feat(coverage): add bounded PyO3 peer-evidence gate - #789

_{Comment @coderabbitai help to get the list of available commands.}

@opencode-agent address

Integrate the published PyO3 native-extension helper into the protected central OpenCode coverage/review path on this same branch; keep the PR Draft until the integration is complete and exact-head evidence passes.

Mirror the existing fail-closed R peer-evidence pattern rather than creating a second privileged reviewer. Required behavior:

1. In .github/workflows/opencode-review-dispatch.yml, capture each Python pytest/coverage command's complete bounded log and exit status without changing successful behavior.
2. When and only when a Python suite fails, invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest against the exact log, the relevant regular non-symlink pyproject.toml, and the exact base-to-head changed-file list.
3. A successful classification must not be reported as ordinary passing coverage. Publish a distinct compact marker stating that source-only Python collection was deferred exclusively for the unchanged declared PyO3 module and requires exact-head native peer evidence.
4. In the trusted review/approval phase, query live CheckRun objects for the exact PR head and verify the repository-owned Python, Rust/PyO3, and package checks with require-checks. Do not accept statuses, stale heads, queued/cancelled/skipped checks, name lookalikes, duplicate requirements, or predecessor evidence. Preserve the existing R peer gate and all normal failure paths.
5. Approval must remain blocked if the classifier, changed-file trust boundary, check inventory, or required peer check is absent or malformed. The classifier is a deferral classifier, never approval evidence by itself.
6. Add permanent workflow-contract tests covering: pure declared-module collection failure; mixed missing imports; test/setup/teardown/internal/crash/truncated failures; native/Cargo/Rust/stub/packaging/lock/requirements/workflow changes; exact-head successful peer checks; stale/pending/failed/status/lookalike evidence; coexistence with R deferral; coverage summary wording; and approval-gate enforcement.
7. Include the helper and workflow contract tests in permanent Python 3.10/3.14, compilation, 100% production statement/branch coverage, and public-docstring gates. No temporary repair workflow, branch-selected privileged execution, Python compatibility stub, networked PR test, skipped test, synthesized approval, merge, release, or protection change may remain.
8. After exact-head central checks pass, rerun OpenCode/Noema review for unchanged fast-mlsirm heads build(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 #546 d111e2b1341b0daab6b813074c7a7dbcf5c24ff4, fix(deps): protobuf를 aiplatform 호환 범위로 유지 #549 12fc519ca798c8400840f04b3b19c07754ad7dfe, and build(deps): bump google-cloud-bigquery from 3.42.0 to 3.42.2 #550 8db4c235d466446429fc32bdeeef3ca1fdaa8827; do not reuse their failed source-only coverage verdicts.

Update the doctoring and CHANGELOG to distinguish source-only measurement, trusted native peer evidence, and remaining interpretation limits. Preserve immutable called-workflow source, reviewer credentials, NVIDIA/OpenCode model policy, independent approval, unresolved-thread, and branch-protection boundaries.

@jules Implement the remaining central workflow integration on this existing Draft PR. Preserve the published helper and fail-closed trust boundary; do not create another PR or temporary workflow.

Required scope:

• wire python_native_extension_peer_gate.py classify-pytest into .github/workflows/opencode-review-dispatch.yml only after a real bounded Python suite failure, using the exact pytest log, regular non-symlink pyproject, and exact base-to-head changed-file list;
• publish a distinct PyO3 deferral marker rather than ordinary passing coverage;
• in the trusted approval phase, query live exact-head CheckRun records and call require-checks for protected Python, Rust/PyO3, and package peer checks;
• reject stale/pending/failed/status/lookalike/missing/malformed evidence and preserve the existing R deferral independently;
• add permanent workflow-contract tests for classification, changed-boundary rejection, exact-head peer evidence, R/PyO3 coexistence, summary wording, and approval enforcement;
• include the helper and workflow integration in Python 3.10/3.14 compile, 100% statement/branch coverage, public docstrings, actionlint, security, and changelog/doctoring checks.

Do not build PR-selected native code in the central sandbox, add a compatibility stub, skip product tests, use networked PR execution, change reviewer tokens or NVIDIA/OpenCode policy, weaken approval/protection gates, mark Ready, merge, or release. Commit as normal descendants without force-push, and report exact verification commands and the final head SHA.

@jules Implement the remaining integration directly on this branch; do not create any temporary, self-modifying, encoded-patch, or branch-writing workflow.

Required GREEN slice:

1. Wire scripts/ci/python_native_extension_peer_gate.py into .github/workflows/opencode-review-dispatch.yml after the isolated pytest attempt has produced a complete bounded log and exact changed-file inventory.
2. Accept deferral only when classify-pytest proves the sole failure is the exact declared maturin/PyO3 module and require-checks proves trusted exact-head CI::python, CI::rust, and CI::package CheckRuns are completed/successful.
3. Treat classification as deferred peer evidence, never as a passing test; preserve all coverage/docstring gates for the Python-owned changed files and fail closed on mixed failures, native/package/lock/workflow changes, stale or status-only evidence.
4. Add permanent workflow-contract tests covering ordering, trusted workflow/check-name ownership, exact-head binding, malformed evidence, and the fast_mlsirm._core case.
5. Run the focused suite, complete central tests, 100% production statement/branch/docstring evidence, compilation, and exact-head security workflows. Keep Draft until all current-head evidence is GREEN.

After integration, rerun OpenCode review for unchanged fast-mlsirm PRs #546, #549, and #550; predecessor coverage failures are not reusable.

@jules Integrate the committed helper into the central opencode-review-dispatch.yml now; keep this PR Draft until end-to-end exact-head evidence is complete.

Required fail-closed flow:

1. Preserve the current central source-only coverage run and capture its complete bounded combined stdout/stderr plus exit status. On success, continue unchanged.
2. On failure, write the exact base…head changed-file list to a bounded newline file and invoke python_native_extension_peer_gate.py classify-pytest. Deferral is allowed only when that helper proves the sole failure is absence of the exact unchanged maturin/PyO3 module-name; any native/Cargo/stub/packaging/lock/requirements/workflow/maturin-metadata change or mixed pytest failure remains blocking.
3. A successful classification is not a pass. Query CheckRun—not StatusContext—evidence for the exact PR head and invoke require-checks for these exact fast-mlsirm CI jobs before the central review may treat source-only coverage as peer-proven:
   • CI::python
   • CI::rust
   • CI::package
   • CI::gpu-smoke
   • CI::fuzz
     Keep Security Scan and SAST under the existing central gates. Reject absent, pending, failed, stale-head, lookalike-workflow, duplicate-requirement, or malformed evidence.
4. Emit an explicit non-success classification such as coverage_deferred_to_exact_head_native_peer_evidence; do not report the source-only sandbox as passing and do not lower the repository's 100% coverage contract.
5. Add workflow contract tests that exercise the exact fast_mlsirm._core collection failure, successful exact-head peer evidence, stale/pending/failed/status-only/check-name/workflow-name mismatches, native-boundary changes, mixed failures, truncation, and normal pure-Python pytest failures.
6. Re-run the central workflow against current exact heads of fast-mlsirm#546, #549, and #550. The integration is accepted only if those previously blocked Python-only PRs receive no coverage CHANGES_REQUESTED, while a synthetic native-code change and mixed pytest failure still block.

