feat(opencode): add risk-adaptive shadow review pool

[seonghobae]

Purpose

Implement the production-independent part of Task 6 in the OpenCode review-quality plan: deterministic risk-adaptive detector routing, bounded OpenCode shadow execution, and independent source-contract verification without GitHub publication authority.

Exact stacked identity

• stacked base branch: feat/opencode-review-decision-envelope (PR feat(opencode): separate semantic and merge decisions #836);
• independently resolved live stacked-base SHA: c3133887df775605bfca2aaaa8b94094aec609fc;
• branch: feat/opencode-review-shadow-pool;
• exact current implementation head: 94a54be6b3d424b59b5a32854099fff24f5794e6;
• protected-main tip observed for separation: 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
• state: Draft / implementation complete on this stacked head.

No predecessor check, review, approval, or comment authorizes this head. If a predecessor moves or integrates, this branch must be reconciled once and every exact-head evidence surface regenerated.

Implemented contract

This head adds:

• strict canonical JSON primitives with duplicate-key and non-finite-number rejection, safe relative paths, immutable SHA-256 receipts, and atomic writes;
• deterministic small/medium/large classification and low/standard/high/critical risk routing;
• bounded general, specialist, verifier, and recursive-verifier allocation with fail-closed budgets and independent model selection;
• fixed non-shell OpenCode argument vectors and detector-before-verifier execution;
• per-attempt timeout, failure isolation, and dependency-failed verifier receipts;
• child-only NVIDIA_NIM_API_KEY to NVIDIA_API_KEY mapping, minimal child environment, and persisted stdout/stderr secret redaction;
• immutable executable, worktree, evidence, and private empty-output-directory boundaries;
• exact-head source receipt validation, semantic/infrastructure separation, independent-verifier enforcement, model-diversity policy, and deterministic deduplication;
• shadow_findings only, with published_findings=[] and publication disabled;
• a thin plan-only shell wrapper with no GitHub mutation path; and
• beginner-readable operator, recovery, rollback, and maturity documentation.

The implementation does not modify .github/workflows/opencode-review-dispatch.yml, opencode.jsonc, reviewer identities, model credentials, branch protection, merge controls, or release controls.

Test-first and exact-head evidence

The original exact-head run 31261292975 correctly proved RED at the missing production boundary. During implementation, new security regressions first proved five failures covering secret echo and untrusted output paths, then passed after the root-cause repair.

Current evidence:

• focused behavioral/adversarial suite: 73 passed;
• owned production coverage: 486/486 statements and 166/166 branches (100%);
• owned production callable docstrings: 42/42 (100%);
• complete repository behavior suite: 1,188 passed plus 16 subtests;
• Python compilation, Bash syntax, and diff checks: passed;
• hosted Python 3.14 exact-head workflow: run 31496243794, success, checked against 94a54be6b3d424b59b5a32854099fff24f5794e6.

An exploratory stack-wide coverage run is not presented as acceptance evidence: it exposed one collection-order-only branch in each existing predecessor module opencode_review_adjudicate.py and opencode_review_decision.py. This branch does not mutate those predecessor-owned modules. The exact owned production gate above is complete and the full behavioral suite passes.

Security and authority boundary

• no GitHub comment, review, check, approval, merge, branch update, release, or auto-merge authority;
• no arbitrary shell evaluation;
• no COPILOT_GITHUB_TOKEN;
• no credential in a plan or process argument;
• child secret echoes are redacted before persistence and hashing;
• symlink, non-directory, reusable non-empty, and group/world-writable output paths fail closed;
• infrastructure failures cannot become source findings; and
• local or automated evidence is not a qualifying independent human approval.

