You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The trusted OpenCode coverage image installs a target repository's immutable production lock plus the central review toolchain, but that central toolchain omits pytest-asyncio. A repository that correctly configures asyncio_mode and marks coroutine tests therefore collects normally and then fails with async def functions are not natively supported and Unknown config option: asyncio_mode. That is central infrastructure evidence, not a downstream product-code regression.
Bounded implementation
Add the pinned Python 3.10–3.14-compatible pytest-asyncio==1.4.0 requirement to the central review toolchain.
Regenerate requirements-opencode-review-ci-hashes.txt through the repository's canonical compile script and retain complete hashes.
Extend the trusted offline toolchain smoke check with an explicit pytest_asyncio import.
Preserve the source-only, networkless, non-root sandbox, immutable base materialization, hash validation, exact-head artifact identity, reviewer separation, and all existing coverage/docstring/security gates.
Add no mutable installer, consumer-selected resolution, or downstream source workaround.
Exact identity and scope correction
exact current head: d6f7e1a662ce99100025d84c2b07f3a685fa0c5c;
protected base and independently resolved live base: main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;
state: Draft and mechanically mergeable.
The final protected-base diff is limited to:
.github/workflows/opencode-review-dispatch.yml
requirements-opencode-review-ci.txt
requirements-opencode-review-ci-hashes.txt
scripts/ci/test_strix_quick_gate.sh
tests/test_opencode_agent_contract.py
tests/test_opencode_asyncio_toolchain_contract.py
docs/doctoring/opencode-asyncio-test-runtime.md
CHANGELOG.md
The overlapping AGENTS.md, CLAUDE.md, and root ARCHITECTURE.md changes were removed because PR #896 owns the canonical central documentation graph. Requirements-directory lock discovery and its materializer tests were restored to protected-main content because PR #785 owns that independent boundary.
Test-first lineage and standards
The initial RED contract required the package in the input and generated hash lock and required the offline import. PyPI release metadata and the tagged project metadata support Python 3.10–3.14 and a pytest range compatible with the central pytest==9.1.1; the focused doctoring records those sources in APA 7 form. Predecessor results are lineage only.
Merge gate
The scope correction changed the exact head, so every prior check and review is historical. Keep Draft until the unchanged current head completes the OpenCode toolchain/full-suite, exact 100% owned statement/branch coverage, public-docstring, security, SAST, dependency/SBOM, and semantic-review cycle with zero valid unresolved findings. Then mark Ready and require qualifying non-author exact-head approvals plus normal protected-main last-push semantics. No self-approval, stale evidence, temporary writer, administrative bypass, or weakened gate is authorized.
After protected integration, rerun an affected async downstream repository such as ContextualWisdomLab/pg-erd-cloud; protected-main consumer evidence is required before incident closure.
@seonghobae, you've reached your PR review limit, so we couldn't start this review.
Next review available in:51 minutes
Limit details: You’ve used all 1 included review currently available under your plan.
You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
How can I continue?
After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.
To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.
How do review limits work?
CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.
For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.
@opencode-agent Please implement the failing test-first contract on this branch: add pytest-asyncio==1.4.0, regenerate requirements-opencode-review-ci-hashes.txt only with scripts/ci/compile_opencode_review_lock.sh, add pytest_asyncio to the trusted offline import smoke check, run focused and complete quality gates, and keep the change bounded to the central trusted coverage toolchain. Do not weaken hash locking, sandbox isolation, or downstream required checks.
Complete the test-first asyncio coverage-toolchain repair on the current protected base. Exact PR head is fc43514b2ac9bfb15d7a85aaeb2fbfd5c77f7166; protected main is 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. The only current PR change is fail-first tests/test_opencode_asyncio_toolchain_contract.py blob 4b35ee94f29a801fb1561b40bf2a78ae1bf2590a. requirements-opencode-review-ci.txt is still blob 0b585231f67de35a2172da3b21272788bd631bf6 on both this head and protected main, and .github/workflows/opencode-review-dispatch.yml is still 83f6830d5c21a324b4dbcd4e5c21a07968994b81. Do not write if any head/base/target identity moves.