Do not build PR-selected native code inside the central sandbox, introduce a Python stub, auto-approve, weaken required checks, use COPILOT_GITHUB_TOKEN, or disturb the existing reviewer-agent secret contract. Update APA 7 doctoring and the authoritative changelog after GREEN.

@coderabbitai Review the current Draft head 68e8b1695280d11c58b5553457442527f9d0542c specifically as an implementation-design review for the remaining PyO3 workflow integration. Do not approve, mutate, or merge. Identify the exact existing R-deferral variables/functions/approval gates in .github/workflows/opencode-review-dispatch.yml, and provide a minimal patch plan that reuses them for python_native_extension_peer_gate.py while preserving ordinary Python failures, exact-head CheckRun validation, R/PyO3 coexistence, and all immutable-source/credential boundaries. Flag any defect in the published helper or tests before integration.

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 5 minutes and 1 seconds before sending another message.

@opencode-agent

Prepare the next bounded integration only after .github#759 produces a GREEN exact head, because both changes touch the authoritative coverage workflow and stale-base integration would reintroduce or overwrite the LLVM runtime-boundary repair.

For the eventual current-main integration:

• invoke python_native_extension_peer_gate.py classify-pytest only after a real pytest collection failure has been captured completely and before converting that failure into deferred peer-evidence requirements;
• write changed paths from the exact base/head diff into a bounded regular file;
• require the declared maturin/PyO3 module and refuse deferral for every native, packaging, dependency, workflow, stub, or metadata change already covered by the helper;
• query CheckRun evidence from trusted GitHub metadata and require exact current head plus repository-owned Python, Rust/PyO3, and package checks, all completed/successful; statuses, stale heads, duplicates, lookalikes, and missing evidence remain blocking;
• keep classification explicitly non-passing until peer checks are proven;
• add permanent workflow-ordering, permission, exact-head, and fail-closed contracts; execute/cover/compile the helper through the exact-head quality lane;
• rerun fast-mlsirm#546 only after the central integration merges.

Keep Draft. Do not mutate the authoritative workflow from the pre-#759 base, approve, or merge.

@jules Implement the existing TDD RED workflow contracts on exact live head 5bc9ba4070866934ed819c2ff06f209b785d7b88 as normal descendant commits. Keep this PR Draft. Do not amend, rebase, force-push, create a repair workflow, mark Ready, merge, release, change branch protection, change reviewer credentials, or alter NVIDIA/OpenCode model policy.

Precondition: before every write, re-read the live head and stop without mutation unless it is the expected current head or your own direct descendant.

Coverage integration

In .github/workflows/opencode-review-dispatch.yml, preserve the existing sandbox, run_and_capture, R deferral, immutable-source, credential, and publication boundaries. Add a separate Python-suite runner that uses the identical timeout --kill-after=20 900 setpriv ... low-privilege environment but retains the complete bounded log long enough to classify a real nonzero Python suite exit.

Initialize exactly:

python_native_peer_check_required=0

Only after a Python configured/default pytest/coverage command actually fails:

1. snapshot changed_files_for_coverage to a bounded regular file;
2. require the relevant ${project_dir}/pyproject.toml to be regular and non-symlink;
3. invoke the trusted helper:

python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
  --log "$log_file" \
  --pyproject "$project_dir/pyproject.toml" \
  --changed-files "$changed_files_file" \
  --repo-root "$COVERAGE_SOURCE_WORKDIR"

4. on classifier success, do not report ordinary PASS and do not increment failures; emit a distinct section containing all these literal contracts:

### Python native-extension source-only deferral
- Result: DEFERRED
the unchanged declared PyO3 module was unavailable in the source-only sandbox
exact-head Python, Rust/PyO3, and package CheckRuns

and set python_native_peer_check_required=1;
5. on classifier rejection, retain the ordinary exact exit failure and increment failures;
6. any other Python suite failure in the same run remains blocking.

In the compact PASS decision, when the variable is 1, emit exactly:

- Python native-extension peer evidence: deferred source-only collection requires successful exact-head peer checks

Do not build/install PR-selected native code, add a Python stub, skip tests, or grant network access.

Approval integration

Mirror—but do not replace—the existing R peer-check pattern. Add independent functions that:

• detect only the exact compact Python deferral marker;
• query the live PR statusCheckRollup immediately before approval and normalize only CheckRun nodes with __typename, workflow name, check name, exact trusted $HEAD_SHA, status, and conclusion into a bounded JSON file;
• call:

python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" require-checks \
  --checks-json "$checks_file" \
  --head-sha "$HEAD_SHA" \
  --required-check "CI::python" \
  --required-check "CI::rust" \
  --required-check "CI::package"

• reject missing, pending, failed, skipped, cancelled, stale, status-only, lookalike, malformed, or lookup-failed evidence.

Call this gate in both approval paths that already call require_r_cmd_check_for_deferred_coverage: the deterministic model-unavailable blocker path and the normal APPROVE path. R and PyO3 deferrals must coexist independently. On failure, leave review state unchanged with a bounded WAITING_FOR_PYTHON_NATIVE_PEER_CHECKS explanation; never synthesize approval.

Permanent tests and verification

Make the current tests GREEN without weakening them:

python -m pytest -q \
  tests/test_python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate_nested_project.py \
  tests/test_python_native_extension_peer_gate_workflow_contract.py

Then run the permanent Python 3.10/3.14 quality workflow, focused and complete 100% production statement/branch coverage, interrogate 100%, compileall, actionlint, full central tests, security and supply-chain checks. Fix actual failures only. Preserve CHANGELOG.md and docs/doctoring/python-native-extension-peer-evidence.md; update them only where integration semantics or verified limitations changed.

After GREEN, report the exact final SHA and verification commands in a PR comment. Do not request approval or change Draft state.

Exact-head quality run 31133025300 confirms the intended integration RED: 87 focused tests passed and only the three workflow-contract tests failed because opencode-review-dispatch.yml still lacks python_native_peer_check_required, the distinct source-only deferral summary, and trusted require-checks enforcement. Python 3.10 compatibility passed; all security workflows passed.

@jules Implement the central workflow integration now rather than weakening these tests. Preserve the existing R peer gate and privileged reviewer chain. After GREEN, run full central coverage/docstrings/actionlint and replay OpenCode review against exact fast-mlsirm heads #546, #549, and #550.

@opencode-agent address

Fix the exact current-head quality failure on 5bc9ba4070866934ed819c2ff06f209b785d7b88 by completing the integration already required by this Draft PR; do not weaken or delete the three failing workflow-contract tests.

