Uh oh!
There was an error while loading. Please reload this page.
feat(automation): run Keyverse hourly NVIDIA NIM review repair - #1074
feat(automation): run Keyverse hourly NVIDIA NIM review repair#1074seonghobae wants to merge 9 commits into
Conversation
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Warning Review limit reached
Next review available in:46 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
42cc5df to
6afb5caCompareseonghobae
commented
Aug 19, 2026
Rebased onto current |
ec2eddf to
f5a4195Compareseonghobae
commented
Aug 19, 2026
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
feat/keyverse-hourly-nvidia-nim-review-repaircannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofeat/keyverse-hourly-nvidia-nim-review-repair, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 1074 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files># merge path: git commit# rebase path: git rebase --continue
git push origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair
# rebase path only: git push --force-with-lease origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: keyverse-hourly-review-caller.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_keyverse_hourly_review_caller.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
f5a4195e2a12e6953bc9b6ec823e2e36ce8d9489 - Workflow run: 32293312756
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: keyverse-hourly-review-caller.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_keyverse_hourly_review_caller.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path. Findings1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
gh pr checkout 1074 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files># merge path: git commit# rebase path: git rebase --continue
git push origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair
# rebase path only: git push --force-with-lease origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair
Merge Conflict Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: keyverse-hourly-review-caller.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_keyverse_hourly_review_caller.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: keyverse-hourly-review-caller.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_keyverse_hourly_review_caller.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Merge Conflict Guidance
gh pr checkout 1074 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files># merge path: git commit# rebase path: git rebase --continue
git push origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair
# rebase path only: git push --force-with-lease origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair |
f5a4195 to
16112a2Compareseonghobae
commented
Aug 20, 2026
Rebased onto current origin/main c47bee5 and preserved the existing hourly caller path set. Current HEAD: 16112a2 Validation on this HEAD:
@OpenCode review this exact HEAD after the rebase. |
16112a2 to
4e88010Compareseonghobae
commented
Aug 20, 2026
@opencode-agent review the exact current head $head_oid against protected base 2cce96f. Rebased this hourly caller onto current main; contract tests, changed-workflow actionlint, and diff --check were run on the exact rebased source. The caller keeps explicit target identity, bounded dispatch/retry, OIDC/approved secret scope, and no COPILOT token forwarding. Treat predecessor reviews/checks as historical and do not approve from queued or status-only evidence. |
seonghobae
commented
Aug 20, 2026
@opencode-agent Review the current exact head of the Keyverse hourly review-repair caller. Verify the thin caller targets |
![pr-auto-rebase[bot]](https://github.laxmiang.work.gd/r/github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Add a thin minute-29 caller for ContextualWisdomLab/keyverse on protected main. The caller maps only established scheduler credentials, grants job-scoped OIDC, and leaves NVIDIA_NIM_API_KEY on the reusable worker.
4e88010 to
507ae5eCompareseonghobae
commented
Aug 20, 2026
@opencode-agent Please review the exact current PR head 3bb0af9. Re-check changed-file scope, current mergeability, unresolved threads, and all required checks. Do not approve a stale head. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
seonghobae
commented
Aug 21, 2026
Exact-head review renewal
The two review threads are addressed; merge remains subject to fresh terminal protected Checks and independent approval. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
| # Minute 29 avoids Clearfolio (23), DiskSage (37), fast-mlsirm (49), | ||
| # BandScope (53), naruon (11), Inkspan (47), orchestrator (17), and | ||
| # Wardnet (7). |
There was a problem hiding this comment.
📝 Info: Cron comment lists an incomplete avoid-set
The avoid-set comment omits several existing callers (github 21, governance 43, orgmetra 58, nonnest2 16, originweave 10, quarantine-sandbox 14). Harmless since 29 collides with none, but the list is not exhaustive.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and requested changes before merge.