First normally merge exact protected main into the existing branch without rewriting history. Then implement only the permanent toolchain requirement already captured by the RED contract:
Add exact pytest-asyncio==1.4.0 to requirements-opencode-review-ci.txt alongside the existing pytest toolchain. Current PyPI release metadata (May 26, 2026) identifies 1.4.0 as stable, Python >=3.10 with Python 3.14 classifier support, and Trusted Publishing provenance; do not broaden it to an unpinned range.
Regenerate requirements-opencode-review-ci-hashes.txtonly via the repository-authoritative scripts/ci/compile_opencode_review_lock.sh; do not hand-edit hashes or resolve from pull-request-controlled metadata.
Extend the existing trusted offline toolchain smoke import in .github/workflows/opencode-review-dispatch.yml to import pytest_asyncio together with coverage/interrogate/pytest/pytest_cov before the networkless/non-root PR test execution.
Add the minimal changelog/doctoring trace needed to record the infrastructure boundary and primary release metadata if not already present. Do not claim that adding the plugin makes arbitrary async frameworks supported; it only supplies pytest's asyncio plugin for repositories that declare/use it.
Preserve the digest-pinned trusted image, exact base-owned lock materialization, hash verification, networkless/non-root PR execution, source/archive bounds, credential isolation, reviewer identities, model routing, and branch protection. Do not add mutable installers, consumer-selected dependency resolution, COPILOT_GITHUB_TOKEN, temporary/self-modifying/write-capable workflows, or bypasses.
Run the fail-first asyncio toolchain contract, lock-compiler/hash-lock consistency contracts, offline import smoke, complete central suite and Strix quick gate, Python 3.10/3.14 compatibility, exact 100% production statement/branch/public-docstring gates, then all exact-head security/supply-chain checks. Keep Draft until current-head automated and qualifying independent review are clean; do not merge or synthesize approval.
/oc Refetch the live PR and abort without writing unless exact head is still fc43514b2ac9bfb15d7a85aaeb2fbfd5c77f7166. This branch is test-only and is based on an old protected-main generation; use its RED contract as historical ordering evidence, not as a merge candidate. The missing runtime dependency is still real: as of 2026-08-09 the official PyPI/GitHub release is pytest-asyncio==1.4.0, published 2026-05-26, requiring Python >=3.10 with Python 3.14 support.
First reconcile the latest protected main into this existing branch by ordinary non-force ancestry only. If current-main already contains an equivalent fix, close this PR as superseded after exact proof. Otherwise implement the smallest permanent correction on the reconciled branch:
Add exact pytest-asyncio==1.4.0 to the trusted OpenCode review tooling source manifest.
Regenerate requirements-opencode-review-ci-hashes.txt only through the repository's reviewed lock compiler; do not hand-edit hashes or introduce a mutable installer.
Extend the trusted offline Python toolchain smoke to import pytest_asyncio explicitly.
Preserve networkless/non-root PR execution, immutable source/materialization, hash verification, no PR-selected builds, credential isolation, reviewer identities, model routing, and branch protection.
Keep this an infrastructure correction: async-plugin absence may block merge readiness, but must not be published as an invented source-code defect.
Verify test-first after reconciliation: the permanent plugin contract, Python 3.10 and 3.14 compatibility, the complete central suite, 100% owned production statement/branch coverage and public docstrings, compileall, lock reproducibility, Strix quick gate, and git diff --check. Then run a real protected-main or exact trusted-dispatch canary against an async-test consumer such as ContextualWisdomLab/pg-erd-cloud before declaring the operational incident closed. Do not create a one-shot writer workflow, use COPILOT_GITHUB_TOKEN, force-push, weaken coverage, merge, or mark Ready until exact-head gates are regenerated.
