fix(automation): bind commercial writer toolchain

[seonghobae]

Purpose

Test-first repair for #149. The trusted commercial writer now runs under the exact reviewed Node/npm/install contract, preserves narrow Maintainer App authority, and fails closed when the no-PR commercial-readiness evidence bundle expected by downstream diligence is not retained.

Exact current lineage

• protected/live base: c85d710804139c0697d7ef8fa47d02b1389e6d84
• branch: fix/commercial-writer-exact-toolchain
• original toolchain/test-contract GREEN: 64f5c4a011add011d7cfe2c5dd9896c5ed8cec2a
• retained-evidence contract commit: a060018610d888fb8c214782075dd39e08d9c7e3
• exact current GREEN: aa10ed6664720907eb7fd319ab7296361f6697b3
• changed files: .github/workflows/hourly-commercial-readiness.yml, test/hourly-commercial-readiness-toolchain-integrity.test.ts

RCA -> remedies -> feasibility -> action

The workflow originally evaluated governance and write-capable automation under a broad Node/ambient npm contract. The repair pins the reviewed setup-node revision, Node 24.19.0, verifies npm 11.17.0, uses frozen install flags, preserves non-persistent checkout credentials, exact Maintainer App permissions, and limits the App-token GH_TOKEN consumers to the governance audit and exact-head PR loop. The valid predecessor CodeRabbit test-contract finding is addressed and its thread is resolved/outdated.

A later fresh audit found a separate retained-evidence boundary. Main-governance and loop-report uploads already used if-no-files-found: error, but the no-open-PR evidence bundle used if-no-files-found: warn. When the queue is empty, that branch intentionally refreshes saleable-readiness and acquisition evidence; workflow success could therefore coexist with no retained no-PR buyer-evidence artifact. Warning-only telemetry, an explicit pre-upload existence check, and native upload fail-closed behavior were considered. if-no-files-found: error is the narrowest supported remedy and does not broaden workflow authority.

Contract commit a060018610d888fb8c214782075dd39e08d9c7e3 requires fail-closed no-PR retention. Exact current GREEN aa10ed6664720907eb7fd319ab7296361f6697b3 changes the corresponding upload policy from warn to error while preserving artifact paths, retention and queue-empty semantics.

Exact current proof

For unchanged head aa10ed6664720907eb7fd319ab7296361f6697b3 against live base c85d710804139c0697d7ef8fa47d02b1389e6d84:

• application ci run 31472615425: terminal success;
• reviewer-ci run 31472615362: terminal success;
• eligible central Security Scan run 31472615351: terminal success;
• current inline review finding is resolved/outdated;
• visible formal review remains CodeRabbit COMMENTED on a predecessor, not a qualifying independent APPROVED review;
• GitHub reports Ready and mergeable.

Remaining integration

• Use exact protected-CI setup-node revision, Node 24.19.0, npm 11.17.0, and frozen install flags.
• Preserve checkout credential isolation and bounded Maintainer App permissions.
• Keep governance audit, exact-head PR loop and report-only evidence refresh semantics unchanged.
• Fail closed if the no-PR commercial-readiness evidence bundle is not retained.
• Resolve the valid predecessor review finding and reacquire exact-head application/reviewer/security gates.
• Obtain actual live chore(governance): protect main and enforce release checks #27 governance plus qualifying independent non-author formal approval required by chore(operations): provision and activate hourly maintainer App #29 where applicable.
• Merge only an unchanged exact head after all applicable gates remain satisfied.
• Re-run the commercial writer toolchain/authority/evidence-retention contract from protected main after integration.

Technical GREEN does not establish approval, merge, release, deployment, real production KPI, outbound rights, revenue/transfer evidence or acquisition readiness.

Related: #149, #27, #29, #96, #105, #109

[coderabbitai]

📝 Walkthrough

Walkthrough

시간별 상업 준비성 워크플로가 Node.js 24.19.0과 npm 11.17.0을 사용하도록 고정되었습니다. 엄격한 npm ci 옵션과 도구체인 무결성 테스트가 추가되었습니다.

Changes

상업 준비성 도구체인

Layer / File(s)	Summary
고정 도구체인 및 무결성 검증 .github/workflows/hourly-commercial-readiness.yml, test/hourly-commercial-readiness-toolchain-integrity.test.ts	워크플로가 Node.js 24.19.0과 npm 11.17.0을 검증합니다. npm ci --legacy-peer-deps=false --install-links=false를 사용합니다. 테스트는 버전 고정, 설치 옵션, 토큰 발급 순서, 자격 증명 격리와 토큰 권한 경계를 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• ContextualWisdomLab/noema 이슈 149: 동일한 워크플로에서 Node/npm 고정과 엄격한 npm ci 요구사항을 다룹니다.
• ContextualWisdomLab/noema 이슈 153: Node.js 24.19.0 고정과 관련되지만 대상 워크플로는 다릅니다.

Possibly related PRs

• ContextualWisdomLab/noema#62: 동일한 상업 준비성 워크플로 영역에서 Node/npm 고정, 엄격한 의존성 설치, 자격 증명 순서 검증을 다룹니다.
• ContextualWisdomLab/noema#64: 시간별 GitHub Actions 자동화와 고정된 Node/npm 도구체인 및 보안 제어를 함께 수정합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 상업용 작성기 자동화의 도구체인 고정이라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/commercial-writer-exact-toolchain

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/hourly-commercial-readiness-toolchain-integrity.test.ts`:
- Around line 10-21: Update the test uses exact protected-CI Node/npm execution
contract to validate individual workflow step blocks rather than relying on
whole-YAML string matches. Assert unique step names and verify the setup-node
version, Node/npm versions, ordering, and npm ci flags within their actual
steps; also validate the exact permissions for the maintainer_app step and
restrict GH_TOKEN usage to the expected governance-audit and PR-loop steps.
Preserve token confidentiality and the existing protocol/security contracts.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3e988f3a-9b89-4257-88e0-1a4ce51a27e6

📥 Commits

Reviewing files that changed from the base of the PR and between c85d710 and 0f83023.

📒 Files selected for processing (2)

• .github/workflows/hourly-commercial-readiness.yml
• test/hourly-commercial-readiness-toolchain-integrity.test.ts

[seonghobae]

Superseded by current-main successor #216, now merged as protected main 2b3eee922efaa7ae2f11040b1a82a2ce305b75c6.

Fresh exact-byte preservation proof before closure:

• protected-main .github/workflows/hourly-commercial-readiness.yml blob: fd86cf78afd66f38ee3c08ff23737cc6aab674ac;
• fix(automation): bind commercial writer toolchain #150 head aa10ed6664720907eb7fd319ab7296361f6697b3 workflow blob: the same fd86cf78afd66f38ee3c08ff23737cc6aab674ac;
• protected-main test/hourly-commercial-readiness-toolchain-integrity.test.ts blob: e648bd6c6cbd5e70578eb3325e27af333df03fd1;
• fix(automation): bind commercial writer toolchain #150 head test blob: the same e648bd6c6cbd5e70578eb3325e27af333df03fd1.

#216 reacquired current-base test-first RED/GREEN plus exact-head application CI, reviewer-ci and protected-base Security Scan before merge. #150 predecessor checks/reviews are not transferred. Its unique two-file semantic work is now protected-main truth, so this historical line can close without data loss.