chore(operations): prove external hourly scheduler continuation and error recovery

Problem and owner boundary

Noema repository source can prove its own work-conserving/manual-dispatch contract, exact-head safeguards and fail-closed publisher behavior. It cannot by itself prove the identity, enablement, cadence, failure/recovery history or duplicate suppression of the external scheduler that invokes the commercial loop. External scheduler evidence stays access-controlled and separate from GitHub checks, formal review, protected merge, release/deployment and acquisition evidence.

This issue owns that external control-plane evidence gap. It does not duplicate the repository workflow implementation, central .github scheduler authority, live App/ruleset provisioning, provider routing, or Noema product-domain source.

Current protected repository authority — 2026-09-18 KST

Fresh protected Noema is GitHub-verified main@f38962869307a45b3b6e65692b2acbabb075e0eb. The only open Noema source lane is Draft #722 on exact b4563512dce9ce9084548cad29f247911949c359; it repairs private-vulnerability-reporting audit authentication and does not modify external-scheduler authority.

Fresh protected read of .github/workflows/hourly-product-development.yml still shows the repository workflow is manual-dispatch only (workflow_dispatch), not repository-scheduled. The protected work-conserving gate remains current: the workflow reads live open PR inventory but does not globally starve while a PR exists; it permits a new proposal only if later publication proves path isolation from every live PR and the protected base remains current. It also fails closed when contextual-orchestrator gateway configuration or the repository-scoped Maintainer App publication path is unavailable.

The same workflow still routes the model session only through contextual-orchestrator (orchestrator/free), strips GitHub/runtime credential variables before the OpenCode process, bounds changed files/diff size, and separates credential-bearing proposal/publication authority from uncredentialed verification. These are protected source contracts, not evidence that the external scheduler itself is enabled, unique, healthy or correctly scoped.

Current protected package.json still exposes operations:external-scheduler-evidence = node scripts/external-scheduler-evidence-audit.mjs, so repository-owned validation remains available without inventing a second scheduler truth.

#722's current hosted wait is also useful negative evidence for scheduler semantics: application CI/reviewer/image are terminal SUCCESS on unchanged b4563512..., while Security fan-out trivy-fs and scorecard remain positively unassigned in the same generation. The external scheduler must not respond to such waits by blind rerun, no-op commit, force-restack or parallel duplicate writer creation.

External scheduler evidence requirement

Retain the scheduler record outside public repository prose or in another approved access-controlled evidence store. Minimum bounded fields remain:

{
  "schema_version": 1,
  "scheduler_task_identity": "provider-scoped opaque identity",
  "prompt_sha256": "64 lowercase hex",
  "scheduled_at": "ISO-8601 UTC",
  "started_at": "ISO-8601 UTC",
  "repository_full_name": "ContextualWisdomLab/noema",
  "protected_main_sha": "40 lowercase hex",
  "generic_error_observed": false,
  "github_actions_performed": [],
  "deferred_lanes": [],
  "exit_sweep_count": 2,
  "remaining_non_actionable_reasons": []
}

Do not put secrets, raw tokens, private keys, hidden model reasoning, vulnerability details or unnecessary personal data in that record.

Acceptance criteria

Scheduler identity/configuration

Retain one enabled external Noema scheduler identity, owner, cadence/timezone, observation time and prompt digest in access-controlled operational evidence.
Prove duplicate/obsolete Noema scheduler tasks are disabled rather than concurrently writing.
Prove the task is scoped to ContextualWisdomLab/noema; .github, contextual-orchestrator and other canonical-owner repositories remain read-only dependencies except through their own owner path.
Protected repository source still carries no repository-local hourly cron for this workflow; invocation is external.
Protected work-conserving PR-scoped admission/supersession behavior remains current repository workflow authority.

