draft: integrate OpenCode gateway route with coverage lock context

[seonghobae]

Scope

Reviewable integration of #2333 gateway /v1 routing and #2286 coverage build-context repair. This Draft PR targets #2333's branch and does not replace either owner PR.

• Base at creation: fix(review): point OpenCode at the gateway's /v1 routes and split failure classes #2333 9c6d053742856f4969504474f7e8f4c6378aaffc.
• Merged source: fix(opencode): materialize every coverage lock input #2286 42e4198fa012eb24596e7984d77e27f0905348d6.
• Integration head: 269f9db80c15b7c292958facf4492b558a89da6e.

The workflow changes auto-merge. The only content conflict is tests/test_pr_review_autofix_nvidia_nim_contract.py's REVIEW_DISPATCH_BLOB_SHA; it is set to ca90c602d95512ccba3daa581d44464e8871c63c, the hash of the combined workflow.

Local verification

• git diff --check: clean.
• Combined workflow retains both trusted Noema lockfile validation/copy and the gateway /v1 route.
• Focused gateway route, coverage context, route assertion and blob-pin tests: 5 passed normally and 5 passed with GITHUB_ACTIONS=true.

Gates and ownership

#2286 remains the coverage owner; #2333 remains the gateway-route owner. An existing separate #2333 owner worktree contains unpushed commits, so this branch does not update that owner's branch. If that branch advances, re-evaluate the diff and recompute the pin before adopting this integration.

#2291 Strix binder and #2276 CodeQL App analyses GET permission remain independent blockers. This local verification does not establish hosted acceptance. Keep both owner PRs OPEN and preserve all required checks and valid independent review; do not merge this Draft PR until the owners adopt and revalidate the exact head.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai approve

Please independently review Draft #2363 at exact head 269f9db80c15b7c292958facf4492b558a89da6e against base 9c6d053742856f4969504474f7e8f4c6378aaffc. Issue a formal non-author APPROVED review only if your own inspection confirms that all valid #2286 coverage changes and #2333 gateway-route changes survive the merge, the trusted Noema lockfile is present in the Docker build context, the /v1 route remains correct, and REVIEW_DISPATCH_BLOB_SHA=ca90c602d95512ccba3daa581d44464e8871c63c matches the combined workflow. Otherwise report exact blocking findings. Local focused tests passed 5/5 normally and with GITHUB_ACTIONS=true; hosted required checks remain queued and must not be inferred from this local result. No merge is requested.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
git status --short
git rev-parse HEAD
git cat-file -t 269f9db80c15b7c292958facf4492b558a89da6e
git cat-file -t 9c6d053742856f4969504474f7e8f4c6378aaffc
git cat-file -t 42e4198fa012eb24596e7984d77e27f0905348d6
git log -4 --format='%H %P %s' 269f9db80c15b7c292958facf4492b558a89da6e
git diff --name-status 9c6d053742856f4969504474f7e8f4c6378aaffc 269f9db80c15b7c292958facf4492b558a89da6e
gh pr view 2363 --repo ContextualWisdomLab/.github --json headRefOid,baseRefOid,isDraft,state,author,statusCheckRollup --jq '{headRefOid,baseRefOid,isDraft,state,author:.author.login,checks:[.statusCheckRollup[]? | {name,status,conclusion}]}'

Length of output: 3082

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo '---- merge vs gateway parent ----'
git diff --stat 9c6d053742856f4969504474f7e8f4c6378aaffc 269f9db80c15b7c292958facf4492b558a89da6e
git diff 9c6d053742856f4969504474f7e8f4c6378aaffc 269f9db80c15b7c292958facf4492b558a89da6e -- .github/workflows/opencode-review-dispatch.yml tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py requirements-strix-ci-hashes.txt
echo '---- merge vs coverage parent ----'
git diff --stat 42e4198fa012eb24596e7984d77e27f0905348d6 269f9db80c15b7c292958facf4492b558a89da6e
git diff 42e4198fa012eb24596e7984d77e27f0905348d6 269f9db80c15b7c292958facf4492b558a89da6e -- .github/workflows/opencode-review-dispatch.yml tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py
echo '---- AST outline tests ----'
ast-grep outline tests/test_opencode_agent_contract.py --items all --type function --match 'coverage|lock|gateway|route|v1' || true
ast-grep outline tests/test_pr_review_autofix_nvidia_nim_contract.py --items all --type function --match 'blob|workflow|pin|coverage|lock' || true
echo '---- file sizes ----'
wc -l .github/workflows/opencode-review-dispatch.yml tests/test_opencode_agent_contract.py tests/test_pr_review_autofix_nvidia_nim_contract.py