/oc Refetch the live PR and stop without writing unless exact head is fc43514b2ac9bfb15d7a85aaeb2fbfd5c77f7166. Preserve the permanent RED contract in tests/test_opencode_asyncio_toolchain_contract.py. Implement the minimum trusted-toolchain fix: add exact pytest-asyncio==1.4.0 to requirements-opencode-review-ci.txt; regenerate requirements-opencode-review-ci-hashes.txt only with the repository's authoritative scripts/ci/compile_opencode_review_lock.sh rather than hand-editing hashes; and extend the existing offline trusted-toolchain import smoke in .github/workflows/opencode-review-dispatch.yml to import pytest_asyncio alongside coverage/interrogate/pytest/pytest_cov. Do not change product dependencies, provider credentials, sandbox root/non-root behavior, artifact boundaries, or independent reviewer identity.
Verify the focused asyncio contract RED→GREEN first, then lock regeneration reproducibility, exact-hash install, Python 3.10 and 3.14 compatibility, full central tests, 100% applicable production coverage/docstrings, compileall, security/supply-chain checks, and an actual downstream async consumer canary before Ready. Keep Draft until current-head review and protected gates are complete. Never use COPILOT_GITHUB_TOKEN, mutable install fallback, unhashed dependencies, temporary branch-writer workflows, or force-push.
Review exact current head 9e0a43d5563ed2d77f505178811f20413f85b27d against independently resolved live main6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. 19 exact-head hosted workflows are terminal-success and no review thread is unresolved. Verify repository asyncio tests execute inside the source-only coverage sandbox without network, credential, event-loop, or evidence-classification weakening. Automated judgment is not qualifying independent human approval or merge authorization.
Finish this test-first PR directly on its existing Draft branch. Do not introduce a mutable installer, consumer-selected dependency resolution, temporary writer workflow, or competing PR.
Implement the minimum trusted-toolchain correction:
add the current reviewed pytest-asyncio==1.4.0 requirement to the authoritative OpenCode review requirements;
regenerate requirements-opencode-review-ci-hashes.txt only through scripts/ci/compile_opencode_review_lock.sh, retaining exact versions and hashes;
extend the offline trusted-toolchain smoke check with an explicit pytest_asyncio import;
add contracts proving version equality across source requirement, generated lock, and offline import smoke, plus rejection of drift or unhashed resolution;
retain the source-only, non-root, network-disabled PR execution boundary and all exact-head, source, artifact, credential, archive, and coverage controls;
validate a real downstream asyncio repository on the exact final central head rather than reclassifying coroutine-test failures as product success;
run focused RED/GREEN evidence, complete central tests, 100% production statement/branch coverage and public docstrings, Python 3.10/3.14 compilation, actionlint, security/supply-chain checks, and clean-tree verification;
update doctoring and CHANGELOG.md with authoritative APA 7 references and the precise compatibility boundary.
Keep Draft until the exact final head and downstream canary are green. Do not approve, merge, release, or bypass protection.
Exact-current-head review request for 9e0a43d5563ed2d77f505178811f20413f85b27d over protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
Review the bounded six-file trusted-toolchain repair. Add exactly pytest-asyncio==1.4.0 to the central OpenCode review requirements, regenerate the hash lock only through the repository compiler, and require an explicit offline pytest_asyncio import in the trusted image smoke check. Preserve immutable sources, complete hashes, networkless non-root PR execution, exact-head/source/artifact validation, and the prohibition on mutable or consumer-selected dependency installation. Directly observed exact-head Trusted uv, Agent Mention Router, Strix, CodeQL, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV, Scorecard, and SBOM workflows are terminal-success; no formal review or inline thread exists. Downstream pg-erd-cloud async canary remains required after protected integration.
Keep the exact head unchanged. Do not relax hash locking, add runtime network resolution, treat infrastructure absence as product failure, synthesize author approval, update the branch, merge, release, or bypass protection.
Re-evaluate exact current head e61ef0cc4a5cf681d0c335ae74b98f9a05836f80. 리뷰 확인 for the bounded-include increment; do not treat Checks wait as a blocker.
Exact-current-head read-only review request for e61ef0cc4a5cf681d0c335ae74b98f9a05836f80 over protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
All eleven directly observed exact-head workflows are terminal-success: Agent Mention Router Quality CI, Trusted uv Materializer Quality CI, Strix Changed Path Quality CI, CodeQL PR, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, and SBOM Generation. No formal review or inline thread exists on the current head.