Keep Draft and do not merge until all stacked predecessors integrate, this branch is reconciled onto the exact protected base, all exact-head quality/security/review evidence remains passing, no valid unresolved finding remains, and a qualifying independent non-author formal approval exists.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4c2ec709-e2d3-4567-997d-8dfbb8a3fc19

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Implement only PR #839 at exact current head 4fc5d75fe01258bbc469373eafdcc2d8afb55cfa on exact stacked base branch feat/opencode-review-decision-envelope at c3133887df775605bfca2aaaa8b94094aec609fc. Immediately before any write, refetch the PR head/base and confirm the intended production targets scripts/ci/opencode_review_shadow.py, scripts/ci/opencode_review_shadow_primitives.py, scripts/ci/opencode_review_verify.py, and scripts/ci/run_opencode_semantic_review_pool.sh are still absent at this head. Abort without writing if the head/base moved, any target unexpectedly exists, or another write-capable actor is active on this branch.

RCA: exact-head OpenCode Review Shadow Quality run 31261292975, job 93112384895, checked out literal head 4fc5d75f... and failed during collection with four FileNotFoundError errors because scripts/ci/opencode_review_shadow.py does not exist. This is the intentional test-first RED contract, not an infrastructure/provider failure. The permanent tests and quality workflow already specify the missing bounded production-independent shadow planner/executor/verifier behavior.

Feasibility: do not modify .github/workflows/opencode-review-dispatch.yml, opencode.jsonc, existing reviewer identities/credentials, GitHub publication code, branch protection, or any stacked predecessor. Do not add GitHub mutation authority or COPILOT_GITHUB_TOKEN. This branch is deliberately production-independent, so implementation is feasible without racing the active dispatch-workflow owners named in the PR. Implement only the smallest modules/shell wrapper required by the existing tests: deterministic risk-adaptive detector routing, bounded non-shell OpenCode execution, child-only NVIDIA credential mapping, immutable evidence/worktree/output checks, independent verifier ordering/diversity, fail-closed partial failure handling, strict normalized receipts/deduplication, and shadow_findings with publication disabled.

Use the existing tests as the authoritative contract; do not weaken/delete/skip them. Run the focused shadow suite first, then exact 100% owned production statement/branch coverage, public callable docstrings, Python compileall, Bash syntax for the wrapper, clean-tree/diff checks, and the branch's exact-head quality workflow. Commit ordinary descendant commits only. Keep the PR Draft and stacked; do not approve, merge, retarget, rebase, force-push, or synthesize review evidence. If any requirement cannot be satisfied within the stated production-independent boundary, leave the branch unchanged and report the exact infeasible condition.

[seonghobae]

Exact-head RCA for 4fc5d75fe01258bbc469373eafdcc2d8afb55cfa (observed failing run 31261292975; independently resolved live main 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba; live target base c3133887df775605bfca2aaaa8b94094aec609fc):

First failing boundary: OpenCode Review Shadow Quality CI job 93112384895, step Verify shadow detector-verifier contracts. Four test modules fail collection because scripts/ci/opencode_review_shadow.py is absent from the exact checkout. Immediate cause: the test-support loader resolves a required production path that the stack tree does not contain. Technical root cause: the shadow-quality workflow/tests and their production implementation are not atomic in the current stack. Smallest remedy: reconcile the stack so the exact base/head tree contains the reviewed implementation before rerunning; a blind rerun is falsified by deterministic FileNotFoundError evidence.

Source mutation is frozen in this invocation because this open PR’s existing writer owns the branch/path. The branch remains Draft; no approval, success, or merge authority is inferred.

[seonghobae]

@opencode-agent review

Review PR #839 at exact head 94a54be6b3d424b59b5a32854099fff24f5794e6 against exact stacked base c3133887df775605bfca2aaaa8b94094aec609fc. Treat hosted run 31496243794 as exact-head quality evidence only, not semantic approval. Review the new production modules, permanent tests, shell wrapper, doctoring, and CHANGELOG for source-backed correctness, security, privacy, reliability, and evidence-authority defects.

Pay particular attention to fixed non-shell argv construction; child-only credential mapping and secret redaction; executable, worktree, evidence, symlink, permission, and empty-output boundaries; detector/verifier independence; exact-head/source receipt binding; infrastructure-versus-semantic separation; deterministic deduplication; fail-closed partial failures; and the hard guarantee that publication and GitHub mutation remain disabled.

Do not infer a qualifying human approval, merge readiness, protected-main acceptance, or commercial parity. Anchor every actionable finding to this exact head.