feat(automation): repair the LineageWeave buyer-surface stack hourly

.github/workflows/lineageweave-hourly-review-repair-quality.yml

@@ -0,0 +1,71 @@
+name: LineageWeave Hourly Review Repair Quality
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/lineageweave-hourly-review-repair.yml
+      - .github/workflows/lineageweave-hourly-review-repair-quality.yml
+      - scripts/ci/pr_review_fix_scheduler.py
+      - scripts/ci/pr_review_fix_stack_scheduler.py
+      - scripts/ci/pr_review_merge_scheduler.py
+      - tests/test_pr_review_fix_stack_scheduler.py
+      - tests/test_pr_review_fix_scheduler.py
+      - tests/test_pr_review_merge_scheduler.py
+      - tests/test_lineageweave_hourly_review_caller.py
+      - docs/doctoring/lineageweave-hourly-review-caller.md
+      - docs/doctoring/lineageweave-buyer-surface-opencode-incident.md
+      - requirements-opencode-review-ci-hashes.txt
+
+permissions:
+  contents: read
+
+concurrency:
+  group: lineageweave-hourly-review-quality-${{ github.event.pull_request.head.repo.full_name }}-${{ github.event.pull_request.head.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    name: LineageWeave ordered-stack and least-privilege contract
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+      - name: Checkout exact source revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+      - name: Install hash-locked test tooling
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+      - name: Verify ordered-stack repair contracts
+        run: |
+          set -euo pipefail
+          python -m coverage erase
+          python -m coverage run --branch -m pytest -q tests
+          python -m coverage report \
+            --include=scripts/ci/pr_review_fix_scheduler.py,scripts/ci/pr_review_fix_stack_scheduler.py,scripts/ci/pr_review_merge_scheduler.py \
+            --fail-under=100
+          interrogate -vv --fail-under 100 \
+            scripts/ci/pr_review_fix_scheduler.py \
+            scripts/ci/pr_review_fix_stack_scheduler.py \
+            scripts/ci/pr_review_merge_scheduler.py
+          python -m compileall -q \
+            scripts/ci/pr_review_fix_scheduler.py \
+            scripts/ci/pr_review_fix_stack_scheduler.py \
+            scripts/ci/pr_review_merge_scheduler.py \
+            tests/test_lineageweave_hourly_review_caller.py \
+            tests/test_pr_review_fix_stack_scheduler.py \
+            tests/test_pr_review_merge_scheduler.py
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
+          git diff --check "$BASE_SHA...$HEAD_SHA"

