security(automation): add credential-separated hourly NIM product-dev loop

.coveragerc

@@ -5,6 +5,7 @@ source =
     scripts.check_workspace_contract
     scripts.check_docstrings
     scripts.check_coverage
+    scripts.prepare_agent_pr_message
 
 [report]
 fail_under = 100

.github/workflows/ci.yml

@@ -55,7 +55,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install pinned Python quality dependency
-        run: python3 -m pip install --disable-pip-version-check --no-deps -r requirements-quality.txt
+        run: python3 -m pip install --disable-pip-version-check --no-deps --require-hashes -r requirements-quality.txt
       - name: Exercise repository tooling with branch coverage
         run: python3 -m coverage run --branch -m unittest discover -s tests/quality -p 'test_*.py'
       - name: Enforce repository tooling coverage

CHANGELOG.md

@@ -13,6 +13,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 - `corpus_split` leakage-safe knowledge-cutoff snapshots, relation-connected co-partition groups, rolling-origin windows, and group-normalized ESS weight contracts.
 - `persistence_postgres` live SQL port: `SqlSession` transport, migration batch applicator, document/audit SQL contracts, `LiveDocumentRepository`, and fail-closed `DATABASE_URL`/`LiveSqlxConfig` gate for SQLx pool wiring (live pool/query driver remains accepted-target).
 - `membership_core` Kish effective sample size, design effect, and group-normalized ESS helpers for multiple-membership estimation inputs.
+- Credential-separated hourly NVIDIA NIM/OpenCode product-development workflow (issue #2): proposal, independent verification, and late Maintainer-App publication with `NVIDIA_NIM_API_KEY` only for model work.
 - Documented modular naruon consumer contract for TEPP analysis-run and export surfaces, with a committed example request payload.
 - Documented contextual-orchestrator interpretation port boundary and credential separation for TEPP.
 - Foundation validation/release-readiness ledger at `docs/validation/temporal-event-foundation.md` tracking capability maturity and scientific acceptance gates.

DOCUMENTATION.md

@@ -30,6 +30,8 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Governance | [`GOVERNANCE.md`](GOVERNANCE.md) |
 | Agent development rules | [`AGENTS.md`](AGENTS.md) |
 | Agent context | [`CLAUDE.md`](CLAUDE.md) |
+| Hourly NIM product-development operations | [`docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md`](docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md) |
+| Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) |
 | Change history | [`CHANGELOG.md`](CHANGELOG.md) |
 
 ## Maturity vocabulary

docs/adr/0015-autonomous-development-review-and-merge-authority.md

@@ -1,7 +1,7 @@
 # ADR 0015 — Autonomous development, review, and merge authority separation
 
 **Decision status:** Accepted  
-**Implementation maturity:** accepted-target  
+**Implementation maturity:** active-PR — the hourly credential-separated product-development workflow remains unmerged; independent review and merge authority remain deployment/policy owned
 **Date:** 2026-08-12  
 **Supersedes:** None; narrows and clarifies the automation clauses previously mixed into ADR 0006.
 

docs/adr/README.md

@@ -20,7 +20,7 @@ Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementatio
 | [0012](0012-temporal-relational-shared-latent-topic-measurement.md) | Temporal Relational Shared-Latent Topic Measurement (TRSL-TM) | Accepted | accepted-target | Owns topic backend compatibility, global topic identity, method effects, K/model-selection prerequisites, and compositional topic coordinates. |
 | [0013](0013-bitemporal-persistence-reproducibility-and-split-authority.md) | Bitemporal persistence, reproducibility manifests, and relation-aware split authority | Accepted | partial | Owns PostgreSQL adapter semantics, immutable run/split manifests, leakage-safe partitions, and recovery identity; live SQLx pool wiring remains accepted-target. |
 | [0014](0014-scientific-claim-promotion-and-release-evidence.md) | Scientific claim promotion and release evidence authority | Accepted | partial | Separates design, implementation, scientific/product claim, and release authority. |
-| [0015](0015-autonomous-development-review-and-merge-authority.md) | Autonomous development, review, and merge authority separation | Accepted | accepted-target | Separates model proposal, deterministic verification, publication, independent review, and merge/release authority. |
+| [0015](0015-autonomous-development-review-and-merge-authority.md) | Autonomous development, review, and merge authority separation | Accepted | active-PR | Separates model proposal, deterministic verification, publication, independent review, and merge/release authority. |
 | [0016](0016-tdt-chronos-event-intelligence-boundary.md) | TDT, CHRONOS, and Event Ontology intelligence boundary | Accepted | accepted-target | Separates observed evidence, detection/tracking, prediction/schema inference, temporal consistency, and promoted transition authority. |
 
