fix: keep cross-repo OpenCode evidence healthy

.github/workflows/opencode-review-dispatch.yml

@@ -7851,8 +7851,35 @@ jobs:
             exit 1
           fi
           if [ "${GH_REPOSITORY:-}" != "${GITHUB_REPOSITORY:-}" ] &&
-            [ "${OPENCODE_STATUS_TOKEN_SOURCE:-}" = "github-token" ]; then
-            echo "::notice::OpenCode repository_dispatch status publication is unavailable because only the same-repository github.token can access cross-repository target ${GH_REPOSITORY}. The exact-head formal review remains authoritative; configure PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN to publish the optional commit status."
+            { [ "${OPENCODE_STATUS_TOKEN_SOURCE:-}" = "github-token" ] ||
+              [ "${OPENCODE_STATUS_TOKEN_SOURCE:-}" = "opencode-app" ]; }; then
+            formal_review_file="$(mktemp)"
+            cleanup_formal_review_evidence() {
+              rm -f "$formal_review_file"
+            }
+            trap cleanup_formal_review_evidence EXIT
+            if ! gh api "repos/${GH_REPOSITORY}/pulls/${PR_NUMBER}/reviews" --paginate --slurp |
+              jq 'flatten' >"$formal_review_file"; then
+              echo "::error::OpenCode repository_dispatch status publication could not prove an exact-head formal OpenCode review before skipping unavailable cross-repository commit-status publication."
+              exit 1
+            fi
+            if ! jq -e --arg head "$PR_HEAD_SHA" '
+              any(.[];
+                (.commit_id // "") == $head
+                and (
+                  (.user.login // "") == "opencode-agent[bot]"
+                  or (.user.login // "") == "opencode-agent"
+                )
+                and (
+                  ((.state // "") | ascii_upcase) == "APPROVED"
+                  or ((.state // "") | ascii_upcase) == "CHANGES_REQUESTED"
+                )
+              )
+            ' "$formal_review_file" >/dev/null; then
+              echo "::error::OpenCode repository_dispatch status publication could not prove an exact-head formal OpenCode review; refusing to hide a cross-repository review-evidence gap."
+              exit 1
+            fi
+            echo "::notice::OpenCode repository_dispatch status publication is unavailable because only the same-repository github.token can access cross-repository target ${GH_REPOSITORY}, and the OpenCode App token has no cross-repository commit-status permission in this deployment. A verified exact-head formal review remains authoritative; configure PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN to publish the optional commit status."
             exit 0
           fi
 

.github/workflows/opencode-review.yml

@@ -33,7 +33,6 @@ jobs:
 
   coverage-source-tree:
     name: coverage-source-tree
-    needs: [required-workflow-bootstrap]
     runs-on: ubuntu-latest
     steps:
       - run: >-
@@ -42,7 +41,6 @@ jobs:
 
   coverage-evidence:
     name: coverage-evidence
-    needs: [coverage-source-tree]
     runs-on: ubuntu-latest
     steps:
       - run: >-
@@ -51,7 +49,6 @@ jobs:
 
   opencode-review-target:
     name: opencode-review
-    needs: [coverage-evidence]
     runs-on: ubuntu-latest
     steps:
       - run: >-

.github/workflows/pr-review-merge-scheduler.yml

@@ -101,7 +101,10 @@ concurrency:
     github.event_name == 'repository_dispatch' && github.event.client_payload.pr_number != '' && format('pr-{0}', github.event.client_payload.pr_number) ||
     github.event_name == 'repository_dispatch' && format('repo-dispatch-{0}', github.repository) ||
     github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review' || github.event_name == 'repository_dispatch' || (github.event_name == 'workflow_run' && !github.event.workflow_run.pull_requests[0].number) }}
+  # scan-pr-queue is a required check. Cancelling an in-flight same-head run
+  # leaves a CANCELLED required conclusion that stays in the rollup after a
+  # later success, so the PR looks failed with zero failed jobs.
+  cancel-in-progress: false
 
 # Scorecard Token-Permissions (alert #9): declare a least-privilege default at
 # the workflow level. The scan-pr-queue job that actually needs write access

