fix(review): fail closed when required check is not a verdict

.github/workflows/opencode-review-dispatch.yml

@@ -179,13 +179,13 @@ jobs:
 
           if [ "$live_state" != "open" ] ||
             [ "$live_base_repository" != "$TARGET_REPOSITORY" ] ||
-            [ "$live_head_repository" != "$TARGET_REPOSITORY" ] ||
+            ! [[ "$live_head_repository" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] ||
             ! [[ "$live_base_sha" =~ ^[0-9a-fA-F]{40}$ ]] ||
             ! [[ "$live_head_sha" =~ ^[0-9a-fA-F]{40}$ ]] ||
             ! [[ "$live_is_private" =~ ^(true|false)$ ]] ||
             [ -z "$live_base_ref" ] ||
             [ -z "$live_head_ref" ]; then
-            printf '::error::PR metadata validation rejected closed, missing, cross-repository, or malformed live metadata. target=%s#%s state=%s base_repo=%s head_repo=%s base=%s head=%s\n' "$TARGET_REPOSITORY" "$PR_NUMBER" "${live_state:-<missing>}" "${live_base_repository:-<missing>}" "${live_head_repository:-<missing>}" "${live_base_sha:-<missing>}" "${live_head_sha:-<missing>}"
+            printf '::error::PR metadata validation rejected closed, missing, malformed, or target-base-mismatched live metadata. target=%s#%s state=%s base_repo=%s head_repo=%s base=%s head=%s\n' "$TARGET_REPOSITORY" "$PR_NUMBER" "${live_state:-<missing>}" "${live_base_repository:-<missing>}" "${live_head_repository:-<missing>}" "${live_base_sha:-<missing>}" "${live_head_sha:-<missing>}"
             exit 1
           fi
 
