feat(automation): run BandScope hourly NVIDIA NIM review repair

[seonghobae]

Purpose

Add the product-specific one-hour PR review → repair → revalidation caller for ContextualWisdomLab/bandscope, reusing the bounded NVIDIA NIM scheduler from prerequisite PR #782 without copying privileged implementation into the product repository.

Exact current stacked head

25b2109628f6dcf8fdf6af6f860b727c3980496a

The branch now contains a real merge parent for current prerequisite head b921e26854f1b0fd367c76a32af6db966374bcef; GitHub reports the stacked PR mergeable with exactly six product/support files. The inherited tests/test_opencode_agent_contract.py drift is absent. No force-push, temporary workflow, encoded patch, or competing branch writer was used.

Product and MSA behavior

• Run .github/workflows/bandscope-hourly-review-repair.yml at minute 47 of every hour.
• Target only ContextualWisdomLab/bandscope pull requests into protected develop.
• Permit one repair dispatch per invocation and one retry per exact head per hour.
• Keep a BandScope-specific single-flight concurrency group so product runs cannot cancel other product heartbeats.
• Reuse the product-neutral central scheduler rather than copying privileged implementation into BandScope.
• Preserve standalone BandScope operation and naruon rehearsal-handoff integration.

Credential, privacy, and compliance boundary

• The caller maps only PR_REVIEW_MERGE_TOKEN and OPENCODE_APPROVE_TOKEN; it never uses secrets: inherit.
• COPILOT_GITHUB_TOKEN, GitHub Models, and direct NVIDIA_NIM_API_KEY binding are absent from the caller.
• The caller and reusable scheduler keep the workflow-generated GITHUB_TOKEN read-only and declare no job-level write elevation.
• Cross-repository operations use only explicit scheduler credentials, with no github.token mutation fallback.
• The caller contains product/base identity and bounded numeric limits, not business payloads, review bodies, model output, or personal records. Separation and minimization preserve required operational identifiers without masking them.
• The repair plane cannot approve, merge, release, alter reviewer credentials, update branch protection, or reinterpret failed checks.

Permanent six-file slice

• .github/workflows/bandscope-hourly-review-repair.yml
• .github/workflows/hourly-nvidia-nim-review-repair.yml
• CHANGELOG.md
• docs/doctoring/bandscope-hourly-review-caller.md
• tests/test_bandscope_hourly_review_repair_contract.py
• tests/test_hourly_autofix_context_quality_gate.py

The focused workflow tracks the caller, contract, and doctoring and compiles the BandScope-specific contract. The shared quality regression now inspects the complete compile block rather than relying on one fragile file adjacency.

Stacked activation boundary

This PR targets fix/hourly-nvidia-nim-review-repair-main, the head branch of prerequisite #782. It must not merge before #782. The schedule is inactive until prerequisite and caller both reach protected main.

After #782 merges:

1. retarget this PR to main;
2. verify the effective diff remains the exact six-file product/support slice;
3. rerun every exact-head focused/full quality, 100% production statement/branch/docstring, security, supply-chain, CodeRabbit, OpenCode, Noema, independent-approval, unresolved-thread, and branch-protection gate;
4. merge only without administrative bypass.

Keep Draft. Pending, queued, cancelled, skipped-required, status-only, author-only, predecessor-head, or synthetic evidence is not acceptance.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1d2668fd-80e9-4e42-800a-f5e536a2f3ba

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

/oc Refetch the exact live PR head and stop without writing unless it is a628d4dd77541305a958acd1a911b70dfdcc7d9c. Exact-head run 31162266315, job 92815128555, produced valid RED evidence: 1,053 tests passed, both production helpers retained 100% statement/branch coverage, and only three stale or brittle test contracts failed. Apply the minimum test-only GREEN repair; do not weaken or alter production workflows, scripts, credentials, scheduling, merge policy, or NVIDIA NIM boundaries.