 ## Decision ownership summary

docs/doctoring/hourly-nim-opencode-development.md

@@ -0,0 +1,116 @@
+# Hourly NVIDIA NIM OpenCode Development — Evidence Doctoring
+
+## Claim boundary
+
+This workflow can propose one bounded pull request. It does not claim autonomous
+semantic correctness, production safety, customer acceptance, scientific
+validity, or permission to merge, release, deploy, or approve. Deterministic
+tests, schemas, security scanners, CodeRabbit/OpenCode review, human judgment,
+and exact-head branch rules remain independent controls.
+
+## Source-supported facts and project decisions
+
+| Topic | Source-supported fact | TEPP decision |
+|---|---|---|
+| GitHub jobs | Jobs run on separate runner instances and receive scoped tokens | Model, verifier, and publisher are separate jobs |
+| GitHub App authentication | A workflow can mint an installation token with explicit repository permissions | Publication token is minted only after non-executing validation |
+| Artifact handoff | Artifact upload/download actions expose immutable IDs and digests | Patch ID, digest, base, size, count, and modes are checked twice |
+| OpenCode | OpenCode is a programmable coding agent with provider configuration | One checksum-pinned binary uses NVIDIA NIM only |
+| NVIDIA NIM | NIM exposes OpenAI-compatible hosted inference APIs | Only `NVIDIA_NIM_API_KEY` reaches the proposal process |
+| SSDF | NIST SP 800-218 recommends protected build environments, review, provenance, and vulnerability response | Fresh verification and ordinary PR governance remain mandatory |
+| AI risk | ISO/IEC 23894:2023 and 42001:2023 require contextual risk treatment and controlled change | Stable no-op reasons, bounded proposals, traceable decisions, and rollback are documented |
+| Test-time compute | Fugu, Conductor, and TRINITY distinguish routing from deeper role-based workflows | Runtime LLM increments must preserve route/conduct and access-list controls |
+
+The GitHub, OpenCode, NVIDIA, NIST, ISO, and paper references below follow APA 7
+conventions as closely as the source type permits.
+
+## Upstream version evidence
+
+The official OpenCode GitHub release API identified OpenCode 1.18.13 as the
+current upstream release on 2026-08-06. The workflow deliberately pins OpenCode 1.17.13 because its Linux x64 archive SHA-256
+`157afa289d1a8d9372de0ce19ac726119b937a1f6b201808d46f06e4e59bb348`
+had already been independently reviewed in the CWL Noema workflow. The newer
+archive is not adopted until its exact asset digest is independently captured,
+reviewed, committed, and exercised. “Latest” is not allowed to mean
+“unverified.”
+
+This is a supply-chain project decision, not a claim that OpenCode 1.17.13 is
+functionally superior. The scheduled agent cannot auto-update itself.
+
+## Orchestration research application
+
+**Fugu.** Fugu frames orchestration as selecting between direct model use and
+deeper coordinated execution. TEPP already exposes explicit
+`auto|route|conduct` organization modes; the autonomous prompt requires future
+LLM changes to preserve this distinction.
+
+**Conductor.** Conductor generates natural-language subtasks, worker assignment,
+and access lists. The prompt therefore requires explicit workflow stages,
+dependencies, least-privilege evidence access, and bounded recursive depth.
+
+**TRINITY.** TRINITY emphasizes specialized thinker, worker, verifier, and
+synthesis roles. The prompt requires role-specific reasoning effort and
+reasoning-level ablation rather than one undifferentiated maximum-effort call.
+
+These papers motivate evaluation hypotheses. They do not prove that deeper
+orchestration always improves TEPP reports. Deterministic grounding,
+latency-insensitive quality tests, provider-reported usage where available, and
+human review must compare forced routing and conducted cells.
+
+## APA 7th references
+
+GitHub. (n.d.). *Security hardening for GitHub Actions*. GitHub Docs. Retrieved
+August 6, 2026, from
+https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
+
+GitHub. (n.d.). *Making authenticated API requests with a GitHub App in a GitHub
+Actions workflow*. GitHub Docs. Retrieved August 6, 2026, from
+https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow
+
+International Organization for Standardization, & International Electrotechnical
+Commission. (2023a). *Information technology—Artificial intelligence—Guidance
+on risk management* (ISO/IEC Standard No. 23894:2023).
+https://www.iso.org/standard/77304.html
+
+International Organization for Standardization, & International Electrotechnical
+Commission. (2023b). *Information technology—Artificial
+intelligence—Management system* (ISO/IEC Standard No. 42001:2023).
+https://www.iso.org/standard/42001
+
+National Institute of Standards and Technology. (2022). *Secure Software
+Development Framework (SSDF) version 1.1: Recommendations for mitigating the
+risk of software vulnerabilities* (NIST SP 800-218).
+https://doi.org/10.6028/NIST.SP.800-218
+
+Nielsen, S., Cetin, E., Schwendeman, P., Sun, Q., Xu, J., & Tang, Y. (2025).
+Learning to orchestrate agents in natural language with the Conductor. *arXiv*.
+https://arxiv.org/abs/2512.04388
+
+NVIDIA. (n.d.). *NVIDIA NIM APIs*. NVIDIA API Catalog. Retrieved August 6, 2026,
+from https://build.nvidia.com/
+
+OpenCode. (2026, August 4). *OpenCode 1.18.13* [Computer software release].
+GitHub. https://github.com/anomalyco/opencode/releases/tag/v1.18.13
+
+Sakana AI. (2026, June 22). *Sakana Fugu: One model to command them all*.
+https://sakana.ai/fugu-release/
+
+Xu, J., Sun, Q., Schwendeman, P., Nielsen, S., Cetin, E., & Tang, Y. (2025).
+TRINITY: An evolved LLM coordinator. *arXiv*.
+https://arxiv.org/abs/2512.04695
+
+## Tooling limitations recorded
+
+Consensus search was requested for this increment but did not return a usable
+paper record. Context7 reported its monthly quota exhausted. Primary paper
+records, official documentation, and the existing Contextual Orchestrator
+doctoring were therefore used directly. This limitation does not weaken the
+deterministic workflow tests and must be revisited in a later literature update.
+
+## Residual risk
+
+The NIM key exists inside the model process, proposed code is executed by an
+uncredentialed verifier with ordinary hosted-runner egress, and artifact digests
+do not establish semantic safety. A later broker can narrow NIM egress; a later
+central reusable workflow can remove duplicated repository policy. Neither
+future improvement may combine model execution with publication authority.

docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md

@@ -0,0 +1,147 @@
+# Hourly NVIDIA NIM Product Development
+
+The hourly NVIDIA NIM product-development workflow proposes one bounded
+commercial-quality increment when the repository has no open pull request. It is
+separate from the deterministic minute-17 quality sentinel and never merges,
+releases, deploys, approves, or changes reviewer credentials.
+
+## Schedule and queue behavior
+
+`.github/workflows/hourly-nim-product-development.yml` runs at minute 47 of every
+hour and supports `workflow_dispatch` with `dry_run=true`. The nonzero minute
+avoids the busiest scheduler boundary. A repository-scoped concurrency group
+does not cancel an active run.
+
+Before checkout or model execution, the proposal job reads at most one open pull
+request. Unreadable inventory, any open PR, a missing `NVIDIA_NIM_API_KEY`, or a
+missing Maintainer App configuration produces a stable fail-closed no-op. A dry
+run may print the task contract without either credential.
+
+When a PR exists, normal review → repair → exact-head Checks → merge governance
+owns the hour. The scheduler does not create a competing branch.
+
+## Required repository configuration
+
+Configure these repository or organization values:
+
+- Secret `NVIDIA_NIM_API_KEY` for the proposal runner only.
+- Variable `TEPP_MAINTAINER_APP_CLIENT_ID`.
+- Secret `TEPP_MAINTAINER_APP_PRIVATE_KEY`.
+- A repository-scoped GitHub App installation with metadata read, contents
+  write, and pull-request write permissions only.
+
+Do not place GitHub App credentials in the proposal or verifier jobs. Do not
+reuse the existing review App or alter its variable, secret, identity, or
+provider route. Do not configure `COPILOT_GITHUB_TOKEN`.
+
+A manual dry run verifies scheduling, queue, and prompt contracts without model
+or publication credentials. Missing production credentials leave the hourly
+developer disabled rather than falling back to `GITHUB_TOKEN`.
+
+## Three-runner trust boundary
+
+### 1. Proposal runner
+
+The proposal runner has read-only repository and pull-request permissions.
+OpenCode is downloaded from an immutable versioned URL and checked against a
+committed SHA-256. Its only model provider is NVIDIA NIM.
+
+The OpenCode process receives `NVIDIA_NIM_API_KEY` but has GitHub, OIDC, Actions
+runtime/cache, and runner command-file variables removed. Network tools, GitHub
+CLI, remote Git operations, commits, pushes, tags, external-directory access,
+task delegation, interactive questions, and OpenCode web tools are denied.
+
+The model may edit the local working tree and run repository tests. The trusted
+step stages the complete proposal, rejects whitespace errors, symbolic links,
+gitlinks, excessive file count, and excessive patch bytes, then uploads one
+binary full-index patch with a one-day retention period.
+
+### 2. Fresh verifier
+
+A new runner checks out the exact base SHA and downloads by immutable numeric
+artifact ID. It validates the upload digest, patch SHA-256, workflow-run
+identity, expiration, base SHA, file count, byte count, and Git modes before
+applying the patch.
+
+The verifier receives neither model nor publication credentials. It installs
+the hash-locked Python environment, compiles the quality scripts and tests,
+validates the workspace and documentation contracts, runs the quality tests
+with 100% statement and branch coverage, and executes the pinned Rust format,
+lint, test, documentation, dependency, line-coverage, and branch-coverage
+gates. Coverage artifacts remain under `$RUNNER_TEMP`. It rejects any
+verification mutation and proves the post-verification patch is byte-identical.
+
+### 3. Fresh publisher
+
