chore(operations): prove external hourly scheduler continuation and error recovery

[seonghobae]

Problem

Noema's repository-owned maintenance/product-development controls cannot prove that the external ChatGPT hourly task is enabled, contains the current compact execution prompt, survives a generic scheduled-task failure, or continues past one useful action. A scheduler prompt edit, chat claim, or generic There was a problem with your scheduled task response is not repository execution evidence.

This issue owns the external control-plane evidence gap identified as G-17 by the canonical documentation audit on PR #71. It does not duplicate repository workflow implementation owned by #80 or live App/ruleset provisioning owned by #27/#29.

Protected main observed when opening this issue: c85d710804139c0697d7ef8fa47d02b1389e6d84.

Compact external task prompt

The external scheduler should keep one enabled hourly task and use a compact prompt that delegates stable detail to repository authority:

Continuously improve ContextualWisdomLab/noema toward defensible commercial/acquisition readiness. Execute, do not merely report. Start from fresh protected-main, every open PR/issue, exact heads/live bases, stacks, reviews/threads/checks/security/rules/releases/docs and active-writer evidence; rebuild after every material action. Treat pending, absent, skipped, stale, predecessor, synthetic, model-only, rate-limited or status-only evidence as non-passing.

Write only Noema. Before every write refetch exact target/base/blob/ref/review/writer state; freeze only raced branches and rotate. Never force-push, self-approve, weaken gates, fabricate authority/secrets/evidence, or create repair/self-modifying branch-patching workflows.

Priority: merge only unchanged gate-clean authorized PRs; test-first fix current product/security/reliability/data/accessibility defects; remove Noema-owned blockers; resolve only addressed threads/duplicates; advance stacks/issues; run protected-main operational acceptance; repair canonical docs and executable contracts; convert gaps into source/tests/operators; then implement the highest-impact bounded buyer slice. After every action or defer, return to queue top.

Use RCA -> distinct remedies -> feasibility -> smallest safe action -> exact proof. Waiting blocks only that exact lane. Prompt repair, inventory, docs, one test, one commit, one PR update, one merge or one blocker is intermediate. After user redirection, perform at least two materially distinct repository actions when two safe lanes exist. Never end on test-only RED while safe GREEN exists. Documentation must hand off to the highest-priority safe non-documentation action.

On a generic scheduled-task error, refetch this task and GitHub, keep one enabled hourly task, simplify this prompt if needed, do not invent hidden error codes, and immediately resume repository execution. Stable architecture/security/product detail belongs in AGENTS.md and canonical PRD/TRD/ARCHITECTURE/ADR/UML/ERD/TRACEABILITY/security/test/operability/licensing authority.

Before exit, perform two consecutive fresh whole-Noema sweeps. Any safe merge, mutation, test, closure, stack repair, operational proof, docs repair, release preparation or bounded product action resets the sweep count. End only on practical invocation-budget exhaustion or two clean sweeps proving every remaining lane non-actionable. Routine status remains internal.

Acceptance criteria

Scheduler identity and configuration

• Record one enabled hourly task identity, owner, timezone/schedule, observation time and prompt digest in access-controlled operational evidence.
• Prove duplicate/obsolete Noema scheduler tasks are disabled rather than concurrently writing.
• Bind the task to ContextualWisdomLab/noema only; .github, naruon, contextual-orchestrator and other dedicated-writer repositories remain read-only dependencies.
• Confirm stable product/architecture/security detail is referenced from repository authority rather than copied into diverging scheduler prose.

Generic-error recovery

• Exercise or observe one bounded generic task failure without inventing a hidden provider error code.
• Prove the next invocation refetches task state and GitHub live state before acting.
• Prove prompt repair earns zero completion credit and repository execution resumes in the same invocation when a safe lane exists.
• Retain failure timestamp, scheduler/task identity, next successful invocation identity and exact resulting GitHub mutation(s).

Work-conserving behavior

• On a run with two safe independent lanes, retain evidence of at least two materially distinct repository actions.
• Prove a waiting CI/review lane rotates to another safe lane rather than ending the run.
• Prove documentation work hands off to a non-documentation action when one is safe.
• Prove test-first work does not stop on RED when a safe GREEN implementation exists.
• Retain two fresh exit sweeps or an explicit practical invocation-budget boundary.

