docs: fix stale "active PR #80" references in automation-threat-model.md

.github/workflows/central-review.yml

@@ -429,7 +429,7 @@ jobs:
       - name: Run independent PydanticAI review and publish current-head verdict
         env:
           GH_TOKEN: ${{ steps.noema_write_app.outputs.token }}
-          PYTHONPATH: ${{ github.workspace }}/reviewer
+          PYTHONPATH: ${{ github.workspace }}/reviewer:${{ github.workspace }}/packages/noema-core/src
           NOEMA_REVIEW_TOKEN_SOURCE: noema-github-app
           NOEMA_LLM_API_URL: ${{ vars.NOEMA_LLM_API_URL }}
           NOEMA_LLM_MODEL: ${{ vars.NOEMA_LLM_MODEL }}

.github/workflows/ci.yml

@@ -7,8 +7,8 @@ on:
       - main
 
 concurrency:
-  group: noema-ci-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   verify:

.github/workflows/hourly-product-development.yml

@@ -8,9 +8,6 @@ on:
         required: false
         default: false
         type: boolean
-  schedule:
-    - cron: "47 * * * *"
-
 concurrency:
   group: hourly-orchestrator-product-development-${{ github.repository }}
   cancel-in-progress: false
@@ -22,9 +19,6 @@ env:
   DEFAULT_BRANCH: main
   OPENCODE_VERSION: "1.17.13"
   OPENCODE_SHA256: 157afa289d1a8d9372de0ce19ac726119b937a1f6b201808d46f06e4e59bb348
-  # One gateway-backed session plus setup/diagnostic reserve fits in 55 minutes.
-  OPENCODE_RUN_TIMEOUT_SECONDS: "2700"
-  OPENCODE_KILL_GRACE_SECONDS: "30"
   MAX_CHANGED_FILES: "40"
   MAX_DIFF_BYTES: "500000"
   MAX_PR_TITLE_BYTES: "120"
@@ -51,7 +45,7 @@ jobs:
     env:
       DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
     steps:
-      - name: Enforce zero-open-PR single-flight gate
+      - name: Validate work-conserving single-flight admission
         id: gate
         shell: bash
         env:
@@ -80,13 +74,9 @@ jobs:
           fi
 
           if [ "$(jq 'length' <<<"$open_prs")" -gt 0 ]; then
-            {
-              echo "dispatch=false"
-              echo "reason=open_pull_request"
-            } >>"$GITHUB_OUTPUT"
-            echo "An open pull request exists; exact-head PR governance owns this hour." \
+            echo "open_pull_request_count=at_least_one" >>"$GITHUB_OUTPUT"
+            echo "Open pull-request lanes remain; a new proposal is allowed only if publication proves path isolation from every live PR." \
               >>"$GITHUB_STEP_SUMMARY"
-            exit 0
           fi
 
           if { [ "$ORCHESTRATOR_KEY_CONFIGURED" != "true" ] \
@@ -141,6 +131,12 @@ jobs:
           supportability, or operations gap that can be completed as exactly one bounded
           pull request. Do not create another repository.
 
+          Existing open pull requests are independent governance lanes, not a global stop.
+          Select an unrelated buyer gap from current protected main. A trusted publisher will
+          fail closed if any proposed changed path overlaps any live open pull request or if
+          protected main advances. Do not intentionally duplicate or replace work already owned
+          by an active pull-request lane.
+
           Keep Noema independently deployable and preserve its modular MSA role with
           ContextualWisdomLab/.github, naruon, contextual-orchestrator, and other CWL
           services. Keep interfaces explicit and replaceable. Route every Noema LLM
@@ -206,7 +202,7 @@ jobs:
         run: |
           set -euo pipefail
           {
-            echo "Dry run: the zero-open-PR gate permits one bounded OpenCode proposal."
+            echo "Dry run: work-conserving admission permits one bounded OpenCode proposal; publication still requires current-base and open-PR path isolation."
             echo
             cat "$RUNNER_TEMP/noema-agent-prompt.md"
           } >>"$GITHUB_STEP_SUMMARY"
@@ -280,8 +276,7 @@ jobs:
         run: |
           set -euo pipefail
           prompt="$(cat "$RUNNER_TEMP/noema-agent-prompt.md")"
-          if timeout --kill-after="${OPENCODE_KILL_GRACE_SECONDS}s" "${OPENCODE_RUN_TIMEOUT_SECONDS}s" \
-            env -u GH_TOKEN -u GITHUB_TOKEN \
+          if env -u GH_TOKEN -u GITHUB_TOKEN \
             -u REPOSITORY_TOKEN \
             -u ACTIONS_ID_TOKEN_REQUEST_TOKEN \
             -u ACTIONS_ID_TOKEN_REQUEST_URL \
@@ -712,7 +707,7 @@ jobs:
           permission-metadata: read
           permission-pull-requests: write
 