+A third runner checks out the exact base and copies the trusted PR-message parser
+to `RUNNER_TEMP` before applying the proposal. It repeats the immutable artifact
+checks and applies the patch only as Git data. It executes no proposed tests,
+build scripts, packages, binaries, or shell files.
+
+The copied parser rejects symlinks, non-regular files, malformed UTF-8,
+unsupported controls, bidirectional spoofing, and byte-limit violations. Only
+after bounded metadata is written does the publisher mint the repository-scoped
+Maintainer App token. It then rechecks open-PR inventory and live `main`, pushes
+one unique branch, and calls `gh pr create` exactly once.
+
+## Proposal contract
+
+The autonomous prompt requires one buyer-visible gap, standalone and modular MSA
+compatibility, realistic test-first evidence, 100% coverage and docstrings,
+database naming policy, CHANGELOG and operations updates, and APA 7 doctoring.
+LLM work must use or improve Contextual Orchestrator and consider Fugu,
+Conductor, TRINITY, workflow stages, access lists, bounded recursion,
+role-specific reasoning effort, and ablation.
+
+The model must write `PR_MESSAGE.md` with a bounded title on the first line and a
+body describing the product gap, design, RED-to-GREEN evidence, verification,
+sources, version decision, and residual risk. Missing metadata receives a
+minimal trusted fallback body.
+
+## Failure and recovery
+
+Stable no-op reasons are:
+
+- `pull_request_inventory_unavailable`
+- `open_pull_request`
+- `nim_api_key_unavailable`
+- `maintainer_app_unavailable`
+
+A failed model candidate is discarded before a later candidate runs. A cleanup
+or reinstall failure stops fallback. A failed verifier publishes nothing. A
+publisher aborts if the artifact, base, queue, or metadata changed. If branch
+push succeeds but PR creation fails, the error trap removes the orphan branch.
+
+Investigate the exact run and job log, reproduce the relevant command on the
+same commit, add or retain a failing regression, and repair through a normal PR.
+Never bypass the verifier, substitute stale check evidence, or grant the model a
+write token.
+
+## Disablement and rollback
+
+Disable scheduled development by disabling the workflow, removing its schedule,
+or removing either dedicated credential. Removing only the model secret stops
+model execution; removing the Maintainer App values stops publication. The
+minute-17 deterministic quality sentinel continues independently.
+
+Rollback a faulty workflow through a reviewed revert PR. Do not edit branch
+protection, review workflows, or release workflows as an incident shortcut.
+Delete orphan `nim-agent/product-dev-*` branches only after confirming no open PR
+references them.
+
+## Residual risks
+
+- The model process necessarily receives the NIM credential. A future narrow
+  inference broker could keep the upstream secret outside the model process.
+- NVIDIA NIM may process repository source; operators must review confidentiality,
+  retention, regional, and contractual obligations.
+- The verifier executes untrusted code on an ephemeral hosted runner with
+  outbound network access, but receives no publication, NIM, OIDC, artifact/cache
+  runtime, command-file, or reviewer credential.
+- GitHub artifact storage, hosted runners, and pinned actions remain trusted
+  infrastructure. Digests prove identity, not semantic correctness.
+- GitHub cannot atomically create a PR only when none exists. Final queue and
+  base revalidation, unique branches, review, and exact-head Checks bound the
+  race.
+- The pinned OpenCode release intentionally trails the latest observed upstream
+  release until the exact Linux asset digest is independently reviewed.