.github/workflows/lineageweave-hourly-review-repair.yml

@@ -0,0 +1,195 @@
+name: LineageWeave Hourly Review Repair
+
+on:
+  schedule:
+    # Minute 4 avoids the start-of-hour load peak and existing product callers.
+    - cron: "4 * * * *"
+
+concurrency:
+  group: lineageweave-hourly-review-repair
+  # A later heartbeat must not cancel an in-flight lineage or buyer-surface RCA.
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch-review-repair:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      TARGET_REPOSITORY: ContextualWisdomLab/LineageWeave
+      ROOT_BASE_BRANCH: main
+      PULL_REQUEST_NUMBERS: "258,260,261,262,263,264"
+      MAX_PRS: "6"
+      OPEN_PR_SCAN_LIMIT: "1000"
+      MAX_DISPATCHES: "1"
+      RETRY_HOURS: "2"
+      AUTOFIX_WORKFLOW: pr-review-autofix.yml
+      AUTOFIX_REPOSITORY: ContextualWisdomLab/.github
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Validate protected source and target authority
+        env:
+          ALLOWED_TARGET_REPOSITORIES: ${{ vars.OPENCODE_REPOSITORY_DISPATCH_TARGETS }}
+        run: |
+          set -euo pipefail
+          if [ "$GITHUB_REPOSITORY" != "ContextualWisdomLab/.github" ] ||
+            [ "$GITHUB_REF" != "refs/heads/main" ]; then
+            echo "::error::LineageWeave repair may run only from protected ContextualWisdomLab/.github main."
+            exit 1
+          fi
+
+          target_allowed=false
+          IFS=',' read -r -a allowed_targets <<<"${ALLOWED_TARGET_REPOSITORIES:-}"
+          for candidate in "${allowed_targets[@]}"; do
+            candidate="${candidate//[[:space:]]/}"
+            if [ "$candidate" = "$TARGET_REPOSITORY" ]; then
+              target_allowed=true
+              break
+            fi
+          done
+          if [ "$target_allowed" != "true" ]; then
+            echo "::error::ContextualWisdomLab/LineageWeave is absent from OPENCODE_REPOSITORY_DISPATCH_TARGETS."
+            exit 1
+          fi
+
+      - name: Exchange OpenCode app token for scheduler mutations
+        id: scheduler_app_token
+        env:
+          OIDC_AUDIENCE: opencode-github-action
+          OPENCODE_API_BASE_URL: https://api.opencode.ai
+          USER_TOKEN_CONFIGURED: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '' }}
+        run: |
+          set -euo pipefail
+          mark_unavailable() {
+            echo "available=false" >>"$GITHUB_OUTPUT"
+          }
+
+          if [ "$USER_TOKEN_CONFIGURED" = "true" ]; then
+            echo "A configured cross-repository user token takes precedence."
+            mark_unavailable
+            exit 0
+          fi
+          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] ||
+            [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            echo "OpenCode app token exchange unavailable: OIDC request environment is missing."
+            mark_unavailable
+            exit 0
+          fi
+
+          request_url="${ACTIONS_ID_TOKEN_REQUEST_URL}"
+          separator="&"
+          case "$request_url" in
+            *\?*) ;;
+            *) separator="?" ;;
+          esac
+          if ! oidc_response="$(
+            curl -fsS --connect-timeout 10 --max-time 30 \
+              -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+              "${request_url}${separator}audience=${OIDC_AUDIENCE}"
+          )"; then
+            echo "OpenCode app token exchange unavailable: OIDC token request did not complete."
+            mark_unavailable
+            exit 0
+          fi
+          oidc_token="$(jq -r '.value // empty' <<<"$oidc_response")"
+          if [ -z "$oidc_token" ]; then
+            echo "OpenCode app token exchange unavailable: OIDC token response was empty."
+            mark_unavailable
+            exit 0
+          fi
+          if ! token_response="$(
+            curl -fsS --connect-timeout 10 --max-time 30 -X POST \
+              -H "Authorization: Bearer ${oidc_token}" \
+              "${OPENCODE_API_BASE_URL}/exchange_github_app_token"
+          )"; then
+            echo "OpenCode app token exchange unavailable: app token request did not complete."
+            mark_unavailable
+            exit 0
+          fi
+          app_token="$(jq -r '.token // empty' <<<"$token_response")"
+          if [ -z "$app_token" ]; then
+            echo "OpenCode app token exchange unavailable: app token response was empty."
+            mark_unavailable
+            exit 0
+          fi
+
+          echo "::add-mask::$app_token"
+          {
+            echo "available=true"
+            echo "token=$app_token"
+          } >>"$GITHUB_OUTPUT"
+
+      - name: Checkout exact protected source revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Verify exact source and scheduler contracts
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          python3 scripts/ci/pr_review_fix_scheduler.py --self-test
+          python3 scripts/ci/pr_review_fix_stack_scheduler.py --self-test
+          git diff --check
+
+      - name: Dispatch one missing stacked-PR review
+        env:
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token }}
+          MUTATION_CREDENTIAL_AVAILABLE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '' || steps.scheduler_app_token.outputs.available == 'true' }}
+          SCHEDULER_ACTIONS_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token }}
+          SCHEDULER_DISPATCH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token }}
+          SCHEDULER_REQUIRED_WORKFLOW_REPOSITORY: ContextualWisdomLab/.github
+        run: |
+          set -euo pipefail
+          if [ "$MUTATION_CREDENTIAL_AVAILABLE" != "true" ]; then
+            echo "::error::An established scheduler mutation credential or exchanged OpenCode app token is required."
+            exit 1
+          fi
+
+          python3 scripts/ci/pr_review_merge_scheduler.py \
+            --repo "$TARGET_REPOSITORY" \
+            --base-branch "$ROOT_BASE_BRANCH" \
+            --project-flow github-flow \
+            --max-prs "$OPEN_PR_SCAN_LIMIT" \
+            --stacked-only \
+            --trigger-reviews \
+            --review-dispatch-limit 1 \
+            --branch-update-limit 0 \
+            --no-enable-auto-merge \
+            --merge-mode disabled \
+            --no-update-branches
+
+      - name: Dispatch one dependency-safe review repair
+        env:
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token }}
+          MUTATION_CREDENTIAL_AVAILABLE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' || secrets.OPENCODE_APPROVE_TOKEN != '' || steps.scheduler_app_token.outputs.available == 'true' }}
+        run: |
+          set -euo pipefail
+          if [ "$MUTATION_CREDENTIAL_AVAILABLE" != "true" ]; then
+            echo "::error::An established scheduler mutation credential or exchanged OpenCode app token is required."
+            exit 1
+          fi
+
+          args=(
+            --repo "$TARGET_REPOSITORY"
+            --base-branch "$ROOT_BASE_BRANCH"
+            --pull-request-numbers "$PULL_REQUEST_NUMBERS"
+            --max-prs "$MAX_PRS"
+            --max-dispatches "$MAX_DISPATCHES"
+            --retry-hours "$RETRY_HOURS"
+            --resolve-unreviewed-conflicts
+            --autofix-workflow "$AUTOFIX_WORKFLOW"
+            --autofix-repository "$AUTOFIX_REPOSITORY"
+          )
+          python3 scripts/ci/pr_review_fix_stack_scheduler.py "${args[@]}"