Run 31133025300, job 92726135563, proves 87/90 focused tests pass and these exact contracts remain RED:

1. python_native_peer_check_required=0 and the bounded classify-pytest invocation are absent from .github/workflows/opencode-review-dispatch.yml;
2. the coverage artifact lacks the distinct ### Python native-extension source-only deferral, - Result: DEFERRED, and exact-head peer-check requirement text;
3. the approval phase does not yet call require-checks for CI::python, CI::rust, and CI::package against PR_HEAD_SHA using live GraphQL CheckRun evidence.

Implement the documented fail-closed flow:

• initialize python_native_peer_check_required=0 and keep ordinary source-test failure authoritative;
• only after a real Python pytest failure, call scripts/ci/python_native_extension_peer_gate.py classify-pytest with the bounded pytest log, changed-file list, --repo-root "$COVERAGE_SOURCE_WORKDIR", and exact --pyproject "$project_dir/pyproject.toml";
• if and only if that classifier succeeds, serialize a distinct DEFERRED section, never PASS, stating the unchanged declared PyO3 module was unavailable in the source-only sandbox and that exact-head Python, Rust/PyO3, and package CheckRuns are mandatory;
• pass this state into the trusted approval job;
• query current live check runs, preserve __typename, require actual CheckRun values, and call the helper's require-checks for CI::python, CI::rust, and CI::package with --head-sha "$PR_HEAD_SHA";
• retain R CMD check deferral logic independently;
• reject mixed failures, changed native/package/workflow boundaries, missing/pending/failed/stale/status-only/lookalike evidence, malformed metadata, or any classifier error;
• keep all source handling read-only and bounded, no PR-selected build/install, no Python native stub, no token weakening, no approval or merge inside the helper.

After GREEN, run all 90 focused tests at 100% statement/branch coverage, the complete central suite, interrogate 100%, compileall, actionlint, Python 3.10 compatibility, security workflows, and exact-head review. Keep Draft, needs-revision, do-not-merge, and no auto-merge until integration and a live fast-mlsirm proof run are complete.

@jules Implement the missing production integration on current branch fix/pyo3-native-peer-gate; do not create a separate workflow-only substitute. Wire scripts/ci/python_native_extension_peer_gate.py into .github/workflows/opencode-review-dispatch.yml after the isolated pytest log and exact changed-file inventory exist. Deferral must remain non-PASS evidence and require exact-head successful trusted CheckRuns CI::python, CI::rust, and CI::package; preserve all Python coverage/docstring gates and the independent R peer gate; fail closed on mixed/native/package/lock/workflow changes or malformed/stale/status-only evidence. Add permanent ordering/ownership/exact-head workflow-contract tests, run focused/full quality and security, and keep Draft.

@opencode-agent address

Implement the committed workflow-integration RED contract on this Draft branch. Do not weaken the helper or tests. Preserve the existing R peer gate and reviewer credential chain.

The central coverage job must capture bounded combined pytest output and status, classify only the exact unchanged maturin/PyO3 module-absence collection failure, then require trusted exact-head CheckRun success for CI::python, CI::rust, CI::package, CI::gpu-smoke, and CI::fuzz. StatusContext, stale heads, lookalike workflow/check names, pending/failed/missing/malformed evidence, native-boundary changes, and mixed failures remain blocking. Emit an explicit non-success source-only deferral classification; never call it passing, never build PR-selected native code, and never auto-approve.

After GREEN, run the permanent workflow contracts, full central coverage/docstrings/actionlint/security, then replay exact current heads of fast-mlsirm #546, #549, and #550.

@jules Apply and remove the committed one-shot patcher scripts/ci/apply_pyo3_peer_gate_workflow_integration.py on the current branch, then run the exact verification below and commit the resulting ordinary source changes. Do not force-push, mark Ready, merge, or weaken tests.

python3 scripts/ci/apply_pyo3_peer_gate_workflow_integration.py
rm scripts/ci/apply_pyo3_peer_gate_workflow_integration.py
python3 -m coverage erase
python3 -m coverage run --branch -m pytest -q \
  tests/test_python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate_nested_project.py \
  tests/test_python_native_extension_peer_gate_workflow_contract.py
python3 -m coverage report \
  --include=scripts/ci/python_native_extension_peer_gate.py \
  --show-missing --fail-under=100
python3 -m pytest -q \
  tests/test_opencode_agent_contract.py \
  tests/test_repository_branch_coverage_review_schedulers.py
python3 -m compileall -q \
  scripts/ci/python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate_nested_project.py \
  tests/test_python_native_extension_peer_gate_workflow_contract.py

The reviewed local proof is 91 focused tests and 100% helper statement/branch coverage. The patch also removes the temporary source-snapshot workflow and the duplicate quality workflow. Keep only python-native-extension-peer-gate-quality-ci.yml, then run its actionlint/complete-suite gates on the pushed exact head.

@opencode-agent address

The branch now contains scripts/ci/apply_pyo3_peer_gate_workflow_integration.py, which is only an intermediate patch plan and is not an accepted product artifact. Apply its reviewed transformations as ordinary commits to .github/workflows/opencode-review-dispatch.yml, permanent workflow-contract tests, doctoring, and CHANGELOG; correct any integration defects found by the real suites; then delete the patcher itself. Keep tests/test_python_native_extension_peer_gate_requirements_directory.py GREEN by making direct .txt/.in children of a directory named requirements block deferral. Do not add a branch-writing workflow, trigger, compatibility stub, skipped tests, or duplicated reviewer. Run actionlint, focused/full Python 3.10/3.14, 100% production statement/branch coverage, docstrings, security/supply-chain, and keep Draft.

@jules @opencode-agent The implementation patcher remains committed at exact head e92ed9f5f3aad6f0f49744109cbf1984a71e288b and has not yet been applied. Execute python3 scripts/ci/apply_pyo3_peer_gate_workflow_integration.py, remove the patcher, run the exact 91-test/100%-coverage verification from comment 5210490512, and push one ordinary descendant commit. Do not add another workflow, force-push, mark Ready, merge, or alter protections. This is the active integration blocker for current-head OpenCode approvals in fast-mlsirm.

/oc

Complete the current Draft PR by applying the already reviewed permanent integration directly; do not add or retain another one-shot/branch-writer workflow.

1. Run the logic represented by scripts/ci/apply_pyo3_peer_gate_workflow_integration.py against .github/workflows/opencode-review-dispatch.yml, then remove the integration script from the final tree.
2. Preserve the bounded classifier contract: only unchanged declared maturin/PyO3 module absence during complete pytest collection may become distinct DEFERRED evidence; mixed imports, real test failures, changed native/packaging/lock/workflow surfaces, malformed logs, unsafe paths, and missing exact-head peer CheckRuns remain blockers.
3. Require live exact-head CheckRun evidence for Python, Rust/PyO3, and package workflows before approval; a classifier result alone is never PASS.
4. Remove duplicate or temporary integration workflow machinery that is not part of the permanent control plane. Keep only the permanent quality workflow(s) necessary to enforce the integrated contract.
5. Run all focused peer-gate tests (including file safety, nested projects, requirements-directory cases, and workflow contracts), the complete central statement/branch coverage and docstring gates, Python 3.10/3.14 compilation, actionlint, and git diff --check.