Generic-error recovery

Retain one bounded external generic-task-failure observation without inventing hidden provider error codes.
Bind the next successful invocation to a fresh scheduler-state read, fresh GitHub protected/open-lane read and exact resulting GitHub mutations.
Prove prompt/task repair earns no repository-completion credit by itself when another safe source/issue lane exists.
Preserve failure and recovery identities/timestamps in access-controlled evidence rather than issue prose.

Work-conserving execution

Repository workflow source expresses work-conserving admission rather than global open-PR starvation.
Retain an access-controlled external-run receipt showing a waiting CI/review lane rotated to at least one materially distinct safe action.
Retain a run showing documentation/authority work handed off to another safe operational/source lane where one exists.
Retain test-first RED→causal GREEN evidence without ending on a safe repairable RED.
Retain two consecutive fresh whole-Noema exit sweeps or a falsifiable invocation-budget boundary.

Writer safety/authority

Retain exact pre-write target/base/blob/ref/review/writer reads for a representative external run and any detected competing-writer freeze/rotation.
Prove no force push, self-approval, gate weakening, synthetic authority, self-modifying repair workflow or credential fallback occurs.
Keep scheduler evidence separate from required GitHub checks, review, merge, immutable release, deployment and production evidence.

Non-goals

No second repository schedule, no mutable scheduler prose as architecture authority, no central .github source mutation from this Noema owner, no provider routing duplication, no weakening of #27/#29 governance, and no inference that a running external task proves release/deployment/KPI/acquisition readiness.

Related: #5, #27, #29, #30, #227, #722.

Repository-side implementation is now tracked by Draft PR #97. Exact test-first lineage at this update:

initial schema/operator RED 9a45e9a4612b7c3f15fe72267a51b8a3b70a1289 / application CI 31383499168: existing 62 files / 646 tests passed; 23 new contract tests failed only because the evaluator and operator command were absent;
first evaluator/operator GREEN 00a7ac8454a4be957e9db100de2b9abca076ae0f / application CI 31384072872: 63 files / 669 tests passed;
production-coverage RED fa193637158bff0d0019ff23857e81a9f9306416 / application CI 31384315970: only the new production-path coverage policy failed;
CLI safety/testability RED 8af6f6feae86d28799dbb9af6a4730252fd7cbd0 / application CI 31384755916: 63 existing files / 675 tests passed, while 13 of 19 new CLI tests failed exactly on missing verifiable seams;
current GREEN candidate 391a61a9f0ad158bd94ddc87b8327c10ce51cde1 is pending fresh exact-head CI/security/reviewer evidence.

#97 validates retained scheduler evidence bytes and exposes the operator command; it does not enable, disable, deduplicate, schedule, or otherwise operate the external ChatGPT task. Provider-side one-enabled-task identity, prompt digest, schedule/timezone, duplicate disablement, failure/recovery receipt, and resulting GitHub mutations remain open acceptance items on this issue. Canonical architecture and whole-product sufficiency remain owned by #71.

Final repository-side implementation status after fresh exact-head revalidation:

PR feat(operations): audit external scheduler continuation evidence #97 is Ready for review at unchanged exact head 7ed8fd0b0cb2f2fe0b5504f70f02992ae3d93287 on protected base c85d710804139c0697d7ef8fa47d02b1389e6d84.
Application ci run 31385955671 is terminal-success: exact-head checkout, 66 test files / 699 tests passed, statements/branches/functions/lines all 100%, and npm audit --audit-level=high reported 0 vulnerabilities.
reviewer-ci run 31385955678 is terminal-success on the exact head with its read-only reviewer package, sandbox/image checks, 120 reviewer tests, 100% reviewer statement/branch coverage, and 100% docstrings.
Central Security Scan run 31385955685 is terminal-success under the current central workflow source; exact base/head OSV found 0 on both sides, dependency review found no moderate-or-higher vulnerable or denied packages, and the synthetic integration-tree Trivy MEDIUM/HIGH/CRITICAL gate found 0 findings.
Formal GitHub reviews remain 0 and review threads remain 0. Technical checks do not create qualifying independent approval or live merge authority.

