fix(automation): run hourly NVIDIA NIM review repair

.github/workflows/codeql-pr.yml

@@ -90,13 +90,13 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}"
           upload: false
@@ -197,13 +197,13 @@ jobs:
           ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{ matrix.language }}-merge"
           upload: false

.github/workflows/hourly-nvidia-nim-review-repair.yml

@@ -0,0 +1,66 @@
+name: Hourly NVIDIA NIM Review Repair
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/pr-review-fix-scheduler.yml
+      - .github/workflows/pr-review-autofix.yml
+      - .github/workflows/hourly-nvidia-nim-review-repair.yml
+      - tests/test_pr_review_fix_hourly_contract.py
+      - tests/test_pr_review_fix_scheduler_source_pin.py
+      - tests/test_pr_review_autofix_nvidia_nim_contract.py
+      - docs/automation/hourly-review-repair.md
+      - docs/doctoring/hourly-nvidia-nim-autofix.md
+  push:
+    paths:
+      - .github/workflows/pr-review-fix-scheduler.yml
+      - .github/workflows/pr-review-autofix.yml
+      - .github/workflows/hourly-nvidia-nim-review-repair.yml
+      - tests/test_pr_review_fix_hourly_contract.py
+      - tests/test_pr_review_fix_scheduler_source_pin.py
+      - tests/test_pr_review_autofix_nvidia_nim_contract.py
+      - docs/automation/hourly-review-repair.md
+      - docs/doctoring/hourly-nvidia-nim-autofix.md
+
+permissions:
+  contents: read
+
+concurrency:
+  group: hourly-nvidia-nim-review-repair-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    name: Hourly cadence, immutable source, and NIM credential boundary
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install hash-locked test tooling
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+      - name: Verify hourly scheduler and NVIDIA NIM autofix contracts
+        run: |
+          set -euo pipefail
+          python -m pytest -q \
+            tests/test_pr_review_fix_hourly_contract.py \
+            tests/test_pr_review_fix_scheduler_source_pin.py \
+            tests/test_pr_review_autofix_nvidia_nim_contract.py
+          python -m compileall -q \
+            tests/test_pr_review_fix_hourly_contract.py \
+            tests/test_pr_review_fix_scheduler_source_pin.py \
+            tests/test_pr_review_autofix_nvidia_nim_contract.py
+          git diff --check

.github/workflows/opencode-coverage-diagnostics-ci.yml

@@ -0,0 +1,172 @@
+name: OpenCode Coverage Diagnostics CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "scripts/ci/coverage_failure_summary.py"
+      - "scripts/ci/materialize_base_javascript_packages.py"
+      - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/sanitize_github_output_summary.py"
+      - "tests/test_materialize_base_javascript_packages.py"
+      - "tests/test_materialize_base_python_requirements.py"
+      - "tests/test_coverage_materializer_failure_diagnostics.py"
+      - "tests/test_sanitize_github_output_summary.py"
+      - "tests/test_strix_dependency_security_floor.py"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-strix-ci.txt"
+      - "requirements-strix-ci-hashes.txt"
+      - "pyproject.toml"
+      - ".github/workflows/opencode-coverage-diagnostics-ci.yml"
+  push:
+    branches: [main]
+    paths:
+      - "scripts/ci/coverage_failure_summary.py"
+      - "scripts/ci/materialize_base_javascript_packages.py"
+      - "scripts/ci/materialize_base_python_requirements.py"
+      - "scripts/ci/sanitize_github_output_summary.py"
+      - "tests/test_materialize_base_javascript_packages.py"
+      - "tests/test_materialize_base_python_requirements.py"
+      - "tests/test_coverage_materializer_failure_diagnostics.py"
+      - "tests/test_sanitize_github_output_summary.py"
+      - "tests/test_strix_dependency_security_floor.py"
+      - "requirements-opencode-review-ci-hashes.txt"
+      - "requirements-strix-ci.txt"
+      - "requirements-strix-ci-hashes.txt"
+      - "pyproject.toml"
+      - ".github/workflows/opencode-coverage-diagnostics-ci.yml"
+
+concurrency:
+  group: opencode-coverage-diagnostics-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  minimum-python-contract:
+    name: Python 3.10 runtime contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Set up minimum supported Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Compile production modules on Python 3.10
+        run: |
+          python -m compileall -q \
+            scripts/ci/coverage_failure_summary.py \
+            scripts/ci/materialize_base_javascript_packages.py \
+            scripts/ci/materialize_base_python_requirements.py \
+            scripts/ci/sanitize_github_output_summary.py
+
+      - name: Exercise exact failure evidence on Python 3.10
+        run: |
+          python - <<'PY'
+          import os
+          import pathlib
+          import tempfile
+
+          from scripts.ci import materialize_base_javascript_packages as javascript_materializer
+          from scripts.ci import materialize_base_python_requirements as python_materializer
+
+          with tempfile.TemporaryDirectory() as directory:
+              output = pathlib.Path(directory) / "github-output"
+              os.environ["GITHUB_OUTPUT"] = str(output)
+              exact_reason = (
+                  "current-head npm lock package-lock.json package "
+                  "apps/desktop/node_modules/@types/react-dom must pin a registry "
+                  "tarball and SHA-512 integrity"
+              )
+              javascript_materializer._publish_coverage_failure_summary(
+                  "Base JavaScript package lock materialization",
+                  ValueError(exact_reason),
+                  "Repair the lock and rerun coverage-evidence.",
+              )
+              python_materializer._publish_coverage_failure_summary(
+                  "Base Python lock materialization",
+                  OSError("fixture <unsafe>\nCWL_COVERAGE_SUMMARY_EOF"),
+                  "Repair the trusted lock and rerun coverage-evidence.",
+              )
+              published = output.read_text(encoding="utf-8")
+              assert f"ValueError: {exact_reason}" in published
+              assert "OSError: fixture &lt;unsafe&gt; CWL_COVERAGE_SUMMARY_END" in published
+              assert published.count("coverage_summary<<CWL_COVERAGE_SUMMARY_EOF") == 2
+          PY
+
+  full-quality-gate:
+    name: Python 3.14 full quality gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Set up current stable Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install hash-locked test tooling
+        run: >-
+          python -m pip install --disable-pip-version-check --require-hashes
+          -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Run diagnostics and lock contracts with full branch coverage
+        run: |
+          python -m pytest \
+            tests/test_materialize_base_javascript_packages.py \
+            tests/test_materialize_base_python_requirements.py \
+            tests/test_coverage_materializer_failure_diagnostics.py \
+            tests/test_sanitize_github_output_summary.py \
+            tests/test_strix_dependency_security_floor.py \
+            --cov=scripts.ci.coverage_failure_summary \
+            --cov=scripts.ci.materialize_base_javascript_packages \
+            --cov=scripts.ci.materialize_base_python_requirements \
+            --cov=scripts.ci.sanitize_github_output_summary \
+            --cov-branch \
+            --cov-fail-under=100 \
+            -q
+
+      - name: Enforce complete production docstrings
+        run: |
+          python -m interrogate \
+            --fail-under 100 \
+            scripts/ci/coverage_failure_summary.py \
+            scripts/ci/materialize_base_javascript_packages.py \
+            scripts/ci/materialize_base_python_requirements.py \
+            scripts/ci/sanitize_github_output_summary.py
+
+      - name: Compile changed Python surfaces
+        run: |
+          python -m compileall -q \
+            scripts/ci/coverage_failure_summary.py \
+            scripts/ci/materialize_base_javascript_packages.py \
+            scripts/ci/materialize_base_python_requirements.py \
+            scripts/ci/sanitize_github_output_summary.py \
+            tests/test_coverage_materializer_failure_diagnostics.py \
+            tests/test_sanitize_github_output_summary.py \
+            tests/test_strix_dependency_security_floor.py

.github/workflows/opencode-review-dispatch.yml

@@ -652,11 +652,15 @@ jobs:
               r-base \
               r-cran-covr \
               r-cran-testthat \
+              llvm-19 \
               rustc \
               util-linux \
               vulkan-tools \
               xz-utils \
             && rm -rf /var/lib/apt/lists/*
+          ENV LLVM_COV=/usr/bin/llvm-cov-19
+          ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19
+          RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"
           RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \
               https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz \
             && echo '55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742  /tmp/node-linux-x64.tar.xz' | sha256sum -c - \