fix(compile): enforce documented hourly cron floor

docs/dream-cycle/LEDGER.md

@@ -1,3 +1,8 @@
 | Date | Deep | Finding | Issue | PR | Evaluated? | Verdict | Effect | Witness | Prior-night fates |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | 2026-08-13 | security-adversarial | redblue evaluator entrypoint silently no-ops (npx bin-symlink isMain footgun); added classifyEntrypointResult + verify-entrypoint | #6 | #7 | yes | ACCEPT | npm test 85->96, 0 regressions | ec2052aa | first real night (demo seed rows removed 2026-08-13; see #6) |
+| 2026-08-22 | portfolio 308; dream-machine; metaharness | enforce hourly cron floor; separate security finding retained for private advisory | redacted #219 | #24 | partial | ACCEPT / INCONCLUSIVE | CI + CodeQL green; prevents up to 60x schedule amplification; private finding awaits maintainer triage | db6f18cb | existing draft #24 repaired after CI caught missing constant; public security stub redacted and closed |
+| 2026-08-23 | portfolio 309; RuView; RuVector; openAVO; ruv-drone; Group-Field-Theory | rotate into five changed repositories; openAVO license artifact absent; separate security gate retained for private triage | openAVO#1; reuse RuVector#908 | #24 | partial | INCONCLUSIVE | 60 recent commits across 8 repositories; Group-Field-Theory records 98.1% lower deterministic work; RuVector default-branch security and lint gates need remediation | RuVector c7b5e4ef; openAVO e099ec87; GFT a0d5a78f | #24 remained draft and green; prior private finding still awaits maintainer triage |
+| 2026-08-24 | portfolio 310; one private infrastructure aggregate; metaharness; open-claude-code; rvm; rufield | coordinate federation evidence gates; reuse execution-control and RVF findings; record RVM CI provenance debt and RuField BLE contract evidence | reuse open-claude-code#17, metaharness#22/#172/#222; rvm#52 | rufield#5; dream-machine#24 | partial | ACCEPT / INCONCLUSIVE | 58 recent commits across 6 repositories; RVM ruv:// parse 17.6-24.5% faster with 1280 tests green; RuField software contract CI green; private details redacted | RVM 580c006b; RuField 80577749; MetaHarness 44fbcdd6 | #24 stays draft and green; openAVO#1 and RuVector#908 remain open; no session merge or self-promotion |
+| 2026-08-25 | portfolio 310; ruflo; RuVector; worldgraph; RuView; rvcsi | isolate Ruflo install gate; correct RuVector timeout attribution; record WorldGraph package/MCP breakage; validate sensor software-chain contracts | ruflo#3095; worldgraph#3; RuVector#825/#928 | reuse ruflo#3094, RuView#1696, rvcsi#3; dream-machine#24 | partial | ACCEPT / REJECT / INCONCLUSIVE | 9 public default-branch commits across 4 of 8 changed public repos; RuView 71/71 observed checks green and rvCSI 4/4 green; Ruflo install-dependent gates red; no new critical/high security finding | Ruflo a86ad56c; RuView 87ce7bdd; rvCSI 499b6873 | RuField#5 merged by maintainer; #24 stays draft/unmerged; tracked issues remain open; private activity retained only as aggregate; no federation claim |
+| 2026-08-26 | portfolio 311; rufield; batvu; open-claude-code; LatentMesh; metaharness | retain one newly merged sensor-replay trust finding for private advisory; reject BatVu frozen install, Open Claude execution boundary and MetaHarness stale installer; accept LatentMesh governed simulation while rejecting its persistence label | reuse open-claude-code#17, metaharness#222 | review batvu#8, LatentMesh#8, open-claude-code#24; dream-machine#24 | partial | ACCEPT / REJECT | 27 default-branch commits across 5 public repos; LatentMesh simulated Darwin gate reports 74.2% compute-proxy reduction with task success preserved; BatVu CI stops at npm ci; private activity 0 repos/0 commits | RuField 99556728; BatVu 1302ec02; LatentMesh 4214d51d | #24 stayed draft/green before ledger update; Ruflo#3095, WorldGraph#3 and RuVector#928 remain open; no public disclosure, new implementation PR, direct push, merge, or federation claim |

packages/compile/src/config.ts

@@ -68,6 +68,7 @@ export interface ValidationResult {
 }
 
 const CRON_RE = /^(\S+\s+){4}\S+$/;
+const FIXED_MINUTE_RE = /^(?:[0-9]|[1-5][0-9])$/;
 
 /** Validate a dream.config, returning structured errors (never throws). */
 export function validateConfig(config: Partial<DreamConfig>): ValidationResult {
@@ -77,8 +78,13 @@ export function validateConfig(config: Partial<DreamConfig>): ValidationResult {
   if (!config.repo || !/^[\w.-]+\/[\w.-]+$/.test(config.repo)) {
     errors.push('repo must be "owner/name"');
   }
-  if (!config.cron || !CRON_RE.test(config.cron.trim())) {
+  if (typeof config.cron !== 'string' || !CRON_RE.test(config.cron.trim())) {
     errors.push('cron must be a 5-field expression');
+  } else {
+    const [minute] = config.cron.trim().split(/\s+/);
+    if (!FIXED_MINUTE_RE.test(minute)) {
+      errors.push('cron minute field must be a single value from 0 to 59; minimum interval is 1 hour');
+    }
   }
   if (!config.slots || config.slots.length === 0) {
     errors.push('at least one rotation slot is required');

packages/compile/src/index.test.ts

@@ -29,6 +29,16 @@ describe('validateConfig', () => {
   it('rejects a bad cron', () => {
     expect(validateConfig({ ...metaharness, cron: 'nightly' }).ok).toBe(false);
   });
+  it('rejects schedules more frequent than hourly', () => {
+    for (const cron of ['* * * * *', '*/5 * * * *', '0,30 * * * *', '60 * * * *']) {
+      const result = validateConfig({ ...metaharness, cron });
+      expect(result.ok).toBe(false);
+      expect(result.errors.join()).toMatch(/minimum interval is 1 hour/);
+    }
+  });
+  it('accepts a fixed minute with an hourly or slower cadence', () => {
+    expect(validateConfig({ ...metaharness, cron: '15 */2 * * *' }).ok).toBe(true);
+  });
   it('rejects empty slots', () => {
     const r = validateConfig({ ...metaharness, slots: [] });
     expect(r.ok).toBe(false);