Keep Draft until a workflow-free exact head is green. Do not build PR-selected native code in the central sandbox, alter reviewer credentials, weaken branch protection, or introduce COPILOT_GITHUB_TOKEN.

@opencode-agent address

Exact head e92ed9f5f3aad6f0f49744109cbf1984a71e288b has Python 3.10 compatibility plus Security, SAST, CodeQL, Secret Scan, OSV, Scorecard, SBOM, and Python Security green. The Python 3.14 quality gate fails only the three committed protected-workflow integration contracts (87 passed, 3 failed):

• missing python_native_peer_check_required=0 and bounded failed-suite classifier path;
• missing distinct ### Python native-extension source-only deferral evidence;
• missing trusted approval enforcement for exact-head peer CheckRun evidence.

Apply the reviewed integration directly to .github/workflows/opencode-review-dispatch.yml; do not leave scripts/ci/apply_pyo3_peer_gate_workflow_integration.py or either duplicate/temporary snapshot-quality workflow in the final diff. CI must validate committed source, never rely on a one-shot source-rewriting patcher.

Preserve the existing R peer gate and reviewer credential chain. The PyO3 classifier is a non-success deferral only. Approval must query live exact-head CheckRun records and require successful CI::python, CI::rust, CI::package, CI::gpu-smoke, and CI::fuzz; reject StatusContext, stale heads, lookalikes, pending/failed/skipped/missing/malformed evidence, mixed pytest failures, and native-boundary changes. Do not build PR-selected native code or add a compatibility stub.

After direct integration, delete the patcher and temporary workflows, update permanent workflow contracts/doctoring/changelog, run Python 3.10/3.14, complete central tests, 100% production statement/branch coverage, docstrings, compilation, actionlint, security and supply-chain gates on one unchanged head. Keep Draft until GREEN.

@opencode-agent address

The branch has been reduced to a reviewable permanent-source state at exact head 0948976a88888b8a06e27b42a4689bc5b478d59a: the PR-wide source snapshot, PR-controlled integration patcher, and duplicate quality workflow have been deleted. Do not recreate any source snapshot, self-removing workflow, patch generator, branch writer, or compatibility stub.

Complete the vertical slice through ordinary reviewed commits only:

1. Integrate scripts/ci/python_native_extension_peer_gate.py directly into the authoritative .github/workflows/opencode-review-dispatch.yml.
2. A source-only pytest failure may become DEFERRED, never PASS, only when the bounded classifier proves complete collection failure caused exclusively by the unchanged exact dotted maturin/PyO3 module-name being unavailable.
3. Refuse deferral when any Rust/Cargo/native crate or stub, Python packaging/build metadata, dependency lock/requirements, GitHub workflow/action, maturin metadata, unsafe path, mixed import, test/setup/teardown/internal error, crash, truncation, or malformed evidence is present.
4. Snapshot and hash the exact project pyproject.toml and changed-file list before untrusted tests; revalidate them before classification. Support nested projects without allowing path escape, symlink substitution, or ambient working-directory drift.
5. Emit one stable source-text-free peer-evidence marker. The final review path must then require live GraphQL CheckRun evidence on the literal current head for the repository's authoritative Python, Rust/PyO3, and package checks. Reject status contexts, stale SHA, pending/failed/skipped/cancelled checks, lookalike workflow/check names, missing or duplicate requirements, malformed GraphQL, pagination truncation, and absent workflow identity.
6. Preserve the existing R-package peer gate independently; one deferral must not satisfy another language's evidence contract.
7. No PR-selected native build, network access, test skip, approval, branch update, merge, release, or protection change may be introduced.
8. Keep only .github/workflows/python-native-extension-peer-gate-quality-ci.yml as the permanent quality workflow. Expand its path filters, Python 3.10/3.14 compile/tests, complete central tests, 100% production statement/branch/docstrings, actionlint, clean-worktree checks, and immutable/hash-locked dependencies to cover all permanent helper, workflow-contract, nested-project, file-safety, requirements-directory, doctoring, and changelog files.
9. Update APA 7 doctoring and authoritative CHANGELOG.md; remove obsolete text claiming integration remains future work.

Prove the exact fast-mlsirm._core source-only failure shape is RED on protected main, GREEN only after the ordinary integration, then rerun all current-head quality/security/supply-chain and independent-review gates. Keep Draft and merge-block labels until complete.

@opencode-agent address

Integrate the published PyO3 deferral helper into the permanent central workflow on exact current Draft head 0948976a88888b8a06e27b42a4689bc5b478d59a. Quality run 31139377250 has 87 passing focused tests and exactly three RED workflow-contract failures; Python 3.10 compatibility and all completed security/supply-chain gates are green. The helper itself is present, but .github/workflows/opencode-review-dispatch.yml still lacks the integration.

Required bounded implementation:

1. Initialize a stable python_native_peer_check_required=0 state in the coverage measurement path. Capture every supported Python pytest/coverage command's complete bounded log and exact exit status without changing successful behavior.
2. Only after a real Python suite failure, locate the relevant regular non-symlink pyproject.toml under the validated repository root and invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest with the exact log and exact base-to-head changed-file list. Never classify setup/tool-install failures or successful runs.
3. On successful classification, set the peer-evidence requirement and emit a distinct ### Python native-extension source-only deferral section. Do not serialize it as passing Python coverage; state that collection was deferred solely for the unchanged declared PyO3 module and still requires exact-head native peer checks.
4. In the trusted approval phase, query live CheckRun records for the exact PR head and call the helper's require-checks path for repository-owned Python, Rust/PyO3, and package checks. Reject statuses, stale heads, pending/failed/cancelled/skipped checks, workflow/check-name lookalikes, duplicate requirements, missing/malformed evidence, and predecessor runs.
5. Preserve the existing R source-only deferral independently. Normal Python failures, classifier rejection, changed native/Cargo/Rust/stub/packaging/lock/requirements/workflow boundaries, missing check inventory, or any peer-check failure must continue to block approval.
6. Keep the permanent three focused suites, complete central 100% statement/branch/docstring gates, Python 3.10/3.14 compilation, actionlint, security, and clean-tree checks. Remove no RED assertion and add no branch-selected privileged execution, compatibility stub, networked PR test, generated patcher, transient workflow, reviewer credential change, model-policy change, synthesized approval, merge, release, or protection change.

Run:

python -m coverage erase
python -m coverage run -m pytest -q \
  tests/test_python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate_nested_project.py \
  tests/test_python_native_extension_peer_gate_workflow_contract.py
python -m coverage report
pytest -q
python -m interrogate scripts/ci
python -m compileall -q scripts/ci tests

Then rerun exact-head CodeQL, Python Security, SAST, Security Scan, Secret Scan, OSV, Scorecard, SBOM, CodeRabbit/OpenCode/Noema. Keep Draft until the complete unchanged head is GREEN and independently approved.

