Wire test_opencode_fact_gate_contract.sh into CI

[seonghobae]

Finding

Org-wide hollow-path audit flagged scripts/ci/test_opencode_fact_gate_contract.sh: a real 15-assertion contract test checking that opencode-review-dispatch.yml still contains specific fact-gate evidence strings (repo-tree evidence, unresolved-thread evidence, review-body evidence excerpting, HTML-escaping, etc.), but it was invoked by zero workflows, scripts, or tests — unlike its sibling test_strix_quick_gate.sh, which is genuinely wired into strix.yml, strix-changed-path-quality-ci.yml, and opencode-review-dispatch.yml.

Independent re-verification (before touching anything)

• grep -rn "test_opencode_fact_gate_contract" across the repo (excluding the script's own contents and .git internals) returned no hits — confirmed unwired.
• Ran the script directly against current origin/main: all 15 assertions pass (OpenCode fact-gate contract OK, exit 0) — confirmed the test itself is correct and current, not stale, so deleting it would throw away a working guardrail rather than a dead one.
• Confirmed the sibling's wiring pattern by grepping test_strix_quick_gate.sh: it's referenced in 3 workflows, 3 helper scripts, and 6+ test files, with strix-changed-path-quality-ci.yml as the actual CI-execution point (bash scripts/ci/test_strix_quick_gate.sh, gated on a paths: filter).

Fix

Wires the contract into CI by mirroring the sibling's pattern exactly, rather than deleting a currently-passing guardrail:

• .github/workflows/opencode-fact-gate-quality-ci.yml (new) — triggers on PRs touching opencode-review-dispatch.yml, the contract script itself, or the new workflow file; checks out the exact PR head; runs bash scripts/ci/test_opencode_fact_gate_contract.sh. Shape and pinned action SHAs copied from opencode-rust-coverage-toolchain-quality-ci.yml, the closest existing sibling already gated on the same dispatch workflow's paths.
• tests/test_opencode_fact_gate_quality_ci_contract.py (new) — pins the new workflow's watched paths and its actual invocation line (per this repo's own convention that "contract tests pin workflows AND prose," see test_opencode_rust_coverage_toolchain_contract.py for the established pattern), and additionally runs the shell contract directly via subprocess so a future break is caught by pytest tests itself, not only by the dedicated workflow.
• CHANGELOG.md — Unreleased entry per repo convention.

Scope is kept to exactly this finding: no other workflow, script, or doc is touched, and no fact-gate assertion in the shell script itself was changed.

Verification

Run from a clean clone of origin/main + this branch, per this repo's own commands in CLAUDE.md:

$ bash scripts/ci/test_opencode_fact_gate_contract.sh
OpenCode fact-gate contract OK

$ coverage run -m pytest tests -q
2109 passed, 1 skipped, 21 subtests passed in 98.30s

$ coverage report --show-missing
TOTAL   10390  0  4138  0  100%

$ interrogate
RESULT: PASSED (minimum: 100.0%, actual: 100.0%)

YAML parses cleanly and the new run: block passes bash -n.

Developer experience

Adds one workflow file and one test file; no existing file's behavior changes except the CHANGELOG. Full local test suite (2109 tests), 100% branch coverage over scripts/ci, and 100% docstring coverage (interrogate) all still pass.

User experience

No production runtime change — this is CI-only. The practical effect: a future edit to opencode-review-dispatch.yml that silently drops one of the 15 fact-gate evidence strings (repo-tree evidence, unresolved-thread evidence, escaping, etc.) will now fail CI on this repo instead of merging unnoticed, closing the "hollow path" gap the audit found.

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 3063a21a-fa6d-4e17-a869-28ec4c7f34ea

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

exact-head-path-policy failure: pre-existing main bug, now fixed on this branch too

This PR's exact-head-path-policy check (Strix Changed Path Quality CI) started failing today, but not because of anything in this PR's own diff.

Root cause: scripts/ci/test_strix_quick_gate.sh's assert_opencode_review_uses_codegraph_and_contextual_orchestrator extracted the required-workflow-bootstrap: job block from .github/workflows/opencode-review.yml with awk '/^ required-workflow-bootstrap:$/,/^[^ ]/'. Every job key in that workflow is indented 2 spaces, never column 0, so the /^[^ ]/ end pattern never matched until EOF — the "block" captured was actually the rest of the entire jobs section. An already-merged, unrelated commit (4a5dfd8, PR #1497) added a step-level if: line inside a later, different job; the broken awk swept it into this job's "block" and the assertion wrongly failed. Reproduced identically against unmodified origin/main before any change.

Trigger-type check: .github/workflows/strix-changed-path-quality-ci.yml's exact-head-path-policy job runs on plain pull_request: (not pull_request_target:) and explicitly checks out github.event.pull_request.head.sha — i.e. it runs this PR's own branch copy of test_strix_quick_gate.sh, not main's. So merging the root-cause fix into main alone would not resolve this PR's check.

Root-cause fix: #1506 (targets main, full write-up and validation there).

What I did here: ported the identical one-line awk fix onto this branch directly (commit 25d7e42), validated from a clean isolated clone: bash scripts/ci/test_strix_quick_gate.sh → test_strix_quick_gate: PASS (was FAIL before the fix); coverage run -m pytest tests -q → 2129 passed, 1 skipped, 21 subtests; coverage report --show-missing → 100% on scripts/ci/; interrogate → 100%; bash -n clean.

A re-run of the failed check should now pass.