Writer safety and authority

• Prove exact pre-write head/base/target/review/writer refetch and branch-local freeze on detected competing writes.
• Prove no force push, self-approval, gate weakening, synthetic evidence, repair workflow or credential fallback occurs.
• Keep external task evidence separate from GitHub checks, formal reviews, protected merge authority, release/deployment acceptance and acquisition evidence.

Evidence schema (minimum)

Retain a bounded record with descriptive multiword snake_case fields:

{
  "schema_version": 1,
  "scheduler_task_identity": "provider-scoped opaque id",
  "prompt_sha256": "64 lowercase hex",
  "scheduled_at": "ISO-8601 UTC",
  "started_at": "ISO-8601 UTC",
  "repository_full_name": "ContextualWisdomLab/noema",
  "protected_main_sha": "40 lowercase hex",
  "generic_error_observed": false,
  "github_actions_performed": [],
  "deferred_lanes": [],
  "exit_sweep_count": 2,
  "remaining_non_actionable_reasons": []
}

The record must not contain secrets, private keys, raw tokens, hidden model reasoning, vulnerability details or unnecessary personal data.

Documentation handoff

PR #71 remains the canonical PRD/TRD/Architecture/ADR/UML/ERD/Traceability owner. Reconcile this issue into canonical traceability/operability after #71 stabilizes; do not create a parallel architecture authority. PR #80 remains the source implementation owner for repository-side work-conserving scheduler/publisher behavior.

Non-goals

• No claim that this issue itself updates the external scheduler.
• No replacement of repository-owned GitHub Actions with a chat task.
• No weakening of chore(governance): protect main and enforce release checks #27/chore(operations): provision and activate hourly maintainer App #29 governance or independent formal review.
• No outbound license, release, deployment, production KPI or acquisition-ready claim.

Related: #27, #29, #71, #80

[seonghobae]

Repository-side implementation is now tracked by Draft PR #97. Exact test-first lineage at this update:

• initial schema/operator RED 9a45e9a4612b7c3f15fe72267a51b8a3b70a1289 / application CI 31383499168: existing 62 files / 646 tests passed; 23 new contract tests failed only because the evaluator and operator command were absent;
• first evaluator/operator GREEN 00a7ac8454a4be957e9db100de2b9abca076ae0f / application CI 31384072872: 63 files / 669 tests passed;
• production-coverage RED fa193637158bff0d0019ff23857e81a9f9306416 / application CI 31384315970: only the new production-path coverage policy failed;
• CLI safety/testability RED 8af6f6feae86d28799dbb9af6a4730252fd7cbd0 / application CI 31384755916: 63 existing files / 675 tests passed, while 13 of 19 new CLI tests failed exactly on missing verifiable seams;
• current GREEN candidate 391a61a9f0ad158bd94ddc87b8327c10ce51cde1 is pending fresh exact-head CI/security/reviewer evidence.

#97 validates retained scheduler evidence bytes and exposes the operator command; it does not enable, disable, deduplicate, schedule, or otherwise operate the external ChatGPT task. Provider-side one-enabled-task identity, prompt digest, schedule/timezone, duplicate disablement, failure/recovery receipt, and resulting GitHub mutations remain open acceptance items on this issue. Canonical architecture and whole-product sufficiency remain owned by #71.

[seonghobae]

Final repository-side implementation status after fresh exact-head revalidation:

• PR feat(operations): audit external scheduler continuation evidence #97 is Ready for review at unchanged exact head 7ed8fd0b0cb2f2fe0b5504f70f02992ae3d93287 on protected base c85d710804139c0697d7ef8fa47d02b1389e6d84.
• Application ci run 31385955671 is terminal-success: exact-head checkout, 66 test files / 699 tests passed, statements/branches/functions/lines all 100%, and npm audit --audit-level=high reported 0 vulnerabilities.
• reviewer-ci run 31385955678 is terminal-success on the exact head with its read-only reviewer package, sandbox/image checks, 120 reviewer tests, 100% reviewer statement/branch coverage, and 100% docstrings.
• Central Security Scan run 31385955685 is terminal-success under the current central workflow source; exact base/head OSV found 0 on both sides, dependency review found no moderate-or-higher vulnerable or denied packages, and the synthetic integration-tree Trivy MEDIUM/HIGH/CRITICAL gate found 0 findings.
• Formal GitHub reviews remain 0 and review threads remain 0. Technical checks do not create qualifying independent approval or live merge authority.