Additional current-head hardening before GREEN:

• _read_bounded_regular() currently performs is_file() / is_symlink() / stat() / read_bytes() as separate path operations. A caller-controlled path can be replaced between validation and read. Replace this with one fail-closed descriptor-bound read (os.open with O_RDONLY | O_CLOEXEC | O_NOFOLLOW where available, fstat, regular-file and size checks, bounded reads, EOF/size revalidation) and tests for post-check symlink/file replacement. Do not echo path content or exception text.
• Bind pyproject.toml, pytest log, changed-file list, and check JSON through that same primitive. The outer workflow hash check does not remove the helper's standalone trust obligation.
• Define rerun semantics for duplicate exact-head CheckRun records. Do not silently accept an arbitrary member. Either require exactly one authoritative workflow/check context after GraphQL normalization, or bind the accepted record to an explicit latest run/attempt identity while rejecting older, ambiguous, and status-only evidence. Add a regression proving that a stale successful run cannot authorize a current failed or pending rerun and that an obsolete failure cannot permanently block a later uniquely authoritative success.

Preserve 100% branch coverage and Python 3.10 compatibility.

@opencode-agent address

Complete the permanent integration for exact head 0948976a88888b8a06e27b42a4689bc5b478d59a through ordinary reviewed commits. Do not add a trigger, repair, materializer, self-modifying, encoded-patch, or branch-writing workflow.

Wire scripts/ci/python_native_extension_peer_gate.py into .github/workflows/opencode-review-dispatch.yml without weakening the existing source-only sandbox:

• initialize python_native_peer_check_required=0;
• capture the real failed pytest collection log and exact changed-file list into bounded files;
• invoke classify-pytest only after a nonzero Python test result, with --repo-root "$COVERAGE_SOURCE_WORKDIR", the selected project --pyproject, and exact changed-file evidence;
• allow only the helper's proven unchanged maturin/PyO3 native-module collection failure to become a distinct ### Python native-extension source-only deferral section with - Result: DEFERRED;
• never serialize deferral as passing test evidence and never approve from the classifier alone;
• propagate python_native_peer_check_required to the trusted approval phase;
• query live GitHub CheckRun records at the exact PR_HEAD_SHA and require unambiguous completed-success checks for CI::python, CI::rust, and CI::package via the helper's require-checks command before approval;
• reject statuses, stale heads, lookalikes, pending/failing/missing/duplicate evidence, and preserve the existing R CMD peer-check path;
• keep all repository, dependency, native-source, lockfile, packaging, workflow/action, unsafe-path, symlink, hard-link, descriptor, and source-root exclusions fail closed.

Update the permanent workflow contracts, quality workflow path/test/compile coverage for every current helper/test/doctoring file, authoritative doctoring and CHANGELOG. Run Python 3.10 compatibility, Python 3.14 focused and complete tests, 100% production statement/branch/docstrings, actionlint, compilation, all security/supply-chain gates, and keep Draft until the workflow-free exact head succeeds.

/opencode

Continue directly on fix/pyo3-native-peer-gate at exact RED head 0948976a88888b8a06e27b42a4689bc5b478d59a; do not open a stacked PR, do not update main, and do not add any one-shot/self-modifying branch writer.

The helper tests pass, but the permanent workflow-contract tests correctly fail because the gate has not yet been integrated into .github/workflows/opencode-review-dispatch.yml. Apply the intended integration test-first and keep the PR Draft until the new exact head is green:

1. In the isolated Python coverage path, initialize a distinct python_native_peer_check_required=0 state and invoke scripts/ci/python_native_extension_peer_gate.py only after a real repository Python test/collection failure. Pass the validated repository root and bounded captured pytest log; never invoke the classifier after a passing suite.
2. Treat a successful classifier result only as ### Python native-extension source-only deferral, never as ordinary PASS. Preserve the original failure output and set the peer-evidence requirement explicitly.
3. Before APPROVE, require live same-head successful CheckRun evidence for all repository-declared Python, Rust/PyO3, and package/build checks. Verify exact head_sha, trusted workflow/check names, completed status, success conclusion, uniqueness, and the declared maturin/PyO3 module identity. Reject status-only, stale, lookalike, duplicate, missing, pending, failed, or malformed evidence.
4. Keep every existing no-network/no-credential sandbox boundary, exact-head materialization, unsupported/mixed failure rejection, unsafe-path rejection, source/lock/workflow-change exclusions, 100% statement/branch coverage, public docstrings, and bounded diagnostics unchanged.
5. Do not delete or weaken tests/test_python_native_extension_peer_gate_workflow_contract.py; make its three current RED assertions pass through the canonical production integration. Keep only the permanent quality workflow already present on this branch.

Run the focused helper and workflow-contract suite first, then the complete central quality/coverage/docstring/compile/actionlint/security suite. Commit the minimal integration directly to the current branch.

@opencode-agent Complete the missing permanent workflow integration on current Draft head 0948976a88888b8a06e27b42a4689bc5b478d59a.

Exact failure evidence: quality run 31139377250, job 92745853221, has 87 passing tests and exactly three failing workflow contracts because .github/workflows/opencode-review-dispatch.yml does not yet contain python_native_peer_check_required, the distinct ### Python native-extension source-only deferral evidence marker, or exact-head Python/Rust/package CheckRun enforcement.

Implement the bounded integration directly in permanent source:

• initialize an independent python_native_peer_check_required=0 state beside, not replacing, the existing R peer state;
• route configured/project/root pytest coverage failures through the bounded repo-root-aware classifier only after the actual source-only pytest command fails;
• preserve complete captured evidence; serialize a successful classifier result as DEFERRED, never PASS, with the exact distinct marker required by the permanent tests;
• continue treating mixed imports, test/setup/teardown/internal errors, crashes, truncation, unsafe paths, changed Rust/Cargo/native/packaging/lock/workflow/maturin inputs, and malformed metadata as ordinary failures;
• in the trusted approval phase, collect live CheckRun records for the literal current head and require exact successful CI::python, CI::rust, and CI::package evidence through python_native_extension_peer_gate.py require-checks before a deferred coverage result can authorize approval;
• keep status-only, pending, failed, stale-head, lookalike, missing, duplicated, or malformed records fail-closed;
• preserve the existing R deferral path independently;
• include .github/workflows/opencode-review-dispatch.yml in the permanent quality workflow triggers and final PR diff;
• add no patcher, temporary, self-removing, branch-writing, encoded-payload, or model-executing workflow.

Run the focused 90-test gate, complete central 100% statement/branch coverage, production docstrings, Python 3.10/3.14 compilation, actionlint, and clean-tree verification. Keep Draft; do not approve, merge, tag, release, or publish.

/oc

Complete the missing permanent workflow integration on exact head 0948976a88888b8a06e27b42a4689bc5b478d59a; the focused quality run has 87 behavior tests green and only the three intentional workflow-contract tests RED because .github/workflows/opencode-review-dispatch.yml still lacks the peer-gate path.

