ci: schedule fail-closed hourly product development

[seonghobae]

Purpose

Add the missing product-development half of ScopeWeave's commercialization loop without duplicating the organization-owned PR maintenance schedulers.

ContextualWisdomLab/.github continues to own review dispatch, feedback repair, exact-head checks, branch updates, and policy-compliant merges more frequently than once per hour. This repository workflow runs at minute 41 and creates one bounded product task only after both open PRs and active or unknown agent tasks are proven to be zero.

Safety contract

• read-only repository permissions;
• repository-wide non-cancelling concurrency group;
• fail closed when COPILOT_GITHUB_TOKEN is missing;
• fail closed when pull-request or Agent Tasks inventory fails or changes shape;
• recognize only explicit terminal Agent Task states;
• revalidate both queues immediately before task creation;
• create exactly one task with create_pull_request: true;
• never inherit all repository secrets;
• never duplicate central PR review or repair workflows;
• prohibit the agent from self-merging, releasing, weakening protections, or bypassing checks.

Product-quality prompt

The created task must select one buyer-visible vertical slice, work test-first, preserve standalone and modular MSA operation, use two-or-more-word snake_case database objects, require complete JSDoc/docstrings and 100% coverage for changed production modules, use realistic multi-tenant and failure tests, place APA 7th standards evidence in docs/doctoring/, use Figma only for genuine buyer-facing UI, and route genuinely necessary LLM tests through NVIDIA_NIM_API_KEY and contextual-orchestrator.

Standards and platform evidence

docs/doctoring/hourly-product-development.md records the architecture decision and APA 7th references to GitHub's current Agent Tasks API, scheduled-workflow, concurrency, and workflow-security documentation. The documented Agent Tasks API is public preview and requires user-to-server credentials; scheduled workflows become active only after the workflow reaches the default branch. The implementation therefore keeps the ordinary GITHUB_TOKEN read-only, requires a separately scoped user token, treats unknown API/task state as queue ownership, and remains inactive until protected merge.

Verification

• tests/config/hourly-product-development.test.mjs statically enforces schedule, permissions, duplicate prevention, task-state handling, prompt requirements, and no-self-merge behavior.
• The contract test is wired into npm run test:unit.
• docs/operations/hourly-product-development.md documents credentials, failure modes, recovery, and ownership boundaries.
• docs/doctoring/hourly-product-development.md records limitations and authoritative platform evidence.
• CHANGELOG.md records the new gate under Unreleased.

Sequencing

This PR is intentionally Draft while the security train in #432 owns the merge queue. After #432 and #414 merge, update this branch onto the exact protected develop head, rerun all repository and central checks, obtain an independent exact-head approval, and only then enable auto-merge.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d105c92f-235e-4f1e-a195-59e4d00b622f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing this implementation because it directly conflicts with the repository operating contract: the hourly GitHub Actions scheduler creates Copilot Agent Tasks with COPILOT_GITHUB_TOKEN, while ScopeWeave must run an in-workflow OpenCode coding agent authenticated only with NVIDIA_NIM_API_KEY. The replacement will retain the fail-closed open-PR single-flight gate and central PR-governance ownership, but it will install a pinned, checksum-verified OpenCode CLI, configure an OpenAI-compatible NVIDIA NIM provider, strip GitHub mutation credentials from the agent process, use a bounded model fallback pool, and let a separate trusted step create exactly one PR. The existing CodeRabbit, Noema, OpenCode-review, and Strix reviewer credentials and workflows will remain untouched.