#97 now supplies the fail-closed repository validator, operator command, compact prompt authority, tests, documentation and changelog. It still does not enable, disable, deduplicate, schedule or invoke the external ChatGPT task. This session has no provider scheduler-control connector, so no claim is made that the live task itself was modified.

The unchecked provider-side acceptance criteria on this issue remain authoritative: one enabled task identity/owner/timezone/schedule, prompt digest, duplicate-task disablement, observed generic-error receipt, subsequent task/GitHub refetch, same-invocation repository execution, exact resulting GitHub mutations, two materially distinct actions when two safe lanes existed, and two clean exit sweeps or a concrete invocation-budget boundary.

[seonghobae]

Superseding exact-head observation: the earlier comment's 7ed8fd0b0cb2f2fe0b5504f70f02992ae3d93287 GREEN evidence is now predecessor-only because another active writer moved PR #97.

Fresh current state at this observation:

• protected main: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• PR feat(operations): audit external scheduler continuation evidence #97 head: 04524185a97d22cc70c161b9812333968d93a665;
• the branch is frozen for this invocation under the single-writer rule because it moved from 7ed8fd0… to test-only RED 53df217… and then to GREEN 0452418… while the whole-repository exit sweep was running;
• 53df217… exact-head CI 31387877944 correctly failed one new duplicate-decoded-JSON-key regression while the other 699 tests passed;
• 0452418… adds duplicate-key-aware rejection and has terminal-success application ci 31388090981, reviewer-ci 31388090959, and central Security Scan 31388090956;
• the current CodeRabbit review is COMMENTED, not formal approval;
• four valid current-head threads remain unresolved: failed validation reports still copy untrusted evidence identity/timestamp values; camelCase/common credential aliases are not rejected; generic-error resumed_action_identity is not bound to a retained action; and materially-distinct action kinds are incorrectly required even when fewer than two safe lanes existed.

Therefore #97 is not gate-clean and no merge/readiness claim is made. The active branch writer may continue the RED→GREEN remediation; this invocation will not race it or create a competing branch. Provider-side scheduler configuration/receipt acceptance criteria on this issue remain unchanged.

[seonghobae]

Final superseding repository-side observation for this invocation:

• protected main remains c85d710804139c0697d7ef8fa47d02b1389e6d84;
• PR feat(operations): audit external scheduler continuation evidence #97 is Ready and mergeable at current exact head 11a306e94982890935381704cf8e6b43df0bdb46;
• application ci 31388866910, reviewer-ci 31388866919, and central Security Scan 31388866943 are all terminal-success on that exact head;
• all five CodeRabbit inline threads are resolved; the duplicate-decoded-key, failed-report identity retention, camelCase/common credential alias, resumed-action binding, and one-safe-lane action-kind defects are addressed in current source;
• the only current formal review is CodeRabbit COMMENTED, not a qualifying independent non-author APPROVED review;
• the PR body still describes predecessor head 7ed8fd0b0cb2f2fe0b5504f70f02992ae3d93287; because another writer moved this branch during the invocation, this invocation froze branch/PR-state writes rather than racing that writer. Exact live metadata and checks above supersede the stale body identity.

Accordingly #97 is technically gate-clean at this observation but not merge-authorized: live #27/#29 governance and eligible independent formal approval remain separate blockers. This still does not prove or operate the provider-side ChatGPT task. The unchecked live scheduler identity/configuration, duplicate-task disablement, prompt digest, generic-error receipt/recovery, same-invocation GitHub execution, and exit-sweep evidence on this issue remain required.

[seonghobae]

Provider-side recovery evidence from the generic scheduled-task failure is now materially stronger in this invocation, without publishing provider-scoped task identifiers or copying stable product/security authority out of the repository.

• The recovery invocation first re-fetched the scheduler control plane and found one enabled hourly Noema task; obsolete Noema task entries were not re-enabled. The task was compacted in place while preserving Noema-only write scope and read-only dependency boundaries. Prompt repair was treated as zero repository-completion credit.
• Protected main was independently re-resolved as c85d710804139c0697d7ef8fa47d02b1389e6d84 before repository writes. The live central Security Scan authority was separately re-read from ContextualWisdomLab/.github and confirmed to trigger only on protected bases (main, master, develop) with fixable Trivy MEDIUM/HIGH/CRITICAL; feature-base absence therefore remains non-passing defer_until_trigger evidence.
• Repository execution resumed in the same invocation instead of ending after scheduler repair. A distinct product/data-integrity lane created Draft PR fix(api): reject duplicate decoded target_repository keys #103 on exact fix(api): reject unsupported exchange methods before side effects #101 head 50af2026b30693524d5307b4e9449c888d4dc8b8 to reject ambiguous decoded target_repository JSON members before credential-bearing work.
• Exact RED commit abdb8aa55c392d74a5eac7a3b443e4f41f953a24 was checked out by application CI 31407630318 and failed exactly the new regression: 63 existing test files passed, while test/exchange-json-integrity.test.ts alone failed because bounded JSON was still accepted. The invocation did not stop on RED.
• GREEN commit e15eabce06609c585fcd10a7e916c126fd462771 immediately added the narrow fail-closed duplicate_keys path; its application/reviewer CI was queued/in progress at the first observation, so that exact waiting lane was deferred and work rotated here rather than ending the run.
• This issue-evidence mutation is a second materially distinct repository action from the source/test lane. It records generic-error recovery and work-conserving rotation without conflating scheduler evidence with GitHub checks, formal reviews, merge authority, release/deployment evidence, or acquisition readiness.

Still open here: retain the provider-scoped task identity/prompt digest in access-controlled evidence rather than this public issue; finish exact-head proof for #103; and retain two clean whole-repository exit sweeps (or a concrete invocation-budget boundary) after all newly discovered safe work is exhausted.

[seonghobae]

Fresh external-control-plane evidence from the successful 2026-08-12 KST retry invocation:

• exactly one enabled dedicated Noema hourly task is currently observable: title Noema Commercial Loop, task identity 6a6fff020c7881918e70933346d84d87;
• schedule is hourly (RRULE:FREQ=HOURLY) with default timezone Asia/Seoul; the task is enabled and its latest recorded run time is 2026-08-11T22:53:29.380036Z;
• the task prompt is scoped to ContextualWisdomLab/noema, explicitly treats .github, naruon, contextual-orchestrator and dedicated-writer repositories as read-only dependencies, and requires exact-head/live-base refetch, branch-local freeze, work-conserving continuation, no synthetic approval/authority, and two fresh exit sweeps;
• the enabled fleet writer CWL Autonomous Development explicitly skips every repository with an enabled dedicated writer loop, so it is not a competing Noema writer under its current contract;
• this conversation observed repeated generic There was a problem with your scheduled task responses. No hidden provider error code or cause is invented. On the user’s 다시 시도 redirection, this invocation refetched the task and GitHub first, then resumed material Noema work rather than treating prompt/task repair as completion;
• resulting same-invocation GitHub mutations already include fresh governance/evidence corrections on fix(security): isolate reviewer GitHub CLI subprocess environment #175, chore(governance): protect main and enforce release checks #27, chore(operations): provision and activate hourly maintainer App #29 and 20억 매각 readiness evidence 확보 #5 while protected main remained exact cd40474b258f9512d93ce82f5375071ce1f78762; multiple moving PR branches were branch-frozen instead of raced.

This closes part, but not all, of #96’s provider-side evidence gap. Still not established here: an independently retained prompt SHA-256 receipt bound to the provider task, an exact provider invocation/receipt identifier for each failed/successful run, and a final retained machine-readable evidence record passing PR #97’s repository validator. Those remain fail-closed rather than inferred from this issue comment.

[seonghobae]

Control-plane recovery evidence (2026-08-12 UTC): after repeated generic scheduled-task error reports, the live scheduler inventory was refetched and still showed exactly one enabled hourly Noema Commercial Loop (6a6fff020c7881918e70933346d84d87, Asia/Seoul) with the compact repository-authority prompt. Protected main was independently refetched at 5addf7fc1fc3494b3fc3dbc390d504e260ea4f09, and live ruleset/security-workflow authority was re-read before writes. The invocation then resumed repository execution rather than treating prompt/scheduler inspection as completion. Two independent Noema source lanes were advanced non-destructively: PR #207 branch fix/acquisition-deployment-exact-bytes-current-main-v2 was fast-forwarded from 7a31ae760e845cab94f2b66aaffc6824d27efbfe to merge-current-main head 4d9c4919703b86b16f449c084c8c928c36f99d21; PR #206 branch fix/exchange-method-contract-current-main-v2 was fast-forwarded from 5714d11f7fcbb673961cc7afc384f27ed8d86ebf to merge-current-main head a9a66b795d80b6a6ab14202ba54d3dd68f2e241b. Both updates used non-forced refs after exact branch/main revalidation; their fresh CI/reviewer/Security Scan runs are separate non-passing queued evidence until terminal. PR #212 was not mutated because its head moved independently during this invocation, so that lane was branch-locally frozen instead of raced. This comment is scheduler/continuation evidence only; it is not a CI check, formal review, merge authority, release/deployment evidence, or acquisition evidence.

[seonghobae]

Generic-scheduler-error recovery receipt for the current continuation, intentionally recorded before exit sweeps so this evidence mutation does not invalidate a completed sweep count.

Fresh control-plane/repository state immediately before this write:

• exactly one enabled dedicated Noema task was refetched: Noema Commercial Loop, provider task id 6a6fff020c7881918e70933346d84d87, RRULE:FREQ=HOURLY, timezone Asia/Seoul;
• the fleet writer remains configured to skip repositories with an enabled dedicated writer;
• protected main is 0b515c11670f26f888ccdf66707f34b946f505ef;
• no hidden provider error code or unobserved scheduler cause is asserted.

Same-invocation repository execution resumed instead of treating prompt/task recovery as completion. Concrete GitHub mutations already completed in this continuation:

1. fix(api): restack unsupported exchange method short-circuit on current main #206 was proven byte/scope-superseded by current-main fix(api): short-circuit unsupported exchange methods on current main #214 and closed unmerged; its two unique API/test blobs are exactly preserved on fix(api): short-circuit unsupported exchange methods on current main #214, while its extra KPI path equals protected main.
2. fix(acquisition): restack exact deployment evidence bytes on current main #207 was proven byte/scope-superseded by current-main fix(acquisition): bind deployment audit to exact bytes on current main #213 and closed unmerged; its acquisition source/test blobs are exactly preserved on fix(acquisition): bind deployment audit to exact bytes on current main #213, while its extra KPI path equals protected main.
3. historical fix(api): reject unsupported exchange methods before side effects #101 was proven fully byte-identical to current-main fix(api): short-circuit unsupported exchange methods on current main #214 across its complete two-file delta and closed unmerged.
4. historical fix(acquisition): authenticate exact deployment evidence bytes #125 was proven semantically preserved and strictly strengthened by fix(acquisition): bind deployment audit to exact bytes on current main #213's descriptor-bound exact-byte verifier and closed unmerged.
5. the orphan current-main test-first branch for security(kpi): reject GitHub credential prefixes in retained source labels #134 was recovered without rewriting history and opened as Draft fix(security): restack GitHub credential-shaped KPI source labels #215 at exact RED head 88731607c58288f37c7638e2db7b35f2e282ea1a; its application/security workflows are currently queued and therefore non-passing.

Writer-safety evidence: #214 and #213 each moved from their PR-body RED identity to a new current GREEN identity during the fresh state sweep, so both source/PR-state lanes are frozen for this invocation rather than raced. The recovered #215 branch was re-read twice at the same exact head before PR creation and had no open PR/competing movement.

This comment does not claim the required two clean exit sweeps, prompt digest retention, release/deployment/KPI evidence, or acquisition readiness. Those remain separate acceptance facts.