feat(automation): run contextual-orchestrator hourly NVIDIA NIM review repair

[seonghobae]

Buyer-perceivable gap

Commercial contextual-orchestrator buyers still had no hourly NVIDIA NIM
review-repair heartbeat after Clearfolio, DiskSage, and fast-mlsirm already
received one. Inkspan/naruon (#796) and BandScope (#817) callers remain
independent heads.

Unique source

Thin minute-17 caller only. Queue classification, RCA, repair dispatch, and
NVIDIA_NIM_API_KEY stay on the existing central worker. The caller never
receives COPILOT_GITHUB_TOKEN or secrets: inherit.

Checks 재검증

Local pytest+coverage+interrogate ran twice: 1121 passed, coverage 100%,
interrogate 100%.

GitHub review/Checks wait is not a blocker.

---

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 4 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cbbf2655-39f0-4231-aeea-29375f51da3f

📥 Commits

Reviewing files that changed from the base of the PR and between 6479989 and ac4271a.

📒 Files selected for processing (9)

• .github/workflows/contextual-orchestrator-hourly-review-repair.yml
• .github/workflows/hourly-nvidia-nim-review-repair.yml
• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• docs/automation/hourly-review-repair.md
• docs/doctoring/contextual-orchestrator-hourly-review-caller.md
• tests/test_contextual_orchestrator_hourly_review_caller.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Rebased onto current main 9e9f59f3ac1e96a960c021b131d768c238f4c21a and pushed exact head 21a74c39. Added the thin minute-17 contextual-orchestrator caller with one-dispatch/non-cancelling/read-only secret scope and wired its caller/test/doc paths into the quality workflow. Focused verification: 8 passed; actionlint passed.

[seonghobae]

Current-head evidence: rebased the contextual-orchestrator hourly caller onto main bbedc1a. Exact head 13de64b. Caller contract tests: 5 passed; changed workflows passed actionlint; git diff --check passed. Protected hosted checks remain; no bypass used.

[seonghobae]

Rebased the contextual-orchestrator hourly caller onto current main@c47bee59 and corrected its reusable-scheduler boundary: job-scoped contents:read plus id-token:write is now explicit for the OpenCode App-token exchange. Exact head: 7e39946. Focused caller tests: 5 passed; actionlint, compileall, and diff check passed.

[seonghobae]

@OpenCode Please review exact current head 7e39946 against base main@c47bee591c3d95bd305f2130833ed3a4780d2d1d.

[seonghobae]

@opencode-agent please review current PR HEAD ac4271a, with particular attention to reusable-workflow trust boundaries and secret exposure. Re-run required checks and report only exact-head findings.

[seonghobae]

Current HEAD ac4271ada604f382b31605d6c18ba20626e1d1ef addresses the Strix privilege finding by removing unnecessary id-token: write from the contextual-orchestrator caller. The caller remains read-only, forwards only the established scheduler credentials, and does not checkout or execute target PR code. Evidence: focused caller/scheduler contract tests (32 passed), actionlint, Ruff, and git diff --check passed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Closing this as superseded by #1178, the focused current-base owner lane for the same four core caller/workflow/test/doc paths.

The protected-main pr-review-fix-scheduler.yml now performs GitHub OIDC token exchange and declares id-token: write; this PR's test/documentation contract explicitly forbidding that caller permission is stale and would prevent the supported credential path. #1178 carries the current gateway contract, explicit unreviewed-conflict repair, bounded retry, and the #1168 activation dependency without the older NVIDIA-NIM-only framing.

No review threads are open here. Keeping one writer for these source paths avoids conflicting automation definitions.