feat(automation): run aFIPC hourly NVIDIA NIM review repair

[seonghobae]

Buyer-perceivable gap

Hourly NVIDIA NIM review repair never scanned ContextualWisdomLab/aFIPC. Live Fixed-Item Parameter Calibration pull requests such as ContextualWisdomLab/aFIPC#259, ContextualWisdomLab/aFIPC#263, ContextualWisdomLab/aFIPC#261, and ContextualWisdomLab/aFIPC#262 target protected master and stalled while Clearfolio, DiskSage, and fast-mlsirm received heartbeats.

Change

• Thin scheduled caller at minute 2, base_branch: master, one dispatch, two-hour same-head retry.
• Job-scoped id-token: write so the reusable scheduler can mint the OpenCode App fallback from GitHub OIDC.
• Maps only PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN. Never NVIDIA_NIM_API_KEY on the caller. Never COPILOT_GITHUB_TOKEN.
• Independent pull_request / push / compileall path contracts.
• Local 2× pytest + coverage + interrogate at 100% on this head.

Do not self-approve. Merge remains subject to two-approval + last-pusher ruleset. GitHub review/Checks wait is not a blocker.

Refs ContextualWisdomLab/aFIPC#259, ContextualWisdomLab/aFIPC#263, ContextualWisdomLab/aFIPC#261, and ContextualWisdomLab/aFIPC#262.

---

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 403b4c5c-9777-47df-8bb5-d936cc130904

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Rebased onto current main 9e9f59f3; resolved shared hourly-contract conflicts while preserving aFIPC paths. Caller tests passed (6 passed); actionlint passed on both changed workflows; diff check passed. Project #1 is In Progress.

[seonghobae]

Current-head maintenance: rebased the aFIPC hourly caller onto main bbedc1a. Exact head: f22a456. Caller contract tests: 34 passed; actionlint and git diff --check passed. Protected hosted checks remain; no bypass used.

[seonghobae]

Rebased onto current origin/main c47bee5 and preserved the existing hourly caller path set.

Current HEAD: 2fb50b3

Validation on this HEAD:

• pytest -q tests/test_afipc_hourly_review_caller.py: 6 passed
• actionlint: caller and hourly dispatcher passed
• compileall and git diff --check passed

@OpenCode review this exact HEAD after the rebase.

[seonghobae]

@opencode-agent review the exact current head $head_oid against protected base 2cce96f. Rebased this hourly caller onto current main; contract tests, changed-workflow actionlint, and diff --check were run on the exact rebased source. The caller keeps explicit target identity, bounded dispatch/retry, OIDC/approved secret scope, and no COPILOT token forwarding. Treat predecessor reviews/checks as historical and do not approve from queued or status-only evidence.

[seonghobae]

Validated exact head 5486857.

Addressed the remaining review finding by removing the duplicate quality-gates sentence from ARCHITECTURE.md. The earlier caller-boundary and CLAUDE.md findings remain corrected in this same PR.

Verification on this head:

• python3 -m pytest -q: 1289 passed, 16 subtests passed
• git diff --check: passed
• no duplicate quality-gates fragment remains

The PR is still subject to independent approvals and terminal protected Checks; no bypass or self-approval was used.

[seonghobae]

Review disposition

The accounting-information-platform path-filter observation is pre-existing scope information, not a defect in this aFIPC caller. It is recorded for the central caller inventory and this informational thread is resolved. Current-head Checks and qualifying independent approvals remain required before normal merge.

[seonghobae]

Exact-head follow-up disposition

• Exact head: 4d70c472
• Updated the aFIPC scheduler comment to enumerate the complete occupied/planned hourly registry, including the currently allocated newsdom-api minute 18 and all intervening slots.
• Verification: 6 passed in tests/test_afipc_hourly_review_caller.py; git diff --check passed.
• This was a documentation-only scheduler registry correction; no credential, target, base branch, or dispatch behavior changed.
• Normal protected merge only; no emergency bypass criteria are met.

