ci(automation): restore LineageWeave hourly repair caller (#1380)

Author: seonghobae

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -11,6 +11,7 @@ on:
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/inkspan-hourly-review-repair.yml
+      - .github/workflows/lineageweave-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
       - .github/workflows/github-hourly-review-repair.yml
       - .github/workflows/governance-risk-compliance-hourly-review-repair.yml
@@ -34,6 +35,7 @@ on:
       - tests/test_bandscope_hourly_review_caller.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_inkspan_hourly_review_caller.py
+      - tests/test_lineageweave_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
       - tests/test_github_hourly_conflict_repair.py
       - tests/test_governance_risk_compliance_hourly_review_caller.py
@@ -62,6 +64,7 @@ on:
       - docs/doctoring/conflict-control-evidence-isolation.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/inkspan-hourly-review-caller.md
+      - docs/doctoring/lineageweave-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
       - docs/doctoring/github-hourly-conflict-repair.md
       - docs/doctoring/governance-risk-compliance-hourly-review-caller.md
@@ -82,6 +85,7 @@ on:
       - .github/workflows/clearfolio-hourly-review-repair.yml
       - .github/workflows/disksage-hourly-review-repair.yml
       - .github/workflows/inkspan-hourly-review-repair.yml
+      - .github/workflows/lineageweave-hourly-review-repair.yml
       - .github/workflows/fast-mlsirm-hourly-review-repair.yml
       - .github/workflows/github-hourly-review-repair.yml
       - .github/workflows/governance-risk-compliance-hourly-review-repair.yml
@@ -105,6 +109,7 @@ on:
       - tests/test_bandscope_hourly_review_caller.py
       - tests/test_disksage_hourly_review_caller.py
       - tests/test_inkspan_hourly_review_caller.py
+      - tests/test_lineageweave_hourly_review_caller.py
       - tests/test_fast_mlsirm_hourly_review_caller.py
       - tests/test_github_hourly_conflict_repair.py
       - tests/test_governance_risk_compliance_hourly_review_caller.py
@@ -133,6 +138,7 @@ on:
       - docs/doctoring/conflict-control-evidence-isolation.md
       - docs/doctoring/disksage-hourly-review-caller.md
       - docs/doctoring/inkspan-hourly-review-caller.md
+      - docs/doctoring/lineageweave-hourly-review-caller.md
       - docs/doctoring/fast-mlsirm-hourly-review-caller.md
       - docs/doctoring/github-hourly-conflict-repair.md
       - docs/doctoring/governance-risk-compliance-hourly-review-caller.md
@@ -204,6 +210,7 @@ jobs:
             tests/test_bandscope_hourly_review_caller.py \
             tests/test_disksage_hourly_review_caller.py \
             tests/test_inkspan_hourly_review_caller.py \
+            tests/test_lineageweave_hourly_review_caller.py \
             tests/test_fast_mlsirm_hourly_review_caller.py \
             tests/test_github_hourly_conflict_repair.py \
             tests/test_governance_risk_compliance_hourly_review_caller.py \

.github/workflows/lineageweave-hourly-review-repair.yml

@@ -0,0 +1,28 @@
+name: LineageWeave Hourly Review Repair
+
+on:
+  schedule:
+    - cron: "4 * * * *"
+
+concurrency:
+  group: lineageweave-hourly-review-repair
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch-review-repair:
+    uses: ./.github/workflows/pr-review-fix-scheduler.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      target_repository: ContextualWisdomLab/LineageWeave
+      base_branch: "*"
+      max_prs: "50"
+      max_dispatches: "1"
+      retry_hours: "2"
+    secrets:
+      PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}
+      OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}

CHANGELOG.md

@@ -5,6 +5,12 @@ this file. The format follows Keep a Changelog, and versioned releases follow
 Semantic Versioning where the repository publishes a release.
 
 ## [Unreleased]
+- Add a bounded hourly LineageWeave stacked-PR review-repair caller while
+  preserving the existing review-agent, model-routing, and protected-merge
+  boundaries. Product-gap development remains a separately gated coordinator
+  capability and is not claimed by this caller. The shared repair scheduler
+  now treats an explicit `*` base scope as all branch bases so stacked pull
+  requests are inspected instead of silently filtered out.
 - Ensure the central Security Scan and SAST Semgrep pull-request workflows
   trigger for stacked PRs targeting feature branches, preserving the same
   diff-scoped dependency and repository-wide filesystem security coverage.

