fix(actions): align hourly quality contract with central admission (#647)

[seonghobae]

Finding

Protected main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0 already delegates recurring commercial-development cadence to the central CWL admission owner. The repository workflow is marked cwl-org-commercial-entrypoint: v1, exposes workflow_dispatch/dry_run, and intentionally has no local schedule/cron trigger. The repository quality test and operations runbook still required/described the retired minute-47 local cron, producing the exact hosted RED recorded in #647.

Repair

• keep .github/workflows/hourly-nim-product-development.yml unchanged;
• require the central-entrypoint marker plus repository-local workflow_dispatch/dry_run in the quality contract;
• explicitly refuse any repository-local schedule: or cron: trigger token;
• preserve the existing credential, queue, artifact, verification, and late-publication assertions;
• update the operations runbook so cadence and recurring disablement belong to the central CWL scheduler/admission owner;
• record the owner-boundary correction in CHANGELOG.d/central-hourly-admission-contract.md.

RED → repair evidence

Hosted RED: PR #639 Rust Foundation run 35603427225, Python quality job 106344713116, failed only because test_hourly_workflow_schedule_credentials_and_queue_gate still expected cron: "47 * * * *" after #490 centralized admission.

Source repair lineage:

• e5500207255627895146b54b3df683c6588d8a36 replaces the stale cron-positive contract with central-entrypoint + dispatch/dry-run and local schedule/cron refusal;
• 482388d525a3c59aae3ab40adfb4374f4c974076 currentizes cadence/disablement runbook ownership;
• 844b06b343e844fffd89b13af347a54f6b4ae005 records the changelog fragment;
• 0be133ae0e0a58c1a0f88a8c59df839eae971ead tightens schedule: refusal to cover YAML indentation and restores the source newline.

Foundation prerequisite RCA

Exact-head Rust Foundation run 35639598173 executed the repository/Python contract, 100% authored line/branch coverage, Live PostgreSQL, rustfmt, Clippy, 1,443 nextest tests with 0 skipped, doctests, and rustdoc successfully. Its only failing step was cargo deny check. The job log identifies RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc in rustls 0.23.43; advisories failed while bans, licenses, and sources passed. RustSec requires rustls >=0.23.45.

That dependency delta is already canonically owned by #526 and fully inherited by main-target successor #538, which pins rustls = 0.23.45. Duplicating it on this lane would create competing dependency authority. A base-only stack onto #538 was tested and GitHub reported the PR non-mergeable because #538 and this PR both legitimately modify the hourly runbook/quality contract. The base was therefore restored to protected main; no force update, destructive rebase, hand-written conflict resolution against mutable owner state, advisory suppression, or source-copy was used.

This PR stays Draft until #538 (or a verified complete successor) lands on protected main. It must then ordinary-forward reconcile the overlapping hourly contract files, rerun on the new protected base, and reacquire exact-head evidence. Current exact head remains 0be133ae0e0a58c1a0f88a8c59df839eae971ead.

Acceptance

• fix(coverage): reconcile contradictory LCOV opener counts #538 or a verified complete successor lands the rustls >=0.23.45 dependency-policy repair without suppression;
• this branch ordinary-forward reconciles the overlapping hourly contract files after that landing;
• current exact-head Python quality contract passes with its normal branch-coverage gate;
• no repository-local schedule/cron is introduced;
• exact-head security/documentation/foundation checks pass;
• qualifying independent review is required before Ready/merge;
• dependent feat(membership): add owner-issued single-membership admission #605 and fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639 remain open and reconcile/rerun only after prerequisite foundation landing.

#647 remains open until this repair has current-head GREEN, qualifying independent review, and protected-main landing; this PR does not close dependent scientific work.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 35 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bf3b851a-c5b0-412a-a403-132ec52dbd99

📥 Commits

Reviewing files that changed from the base of the PR and between 0555fe9 and 5094c06.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• CHANGELOG.d/central-hourly-admission-contract.md
• CHANGELOG.d/rustls-tls-handshake-advisory.md
• Cargo.toml
• docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md
• tests/quality/test_hourly_nim_product_development.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh prerequisite read from #639 lane: exact 0be133ae0e0a58c1a0f88a8c59df839eae971ead Rust Foundation run 35639598173 is no longer generally queued. Repository/Python contracts + SBOM/provenance (106465395100), authored line/branch coverage (106465395401), Live PostgreSQL (106465395465), formatting, Clippy, full tests, doctests and rustdoc all executed GREEN. The only Rust Foundation failure is job 106465395548 step Enforce dependency, license, advisory, and source policy (cargo deny check). Documentation 35639598051 and Semgrep 35639598131 are GREEN; Security 35639598143 and CodeQL 35639598065 remain non-terminal. #648 changes no Cargo dependency/lock/policy file, so this read does not attribute the cargo-deny failure to the cron-contract delta or weaken the gate; exact cargo-deny diagnostic still needs canonical owner RCA before promotion. Dependent #605/#639 remain Draft.

[seonghobae]

Independent local reproduction — October 3, 2026 (KST)

I reproduced the protected-main Python contract failure on a243f18da4a4ca8a8d068c39922537f1f8ed6ad0: the 169-test quality suite failed only at the retired minute-47 cron assertion. I then recreated this PR's three changed files in an isolated existing worktree and verified byte-for-byte equality with current PR head 0be133ae0e0a58c1a0f88a8c59df839eae971ead.