-      - name: Revalidate queue and default-branch head
+      - name: Revalidate open-PR path isolation and default-branch head
         shell: bash
         env:
           GH_TOKEN: ${{ steps.maintainer_app.outputs.token }}
@@ -725,20 +720,81 @@ jobs:
             exit 1
           fi
 
-          if ! open_prs="$(
-            gh pr list \
-              --repo "$GITHUB_REPOSITORY" \
-              --state open \
-              --limit 1 \
-              --json number,url
+          proposal_paths="$RUNNER_TEMP/proposal-paths.b64"
+          git diff --cached --name-only -z | node -e '
+            const chunks = [];
+            process.stdin.on("data", (chunk) => chunks.push(chunk));
+            process.stdin.on("end", () => {
+              const names = Buffer.concat(chunks).toString("utf8").split("\0").filter(Boolean);
+              for (const name of names) {
+                process.stdout.write(Buffer.from(name, "utf8").toString("base64") + "\n");
+              }
+            });
+          ' >"$proposal_paths"
+          LC_ALL=C sort -u -o "$proposal_paths" "$proposal_paths"
+
+          isolation_check="$RUNNER_TEMP/verify-open-pr-path-isolation.sh"
+          cat >"$isolation_check" <<'SCRIPT'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          exclude_pr="${1:-}"
+          proposal_paths="$RUNNER_TEMP/proposal-paths.b64"
+          reserved_paths="$RUNNER_TEMP/open-pr-paths.b64"
+          overlap_paths="$RUNNER_TEMP/open-pr-overlap.b64"
+          : >"$reserved_paths"
+
+          if ! open_pr_numbers="$(
+            gh api --paginate \
+              "repos/${GITHUB_REPOSITORY}/pulls?state=open&per_page=100" \
+              --jq '.[].number'
           )"; then
             echo "::error::pull_request_inventory_unavailable_after_generation"
             exit 1
           fi
-          if [ "$(jq 'length' <<<"$open_prs")" -gt 0 ]; then
-            echo "::error::open_pull_request_after_generation"
+
+          while IFS= read -r pull_number; do
+            [ -n "$pull_number" ] || continue
+            if ! [[ "$pull_number" =~ ^[1-9][0-9]*$ ]]; then
+              echo "::error::pull_request_inventory_invalid_after_generation"
+              exit 1
+            fi
+            if [ -n "$exclude_pr" ] && [ "$pull_number" = "$exclude_pr" ]; then
+              continue
+            fi
+            if ! expected_files="$(
+              gh api "repos/${GITHUB_REPOSITORY}/pulls/${pull_number}" --jq '.changed_files'
+            )"; then
+              echo "::error::pull_request_file_inventory_unavailable_after_generation"
+              exit 1
+            fi
+            if ! [[ "$expected_files" =~ ^[0-9]+$ ]] || [ "$expected_files" -gt 3000 ]; then
+              echo "::error::pull_request_file_inventory_unbounded_after_generation"
+              exit 1
+            fi
+            before_count="$(wc -l <"$reserved_paths" | tr -d '[:space:]')"
+            if ! gh api --paginate \
+              "repos/${GITHUB_REPOSITORY}/pulls/${pull_number}/files?per_page=100" \
+              --jq '.[].filename | @base64' >>"$reserved_paths"; then
+              echo "::error::pull_request_file_inventory_unavailable_after_generation"
+              exit 1
+            fi
+            after_count="$(wc -l <"$reserved_paths" | tr -d '[:space:]')"
+            if [ $((after_count - before_count)) -ne "$expected_files" ]; then
+              echo "::error::pull_request_file_inventory_incomplete_after_generation"
+              exit 1
+            fi
+          done <<<"$open_pr_numbers"
+
+          LC_ALL=C sort -u -o "$reserved_paths" "$reserved_paths"
+          comm -12 "$proposal_paths" "$reserved_paths" >"$overlap_paths"
+          if [ -s "$overlap_paths" ]; then
+            echo "::error::open_pull_request_after_generation_path_overlap"
             exit 1
           fi
+          SCRIPT
+          chmod 0500 "$isolation_check"
+
+          "$isolation_check"
 
