fix(automation): enforce hourly DDD development contract - #1545

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

@opencode-agent @cwl-noema-review Please review exact head 38f6422f0220cea9f7df4106964bc358f8f692fe independently. Focus on: (1) OIDC/App-token trust and bounded-failure behavior, (2) workflow permission/egress scope, (3) whether the product-entrypoint predicate truly fails closed when any strategic or tactical DDD term is absent, (4) dedicated-writer lease coexistence without duplicate schedules, and (5) final-tree absence of temporary bootstrap files. Do not reuse predecessor-head verdicts.

@opencode-agent Please repair the current DDD-contract review findings on this existing owner branch and then synchronize current protected main non-destructively (no rebase/force).

1. Do not accept DDD eligibility from raw YAML phrase presence. Define/parse a narrowly scoped machine-readable DDD contract that is demonstrably connected to the actual product-agent prompt/invocation. Tests must reject all-required-phrases-only-in-comments, env values, unrelated steps, or unused YAML.
2. Avoid exact prose/capitalization as the semantic gate. Prefer a versioned structured contract/schema with canonical field names/enums so equivalent user-facing prompt wording remains valid while required DDD concepts are machine-checkable.
3. Upgrade the OIDC/App-token credential tests from string search to executable shell-contract tests with fake curl/jq inputs, covering URL/audience construction, malformed/empty JSON, non-string token, network failure, masking/export, and fail-closed behavior without exposing secrets.

Preserve the single existing hourly coordinator (no additional cron), its bounded dispatch budgets, exact default-branch/head revalidation, dedicated-writer lease behavior, and no COPILOT_GITHUB_TOKEN fallback. Run focused tests plus full 100% coverage/docstrings/compile/diff gates and regenerate exact-head review evidence.

@opencode-agent review

The unsafe temporary source-fix workflow/helper have been removed at exact head 1c1532b3d6ce8db5eb7b8fd27b18f6eebcbd389d; their threads are resolved. The three permanent findings remain open and must be implemented directly on this branch: structurally bind the versioned DDD contract to the actual dispatched product-agent input (not raw YAML/comments), replace exact prose matching with canonical schema fields/enums, and execute the OIDC/App-token shell path against fake network/JSON fixtures rather than string-inspecting YAML. After those permanent repairs, merge current protected main non-destructively and regenerate exact-head evidence. Do not recreate a write-capable self-modifying workflow.

The temporary write-capable source-fix workflow/helper were reintroduced by the subsequent aeba2182... commit even after their security finding had been fixed. I removed them again on current branch via normal non-force commits c765e6fc... and 69685376.... Fresh source inspection still shows the three permanent findings are not fixed: DDD_CONTRACT_TERMS remains exact prose and has_domain_driven_development_contract() remains raw-YAML substring matching. Do not recreate temporary writer machinery again. I also attempted to convert this PR to Draft while these substantive findings remain, but the GitHub connector's GraphQL mutation currently fails on its own invalid Repository.fullDatabaseId selection; that tool defect is not merge authorization. Keep this PR non-merge-ready until the permanent structured/prompt-bound contract and executable credential tests land directly on the branch.

@opencode-agent Please implement the current-head review remediation on exact head 69685376ecb5068a0bdbcee2888e82395312bd18 using the trusted default-branch autofix path. Do not recreate any PR-branch workflow or source-fix helper. Replace raw English phrase matching with a versioned machine-readable DDD capability contract, permit free-form/multilingual prompt prose, and require the prompt plus capability-set environment names to be consumed by the same non-comment product-agent command. Add RED/GREEN policy coverage for comments-only text, unrelated/unused YAML, wrong or duplicate root env scopes, missing capability IDs, wrong bindings, and split commands. Preserve the existing hourly writer lease, OIDC/App-token behavior, docs, changelog, and docs/product-technical-gap-baseline.md; remove all temporary artifacts before publishing. Re-run exact-head focused tests, statement/branch coverage, compileall, and diff checks. Do not merge.

