feat(automation): run BandScope hourly NVIDIA NIM review repair

.github/workflows/bandscope-hourly-review-repair.yml

@@ -0,0 +1,30 @@
+name: BandScope Hourly Review Repair
+
+on:
+  schedule:
+    # Minute 53 avoids the Clearfolio, DiskSage, and planned Inkspan heartbeats.
+    - cron: "53 * * * *"
+
+concurrency:
+  group: bandscope-hourly-review-repair
+  # A later heartbeat must not cancel an in-flight queue decision or repair.
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch-review-repair:
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/pr-review-fix-scheduler.yml
+    with:
+      target_repository: ContextualWisdomLab/bandscope
+      base_branch: develop
+      max_prs: "50"
+      max_dispatches: "1"
+      retry_hours: "1"
+    secrets:
+      PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
+      OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -6,12 +6,14 @@ on:
       - .github/workflows/pr-review-fix-scheduler.yml
       - scripts/ci/pr_review_fix_scheduler.py
       - .github/workflows/pr-review-autofix.yml
+      - .github/workflows/bandscope-hourly-review-repair.yml
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
       - .github/workflows/hourly-nvidia-nim-review-repair.yml
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
+      - tests/test_bandscope_hourly_review_repair_contract.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
       - tests/test_hourly_scheduler_runtime_budget.py
@@ -30,6 +32,7 @@ on:
       - docs/automation/hourly-review-repair.md
       - docs/doctoring/clearfolio-hourly-review-caller.md
       - docs/doctoring/conflict-control-evidence-isolation.md
+      - docs/doctoring/bandscope-hourly-review-caller.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
       - docs/doctoring/hourly-nvidia-nim-autofix.md
@@ -38,12 +41,14 @@ on:
       - .github/workflows/pr-review-fix-scheduler.yml
       - scripts/ci/pr_review_fix_scheduler.py
       - .github/workflows/pr-review-autofix.yml
+      - .github/workflows/bandscope-hourly-review-repair.yml
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
       - .github/workflows/hourly-nvidia-nim-review-repair.yml
       - scripts/ci/pr_review_conflict_scope.py
       - scripts/ci/pr_review_autofix_context.py
+      - tests/test_bandscope_hourly_review_repair_contract.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
       - tests/test_hourly_scheduler_runtime_budget.py
@@ -62,6 +67,7 @@ on:
       - docs/automation/hourly-review-repair.md
       - docs/doctoring/clearfolio-hourly-review-caller.md
       - docs/doctoring/conflict-control-evidence-isolation.md
+      - docs/doctoring/bandscope-hourly-review-caller.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
       - docs/doctoring/hourly-nvidia-nim-autofix.md
@@ -112,6 +118,7 @@ jobs:
             scripts/ci/pr_review_conflict_scope.py \
             scripts/ci/pr_review_autofix_context.py \
             tests/test_pr_review_conflict_scope.py \
+            tests/test_bandscope_hourly_review_repair_contract.py \
             tests/test_disksage_hourly_review_caller.py \
             tests/test_fast_mlsirm_hourly_review_caller.py \
             tests/test_hourly_scheduler_runtime_budget.py \

AGENTS.md

@@ -5,3 +5,4 @@
 
 Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md).
 Conflict-scope roots fail closed when the immediate parent directory is a symbolic link.
+The BandScope hourly repair caller runs at minute 53 against protected `develop`. See [`docs/doctoring/bandscope-hourly-review-caller.md`](docs/doctoring/bandscope-hourly-review-caller.md).

ARCHITECTURE.md

@@ -52,9 +52,10 @@ The worker checks out helpers at `${{ github.sha }}` so a later default-branch
 push cannot replace privileged scripts after dispatch (CWE-367). Repair binds
 `NVIDIA_NIM_API_KEY`, never `COPILOT_GITHUB_TOKEN`.
 
