feat: schedule hourly protected review loop

[seonghobae]

Customer-visible outcome

The repository runs one bounded protected review/product-gap loop at minute 07 of every hour. The caller targets main, preserves long-running OpenCode/Noema/Strix work with non-cancelling concurrency, and forwards only the established PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN secrets to the central scheduler.

The workflow has no manual branch-selection entry point, never uses secrets: inherit or COPILOT_GITHUB_TOKEN, and grants id-token: write only to the reusable-workflow job for the existing OpenCode app-token exchange. Central .github PR #1170 supplies the contextual-orchestrator gateway route after it is merged and independently approved. Superseded central PR #1183 is closed without merge and is not a prerequisite.

Current-head verification

• HEAD: 5dccb65fdd6088deb7c014f819340cceeb89c313
• Contract tests: 2 passed
• actionlint: passed
• python -m compileall -q tests: passed
• git diff --check: passed

Please review this exact HEAD and run the protected current-head Checks. Do not merge without an independent qualifying approval, resolved threads, and terminal required Checks.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 459fdc2a-4aaf-4b40-a657-96ac4fc1f9a5

📥 Commits

Reviewing files that changed from the base of the PR and between e226e11 and 5dccb65.

📒 Files selected for processing (4)

• .github/workflows/contextual-orchestrator-hourly-review-repair.yml
• docs/doctoring/contextual-orchestrator-hourly-review-caller.md
• docs/planning/adrs/0028-hourly-review-loop.md
• tests/test_hourly_review_scheduler_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact current HEAD 2693c01b79c564db041abc930f3365eddd74dfe3 adds the one-hour caller and its contract evidence. Focused contract tests: 2 passed; actionlint and git diff --check passed. The caller bounds each tick to one PR/dispatch, preserves in-flight reviews, routes through central pr-review-fix-scheduler.yml, and explicitly excludes COPILOT_GITHUB_TOKEN. @opencode-agent review this exact SHA only and publish a formal verdict.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[seonghobae]

Dependency evidence: this caller remains gated on central ContextualWisdomLab/.github PR #1170, which provides the reviewed contextual-orchestrator gateway route. #1170 is still open at exact head 4684f6e212ba40d12e5217f0f52ee1e90c796ed8 with queued Checks and no qualifying approval; do not enable or claim the hourly caller as protected automation until that prerequisite and this PR each pass current-head review and protected checks.

[seonghobae]

Current-head repair completed at 5dccb65fdd6088deb7c014f819340cceeb89c313.

Root cause fixed: the caller previously inherited the entire caller secret set and exposed workflow_dispatch, which violated the central scheduler's explicit-secret and no-branch-selection contracts. The job now forwards only PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN, grants id-token: write only for the reusable job, and remains schedule-only.

Verification: contract tests 2 passed, actionlint passed, test compileall passed, and git diff check passed. The branch update was a normal PR-head push; no merge, self-approval, or protected merge authorization was used. Please run independent review and protected Checks for this exact head.

[seonghobae]

Architecture reconciliation: central .github PR #1183 now includes the same minute-17 caller plus the gateway route. Do not merge both callers, because they would dispatch duplicate hourly scans for the same target.

Keep this PR as the target-repository fallback until #1183 reaches protected merge; then close this duplicate as superseded (or retain it only if #1183 is abandoned and this caller is explicitly rebased to the current central contract).

[seonghobae]

Review exact current HEAD 5dccb65 only. Verify the hourly reusable-workflow caller, explicit scheduler secret boundary, OIDC permission scope, no COPILOT_GITHUB_TOKEN, and protected central routing. Report current findings only.

[seonghobae]

Dependency correction recorded: current body now points to central .github PR #1170 at exact head 4684f6e212ba40d12e5217f0f52ee1e90c796ed8. Central PR #1183 is closed without merge, so it cannot be the prerequisite. The caller implementation/head 5dccb65fdd6088deb7c014f819340cceeb89c313 was not changed; protected activation still requires independent approvals and terminal Checks for both PRs.

[seonghobae]

@opencode-agent Please independently review exact current head 5dccb65fdd6088deb7c014f819340cceeb89c313 against main. Central .github PR #1170 is the open gateway prerequisite; #1183 is closed without merge. Revalidate the hourly caller, secret boundary, current Checks, and exact dependency wording; bind any result to this SHA only and do not self-approve or merge.

[seonghobae]

Further reconciliation: central .github PR #1178 is the existing canonical minute-17 caller, and #1183 was closed as a competing writer. If #1178 merges, this target-local minute-07 caller must not also merge because it would create duplicate hourly dispatches. Keep this PR as a fallback only until #1178's protected merge decision; then close it as superseded or explicitly retarget it to a non-overlapping product-owned cadence.

[seonghobae]

Closing this target-local caller as superseded by central .github PR #1178, which is the canonical minute-17 caller for the same contextual-orchestrator target and already carries the gateway dependency path. Keeping both would create duplicate hourly scheduler dispatches. The implementation remains available in this PR history; reopen only if #1178 is rejected and ownership is intentionally returned to this repository. No protected merge or approval is inferred.