feat: unify Noema, OpenCode, and Strix free-first fallbacks - #760

_{Comment @coderabbitai help to get the list of available commands.}

@coderabbitai review

@opencode-agent @cwl-noema-review exact-current-head review requested for 6c99cbc25bee6e94b61e7fbdad59afd9893e56f9. Please verify the contextual-orchestrator vendor receipt and blob identities, strict manifest parsing, public/private repository eligibility, credential-value non-disclosure, free-before-paid and free-to-free ordering, unchanged Noema/OpenCode/Strix reviewer-auth and transport boundaries, 100% statement/branch coverage evidence, and fail-closed behavior. Submit approval only for this exact head after required checks succeed.

@seonghobae I will review PR #760 at exact head 6c99cbc25bee6e94b61e7fbdad59afd9893e56f9.

I will verify the requested policy, security, boundary, and evidence requirements. I will approve only if the exact-head review and required checks succeed.

OpenCode Review Overview

• Head SHA: 49aacff9e1a4907ae9eae4e64fad5881968a7053
• Workflow run: 30971144855
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 49aacff9e1a4907ae9eae4e64fad5881968a7053.

• Head SHA: 49aacff9e1a4907ae9eae4e64fad5881968a7053

• Workflow run: 30971144855

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (11 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (11 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["CI script (6 files)"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script (6 files)"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test (9 files)"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test (9 files)"]
  R4 --> V4["targeted test run"]

Exact-head security repair at 6396a8217e0e2737295fb40b4d8747b2f2e25343:

• aligned the Strix dependency closure to the reviewed aiohttp==3.14.3 / cryptography==50.0.0 floor;
• retained Git SHA-1 only as the mandatory Git object-identity algorithm, now with usedforsecurity=False and a rule-scoped documented suppression;
• documented the Noema shared-globals loader as executing only the fixed regular non-symlink sibling from the immutable trusted workflow checkout, with an exact rule-scoped suppression;
• added permanent regression contracts for both boundaries.

The previous dependency-review and Semgrep failures were therefore addressed without excluding either file, weakening the scanners, changing reviewer credentials, or changing the free-first execution policy. Fresh exact-head checks remain authoritative, and cross-repository order #96 → #94 → #760 is unchanged.

@opencode-agent @cwl-noema-review Please independently review exact current head 49aacff9e1a4907ae9eae4e64fad5881968a7053. Exact-head Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, and SBOM are successful; the earlier REQUEST_CHANGES targets superseded 6c99cbc25bee6e94b61e7fbdad59afd9893e56f9, and all scanner threads are resolved/outdated. Verify the receipt-pinned contextual-orchestrator source, strict manifest parser, free-before-paid planning, reviewer transport/identity/key preservation, exact rule-scoped trusted-sibling exec exception, no secret-value serialization, and current secure Strix lock. Do not merge until contextual-orchestrator #96 and then #94 have merged and this branch has been reconciled against protected main.