fix(ci): restore OpenCode coverage honesty and mermaid surfaces

.github/workflows/opencode-review.yml

@@ -20,6 +20,7 @@ concurrency:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   required-workflow-bootstrap:
@@ -53,7 +54,57 @@ jobs:
     name: opencode-review
     needs: [coverage-evidence]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - run: >-
-          echo "Review approval remains a separate current-head PR review
-          requirement produced by the authenticated dispatch workflow."
+      - name: Fail closed without a current-head OpenCode verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TARGET_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event.action }}" = "closed" ]; then
+            echo "PR closed; a current-head OpenCode verdict is not required."
+            exit 0
+          fi
+          if [ -z "${PR_NUMBER:-}" ] || [ -z "${HEAD_SHA:-}" ]; then
+            echo "::error::Missing PR number or head SHA; cannot verify a current-head OpenCode verdict."
+            exit 1
+          fi
+          reviews="$(gh api --paginate "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}/reviews")"
+          verdict="$(printf '%s\n' "$reviews" | jq -r -s --arg sha "$HEAD_SHA" '
+            (add // [])
+            | [
+                .[]
+                | select(
+                    (.user.login // "" | ascii_downcase) as $user
+                    | $user == "opencode-agent" or $user == "opencode-agent[bot]"
+                  )
+                | select((.commit_id // "" | ascii_downcase) == ($sha | ascii_downcase))
+                | select(.state == "APPROVED" or .state == "CHANGES_REQUESTED")
+              ]
+            | (last // {}) as $review
+            | ($review.body // "" | ascii_downcase) as $body
+            | if $review.state == "CHANGES_REQUESTED" then
+                "CHANGES_REQUESTED"
+              elif $review.state == "APPROVED"
+                and ($body | contains("deterministic current-head evidence") | not)
+                and ($body | contains("deterministic fallback approval") | not)
+                and ($body | contains("model-unavailable evidence fallback") | not)
+                and ($body | contains("did not emit a usable current-head control block") | not)
+                and ($body | contains("scope: `unsupported`") | not)
+                and ($body | contains("model-pool outcome: `unknown`") | not)
+              then
+                "APPROVED"
+              else
+                empty
+              end
+          ')"
+          if [ -z "$verdict" ]; then
+            echo "::error::No APPROVED or CHANGES_REQUESTED from opencode-agent on the current head. This required check is not a review and must not succeed until the authenticated dispatch posts a current-head verdict."
+            exit 1
+          fi
+          echo "Current-head OpenCode verdict: ${verdict}."

CHANGELOG.md

@@ -5,6 +5,7 @@ this file. The format follows Keep a Changelog, and versioned releases follow
 Semantic Versioning where the repository publishes a release.
 
 ## [Unreleased]
+- Restore OpenCode coverage honesty and mermaid surfaces stacked on main after #1360 squash `17052a7c`: `publish_fallback_diff_review` posts a COMMENT product-file review then `request_changes_for_coverage_evidence_failure` sets the status comment to `COVERAGE_BLOCKED` so a coverage miss never looks finished as `Gate result: COMMENT`; mermaid labels crates/packages instead of generic `Changed file (N files)` and does not invent class edges; findings say `Review process` instead of `.github/workflows/opencode-review.yml:1` unless that file is in the diff. Does not change `noema-review.yml` (PM owns `feat/noema-orchestrator-free-zdr`) and is not NIM-2h or GitHub Models.
 - Central review now routes through the vendored `contextual-orchestrator`
   gateway sidecar: the write-capable PR autofix and the shared `opencode.jsonc`
   default use the fail-closed zero-cost pool `orchestrator/free`, with

ci-review-prompt.md

@@ -118,6 +118,15 @@ green checks are not runtime-tool receipts. When no receipt exists, describe
 only the source trace or explicit execution limitation; fabricating browser or
 DevTools evidence invalidates the entire control block.
 