docs/doctoring/lineageweave-buyer-surface-opencode-incident.md

@@ -0,0 +1,91 @@
+# LineageWeave buyer-surface OpenCode incident
+
+검토 기준일: **2026-08-20**
+
+## Scope
+
+The affected LineageWeave buyer surface is the stacked dependency chain
+**#258 → #260 → #261 → #262 → #263 → #264**. A trusted
+`@opencode-agent` request on #258 produced neither a visible receipt nor a
+formal exact-head review.
+
+## First causal boundaries
+
+The durable repository dispatch had already succeeded. The router then tried to
+add a cosmetic `eyes` reaction before publishing the acknowledgement comment.
+The target repository returned HTTP 403 for that reaction, which terminated the
+source run before the receipt was written. The exact invocation ledger correctly
+prevented duplicate dispatch, but the previous all-agents-existing early return
+also prevented a later organization sweep from healing the missing receipt.
+
+The scheduled sweep had a separate availability weakness: `gh api` subprocesses
+had no finite timeout, so an already-running repository query could make
+executor shutdown wait indefinitely after the dispatch frontier was reached.
+That weakness did not explain the already-created invocation without a receipt,
+but it could prevent later LineageWeave requests from being discovered and
+recovered predictably.
+
+`concurrency.queue: max` is not an invalid workflow property. GitHub introduced
+larger concurrency queues on May 7, 2026; `queue: max` preserves up to 100
+pending runs and is compatible with an omitted or false `cancel-in-progress`.
+The shared local-mention queue therefore retains `queue: max`, while exact-key
+downstream wrappers keep their invocation-scoped concurrency contract.
+
+## Repair contract
+
+The central repair must:
+
+- retain the valid `queue: max` local concurrency contract;
+- bind every `gh api` subprocess to a finite timeout;
+- bound repository discovery while preserving deterministic output, fair
+  rotation, and repository-local failure isolation;
+- publish the acknowledgement even when the cosmetic reaction is forbidden;
+- recreate a missing acknowledgement for an existing exact invocation without
+  dispatching again;
+- keep acknowledgement publication failure visible for later recovery; and
+- retain exact repository, pull request, head, base, actor, source comment, and
+  review-only behavior binding.
+
+The dedicated LineageWeave hourly caller complements the mention path. Initial
+OpenCode review generation remains with the mention router and organization
+review/merge scheduler. The hourly caller handles only actionable exact-head
+review feedback, failed-check RCA, and conflict repair. It inspects the explicit
+six-PR queue in dependency order, advances only after an exact no-repair result,
+waits without mutation when a child is not based on its current parent head, and
+dispatches no more than one repair.
+
+## Stack order
+
+A descendant is reviewed against its declared parent head. When a parent moves,
+its child is stale until the base is updated and exact-head checks and formal
+reviews are regenerated. Evidence from an ancestor, predecessor head, or sibling
+cannot satisfy a descendant gate.
+
+## Operational acceptance
+
+Source tests do not close this incident. After the central repair and the
+LineageWeave caller reach protected `main`:
+
+1. post one fresh trusted mention on the current head of #258;
+2. observe the sibling-repository sweep discover it;
+3. observe the exact-head acknowledgement receipt;
+4. observe no duplicate dispatch on the next sweep;
+5. observe a formal OpenCode review or explicit fail-visible evidence; and
+6. process #260 through #264 in dependency order after every parent-head change.
+
+Independent approval, required checks, and resolution of valid review findings
+remain merge requirements.
+
+## APA 7th references
+
+GitHub, Inc. (2026, May 7). *GitHub Actions concurrency groups now allow larger
+queues*. GitHub Changelog.
+https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/
+
+GitHub, Inc. (n.d.-a). *Events that trigger workflows*. GitHub Docs. Retrieved
+August 20, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
+
+GitHub, Inc. (n.d.-b). *Workflow syntax for GitHub Actions*. GitHub Docs.
+Retrieved August 20, 2026, from
+https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax