ci: schedule hourly GRC review repair

.github/workflows/governance-risk-compliance-hourly-review-repair.yml

@@ -0,0 +1,28 @@
+name: Governance Risk Compliance Hourly Review Repair
+
+on:
+  schedule:
+    # Minute 43 avoids minute-zero pressure and the existing product callers.
+    - cron: "43 * * * *"
+
+concurrency:
+  group: governance-risk-compliance-hourly-review-repair
+  # Preserve an in-flight exact-head RCA when the next heartbeat arrives.
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch-review-repair:
+    uses: ./.github/workflows/pr-review-fix-scheduler.yml
+    with:
+      target_repository: ContextualWisdomLab/governance-risk-compliance
+      base_branch: develop
+      max_prs: "50"
+      max_dispatches: "1"
+      # Central OpenCode, Noema, Strix, and security evidence can exceed one hour.
+      retry_hours: "2"
+    secrets:
+      PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
+      OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -9,12 +9,14 @@ on:
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
+      - .github/workflows/governance-risk-compliance-hourly-review-repair.yml
       - .github/workflows/hourly-nvidia-nim-review-repair.yml
       - .github/workflows/originweave-hourly-review-repair.yml
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
+      - tests/test_governance_risk_compliance_hourly_review_caller.py
       - tests/test_hourly_scheduler_runtime_budget.py
       - tests/test_originweave_hourly_review_caller.py
       - tests/test_hourly_autofix_context_quality_gate.py
@@ -34,6 +36,7 @@ on:
       - docs/doctoring/conflict-control-evidence-isolation.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
+      - docs/doctoring/governance-risk-compliance-hourly-review-caller.md
       - docs/doctoring/hourly-nvidia-nim-autofix.md
       - docs/doctoring/originweave-hourly-review-caller.md
   push:
@@ -44,12 +47,14 @@ on:
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
+      - .github/workflows/governance-risk-compliance-hourly-review-repair.yml
       - .github/workflows/hourly-nvidia-nim-review-repair.yml
       - .github/workflows/originweave-hourly-review-repair.yml
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
+      - tests/test_governance_risk_compliance_hourly_review_caller.py
       - tests/test_hourly_scheduler_runtime_budget.py
       - tests/test_originweave_hourly_review_caller.py
       - tests/test_hourly_autofix_context_quality_gate.py
@@ -69,6 +74,7 @@ on:
       - docs/doctoring/conflict-control-evidence-isolation.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
+      - docs/doctoring/governance-risk-compliance-hourly-review-caller.md
       - docs/doctoring/hourly-nvidia-nim-autofix.md
       - docs/doctoring/originweave-hourly-review-caller.md
 
@@ -120,6 +126,7 @@ jobs:
             tests/test_pr_review_conflict_scope.py \
             tests/test_disksage_hourly_review_caller.py \
             tests/test_fast_mlsirm_hourly_review_caller.py \
+            tests/test_governance_risk_compliance_hourly_review_caller.py \
             tests/test_hourly_scheduler_runtime_budget.py \
             tests/test_originweave_hourly_review_caller.py \
             tests/test_pr_review_conflict_scope_control_files.py \
@@ -133,4 +140,4 @@ jobs:
             tests/test_pr_review_autofix_context_head_binding.py \
             tests/test_pr_review_autofix_nvidia_nim_contract.py \
             tests/test_pr_review_autofix_writer_security_contract.py
-          git diff --check
+          git diff --check

docs/doctoring/governance-risk-compliance-hourly-review-caller.md

@@ -0,0 +1,51 @@
+# Governance Risk Compliance Hourly Review Caller
+
+## Decision
+
+`ContextualWisdomLab/.github` owns the hourly review-repair scheduler and its privileged OpenCode worker. The GRC product receives a small caller at minute 43 of every hour. Each heartbeat inspects up to 50 open pull requests, dispatches at most one repair, and preserves an in-flight writer. The caller targets the product's protected `develop` branch.
+
+The scheduler requires root-cause analysis and remediation feasibility before a branch mutation. A two-hour same-head retry floor accommodates central OpenCode, Noema, Strix, security, and coverage work without treating provider or runner latency as a source defect or dispatching duplicate writers.
+
+## Product ownership boundary
+
+`ContextualWisdomLab/governance-risk-compliance` owns policy, control, risk, evidence, and compliance-audit truth. It does not absorb central CI/security implementation or another CWL product's authority.
+
+- Keyverse owns identity and federation. A repair must not invent authentication inside the GRC product or weaken its local-only preview boundary.
+- GRC retains exact operational evidence values. Repair must not introduce blanket or destructive PII masking; it must preserve authenticated purpose and tenant authorization, encryption, audit, retention, and purpose-specific omission of unrelated fields.
+- Orgmetra, accounting, billing, naruon, enterprise architecture, and semantic data products remain contract consumers or evidence producers within their own ownership boundaries.
+- Product repair may change the validated same-repository PR branch only. Central workflows, credentials, rulesets, and provider configuration remain owned by `.github`.
+
+## Credential and model boundary
+
+The caller keeps the workflow-generated token read-only and forwards only the established scheduler mutation credentials. It contains no model-provider secret.
+
+The central worker may use `NVIDIA_NIM_API_KEY` through its reviewed credential boundary. The caller and GRC repository must not use `COPILOT_GITHUB_TOKEN`. The independent read-only reviewer keeps its separate credential and model-pool contract; review and write-capable repair remain distinct controls.
+
+The scheduler dispatches at most one repair per heartbeat. A repair worker cannot approve its own change, reinterpret failed or queued checks as success, lower protection, merge, publish, or release.
+
+## Exact-head merge contract
+
+A GRC pull request may merge only after the unchanged current head has:
+
+1. terminal-success product, coverage, SAST, security, and supply-chain checks;
+2. zero valid unresolved review findings;
+3. a current-head semantic review verdict;
+4. independent non-author approval when required by live protection;
+5. a compatible live base and ordinary expected-head merge authority; and
+6. current documentation, CHANGELOG, ADR, and APA 7th references for standards-backed decisions.
+
+Queued, pending, skipped-required, cancelled, stale, predecessor-head, local-only, author-only, synthetic, or model-only evidence is not acceptance. Review or check latency is not a blocker to examining the next eligible PR or buyer-visible product gap, but it is never permission to bypass a gate.
+
+## Activation and fail-closed behavior
+
+GitHub scheduled workflows run from the default branch. The heartbeat becomes active only after this caller reaches protected `.github` `main`. The central scheduler also requires `ContextualWisdomLab/governance-risk-compliance` in the organization target allowlist. A missing target or mutation authority fails closed.
+
+The caller does not create a second provider configuration, review agent, or merge engine. Rollback removes the caller, focused contract, quality-workflow path tracking, and this doctoring record together; it does not weaken the reusable central scheduler.
+
+## References
+
+GitHub, Inc. (n.d.-a). *Events that trigger workflows*. GitHub Docs. Retrieved August 18, 2026, from https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
+
+GitHub, Inc. (n.d.-b). *Reusing workflow configurations*. GitHub Docs. Retrieved August 18, 2026, from https://docs.github.com/actions/using-workflows/reusing-workflows
+
+National Institute of Standards and Technology. (2024). *The NIST Cybersecurity Framework (CSF) 2.0* (NIST CSWP 29). U.S. Department of Commerce. https://doi.org/10.6028/NIST.CSWP.29

