Automate R-parity check and fix with guardrailed agent

[OVVO-Financial]

Adds the "fix if required" half of the fidelity chain. Detection already
exists (inspect-r-api-update.yml); this adds live-R verification plus a
guardrailed, human-reviewed automated fix.

NNS R API change
  -> inspect-r-api-update.yml          (plan + cache gates + inspection PR)
       -> dispatch nns-parity-divergence
            -> parity-autofix.yml      (live-R verify -> fix or escalate -> PR)
                 -> human review + merge

What's added

• .github/workflows/parity-autofix.yml — sets up Python + live R at the
  recorded R commit, reproduces the divergence with the existing
  run_live_r_parity_for_changed_api.py, and only when behavior genuinely
  drifted invokes anthropics/claude-code-action to draft a fix.
• inspect-r-api-update.yml — chains to the autofix via an
  nns-parity-divergence repository_dispatch (gated on the optional
  PARITY_DISPATCH_TOKEN; prints the manual trigger otherwise).
• docs/parity_autofix.md — setup + policy.

Guardrails (enforced in the gate + agent prompt)

• Agent edits src/nns/** only; never extern/NNS-core/**, tools/NNS/**,
  or tests/_r_cache.json.
• Root-cause classification: Python port bug → fix; R behavior change or
  native change → escalate (native code enters only via NNS-core).
• Verifies against live R, not the cache. If live R can't be installed in CI,
  it opens an escalation PR instead of guessing.
• Human-merge only — the workflow never merges; every fix PR is reviewed and
  must contain the function, args, R output, Python output, first divergent
  intermediate, affected files, and proposed fix.

Setup required before it can run (see docs/parity_autofix.md)

Secret	Purpose	Required?
ANTHROPIC_API_KEY	the agent's credentials (via /install-github-app or Settings → Secrets)	yes
PARITY_APP_TOKEN	open the fix PR with a token that triggers native-backend-ci	recommended
PARITY_DISPATCH_TOKEN	auto-chain inspect → autofix (default GITHUB_TOKEN can't emit repository_dispatch)	optional

Model defaults to claude-sonnet-4-6, overridable via the workflow_dispatch
model input (e.g. claude-opus-4-8 for harder divergences).

Validation

All four workflow YAMLs parse; git diff --check clean; ruff check . passes
(no Python/package changes). Note: live-R-in-CI depends on the runner installing
the vendored NNS R dependencies (r-lib/actions/setup-r-dependencies against
tools/NNS, best-effort) — if that fails the workflow escalates rather than
producing an unverified fix.

This PR is automation only; it does not change runtime/package behavior.

https://claude.ai/code/session_017KnASettwNxUdYJzchRLux

---

Generated by Claude Code