[devin-ai-integration]

Devin Review found 0 new potential issues.

[seonghobae]

Exact-head lock repair pushed as 4f0f97e from e1d673e. Updated the hashed pip audit runtime from pip 26.1.2 to pip 26.2.1 with exact hashes, without changing the hourly caller implementation. The same lock has already passed local pip-audit in this maintenance loop; hosted checks and exact-head approval must be re-evaluated. No bypass or force push was used.

[opencode-agent]

OpenCode Review Overview

• Head SHA: e6694c9f420721fdd968abddc779d309079dd5bc
• Workflow run: 32556867978
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

B[\"pr-review-fix-scheduler.yml\"] --> C[\"target repository dispatch\"] --> D[\"contract and security gates\"]; CodeGraph indexed 209 files with 3,808 nodes and 8,777 edges, and identified the focused caller-test reachability. PoC/execution: No browser or runtime UI surface; source/diff probes and bounded Coverage execution evidence were used, with no untrusted command claim. DDD/domain: Product identity remains in the thin caller while the reusable engine remains product-neutral. CDD/context: ARCHITECTURE.md, CLAUDE.md, doctoring documentation, workflow paths, and contract tests are aligned. Similar issues: Sibling hourly callers use the same bounded caller pattern and explicit secret scope. Claim/concept check: The aFIPC target, protected master branch, hourly cadence, bounded dispatch, retry floor, and credential claims are reflected across workflow, docs, and tests. Standards search: No external standards-dependent claim is material to this change. Compatibility/convention: Additive workflow and test registration follow repository conventions; no new ambiguous externally meaningful identifier was introduced. Breaking-change/backcompat: No existing reusable workflow contract or caller was changed incompatibly. Implementation completeness: The workflow, documentation, and contract tests are concrete; no executable placeholder was identified. Performance: max_dispatches=1 and the dedicated concurrency group bound scheduler load. Developer experience: The doctoring guide and focused contract test document and enforce operational expectations. User experience: aFIPC receives the intended scheduled review-repair coverage without changing product UI. Visual/DOM: Non-web workflow, documentation, and test surfaces reviewed; no DOM surface changed. Accessibility/i18n: No interactive UI or localized surface changed. Supply-chain/license: No dependency or lockfile change; no new supply-chain surface. Packaging: Existing repository Python test and workflow contracts cover the changed source/test surfaces. Security/privacy: Job-scoped id-token: write, contents: read, and explicit approved secret forwarding avoid inherited secrets and write permissions. Historical review context was reconciled against authoritative current-head evidence; no active unresolved feedback remains.\n\nApproval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.\nVerification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/afipc-hourly-review-repair.yml, .github/workflows/hourly-nvidia-nim-review-repair.yml, ARCHITECTURE.md, CLAUDE.md, docs/doctoring/afipc-hourly-review-caller.md, and 1 more.\nLinter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.\nTDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.\nCoverage: coverage execution evidence reports supported repository test suites passed.\nDocstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.\nDAG: CodeGraph/source-backed behavior map connects .github/workflows/afipc-hourly-review-repair.yml to the affected review, runtime, or workflow path and required checks.\nPoC/execution: coverage-evidence job executed on the current head and reported PASS.\nDDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.\nCDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.\nSimilar issues: changed-file history evidence was reviewed for comparable local precedents.\nClaim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.\nStandards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.\nCompatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.\nBreaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.\nPerformance: changed surfaces were checked for performance risk in bounded evidence.\nDeveloper experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.\nUser experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.\nVisual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.\nAccessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.\nSupply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.\nPackaging: package, build, test, lint, and security contracts were checked in bounded evidence.\nSecurity/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.\n","adversarial_validation":{"status":"passed","probes":[{"path":".github/workflows/afipc-hourly-review-repair.yml","line":38,"hypothesis":"The new scheduled caller could broaden the trust boundary by inheriting unrelated secrets or write permissions.","attack_or_counterexample":"Inspect the caller for secrets: inherit, model/provider credentials, or write-scoped permissions that would expose credentials or permit unintended repository mutation.","evidence":"Trusted source trace at .github/workflows/afipc-hourly-review-repair.yml:38 and the current-head contract assertions in tests/test_afipc_hourly_review_caller.py:68-90 observed only explicit PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN mappings, no secrets: inherit, no NVIDIA_NIM_API_KEY or COPILOT_GITHUB_TOKEN, and no write permissions; Coverage execution evidence reports Result: PASS and supported repository test suites passed; Trusted current-head source binding at .github/workflows/afipc-hourly-review-repair.yml:38; source-line-sha256=b1f03174d241d8bbca8a502bc9f395b7c214f6639a277e26b5893055f8be185c","outcome":"falsified"},{"path":".github/workflows/hourly-nvidia-nim-review-repair.yml","line":20,"hypothesis":"The new aFIPC caller could be omitted from the focused quality workflow, leaving its workflow, test, or documentation changes unvalidated by path-triggered checks.","attack_or_counterexample":"Trace the new caller through pull_request paths, push paths, and the focused compile/test command registration; omission from any required set would create a validation gap.","evidence":"Trusted current-head diff trace at .github/workflows/hourly-nvidia-nim-review-repair.yml:20 observed the aFIPC workflow added to the quality workflow path set; the focused hunk also observed the caller, doctoring document, and contract test added to both trigger path sets and the test added to the compileall command; Coverage execution evidence reports Result: PASS and supported repository test suites passed; Trusted current-head source binding at .github/workflows/hourly-nvidia-nim-review-repair.yml:20; source-line-sha256=d9a119f60f33d9625f5ffe8b815038846d9c0b133e52148c18fecc55ffc7f0b3","outcome":"falsified"}],"residual_risk":"The scheduled cross-repository dispatch still depends on repository-level GitHub configuration and secret availability, which are outside the bounded source and check evidence; the source-level scope and validation contracts are consistent."},"findings":[]}