Observed local results using the hash-pinned coverage==7.15.2 dependency and Python 3.14.7:

• focused hourly contract: 11 tests passed;
• complete repository quality suite: 169 tests passed;
• coverage: 1,350 statements and 670 branches, zero missing, 100%;
• workspace contract, Rust docstring contract, documentation validation, and diff whitespace checks passed;
• executable fixture controls ran the actual contract: current dispatch accepted; missing central marker, reintroduced local schedule, and reintroduced cron each rejected with the expected assertion and no harness errors.

This confirms the bounded local contract repair, not protected-main shipment or whole-product acceptance. No commit, push, readiness transition, workflow rerun, review approval, or merge was performed. Native Rust all-features verification failed in the macOS MLX build while the host was under severe storage pressure; its truncated failure log does not establish the underlying MLX cause. The separate CPU workspace test excludes only mlx_native_receipt and is still running. This exclusion is not MLX/GPU acceptance.

A fresh local cargo deny check on protected-main dependencies independently reproduced RUSTSEC-2026-0285 for rustls 0.23.43; official RustSec identifies >=0.23.45 as patched. Preserve the existing dependency owner/successor #538 rather than duplicate its manifest delta or suppress the advisory. Current PR checks still show the Rust dependency-policy failure and CodeQL compatibility failures; skip-like reviewer statuses are not qualifying independent approvals.

Retained local evidence is under /Users/seonghobae/.hermes/cache/scratch/tepp-health-20261003/; this local path is not a public artifact or CI receipt. #647 remains open. Related product/scientific requirements remain unchanged.

[seonghobae]

Local successor verification: completed coverage gates

The ten-file local composition based on main a243f18da4a4ca8a8d068c39922537f1f8ed6ad0 now passed both unchanged repository coverage gates: authored lines 11,209/11,209 (100%), folded branches 3,900/3,900 (100%). It retains the exact three-file dependency slice from #538 and three-file contract repair from #648, with an additional locally reviewed MLX finite-output/error-path regression repair.

The current composition also passed all-features locked Rust tests/doctests 1,448 passed / 0 failed / 0 ignored, warning-fatal Clippy/rustdoc, MLX Cargo packaging and extracted-package compilation. A fresh read-only independent source review passed for the complete ten-file manifest; parent verified every file hash. Native Git patch replay against the exact base reproduced all ten reviewed file hashes.

Earlier missing-coverage gates, SIGTRAP and review rejection are preserved, not deleted or reclassified. The current cfg(test)-only mutex covers every native test journey; injected error statuses use actual native allocations/frees and are not observed hardware faults. The inherited sqlx_live.rs producer exclusion is unchanged; separate native PostgreSQL18 evidence is not pinned16 hosted acceptance. Native MLX CPU probe is not GPU estimator parity.

No commit, push, new PR, Ready transition, workflow rerun, formal approval or merge was performed. This is local composition evidence, not whole-PR approval or protected-main shipment. Existing #538/#648 owners and failing hosted security/CodeQL gates remain authoritative. Effective main-rule read returned REST rate-limit403; rules are unknown, not absent.

Local artifact (not a public/CI artifact): /Users/seonghobae/.hermes/cache/scratch/tepp-health-20261003/tepp-health-candidate.patch. Final receipt: local-acceptance-final.json; manifest SHA256 f30c3ced580bc3ea36d9a807206d9baa6bcb26a233ef347cc2be423a6d7fa6b0. Any adoption must preserve existing branch ownership, bind the full successor delta and obtain normal exact-head checks/qualifying reviews.

[seonghobae]

Advanced the existing branch by normal fast-forward composition, preserving original PR648 commits and merging main0555fe916. Added only Cargo.toml/Cargo.lock/security-changelog bytes identical to current PR526@04ef5a46 and PR538@5f070a6c; no broad coverage/CI changes copied. Primary RustSec record requires rustls>=0.23.45. Candidate5094c060: full Python quality170/170,100% statement/branch coverage,cargo deny0.19.7 exit0(advisories,bans,licenses,sources),workspace/docstring contracts PASS. Baseline main reproduces stalecron and rustls advisory failures. No ignore/exemption/scientific-threshold changes. Independent Hermes auto source review is now running after external Codex review failure; no formal approval, complete Rust/liveDB/Actions execution or merge is claimed.

[seonghobae]

Hermes auto independent source review: SCOPED PASS of exact5094c060 six-path composition; hourly semantics preserved, canonical rustls0.23.45 satisfies primary advisory, no workflow/deny-policy changes. Full Python170/170 and100%branchcoverage, cargo deny exit0 verified. Full Rust/Clippy/rustdoc/hosted/liveDB and formal App approval remain unverified. User-authorized infrastructure bypass is used for this bounded source prerequisite integration, not a claim of complete release/scientific acceptance.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Dependency ownership changed since PR description

The PR description says this branch leaves the rustls upgrade to another PR. This head includes the upgrade; reconcile dependency ownership and exact-head check evidence before merging.

---

Was this helpful? React with 👍 or 👎 to provide feedback.