🤖 Generated with Claude Code

---

Generated by Claude Code

[cwl-noema-review]

Noema LLM review

The PR introduces a new quality gate workflow that wires the fact-gate contract into CI, ensuring that the contract is executed on every pull request that could change the contract script or the dispatch workflow. The workflow is properly configured to watch the contract script and the dispatch workflow, and the contract script is executed correctly. The test suite for the quality gate workflow is also updated to ensure that the contract is executed correctly.

Reviewed changed lines

• .github/workflows/opencode-fact-gate-quality-ci.yml:1 (RIGHT): The workflow is properly configured to watch the contract script and the dispatch workflow.
• .github/workflows/opencode-fact-gate-quality-ci.yml:10 (RIGHT): The workflow is properly configured to execute the contract script.
• tests/test_opencode_fact_gate_quality_ci_contract.py:1 (RIGHT): The test suite for the quality gate workflow is updated to ensure that the contract is executed correctly.

Adversarial validation

• .github/workflows/opencode-fact-gate-quality-ci.yml:1 (RIGHT) falsified: The workflow is not properly configured to watch the contract script and the dispatch workflow. — observed result
• .github/workflows/opencode-fact-gate-quality-ci.yml:10 (RIGHT) falsified: The workflow is not properly configured to execute the contract script. — observed result
• tests/test_opencode_fact_gate_quality_ci_contract.py:1 (RIGHT) falsified: The test suite for the quality gate workflow is not updated to ensure that the contract is executed correctly. — observed result
• Residual risk: low

Findings

• [low] .github/workflows/opencode-fact-gate-quality-ci.yml:1 (RIGHT): The workflow is not properly configured to watch the contract script and the dispatch workflow.

• [low] .github/workflows/opencode-fact-gate-quality-ci.yml:10 (RIGHT): The workflow is not properly configured to execute the contract script.

• [low] tests/test_opencode_fact_gate_quality_ci_contract.py:1 (RIGHT): The test suite for the quality gate workflow is not updated to ensure that the contract is executed correctly.

• Result: APPROVE

• Head SHA: dd9a8b2a2592ad9fd5502f8c943e63bc26acaecd

• Reviewer credential: noema-review-github-app

• Actor: cwl-noema-review[bot]

[seonghobae]

Resolved this PR's merge conflict with current main (was mergeable_state: dirty).

Conflicts (2 files), both mechanical:

• CHANGELOG.md — both sides added entries under ## [Unreleased]; kept both (this PR's fact-gate-wiring entry followed by main's entries), no content dropped.
• scripts/ci/test_strix_quick_gate.sh — both sides independently fixed the same awk job-block-boundary bug (this branch's own commit 25d7e42 had a simpler inline fix; main had since landed a more complete fix via a required_workflow_bootstrap_has_if helper that also closes a grep -q-under-pipefail SIGPIPE gap, and that helper is already called elsewhere in the file). Kept main's version.

Verification on the merged head (1acf9d932, clean Python 3.12 venv, --require-hashes --only-binary=:all:):

• coverage run -m pytest tests -q — 2574 passed, 1 skipped, 21 subtests, 9 failed. All 9 are pre-existing on origin/main itself, not caused by this merge:
  • 2 are the known test_opencode_live_draft_state_regression.py::test_draft_exemption_fails_closed_when_live_head_moved failures tracked by fix(tests): match live-head-moved regression to #1697's intentional reorder #1705 (open, not yet merged as of this check).
  • 7 are in tests/test_opencode_poll_self_retirement.py (a FileNotFoundError on a gh-calls.log tmp fixture) — confirmed by running the identical test file against an unmodified origin/main checkout in an isolated worktree: same 7 failures, same error. Environment/sandbox-specific, unrelated to this PR's diff or the merge.
• coverage report --show-missing — 100% on scripts/ci (11867 stmts, 4842 branches, 0 missing).
• interrogate — 100.0% docstrings.
• bash scripts/ci/test_opencode_fact_gate_contract.sh — OpenCode fact-gate contract OK (this PR's own payload, still passing post-merge).
• bash -n scripts/ci/test_strix_quick_gate.sh — clean.

Pushed the merge commit to this branch. No conflict markers remain; the PR's own new files (.github/workflows/opencode-fact-gate-quality-ci.yml, tests/test_opencode_fact_gate_quality_ci_contract.py) are unchanged.

---

Generated by Claude Code

---

Generated by Claude Code

[seonghobae]

The required "Scheduler, contextual-orchestrator, writer, and conflict-scope contracts" check failed on 1acf9d93 with 9 test failures: 2 in tests/test_opencode_live_draft_state_regression.py (returncode assertion mismatch) and 7 in tests/test_opencode_poll_self_retirement.py (FileNotFoundError on a gh-calls.log fixture path).

Not this PR's diff — #1484 only touches opencode.jsonc, scripts/ci/test_strix_quick_gate.sh, the new opencode-fact-gate-quality-ci.yml/its contract test, and CHANGELOG.md; it never touches either failing test file or the scripts they test. Root cause: this branch was 27 commits behind main. Confirmed both files pass cleanly (32/32) on a fresh origin/main clone — these were already-fixed stale-test issues, not a live regression.

Fix ported, not re-derived: merged origin/main into this branch (1b9885d0), resolving one pure-append CHANGELOG.md conflict. Full suite re-validated post-merge: all tests passed, 100% coverage on scripts/ci/, 100% docstrings. Pushed.

---

Generated by Claude Code

---

Generated by Claude Code