           if ! live_base="$(
             gh api \
@@ -894,13 +950,19 @@ jobs:
             echo "::error::created_pull_request_queue_inventory_unavailable"
             false
           fi
-          if [ "$open_pr_numbers" != "$pr_number" ]; then
+          created_pr_occurrences="$(grep -Fxc -- "$pr_number" <<<"$open_pr_numbers" || true)"
+          if [ "$created_pr_occurrences" -ne 1 ]; then
             echo "::error::created_pull_request_queue_conflict"
             false
           fi
 
+          if ! "$RUNNER_TEMP/verify-open-pr-path-isolation.sh" "$pr_number"; then
+            echo "::error::created_pull_request_queue_conflict_path_overlap"
+            false
+          fi
+
           trap - ERR
           {
-            echo "Opened bounded pull request: $pr_url"
+            echo "Opened bounded path-isolated pull request: $pr_url"
             echo "hourly-commercial-readiness owns review, repair, exact-head revalidation, and merge."
           } >>"$GITHUB_STEP_SUMMARY"

.github/workflows/patch-validator-image.yml

@@ -5,8 +5,8 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: noema-patch-validator-image-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read

.github/workflows/reviewer-ci.yml

@@ -7,8 +7,8 @@ on:
       - main
 
 concurrency:
-  group: noema-reviewer-ci-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
@@ -20,6 +20,7 @@ jobs:
     timeout-minutes: 30
     env:
       NOEMA_CODEGRAPH_SANDBOX_SOURCE_IMAGE: gcr.io/distroless/java-base-debian13:nonroot
+      PYTHONPATH: ${{ github.workspace }}/reviewer:${{ github.workspace }}/packages/noema-core/src
     defaults:
       run:
         working-directory: reviewer
@@ -50,12 +51,98 @@ jobs:
       - name: install (hash-pinned dependencies)
         run: pip install --require-hashes --no-deps -r requirements-ci-hashes.txt
 
+      - name: test noema-core (100% line+branch coverage gate)
+        working-directory: packages/noema-core
+        run: python -m pytest
+
+      - name: docstring coverage noema-core (100% gate)
+        working-directory: packages/noema-core
+        run: python -m interrogate -c pyproject.toml src/noema_core
+
       - name: test (100% line+branch coverage gate)
         run: python -m pytest
 
       - name: docstring coverage (100% gate)
         run: python -m interrogate -c pyproject.toml noema_reviewer
 
