fix(actions): align hourly quality contract with central admission (#647)

[seonghobae]

Finding

Protected main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0 already delegates recurring commercial-development cadence to the central CWL admission owner. The repository workflow is marked cwl-org-commercial-entrypoint: v1, exposes workflow_dispatch/dry_run, and intentionally has no local schedule/cron trigger. The repository quality test and operations runbook still required/described the retired minute-47 local cron, producing the exact hosted RED recorded in #647.

Repair

• keep .github/workflows/hourly-nim-product-development.yml unchanged;
• require the central-entrypoint marker plus repository-local workflow_dispatch/dry_run in the quality contract;
• explicitly refuse any repository-local schedule: or cron: trigger token;
• preserve the existing credential, queue, artifact, verification, and late-publication assertions;
• update the operations runbook so cadence and recurring disablement belong to the central CWL scheduler/admission owner;
• record the owner-boundary correction in CHANGELOG.d/central-hourly-admission-contract.md.

RED → repair evidence

Hosted RED: PR #639 Rust Foundation run 35603427225, Python quality job 106344713116, failed only because test_hourly_workflow_schedule_credentials_and_queue_gate still expected cron: "47 * * * *" after #490 centralized admission.

Source repair lineage:

• e5500207255627895146b54b3df683c6588d8a36 replaces the stale cron-positive contract with central-entrypoint + dispatch/dry-run and local schedule/cron refusal;
• 482388d525a3c59aae3ab40adfb4374f4c974076 currentizes cadence/disablement runbook ownership;
• 844b06b343e844fffd89b13af347a54f6b4ae005 records the changelog fragment;
• 0be133ae0e0a58c1a0f88a8c59df839eae971ead tightens schedule: refusal to cover YAML indentation and restores the source newline.

Foundation prerequisite RCA

Exact-head Rust Foundation run 35639598173 executed the repository/Python contract, 100% authored line/branch coverage, Live PostgreSQL, rustfmt, Clippy, 1,443 nextest tests with 0 skipped, doctests, and rustdoc successfully. Its only failing step was cargo deny check. The job log identifies RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc in rustls 0.23.43; advisories failed while bans, licenses, and sources passed. RustSec requires rustls >=0.23.45.

That dependency delta is already canonically owned by #526 and fully inherited by main-target successor #538, which pins rustls = 0.23.45. Duplicating it on this lane would create competing dependency authority. A base-only stack onto #538 was tested and GitHub reported the PR non-mergeable because #538 and this PR both legitimately modify the hourly runbook/quality contract. The base was therefore restored to protected main; no force update, destructive rebase, hand-written conflict resolution against mutable owner state, advisory suppression, or source-copy was used.

This PR stays Draft until #538 (or a verified complete successor) lands on protected main. It must then ordinary-forward reconcile the overlapping hourly contract files, rerun on the new protected base, and reacquire exact-head evidence. Current exact head remains 0be133ae0e0a58c1a0f88a8c59df839eae971ead.

Acceptance

• fix(coverage): reconcile contradictory LCOV opener counts #538 or a verified complete successor lands the rustls >=0.23.45 dependency-policy repair without suppression;
• this branch ordinary-forward reconciles the overlapping hourly contract files after that landing;
• current exact-head Python quality contract passes with its normal branch-coverage gate;
• no repository-local schedule/cron is introduced;
• exact-head security/documentation/foundation checks pass;
• qualifying independent review is required before Ready/merge;
• dependent feat(membership): add owner-issued single-membership admission #605 and fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639 remain open and reconcile/rerun only after prerequisite foundation landing.

#647 remains open until this repair has current-head GREEN, qualifying independent review, and protected-main landing; this PR does not close dependent scientific work.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh prerequisite read from #639 lane: exact 0be133ae0e0a58c1a0f88a8c59df839eae971ead Rust Foundation run 35639598173 is no longer generally queued. Repository/Python contracts + SBOM/provenance (106465395100), authored line/branch coverage (106465395401), Live PostgreSQL (106465395465), formatting, Clippy, full tests, doctests and rustdoc all executed GREEN. The only Rust Foundation failure is job 106465395548 step Enforce dependency, license, advisory, and source policy (cargo deny check). Documentation 35639598051 and Semgrep 35639598131 are GREEN; Security 35639598143 and CodeQL 35639598065 remain non-terminal. #648 changes no Cargo dependency/lock/policy file, so this read does not attribute the cargo-deny failure to the cron-contract delta or weaken the gate; exact cargo-deny diagnostic still needs canonical owner RCA before promotion. Dependent #605/#639 remain Draft.