@@ -333,8 +333,44 @@ jobs:
           git -C "$fetch_dir" remote add origin "${GITHUB_SERVER_URL}/${TARGET_REPOSITORY}.git"
           if ! git -C "$fetch_dir" \
             -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \
-            fetch --no-tags --prune --no-recurse-submodules origin "$PR_BASE_SHA" "$PR_HEAD_SHA"; then
-            echo "::error::Coverage fetch could not authenticate to ${TARGET_REPOSITORY} or read base/head SHAs ${PR_BASE_SHA}/${PR_HEAD_SHA}; check token permissions, target repository access, and SHA visibility."
+            fetch --no-tags --prune --no-recurse-submodules origin "$PR_BASE_SHA"; then
+            echo "::error::Coverage fetch could not authenticate to ${TARGET_REPOSITORY} or read base SHA ${PR_BASE_SHA}; check token permissions, target repository access, and SHA visibility."
+            exit 1
+          fi
+          head_fetch_succeeded=0
+          if git -C "$fetch_dir" \
+            -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \
+            fetch --no-tags --prune --no-recurse-submodules origin "$PR_HEAD_SHA"; then
+            head_fetch_succeeded=1
+          else
+            echo "Direct head-SHA coverage fetch was unavailable; resolving the exact head through the target pull request ref."
+          fi
+          if [ "$head_fetch_succeeded" -ne 1 ]; then
+            for pr_head_fetch_attempt in 1 2 3 4 5 6; do
+              if git -C "$fetch_dir" \
+                -c http.extraheader="AUTHORIZATION: basic ${auth_header}" \
+                fetch --no-tags --prune --no-recurse-submodules origin \
+                "+refs/pull/${PR_NUMBER}/head:refs/remotes/origin/pr-${PR_NUMBER}-head"; then
+                fetched_head_sha="$(git -C "$fetch_dir" rev-parse "refs/remotes/origin/pr-${PR_NUMBER}-head")"
+                if [ "$fetched_head_sha" = "$PR_HEAD_SHA" ]; then
+                  head_fetch_succeeded=1
+                  break
+                fi
+                if [ "$pr_head_fetch_attempt" -lt 6 ]; then
+                  echo "Fetched PR head $fetched_head_sha, expected $PR_HEAD_SHA; retrying after propagation delay."
+                  sleep 10
+                else
+                  echo "Fetched PR head $fetched_head_sha, expected $PR_HEAD_SHA; no retries remain."
+                fi
+              elif [ "$pr_head_fetch_attempt" -lt 6 ]; then
+                echo "PR head ref fetch failed on attempt $pr_head_fetch_attempt; retrying after propagation delay."
+                sleep 10
+              fi
+            done
+          fi
+          if [ "$head_fetch_succeeded" -ne 1 ] ||
+            ! git -C "$fetch_dir" cat-file -e "${PR_HEAD_SHA}^{commit}"; then
+            echo "::error::Coverage fetch could not resolve exact head SHA ${PR_HEAD_SHA} from ${TARGET_REPOSITORY} or refs/pull/${PR_NUMBER}/head; check token permissions, target repository access, PR state, and SHA propagation."
             exit 1
           fi
           git -C "$fetch_dir" checkout --detach "$PR_BASE_SHA"
@@ -2146,7 +2182,7 @@ jobs:
           live_is_private="$(jq -r '.base.repo.private | tostring' <<<"$pull_request_json")"
           if [ "$live_state" != "open" ] ||
             [ "$base_repository" != "$GH_REPOSITORY" ] ||
-            [ "$head_repository" != "$GH_REPOSITORY" ] ||
+            ! [[ "$head_repository" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] ||
             [ "$live_base_ref" != "$EXPECTED_BASE_REF" ] ||
             [ "$live_base_sha" != "$EXPECTED_BASE_SHA" ] ||
             [ "$live_head_ref" != "$EXPECTED_HEAD_REF" ] ||
@@ -2158,7 +2194,7 @@ jobs:
               "$GH_REPOSITORY" "$PR_NUMBER" "${live_state:-<missing>}" "${base_repository:-<missing>}" "${live_base_ref:-<missing>}" "${live_base_sha:-<missing>}" "$EXPECTED_BASE_REF" "$EXPECTED_BASE_SHA" "${head_repository:-<missing>}" "${live_head_ref:-<missing>}" "${live_head_sha:-<missing>}" "$EXPECTED_HEAD_REF" "$EXPECTED_HEAD_SHA" "${live_is_private:-<missing>}" "${EXPECTED_IS_PRIVATE:-<missing>}"
             exit 1
           fi
-          printf 'Validated same-repository OpenCode review source for %s#%s (%s).\n' \
+          printf 'Validated current-head OpenCode review source for %s#%s (head=%s; this path is review-only for external heads).\n' \
             "$GH_REPOSITORY" "$PR_NUMBER" "$head_repository"
 
       - name: Exchange OpenCode app token for target repository review reads

.github/workflows/opencode-review.yml

@@ -20,6 +20,7 @@ concurrency:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   required-workflow-bootstrap:
@@ -53,7 +54,56 @@ jobs:
     name: opencode-review
     needs: [coverage-evidence]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - run: >-
-          echo "Review approval remains a separate current-head PR review
-          requirement produced by the authenticated dispatch workflow."
+      - name: Fail closed without a current-head OpenCode verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event.action }}" = "closed" ]; then
+            echo "PR closed; a current-head OpenCode verdict is not required."
+            exit 0
+          fi
+          if [ -z "${PR_NUMBER:-}" ] || [ -z "${HEAD_SHA:-}" ]; then
+            echo "::error::Missing PR number or head SHA; cannot verify a current-head OpenCode verdict."
+            exit 1
+          fi
+          reviews="$(gh api --paginate "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}/reviews")"
+          verdict="$(printf '%s\n' "$reviews" | jq -r -s --arg sha "$HEAD_SHA" '
+            (add // [])
+            | [
+                .[]
+                | select(
+                    (.user.login // "" | ascii_downcase) as $user
+                    | $user == "opencode-agent" or $user == "opencode-agent[bot]"
+                  )
+                | select((.commit_id // "" | ascii_downcase) == ($sha | ascii_downcase))
+              ]
+            | (last // {}) as $review
+            | ($review.body // "" | ascii_downcase) as $body
+            | if $review.state == "CHANGES_REQUESTED" then
+                "CHANGES_REQUESTED"
+              elif $review.state == "APPROVED"
+                and ($body | contains("deterministic current-head evidence") | not)
+                and ($body | contains("deterministic fallback approval") | not)
+                and ($body | contains("model-unavailable evidence fallback") | not)
+                and ($body | contains("did not emit a usable current-head control block") | not)
+                and ($body | contains("scope: `unsupported`") | not)
+                and ($body | contains("model-pool outcome: `unknown`") | not)
+              then
+                "APPROVED"
+              else
+                empty
+              end
+          ')"
+          if [ -z "$verdict" ]; then
+            echo "::error::No APPROVED or CHANGES_REQUESTED from opencode-agent on the current head. This required check is not a review and must not succeed until the authenticated dispatch posts a current-head verdict."
+            exit 1
+          fi
+          echo "Current-head OpenCode verdict: ${verdict}."