Review the unchanged current head. Confirm the hash-locked, offline central review toolchain adds pytest-asyncio without weakening non-root/networkless execution, immutable resolution, source validation, or downstream product-code gates. Do not mutate the branch, synthesize approval, or bypass protection.
Review only exact current head e61ef0cc4a5cf681d0c335ae74b98f9a05836f80 against live protected main. All 11 directly observed current-head hosted workflows are terminal-success and no review thread exists. Review read-only; do not mutate source, synthesize author approval, weaken protection, or merge. Validate the async-test runtime/toolchain contract and submit an exact-head verdict only.
#!/bin/bashset -euo pipefail
repo="ContextualWisdomLab/.github"
pr="819"echo"== Live PR metadata =="
gh pr view "$pr" --repo "$repo" --json number,headRefName,headRefOid,baseRefName,baseRefOid,isDraft,state,mergeStateStatus
echo"== Live protected main ref =="
gh api "repos/${repo}/git/ref/heads/main" --jq '.object.sha'echo"== Changed files at the checked-out PR head =="
git status --short
git rev-parse HEAD
git diff --check "origin/main...HEAD"
git diff --name-status "origin/main...HEAD"echo"== Relevant file structure =="
ast-grep outline requirements-opencode-review-ci.txt --items all ||true
ast-grep outline requirements-opencode-review-ci-hashes.txt --items all ||true
ast-grep outline .github/workflows/opencode-review-dispatch.yml --items all ||true
ast-grep outline tests/test_opencode_asyncio_toolchain_contract.py --items all ||true
ast-grep outline tests/test_opencode_agent_contract.py --items all ||true
ast-grep outline scripts/ci/compile_opencode_review_lock.sh --items all ||true
ast-grep outline scripts/ci/test_strix_quick_gate.sh --items all ||trueecho"== Exact relevant diff =="
git diff --unified=80 "origin/main...HEAD" -- \
requirements-opencode-review-ci.txt \
requirements-opencode-review-ci-hashes.txt \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/test_strix_quick_gate.sh \
tests/test_opencode_agent_contract.py \
tests/test_opencode_asyncio_toolchain_contract.py
echo"== Toolchain and boundary references =="
rg -n -C 4 \
'pytest-asyncio|pytest_asyncio|pytest-cov|pytest_cov|coverage|interrogate|asyncio_mode|--require-hashes|--network|network|non-root|user:' \
requirements-opencode-review-ci.txt \
requirements-opencode-review-ci-hashes.txt \
.github/workflows/opencode-review-dispatch.yml \
scripts/ci/compile_opencode_review_lock.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_opencode_agent_contract.py \
tests/test_opencode_asyncio_toolchain_contract.py
Length of output: 202447
🏁 Script executed:
#!/bin/bashset -euo pipefail
repo="ContextualWisdomLab/.github"
pr="819"echo"== Live identity =="
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus}'printf'live_main='
gh api "repos/${repo}/git/ref/heads/main" --jq '.object.sha'printf'checked_out_head='
git rev-parse HEAD
printf'merge_base_with_origin_main='
git merge-base origin/main HEAD
echo"== GitHub PR files and patches =="
gh api --paginate "repos/${repo}/pulls/${pr}/files?per_page=100" \
--jq '.[] | {filename,status,additions,deletions,patch}'echo"== Exact manifest and lock entries =="
rg -n -A8 -B8 '^pytest-asyncio==|^pytest-asyncio[ =]' \
requirements-opencode-review-ci.txt requirements-opencode-review-ci-hashes.txt
rg -n -A5 -B5 'pytest_asyncio|pytest-asyncio|compile_opencode_review_lock' \
tests/test_opencode_asyncio_toolchain_contract.py \
tests/test_opencode_agent_contract.py \
scripts/ci/test_strix_quick_gate.sh \
scripts/ci/compile_opencode_review_lock.sh \
.github/workflows/opencode-review-dispatch.yml
echo"== Lock-format validation for the new requirement =="