-->

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (2 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (2 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: afipc-hourly-review-caller.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: afipc-hourly-review-caller.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_afipc_hourly_review_caller.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_afipc_hourly_review_caller.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Overview: Reviewed .github/workflows/afipc-hourly-review-repair.yml, .github/workflows/hourly-nvidia-nim-review-repair.yml, ARCHITECTURE.md, CLAUDE.md, docs/doctoring/afipc-hourly-review-caller.md, and tests/test_afipc_hourly_review_caller.py. Approval sufficiency: Sufficient bounded evidence for the additive workflow change. Verification posture: Current-head Coverage execution evidence reports Result: PASS, supported repository test suites passed, and no unresolved threads or completed failed checks. Linter/static: The focused quality workflow includes compileall and git diff --check; no failed check evidence was present. TDD/regression: Dedicated caller contract tests cover cadence, concurrency, target, permissions, secrets, documentation, and quality-workflow registration. Coverage: Coverage execution evidence reports supported repository test suites passed. Docstring coverage: Coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory. DAG: Base-to-head flow is represented as Mermaid DAG: flowchart LR; A["aFIPC scheduled caller"] --> B["pr-review-fix-scheduler.yml"] --> C["target repository dispatch"] --> D["contract and security gates"]; CodeGraph indexed 209 files with 3,808 nodes and 8,777 edges, and identified the focused caller-test reachability. PoC/execution: No browser or runtime UI surface; source/diff probes and bounded Coverage execution evidence were used, with no untrusted command claim. DDD/domain: Product identity remains in the thin caller while the reusable engine remains product-neutral. CDD/context: ARCHITECTURE.md, CLAUDE.md, doctoring documentation, workflow paths, and contract tests are aligned. Similar issues: Sibling hourly callers use the same bounded caller pattern and explicit secret scope. Claim/concept check: The aFIPC target, protected master branch, hourly cadence, bounded dispatch, retry floor, and credential claims are reflected across workflow, docs, and tests. Standards search: No external standards-dependent claim is material to this change. Compatibility/convention: Additive workflow and test registration follow repository conventions; no new ambiguous externally meaningful identifier was introduced. Breaking-change/backcompat: No existing reusable workflow contract or caller was changed incompatibly. Implementation completeness: The workflow, documentation, and contract tests are concrete; no executable placeholder was identified. Performance: max_dispatches=1 and the dedicated concurrency group bound scheduler load. Developer experience: The doctoring guide and focused contract test document and enforce operational expectations. User experience: aFIPC receives the intended scheduled review-repair coverage without changing product UI. Visual/DOM: Non-web workflow, documentation, and test surfaces reviewed; no DOM surface changed. Accessibility/i18n: No interactive UI or localized surface changed. Supply-chain/license: No dependency or lockfile change; no new supply-chain surface. Packaging: Existing repository Python test and workflow contracts cover the changed source/test surfaces. Security/privacy: Job-scoped id-token: write, contents: read, and explicit approved secret forwarding avoid inherited secrets and write permissions. Historical review context was reconciled against authoritative current-head evidence; no active unresolved feedback remains.