Directly integrate the bounded classifier and approval evidence into the permanent review workflow:

• initialize python_native_peer_check_required=0 and related exact module/repository evidence before coverage classification;
• invoke scripts/ci/python_native_extension_peer_gate.py only after a real complete Python collection failure, passing the bounded repository root and exact changed-path/evidence inputs;
• serialize a distinct ### Python native-extension source-only deferral section; never convert it to ordinary PASS coverage;
• set the peer-check-required flag only for a valid exclusive declared-module absence classified as deferred;
• before formal approval, query live CheckRun records for the exact current head and require the configured Python, Rust/PyO3, and package workflow/check names to be completed successfully; reject stale, pending, failed, status-only, lookalike, missing, or duplicate evidence;
• preserve every existing branch, coverage, exact-head, credential, dependency, native-fuzz, and reviewer gate, and do not build PR-selected native code in the central sandbox.

Run all five focused peer-gate test files, complete central statement/branch coverage and production docstrings, Python 3.10/3.14 compilation, actionlint, and git diff --check. Keep the ten-file permanent scope plus the required modification to .github/workflows/opencode-review-dispatch.yml; do not add helper or branch-writer workflows.

@opencode-agent address

Apply the exact-current-head integration request already specified for 0948976a88888b8a06e27b42a4689bc5b478d59a directly on fix/pyo3-native-peer-gate. The three permanent workflow-contract failures are the acceptance tests: add distinct python_native_peer_check_required=0 state, emit ### Python native-extension source-only deferral only after a real Python suite failure classified by python_native_extension_peer_gate.py, and require live exact-head successful Python + Rust/PyO3 + package CheckRun evidence before approval while preserving the independent R peer gate. Do not create another PR, temporary writer workflow, native compatibility stub, skipped test, networked PR execution, synthesized approval, or merge. Run focused contracts first, then full 100% statement/branch/docstring, Python 3.10/3.14, actionlint, and security gates; commit normal descendants to this branch and keep Draft.

@jules Complete this existing Draft PR in place on fix/pyo3-native-peer-gate; do not create another PR, retain temporary transformers, or weaken the source-only sandbox.

Exact head 0948976a88888b8a06e27b42a4689bc5b478d59a has three focused workflow-contract failures because .github/workflows/opencode-review-dispatch.yml is not wired to the already-GREEN helper. Implement the permanent integration required by tests/test_python_native_extension_peer_gate_workflow_contract.py:

1. Initialize python_native_peer_check_required=0 in the coverage path.
2. Only after the ordinary Python suite exits nonzero, capture the complete bounded pytest log and exact authenticated base-to-head changed-path list into the expected python_native_pytest_log and python_native_changed_files artifacts/files; invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest with the exact project pyproject.toml, --repo-root "$COVERAGE_SOURCE_WORKDIR", and the same changed-file inventory.
3. If and only if classification succeeds, keep coverage distinct and nonpassing: set the peer requirement flag, write the exact ### Python native-extension source-only deferral / - Result: DEFERRED summary, state that the unchanged declared PyO3 module was unavailable in the source-only sandbox, and require successful exact-head Python, Rust/PyO3, and package CheckRuns. Any rejected classification remains the original blocking Python failure.
4. In the trusted approval phase, when python_native_peer_check_required is set, query live exact-head CheckRun objects (not status contexts or prose) and invoke require-checks with --head-sha "$PR_HEAD_SHA" plus exact trusted requirements CI::python, CI::rust, and CI::package. Preserve the independent R peer gate and require both when both deferrals apply.
5. Reject stale/pending/failed/cancelled/skipped/neutral/status-only/lookalike/missing/malformed evidence. Do not build/install PR-selected native code, add a stub, expose credentials, change reviewer identities, use COPILOT_GITHUB_TOKEN, or grant update/approval/merge/release authority.

Also update the focused quality step to execute every permanent peer-gate test now in this PR, including file-safety and requirements-directory regressions, before the complete central suite. Run Python 3.10/3.14, 100% production statement/branch coverage, 100% public docstrings, compilation, actionlint, clean generated state, and all exact-head security/SAST/supply-chain gates. Keep Draft until the integrated unchanged head is fully GREEN; do not approve, mark Ready, merge, or release.

@opencode-agent address

Exact head 0948976a88888b8a06e27b42a4689bc5b478d59a is intentionally RED only because the permanent helper is not integrated into .github/workflows/opencode-review-dispatch.yml. Python Native Extension Peer Gate Quality CI run 31139377250, job 92745853221, reports 3 failed, 87 passed; Python 3.10 compatibility and every security/supply-chain workflow are successful.

Implement the three already-committed workflow contracts directly, without a patch artifact or writer workflow:

1. Initialize python_native_peer_check_required=0 beside r_peer_check_required=0 in the isolated coverage runtime.
2. Capture each real failed Python pytest invocation to a bounded regular log and an exact changed-file list. Only after an actual pytest failure, call:

python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
  --repo-root "$COVERAGE_SOURCE_WORKDIR" \
  --pyproject "$project_dir/pyproject.toml" \
  --pytest-log "$python_native_pytest_log" \
  --changed-files "$python_native_changed_files"

A successful classification must not become PASS. Emit the exact separate section ### Python native-extension source-only deferral, - Result: DEFERRED, state that the unchanged declared PyO3 module was unavailable in the source-only sandbox, set python_native_peer_check_required=1, and retain the failed-suite evidence for the final trusted peer-check gate. Every nonexclusive/malformed/mixed/error case remains an ordinary coverage failure.
3. In the trusted approval phase, when python_native_peer_check_required=1, query live GraphQL CheckRun evidence on literal $PR_HEAD_SHA and invoke the helper's require-checks command with exactly:

--required-check "CI::python"
--required-check "CI::rust"
--required-check "CI::package"

Require unique authoritative completed-success CheckRuns, never status contexts or stale/ambiguous reruns. Keep the R peer gate independent. A source-only deferral remains blocking until all three exact-head peer checks pass.

Also implement the previously requested descriptor-bound O_NOFOLLOW/fstat bounded read primitive and explicit latest-rerun semantics before GREEN. Preserve no-network source execution, no PR-selected native build, no stub, no skip, exact-head binding, 100% branch/docstrings, and all existing approval/security boundaries. Add no temporary workflow, source snapshot, patch generator, or branch writer.

@opencode-agent address

Implement the already-specified permanent central workflow integration on this same Draft branch and exact helper contract. Wire source-only PyO3 classification into the failed Python coverage path; publish DEFERRED rather than PASS; require live exact-head CheckRun success for CI::python, CI::rust, and CI::package during approval; preserve the independent R peer gate; add every focused workflow contract to the quality job; and keep all native-code, credential, reviewer-identity, branch-protection, and no-COPILOT_GITHUB_TOKEN boundaries unchanged. Do not create another PR or temporary repair machinery. Run the focused three failing contracts first, then Python 3.10/3.14, full suite, 100% coverage/docstrings, actionlint, and exact-head security gates. Keep Draft.

@opencode-agent

Continue development on the live Draft head 0948976a88888b8a06e27b42a4689bc5b478d59a. There are currently no submitted reviews or unresolved inline threads, so preserve Draft and complete the intentionally missing integration rather than treating the helper-only slice as mergeable.

Implement test-first, directly in permanent authoritative sources only:

1. Wire scripts/ci/python_native_extension_peer_gate.py into the central OpenCode coverage/approval path so native-extension collection deferral is considered only after a complete source-only pytest collection failure exclusively caused by the exact declared maturin/PyO3 module being absent.
2. Require trusted peer evidence bound to the same exact PR head: successful repository Python coverage, Rust/PyO3 native test, and package/build surfaces as explicitly named workflow/check contracts. Pending/failed/stale/status-only/lookalike/duplicate/malformed evidence must fail closed.
3. Never classify actual test failures, mixed missing imports, setup/teardown/internal pytest errors, crashes/truncation, unsafe paths, Rust/Cargo/native/package/lock/requirements/workflow/maturin changes, or incomplete metadata as deferrable.
4. Do not build or import PR-selected native code inside the central source-only coverage sandbox, do not enable network/model secrets there, and do not turn deferral into passing evidence; it may only allow the independently trusted exact-head peer gates to satisfy the native boundary.
5. Add permanent workflow-contract/regression tests that first fail without the integration, then pass after the source repair. Keep production statement/branch coverage and public docstrings at 100%, compile cleanly, update CHANGELOG and APA 7 doctoring, and remove any temporary writer/repair workflow before the final head.
6. After GREEN, rerun the real downstream ContextualWisdomLab/fast-mlsirm#546 exact-head review/coverage path and record only same-head evidence. Do not approve, merge, or release from the write-capable repair identity.

@jules Complete the declared integration slice directly on the Draft branch. Exact head 0948976a88888b8a06e27b42a4689bc5b478d59a; focused run 31139377250, job 92745853221, proves the helper is implemented and covered but the authoritative OpenCode workflow is not wired. The three failing permanent assertions require all of the following:

1. Initialize python_native_peer_check_required=0 in the isolated coverage measurement state.
2. When—and only when—the bounded classifier accepts a complete pytest collection failure caused exclusively by the declared maturin/PyO3 native module being absent, set the flag to 1, preserve the classifier's structured evidence, and record a distinct ### Python native-extension source-only deferral section. Never serialize this as ordinary passing coverage and never reduce the normal failure count for any mixed/import/test/setup/internal/crash/truncated case.
3. Propagate the flag/evidence across the authenticated sandbox-output boundary without exposing source or credentials.
4. In the trusted approval phase, if deferral is required, verify live GitHub CheckRun evidence for the exact current head and the exact allowlisted Python, Rust/PyO3, and package workflows/check names; require completed+success for all three. Reject status-only, pending, failed, skipped-required, stale-head, lookalike, missing, duplicate, or malformed records. Approval remains impossible without the normal security, coverage, review, and branch-protection gates.
5. Add the permanent workflow contracts, action pins, complete-source coverage, docstrings, compilation, and clean-state checks. Update the stale PR-body head/evidence.

Do not build PR-selected native code in the privileged workflow, enable network in untrusted execution, add a compatibility stub, skip pytest, create a branch writer, or change reviewer identities/credentials. Keep Draft until the integrated exact head passes all gates and independent approval.

@opencode-agent address

Complete only the explicitly pending integration on exact head 0948976a88888b8a06e27b42a4689bc5b478d59a; keep the PR Draft and preserve fail-closed coverage. The focused gate is correctly RED because the classifier exists but the protected review workflow never calls it.

Work test-first against tests/test_python_native_extension_peer_gate_workflow_contract.py and the existing 87 passing helper/adversarial tests:

1. In the coverage evidence script, initialize python_native_peer_check_required=0. Capture the actual failed pytest output in a bounded regular UTF-8 log and the exact validated changed-file list in a bounded file. Invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest only after a real Python suite failure, with --repo-root "$COVERAGE_SOURCE_WORKDIR", the current project --pyproject "$project_dir/pyproject.toml", and the exact log/changed-files paths.
2. When and only when the helper returns success, set python_native_peer_check_required=1, record a distinct ### Python native-extension source-only deferral section with - Result: DEFERRED, identify that the unchanged declared PyO3 module was unavailable in the source-only sandbox, and state that successful exact-head Python, Rust/PyO3, and package CheckRuns remain mandatory. Never serialize this classifier outcome as PASS, and never defer mixed imports, test/setup/teardown/internal/crash/truncated failures or native/trust-boundary changes.
3. Export the deferral flag through the existing coverage output/decision boundary. In the trusted approval phase, when the flag is 1, fetch live check-run records for the exact PR_HEAD_SHA and run the helper’s require-checks command with the literal contracts --required-check "CI::python", --required-check "CI::rust", and --required-check "CI::package". Require GraphQL CheckRun identity, exact workflow/check names, COMPLETED/SUCCESS, and the current head; reject statuses, duplicates in the requirement declaration, stale/pending/failed/missing/lookalike evidence. Preserve the existing R peer-check gate independently.
4. Do not build or import PR-selected native code in the source-only sandbox, grant network access, add compatibility stubs, turn deferred evidence into approval, relax exact-head or branch protection, or create temporary writer workflows.
5. Update existing doctoring/CHANGELOG only as needed to describe the integrated path. Run the focused Python 3.14 contract to GREEN, Python 3.10 compatibility, the complete central suite, 100% production statement/branch coverage, complete production docstrings, compilation, actionlint, clean patches, then all exact-head security and independent-review gates.

Keep this branch Draft until the integration itself is GREEN and a downstream exact-head PyO3 repository run proves the intended peer-check flow.

@opencode-agent address

Apply and delete docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch on this same Draft branch, then run the permanent PyO3 peer-gate contract and complete central quality surface.

The patch preserves the existing R deferral and adds a separate fail-closed Python native-extension boundary:

• captures the real pytest/coverage command log and exact changed-file list;
• calls the trusted classify-pytest helper only after a nonzero Python test exit;
• serializes the result as DEFERRED, never ordinary passing evidence;
• permits deferral only for an unchanged declared maturin/PyO3 module absent in the networkless source-only sandbox;
• re-queries the live current-head GraphQL CheckRun rollup before any approval;
• requires exact-head successful CI::python, CI::rust, and CI::package checks through the trusted helper;
• fails closed for stale, missing, pending, failed, status-only, lookalike, or malformed peer evidence.

git apply --check docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch
git apply docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch
rm docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch
python -m pytest \
  tests/test_python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate_file_safety.py \
  tests/test_python_native_extension_peer_gate_nested_project.py \
  tests/test_python_native_extension_peer_gate_requirements.py \
  tests/test_python_native_extension_peer_gate_workflow_contract.py -q
python -m coverage erase
python -m coverage run -m pytest tests -q
python -m coverage report
python -m interrogate --fail-under 100 scripts/ci
python -m compileall -q scripts/ci tests
actionlint .github/workflows/opencode-review-dispatch.yml .github/workflows/python-native-extension-peer-gate-quality-ci.yml
git diff --check
test -z "$(git status --short)"

Commit ordinary reviewed workflow source and patch deletion only. Keep Draft until one unchanged head passes the dedicated quality workflow, complete central security/SAST/supply-chain surface, fresh automated review, zero actionable threads, and qualifying independent approval. Do not build a PR-selected extension in the coverage sandbox, add network access or stubs, weaken the exact native-boundary file list, create a writer workflow, force-push, merge, release, or mark Ready.

