repository, protected `main` branch, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, job-scoped OIDC, and only the established scheduler credentials. - Added a trusted pull-request comment router for `@cwl-noema-review` and review-only `@opencode-agent` dispatches, with an organization sweep, exact-head receipts, repository allowlisting, fixed runners, immutable checkout pins, and a permanent 100% statement/branch/docstring quality gate. - Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence. - Added a permanent exact-head contract workflow for the hourly review-repair scheduler, immutable reusable-workflow source, NVIDIA NIM model boundary, credential isolation, and fail-closed unattended-agent permissions. @@ -33,7 +34,7 @@ Semantic Versioning where the repository publishes a release. - Parsed `opencode.jsonc` as JSONC (stripping `//` and `/* */` comments outside string literals) in the reasoning-effort guard and its contract tests, instead of raw `json.loads`, which rejected the file the moment it carried its first explanatory comment (added for the `contextual-orchestrator` provider block) with `Expecting property name enclosed in double quotes`. Comment markers inside string values, such as the `$schema` URL, are left untouched. - Download the pinned `uv` 0.12.1 exporter from the official GitHub Releases URL instead of `releases.astral.sh`, which now returns HTTP 403 and blocks org-wide OpenCode `coverage-evidence`. The SHA-256 pin is unchanged. The opener may follow one hop onto `release-assets.githubusercontent.com` or `objects.githubusercontent.com` and still rejects every other host, userinfo, non-HTTPS scheme, and nondefault port (ContextualWisdomLab/.github#1109). -- Materialized base Python locks only when every package line is an exact SHA-256 pin or a bounded relative `-r`/`--requirement` include. A lone `--require-hashes` directive, a dotted include such as `./lock.txt`, or `-r other-hashes.txt` no longer enters the trusted build context. +- Excluded relative `-r` and `--requirement` referrers from generated flat base-lock publication while retaining bounded include syntax diagnostics and discovering independently complete direct `.txt` children of `requirements` directories. - Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367). - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics. - Allowed commas and ASCII parentheses in the bounded Strix changed-file path policy so legal tracked Packrat fixtures can receive exact-head security analysis, while rejecting raw `..` components before normalization and keeping controls, backslashes, whitespace ambiguity, and shell punctuation fail-closed. @@ -67,4 +68,4 @@ Semantic Versioning where the repository publishes a release. - Added DiskSage operational documentation for the hourly RCA loop, bounded retry cadence, permission model, standalone and MSA reuse, verification, rollback, and APA 7 references. - Added fast-mlsirm operational documentation for the hourly RCA loop, psychometric scientific gates, Rust ownership, bounded retry cadence, credential isolation, modular reuse, rollback, and APA 7 references. - Documented the ordinary and conflict repair write-scope parity, ignored-path and symlink inventory, Git-control-file denial, hook suppression, explicit push destination, RED/GREEN evidence, operator response, and local-versus-protected evidence boundary. -- Documented the review-authentication boundary that excludes autonomous writer control-plane paths from review-derived file authority, its test-first Strix security evidence, exact-head coverage contract, and rollback prohibition. \ No newline at end of file +- Documented the review-authentication boundary that excludes autonomous writer control-plane paths from review-derived file authority, its test-first Strix security evidence, exact-head coverage contract, and rollback prohibition. From 5086006484f1025a53b2f41dd157502aba831684 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 19:06:32 -0700 Subject: [PATCH 6/6] chore(ci): reconcile agent guidance with current main --- CLAUDE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 7c12bea52..65ee3ce81 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -114,7 +114,7 @@ repeatable compile command. without running the test suite will break CI. - **100% coverage and 100% docstrings on `scripts/ci/`** are hard gates, not aspirations. New helper code needs matching tests and docstrings. -- **Product hourly callers** stay thin. Do not hard-code nonnest2, naruon, or Keyverse +- **Product hourly callers** stay thin. Do not hard-code OriginWeave, naruon, or Keyverse into `pr-review-fix-scheduler.yml`. The model credential remains `NVIDIA_NIM_API_KEY` on the worker, never `COPILOT_GITHUB_TOKEN`. - **`pull_request_target` trust boundary.** The required review workflows run the *base branch's*