fix(automation): harden hourly maintenance credentials

[seonghobae]

Scope

This Draft is the repository-local scheduler hardening replacement for superseded #67. It is limited to hourly maintenance credentials, concurrency, RCA/feasibility behavior, and writer-lease recovery. Exact-source CI governance remains independently owned by #88.

Scheduler and trust boundary

• run the existing maintenance workflow at minute 17 each hour rather than add a duplicate scheduler;
• serialize maintenance with repository-level queue: max and cancel-in-progress: false;
• pin the review-fix caller and compatibility input to exact current central #782 candidate 60de3e6b6e8363c0aa3de8276f42a67597b2599c for Draft verification only;
• grant the caller only contents: read and id-token: write;
• keep workflow GITHUB_TOKEN without repository-write authority;
• allow central OIDC exchange for the short-lived OpenCode GitHub App token;
• retain only explicitly mapped PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN fallbacks, never secrets: inherit in the review-fix plane;
• keep NVIDIA_NIM_API_KEY inside the separately reviewed central worker and keep COPILOT_GITHUB_TOKEN out of the product caller; and
• preserve the independent review-merge scheduler credential chain, permissions, inputs, and merge policy.

No temporary repair workflow, generated coverage database, release/publication, new long-lived credential, or new model credential is introduced.

RCA -> remedy -> proof

The previous Draft candidate pin became stale when read-only central #782 advanced. The leaf-owned workflow was correctly moved to 60de3e6b6e8363c0aa3de8276f42a67597b2599c, but source e535bf940dfcae701103c7937a90c1738a8a8bfe exposed a repository-owned regression in the general workflow contract: tests/test_workflow_contracts.py still hard-coded predecessor candidate 17bd5e4a98a718012dcb82d5028aa697a4ca8077.

CI 31518697857 failed exactly that mismatch: Python 3.10 reported 1 failed, 354 passed, 3 deselected; the failed test was test_hourly_workflow_repairs_revalidates_and_merges_pull_requests. The dedicated scheduler credential-boundary test already expected 60de3e6b6e8363c0aa3de8276f42a67597b2599c, so the first failing boundary was the stale shared test rather than the workflow or central candidate.

Current source b27c0c4ac27996581ead3f1ba766e303113a1cdb applies the smallest root-cause repair: the shared workflow contract now expects the same exact immutable candidate as the permanent scheduler workflow and dedicated boundary test. It does not change the workflow, permissions, central source, credentials, or production package behavior.

Current exact state

• Source head: b27c0c4ac27996581ead3f1ba766e303113a1cdb.
• Independently resolved protected pg-llm-batch main: bf2cc2e140dc3ff4a56c3203f80f41bb9fed5d10.
• GitHub reports Draft and mergeable.
• Current-head CI 31526608108: completed / success.
• Current-head Security Scan 31526607995: completed / success.
• Current-head SAST Semgrep 31526607894: completed / success.
• Formal reviews: none; unresolved inline review threads: zero.

The predecessor CI failure is retained as RCA evidence only and does not transfer to this head. These current PR-triggered successes are still staged merge-compatibility evidence because protected main has not yet integrated #88 exact-source checkout governance; they are not final exact contributor-head acceptance.

Read-only central prerequisites

• central #782 remains read-only and its exact candidate is used only for Draft verification; final acceptance requires the actual protected integration SHA;
• OPENCODE_REPOSITORY_DISPATCH_TARGETS authorization remains an external configuration-evidence boundary because this writer cannot read the relevant organization/repository variable through the connected credential; do not infer membership or weaken the allow-list;
• central #790 remains a separate read-only review/runtime dependency; no leaf workaround, trigger, dismissal, or merge is permitted here.

Central movement is dependency drift, not a pg-llm-batch writer conflict.

Promotion / merge boundary

Keep #69 Draft until central scheduler prerequisite #782 reaches protected .github/main, caller-visible dispatch authorization for ContextualWisdomLab/pg-llm-batch is proven, and current leaf evidence is regenerated under protected exact-source governance. Then replace the temporary candidate pin with the exact protected integration SHA and reacquire affected CI/security/coverage/package/provenance/review/branch/release gates.

Merge only with zero valid unresolved findings and every approval requirement actually imposed by live policy. Predecessor, generated-merge-only, queued, pending, cancelled, skipped-required, absent, neutral-required, status-only, author-only, infrastructure-only, or failed evidence is not final acceptance.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 829a6521-51ae-4d50-b659-cf47c9a4cd76

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact current head ce35185a210caa16a1255c78e5c27e51d8870f89 while this scheduler/credential PR remains Draft. The read-only central candidate #782 is still open at the pinned 17bd5e4a98a718012dcb82d5028aa697a4ca8077; review only current pg-llm-batch source semantics and do not treat central integration latency as a leaf source defect.

[coderabbitai]

@seonghobae I will review PR #69 at ce35185a210caa16a1255c78e5c27e51d8870f89.

I will review only the current pg-llm-batch source semantics. I will not report the open central candidate #782 or its integration latency as a leaf-source defect.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Superseded by the live protected-main governance gap tracked in #157. Fresh protected main 7a0603c2ef27469f20574858d939172e571a2421 now has exact-source governance, while this branch is anchored to an obsolete central candidate and predates the current hourly caller/runtime contract. The remaining real defect is narrower and current: the protected hourly caller still uses cancel-in-progress: true, pins the central reusable workflows to 5983b41ace75040c1d81818171ca7d0f3653254e, and passes secrets: inherit; #157 owns composition with the read-only central prerequisite. No checks or reviews from this stale branch transfer.