@opencode-agent address exact current head 6e723a2c85a1f87327b96b8bb3be6a70edb527ab by completing the permanent integration on this same Draft PR.

Wire scripts/ci/python_native_extension_peer_gate.py into the authoritative central coverage and approval flow without changing its narrow classifier boundary:

• invoke classify-pytest only after an otherwise complete pytest collection failure and only for the exact declared maturin/PyO3 module;
• emit a bounded deferred-evidence marker, never PASS, when classification succeeds;
• before approval, query normalized exact-head CheckRun evidence and require the documented trusted Python, Rust/PyO3, and package checks through require-checks;
• fail closed on missing, pending, failed, stale, status-only, lookalike, malformed, duplicate, mixed-import, changed-native-boundary, or untrusted evidence;
• preserve source-only sandbox isolation, no PR build hooks, no network or secret exposure, no compatibility stub, no test skipping, and all existing coverage/review/branch-protection gates;
• add permanent workflow contracts and doctoring/changelog updates only where needed.

Run the focused peer-gate suite, complete central tests with 100% statement/branch coverage and public docstrings, Python 3.10/3.14 compilation, actionlint, git diff --check, and the full security/supply-chain matrix. Keep Draft until fast-mlsirm#546 is rerun on its unchanged exact head and the peer evidence is proven. Do not create temporary workflows, patch artifacts, branch writers, approvals, merges, releases, or protection changes.

@opencode-agent Integrate the reviewed PyO3 peer-evidence gate directly into the authoritative central workflow on this PR branch, then remove the staged patch artifact.

Apply docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch only after rebasing its anchors against the current exact .github/workflows/opencode-review-dispatch.yml; do not import unrelated workflow history. Preserve these fail-closed boundaries:

• classification is allowed only for a complete pytest collection failure caused exclusively by the exact declared maturin/PyO3 module being absent;
• mixed imports, actual tests, setup/teardown/internal errors, crashes, truncation, unsafe paths, Rust/native/packaging/lock/workflow/maturin changes remain blocking;
• deferral is not pass evidence and requires exact-current-head completed-success CheckRun evidence for the canonical Python, Rust/PyO3, and package jobs;
• stale heads, status contexts, lookalike workflows/check names, pending/failed/skipped/duplicate/malformed evidence fail closed;
• no source-selected native build, network expansion, compatibility stub, approval synthesis, merge, or branch-protection change.

Before production integration, strengthen tests/test_python_native_extension_peer_gate_workflow_contract.py so the RED contract parses the actual coverage and approval step blocks, verifies the helper is invoked from trusted workflow source, proves classification happens only after a nonzero pytest result, and proves approval cannot proceed before exact-head peer evidence is validated. Then apply the integration, delete the patch file, run the focused 100% statement/branch/docstring suite and complete central test/compilation/security surfaces. Keep Draft until fast-mlsirm#546 is rerun through this exact head and all current-head reviews complete.

@jules Apply the already reviewed patch docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch to .github/workflows/opencode-review-dispatch.yml, delete the patch file, and commit ordinary workflow source. Do not merely delete the patch or update the PR body. The resulting diff must contain the permanent coverage-phase classifier/DEFERRED path and the approval-phase live exact-head CI::python, CI::rust, and CI::package CheckRun gate while preserving the existing R CMD check deferral. Run the focused workflow contract first, then full central coverage/docstrings/compile/actionlint/security gates. Keep Draft; do not add network or build the PR-selected extension, create a writer workflow, force-push, merge, release, or mark Ready.

@opencode-agent Implement the bounded PyO3 peer-evidence integration on exact current head 247ebc6e89b6948b1848794cb52901dbac5e3c66 of branch fix/pyo3-native-peer-gate; stop without writing if the live head differs.

The helper and adversarial tests are complete, but exact-head quality run 31150926881 correctly failed three workflow-contract tests because .github/workflows/opencode-review-dispatch.yml does not yet integrate the gate. Keep this PR Draft and implement the permanent integration without weakening source-only coverage.

Modify the protected workflow and only directly necessary permanent tests/docs/CHANGELOG:

1. Initialize python_native_peer_check_required=0 beside the existing r_peer_check_required=0.
2. For each Python project test command, capture the exact sandbox log and changed-file inventory. On ordinary success, keep PASS behavior. On failure, invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest with the exact log, ${project_dir}/pyproject.toml, a validated newline-delimited changed-file file, and --repo-root "$COVERAGE_SOURCE_WORKDIR".
3. A successful classifier must not become PASS and must not decrement other failures. Emit a distinct section headed ### Python native-extension source-only deferral, - Result: DEFERRED, state that the unchanged declared PyO3 module was unavailable in the source-only sandbox, set python_native_peer_check_required=1, and preserve the failed command/log evidence. Any classifier rejection remains the original FAIL.
4. Export the deferral flag through the authenticated coverage output and summary with the exact message Python native-extension peer evidence: deferred source-only collection requires successful exact-head peer checks.
5. In the trusted approval phase, when the flag is set, fetch normalized CheckRun records for the exact PR head and run the helper’s require-checks command with exact --head-sha "$PR_HEAD_SHA" and all three requirements: CI::python, CI::rust, and CI::package. Require __typename=CheckRun, exact workflow/check names, COMPLETED/SUCCESS, and exact head; reject statuses, pending/failed/stale/lookalike/missing evidence. Preserve the existing R peer-check path independently.
6. Do not build/import/install a PR-selected extension, do not grant network/model/token/OIDC authority to untrusted tests, and do not classify mixed imports, test/setup/teardown failures, internal errors, crashes, truncation, or any native/trust-boundary-changing diff.
7. Ensure the permanent quality workflow runs all peer-gate files, the integration contracts, the complete central suite, 100% statement/branch coverage, 100% public docstrings, Python 3.10/3.14 compilation, actionlint, and git diff --check.

Run the exact three failing workflow contracts first, then the complete focused and central quality gates. Final diff must contain only permanent integration/helper/tests/quality/doctoring/CHANGELOG files; no staged patch, one-shot writer, trigger, or repair workflow. Do not approve, merge, mark Ready, rebase, retarget, release, or publish.