chore: schedule contextual-orchestrator hourly review repair

.github/workflows/contextual-orchestrator-hourly-review-repair.yml

@@ -0,0 +1,32 @@
+name: Contextual Orchestrator Hourly Review Repair
+
+on:
+  schedule:
+    # Run at minute 17 each hour; the slot is shared with the three-hourly
+    # pr-auto-rebase workflow, so both workflows use independent concurrency groups.
+    - cron: "17 * * * *"
+
+concurrency:
+  group: contextual-orchestrator-hourly-review-repair
+  # A complete exact-head review can exceed one hour; keep it alive for the next heartbeat.
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch-review-repair:
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/pr-review-fix-scheduler.yml
+    with:
+      target_repository: ContextualWisdomLab/contextual-orchestrator
+      base_branch: main
+      max_prs: "50"
+      max_dispatches: "1"
+      resolve_unreviewed_conflicts: true
+      retry_hours: "2"
+    secrets:
+      PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
+      OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -8,6 +8,7 @@ on:
       - .github/workflows/pr-review-autofix.yml
       - .github/workflows/bandscope-hourly-review-repair.yml
       - .github/workflows/clearfolio-hourly-review-repair.yml
+      - .github/workflows/contextual-orchestrator-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
       - .github/workflows/github-hourly-review-repair.yml
@@ -20,6 +21,7 @@ on:
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
       - tests/test_bandscope_hourly_review_caller.py
+      - tests/test_contextual_orchestrator_hourly_review_caller.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
       - tests/test_github_hourly_conflict_repair.py
@@ -44,6 +46,7 @@ on:
       - docs/automation/hourly-review-repair.md
       - docs/doctoring/bandscope-hourly-review-caller.md
       - docs/doctoring/clearfolio-hourly-review-caller.md
+      - docs/doctoring/contextual-orchestrator-hourly-review-caller.md
       - docs/doctoring/conflict-control-evidence-isolation.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
@@ -61,6 +64,7 @@ on:
       - .github/workflows/pr-review-autofix.yml
       - .github/workflows/bandscope-hourly-review-repair.yml
       - .github/workflows/clearfolio-hourly-review-repair.yml
+      - .github/workflows/contextual-orchestrator-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
       - .github/workflows/github-hourly-review-repair.yml
@@ -73,6 +77,7 @@ on:
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
       - tests/test_bandscope_hourly_review_caller.py
+      - tests/test_contextual_orchestrator_hourly_review_caller.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
       - tests/test_github_hourly_conflict_repair.py
@@ -97,6 +102,7 @@ on:
       - docs/automation/hourly-review-repair.md
       - docs/doctoring/bandscope-hourly-review-caller.md
       - docs/doctoring/clearfolio-hourly-review-caller.md
+      - docs/doctoring/contextual-orchestrator-hourly-review-caller.md
       - docs/doctoring/conflict-control-evidence-isolation.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
@@ -155,6 +161,7 @@ jobs:
             scripts/ci/pr_review_autofix_context.py \
             tests/test_pr_review_conflict_scope.py \
             tests/test_bandscope_hourly_review_caller.py \
+            tests/test_contextual_orchestrator_hourly_review_caller.py \
             tests/test_disksage_hourly_review_caller.py \
             tests/test_fast_mlsirm_hourly_review_caller.py \
             tests/test_github_hourly_conflict_repair.py \

docs/doctoring/contextual-orchestrator-hourly-review-caller.md

@@ -0,0 +1,60 @@
+# Contextual Orchestrator Hourly Review-Repair Caller
+
+## Customer action
+
+Keep `ContextualWisdomLab/contextual-orchestrator` on the protected `main`
+branch, then confirm the central autofix gateway contract in
+`ContextualWisdomLab/.github#1168` is merged before enabling this scheduled
+caller. After the caller runs, inspect the target PR's exact-head review,
+Checks, and independent approval; merge only through the protected normal path.
+
+## Runtime boundary
+
+The workflow runs at minute 17 of every hour and calls the central
+`pr-review-fix-scheduler.yml` reusable workflow. It scans at most 50 open PRs,
+dispatches one bounded repair, permits unresolved conflict repair, and waits
+two hours before retrying the same head. Non-cancelling concurrency preserves a
+long-running exact-head OpenCode, Noema, or security operation.
+
+The caller grants read-only contents access and OIDC token exchange only. It
+forwards the established `PR_REVIEW_MERGE_TOKEN` and
+`OPENCODE_APPROVE_TOKEN` paths explicitly; it does not inherit all secrets and
+does not receive `NVIDIA_NIM_API_KEY` or `COPILOT_GITHUB_TOKEN`. The central
+target allowlist must include `ContextualWisdomLab/contextual-orchestrator` in
+`OPENCODE_REPOSITORY_DISPATCH_TARGETS`.
+
+## Gateway dependency and evidence
+
+The reusable scheduler dispatches the default-branch central autofix workflow.
+Merge `ContextualWisdomLab/.github#1168` first so that this caller's write path
+uses the contextual-orchestrator gateway's automatic model discovery and
+bounded OpenCode tool loop. The worker must keep provider credentials in the
+gateway KV boundary and must fail closed when gateway configuration is absent.
+
+Every dispatched repair is diagnostic until the target PR's live head is
+revalidated. A changed head invalidates earlier review and Checks evidence.
+Queued, cancelled, unavailable, or synthetic evidence never authorizes a
+merge. A customer should open the target PR, resolve actionable review threads,
+wait for terminal required Checks, obtain an independent review and non-author approval,
+and then use the repository's protected merge control.
+
+## Verification
+
+Run the caller contract test and `actionlint` against the exact commit before
+changing the target allowlist or credential bindings:
+
+```text
+python3 -m pytest -q tests/test_contextual_orchestrator_hourly_review_caller.py
+actionlint .github/workflows/contextual-orchestrator-hourly-review-repair.yml
+```
+
+## APA 7th references
+
+GitHub. (n.d.). *Events that trigger workflows*. Retrieved August 21, 2026,
+from https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
+
+GitHub. (n.d.). *Reuse workflows*. Retrieved August 21, 2026, from
+https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
+
+OpenCode. (n.d.). *Permissions*. Retrieved August 21, 2026, from
+https://opencode.ai/docs/permissions