docs/doctoring/lineageweave-hourly-review-caller.md

@@ -0,0 +1,66 @@
+# LineageWeave hourly review-repair caller
+
+## Decision
+
+The organization control plane invokes its existing review-repair scheduler for
+`ContextualWisdomLab/LineageWeave` at minute 4 of every hour. The caller scans
+all pull-request bases because LineageWeave uses stacked pull requests, but it
+dispatches at most one repair and waits two hours before retrying an unchanged
+head. A new heartbeat never cancels an in-flight diagnosis.
+
+The caller is deliberately thin. It does not approve, merge, release, or change
+a review-agent identity. It does not create product work. The reusable
+scheduler refetches the current head, reviews, threads, checks, and writer lease
+before dispatching the existing OpenCode repair worker. Independent current-head approval
+and all protected checks remain mandatory.
+
+## Credential and model boundary
+
+The workflow token is read-only. The caller maps only the established
+`PR_REVIEW_MERGE_TOKEN` and `OPENCODE_APPROVE_TOKEN` inputs and permits the
+reusable scheduler's existing OIDC fallback; it never inherits all secrets.
+It does not receive a model credential or provider endpoint and does not use
+`COPILOT_GITHUB_TOKEN`.
+
+Model execution remains inside the reviewed central worker and crosses its
+`contextual-orchestrator` boundary. This caller neither selects a provider nor
+changes contextual-orchestrator discovery, routing, or review-agent secrets.
+
+## Product-gap continuation boundary
+
+This caller closes the missing hourly stacked-PR repair path only. Product-gap
+development after the PR queue empties remains owned by the organization
+commercial-readiness coordinator and an explicitly opted-in, bounded
+repository development entrypoint. LineageWeave does not currently publish
+that entrypoint, and recent coordinator runs failed before inventory because
+their maintainer credential was unavailable. Therefore this workflow is not
+evidence that autonomous product-gap development is operational.
+
+## Verification and rollback
+
+Contract tests bind the cadence, stack scope, dispatch budget, retry floor,
+permissions, explicit secret mapping, absent model credentials, reusable
+scheduler path, and focused quality-workflow coverage. A scheduled run proves
+only accepted dispatch after live state validation; it does not prove a repair,
+approval, merge, release, or product increment.
+
+Rollback is removal of this caller after confirming another enabled workflow
+owns the same LineageWeave writer lease. Do not run duplicate scheduled writers.
+
+## APA 7th references
+
+GitHub. (n.d.). *Control the concurrency of workflows and jobs*. Retrieved
+August 28, 2026, from
+https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency
+
+GitHub. (n.d.). *Events that trigger workflows: Schedule*. Retrieved August
+28, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule
+
+GitHub. (n.d.). *Reuse workflows*. Retrieved August 28, 2026, from
+https://docs.github.com/en/actions/how-tos/sharing-automations/reusing-workflows
+
+National Institute of Standards and Technology. (2022). *Secure software
+development framework (SSDF) version 1.1: Recommendations for mitigating the
+risk of software vulnerabilities* (NIST Special Publication 800-218).
+https://doi.org/10.6028/NIST.SP.800-218

scripts/ci/pr_review_fix_scheduler.py

@@ -282,6 +282,11 @@ def dispatch_autofix(
     run(args, stdin=json.dumps(payload))
 
 
+def _base_branch_matches(pr: dict[str, Any], expected: str) -> bool:
+    """Return whether a PR belongs to the configured base scope."""
+    return expected == "*" or pr.get("baseRefName") == expected
+
+
 def inspect_pr(
     repo: str,
     pr: dict[str, Any],
@@ -293,7 +298,7 @@ def inspect_pr(
     number = int(pr["number"])
     if pr.get("isDraft"):
         return "skip", ("draft PR",)
-    if pr.get("baseRefName") != args.base_branch:
+    if not _base_branch_matches(pr, args.base_branch):
         return "skip", (
             f"base branch is {pr.get('baseRefName')}; expected {args.base_branch}",
         )
@@ -363,7 +368,7 @@ def process_queue(args: argparse.Namespace) -> int:
     for pr in prs:
         if pr.get("isDraft"):
             continue
-        if pr.get("baseRefName") != args.base_branch:
+        if not _base_branch_matches(pr, args.base_branch):
             continue
         if not same_repository_head(args.repo, pr):
             continue