.github/workflows/strix.yml

@@ -844,9 +844,10 @@ jobs:
           # exit 1 both for genuine blocking vulnerabilities AND for
           # LLM-backend-unavailable outcomes (GitHub Models "Too many requests"
           # rate limits, OpenAI quota starvation, 413 tokens_limit_reached
-          # token-cap, connection/warm-up failures) that could not complete a scan. A backend outage is CI
-          # infrastructure noise, not a security finding, so it must not fail
-          # the required check and block merges.
+          # token-cap, connection/warm-up failures) that could not complete a
+          # scan. Incomplete provider evidence is not a clean security result,
+          # so the required check stays failed until a later scheduler pass or
+          # explicit rerun obtains complete evidence.
           strix_run_log="$RUNNER_TEMP/strix_gate_console.log"
           strix_rc=0
           set +e
@@ -859,28 +860,21 @@ jobs:
           fi
 
           # Preserve configuration failures (exit 2) and any unexpected exit
-          # code as hard failures — only the scan-failure code (1) can be an
-          # infrastructure/backend-unavailability outcome.
+          # code as hard failures. A scan-failure code (1), including provider
+          # or backend unavailability, is incomplete security evidence and
+          # remains a hard failure for the required check.
           if [ "$strix_rc" -ne 1 ]; then
             exit "$strix_rc"
           fi
 
           # Recognized signals that the LLM backend was unavailable / starved.
           backend_unavailable_signal='RateLimitError|Too many requests\. For more on scraping GitHub|exceeded your current quota|insufficient_quota|billing details|"status"[[:space:]]*:[[:space:]]*"RESOURCE_EXHAUSTED"|tokens_limit_reached|Request body too large|Max size:[[:space:]]*[0-9]+[[:space:]]+tokens|Error code:[[:space:]]*413|LLM CONNECTION FAILED|Could not establish connection to the language model|LLM warm-up failed|Configured model and fallback models were unavailable|Configured Vertex model and fallback models were unavailable|emitted provider infrastructure or failure-signal output|before provider infrastructure failure|litellm(\.exceptions)?\.NotFoundError[^[:cntrl:]]*Nvidia_nimException[^[:cntrl:]]*Error code:[[:space:]]*404'
-          # Any evidence that a vulnerability was actually reported. Its presence
-          # forces a hard failure so real findings are NEVER downgraded. Keep the
-          # severity branch anchored away from identifiers so environment lines
-          # such as STRIX_FAIL_ON_MIN_SEVERITY do not look like findings.
-          reported_vulnerability_signal='Vulnerabilities[[:space:]]+[1-9]|(^|[^A-Za-z0-9_])severity[[:space:]]*:'
-
-          # Neutral skip only when ALL hold: a backend-unavailability signal is
-          # present and no vulnerability was reported anywhere. This preserves
-          # real security gating while keeping uncontrollable provider outages
-          # from blocking current-head merge progress.
-          if grep -Eiq "$backend_unavailable_signal" "$strix_run_log" \
-            && ! grep -Eiq "$reported_vulnerability_signal" "$strix_run_log"; then
-            echo "::warning title=Strix backend unavailable::Strix could not complete because its LLM backend was unavailable (rate limit / token cap / connection or warm-up failure) before producing a vulnerability report. Treating as a neutral skip so an infrastructure outage does not block merges; genuine findings still fail the check. See the strix-reports artifact and the run log."
-            exit 0
+          # Provider/backend failures are not a clean scan. Keep the required
+          # check red and let the scheduler or an explicit rerun recover after
+          # provider capacity returns; never convert missing evidence to a pass.
+          if grep -Eiq "$backend_unavailable_signal" "$strix_run_log"; then
+            echo "::error title=Strix backend unavailable::Strix could not complete because its LLM backend was unavailable before producing complete security evidence. The required check remains failed; rerun after provider capacity recovers. See the strix-reports artifact and the run log."
+            exit "$strix_rc"
           fi
 
           echo "Strix reported security findings or failed for a non-backend reason; failing the required check (gate exit ${strix_rc})." >&2

