fix(opencode): preserve exact-head dispatch queue position

[seonghobae]

Goal

Repair the OpenCode control-plane race that allowed a newer dispatch to replace pending same-head work or let stale-head work retain queue position. This successor preserves every valid delta from the RED→GREEN stack. This leaf is Draft / Proposed. Its prerequisites remain separately open and are not acceptance evidence.

Exact stacked topology

• Base PR: fix(ci): integrate parser, security, response, and coverage gates #2530 fix/full-suite-parser-locks-20260930
• Exact base: 3a332c51e3dba679d97df445944b6e92e8d97e80
• Exact head: 8b4fdca9f6726ed6c6f3d39a26f1d5654393fba5
• Exact tree: f20227f466b5f4ad52915a1ee4f2a0153d307896
• Current merge parents: prior leaf 67c68928eab022b146cdd9d9405628aad0d83335 and current owner 3a332c51e3dba679d97df445944b6e92e8d97e80
• Publication used a new branch ref; no Force Push, destructive rebase, bypass, or predecessor closure.

Publication provenance

The local test-first stack remains intact and was not rebased, force-pushed, or deleted. Non-interactive HTTPS push lacked a local credential, so the authorized GitHub connection published one ordinary child of the exact base using the verified final tree. The published tree f7ebe108a40132339e66b6ca053f01499b58f242 is byte-for-byte identical to the locally verified tree and includes all 12 valid paths, including the RED evidence fragment in CHANGELOG.d/. Only commit metadata differs; no valid diff, requirement, fixture, or evidence was discarded.

Incident and RCA

The repair follows the same-head admission failures evidenced by #2545 exact head 9a4af5e438283a31dc05814d6bc2818caee782a3 and Actions runs 36776536447 and 36778773766.

Root causes:

1. GitHub native concurrency may replace a pending member, so it cannot preserve every active exact-head dispatch.
2. Producer stale-run retirement did not enumerate and revalidate all active states before mutation.
3. The central receiver lacked an atomic exact-PR lease and performed privileged preparation before exact envelope authorization.
4. Required-run wake-up trusted a supplied run id/run-level SHA instead of enumerating all failed PR-associated runs; for pull_request_target, the run-level SHA is the trusted base.
5. GitHub filtered workflow-run search is capped at 1,000 results and may return the "2,500+" sentinel, requiring bounded recursive date partitioning and reconciliation.

RED → GREEN contracts

• producer inventories requested/waiting/pending/queued/in_progress twice, keeps same-head work, validates canonical older-head identity, and cancels only stale work;
• same-head dispatch is still POSTed when an earlier asynchronous cancellation was accepted;
• receiver authorizes exact actor/sender, target allowlist, repository/PR/payload shape before OIDC exchange or mutation;
• one dedicated contents: write admission job acquires a per-PR CAS lease after live open/non-draft base/head validation and revalidates before mutation;
• downstream jobs are admitted-only and read-only;
• formal receipt inventories all required workflow runs, binds the intended PR through pull_requests[].number plus pull_requests[].head.sha, and reruns every failed exact-head run after live revalidation;
• workflow-run inventory recursively bisects PR-lifetime ISO-8601 ranges when numeric total exceeds 1,000 or GitHub returns "2,500+"; an unsplittable one-second overflow or pagination mismatch fails closed;
• byte-for-byte receiver pin: 10707b070475c5e0889501ae4178b7868c6a7cc9.

Verification

• focused contracts: 248 passed, 1 skipped
• complete Python 3.14 warnings-fatal suite: 5,339 passed, 5 skipped, 40 subtests passed
• owned production coverage: 18,729/18,729 statements; 7,642/7,642 branches (100%)
• production Docstrings: 100%
• YAML parse and git diff --check: GREEN
• independent current-diff review: 0 Critical / 0 Important, exact blob pin matched

Remaining protected gates

Hosted exact-head security/quality Checks, zero unresolved review threads, and qualifying independent approval remain mandatory. This PR must not be merged before #2530 and this exact head satisfy those gates. The current exact head has failed CodeQL/OpenCode contexts, pending agent reviews, and no qualifying approval; Draft / Proposed remains required. No auto-merge or bypass is enabled.

2026-10-01 current owner reconciliation (authoritative)

Exact head 8b4fdca9f6726ed6c6f3d39a26f1d5654393fba5 is an ordinary two-parent merge of prior leaf 67c68928eab022b146cdd9d9405628aad0d83335 and canonical owner #2530 at 3a332c51e3dba679d97df445944b6e92e8d97e80. Its tree is f20227f466b5f4ad52915a1ee4f2a0153d307896; the ref update used force=false.

The current-base effective delta is 12 expected workflow, test, doctoring, CHANGELOG, and Gap-evidence paths (1,771 insertions / 145 deletions). git diff --check 3a332c51... 8b4fdca9... is GREEN. No prior-head Check or review is transported as approval; fresh exact-head hosted Checks and a qualifying independent approval remain required. Status remains Draft / Proposed.

2026-10-01 latest base-move reconciliation (authoritative)

• Exact head: bd05e83c7e4b425a499c488c2b98f1d791d150ce; exact tree: 475f57fead2f8b8124c8721b9b13009c6f2670d6.
• Ordinary two-parent merge preserves prior leaf 8b4fdca9f6726ed6c6f3d39a26f1d5654393fba5 and current canonical owner fix(ci): integrate parser, security, response, and coverage gates #2530 813f16fad7528b035d6ae4386cd176c9a67413c1; the branch ref advanced with force=false.
• Owner-to-leaf comparison is ahead 3 / behind 0, mechanically mergeable, and retains exactly the 12 intended workflow, test, doctoring, CHANGELOG, and Gap-evidence paths (1,771 insertions / 145 deletions).
• The single overlapping Gap file was resolved from the complete current owner blob: the OpenCode idempotency row is retained alongside the bounded Maturin downloader and LiteLLM security evidence. The owner's other four changed paths remain byte-for-byte inherited.
• Exact-head SAST run 36804188797 and Security run 36804188858 are queued; CodeQL run 36804188825 is skipped because this PR remains Draft. Skipped or queued results are not acceptance evidence. Fresh terminal Checks and qualifying independent approval remain mandatory; no bypass, auto-merge, closure, or release is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head admission correction: 67c68928eab022b146cdd9d9405628aad0d83335 was returned to Draft / Proposed. Ready-triggered evidence contains OpenCode failure (run 36799078916: no authenticated current-head verdict), CodeQL actions/Python failures (run 36799078327: dispatch succeeded but VERDICT_STATE=pending), queued Noema, in-progress Strix, and zero qualifying approvals. The valid 12-file delta and stack are preserved. No merge, bypass, rebase, Force Push, or close was performed.

[seonghobae]

비파괴 current-owner 재적층 완료 (2026-10-01).

• current base / canonical owner fix(ci): integrate parser, security, response, and coverage gates #2530: 3a332c51e3dba679d97df445944b6e92e8d97e80
• current exact head: 8b4fdca9f6726ed6c6f3d39a26f1d5654393fba5
• tree: f20227f466b5f4ad52915a1ee4f2a0153d307896
• parents: prior leaf 67c68928eab022b146cdd9d9405628aad0d83335 + current owner 3a332c51e3dba679d97df445944b6e92e8d97e80
• ref update: ordinary, force=false
• current-base scope: 12 expected workflow/test/doctoring/CHANGELOG/Gap paths, 1,771 insertions / 145 deletions
• git diff --check 3a332c51... 8b4fdca9...: GREEN

이전 head의 Check·review는 승인으로 이월하지 않습니다. 새 exact head의 hosted Checks와 독립 APPROVED가 필요하므로 Draft / Proposed를 유지합니다.

[seonghobae]

Base-move conflict repaired non-destructively at exact head bd05e83c7e4b425a499c488c2b98f1d791d150ce (tree 475f57fead2f8b8124c8721b9b13009c6f2670d6). This ordinary two-parent merge preserves prior leaf 8b4fdca9f6726ed6c6f3d39a26f1d5654393fba5 and current #2530 owner 813f16fad7528b035d6ae4386cd176c9a67413c1; the ref update used force=false.

The PR is mechanically mergeable, ahead 3 / behind 0, and retains exactly the intended 12-path delta (+1,771/-145). Exact-head Security 36804188858 and SAST 36804188797 are terminal GREEN; CodeQL 36804188825 is Draft-gated skipped and is not acceptance. Fresh Ready-admitted CodeQL/authenticated verdicts and independent approval remain mandatory.

[seonghobae]

Successor-equivalence audit at exact head bd05e83c7e4b425a499c488c2b98f1d791d150ce found valid predecessor deltas that are not yet carried completely. This is a repair finding, not a request to close any PR.

1. fix(opencode): skip duplicate same-head review dispatch while in flight #2283 receiver receipt boundary is incomplete. The required-workflow producer checks for a formal exact-head receipt before dispatch, and the central receiver has an atomic per-PR lease, but the receiver does not re-check the formal exact-head receipt after lease acquisition and immediately before coverage/model execution. A later duplicate receiver can therefore proceed after an earlier receiver has completed/published.
2. fix(scheduler): do not cancel same-SHA scan-pr-queue on review #2289 scheduler cancellation contract is not equivalent. The current producer POSTs cancellation, reads the run status once, and explicitly continues while it remains requested|waiting|pending|queued|in_progress. That does not carry fix(scheduler): do not cancel same-SHA scan-pr-queue on review #2289's bounded proof of terminal completed/cancelled, metadata-only cleanup, and immediately-before-mutation live PR/head revalidation as an executable contract.
3. The current CHANGELOG/PR completion language should remain Proposed until those contracts and fixtures are present. The binary/corrupt fix(scheduler): do not cancel same-SHA scan-pr-queue on review #2289 test delta is not valid carryover and must not be copied.

Required next lane: RED receiver-receipt race contract → minimal receiver recheck/fail-closed implementation → scheduler terminal-cancellation contracts → exact-head GREEN evidence. #2283/#2289 must remain open until verified equivalence or ordinary merges preserve every valid delta.

[seonghobae]

2026-10-01 receiver receipt recheck — exact current head

The branch advanced by one ordinary fast-forward child with force=false.

• Exact head: 57044408a7b76563b47aadc481c4419cac828489
• Exact tree: 97d95556282d496fc17cbcdb239fae51a0a1ad00
• Parent: bd05e83c7e4b425a499c488c2b98f1d791d150ce
• Receiver workflow Git blob: 5c87c74863ef6872c1ef7136d5b330071920c09e

RED → GREEN repair

RED proved that exact-PR lease ownership alone did not prevent a completed prior receiver from repeating coverage/model work. The receiver now, after lease acquisition or self-rerun lease retention:

1. revalidates the live repository/PR/base/head authority;
2. loads the formal receipt helper from the trusted default-branch exact GITHUB_SHA;
3. evaluates the exact-head formal review receipt with the read-scoped target token;
4. returns admitted=false before source materialization, coverage, or model execution when a receipt exists;
5. fails closed for helper download, Reviews API, malformed state, or authority movement.

Executable cases cover receipt present/missing, completed-owner recovery, same-run retention, CAS concurrency, and concurrent lease-branch initialization.

Exact-tree verification

• Full warnings-fatal suite: 5,352 passed, 5 skipped, 40 subtests passed
• YAML parse: GREEN
• git diff --check: GREEN
• Independent current-diff review: 0 high / 0 medium findings
• Remote tree equals the locally verified tree byte-for-byte.

Protected status

This remains Draft / Proposed / HOLD. Fresh hosted exact-head Checks have not yet reached terminal acceptance, there is no qualifying independent GitHub approval, and the separately identified scheduler retirement equivalence gap from #2289 remains unresolved. This comment does not transport prior-head evidence and does not authorize merge, auto-merge, bypass, closure, or release.