Findings
1. P2 .github/workflows/keyverse-hourly-review-repair.yml:1 - The new cron avoid-set comment is already stale
- Problem: The new workflow header introduces a schedule comment block (lines 5-7 in the focused changed hunk) that says minute 29 avoids only Clearfolio, DiskSage, fast-mlsirm, BandScope, naruon, Inkspan, orchestrator, and Wardnet. Cross-file counterpart evidence independently shows other active hourly callers already exist at originweave 10, quarantine-sandbox 14, and nonnest2 16 via tests/test_originweave_hourly_review_caller.py:57, tests/test_quarantine_sandbox_hourly_review_caller.py:62, and tests/test_nonnest2_hourly_review_caller.py:57, so the comment is not exhaustive and the current-head unresolved thread remains valid. Observable impact: future scheduler maintenance can rely on inaccurate operator guidance when choosing new cron minutes or reconciling collisions.
- Root cause: A hand-maintained avoid-set list was copied into the new caller without reconciling it against the current set of sibling hourly workflows, and the new Keyverse contract tests only verify cron/permissions/scheduler wiring/path coverage rather than this fragile comment contract.
- Fix: Either remove the enumerated avoid-set entirely or replace it with an accurate repo-neutral statement that minute 29 does not overlap the current hourly review-repair callers. If the exhaustive list should remain, update it from the full current caller set and add a contract assertion in
tests/test_keyverse_hourly_review_caller.pyso later scheduler additions cannot silently stale it again. - Regression test: python3 -m pytest tests
- Suggested diff: posted in this finding's inline review thread.
Summary
Pull request overview: reviewed .github/workflows/keyverse-hourly-review-repair.yml, .github/workflows/hourly-nvidia-nim-review-repair.yml, ARCHITECTURE.md, docs/doctoring/keyverse-hourly-review-caller.md, and tests/test_keyverse_hourly_review_caller.py; the thin caller, shared-gate wiring, docs, and new contract test mostly match sibling patterns, but the current-head unresolved thread remains source-backed because the new minute-29 avoid-set comment omits active callers proved by sibling tests. Approval sufficiency: not sufficient. Verification posture: focused hunk inspection plus trusted bounded CodeGraph/current-head evidence only; no untrusted runtime claims. Linter/static: failed-check evidence says no completed failed GitHub Checks were present when evidence was collected. TDD/regression: new Keyverse contract tests exist, but they do not guard the stale cron-allocation comment. Coverage: Coverage execution evidence says supported repository test suites passed. Docstring coverage: Coverage execution evidence says configured repository docstring gates passed or docstring coverage was advisory. DAG: head-flow Mermaid flowchart LR A[".github/workflows/keyverse-hourly-review-repair.yml"] --> B[".github/workflows/pr-review-fix-scheduler.yml"]; C["tests/test_keyverse_hourly_review_caller.py"] --> A; D[".github/workflows/hourly-nvidia-nim-review-repair.yml"] --> C; A --> E["Risk: stale cron-allocation comment"]; C --> F["Verification: python3 -m pytest tests"]. PoC/execution: bounded source traces plus coverage evidence only. DDD/domain: hourly review-repair caller provisioning. CDD/context: CodeGraph blast radius is the thin caller, sibling contract-test pattern, and shared scheduler boundary. Similar issues: current-head unresolved review thread on .github/workflows/keyverse-hourly-review-repair.yml line 7 matches the verified drift. Claim/concept check: target_repository, base_branch, non-cancelling concurrency, and narrow secret/OIDC scope are source-backed by the focused hunk and tests. Standards search: not material to this workflow/doc/test change. Compatibility/convention: changed workflow/doc/test names follow existing caller conventions; no new exposed API/schema identifiers or reserved-word issues. Breaking-change/backcompat: no public API break, but stale operator guidance should be corrected before merge. Implementation completeness: caller, docs, and tests are present; only the schedule comment contract is incomplete. Performance: negligible. Developer experience: scheduler-maintenance guidance regresses because the comment looks exhaustive but is not. User experience: Keyverse hourly repair cadence is added and otherwise bounded correctly. Visual/DOM: non-web workflow/docs/test surface reviewed. Accessibility/i18n: non-web change with no interactive UI surface. Supply-chain/license: no dependency additions. Packaging: existing pyproject.toml test/coverage/docstring contracts cover the Python test surface. Security/privacy: the caller remains read-only at workflow scope with job-scoped id-token: write and explicit secret mapping only.