-Product callers stagger Clearfolio at minute 23, DiskSage at minute 37, and
-fast-mlsirm at minute 49. Each caller is read-only, dispatches at most one
-repair, and delegates all privileged logic to the same sealed scheduler.
+Product callers stagger Clearfolio at minute 23, DiskSage at minute 37,
+fast-mlsirm at minute 49, and BandScope at minute 53. Each caller is
+read-only, dispatches at most one repair, and delegates all privileged
+logic to the same sealed scheduler.
 
 ## Control-plane data flow
 
@@ -107,4 +108,6 @@ tests pin workflow structure and governance prose so drift fails closed.
 - [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md)
   — current increment's repair-worker decision and APA 7th citations.
 - [`docs/doctoring/fast-mlsirm-hourly-review-caller.md`](docs/doctoring/fast-mlsirm-hourly-review-caller.md)
-  — product-specific psychometric repair heartbeat and scientific gates.
+  — product-specific psychometric repair heartbeat and scientific gates.
+- [`docs/doctoring/bandscope-hourly-review-caller.md`](docs/doctoring/bandscope-hourly-review-caller.md)
+  — BandScope rehearsal vertical hourly caller and CWE-250 boundary.

CHANGELOG.md

@@ -14,18 +14,21 @@ Semantic Versioning where the repository publishes a release.
 - Added a dedicated Clearfolio hourly caller that invokes the product-neutral central scheduler with the exact repository, protected base branch, one-dispatch budget, one-hour retry floor, single-flight concurrency, and only the established scheduler credentials.
 - Added a dedicated DiskSage hourly caller that invokes the same product-neutral RCA and remediation-feasibility scheduler with an exact repository target, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, and explicit established scheduler credentials.
 - Added a dedicated fast-mlsirm hourly caller that preserves Rust-owned psychometric arithmetic while dispatching at most one exact-head, root-cause-driven repair with a two-hour same-head retry floor.
+- Added a dedicated BandScope hourly caller that invokes the product-neutral RCA scheduler for `ContextualWisdomLab/bandscope` at minute 53 against protected `develop`, with a one-dispatch budget, one-hour same-head retry floor, and only the established scheduler credentials.
 
 ### Changed
 
 - Require the hourly repair worker to establish an exact-head root cause, enumerate the smallest remediation candidates, and prove writer authority, sealed-path scope, credentials, dependency order, verifiability, and causal effect before editing; infeasible or external blockers leave the tree unchanged while the broader loop continues with another eligible PR or buyer-visible product gap.
 - Run the bounded Clearfolio PR review-feedback repair caller at minute 23 of every hour while keeping the shared scheduler free of product-specific timers and repository names for modular reuse by naruon, contextual-orchestrator, Inkspan, and other CWL services.
 - Run the bounded DiskSage repair heartbeat at minute 37 of every hour, dispatch no more than one exact-head repair, and wait two hours before redispatching an unchanged head so legitimate OpenCode or NVIDIA NIM latency does not create duplicate writers.
 - Run the bounded fast-mlsirm repair heartbeat at minute 49 of every hour with one-dispatch scope and a two-hour same-head floor, without weakening true-parameter recovery, CPU/GPU parity, skipped-test, or Rust-ownership gates.
+- Run the bounded BandScope repair heartbeat at minute 53 of every hour against `develop`, dispatching at most one exact-head repair and waiting one hour before redispatching an unchanged head.
 - Use NVIDIA NIM `mistralai/mistral-small-4-119b-2603` with explicit high reasoning for scheduled repair and `nvidia/nemotron-3-nano-30b-a3b` for bounded helper work instead of GitHub Models in the write-capable autofix worker.
 - Apply one NUL-delimited exact-path and complete pre/post-worktree verification contract to both ordinary review repair and merge-conflict repair rather than relying on a visible post-model diff for the ordinary path.
 
