fix(automation): run immutable review repair every hour

[seonghobae]

Problem

The central merge scheduler revisits merge readiness every 15–30 minutes, but review-feedback repair still waits too long before retrying the same exact head. Review-addressable pull requests can remain idle long after feedback is available.

The reusable workflow must also execute its own immutable called-workflow implementation rather than allowing caller context, a mutable branch, or a compatibility input to select privileged scheduler code.

Change

• run the bounded review-fix scheduler every hour at minute 23;
• reduce the same-head retry floor to one hour;
• bind privileged source checkout to job.workflow_repository and job.workflow_sha;
• retain the deprecated canonical_ref input only as ignored compatibility surface;
• retain one-dispatch-per-run, repository-scoped single flight, current-head validation, bounded payloads, least-privilege permissions, and fail-closed repair behavior;
• pin cadence, retry bounds, source identity, permissions, and dispatch limits with permanent contract tests.

Safety

The scheduler does not approve or merge code and does not weaken repository protections. It only dispatches the existing bounded repair workflow. Exact-current-head checks, independent approval, branch protection, and the separate merge scheduler remain authoritative.

Verification contract

• exact cron and one-hour retry default;
• immutable called-workflow source identity;
• caller SHA, mutable ref, payload, and deprecated input cannot select trusted code;
• one dispatch maximum per invocation;
• full central tests, 100% changed-code coverage/docstrings, workflow syntax, Ruff/compile, security gates, and independent review before merge.

Supersession

This clean review entry supersedes #745. The source tree is identical, but every exact-head security run on #745 was cancelled before yielding merge evidence. This replacement retriggers the same three-file implementation through the normal protected current-head path.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b548c250-ae79-40bb-b711-a49c8f1c97ea

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 5446057.

📒 Files selected for processing (3)

• .github/workflows/pr-review-fix-scheduler.yml
• tests/test_pr_review_fix_hourly_contract.py
• tests/test_pr_review_fix_scheduler_source_pin.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as a duplicate after discovering that #745 had already merged the complete scheduler change into the protected baseline branch at 69fc4d29cdf88c33933aec90d784300b9e162bc2. Central #731 now owns exact-head verification and the single default-branch merge for the hourly cadence, immutable source binding, one-hour retry floor, and bounded dispatch policy.