fix(automation): enforce hourly DDD development contract

[seonghobae]

Outcome

Reuses the existing organization commercial-readiness schedule at minute 7 of every hour and makes its product-development lane require a versioned, executable Domain-Driven Design architecture contract. No second cron or competing organization writer is introduced.

Current exact branch

• exact head: 76b290ca358f1b9d0e0af6df73e3429aae41b895
• protected main included as second parent: 44a3c740f7c46c06e7500174d4127413f3f581eb
• the branch therefore retains the newly merged failed-check RCA control-plane changes from fix(governance): dispatch failed-check RCA directly #1541
• no force push was used

Hourly execution boundary

• The coordinator remains bounded to at most one review-repair dispatch and one product-development dispatch per pass.
• Repositories with an enabled dedicated hourly or more-frequent writer retain their writer lease and are not double-dispatched.
• Repositories without a dedicated writer must expose one active manual default-branch entrypoint with the organization opt-in marker and DDD contract marker.
• The coordinator refetches the exact default-branch SHA, workflow sources, active writer runs, and open PR state before dispatch.

Executable DDD contract

The repository owns its human-readable product-agent prompt, which may use any language. Eligibility no longer depends on copied English terminology appearing anywhere in raw YAML.

A valid entrypoint must define exactly one root workflow environment with:

CWL_DDD_CONTRACT_VERSION: "1"
CWL_DDD_CONTRACT_CAPABILITIES: >-
  aggregate anti_corruption_layer bounded_context context_map
  directory_ownership domain_event domain_service entity invariant
  minimal_shared_kernel product_gap_baseline repository
  subdomain_classification ubiquitous_language value_object
CWL_PRODUCT_AGENT_PROMPT: |
  <repository-owned product-development instructions>

The same non-comment product-agent command under # cwl-ddd-prompt-binding: v1 must consume both:

--prompt-env CWL_PRODUCT_AGENT_PROMPT
--architecture-contract-env CWL_DDD_CONTRACT_CAPABILITIES

Version one uses an exact closed capability set. Missing, extra, duplicated, misspelled, or unversioned capabilities fail closed. Comments, unrelated or unused YAML, nested or duplicate environment scopes, shell built-ins, malformed quoting, dangling continuations, and flags split across commands do not satisfy the contract.

The capabilities cover core/supporting/generic subdomain classification, Bounded Context, Context Map, Ubiquitous Language, Aggregate, Entity, Value Object, Domain Service, Repository, Domain Event, Invariant, Anti-Corruption Layer, minimal Shared Kernel, directory ownership, and docs/product-technical-gap-baseline.md traceability.

Directory and responsibility repair

Each hourly product increment must identify the owning product responsibility before selecting a repository, then compare the live directory tree, package/module names, API, database objects, tests, and documentation with that responsibility.

Misleading directory ownership, domain behavior hidden in generic utils or common paths, infrastructure imports inside the domain model, cross-context database access, obsolete product names, and customer-visible implementation boundaries are architecture defects. A bounded repair moves implementation together with imports, callers, package manifests, migrations, tests, ADRs, diagrams, and compatibility adapters. A larger coherent migration must be recorded with owner, callers, target context, sequence, and acceptance evidence in docs/product-technical-gap-baseline.md rather than silently deferred.

This does not impose one universal directory template; moves are justified by domain ownership and dependency direction.

Implementation boundary

The previously verified coordinator implementation is preserved byte-for-byte in scripts/ci/organization_commercial_readiness_core.py. The original public/script path remains a compatibility facade that loads the core and injects the new dedicated DDD contract validator. This keeps existing imports and the scheduled command stable while isolating architecture-contract parsing from fleet coordination.

Coordinator credential availability

The scheduled coordinator still prefers PR_REVIEW_MERGE_TOKEN. When absent, the protected default-branch job may exchange its job-bound GitHub OIDC identity for the existing short-lived OpenCode App installation token.

Security properties:

• job-scoped id-token: write only;
• exact OpenCode exchange endpoint in the blocked-egress allowlist;
• 10-second connect and 30-second total timeout on both network calls;
• strict non-empty JSON string parsing;
• OIDC and App tokens masked before reuse;
• no repository GITHUB_TOKEN, reviewer credential, model-provider key, or COPILOT_GITHUB_TOKEN fallback;
• malformed or unavailable exchange fails closed.

Executable transport-level branch tests for the exchange helper are tracked separately in #1549 so pull-request code never receives a real job-bound OIDC identity.