 ### Fixed
 
+- Grant the BandScope hourly caller job `id-token: write` so the reusable NVIDIA NIM scheduler can mint its OpenCode App fallback from GitHub OIDC, and prove the focused quality path filters independently per `pull_request`, `push`, and `compileall` block.
 - Materialized base Python locks only when every package line is an exact SHA-256 pin or a bounded relative `-r`/`--requirement` include. A lone `--require-hashes` directive, a dotted include such as `./lock.txt`, or `-r other-hashes.txt` no longer enters the trusted build context.
 - Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367).
 - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics.

CLAUDE.md

@@ -66,7 +66,8 @@ Details: `README.md` and `PR_GOVERNANCE_AUDIT.md`.
 - `docs/` — master context, Project protocol, `org-required-workflow-rollout.md`,
   `scorecard-governance.md`, SBOM inventory. Doctoring records live under
   `docs/doctoring/`. [`ARCHITECTURE.md`](ARCHITECTURE.md) is the control-plane
-  diagram for review, hourly NVIDIA NIM repair, and merge trust boundaries.
+  diagram for review, hourly NVIDIA NIM repair (including the BandScope
+  minute-53 `develop` caller), and merge trust boundaries.
 - `.jules/` — recorded performance (`bolt.md`) and security (`sentinel.md`) learnings from past work
   on `scripts/ci/`; worth scanning before optimizing or hardening those scripts.
 

docs/automation/hourly-review-repair.md

@@ -5,6 +5,8 @@ engine**.
 
 - `clearfolio-hourly-review-repair.yml` owns Clearfolio's heartbeat at minute 23
   of every hour.
+- `bandscope-hourly-review-repair.yml` owns BandScope's heartbeat at minute 53
+  against protected `develop` with a one-hour same-head retry floor.
 - `pr-review-fix-scheduler.yml` is the reusable, product-neutral scheduler
   module. It has no product-specific timer and can be called by naruon,
   contextual-orchestrator, Inkspan, or another CWL service with an explicit
@@ -39,6 +41,24 @@ The caller passes only the established `PR_REVIEW_MERGE_TOKEN` and
 `NVIDIA_NIM_API_KEY`; the model credential is scoped exclusively to the two
 OpenCode execution steps in the separately reviewed autofix worker.
 
+## BandScope execution contract
+
+The BandScope caller is a thin consumer of the same reusable scheduler:
+
+```yaml
+target_repository: ContextualWisdomLab/bandscope
+base_branch: develop
+max_prs: "50"
+max_dispatches: "1"
+retry_hours: "1"
+```
+
+It runs at `53 * * * *`, uses its own non-cancelling single-flight group, and
+passes only the two established scheduler credentials. Before activation on
+protected `main`, `OPENCODE_REPOSITORY_DISPATCH_TARGETS` must include the exact
+BandScope repository. A missing target mapping fails before any mutation
+credential is materialized; it never falls back to a broader repository scope.
+
 ## Reusable target-selection contract
 
 The shared scheduler resolves its target in this order:
@@ -195,6 +215,9 @@ Permanent tests prove:
 
 - the Clearfolio caller owns exactly one hourly schedule and names the exact
   repository and protected base branch;
+- the BandScope caller owns its distinct minute-53 schedule, exact repository,
+  protected `develop` base, non-cancelling concurrency, and explicit secret
+  contract;
 - the shared scheduler contains no product-specific timer or repository name;
 - the dispatch budget and same-head retry floor remain one;
 - caller and reusable-workflow secrets are explicit and never use