tests/test_lineageweave_hourly_review_caller.py

@@ -0,0 +1,72 @@
+"""Contract tests for LineageWeave's bounded hourly review-repair caller."""
+
+from pathlib import Path
+
+
+CALLER = Path(".github/workflows/lineageweave-hourly-review-repair.yml")
+DOCTORING = Path("docs/doctoring/lineageweave-hourly-review-caller.md")
+QUALITY_WORKFLOW = Path(".github/workflows/hourly-nvidia-nim-review-repair.yml")
+SCHEDULER = Path(".github/workflows/pr-review-fix-scheduler.yml")
+
+
+def _read(path: Path) -> str:
+    """Return one repository contract file as UTF-8 text."""
+    return path.read_text(encoding="utf-8")
+
+
+def test_lineageweave_caller_is_hourly_bounded_and_stack_aware() -> None:
+    """The stacked repository receives one non-cancelling repair opportunity."""
+    caller = _read(CALLER)
+
+    for contract in (
+        'cron: "4 * * * *"',
+        "group: lineageweave-hourly-review-repair",
+        "cancel-in-progress: false",
+        "uses: ./.github/workflows/pr-review-fix-scheduler.yml",
+        "target_repository: ContextualWisdomLab/LineageWeave",
+        'base_branch: "*"',
+        'max_prs: "50"',
+        'max_dispatches: "1"',
+        'retry_hours: "2"',
+    ):
+        assert contract in caller
+
+
+def test_lineageweave_caller_preserves_the_existing_credential_boundary() -> None:
+    """The caller maps only scheduler credentials and exposes no model secret."""
+    caller = _read(CALLER)
+    workflow_scope, jobs_scope = caller.split("\njobs:\n", maxsplit=1)
+
+    assert "\npermissions:\n  contents: read\n" in workflow_scope
+    assert "\n    permissions:\n      contents: read\n      id-token: write\n" in jobs_scope
+    assert "PR_REVIEW_MERGE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN }}" in caller
+    assert "OPENCODE_APPROVE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN }}" in caller
+    assert "secrets: inherit" not in caller
+    assert "COPILOT_GITHUB_TOKEN" not in caller
+    assert "NVIDIA_NIM_API_KEY" not in caller
+    assert "LLM_GATEWAY_API_URL" not in caller
+    assert "ContextualWisdomLab/LineageWeave" not in _read(SCHEDULER)
+
+
+def test_lineageweave_caller_is_covered_by_the_focused_quality_gate() -> None:
+    """Caller, evidence, and regression test all trigger the focused gate."""
+    quality = _read(QUALITY_WORKFLOW)
+
+    assert quality.count(str(CALLER)) == 2
+    assert quality.count(str(DOCTORING)) == 2
+    assert quality.count("tests/test_lineageweave_hourly_review_caller.py") == 3
+
+
+def test_lineageweave_doctoring_keeps_product_and_review_claims_separate() -> None:
+    """The evidence record states what this caller can and cannot prove."""
+    doctoring = _read(DOCTORING).lower()
+
+    for contract in (
+        "stacked pull requests",
+        "independent current-head approval",
+        "does not create product work",
+        "contextual-orchestrator",
+        "copilot_github_token",
+        "apa 7th references",
+    ):
+        assert contract in doctoring

tests/test_pr_review_fix_scheduler.py

@@ -770,7 +770,7 @@ def test_inspect_pr_dispatches_conflict_resolution(monkeypatch):
 
 def test_process_queue_includes_conflict_resolution_candidates(monkeypatch, capsys):
     """The queue pre-filter fetches comments for approved conflicting PRs too."""
-    pr = _approved_dirty_pr()
+    pr = _approved_dirty_pr(baseRefName="feature-base")
     monkeypatch.setattr(fix, "fetch_open_prs", lambda repo, max_prs: [pr])
     monkeypatch.setattr(fix, "issue_comments", lambda repo, number: [])
     monkeypatch.setattr(
@@ -779,7 +779,7 @@ def test_process_queue_includes_conflict_resolution_candidates(monkeypatch, caps
         lambda repo, pr, workflow, workflow_repository, dry_run, resolve_conflict=False: None,
     )
     monkeypatch.setattr(fix, "create_fix_marker", lambda repo, pr, dry_run: None)
-    assert fix.main(["--repo", "owner/repo", "--base-branch", "main", "--dry-run"]) == 0
+    assert fix.main(["--repo", "owner/repo", "--base-branch", "*", "--dry-run"]) == 0
     payload = json.loads(capsys.readouterr().out.strip().splitlines()[-1])
     assert payload["autofix_dispatches"] == 1
 
@@ -789,6 +789,12 @@ def test_fix_inspect_skip_wait_and_error_paths(monkeypatch):
     args = fix.parse_args(["--repo", "owner/repo", "--base-branch", "main"])
     assert fix.inspect_pr("owner/repo", make_pr(isDraft=True), args) == ("skip", ("draft PR",))
     assert fix.inspect_pr("owner/repo", make_pr(baseRefName="develop"), args)[1][0].startswith("base branch")
+    wildcard_args = fix.parse_args(["--repo", "owner/repo", "--base-branch", "*"])
+    monkeypatch.setattr(fix, "needs_autofix", lambda pr: (False, ()))
+    assert fix.inspect_pr("owner/repo", make_pr(baseRefName="develop"), wildcard_args) == (
+        "skip",
+        ("no current-head autofixable review, failed-check RCA, or approved merge conflict",),
+    )
     assert fix.inspect_pr("owner/repo", make_pr(headRepository={"nameWithOwner": "fork/repo"}), args)[1] == (
         "external PR head is not writable by repository workflow credentials",
     )