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/afipc-hourly-review-repair.yml, .github/workflows/hourly-nvidia-nim-review-repair.yml, ARCHITECTURE.md, CLAUDE.md, docs/doctoring/afipc-hourly-review-caller.md, and 1 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/afipc-hourly-review-repair.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

Adversarial validation

{"status":"passed","probes":[{"path":".github/workflows/afipc-hourly-review-repair.yml","line":38,"hypothesis":"The new scheduled caller could broaden the trust boundary by inheriting unrelated secrets or write permissions.","attack_or_counterexample":"Inspect the caller for secrets: inherit, model/provider credentials, or write-scoped permissions that would expose credentials or permit unintended repository mutation.","evidence":"Trusted source trace at .github/workflows/afipc-hourly-review-repair.yml:38 and the current-head contract assertions in tests/test_afipc_hourly_review_caller.py:68-90 observed only explicit PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN mappings, no secrets: inherit, no NVIDIA_NIM_API_KEY or COPILOT_GITHUB_TOKEN, and no write permissions; Coverage execution evidence reports Result: PASS and supported repository test suites passed; Trusted current-head source binding at .github/workflows/afipc-hourly-review-repair.yml:38; source-line-sha256=b1f03174d241d8bbca8a502bc9f395b7c214f6639a277e26b5893055f8be185c","outcome":"falsified"},{"path":".github/workflows/hourly-nvidia-nim-review-repair.yml","line":20,"hypothesis":"The new aFIPC caller could be omitted from the focused quality workflow, leaving its workflow, test, or documentation changes unvalidated by path-triggered checks.","attack_or_counterexample":"Trace the new caller through pull_request paths, push paths, and the focused compile/test command registration; omission from any required set would create a validation gap.","evidence":"Trusted current-head diff trace at .github/workflows/hourly-nvidia-nim-review-repair.yml:20 observed the aFIPC workflow added to the quality workflow path set; the focused hunk also observed the caller, doctoring document, and contract test added to both trigger path sets and the test added to the compileall command; Coverage execution evidence reports Result: PASS and supported repository test suites passed; Trusted current-head source binding at .github/workflows/hourly-nvidia-nim-review-repair.yml:20; source-line-sha256=d9a119f60f33d9625f5ffe8b815038846d9c0b133e52148c18fecc55ffc7f0b3","outcome":"falsified"}],"residual_risk":"The scheduled cross-repository dispatch still depends on repository-level GitHub configuration and secret availability, which are outside the bounded source and check evidence; the source-level scope and validation contracts are consistent."}

• Result: APPROVE
• Reason: The additive aFIPC caller, scheduler registration, documentation, and contract tests are source-backed and consistent.
• Head SHA: e6694c9f420721fdd968abddc779d309079dd5bc
• Workflow run: 32556867978
• Workflow attempt: 1