#97 now supplies the fail-closed repository validator, operator command, compact prompt authority, tests, documentation and changelog. It still does not enable, disable, deduplicate, schedule or invoke the external ChatGPT task. This session has no provider scheduler-control connector, so no claim is made that the live task itself was modified.

The unchecked provider-side acceptance criteria on this issue remain authoritative: one enabled task identity/owner/timezone/schedule, prompt digest, duplicate-task disablement, observed generic-error receipt, subsequent task/GitHub refetch, same-invocation repository execution, exact resulting GitHub mutations, two materially distinct actions when two safe lanes existed, and two clean exit sweeps or a concrete invocation-budget boundary.

Superseding exact-head observation: the earlier comment's 7ed8fd0b0cb2f2fe0b5504f70f02992ae3d93287 GREEN evidence is now predecessor-only because another active writer moved PR #97.

Fresh current state at this observation:

protected main: c85d710804139c0697d7ef8fa47d02b1389e6d84;
PR feat(operations): audit external scheduler continuation evidence #97 head: 04524185a97d22cc70c161b9812333968d93a665;
the branch is frozen for this invocation under the single-writer rule because it moved from 7ed8fd0… to test-only RED 53df217… and then to GREEN 0452418… while the whole-repository exit sweep was running;
53df217… exact-head CI 31387877944 correctly failed one new duplicate-decoded-JSON-key regression while the other 699 tests passed;
0452418… adds duplicate-key-aware rejection and has terminal-success application ci 31388090981, reviewer-ci 31388090959, and central Security Scan 31388090956;
the current CodeRabbit review is COMMENTED, not formal approval;
four valid current-head threads remain unresolved: failed validation reports still copy untrusted evidence identity/timestamp values; camelCase/common credential aliases are not rejected; generic-error resumed_action_identity is not bound to a retained action; and materially-distinct action kinds are incorrectly required even when fewer than two safe lanes existed.

Therefore #97 is not gate-clean and no merge/readiness claim is made. The active branch writer may continue the RED→GREEN remediation; this invocation will not race it or create a competing branch. Provider-side scheduler configuration/receipt acceptance criteria on this issue remain unchanged.

Final superseding repository-side observation for this invocation:

protected main remains c85d710804139c0697d7ef8fa47d02b1389e6d84;
PR feat(operations): audit external scheduler continuation evidence #97 is Ready and mergeable at current exact head 11a306e94982890935381704cf8e6b43df0bdb46;
application ci 31388866910, reviewer-ci 31388866919, and central Security Scan 31388866943 are all terminal-success on that exact head;
all five CodeRabbit inline threads are resolved; the duplicate-decoded-key, failed-report identity retention, camelCase/common credential alias, resumed-action binding, and one-safe-lane action-kind defects are addressed in current source;
the only current formal review is CodeRabbit COMMENTED, not a qualifying independent non-author APPROVED review;
the PR body still describes predecessor head 7ed8fd0b0cb2f2fe0b5504f70f02992ae3d93287; because another writer moved this branch during the invocation, this invocation froze branch/PR-state writes rather than racing that writer. Exact live metadata and checks above supersede the stale body identity.

Accordingly #97 is technically gate-clean at this observation but not merge-authorized: live #27/#29 governance and eligible independent formal approval remain separate blockers. This still does not prove or operate the provider-side ChatGPT task. The unchecked live scheduler identity/configuration, duplicate-task disablement, prompt digest, generic-error receipt/recovery, same-invocation GitHub execution, and exit-sweep evidence on this issue remain required.

Provider-side recovery evidence from the generic scheduled-task failure is now materially stronger in this invocation, without publishing provider-scoped task identifiers or copying stable product/security authority out of the repository.