+      - name: smoke-test installed reviewer wheel and sdist-to-wheel path
+        run: |
+          set -euo pipefail
+          wheel_dir="$RUNNER_TEMP/noema-reviewer-wheel"
+          sdist_dir="$RUNNER_TEMP/noema-reviewer-sdist"
+          sdist_wheel_dir="$RUNNER_TEMP/noema-reviewer-sdist-wheel"
+          direct_venv="$RUNNER_TEMP/noema-reviewer-install-smoke"
+          sdist_venv="$RUNNER_TEMP/noema-reviewer-sdist-install-smoke"
+          mkdir -p "$wheel_dir" "$sdist_dir" "$sdist_wheel_dir"
+
+          python -m pip wheel . --no-deps --no-build-isolation --wheel-dir "$wheel_dir"
+          direct_wheel="$(find "$wheel_dir" -maxdepth 1 -type f -name 'noema_reviewer-*.whl' -print -quit)"
+          test -n "$direct_wheel"
+
+          SDIST_DIR="$sdist_dir" SDIST_NAME_FILE="$RUNNER_TEMP/noema-reviewer-sdist-name" python - <<'PY'
+          import os
+          from pathlib import Path
+          from build_backend import build_sdist
+
+          sdist_name = build_sdist(os.environ["SDIST_DIR"])
+          Path(os.environ["SDIST_NAME_FILE"]).write_text(sdist_name, encoding="utf-8")
+          PY
+          sdist="$sdist_dir/$(cat "$RUNNER_TEMP/noema-reviewer-sdist-name")"
+          test -f "$sdist"
+          python -m pip wheel "$sdist" --no-deps --no-build-isolation --wheel-dir "$sdist_wheel_dir"
+          sdist_wheel="$(find "$sdist_wheel_dir" -maxdepth 1 -type f -name 'noema_reviewer-*.whl' -print -quit)"
+          test -n "$sdist_wheel"
+
+          for contract in direct sdist; do
+            if [ "$contract" = direct ]; then
+              wheel="$direct_wheel"
+              venv_dir="$direct_venv"
+            else
+              wheel="$sdist_wheel"
+              venv_dir="$sdist_venv"
+            fi
+            python -m venv --system-site-packages "$venv_dir"
+            (
+              cd "$RUNNER_TEMP"
+              PYTHONPATH='' "$venv_dir/bin/python" -m pip install --no-deps "$wheel"
+              PYTHONPATH='' "$venv_dir/bin/python" - <<'PY'
+          import hashlib
+          import os
+          from pathlib import Path
+
+          import noema_core
+          import noema_core.agent
+          import noema_reviewer
+          from noema_reviewer.cli import parse_args
+
+          canonical_agent = Path(os.environ["GITHUB_WORKSPACE"]) / "packages" / "noema-core" / "src" / "noema_core" / "agent.py"
+          installed_agent = Path(noema_core.agent.__file__)
+          assert hashlib.sha256(installed_agent.read_bytes()).digest() == hashlib.sha256(canonical_agent.read_bytes()).digest()
+          assert noema_core.NOEMA_PERSONA
+          assert noema_reviewer.build_agent is not None
+          assert parse_args([]).repo == ""
+          PY
+            )
+          done
+
+      - name: smoke-test isolated editable reviewer with locked runtime dependencies
+        run: |
+          set -euo pipefail
+          editable_venv="$RUNNER_TEMP/noema-reviewer-editable-smoke"
+          python -m venv "$editable_venv"
+          "$editable_venv/bin/python" -m pip install --require-hashes --no-deps -r requirements-ci-hashes.txt
+          "$editable_venv/bin/python" -m pip install --no-deps -e .
+          (
+            cd "$RUNNER_TEMP"
+            PYTHONPATH='' "$editable_venv/bin/python" - <<'PY'
+          import noema_core
+          import noema_reviewer
+
+          assert noema_core.build_agent is not None
+          assert noema_reviewer.build_agent is not None
+          PY
+          )
+
       - name: install lock-pinned CodeGraph tooling for sandbox smoke test
         env:
           NPM_CONFIG_IGNORE_SCRIPTS: "true"
@@ -98,7 +185,7 @@ jobs:
           source_root="$RUNNER_TEMP/noema-codegraph-smoke"
           mkdir -p "$source_root"
           printf 'export const commercialReadiness = true;\n' >"$source_root/example.ts"
-          PYTHONPATH=. python - <<'PY'
+          python - <<'PY'
           import os
           from noema_reviewer.sandbox import DockerCodeGraphRunner
 

.gitignore

@@ -11,3 +11,4 @@ exchange-30d.ndjson
 exchange-30d.ndjson.provenance.json
 noema-kpi-evidence.json
 noema-smoke-evidence.json
+reviewer/_build_include/