Length of output: 11501

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo '---- hash and merge verification ----'
git hash-object .github/workflows/opencode-review-dispatch.yml
git rev-parse HEAD:.github/workflows/opencode-review-dispatch.yml
git diff --check 9c6d053742856f4969504474f7e8f4c6378aaffc 269f9db80c15b7c292958facf4492b558a89da6e
echo '---- coverage workflow region ----'
sed -n '602,750p' .github/workflows/opencode-review-dispatch.yml
echo '---- workflow route region ----'
sed -n '3975,4015p' .github/workflows/opencode-review-dispatch.yml
echo '---- coverage assertion ----'
sed -n '714,782p' tests/test_opencode_agent_contract.py
echo '---- blob pin assertion ----'
sed -n '1,66p;162,198p' tests/test_pr_review_autofix_nvidia_nim_contract.py
echo '---- gateway test outline ----'
ast-grep outline tests/test_opencode_gateway_route_integration.py --items all
echo '---- gateway and route files ----'
git diff 42e4198fa012eb24596e7984d77e27f0905348d6 269f9db80c15b7c292958facf4492b558a89da6e -- opencode.jsonc .github/workflows/pr-review-autofix.yml .github/workflows/strix.yml scripts/ci/test_strix_quick_gate.sh
echo '---- lockfile presence ----'
git ls-tree HEAD requirements-noema-document-ci-hashes.txt requirements-opencode-review-ci-hashes.txt scripts/ci/install_base_python_locks.py

Length of output: 28927

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo '---- Dockerfile lock usage and build invocation ----'
rg -n -C 5 -F 'requirements-noema-document-ci-hashes.txt' .github/workflows/opencode-review-dispatch.yml scripts/ci/install_base_python_locks.py tests/test_opencode_agent_contract.py
rg -n -C 5 'docker build|docker image build|coverage_build_dir|COPY requirements|install-base-python-locks' .github/workflows/opencode-review-dispatch.yml | sed -n '1,230p'
echo '---- gateway sidecar and serving route references ----'
rg -n -C 3 'CONTEXTUAL_ORCHESTRATOR_BASE_URL|/v1/chat/completions|chat/completions' scripts/ci/contextual_orchestrator_review_sidecar.sh tests/test_opencode_gateway_route_integration.py | sed -n '1,240p'
echo '---- gateway route integration test full ----'
cat -n tests/test_opencode_gateway_route_integration.py
echo '---- merge source comparison names ----'
git diff --name-status 42e4198fa012eb24596e7984d77e27f0905348d6 269f9db80c15b7c292958facf4492b558a89da6e
echo '---- owner PR metadata ----'
gh pr view 2286 --repo ContextualWisdomLab/.github --json headRefOid,baseRefOid,state,isDraft --jq '{headRefOid,baseRefOid,state,isDraft}'
gh pr view 2333 --repo ContextualWisdomLab/.github --json headRefOid,baseRefOid,state,isDraft --jq '{headRefOid,baseRefOid,state,isDraft}'

Length of output: 35133

---

@seonghobae I independently reviewed Draft #2363 at head 269f9db80c15b7c292958facf4492b558a89da6e against base 9c6d053742856f4969504474f7e8f4c6378aaffc. I found no blocking merge findings.

• The merge retains the #2286 coverage changes and the #2333 gateway-route changes.
• The trusted Noema lockfile is present in the head tree. The workflow validates and copies it into the Docker build context. The Dockerfile copies and installs it with --require-hashes.
• The sidecar exports a bare origin. The provider configuration adds /v1, which targets the served /v1/chat/completions route.
• The combined workflow blob is ca90c602d95512ccba3daa581d44464e8871c63c. It matches REVIEW_DISPATCH_BLOB_SHA.

I approve this exact head. Hosted required checks remain queued. This approval does not establish hosted acceptance or request a merge.

✅ Action performed

Comments resolved. Approval is disabled; enable reviews.request_changes_workflow to allow explicit top-level @coderabbitai resolve or @coderabbitai approve commands.