1. In tests/test_bandscope_hourly_review_repair_contract.py::test_focused_quality_workflow_tracks_bandscope_caller_and_contract, replace the brittle whole-file count(...) == 2 assertion for tests/test_bandscope_hourly_review_repair_contract.py with bounded assertions that independently prove the path is present in the pull_request.paths trigger block and in the focused verification/compile target block. Do not constrain harmless additional exact occurrences.
2. In inherited tests/test_hourly_autofix_context_quality_gate.py::test_context_helper_is_part_of_the_focused_exact_head_quality_gate, stop requiring scripts/ci/pr_review_autofix_context.py to be immediately adjacent to tests/test_pr_review_conflict_scope.py. Extract the bounded python -m compileall -q command block and assert each required path is present, so adding a product caller contract cannot invalidate the central quality contract.
3. In inherited tests/test_opencode_agent_contract.py::test_autofix_worker_resolves_merge_conflicts_fail_closed, replace the obsolete git push origin "HEAD:${PR_HEAD_REF}" assertion with the hardened explicit destination contract already implemented by the worker: require expected_origin="${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git", require git -c core.hooksPath=/dev/null push "$expected_origin" "HEAD:${PR_HEAD_REF}", and explicitly reject the mutable push origin form.

Run those three tests first, then the exact focused workflow suite, full repository tests, 100% production statement/branch coverage, 100% public docstrings, compileall, and git diff --check. Keep the PR Draft and stacked on #782 until the prerequisite reaches protected main; do not create another branch, PR, repair workflow, encoded patch, self-modifying workflow, or branch writer. Keep NVIDIA_NIM_API_KEY; never introduce COPILOT_GITHUB_TOKEN or alter the independent reviewer credential chain.

[seonghobae]

/oc Refetch the live PR head and stop without writing unless it is exactly 2ecbd35abf6141c4461a81d65747cb965e495f72. Fresh exact-head run 31166591497, job 92828701768, proves the two BandScope-local brittle contracts are GREEN: the full repository suite now has only one failure, inherited from prerequisite #782, while 1,055 tests pass and both production helpers retain 100% statement/branch coverage.

Apply the minimum permanent test-contract repair already required on #782: in tests/test_opencode_agent_contract.py::test_autofix_worker_resolves_merge_conflicts_fail_closed, replace the obsolete mutable-origin assertion with the hardened explicit destination contract implemented by .github/workflows/pr-review-autofix.yml. Require expected_origin="${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git", require git -c core.hooksPath=/dev/null push "$expected_origin" "HEAD:${PR_HEAD_REF}", and explicitly reject git push origin "HEAD:${PR_HEAD_REF}". Do not weaken the production worker, credential isolation, exact-scope verifier, hook suppression, NVIDIA NIM-only model authentication, independent review chain, or fail-closed push validation.

Run the focused test first, then the complete hourly quality suite, full repository tests, 100% production statement/branch coverage, 100% public docstrings, compileall, and git diff --check. Keep this PR Draft and stacked on #782; do not create another branch, PR, repair workflow, patch artifact, approval, merge, release, retarget, or force push. Never introduce COPILOT_GITHUB_TOKEN.

[seonghobae]

@opencode-agent

Repair the current stacked exact head 2ecbd35abf6141c4461a81d65747cb965e495f72 directly on feat/bandscope-hourly-nvidia-nim-review-repair; refetch and abort unless that live head is unchanged. The BandScope caller implementation is not the failing surface. Exact run 31166591497, job 92843419366, reports 1 failed, 1055 passed because this stacked head still carries the predecessor-base assertion git push origin "HEAD:${PR_HEAD_REF}" in tests/test_opencode_agent_contract.py, while prerequisite #782 has already corrected the contract at exact base head 7444580e9418120475964d0b97fe2968f9f11308.

Reconcile the stacked branch with the current prerequisite branch without force-push or transient workflow. The resulting tree must copy the current prerequisite version of tests/test_opencode_agent_contract.py exactly, retaining these assertions:

assert 'expected_origin="${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git"' in worker
assert (
    'git -c core.hooksPath=/dev/null push "$expected_origin" '
    '"HEAD:${PR_HEAD_REF}"'
    in worker
)
assert 'git push origin "HEAD:${PR_HEAD_REF}"' not in worker

Do not modify the reviewed production autofix workflow or widen the six-file BandScope product slice. Preserve the minute-47 bandscope:develop caller, exact explicit token mapping, no inherited/model secrets, product-specific concurrency, doctoring, and CHANGELOG. Run the focused BandScope contract and the complete inherited hourly quality suite with 100% production statement/branch/docstring, compileall, and diff checks. Keep Draft and stacked on #782 until the prerequisite reaches protected main.