python3 - <<'PY'from pathlib import Pathimport remanifest = Path("requirements-opencode-review-ci.txt").read_text()lock = Path("requirements-opencode-review-ci-hashes.txt").read_text()source = re.search(r"^pytest-asyncio==([^\s#]+)", manifest, re.M)locked = re.search( r"^pytest-asyncio==([^\s\\]+)\s*\\\n((?:\s*--hash=sha256:[0-9a-f]{64}\s*\\\n?)+)", lock, re.M,)print(f"manifest_version={source.group(1) if source else 'MISSING'}")print(f"lock_version={locked.group(1) if locked else 'MISSING_OR_UNHASHED'}")if locked: hashes = re.findall(r"--hash=sha256:([0-9a-f]{64})", locked.group(2)) print(f"lock_hash_count={len(hashes)}") print(f"invalid_hashes={sum(len(h) != 64 for h in hashes)}")PYecho"== Sandbox execution arguments =="
sed -n '636,785p' .github/workflows/opencode-review-dispatch.yml
Length of output: 62287
🏁 Script executed:
#!/bin/bashset -euo pipefail
repo="ContextualWisdomLab/.github"
pr="819"
head="e61ef0cc4a5cf681d0c335ae74b98f9a05836f80"echo"== Exact-head check runs =="
gh api --paginate "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,details_url}'echo"== Non-success exact-head checks =="
gh api --paginate "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or .conclusion != "success") | {name,status,conclusion,details_url}]'echo"== Pull request reviews and unresolved threads =="
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" \
--jq '.[] | {user:.user.login,state,commit_id,submitted_at}'
gh api graphql -F owner="ContextualWisdomLab" -F name=".github" -F number="$pr" -f query='query($owner: String!, $name: String!, $number: Int!) { repository(owner: $owner, name: $name) { pullRequest(number: $number) { reviewThreads(first: 100) { nodes { isResolved path line comments(first: 1) { nodes { author { login } body } } } } } }}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | {path,line,author:.comments.nodes[0].author.login,body:.comments.nodes[0].body}]'echo"== Manifest-to-lock exact pin and hash coverage =="
python3 - <<'PY'from pathlib import Pathimport remanifest = Path("requirements-opencode-review-ci.txt").read_text(encoding="utf-8")lock = Path("requirements-opencode-review-ci-hashes.txt").read_text(encoding="utf-8")requirements = {}for line in manifest.splitlines(): line = line.strip() if not line or line.startswith("#"): continue match = re.fullmatch(r"([A-Za-z0-9][A-Za-z0-9._-]*)==([^\s#]+)", line) if match: requirements[match.group(1).lower().replace("_", "-")] = match.group(2) else: print(f"non_exact_manifest_line={line}")blocks = re.split(r"(?m)^(?=[A-Za-z0-9][A-Za-z0-9._-]*==)", lock)locked = {}for block in blocks: match = re.match(r"([A-Za-z0-9][A-Za-z0-9._-]*)==([^\s\\]+)", block) if not match: continue name = match.group(1).lower().replace("_", "-") version = match.group(2) hashes = re.findall(r"--hash=sha256:([0-9a-f]{64})", block) locked[name] = (version, len(hashes))for name, version in sorted(requirements.items()): locked_version, hash_count = locked.get(name, ("MISSING", 0)) print(f"{name}: manifest={version} lock={locked_version} hashes={hash_count}") if locked_version != version or hash_count == 0: raise SystemExit(f"lock coverage failure for {name}")PYecho"== Final exact-base diff hygiene =="
git diff --check 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba...HEAD
git status --short
Length of output: 15155
@seonghobae Exact-head verdict: no actionable findings.
Live PR head: e61ef0cc4a5cf681d0c335ae74b98f9a05836f80.
Live protected base and merge base: main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
pytest-asyncio==1.4.0 matches in the source manifest and generated hash lock. The lock entry has two SHA-256 hashes.
The trusted offline smoke check imports pytest_asyncio with coverage, interrogate, pytest, and pytest_cov.
The image install retains --require-hashes and --only-binary=:all:.
PR execution retains the network-disabled container, read-only trusted source mount, and non-root sandbox controls.