The recovery invocation first re-fetched the scheduler control plane and found one enabled hourly Noema task; obsolete Noema task entries were not re-enabled. The task was compacted in place while preserving Noema-only write scope and read-only dependency boundaries. Prompt repair was treated as zero repository-completion credit.
Protected main was independently re-resolved as c85d710804139c0697d7ef8fa47d02b1389e6d84 before repository writes. The live central Security Scan authority was separately re-read from ContextualWisdomLab/.github and confirmed to trigger only on protected bases (main, master, develop) with fixable Trivy MEDIUM/HIGH/CRITICAL; feature-base absence therefore remains non-passing defer_until_trigger evidence.
Repository execution resumed in the same invocation instead of ending after scheduler repair. A distinct product/data-integrity lane created Draft PR fix(api): reject duplicate decoded target_repository keys #103 on exact fix(api): reject unsupported exchange methods before side effects #101 head 50af2026b30693524d5307b4e9449c888d4dc8b8 to reject ambiguous decoded target_repository JSON members before credential-bearing work.
Exact RED commit abdb8aa55c392d74a5eac7a3b443e4f41f953a24 was checked out by application CI 31407630318 and failed exactly the new regression: 63 existing test files passed, while test/exchange-json-integrity.test.ts alone failed because bounded JSON was still accepted. The invocation did not stop on RED.
GREEN commit e15eabce06609c585fcd10a7e916c126fd462771 immediately added the narrow fail-closed duplicate_keys path; its application/reviewer CI was queued/in progress at the first observation, so that exact waiting lane was deferred and work rotated here rather than ending the run.
This issue-evidence mutation is a second materially distinct repository action from the source/test lane. It records generic-error recovery and work-conserving rotation without conflating scheduler evidence with GitHub checks, formal reviews, merge authority, release/deployment evidence, or acquisition readiness.

Still open here: retain the provider-scoped task identity/prompt digest in access-controlled evidence rather than this public issue; finish exact-head proof for #103; and retain two clean whole-repository exit sweeps (or a concrete invocation-budget boundary) after all newly discovered safe work is exhausted.

Fresh external-control-plane evidence from the successful 2026-08-12 KST retry invocation:

exactly one enabled dedicated Noema hourly task is currently observable: title Noema Commercial Loop, task identity 6a6fff020c7881918e70933346d84d87;
schedule is hourly (RRULE:FREQ=HOURLY) with default timezone Asia/Seoul; the task is enabled and its latest recorded run time is 2026-08-11T22:53:29.380036Z;
the task prompt is scoped to ContextualWisdomLab/noema, explicitly treats .github, naruon, contextual-orchestrator and dedicated-writer repositories as read-only dependencies, and requires exact-head/live-base refetch, branch-local freeze, work-conserving continuation, no synthetic approval/authority, and two fresh exit sweeps;
the enabled fleet writer CWL Autonomous Development explicitly skips every repository with an enabled dedicated writer loop, so it is not a competing Noema writer under its current contract;
this conversation observed repeated generic There was a problem with your scheduled task responses. No hidden provider error code or cause is invented. On the user’s 다시 시도 redirection, this invocation refetched the task and GitHub first, then resumed material Noema work rather than treating prompt/task repair as completion;
resulting same-invocation GitHub mutations already include fresh governance/evidence corrections on fix(security): isolate reviewer GitHub CLI subprocess environment #175, chore(governance): protect main and enforce release checks #27, chore(operations): provision and activate hourly maintainer App #29 and 200억 달러 매각 readiness evidence 확보 #5 while protected main remained exact cd40474b258f9512d93ce82f5375071ce1f78762; multiple moving PR branches were branch-frozen instead of raced.

This closes part, but not all, of #96’s provider-side evidence gap. Still not established here: an independently retained prompt SHA-256 receipt bound to the provider task, an exact provider invocation/receipt identifier for each failed/successful run, and a final retained machine-readable evidence record passing PR #97’s repository validator. Those remain fail-closed rather than inferred from this issue comment.