docs/doctoring/bandscope-hourly-review-caller.md

@@ -0,0 +1,88 @@
+# BandScope hourly review-repair caller
+
+Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include; a lone `--require-hashes` line is not lock evidence.
+
+## Decision and operating boundary
+
+The central repository owns a thin scheduled caller for
+`ContextualWisdomLab/bandscope`. It runs at minute 53 each hour and calls the
+product-neutral `pr-review-fix-scheduler.yml` for pull requests targeting
+BandScope's protected `develop` branch. The offset avoids Clearfolio minute 23,
+DiskSage minute 37, and the planned Inkspan minute 47 heartbeat.
+
+The caller contains product identity, cadence, and explicit reusable-workflow
+inputs only. Queue classification, exact-head/live-base binding, root-cause
+analysis, remediation feasibility, retry markers, and repair dispatch remain
+central. BandScope owns its application, evidence, data, runtime, accessibility,
+and release semantics.
+
+## Authority and secret contract
+
+The caller keeps workflow `GITHUB_TOKEN` at `contents: read` and grants
+the reusable job `id-token: write` so the central scheduler can mint the
+OpenCode GitHub App token from GitHub OIDC when the mapped PAT is absent
+(GitHub, n.d.-c). It maps only `PR_REVIEW_MERGE_TOKEN` and
+`OPENCODE_APPROVE_TOKEN`. It never uses `secrets: inherit`, receives
+`NVIDIA_NIM_API_KEY`, or introduces `COPILOT_GITHUB_TOKEN`. CWE-250
+forbids executing the caller with write or model privileges it does not
+need (MITRE, 2026). Model credentials remain scoped to the separately
+reviewed repair worker. The worker cannot approve, merge, release,
+resolve review findings by inference, change protection, or manufacture
+passing checks.
+
+Before protected-main activation, the repository variable
+`OPENCODE_REPOSITORY_DISPATCH_TARGETS` must contain the exact
+`ContextualWisdomLab/bandscope` target. Missing or mismatched configuration
+fails before mutation credential materialization. GitHub App installation and
+both mapped credentials must remain limited to approved repositories.
+
+## Failure and recovery
+
+A missing target mapping, credential, protected base, or exact-head evidence is
+a non-passing configuration state. Operators correct the bounded configuration
+and rerun unchanged protected source; they do not widen credentials, inherit all
+secrets, bypass review, or perturb a clean source head. A later heartbeat does
+not cancel an in-flight decision. Same-head retry markers and the per-PR writer
+lease prevent duplicate repair writers.
+
+After source integration, closure requires a scheduled or manual protected-main
+consumer run proving the exact BandScope repository and `develop` base. This
+protected-main operational acceptance must also prove the
+read-only caller token, bounded dispatch decision, and fail-closed allowlist and
+credential behavior. Source checks alone are not protected-main operational
+acceptance. Merge still requires zero unresolved valid findings and a
+qualifying independent non-author approval.
+
+## Verification and rollback
+
+Machine-checkable contracts require the exact target/base, minute 53 cadence,
+non-cancelling single-flight group, one dispatch, one-hour retry floor, explicit
+secret mapping, read-only contents plus job-scoped `id-token: write`, focused
+path-filter coverage, and absence of model or Copilot credentials. The full
+owned suite and hosted security and review gates must pass on the unchanged
+exact head.
+
+Rollback removes the BandScope caller, its focused test, doctoring, and central
+path-filter/documentation entries. It must not remove scheduler dispatch
+validation or affect independent product callers.
+
+## APA 7th references
+
+MITRE. (2026). *CWE-250: Execution with unnecessary privileges*.
+https://cwe.mitre.org/data/definitions/250.html
+
+GitHub, Inc. (n.d.-a). *Events that trigger workflows*. GitHub Docs. Retrieved
+August 12, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule
+
+GitHub, Inc. (n.d.-b). *Reuse workflows*. GitHub Docs. Retrieved August 12,
+2026, from
+https://docs.github.com/en/actions/how-tos/sharing-automations/reuse-workflows
+
+GitHub, Inc. (n.d.-c). *Automatic token authentication*. GitHub Docs.
+Retrieved August 17, 2026, from
+https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
+
+National Institute of Standards and Technology. (2022). *Secure software
+development framework (SSDF) version 1.1* (NIST SP 800-218).
+https://doi.org/10.6028/NIST.SP.800-218