Adversarial validation
{"status":"failed","probes":[{"path":".github/workflows/keyverse-hourly-review-repair.yml","line":1,"hypothesis":"The minute-29 comment provides exhaustive and safe scheduler guidance for future hourly caller allocation.","attack_or_counterexample":"Cross-check the new comment against independently sourced sibling caller contracts instead of trusting the comment text.","evidence":"Trusted source trace at .github/workflows/keyverse-hourly-review-repair.yml:1 observed the focused changed hunk add a comment listing only Clearfolio (23), DiskSage (37), fast-mlsirm (49), BandScope (53), naruon (11), Inkspan (47), orchestrator (17), and Wardnet (7); independent cross-file source blocks observed `assert 'cron: \"10 * * * *\"'` in tests/test_originweave_hourly_review_caller.py:57, `assert 'cron: \"14 * * * *\"'` in tests/test_quarantine_sandbox_hourly_review_caller.py:62, and `assert 'cron: \"16 * * * *\"'` in tests/test_nonnest2_hourly_review_caller.py:57, confirming the avoid-set is incomplete; Trusted current-head source binding at .github/workflows/keyverse-hourly-review-repair.yml:1; source-line-sha256=d2fbbc9d071389f040c42dbc8817a969c16e2a4c0c1ca8e9492dedc9de80f120","outcome":"confirmed"},{"path":".github/workflows/keyverse-hourly-review-repair.yml","line":32,"hypothesis":"The new thin caller leaks model secrets or widens workflow authority when delegating to the shared scheduler.","attack_or_counterexample":"Inspect the caller job for inherited secrets, model-token forwarding, or write scopes.","evidence":"Trusted source trace at .github/workflows/keyverse-hourly-review-repair.yml:32 observed the focused changed hunk end with only `PR_REVIEW_MERGE_TOKEN` and `OPENCODE_APPROVE_TOKEN` under `secrets:` and only `contents: read` plus job-scoped `id-token: write`; the CodeGraph source block `test_keyverse_caller_preserves_oidc_and_explicit_secret_scope` observed assertions at tests/test_keyverse_hourly_review_caller.py:73-90 rejecting `secrets: inherit`, `NVIDIA_NIM_API_KEY`, `COPILOT_GITHUB_TOKEN`, and workflow write scopes, so the privilege-escalation hypothesis was falsified; Trusted current-head source binding at .github/workflows/keyverse-hourly-review-repair.yml:32; source-line-sha256=b1f03174d241d8bbca8a502bc9f395b7c214f6639a277e26b5893055f8be185c","outcome":"falsified"},{"path":".github/workflows/hourly-nvidia-nim-review-repair.yml","line":173,"hypothesis":"Keyverse caller/doc/test edits can bypass the focused hourly quality gate.","attack_or_counterexample":"Check whether the quality workflow updated both trigger path sets and the compileall contract for all new Keyverse surfaces.","evidence":"Trusted source trace at .github/workflows/hourly-nvidia-nim-review-repair.yml:173 observed the focused changed hunks add `.github/workflows/keyverse-hourly-review-repair.yml`, `docs/doctoring/keyverse-hourly-review-caller.md`, and `tests/test_keyverse_hourly_review_caller.py` to both `pull_request` and `push` path lists, and add `tests/test_keyverse_hourly_review_caller.py` to the compileall block, so the gate-bypass hypothesis was falsified; Trusted current-head source binding at .github/workflows/hourly-nvidia-nim-review-repair.yml:173; source-line-sha256=fc3be00200cc6db53da7c5f2955ebbb391622216b190e4a47d780a2e2c2716b8","outcome":"falsified"}],"residual_risk":"After fixing or removing the stale schedule comment, the remaining risk is limited to future manual cron-documentation drift across sibling callers because the current Keyverse test file does not appear to enforce exhaustive minute-comment accuracy."}Result: REQUEST_CHANGES
Reason: The new Keyverse caller is wired correctly overall, but the current-head unresolved thread is still valid because the minute-29 avoid-set comment is already incomplete.