Control-plane recovery evidence (2026-08-12 UTC): after repeated generic scheduled-task error reports, the live scheduler inventory was refetched and still showed exactly one enabled hourly Noema Commercial Loop (6a6fff020c7881918e70933346d84d87, Asia/Seoul) with the compact repository-authority prompt. Protected main was independently refetched at 5addf7fc1fc3494b3fc3dbc390d504e260ea4f09, and live ruleset/security-workflow authority was re-read before writes. The invocation then resumed repository execution rather than treating prompt/scheduler inspection as completion. Two independent Noema source lanes were advanced non-destructively: PR #207 branch fix/acquisition-deployment-exact-bytes-current-main-v2 was fast-forwarded from 7a31ae760e845cab94f2b66aaffc6824d27efbfe to merge-current-main head 4d9c4919703b86b16f449c084c8c928c36f99d21; PR #206 branch fix/exchange-method-contract-current-main-v2 was fast-forwarded from 5714d11f7fcbb673961cc7afc384f27ed8d86ebf to merge-current-main head a9a66b795d80b6a6ab14202ba54d3dd68f2e241b. Both updates used non-forced refs after exact branch/main revalidation; their fresh CI/reviewer/Security Scan runs are separate non-passing queued evidence until terminal. PR #212 was not mutated because its head moved independently during this invocation, so that lane was branch-locally frozen instead of raced. This comment is scheduler/continuation evidence only; it is not a CI check, formal review, merge authority, release/deployment evidence, or acquisition evidence.

Generic-scheduler-error recovery receipt for the current continuation, intentionally recorded before exit sweeps so this evidence mutation does not invalidate a completed sweep count.

Fresh control-plane/repository state immediately before this write:

exactly one enabled dedicated Noema task was refetched: Noema Commercial Loop, provider task id 6a6fff020c7881918e70933346d84d87, RRULE:FREQ=HOURLY, timezone Asia/Seoul;
the fleet writer remains configured to skip repositories with an enabled dedicated writer;
protected main is 0b515c11670f26f888ccdf66707f34b946f505ef;
no hidden provider error code or unobserved scheduler cause is asserted.

Same-invocation repository execution resumed instead of treating prompt/task recovery as completion. Concrete GitHub mutations already completed in this continuation:

fix(api): restack unsupported exchange method short-circuit on current main #206 was proven byte/scope-superseded by current-main fix(api): short-circuit unsupported exchange methods on current main #214 and closed unmerged; its two unique API/test blobs are exactly preserved on fix(api): short-circuit unsupported exchange methods on current main #214, while its extra KPI path equals protected main.
fix(acquisition): restack exact deployment evidence bytes on current main #207 was proven byte/scope-superseded by current-main fix(acquisition): bind deployment audit to exact bytes on current main #213 and closed unmerged; its acquisition source/test blobs are exactly preserved on fix(acquisition): bind deployment audit to exact bytes on current main #213, while its extra KPI path equals protected main.
historical fix(api): reject unsupported exchange methods before side effects #101 was proven fully byte-identical to current-main fix(api): short-circuit unsupported exchange methods on current main #214 across its complete two-file delta and closed unmerged.
historical fix(acquisition): authenticate exact deployment evidence bytes #125 was proven semantically preserved and strictly strengthened by fix(acquisition): bind deployment audit to exact bytes on current main #213's descriptor-bound exact-byte verifier and closed unmerged.
the orphan current-main test-first branch for security(kpi): reject GitHub credential prefixes in retained source labels #134 was recovered without rewriting history and opened as Draft fix(security): restack GitHub credential-shaped KPI source labels #215 at exact RED head 88731607c58288f37c7638e2db7b35f2e282ea1a; its application/security workflows are currently queued and therefore non-passing.

Writer-safety evidence: #214 and #213 each moved from their PR-body RED identity to a new current GREEN identity during the fresh state sweep, so both source/PR-state lanes are frozen for this invocation rather than raced. The recovered #215 branch was re-read twice at the same exact head before PR creation and had no open PR/competing movement.

This comment does not claim the required two clean exit sweeps, prompt digest retention, release/deployment/KPI evidence, or acquisition readiness. Those remain separate acceptance facts.