CHANGELOG.md

@@ -36,6 +36,7 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
+- Refreshed the read-only review-dispatch blob contract after the protected main workflow changed, keeping the cross-repository OpenCode evidence checks bound to the current canonical reviewer workflow.
 - Refused PR Review Merge Scheduler head mutations, `update-branch` and the last-push approval head restamp, whenever the resolved mutation credential is the workflow `GITHUB_TOKEN`. GitHub starts no workflow run for events created with that credential, so the moved head collected no current-head required checks and the PR stayed permanently `BLOCKED` with a `github-actions[bot]` merge commit that no later scheduler run could repair, because the branch was no longer behind. The scheduler now waits with `head_mutation_credential_upgrade` guidance naming `PR_REVIEW_MERGE_TOKEN`, `OPENCODE_APPROVE_TOKEN`, and the OpenCode app token exchange.
 - Parsed `opencode.jsonc` as JSONC (stripping `//` and `/* */` comments outside string literals) in the reasoning-effort guard and its contract tests, instead of raw `json.loads`, which rejected the file the moment it carried its first explanatory comment (added for the `contextual-orchestrator` provider block) with `Expecting property name enclosed in double quotes`. Comment markers inside string values, such as the `$schema` URL, are left untouched.
 - Download the pinned `uv` 0.12.1 exporter from the official GitHub Releases URL instead of `releases.astral.sh`, which now returns HTTP 403 and blocks org-wide OpenCode `coverage-evidence`. The SHA-256 pin is unchanged. The opener may follow one hop onto `release-assets.githubusercontent.com` or `objects.githubusercontent.com` and still rejects every other host, userinfo, non-HTTPS scheme, and nondefault port (ContextualWisdomLab/.github#1109).
@@ -44,6 +45,10 @@ Semantic Versioning where the repository publishes a release.
 - Published substantive OpenCode LLM probes when they already carried an independent proof and exact source-line digest but omitted a duplicated `path:line` citation, so NVIDIA NIM / OpenCode review evidence is no longer discarded as `NO_CONCLUSION`.
 - Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367).
 - Materialized base Python locks only when every package line is an exact SHA-256 pin or a bounded relative `-r`/`--requirement` include. A lone `--require-hashes` directive, a dotted include such as `./lock.txt`, or `-r other-hashes.txt` no longer enters the trusted build context.
+- Stopped cancelling in-flight required `scan-pr-queue` runs and stopped serializing the OpenCode required-workflow stub jobs, so a later same-head success is not hidden behind a cancelled or queued required check.
+- Required an exact-head formal OpenCode review before skipping unavailable cross-repository commit-status publication, and kept Strix failed when provider evidence is incomplete instead of neutralizing an outage into a pass.
+- Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367).
+
 - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics.
 - Allowed commas and ASCII parentheses in the bounded Strix changed-file path policy so legal tracked Packrat fixtures can receive exact-head security analysis, while rejecting raw `..` components before normalization and keeping controls, backslashes, whitespace ambiguity, and shell punctuation fail-closed.
 - Bound each review-agent invocation key to the wrapper's complete canonical payload, including the base branch and requesting actor; altered fields with a valid-format key now fail before durable-leader election or forwarding, and wrapper write permission is job-scoped.

docs/doctoring/base-requirements-lock-discovery.md

@@ -0,0 +1,59 @@
+# Base requirements lock discovery contract
+
+## Purpose
+
+This doctoring record defines how the central review and coverage workflows discover hash-pinned Python requirement locks from an authenticated pull-request base commit. It records the nested-path regression repaired in pull request #939 and preserves the security boundary already developed in pull request #785.
+
+## Incident
+
+The materializer intentionally recognizes two candidate forms:
+
+- conventional file names such as `requirements.txt`, `requirements-dev.txt`, and `requirements.lock`; and
+- direct `.txt` children of any directory named `requirements`, such as `requirements/ci.txt` and `service/requirements/package.txt`.
+
+The path predicate implemented both forms, but `base_hash_locks()` still called the basename-only predicate. As a result, a direct child such as `requirements/ci.txt` was rejected before its authenticated base blob and hash-pinned content could be evaluated. The implementation advertised path-aware eligibility while the collector enforced only legacy basename eligibility.
+
+The repair changes the collector to call `_is_candidate_lock_path(candidate)` with the already parsed `PurePosixPath`. It does not broaden the accepted Git object types or relax content validation.
+
+## Trust boundary
+
+A candidate enters the generated build context only when every applicable condition holds:
+
+1. The base revision is an exact 40-character hexadecimal commit SHA.
+2. `git ls-tree` reports a regular `100...` blob in that exact base tree.
+3. The repository-relative path is non-absolute and contains no `..` component.
+4. The path is either a conventional requirements lock name or a direct `.txt` child of a directory named `requirements`.
+5. Every substantive requirement is an exact `==` pin with complete SHA-256 hashes, or a separately bounded relative requirements include.
+6. Symlinks, gitlinks, malformed tree entries, unpinned files, unsafe includes, and pull-request-only content remain excluded.
+7. `uv.lock` follows its separate trusted export path and still requires the corresponding base-owned `pyproject.toml`.
+
+Path eligibility is candidate discovery, not dependency trust. The existing hash, include, export, and downstream closure checks remain authoritative.
+
+## Test-first evidence
+
+Temporary repair workflow run `31787913977` executed the following sequence on head `912313ff92cdcee6f240e9584f79ca37615ee5a2`:
+
+1. Created a temporary Git repository containing hash-pinned `requirements/ci.txt` and `service/requirements/package.txt` blobs.
+2. Confirmed the regression test failed before the implementation change because neither path was collected.
+3. Replaced the basename-only collector predicate with the repository-relative path predicate.
+4. Confirmed both paths were returned in deterministic repository order.
+5. Compiled the implementation and regression test and ran `git diff --check`.
+6. Deleted the temporary writer workflow before committing the production change.
+
+An earlier repair attempt failed before exercising the assertion because direct script execution omitted the repository root from `sys.path`. The corrected workflow ran both RED and GREEN phases with the same explicit `PYTHONPATH=.` environment, so the observed transition is attributable to the collector change rather than import setup.
+
+## Permanent regression command
+
+```bash
+PYTHONPATH=. python3 tests/test_materialize_base_python_requirement_paths.py
+python3 -m compileall -q \
+  scripts/ci/materialize_base_python_requirements.py \
+  tests/test_materialize_base_python_requirement_paths.py
+git diff --check
+```
+
+The repository quality workflow must also run the full materializer and Strix regression suites on the exact pull-request head. Focused repair evidence cannot replace protected-branch checks, semantic review, or required independent approvals.
+
+## Change-management rule
+
+Future changes to candidate naming, path parsing, Git tree filtering, requirement includes, `uv.lock` export, or materialized manifests must update the path-discovery tests and the broader materializer suite together. A path predicate and its collector call site must not evolve independently.

docs/doctoring/cross-repo-opencode-evidence.md

@@ -0,0 +1,32 @@
+# Cross-repository OpenCode evidence
+
+## Incident and buyer impact
+
+Sibling-repo reviews (for example `ContextualWisdomLab/naruon#1317`) lost
+coverage-evidence when the former Astral release endpoint rejected requests,
+and the OpenCode App token could not publish a commit status across
+repositories. A later Strix provider outage was also converted into a green
+required check, so incomplete security evidence looked like a pass.
+
+## Decision
+
+1. Download uv from the literal GitHub Releases HTTPS URL with a fixed
+   `User-Agent`, disable proxies, reject redirects, and retain size, checksum,
+   and executable-version checks. Repository or user data cannot select the
+   network origin.
+2. Before skipping cross-repository status publication, prove an exact-head
+   formal OpenCode review from an accepted author (`opencode-agent[bot]` or
+   `opencode-agent`) with state (`APPROVED` or `CHANGES_REQUESTED`). Missing
+   proof, an unaccepted author, or a mismatched head fails closed.
+3. Keep Strix red when the backend is unavailable. Incomplete provider
+   evidence is not a clean scan.
+
+## References
+
+Fielding, R., Nottingham, M., & Reschke, J. (Eds.). (2022). *HTTP semantics*
+(RFC 9110). Internet Engineering Task Force.
+https://doi.org/10.17487/RFC9110
+
+National Institute of Standards and Technology. (2020). *Security and privacy
+controls for information systems and organizations* (NIST Special Publication
+800-53 Rev. 5). https://doi.org/10.6028/NIST.SP.800-53r5