+The formal review must name the actual changed files and what they do,
+include file/line findings on the current-head diff or an explicit APPROVE
+with a real walkthrough, and draw a useful sequence/class/state diagram of
+the changed API rather than a generic `Changed file (N files)` inventory.
+Coverage is a gate, not the review: cite coverage evidence in the status
+surface and never replace the product-file walkthrough with a coverage
+blocker. Never cite `.github/workflows/opencode-review.yml:1` unless that
+file is in the current-head diff.
+
 Review the diff first, then inspect surrounding code only when needed to
 understand impact. Evaluate correctness, API compatibility, security/privacy,
 data integrity, concurrency, error handling, observability, performance,

docs/doctoring/opencode-review-surfaces-originweave-47.md

@@ -0,0 +1,82 @@
+# OpenCode review surfaces and OriginWeave coverage sandbox
+
+검토 기준일: **2026-08-16**
+
+## Incident
+
+ContextualWisdomLab/OriginWeave#47, head
+`79cf275686e2376a51783a2d03128eca21e7c0e5`, workflow run `31951179896`,
+published the same body as both the formal pull-request review and the issue
+comment: a generic overview plus one HIGH finding on
+`.github/workflows/opencode-review.yml:1` saying coverage-evidence failed. The
+pull request actually changed
+`crates/originweave-destination/src/lib.rs`, `resolution.rs`, and
+`tests/resolution_freshness.rs` (FreshResolutionSnapshot / DNS-rebinding
+TOCTOU). The mermaid inventory said `Changed file (3 files)` because unknown
+paths, including `crates/`, were bucketed as "Changed file". Repository CI on
+that head passed. The central isolated coverage job failed and replaced the
+entire review.
+
+## Root cause
+
+When `needs.coverage-evidence.result != success`, the publisher synthesized
+`REQUEST_CHANGES`, posted it with `gh pr review` and again as an issue comment,
+and exited before the model pool could review the diff. Coverage-evidence
+failure became the review. The mermaid helper bucketed unknown paths,
+including `crates/`, as a generic `Changed file (N files)` inventory and
+findings were anchored to `.github/workflows/opencode-review.yml:1` even
+when that file was not in the pull-request diff.
+
+## Decision
+
+Coverage remains a fail-closed gate. It is no longer the review.
+
+1. The formal pull-request review is a source-backed walkthrough of the
+   current-head product diff, including a fallback review that names the
+   changed crate files when the model pool did not emit a control block.
+2. The issue comment is gate/status only: head SHA, run id/attempt, coverage
+   result, model-pool outcome, verdict, and a link to the formal review. It
+   must not repeat `## Pull request overview`, `## Findings`, mermaid, or the
+   model walkthrough.
+3. A coverage miss, skip, or unsupported-tooling result blocks approval and
+   fails the required review job after the diff review is published. It must
+   not cite `.github/workflows/opencode-review.yml:1` unless that file is in
+   the pull-request diff.
+4. Coverage-evidence failure is injected into `bounded-review-evidence.md` as
+   a `## Coverage gate` section. The model pool still runs. The publisher
+   does not early-return before the model path. `format_request_changes_review`
+   keeps model walkthrough/diagrams and appends structured findings.
+
+## Verification contract
+
+Regression tests prove that:
+
+1. the formal review body is not equal to the status comment;
+2. a coverage-gate failure still produces a review that names the changed
+   crate files;
+3. no finding is anchored to `opencode-review.yml:1` unless that file is in
+   the diff;
+4. mermaid labels a `crates/...` change as a Rust crate surface, not
+   `Changed file (3 files)`;
+5. the publisher function
+   `request_changes_for_coverage_evidence_failure` updates the status comment
+   and does not call `create_pull_review`;
+6. the model pool still runs when coverage-evidence failed (`!= cancelled`);
+7. `publish_fallback_diff_review` restores `COVERAGE_BLOCKED` on the status
+   comment after the COMMENT product-file review, so a coverage miss never
+   looks finished as `Gate result: COMMENT`; and
+8. mermaid class diagrams list extracted public Rust API names only and do
+   not invent a `FirstType --> SecondType` class edge.
+
+## Limitations
+
+A later coverage-image or tooling catalog change can still fail the isolated
+coverage job. That failure remains a coverage-gate failure, not a synthesized
+product-file finding. The sandbox does not weaken a genuine below-threshold
+coverage miss.
+
+## References
+
+GitHub, Inc. (2026). *REST API endpoints for pull request reviews*. GitHub
+Docs.
+https://docs.github.com/en/rest/pulls/reviews