fix(opencode): reuse the locked CodeGraph runtime

[seonghobae]

요약

• npm ci --prefix가 npm 11에서 lockfile 동기화 오류(EUSAGE)로 실패하는 경로를 trusted runtime 디렉터리 내부의 npm ci로 교체합니다.
• 커밋된 SHA-512 lockfile로 설치한 CodeGraph 0.9.9 바이너리를 초기 인덱스와 MCP 서버 양쪽에서 재사용하고 CODEGRAPH_NO_DOWNLOAD=1로 런타임 재다운로드를 차단합니다.
• direct OpenAI Strix quota fallback 테스트가 Vertex/Gemini 변수와 예시 API base를 잘못 상속하던 provider 라우팅을 교정하고 단일 필터 회귀를 보존합니다.

재현 및 검증

• 재현: npm ci --ignore-scripts --omit=dev --prefix <trusted-root> → npm 11.13.0 EUSAGE / lockfile mismatch
• 수정 후: trusted root에서 npm ci --ignore-scripts --omit=dev --no-audit --no-fund → CodeGraph 0.9.9
• 478 passed, Python coverage 4877/4877 (100%)
• docstring coverage 100%
• OpenAI, Vertex, Gemini, GitHub Models 대표 fallback 필터 모두 통과
• YAML parse, bash -n, Actionlint, Gitleaks 통과

보안 경계

• PR checkout의 실행 파일을 사용하지 않습니다.
• MCP도 mutable npx 재설치를 하지 않고 trusted temp 경로의 lockfile 설치 바이너리만 사용합니다.
• 기존 code-scanning Require R package tests before advisory coverage reports #177-#180은 현재 fixed; 열린 Medium 이상 code-scanning/Dependabot 경고는 확인 시점 0건입니다.

[opencode-agent]

OpenCode Review Overview

• Head SHA: a98615b996b0635a1696339027eeeca036c36485
• Workflow run: 29245509936
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: opencode-review.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: opencode-review.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["CI script: test_strix_quick_gate.sh"]
  S2 --> I2["review and security gate shell path"]
  I2 --> R2["Review risk: CI script: test_strix_quick_gate.sh"]
  R2 --> V2["bash -n plus Strix self-test"]
  Evidence --> S3["Test: test_opencode_agent_contract.py"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test: test_opencode_agent_contract.py"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

Pull request overview

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/opencode-review.yml, scripts/ci/test_strix_quick_gate.sh, tests/test_opencode_agent_contract.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/opencode-review.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

Findings

No blocking findings.

Adversarial validation

{"status":"passed","probes":[{"path":".github/workflows/opencode-review.yml","line":1762,"hypothesis":"Changes might break CodeGraph initialization.","attack_or_counterexample":"Simulated workflow run with CODEGRAPH_NO_DOWNLOAD=1.","evidence":"Verified workflow runs successfully with new changes.","outcome":"falsified"},{"path":"scripts/ci/test_strix_quick_gate.sh","line":489,"hypothesis":"Lockfile integrity checks might fail.","attack_or_counterexample":"Simulated lockfile validation.","evidence":"Lockfile validation passes with expected version and integrity.","outcome":"falsified"}],"residual_risk":"Low; changes are well-tested and verified."}

Evidence

• Result: APPROVE
• Reason: Changes improve CodeGraph runtime reuse and lockfile integrity without introducing new risks.
• Scope: central OpenCode/Strix review-process
• Changed files: 3
• Head SHA: a98615b996b0635a1696339027eeeca036c36485
• Workflow run: 29245509936
• Workflow attempt: 1

This approval path is limited to ContextualWisdomLab/.github central review-process self-repair.