[Fleet incident] Remove credential-first and broad secret inheritance from hourly loop

[seonghobae]

Fleet automation incident

Protected main currently exposes two reviewable automation defects in .github/workflows/hourly-commercialization-loop.yml.

1. Product-development eligibility checks NVIDIA before the deterministic PR queue

develop-next-product-gap rejects the run for missing NVIDIA_NIM_API_KEY before it checks whether an open pull request already owns the queue. Deterministic queue/no-op decisions must work without model credentials.

Required ordering:

open-PR / deterministic product gates / dry-run -> NVIDIA credential -> actual NVIDIA-backed OpenCode path

Do not remove the NVIDIA credential from actual inference. Move it to the boundary where inference can genuinely begin.

2. Reusable governance jobs forward all repository/organization secrets

inspect-pr-queue, repair-review-feedback, and revalidate-pr-queue use secrets: inherit when calling the central .github reusable schedulers. This forwards unrelated repository/organization secrets to shared governance jobs and makes the caller dependent on ambient secret inventory. Replace broad inheritance with no secret forwarding where the central workflow's GitHub/OIDC authority is sufficient, or with the minimum explicit named secret mapping if live central contract evidence proves one is genuinely required. Do not invent a new PAT or rename an existing secret to preserve ambient access.

Also re-pin caller SHAs to the exact accepted central protected-main implementation after central prerequisites settle; do not assume historical reusable-workflow SHAs remain the supported contract.

Acceptance criteria

• RED→GREEN contract proving open-PR and other deterministic no-op gates execute and terminate before model credential validation;
• dry-run remains credential-independent;
• no secrets: inherit on central review/fix/merge calls unless a documented, tested, minimum explicit mapping is proven necessary;
• no COPILOT_GITHUB_TOKEN, guessed PAT, self-modifying repair workflow, or weakened protection/check policy;
• exact-head CI/security/review evidence;
• normal protected-main merge;
• real protected-main scheduled/manual loop run verifies PR maintenance, review-fix and revalidation actually execute downstream, and product development either stops for the correct deterministic reason or reaches the supported NVIDIA boundary.

This is part of the organization-wide GitHub Actions fleet incident. Re-fetch exact current central and RankWeave heads before implementation; no identities in this issue are permanent evidence.

[seonghobae]

Fresh RCA and owner-path checkpoint — 2026-08-12

Live protected-main scheduled run 31586922777 still fails before GitHub creates any jobs. The current caller pins the review-repair reusable workflow to central commit 21397126d708d2d536ccc1d68b0d333653ce9315; GitHub cannot resolve that caller/callee graph, so this is a workflow-startup contract failure rather than a model, secret, or repository test failure.

PR #36 is the current normal-policy repair candidate at exact head d6600113abeed42a7a782053f4837b1bedd9701b. Its branch:

• removes broad secrets: inherit from the central scheduler calls;
• preserves reachable immutable merge/revalidation calls;
• substitutes a read-only fail-closed repair hold for the unreachable central repair call;
• moves the deterministic open-PR gate ahead of the NVIDIA-backed development path;
• introduces no PAT, COPILOT_GITHUB_TOKEN, or reviewer credential change.

The branch's current formal CHANGES_REQUESTED review does not identify a RankWeave coverage defect. Central OpenCode run 31300875609, job 93213339754, failed before pull-request-controlled tests with trusted uv archive download failed: HTTPError. That central recurrence is tracked by ContextualWisdomLab/.github#786 and its owner repair PR #790. RankWeave must not duplicate or weaken the central bootstrap.

Realistic action sequence

1. central owner integrates #790 through protected-main policy;
2. rerun the exact-current-head fix(ci): restore executable hourly governance #36 OpenCode coverage/review dispatch so infrastructure-derived review evidence is superseded;
3. process any real current-head findings and obtain qualifying independent approval;
4. merge fix(ci): restore executable hourly governance #36 normally;
5. require a protected-main scheduled/manual Hourly RankWeave Commercialization Loop run to create jobs, execute the reachable merge/revalidation path and read-only repair hold, and stop product development for the correct open-PR reason or reach the supported NVIDIA boundary when the queue is empty.

Issue #37 remains open until that operational evidence exists.