tests/test_governance_risk_compliance_hourly_review_caller.py

@@ -0,0 +1,84 @@
+"""Contract tests for the GRC product's bounded hourly review-repair caller."""
+
+from pathlib import Path
+
+
+CALLER = Path(".github/workflows/governance-risk-compliance-hourly-review-repair.yml")
+DOCTORING = Path("docs/doctoring/governance-risk-compliance-hourly-review-caller.md")
+QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml")
+
+
+def _read(path: Path) -> str:
+    """Return one repository contract file as UTF-8 text."""
+    return path.read_text(encoding="utf-8")
+
+
+def test_grc_caller_is_hourly_bounded_and_non_cancelling() -> None:
+    """GRC receives one realistic exact-head repair opportunity per heartbeat."""
+    caller = _read(CALLER)
+
+    assert 'cron: "43 * * * *"' in caller
+    assert "group: governance-risk-compliance-hourly-review-repair" in caller
+    assert "cancel-in-progress: false" in caller
+    assert "uses: ./.github/workflows/pr-review-fix-scheduler.yml" in caller
+    assert "target_repository: ContextualWisdomLab/governance-risk-compliance" in caller
+    assert "base_branch: develop" in caller
+    assert 'max_prs: "50"' in caller
+    assert 'max_dispatches: "1"' in caller
+    assert 'retry_hours: "2"' in caller
+
+
+def test_grc_caller_preserves_credentials_and_read_only_scope() -> None:
+    """The caller maps scheduler credentials without exposing provider secrets."""
+    caller = _read(CALLER)
+    workflow_scope, jobs_scope = caller.split("\njobs:\n", maxsplit=1)
+    pr_review_secret = "$" + "{{ secrets.PR_REVIEW_MERGE_TOKEN }}"
+    opencode_secret = "$" + "{{ secrets.OPENCODE_APPROVE_TOKEN }}"
+
+    assert "\npermissions:\n  contents: read\n" in workflow_scope
+    assert "\n    permissions:\n" not in jobs_scope
+    assert f"PR_REVIEW_MERGE_TOKEN: {pr_review_secret}" in caller
+    assert f"OPENCODE_APPROVE_TOKEN: {opencode_secret}" in caller
+    assert "secrets: inherit" not in caller
+    assert "NVIDIA_NIM_API_KEY" not in caller
+    assert "COPILOT_GITHUB_TOKEN" not in caller
+    for forbidden in (
+        "actions: write",
+        "contents: write",
+        "issues: write",
+        "pull-requests: write",
+        "statuses: write",
+    ):
+        assert forbidden not in caller
+
+
+def test_grc_doctoring_records_product_and_governance_bounds() -> None:
+    """Operators retain RCA, ownership, credential, and approval contracts."""
+    doctoring = _read(DOCTORING)
+
+    for phrase in (
+        "root-cause analysis",
+        "remediation feasibility",
+        "two-hour same-head retry floor",
+        "policy, control, risk, evidence, and compliance-audit truth",
+        "Keyverse",
+        "independent non-author approval",
+        "NVIDIA_NIM_API_KEY",
+        "COPILOT_GITHUB_TOKEN",
+        "ContextualWisdomLab/governance-risk-compliance",
+        "APA 7th references",
+    ):
+        assert phrase in doctoring
+
+
+def test_focused_quality_workflow_tracks_grc_contracts() -> None:
+    """Caller, doctoring, and contract edits always rerun exact-head verification."""
+    quality = _read(QUALITY_WORKFLOW)
+
+    assert quality.count(
+        ".github/workflows/governance-risk-compliance-hourly-review-repair.yml"
+    ) == 2
+    assert quality.count(
+        "docs/doctoring/governance-risk-compliance-hourly-review-caller.md"
+    ) == 2
+    assert quality.count("tests/test_governance_risk_compliance_hourly_review_caller.py") == 3