fix(opencode): retain adversarial fallback scope

.github/workflows/opencode-review-dispatch.yml

@@ -2439,12 +2439,14 @@ jobs:
               ContextualWisdomLab/.github:scripts/ci/pr_head_replay_guard.py | \
               ContextualWisdomLab/.github:scripts/ci/pr_review_merge_scheduler.py | \
               ContextualWisdomLab/.github:scripts/ci/run_opencode_review_model_pool.sh | \
+              ContextualWisdomLab/.github:scripts/ci/adversarial_evidence.py | \
               ContextualWisdomLab/.github:scripts/ci/opencode_review_normalize_output.py | \
               ContextualWisdomLab/.github:scripts/ci/strix_quick_gate.sh | \
               ContextualWisdomLab/.github:scripts/ci/validate_opencode_failed_check_review.sh | \
               ContextualWisdomLab/.github:tests/test_changed_file_syntax_gate.py | \
               ContextualWisdomLab/.github:tests/test_javascript_coverage_gate.py | \
               ContextualWisdomLab/.github:tests/test_materialize_base_javascript_packages.py | \
+              ContextualWisdomLab/.github:tests/test_adversarial_evidence.py | \
               ContextualWisdomLab/.github:tests/test_opencode_agent_contract.py | \
               ContextualWisdomLab/.github:tests/test_opencode_model_pool_runner.py | \
               ContextualWisdomLab/.github:tests/test_pr_head_replay_guard.py | \

CHANGELOG.md

@@ -60,6 +60,9 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
+- Kept the extracted adversarial-evidence gate and its contract test inside the
+  central OpenCode review-process fallback scope, so changes to that trust
+  boundary retain the same exact-file eligibility and adversarial review path.
 - Publish only the sanitized cumulative Strix report tree, avoiding a later
   copy of relative scanner output that could reintroduce known internal warning
   text into uploaded security evidence.

docs/doctoring/opencode-adversarial-fallback-scope.md

@@ -0,0 +1,41 @@
+# OpenCode adversarial fallback scope
+
+## Incident boundary
+
+The central OpenCode fallback allowlist omitted `adversarial_evidence.py` and
+its contract test after the gate was extracted from an already-allowlisted
+review helper. A pull request that changed the extracted trust-boundary code
+therefore lost the bounded central review-process fallback solely because of
+the refactor.
+
+## Decision
+
+Treat the extracted gate and its test as the same review-process unit as the
+normalizer and approval gate by adding their exact repository paths to
+`fallback_changed_file_allowed`. The existing
+`fallback_changed_file_counts_as_core` function already classifies every
+allowlisted central path except `.jules/bolt.md` as core, so no new classifier,
+provider rule, credential, or approval path is needed.
+
+This keeps the changed control and its regression evidence inside one
+assessment scope. NIST SP 800-53 Rev. 5, control SA-11, requires ongoing unit,
+integration, system, or regression evaluation and evidence at the defined
+depth and coverage (National Institute of Standards and Technology, 2020).
+The stable OWASP Web Security Testing Guide likewise includes positive and
+negative security-control requirements in the security test suite (OWASP
+Foundation, 2020).
+
+## Verification
+
+`tests/test_opencode_agent_contract.py` pins both exact paths in the workflow.
+The allowlist stays closed: unrelated files remain ineligible, and every merge
+still requires the existing exact-head checks and independent review policy.
+
+## References
+
+National Institute of Standards and Technology. (2020). *Security and privacy
+controls for information systems and organizations* (NIST Special Publication
+800-53, Revision 5). https://doi.org/10.6028/NIST.SP.800-53r5
+
+OWASP Foundation. (2020). *OWASP web security testing guide* (Version 4.2).
+https://owasp.org/www-project-web-security-testing-guide/v42/

tests/test_opencode_agent_contract.py

@@ -1395,6 +1395,10 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
         "ContextualWisdomLab/.github:scripts/ci/opencode_review_approve_gate.sh | \\"
         in workflow
     )
+    assert (
+        "ContextualWisdomLab/.github:scripts/ci/adversarial_evidence.py | \\"
+        in workflow
+    )
     assert "scripts/ci/run_opencode_review_model_pool.sh | \\" in workflow
     assert (
         "ContextualWisdomLab/.github:tests/test_javascript_coverage_gate.py | \\"
@@ -1404,6 +1408,10 @@ def test_workflow_provisions_sandbox_tool_and_reviewer_agent():
         "ContextualWisdomLab/.github:tests/test_materialize_base_javascript_packages.py | \\"
         in workflow
     )
+    assert (
+        "ContextualWisdomLab/.github:tests/test_adversarial_evidence.py | \\"
+        in workflow
+    )
     assert "tests/test_opencode_agent_contract.py | \\" in workflow
     assert (
         "ContextualWisdomLab/appguardrail:scripts/ci/collect_org_security_failures.py"

tests/test_pr_review_autofix_nvidia_nim_contract.py

@@ -19,7 +19,7 @@
 DOCTORING_RECORD = Path("docs/doctoring/hourly-nvidia-nim-autofix.md")
 CHANGELOG = Path("CHANGELOG.md")
 REVIEW_DISPATCH_WORKFLOW = Path(".github/workflows/opencode-review-dispatch.yml")
-REVIEW_DISPATCH_BLOB_SHA = "ce7939845286be9668a01d5c640e867a8490ee5c"
+REVIEW_DISPATCH_BLOB_SHA = "13d47026c7a25b33f6e29efb967a81a1835c2b4c"
 
 
 def _workflow_text(path: Path) -> str: