architecture: enforce evidence-first DDD path repair in the hourly development loop

[seonghobae]

Goal

Extend the existing hourly PR review→repair→exact-head Checks→protected merge loop so each heartbeat also audits Domain-Driven Design ownership and corrects at most one evidenced structural violation. Reuse the existing scheduler/cron; do not create a second hourly mutation authority.

DDD acceptance contract

• Derive Core, Supporting, and Generic Subdomains; Bounded Contexts; Context Map; and Ubiquitous Language from PRD, TRD, ADRs, implementation, database ownership, API contracts, and callers.
• Treat utils, helpers, common, services, models, and shared as review signals only. Directory names alone never authorize a move.
• For each finding, prove domain owner, data owner, Aggregate/transaction boundary, dependency direction, affected imports/API consumers, and rollback before changing paths.
• Keep domain policy independent of framework, HTTP, persistence, and provider details. Use Repository ports/adapters and Anti-Corruption Layers for PostgreSQL/Snowflake/Databricks, Keyverse, contextual-orchestrator, and legacy formats.
• Minimize Shared Kernel; move duplicate organization-level responsibilities to their owning ContextualWisdomLab library and retain a narrow port/adapter in pg-erd-cloud.
• Update callers atomically or provide a time-bounded compatibility shim. Detect import cycles and prohibit directory-only churn.
• Keep DB objects two-word-or-longer snake_case where applicable and review 3NF, UPSERT, lock/transaction, and hot-partition boundaries with each persistence move.

Hourly execution contract

• One existing cron, once per hour; inspect up to 100 open PRs.
• One bounded repair or guarded merge decision per heartbeat.
• When PRs and Issues are empty, take the highest buyer-visible gap from docs/product-technical-gap-baseline.md; zero queue is not completion.
• No force push, self-approval, admin/ruleset bypass, stale-head evidence, or COPILOT_GITHUB_TOKEN.
• Concurrent remote commits must be read and composed by intent; do not overwrite them.

Test-first evidence

1. Add a failing static contract for one cron, non-cancelling concurrency, max-PR bound, one-action bound, no-Copilot credential path, and DDD audit invocation.
2. Add a deterministic bounded-context manifest and an advisory auditor that reports ambiguous technical buckets and undeclared cross-context imports but never moves files.
3. Cover unique path ownership, allowed/forbidden dependencies, malformed manifest fail-closed behavior, Unicode paths, and deterministic output.
4. Update AGENTS.md, ARCHITECTURE.md, ADR/doctoring, docs/product-technical-gap-baseline.md, and applicable changelogs.
5. Run workflow YAML/actionlint, shell/Python syntax, focused and full tests, type checking, coverage/docstring gates, import-cycle checks, and git diff --check on the exact head.

Delivery

Use PR #943 as the owner when its current branch is clean. If it is stale or polluted, create a current-main clean successor, close #943 with supersession evidence, and do not transfer predecessor checks or reviews. Merge only through ordinary protected-main semantics after every required current-head Check and qualifying independent review.