fix: protect security contract files from autofix deletion (replacement)

[seonghobae]

Replacement for #1328

This PR supersedes the closed/replaced review path while preserving the current exact-head security fix.

Root cause

The central PR autofix validated changed-file allowlists but did not prevent deletion or rename of protected origin-integrity validators, regression tests, and the standards record. Review automation could therefore remove security contracts during an unrelated optimization.

Change

• Reject deletion/rename of protected security-contract paths after autofix edits, using git diff HEAD so staged and unstaged changes are covered.
• Keep the trusted Strix contract on the canonical direct OpenAI gpt-5.4 fallback.
• Align all Strix quick-gate assertions with the current protected-main OpenCode fallback sequence.

Verification

• bash -n scripts/ci/strix_required_workflow_smoke.sh
• bash scripts/ci/strix_required_workflow_smoke.sh (passed)
• git diff --check (passed)
• Hosted exact-head checks and independent review must re-run for this replacement PR.

No secrets, force-push, or merge bypass.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 24 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5dd8ac16-8a52-462b-b526-3b86c772bf7f

📥 Commits

Reviewing files that changed from the base of the PR and between d2c554d and f8a7210.

📒 Files selected for processing (3)

• .github/workflows/pr-review-autofix.yml
• tests/test_opencode_agent_contract.py
• tests/test_pr_review_conflict_scope.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Replacement PR current-head evidence: a27b6ed9015eab8799122a117000a5319132f47c on base d2c554dbbc04854db6215970fabb70cef1ceb690. Local bash -n scripts/ci/strix_required_workflow_smoke.sh, bash scripts/ci/strix_required_workflow_smoke.sh, and git diff --check pass. The replacement is based on current protected main; hosted Checks and an independent qualifying approval remain required.

[seonghobae]

Fixed on exact new head f8a72106b887230ec12a95ff68947a0e00837b58: conflict-mode now repeats the protected security-contract deletion/rename guard immediately before staging, after OpenCode conflict edits. Local targeted contract tests (test_autofix_worker_resolves_merge_conflicts_fail_closed, test_workflow_snapshots_after_merge_and_verifies_before_staging) pass; Ruff and diff checks pass. Re-review and hosted Checks are required for this new head.

[seonghobae]

Exact-current-head verification for f8a72106b887230ec12a95ff68947a0e00837b58:

• The actionable conflict-mode bypass is repaired after conflict resolution and before staging/push; ordinary autofix retains its independent pre-commit guard.
• Both contract boundaries now assert git diff HEAD --name-status and protected-path delete/rename rejection.
• Hosted run 32843047932 / job 97786569132 checked out the exact head and completed 1418 passed, 1 skipped, 16 subtests passed.
• Current review threads are resolved. Pending/queued security, CodeQL, SBOM, Strix, and formal review evidence remain non-passing; no merge is claimed.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

@opencode-agent review

Please publish an independent substantive formal Reviews API verdict for exact current head f8a72106b887230ec12a95ff68947a0e00837b58 against protected main@d2c554dbbc04854db6215970fabb70cef1ceb690. All substantive commit-associated workflows are terminal-success, the hosted exact-head suite passed 1,418 tests plus 16 subtests, and unresolved review threads are 0.

Review the post-conflict/pre-staging protected-path deletion/rename guard, its git diff HEAD --name-status coverage of staged and unstaged changes, and the intended fail-closed handling of protected files deleted by the base. Bind the verdict only to this SHA through the formal review surface. Review-only: do not mutate or merge the branch.