Fresh generic-error recovery evidence from the user-directed continuation, without inventing any provider error code or claiming current scheduler configuration that was not observable in this runtime:

GitHub was refetched first; protected main remained db4f444c1b1849ec615364a233469870c23407e6.
Waiting exact-head CI on fix(api): restack exchange method short-circuit on latest main #221 was treated as lane-local. The run continued and performed materially distinct repository actions instead of ending:
1. completed the valid CodeRabbit test-contract remediation on fix(api): restack exchange method short-circuit on latest main #221 by pinning X-Latency-Ms: 0, producing exact head a7198c4efc12296f0cd1893b6f26090df72ddd3f;
2. non-destructively refreshed release-attestation isolation PR fix(release): bind release evidence toolchain #152 onto live main, producing exact head ab3b1b1b1add09dd71f2895579120412c85e1fef with 0-behind ancestry and the three exact reviewed blobs;
3. retained independent multi-head unassigned-runner evidence on chore(ci): prove and prevent intermittent GitHub Actions runner-assignment stalls #30 while leaving queued checks non-passing;
4. updated security(release): isolate dependency lifecycle execution from attestation authority #155 with the implemented unprivileged verification/materialization -> authenticated attestation handoff architecture.
Before each branch mutation, exact branch head and live main were re-read; both ref updates were non-forced. A concurrently moving fix(governance): restack independent approval audit after nanoid #90 branch and the competing fix(acquisition): bind deployment audit to exact bytes on current main #213/fix(acquisition): restack deployment audit byte identity on latest main #223 acquisition line were branch-locally frozen rather than raced.

The external task identity/prompt digest/current enabled-state could not be re-read through the available task control plane in this continuation, so those acceptance fields remain unproven. The concrete GitHub mutations above prove only same-invocation repository continuation after the generic error; they are not scheduler configuration, merge, release, production, or acquisition evidence.

Repository-owned hourly scheduler observability is now tracked separately by Draft PR #222. Fresh exact source at this update:

protected main: db4f444c1b1849ec615364a233469870c23407e6;
PR fix(operations): make hourly scheduler activation observable #222 exact head: de68cdc892f6310fc5962a0d5cd81931f64fb9e2;
current compare is zero commits behind protected main with exactly six changed paths;
application ci 31592548665, reviewer-ci 31592548508, and central Security Scan 31592548639 are queued and are not accepted as success.

RCA: the repository workflow attached if: vars.NOEMA_MAINTENANCE_ENABLED == 'true' to its sole job. Observed schedule run 31587463951 therefore contained one skipped job with zero steps and no retained reason. The available integration cannot read the repository variable value, so no claim is made about whether it was absent, false, inaccessible, or intentionally disabled.

#222 test-first separates an always-running read-only activation preflight from the credential-bearing Maintainer App lane. It does not add a second schedule, grant write authority to GITHUB_TOKEN, create a repair/self-modifying workflow, enable maintenance, provision either App, submit approval, merge, release, deploy, or operate the external ChatGPT task.

A second security review corrected the first candidate before acceptance: because this repository is public and workflow artifacts are public-readable evidence, the retained activation JSON no longer exposes per-variable/per-secret presence or credential-specific missing reasons. Ordinary unavailable prerequisites are collapsed to EXTERNAL_GATE_REMAINS / activation_prerequisite_unavailable; exact configuration diagnosis remains in administrator controls and access-controlled Maintainer App readiness evidence.

This does not satisfy #96's provider-side acceptance criteria. One enabled external task identity/owner/timezone/schedule, prompt digest, duplicate disablement, generic-error-to-next-invocation recovery, exact external run identities, resulting GitHub mutations, and two clean exit sweeps remain external evidence gaps.