.github/workflows/pr-review-merge-scheduler.yml

@@ -246,6 +246,7 @@ jobs:
             {
               printf 'repository=%s\n' "$GITHUB_REPOSITORY"
               printf 'base_branch=%s\n' "$DEFAULT_BRANCH"
+              printf 'default_branch=%s\n' "$DEFAULT_BRANCH"
             } >>"$GITHUB_OUTPUT"
             exit 0
           fi
@@ -277,21 +278,26 @@ jobs:
           fi
 
           pull_json="$(gh api "repos/${TARGET_REPOSITORY_INPUT}/pulls/${TARGET_PR_NUMBER}")"
+          repository_json="$(gh api "repos/${TARGET_REPOSITORY_INPUT}")"
           live_number="$(jq -r '.number // 0' <<<"$pull_json")"
           live_state="$(jq -r '.state // empty' <<<"$pull_json")"
           live_base_repository="$(jq -r '.base.repo.full_name // empty' <<<"$pull_json")"
           live_head_repository="$(jq -r '.head.repo.full_name // empty' <<<"$pull_json")"
           live_base_branch="$(jq -r '.base.ref // empty' <<<"$pull_json")"
+          live_default_branch="$(jq -r '.default_branch // empty' <<<"$repository_json")"
           live_head_sha="$(jq -r '.head.sha // empty' <<<"$pull_json")"
           if [ "$live_number" != "$TARGET_PR_NUMBER" ] ||
             [ "$live_state" != "open" ] ||
             [ "$live_base_repository" != "$TARGET_REPOSITORY_INPUT" ] ||
-            [ "$live_head_repository" != "$TARGET_REPOSITORY_INPUT" ] ||
+            ! [[ "$live_head_repository" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] ||
             [ -z "$live_base_branch" ] ||
+            [ -z "$live_default_branch" ] ||
             ! [[ "$live_head_sha" =~ ^[0-9a-fA-F]{40}$ ]]; then
-            printf '::error::Targeted scheduler dispatch rejected closed, cross-repository, or malformed live PR metadata. target=%s pr=%s state=%s base_repository=%s head_repository=%s base_branch=%s head_sha=%s\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "${live_state:-<missing>}" "${live_base_repository:-<missing>}" "${live_head_repository:-<missing>}" "${live_base_branch:-<missing>}" "${live_head_sha:-<missing>}"
+            printf '::error::Targeted scheduler dispatch rejected closed, malformed, or target-base-mismatched live metadata. target=%s pr=%s state=%s base_repository=%s head_repository=%s base_branch=%s default_branch=%s head_sha=%s\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "${live_state:-<missing>}" "${live_base_repository:-<missing>}" "${live_head_repository:-<missing>}" "${live_base_branch:-<missing>}" "${live_default_branch:-<missing>}" "${live_head_sha:-<missing>}"
             exit 1
           fi
+          printf 'Validated targeted scheduler review dispatch for %s#%s (head=%s; this dispatch is review-only for external heads).\n' \
+            "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "$live_head_repository"
           if [ -n "$TARGET_BASE_BRANCH_INPUT" ] &&
             [ "$TARGET_BASE_BRANCH_INPUT" != "$live_base_branch" ]; then
             printf '::error::Targeted scheduler dispatch base branch does not match the live PR. supplied=%s live=%s\n' "$TARGET_BASE_BRANCH_INPUT" "$live_base_branch"
@@ -301,9 +307,10 @@ jobs:
           {
             printf 'repository=%s\n' "$TARGET_REPOSITORY_INPUT"
             printf 'base_branch=%s\n' "$live_base_branch"
+            printf 'default_branch=%s\n' "$live_default_branch"
             printf 'head_sha=%s\n' "$live_head_sha"
           } >>"$GITHUB_OUTPUT"
-          printf 'Validated exact targeted scheduler dispatch for %s#%s at %s on base %s.\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "$live_head_sha" "$live_base_branch"
+          printf 'Validated exact targeted scheduler dispatch for %s#%s at %s on base %s; repository default is %s.\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "$live_head_sha" "$live_base_branch" "$live_default_branch"
 