Verification evidence

Predecessor bounded bootstrap evidence before the review remediation:

• run 33468148830, job 99732190882;
• 35 focused tests passed;
• coordinator 386/386 statements and 88/88 branches, 100%;
• Python 3.14 warning-as-error execution, compileall, and git diff --check passed.

Review remediation adds focused coverage for multilingual prompt freedom, exact version/capability enforcement, comments-only and unused-YAML rejection, environment scope, same-command binding, shell splitting, malformed commands, compatibility imports, and direct script mode. The permanent PR quality workflow now measures the compatibility facade, coordinator core, and DDD validator together.

All temporary source-fix workflows and scripts were removed from the final branch tree. Current-head GitHub checks and independent reviews are authoritative; predecessor evidence is supporting only.

Supersession

This current-main successor supersedes #1161 and #1233. It does not convert unavailable cross-repository credentials into a successful no-op: the loop either obtains bounded maintainer authority and performs the pass, or fails visibly.

Merge boundary

The PR remains not-merge-ready. Merge only after the unchanged exact head has all required repository/security/coverage/review contexts successful, every actionable review thread resolved, and any policy-required independent approval. Queued, stale, predecessor-head, synthetic-merge-only, skipped-required, or failed evidence is non-passing.

[coderabbitai]

Warning

Review limit reached

Next included review available in 33 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: a0bf5e72-e3eb-4b5d-b54d-97c4ffc3dcfd

📥 Commits

Reviewing files that changed from the base of the PR and between 44a3c74 and 0a4d664.

📒 Files selected for processing (17)

• .github/workflows/organization-commercial-readiness-loop-quality-ci.yml
• .github/workflows/organization-commercial-readiness-loop.yml
• CHANGELOG.md
• docs/doctoring/organization-commercial-readiness-loop.md
• docs/product-technical-gap-baseline.md
• organization_commercial_readiness_fixtures.py
• scripts/ci/organization_commercial_readiness_core.py
• scripts/ci/organization_commercial_readiness_ddd_contract.py
• scripts/ci/organization_commercial_readiness_loop.py
• scripts/ci/pr_review_autofix_context.py
• scripts/ci/pr_review_fix_scheduler.py
• tests/test_organization_commercial_readiness_loop_credential_contract.py
• tests/test_organization_commercial_readiness_loop_ddd_binding.py
• tests/test_organization_commercial_readiness_loop_facade.py
• tests/test_organization_commercial_readiness_loop_policy.py
• tests/test_pr_review_fix_scheduler.py
• tests/test_pr_review_merge_scheduler.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review Please review exact head 38f6422f0220cea9f7df4106964bc358f8f692fe independently. Focus on: (1) OIDC/App-token trust and bounded-failure behavior, (2) workflow permission/egress scope, (3) whether the product-entrypoint predicate truly fails closed when any strategic or tactical DDD term is absent, (4) dedicated-writer lease coexistence without duplicate schedules, and (5) final-tree absence of temporary bootstrap files. Do not reuse predecessor-head verdicts.

[seonghobae]

@opencode-agent Please repair the current DDD-contract review findings on this existing owner branch and then synchronize current protected main non-destructively (no rebase/force).

1. Do not accept DDD eligibility from raw YAML phrase presence. Define/parse a narrowly scoped machine-readable DDD contract that is demonstrably connected to the actual product-agent prompt/invocation. Tests must reject all-required-phrases-only-in-comments, env values, unrelated steps, or unused YAML.
2. Avoid exact prose/capitalization as the semantic gate. Prefer a versioned structured contract/schema with canonical field names/enums so equivalent user-facing prompt wording remains valid while required DDD concepts are machine-checkable.
3. Upgrade the OIDC/App-token credential tests from string search to executable shell-contract tests with fake curl/jq inputs, covering URL/audience construction, malformed/empty JSON, non-string token, network failure, masking/export, and fail-closed behavior without exposing secrets.

Preserve the single existing hourly coordinator (no additional cron), its bounded dispatch budgets, exact default-branch/head revalidation, dedicated-writer lease behavior, and no COPILOT_GITHUB_TOKEN fallback. Run focused tests plus full 100% coverage/docstrings/compile/diff gates and regenerate exact-head review evidence.

[seonghobae]

@opencode-agent review

The unsafe temporary source-fix workflow/helper have been removed at exact head 1c1532b3d6ce8db5eb7b8fd27b18f6eebcbd389d; their threads are resolved. The three permanent findings remain open and must be implemented directly on this branch: structurally bind the versioned DDD contract to the actual dispatched product-agent input (not raw YAML/comments), replace exact prose matching with canonical schema fields/enums, and execute the OIDC/App-token shell path against fake network/JSON fixtures rather than string-inspecting YAML. After those permanent repairs, merge current protected main non-destructively and regenerate exact-head evidence. Do not recreate a write-capable self-modifying workflow.