Fresh external-scheduler evidence from the 2026-08-17 Noema maintenance invocation:

One enabled Noema task is present: Noema Commercial Loop, scheduler identity 6a6fff020c7881918e70933346d84d87.
Cadence remains hourly (RRULE:FREQ=HOURLY) with exact scheduling; no second enabled Noema writer task was observed in the current automation inventory.
The task remains repository-scoped in its current contract: Noema is the only source/docs/ref write target; .github, naruon, contextual-orchestrator, and other dedicated-writer repositories remain read-only source dependencies.
The last recorded scheduler invocation before this evidence capture was 2026-08-17T14:36:13.649830Z.
This invocation refetched protected main at 15ccf1226fe92468dc0a0e3761f3fe8bb328f2a9, live PR/issue/check/rules state, then rotated away from a waiting feat(sandbox): restack patch-validator image on current main #407 image lane rather than treating that wait as completion.
Work-conserving continuation is observable in this same invocation: while feat(sandbox): restack patch-validator image on current main #407 exact-head image run 32039518910 remained in progress, the existing canonical docs: establish canonical product and trust-boundary documentation #71 docs owner was advanced with docs(test): record credential-exchange coverage truth (3a7a066fd05c6da18a7300879c4eafa6b8438d75), and this issue received the scheduler evidence rather than ending on the queued image gate.

This is partial acceptance evidence only. It does not prove the generic-error recovery chain or the required two clean consecutive post-repair scheduled runs, so #96 should remain open. No hidden provider error code or unsupported scheduler RCA is inferred.

Fresh provider-side recovery evidence from the current Noema commercial-loop invocation:

Existing external task identity was refetched through the scheduler control plane before this evidence write: 6a6fff020c7881918e70933346d84d87, title Noema Commercial Loop, enabled, exact hourly RRULE:FREQ=HOURLY, default timezone Asia/Seoul. No duplicate Noema writer task was created and cadence was not changed.
The task remains scoped to ContextualWisdomLab/noema for source/docs/refs/PR-state writes; central .github, naruon, contextual-orchestrator and other dedicated writers remain read-only source dependencies.
Generic scheduled-task failure had been observed in the immediately preceding scheduler attempts without inventing a provider error code. This invocation then refetched live GitHub state before mutating it and resumed substantive repository execution rather than editing the prompt and stopping.
Material GitHub action 1: PR fix(ci): bound transient GitHub retries in live-base verification #411 exact head 7c749c7ab2ea3e24dfc1ed7e78d10b0b9dbcdfdb was revalidated with terminal-success application CI 32043313195, reviewer-ci 32043313177, Security Scan 32043313168, zero unresolved threads, and the live Noema ruleset; it was marked Ready and squash-merged with expected-head protection. Protected main advanced to c25760e48362c6b0605a2b2aea19192f8dd0b9b4.
Protected-main operational proof for that merge is now retained separately from PR evidence: push ci run 32043965622 is terminal success, push reviewer-ci run 32043965611 is terminal success, and scheduled Hourly Orchestrator Product Development run 32044027758 is terminal success on the same protected head. The scheduled product job correctly stopped at its zero-open-PR/single-flight gate because another PR was open; downstream proposal/package/publish steps were skipped rather than treated as product success.
Material GitHub action 2: PR feat(sandbox): restack patch-validator image on current main #407 was non-destructively converged onto the new protected main with merge commit e4e3c12329b3c3bca07759c130107be43973a9ec, preserving fix(ci): bound transient GitHub retries in live-base verification #411's two current-main blobs exactly. A separate Noema-owned long-running image-verification reliability defect was then handled test-first: RED head 81898d3303480fa14fb85bd458e56f10daca377d / CI 32044252320 / job 95428774664 failed the new bounded-live-head-retry contract in test/patch-validator-workflow.test.ts; GREEN candidate 68886826654cfacb8814cd6e467f9f1e961824ba implements transient-only 502/503/504 retries at both pre/post image-verification head reads while suppressing raw GitHub diagnostics and preserving exact-head fail-closed equality.
On 68886826654cfacb8814cd6e467f9f1e961824ba, application CI 32044410728, reviewer-ci 32044410708, and Security Scan 32044410751 are terminal success. The real patch-validator-image run 32044410731 / job 95429250360 remains in progress and therefore is explicitly non-passing; the invocation rotated to independent work instead of stopping or perturbing the clean head.
Writer-safety evidence: docs: establish canonical product and trust-boundary documentation #71 was refetched and found to have moved under another actor, so that exact documentation lane was frozen rather than raced; feat(sandbox): restack patch-validator image on current main #407 writes were preceded by exact branch/base/blob/ref/review/check refetches; no force push, self-approval, gate weakening, synthetic passing evidence, credential fallback, or foreign dedicated-repository source write was used.