       - name: Resolve trusted scheduler source ref
         id: trusted_source
@@ -484,7 +491,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token || github.token }}
           TARGET_REPOSITORY: ${{ steps.targeted_dispatch.outputs.repository }}
-          TARGET_DEFAULT_BRANCH: ${{ steps.targeted_dispatch.outputs.base_branch }}
+          TARGET_DEFAULT_BRANCH: ${{ steps.targeted_dispatch.outputs.default_branch }}
           SCHEDULER_ACTIONS_TOKEN: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.target_repository != '' && (secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token) || github.token }}
           # Same-repository dispatch credential: when this scheduler runs inside
           # ContextualWisdomLab/.github (the repository the required workflows are

CHANGELOG.md

@@ -22,6 +22,13 @@ Semantic Versioning where the repository publishes a release.
 
 ### Changed
 
+- Noema now validates the current-head primary OpenCode approval before accepting an existing Noema verdict, preventing a secondary review from making the required gate look successful on its own.
+- Draft pull requests now receive same-head Strix and OpenCode review dispatches while remaining excluded from branch updates, auto-merge changes, direct merge, and review-state cleanup.
+- The required `opencode-review` check now fails closed unless `opencode-agent` already posted `APPROVED` or `CHANGES_REQUESTED` on the current head, so a stub success can no longer look like a review (ContextualWisdomLab/contextual-orchestrator#176).
+- The merge scheduler now spends its review-dispatch budget on pull requests with no OpenCode verdict on any commit before leftover increments that already have a previous-head APPROVED or CHANGES_REQUESTED, so one-dispatch-per-run no longer starves an empty Reviews tab.
+- The scheduler treats GitHub's full `run-name` (`OpenCode Review Dispatch owner/repo#N@sha`) as an in-progress same-head dispatch, so a later sweep cannot `cancel-in-progress` a review that already passed coverage.
+- Noema no longer exits 0 when the current head has no primary OpenCode approval, including on draft pull requests; that skip was the green `noema-review` check with an empty Reviews tab.
+- `load_codegraph_context` now confines `NOEMA_CODEGRAPH_CONTEXT_PATH` to `GITHUB_WORKSPACE` (or cwd) with `..` rejection and realpath checks, so a Strix path-traversal report on that helper cannot read files outside the review workspace.
 - Deduplicate central `workflow_run` scheduler scans: metadata-free workflow-run events now cancel an older run in a workflow-run-specific branch fallback, and the organization queue sweep retains only the newest metadata-free scheduler scan for the current default-branch HEAD while preserving push, PR-associated, and unrelated workflow runs.
 - Require the hourly repair worker to establish an exact-head root cause, enumerate the smallest remediation candidates, and prove writer authority, sealed-path scope, credentials, dependency order, verifiability, and causal effect before editing; infeasible or external blockers leave the tree unchanged while the broader loop continues with another eligible PR or buyer-visible product gap.
 - Run the bounded Quarantine Sandbox Runtime heartbeat at minute 14 without granting the caller model secrets, repository mutation permissions, approval, merge, release, artifact-execution, or final security-verdict authority.