Head SHA:
c70ff9369f9b49b3e961fe1f63d0204e713400f5Workflow run: 32941185001
Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: keyverse-hourly-review-caller.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_keyverse_hourly_review_caller.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
| @@ -0,0 +1,32 @@ | |||
| name: Keyverse Hourly Review Repair | |||
There was a problem hiding this comment.
P2 The new cron avoid-set comment is already stale
- Location:
.github/workflows/keyverse-hourly-review-repair.yml:1 - Problem: The new workflow header introduces a schedule comment block (lines 5-7 in the focused changed hunk) that says minute 29 avoids only Clearfolio, DiskSage, fast-mlsirm, BandScope, naruon, Inkspan, orchestrator, and Wardnet. Cross-file counterpart evidence independently shows other active hourly callers already exist at originweave 10, quarantine-sandbox 14, and nonnest2 16 via tests/test_originweave_hourly_review_caller.py:57, tests/test_quarantine_sandbox_hourly_review_caller.py:62, and tests/test_nonnest2_hourly_review_caller.py:57, so the comment is not exhaustive and the current-head unresolved thread remains valid. Observable impact: future scheduler maintenance can rely on inaccurate operator guidance when choosing new cron minutes or reconciling collisions.
- Root cause: A hand-maintained avoid-set list was copied into the new caller without reconciling it against the current set of sibling hourly workflows, and the new Keyverse contract tests only verify cron/permissions/scheduler wiring/path coverage rather than this fragile comment contract.
- Fix: Either remove the enumerated avoid-set entirely or replace it with an accurate repo-neutral statement that minute 29 does not overlap the current hourly review-repair callers. If the exhaustive list should remain, update it from the full current caller set and add a contract assertion in
tests/test_keyverse_hourly_review_caller.pyso later scheduler additions cannot silently stale it again. - Regression test: python3 -m pytest tests
Suggested diff
```diff
- # Minute 29 avoids Clearfolio (23), DiskSage (37), fast-mlsirm (49),- # BandScope (53), naruon (11), Inkspan (47), orchestrator (17), and- # Wardnet (7).+ # Minute 29 is reserved for Keyverse and does not overlap the current+ # hourly review-repair callers.There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
feat/keyverse-hourly-nvidia-nim-review-repaircannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofeat/keyverse-hourly-nvidia-nim-review-repair, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 1074 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files># merge path: git commit# rebase path: git rebase --continue
git push origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair
# rebase path only: git push --force-with-lease origin HEAD:feat/keyverse-hourly-nvidia-nim-review-repair- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: keyverse-hourly-review-caller.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_keyverse_hourly_review_caller.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
c70ff9369f9b49b3e961fe1f63d0204e713400f5 - Workflow run: 32952900551
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: ARCHITECTURE.md"]
S2 --> I2["repository behavior"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["required checks"]
Evidence --> S3["Docs: keyverse-hourly-review-caller.md"]
S3 --> I3["operator or user guidance"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["docs review"]
Evidence --> S4["Test: test_keyverse_hourly_review_caller.py"]
S4 --> I4["regression suite"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["targeted test run"]
Buyer-perceivable gap
Hourly NVIDIA NIM review repair never scanned
ContextualWisdomLab/keyverse. Live IdP pull requests such as ContextualWisdomLab/keyverse#83, #100, and #101 target protectedmainand stalled while Clearfolio, DiskSage, and fast-mlsirm received heartbeats.Change
base_branch: main, one dispatch, two-hour same-head retry.id-token: writeso the reusable scheduler can mint the OpenCode App fallback from GitHub OIDC.PR_REVIEW_MERGE_TOKENandOPENCODE_APPROVE_TOKEN. NeverNVIDIA_NIM_API_KEYon the caller. NeverCOPILOT_GITHUB_TOKEN.pull_request/push/compileallpath contracts.Do not self-approve. Merge remains subject to two-approval + last-pusher ruleset. GitHub review/Checks wait is not a blocker.
Refs ContextualWisdomLab/keyverse#83, ContextualWisdomLab/keyverse#100, and ContextualWisdomLab/keyverse#101.