scripts/ci/organization_commercial_readiness_loop.py

@@ -239,6 +239,7 @@ class GitHubClient:
     """Use the GitHub CLI as an authenticated, bounded REST transport."""
 
     def __init__(self, token: str, *, timeout_seconds: int = 60) -> None:
+        """Configure the client with an explicit review-control credential."""
         if not token:
             raise GitHubError("GH_TOKEN is required for organization coordination")
         self._token = token
@@ -853,4 +854,4 @@ def main(
 
 
 if __name__ == "__main__":  # pragma: no cover - exercised through main()
-    raise SystemExit(main())
+    raise SystemExit(main())

tests/test_contextual_orchestrator_hourly_review_caller.py

@@ -0,0 +1,85 @@
+"""Contract tests for the contextual-orchestrator hourly repair caller."""
+
+from pathlib import Path
+
+
+CALLER = Path(
+    ".github/workflows/contextual-orchestrator-hourly-review-repair.yml"
+)
+DOCTORING = Path(
+    "docs/doctoring/contextual-orchestrator-hourly-review-caller.md"
+)
+QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml")
+CONTRACT = Path("tests/test_contextual_orchestrator_hourly_review_caller.py")
+
+
+def _read(path: Path) -> str:
+    """Return one required contract file as UTF-8 text."""
+    assert path.is_file(), f"missing required contract file: {path}"
+    return path.read_text(encoding="utf-8")
+
+
+def test_caller_is_hourly_bounded_and_non_cancelling() -> None:
+    """Give the target repository one bounded repair scan per hour."""
+    caller = _read(CALLER)
+
+    assert 'cron: "17 * * * *"' in caller
+    assert "group: contextual-orchestrator-hourly-review-repair" in caller
+    assert "cancel-in-progress: false" in caller
+    assert "uses: ./.github/workflows/pr-review-fix-scheduler.yml" in caller
+    assert "target_repository: ContextualWisdomLab/contextual-orchestrator" in caller
+    assert "base_branch: main" in caller
+    assert 'max_prs: "50"' in caller
+    assert 'max_dispatches: "1"' in caller
+    assert "resolve_unreviewed_conflicts: true" in caller
+    assert 'retry_hours: "2"' in caller
+
+
+def test_caller_preserves_oidc_and_explicit_scheduler_secret_scope() -> None:
+    """Forward only established scheduler credentials to the reusable workflow."""
+    caller = _read(CALLER)
+    workflow_scope, jobs_scope = caller.split("\njobs:\n", maxsplit=1)
+
+    assert "\npermissions:\n  contents: read\n" in workflow_scope
+    assert "\n    permissions:\n      contents: read\n      id-token: write\n" in jobs_scope
+    assert "PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}" in caller
+    assert "OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}" in caller
+    assert "secrets: inherit" not in caller
+    assert "NVIDIA_NIM_API_KEY" not in caller
+    assert "COPILOT_GITHUB_TOKEN" not in caller
+    for forbidden in (
+        "actions: write",
+        "contents: write",
+        "issues: write",
+        "pull-requests: write",
+        "statuses: write",
+    ):
+        assert forbidden not in caller
+
+
+def test_doctoring_records_gateway_dependency_and_customer_next_action() -> None:
+    """Tell operators which gateway PR must land before this caller is enabled."""
+    doctoring = _read(DOCTORING)
+
+    for phrase in (
+        "ContextualWisdomLab/contextual-orchestrator",
+        "#1168",
+        "contextual-orchestrator gateway",
+        "exact-head",
+        "independent review",
+        "OPENCODE_REPOSITORY_DISPATCH_TARGETS",
+        "PR_REVIEW_MERGE_TOKEN",
+        "OPENCODE_APPROVE_TOKEN",
+        "NVIDIA_NIM_API_KEY",
+        "COPILOT_GITHUB_TOKEN",
+        "APA 7th references",
+    ):
+        assert phrase in doctoring
+
+
+def test_quality_workflow_tracks_caller_test_and_doctoring() -> None:
+    """Run the focused quality gate when any caller contract changes."""
+    quality = _read(QUALITY_WORKFLOW)
+    for path in (CALLER, DOCTORING, CONTRACT):
+        assert quality.count(str(path)) >= 2
+    assert str(CONTRACT) in quality[quality.index("python -m compileall"):]