This materially advances the generic-error-recovery and work-conserving acceptance evidence. Still open before #96 can close: a bounded provider timestamp/receipt with prompt SHA-256 and next-invocation identity in the repository-side evidence schema, plus the final two clean exit sweeps for this invocation (or an explicit practical budget boundary).

Bounded generic-error recovery evidence, without provider-private task identifiers or schedule metadata:

A generic scheduled-task failure was observed before this successful repository execution. No hidden provider error code is inferred.
The next executable pass refetched protected Noema main@2c83355529447248c246805d1954f268e027d2ab, open PR/issue state, canonical fix(egress): bound anonymous GitHub API authority #500 head/base, reviews/threads/checks, protected central scanner source, and existing real-owner paths before writing.
Test-first Noema mutation 8b6f932be4206f17433163daf0a535a453a416f9 added a regression proving callable-but-non-writable globalThis.fetch must not satisfy /ready credential transport capability. Hosted Application 33165391236 / verify 98829459734 checked out that exact head, passed base/lockfile/install/typecheck, and failed at release tests.
Production descendant 740e12671adf87c2d0d5ab942cc283ec7b1cf912 repairs the false-ready boundary by requiring a callable, writable runtime fetch data property while leaving the readiness probe side-effect free. Same-head Application 33165499222, reviewer-ci 33165499124, and workflow-level Security 33165499194 are terminal-success; dedicated image 33165499096 remains non-terminal, so this lane was not promoted to merge-ready.
While the image lane remained active, work rotated rather than ending: existing central owner checkpoint .github#1222 comment 5440526640 was updated with the exact Noema RED/GREEN canary and current central #897/#834 identities, without foreign source/ref/PR-source mutation; Noema fix(egress): bound anonymous GitHub API authority #500 PR authority was then updated to current exact head/evidence.
No force push, destructive rebase, self-approval, gate weakening, synthetic success, credential fallback, or competing writer workflow was used.

This advances only the observable generic-error recovery/work-conservation criteria. It does not claim the access-controlled scheduler identity/prompt-digest criteria are complete, and it does not substitute for the two required fresh exit sweeps or terminal image/central-owner evidence.

Navigation Menu

Repository navigation

chore(operations): prove external hourly scheduler continuation and error recovery #96

Problem and owner boundary

Current protected repository authority — 2026-09-18 KST

External scheduler evidence requirement

Acceptance criteria

Scheduler identity/configuration

Generic-error recovery

Work-conserving execution

Writer safety/authority

Non-goals

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

chore(operations): prove external hourly scheduler continuation and error recovery #96

Description

Problem and owner boundary

Current protected repository authority — 2026-09-18 KST

External scheduler evidence requirement

Acceptance criteria

Scheduler identity/configuration

Generic-error recovery

Work-conserving execution

Writer safety/authority

Non-goals

Activity

seonghobae commented on Aug 10, 2026

seonghobae commented on Aug 10, 2026

seonghobae commented on Aug 10, 2026

seonghobae commented on Aug 10, 2026

seonghobae commented on Aug 10, 2026

seonghobae commented on Aug 11, 2026

seonghobae commented on Aug 12, 2026

seonghobae commented on Aug 12, 2026

seonghobae commented on Aug 12, 2026

seonghobae commented on Aug 12, 2026

seonghobae commented on Aug 17, 2026

seonghobae commented on Aug 17, 2026

seonghobae commented on Aug 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions