fix(actions): bound agent mention dispatch envelopes

[seonghobae]

Test-first state

This Draft currently contains only focused regression contracts for the central review-agent mention transport. The production code is intentionally unchanged so the exact branch records the current failure before repair.

The reproduced defect is concrete: the router emits 14 top-level repository_dispatch.client_payload properties for @opencode-agent, while GitHub accepts at most 10. Recent mention-router runs fail with HTTP 422 before the authoritative review scheduler is queued, blocking exact-head OpenCode review requests across CWL repositories.

The regression contract also requires:

• a versioned three-key envelope whose nested claim preserves the existing invocation digest and artifact-ledger identity;
• validation before durable ledger mutation on both dispatch hops;
• exact live head, base, and base-branch binding at the scheduler;
• review-only policy (merge_mode=disabled, no branch update, no auto-merge);
• legacy dispatch compatibility without allowing the versioned envelope to fall through the legacy event;
• optional reaction failure to remain advisory after durable dispatch;
• 100% production coverage and docstring coverage for the affected router and scheduler modules.

This is the bounded successor to stale, conflicted PR #840. It deliberately excludes that PR's unrelated uv materializer, Strix, broad OpenCode, and documentation changes.

Do not merge in the RED state.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e7959cb7-0dd0-4e11-a0f8-2b0f63947f3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh ScopeWeave consumer canary confirms this exact transport defect is currently blocking review delivery, not source quality. Scheduled mention-router run 32002622857 at central main@c47afc2dc68488292c1db7c9d6f82dcd5360f181 successfully obtained the OpenCode installation token, then its sweep-organization-agent-mentions job 95305765001 repeatedly received HTTP 422 Invalid request. No more than 10 properties are allowed; 14 were supplied from the repository-dispatch hop and was ultimately cancelled while still sweeping. ScopeWeave already has exact-current-head review-only mentions waiting on this path, including #490 head e9b445fa8695314249190977351d3dd5e14c1583 (comments 5311248118, 5311461254) and #545 head ef9f9a9912b37946ee340aef26f7f2d62a03e32d (comment 5312307562), both against protected develop@44e7903cf8891c65410f7fc6ca5144de3fdb5185. Please use those as post-GREEN operational canaries: the bounded envelope repair must dispatch each existing mention once, bind the same exact head/live-base identities, and yield a formal review-only verdict without branch update/auto-merge. Do not require new duplicate mentions to prove recovery.

[seonghobae]

Closing this RED-only predecessor because the production defect is already resolved on protected main by #1115 (64feb77e8a178035bfd3822830b9435c3b0562fc): both dispatch hops are within GitHub's payload cap, the complete review-only claim remains digest-bound, exact head/base identity is preserved, and the interactive/sweep queue contract is covered. The remaining post-dispatch acknowledgement failure is owned by current focused PR #1135 rather than this divergent 17-file branch. No check, review, or test-only branch evidence transfers; do not revive or merge this RED state.