ci: schedule hourly OpenCode commercial readiness with NVIDIA NIM

[seonghobae]

Buyer-visible purpose

ScopeWeave already has organization-central review, repair, exact-head verification, and protected merge automation. This pull request adds the missing product-development half of the loop: once per hour, and only while the open pull-request queue is empty, one bounded OpenCode session may implement one buyer-visible commercial-readiness slice and open exactly one pull request for the existing governance system.

Implementation

• runs at minute 41 of each UTC hour with repository-wide non-cancelling concurrency;
• fails closed when pull-request inventory is unavailable, an open PR exists, or NVIDIA_NIM_API_KEY is absent;
• installs OpenCode 1.17.13 from an explicit release archive and verifies its pinned SHA-256 digest;
• configures a documented OpenAI-compatible NVIDIA NIM provider at https://integrate.api.nvidia.com/v1;
• uses a bounded NVIDIA model fallback pool and discards partial work between failed candidates;
• strips GitHub mutation credentials and OIDC request variables from the OpenCode process;
• leaves CodeRabbit, Noema, OpenCode-review, Strix, branch protection, and reviewer credentials untouched;
• rejects agent changes to reviewer-owned workflows and .trivyignore, .semgrepignore, or .gitleaksignore;
• requires red-green-refactor TDD, realistic customer/failure tests, complete JSDoc/docstrings, 100% changed-production-module coverage, two-or-more-word snake_case database objects, standalone/MSA boundaries, contextual-orchestrator for product LLM paths, APA 7th doctoring, and CHANGELOG updates;
• runs npm ci, full unit/API suites, coverage, docstring evidence, cloud browser E2E when available, and git diff --check before publication;
• rechecks the PR queue after model execution to narrow the compare-and-create race; and
• permits only a later trusted step to commit, push, and open one PR against develop.

Verification

tests/config/hourly-opencode-commercial-readiness.test.mjs statically enforces the schedule, single-flight gate, NVIDIA-only credential path, pinned OpenCode supply chain, provider endpoint, GitHub-token stripping, protected-file boundary, deterministic verification order, queue revalidation, and no-self-merge contract. The test is wired into npm run test:unit.

The workflow remains inactive until it reaches the default branch. This PR is intentionally Draft while #432 owns the security merge train. After #432 merges, update this branch onto the exact protected develop head, rerun every repository and central check, obtain independent current-head approval, and only then enable auto-merge.

Standards and platform evidence

docs/doctoring/hourly-opencode-commercial-readiness.md records the architecture, security boundaries, limitations, and APA 7th references to OpenCode provider documentation, NVIDIA NIM API documentation, and GitHub Actions schedule, workflow syntax, and security-hardening guidance. docs/operations/hourly-opencode-commercial-readiness.md documents activation, secrets, release/model updates, failures, verification, and rollback.

Release note

CHANGELOG.md records the hourly NVIDIA NIM/OpenCode loop and the separation between the untrusted coding-agent process and trusted publication/central review boundaries.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4167e266-fa62-489b-b508-5224a7b83dbc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by clean single-commit restack #444. #444 starts from #432 exact head 9746592143d4e87c03b7a95adf678e789d3d352a, preserves the reviewed six-file NVIDIA NIM/OpenCode scope, and removes the historical base conflict. Continue exact-head review and verification on #444.