Exact-head coverage-evidence, opencode-review, Python compatibility, quality, Strix, and security checks completed successfully. Neutral and skipped auxiliary checks are not failures.
No review or unresolved review thread exists.
git diff --check and the working-tree check are clean.
This review does not establish a downstream async-consumer canary. That check remains separate from the central toolchain contract.
⚠️ Action not completed
Review rate limited.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
Add hash-pinned pytest-asyncio and a fail-closed import helper so marked
asyncio tests can run in the coverage sandbox without rewriting the
review-agent dispatch blob.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Next action
Do not merge this head as the landing vehicle. Prefer the successor that executes the asyncio helper after the hash-lock install (cursor/bc-9e1d5dcb-88b1-4dd4-94c0-56d3bf28b33b-de81). After that successor reaches protected main, rerun coverage on an affected async consumer such as ContextualWisdomLab/pg-erd-cloud.
What this head already gets right
f5d1452986b2ac34ec1c2ef68499ba14afd3c8dd hash-pins pytest-asyncio==1.4.0 and typing-extensions==4.16.0 in the central review lock. That is the functional fix: the coverage image installs the lock, pytest-asyncio registers through entry points, and marked coroutines can collect. Leaving opencode-review-dispatch.yml untouched is correct; that file is the independent review-agent blob.
Residual buyer-visible gap
scripts/ci/ensure_opencode_asyncio_toolchain.sh was not invoked after any hash-lock install. The contract only asserted string presence. An unread helper cannot prove the plugin is importable, and the trusted-image smoke check still imports coverage, interrogate, pytest, pytest_cov without pytest_asyncio. If the pin is later dropped, quality CI would not fail closed on this path.
The successor adds:
quality-CI execution of the helper after lock install
a marked-coroutine collection test that reproduces async def functions are not natively supported
exact SHA-256 pin assertions
doctoring that tells the next operator to verify a downstream async suite
Do not self-approve this PR. Required OpenCode/Strix/Noema checks were still queued or cancelled on this synchronize; treat them as in-flight, not as a stop.
The reason will be displayed to describe this comment to others. Learn more.
Verdict
Do not merge #819 at f5d1452986b2ac34ec1c2ef68499ba14afd3c8dd.
The lock pin is the right buyer-visible fix: add pytest-asyncio==1.4.0 to the hash-pinned OpenCode review toolchain so the coverage image can execute marked coroutine tests. Keep hashed opencode-review-dispatch.yml unchanged. tests/test_opencode_agent_contract.py already pins import coverage, interrogate, pytest, pytest_cov.
This head is not the landing vehicle.
Root AGENTS.md, ARCHITECTURE.md, and CLAUDE.md are owned by open #896. This PR body already said those files were removed. They are back. Merging both will collide the control-plane documentation graph.
scripts/ci/ensure_opencode_asyncio_toolchain.sh is never invoked by verify_trusted_python_test_toolchain. The doctoring overclaims a fail-closed sandbox import.
tests/test_opencode_asyncio_toolchain_contract.py only string-matches versions. It does not prove SHA-256 hashes, does not run the import, and does not execute a marked coroutine.
The PR body is stale: it still names head d6f7e1a662ce99100025d84c2b07f3a685fa0c5c, a Draft state, and a six-file dispatch-workflow scope that this head no longer has.
Next action
Use #1060. That head keeps the lock pin, restores the three root ADRs to protected main, and adds hash, helper-import, dispatch-invariant, and marked-coroutine contracts. Do not merge #819 and #1060 together. Do not self-approve. Do not open a third asyncio-toolchain PR unless #1060 regresses the lock pin or the marked coroutine.
CodeRabbit was rate-limited on this head. Required checks were still starting or cancelled/superseded when this review ran; check wait is not the blocker.
Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md).
Conflict-scope roots fail closed when the immediate parent directory is a symbolic link.
Coverage sandbox asyncio execution is pinned through `requirements-opencode-review-ci.txt` and `scripts/ci/ensure_opencode_asyncio_toolchain.sh`; do not rewrite hashed `opencode-review-dispatch.yml` for that import.