Current exact head 69685376ecb5068a0bdbcee2888e82395312bd18 is still not merge-ready on the DDD eligibility boundary. has_domain_driven_development_contract() currently accepts the marker plus exact phrases anywhere in raw YAML, so comments, unrelated env values, or unused keys can satisfy enrollment without the product agent ever receiving the contract; DDD_CONTRACT_TERMS also makes semantically equivalent prompts depend on copied prose. Replace this with a versioned, machine-readable DDD contract schema whose canonical fields/enums are parsed from the actual product-agent prompt/invocation (or a referenced immutable contract passed into that invocation). Add negative tests where all terms appear only in comments, env, unrelated steps, and unused YAML, and positive tests with equivalent structured values independent of prose wording. Keep the completed temporary write-capable source-fix lane deleted; implement the repair directly on this owner branch.

@opencode-agent review exact head cc3b6b8add7bece45e7dd20ce10a65b653b4d3d7. Revalidation this pass confirmed the formerly actionable DDD binding and canonical-example findings are fixed on current source; all visible review threads are now resolved. The branch is 0 behind protected main and auto-merge is enabled, but integration still requires fresh exact-head required checks and formal review evidence.

@opencode-agent current-main convergence pass. All visible Devin threads are resolved on 0a4d66489814fb02568ccad6bb8f61fe30045497, but protected main advanced through #1546 and this branch is now 1 behind. Merge protected main@5686de41660d51a7a7f22b8840dfa6ccfe5ff3f1 into this branch non-destructively (no rebase/force), preserve #1546 reviewer/scheduler behavior, and resolve any overlap by current-main ownership rather than restoring predecessor scheduler code. Do not import unrelated #1567 coverage tests into this DDD product lane; treat #1567 as merged-tree coverage prerequisite until it integrates. Re-run the focused DDD binding/facade/coordinator suites plus full coverage/docstrings, confirm no temporary source-fix workflow/helper reappears, update the exact-head/body evidence, and request fresh OpenCode/Noema review. Keep #1549 as the separate executable credential-transport-test owner.

The protected-main production failure in Organization Commercial Readiness Loop run 33483275421 was independently reproduced as a missing-PR_REVIEW_MERGE_TOKEN credential-availability defect. Because this PR is currently a broader stale/non-mergeable DDD bundle, the credential-recovery slice has been extracted onto current main as focused PR #1577 using the same reviewed OIDC→OpenCode App token boundary. #1577 has deterministic RED evidence and an exact-head GREEN quality run (35 tests, coordinator 100% statement/branch coverage). When this DDD branch next reconciles with protected main, absorb the integrated fallback rather than reintroducing a competing implementation.

Noema owner-path acceptance finding (2026-09-05 KST): protected central main@3f2f21c577804a473d3c63f87226948dd9b9257a still recognizes manual product entrypoints through the older is_manual_product_entrypoint() contract that requires the entrypoint marker, workflow_dispatch, no schedule, concurrency, and literal NVIDIA_NIM_API_KEY. ContextualWisdomLab/noema cannot adopt that provider-specific credential requirement: its canonical LLM boundary is contextual-orchestrator only (NOEMA_LLM_API_KEY / gateway), with provider/model/key routing owned by CO. Noema #551 tried to remove the local hourly cron before a compatible protected central handoff existed; that PR is now Draft/reopened and explicitly blocked on this owner prerequisite.

Please preserve #1545's central single-writer/DDD intent while ensuring the protected successor admission contract is provider-neutral: repository opt-in + DDD capability/prompt binding + manual dispatch/concurrency should be sufficient, and leaf products must not be required to expose NVIDIA/OpenAI/OpenRouter/Bytez provider credentials. Once that contract is protected, Noema can adopt the exact handshake and remove its local cron atomically with its existing workflow regression. Until then Noema retains its local scheduled writer rather than creating a writer outage or duplicating provider authority.

Noema consumer prerequisite refresh (2026-09-05 KST): protected .github/main is now b5e4b55127d3a5658899174f0b34e76b9f203ab6, while this PR remains open/non-mergeable at head 0a4d66489814fb02568ccad6bb8f61fe30045497 and stale base 44a3c740.... Protected-default-branch code search still returns zero matches for CWL_DDD_CONTRACT_VERSION, so the versioned DDD/manual-entrypoint contract is not yet organization authority. Noema #551 therefore keeps its dedicated 47 * * * * writer lease and existing regression intact; deleting the cron before this contract reaches protected truth would create a writer outage rather than a handoff. Please converge this owner lane non-destructively onto current protected main, preserve the exact closed DDD capability contract/manual entrypoint, and land it through normal required gates. Noema will then re-read protected source and implement only the provider-neutral repository handshake before removing its local schedule.