fix(opencode): publish dispatch status with workflow token

.github/workflows/opencode-review.yml

@@ -6754,18 +6754,23 @@ jobs:
           && steps.opencode_review_model_pool.outputs.review_status != ''
         continue-on-error: true
         env:
-          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || github.token }}
+          GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || github.token }}
           GH_REPOSITORY: ${{ github.event.inputs.target_repository }}
           PR_HEAD_SHA: ${{ github.event.inputs.pr_head_sha }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           OPENCODE_MODEL_POOL_OUTCOME: ${{ steps.opencode_review_model_pool.outputs.review_status }}
-          OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || steps.opencode_app_token.outputs.available == 'true' && 'opencode-app' || 'github-token' }}
+          OPENCODE_STATUS_TOKEN_SOURCE: ${{ secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || 'github-token' }}
         run: |
           set -euo pipefail
           if [ -z "${PR_HEAD_SHA:-}" ]; then
             echo "::warning::OpenCode workflow_dispatch status publication skipped because pr_head_sha was empty."
             exit 0
           fi
+          if [ "${GH_REPOSITORY:-}" != "${GITHUB_REPOSITORY:-}" ] &&
+            [ "${OPENCODE_STATUS_TOKEN_SOURCE:-}" = "github-token" ]; then
+            echo "::warning::OpenCode workflow_dispatch status publication skipped because only the same-repository github.token is available for cross-repository target ${GH_REPOSITORY}; configure PR_REVIEW_MERGE_TOKEN or OPENCODE_APPROVE_TOKEN to publish this status."
+            exit 0
+          fi
 
           state="success"
           description="OpenCode workflow_dispatch evidence passed for current head."

PR_GOVERNANCE_AUDIT.md

@@ -324,6 +324,17 @@ PR #381: wait: OpenCode review is already in progress
 
 ## Remaining Proof Gaps
 
+- 2026-07-13 KST `.github` workflow-dispatch run `29227653777` produced a
+  current-head real-model approval for PR #506 after 409 tests, 100% executable
+  coverage, 100% docstring coverage, and three falsified adversarial probes, but
+  job `86745134533` then selected the OpenCode app token for the
+  `opencode-review` commit status and failed with `Resource not accessible by
+  integration (HTTP 403)`. The app has pull-request review permission but not
+  commit-status permission. Same-repository dispatch status publication must use
+  the workflow token; cross-repository dispatch must emit a precise warning and
+  skip the write unless `PR_REVIEW_MERGE_TOKEN` or `OPENCODE_APPROVE_TOKEN` is
+  configured, rather than turning valid review evidence into an opaque job
+  failure.
 - 2026-06-29 KST `html4tree` onboarding gap: PR #3 is the lowest open PR and is
   cleanly mergeable by GitHub, but current head
   `d0c4cbc2bb267aed407e4bf6308f4f3cfd3b504c` has no check runs and no reviews.

tests/test_opencode_agent_contract.py

@@ -927,10 +927,14 @@ def test_opencode_runs_merge_scheduler_after_review_without_repo_local_dispatch(
     )[0]
     assert (
         "GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || "
-        "secrets.OPENCODE_APPROVE_TOKEN || steps.opencode_app_token.outputs.token || "
-        "github.token }}"
+        "secrets.OPENCODE_APPROVE_TOKEN || github.token }}"
     ) in status_step
     assert "OPENCODE_STATUS_TOKEN_SOURCE" in status_step
+    assert "steps.opencode_app_token.outputs" not in status_step
+    assert (
+        "same-repository github.token is available for cross-repository target"
+        in status_step
+    )
     assert "using %s token" in status_step
     assert "SCHEDULER_ACTIONS_TOKEN: ${{ github.token }}" in workflow
     assert (