The reason will be displayed to describe this comment to others. Learn more.
Remove this root ADR edit from #819. Open #896 already owns AGENTS.md. This PR body said the overlap was removed. Put the asyncio boundary in docs/doctoring/opencode-asyncio-test-runtime.md only, as #1060 does.
The reason will be displayed to describe this comment to others. Learn more.
This section claims the helper fail-closed imports pytest_asyncio, but verify_trusted_python_test_toolchain in hashed opencode-review-dispatch.yml still imports only coverage, interrogate, pytest, pytest_cov. Do not rewrite that hashed blob. Drop this root ADR hunk so it does not collide with #896, and keep the honest sandbox path (lock install + plugin autoload) in doctoring.
The reason will be displayed to describe this comment to others. Learn more.
Nothing in the coverage sandbox runs this helper. The buyer-visible fix is the hash-pinned install, not this unused wrapper. Keep the file, but prove the import and a marked coroutine in the quality suite. #1060 does that without touching the hashed dispatch smoke.
The reason will be displayed to describe this comment to others. Learn more.
These asserts only prove the version string exists. They do not prove SHA-256 hashes, do not run the import, and do not execute a @pytest.mark.asyncio coroutine. A missing plugin would still fail downstream collection with async def functions are not natively supported. Replace this with hash, import, dispatch-invariant, and marked-coroutine evidence as in #1060.
The reason will be displayed to describe this comment to others. Learn more.
This paragraph says the helper fail-closed imports the plugin and that the hashed review-agent blob is simply not rewritten. State the actual path: the coverage image installs the lock; pytest loads the plugin; the helper is a local python3 -I wrapper; tests/test_opencode_agent_contract.py is why the dispatch smoke stays unchanged. Also record that root ADRs stay with #896.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Buyer-visible root cause
The trusted OpenCode coverage image installs a target repository's immutable production lock plus the central review toolchain, but that central toolchain omits
pytest-asyncio. A repository that correctly configuresasyncio_modeand marks coroutine tests therefore collects normally and then fails withasync def functions are not natively supportedandUnknown config option: asyncio_mode. That is central infrastructure evidence, not a downstream product-code regression.Bounded implementation
pytest-asyncio==1.4.0requirement to the central review toolchain.requirements-opencode-review-ci-hashes.txtthrough the repository's canonical compile script and retain complete hashes.pytest_asyncioimport.Exact identity and scope correction
d6f7e1a662ce99100025d84c2b07f3a685fa0c5c;main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;The final protected-base diff is limited to:
.github/workflows/opencode-review-dispatch.ymlrequirements-opencode-review-ci.txtrequirements-opencode-review-ci-hashes.txtscripts/ci/test_strix_quick_gate.shtests/test_opencode_agent_contract.pytests/test_opencode_asyncio_toolchain_contract.pydocs/doctoring/opencode-asyncio-test-runtime.mdCHANGELOG.mdThe overlapping
AGENTS.md,CLAUDE.md, and rootARCHITECTURE.mdchanges were removed because PR #896 owns the canonical central documentation graph. Requirements-directory lock discovery and its materializer tests were restored to protected-main content because PR #785 owns that independent boundary.Test-first lineage and standards
The initial RED contract required the package in the input and generated hash lock and required the offline import. PyPI release metadata and the tagged project metadata support Python 3.10–3.14 and a pytest range compatible with the central
pytest==9.1.1; the focused doctoring records those sources in APA 7 form. Predecessor results are lineage only.Merge gate
The scope correction changed the exact head, so every prior check and review is historical. Keep Draft until the unchanged current head completes the OpenCode toolchain/full-suite, exact 100% owned statement/branch coverage, public-docstring, security, SAST, dependency/SBOM, and semantic-review cycle with zero valid unresolved findings. Then mark Ready and require qualifying non-author exact-head approvals plus normal protected-main last-push semantics. No self-approval, stale evidence, temporary writer, administrative bypass, or weakened gate is authorized.
After protected integration, rerun an affected async downstream repository such as
ContextualWisdomLab/pg-erd-cloud; protected-main consumer evidence is required before incident closure.