[seonghobae]

The temporary write-capable source-fix workflow/helper were reintroduced by the subsequent aeba2182... commit even after their security finding had been fixed. I removed them again on current branch via normal non-force commits c765e6fc... and 69685376.... Fresh source inspection still shows the three permanent findings are not fixed: DDD_CONTRACT_TERMS remains exact prose and has_domain_driven_development_contract() remains raw-YAML substring matching. Do not recreate temporary writer machinery again. I also attempted to convert this PR to Draft while these substantive findings remain, but the GitHub connector's GraphQL mutation currently fails on its own invalid Repository.fullDatabaseId selection; that tool defect is not merge authorization. Keep this PR non-merge-ready until the permanent structured/prompt-bound contract and executable credential tests land directly on the branch.

[seonghobae]

@opencode-agent Please implement the current-head review remediation on exact head 69685376ecb5068a0bdbcee2888e82395312bd18 using the trusted default-branch autofix path. Do not recreate any PR-branch workflow or source-fix helper. Replace raw English phrase matching with a versioned machine-readable DDD capability contract, permit free-form/multilingual prompt prose, and require the prompt plus capability-set environment names to be consumed by the same non-comment product-agent command. Add RED/GREEN policy coverage for comments-only text, unrelated/unused YAML, wrong or duplicate root env scopes, missing capability IDs, wrong bindings, and split commands. Preserve the existing hourly writer lease, OIDC/App-token behavior, docs, changelog, and docs/product-technical-gap-baseline.md; remove all temporary artifacts before publishing. Re-run exact-head focused tests, statement/branch coverage, compileall, and diff checks. Do not merge.

[seonghobae]

Current exact head 69685376ecb5068a0bdbcee2888e82395312bd18 is still not merge-ready on the DDD eligibility boundary. has_domain_driven_development_contract() currently accepts the marker plus exact phrases anywhere in raw YAML, so comments, unrelated env values, or unused keys can satisfy enrollment without the product agent ever receiving the contract; DDD_CONTRACT_TERMS also makes semantically equivalent prompts depend on copied prose. Replace this with a versioned, machine-readable DDD contract schema whose canonical fields/enums are parsed from the actual product-agent prompt/invocation (or a referenced immutable contract passed into that invocation). Add negative tests where all terms appear only in comments, env, unrelated steps, and unused YAML, and positive tests with equivalent structured values independent of prose wording. Keep the completed temporary write-capable source-fix lane deleted; implement the repair directly on this owner branch.

[seonghobae]

@opencode-agent review exact head cc3b6b8add7bece45e7dd20ce10a65b653b4d3d7. Revalidation this pass confirmed the formerly actionable DDD binding and canonical-example findings are fixed on current source; all visible review threads are now resolved. The branch is 0 behind protected main and auto-merge is enabled, but integration still requires fresh exact-head required checks and formal review evidence.

[seonghobae]

@opencode-agent current-main convergence pass. All visible Devin threads are resolved on 0a4d66489814fb02568ccad6bb8f61fe30045497, but protected main advanced through #1546 and this branch is now 1 behind. Merge protected main@5686de41660d51a7a7f22b8840dfa6ccfe5ff3f1 into this branch non-destructively (no rebase/force), preserve #1546 reviewer/scheduler behavior, and resolve any overlap by current-main ownership rather than restoring predecessor scheduler code. Do not import unrelated #1567 coverage tests into this DDD product lane; treat #1567 as merged-tree coverage prerequisite until it integrates. Re-run the focused DDD binding/facade/coordinator suites plus full coverage/docstrings, confirm no temporary source-fix workflow/helper reappears, update the exact-head/body evidence, and request fresh OpenCode/Noema review. Keep #1549 as the separate executable credential-transport-test owner.

[seonghobae]

The protected-main production failure in Organization Commercial Readiness Loop run 33483275421 was independently reproduced as a missing-PR_REVIEW_MERGE_TOKEN credential-availability defect. Because this PR is currently a broader stale/non-mergeable DDD bundle, the credential-recovery slice has been extracted onto current main as focused PR #1577 using the same reviewed OIDC→OpenCode App token boundary. #1577 has deterministic RED evidence and an exact-head GREEN quality run (35 tests, coordinator 100% statement/branch coverage). When this DDD branch next reconciles with protected main, absorb the integrated fallback rather than reintroducing a competing implementation.