fix(opencode): bind gold freeze receipts and fail-closed writes

.github/workflows/opencode-review-corpus-quality-ci.yml

@@ -0,0 +1,98 @@
+name: OpenCode Review Corpus Quality CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/opencode-review-corpus-quality-ci.yml"
+      - "scripts/ci/opencode_review_sample.py"
+      - "scripts/ci/opencode_review_adjudicate.py"
+      - "scripts/ci/opencode_review_adjudication_primitives.py"
+      - "scripts/ci/opencode_review_adjudication_annotations.py"
+      - "scripts/ci/opencode_review_adjudication_decisions.py"
+      - "scripts/ci/opencode_review_safe_io.py"
+      - "tests/test_opencode_review_sample.py"
+      - "tests/test_opencode_review_sample_coverage.py"
+      - "tests/test_opencode_review_adjudicate.py"
+      - "tests/test_opencode_review_adjudicate_coverage.py"
+      - "tests/test_opencode_review_safe_io.py"
+      - "docs/doctoring/opencode-review-annotation-guide.md"
+      - "benchmarks/opencode_review/head_matched_v1/**"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-review-corpus-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gold-corpus-quality:
+    name: gold-corpus-quality
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install exact hash-verified test runner dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+          PIP_NO_INPUT: "1"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/opencode-review-corpus-requirements.txt" <<'REQEOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          REQEOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/opencode-review-corpus-requirements.txt"
+
+      - name: Verify head-matched corpus contracts
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run \
+            --branch \
+            --source=scripts/ci \
+            -m pytest \
+            tests/test_opencode_review_sample.py \
+            tests/test_opencode_review_sample_coverage.py \
+            tests/test_opencode_review_adjudicate.py \
+            tests/test_opencode_review_adjudicate_coverage.py \
+            tests/test_opencode_review_safe_io.py \
+            -q
+          python -m coverage report \
+            --include='scripts/ci/opencode_review_sample.py,scripts/ci/opencode_review_adjudicate.py,scripts/ci/opencode_review_adjudication_primitives.py,scripts/ci/opencode_review_adjudication_annotations.py,scripts/ci/opencode_review_adjudication_decisions.py,scripts/ci/opencode_review_safe_io.py' \
+            --fail-under=100 \
+            --show-missing
+          python -m compileall -q \
+            scripts/ci/opencode_review_sample.py \
+            scripts/ci/opencode_review_adjudicate.py \
+            scripts/ci/opencode_review_adjudication_primitives.py \
+            scripts/ci/opencode_review_adjudication_annotations.py \
+            scripts/ci/opencode_review_adjudication_decisions.py \
+            scripts/ci/opencode_review_safe_io.py \
+            tests/test_opencode_review_sample.py \
+            tests/test_opencode_review_sample_coverage.py \
+            tests/test_opencode_review_adjudicate.py \
+            tests/test_opencode_review_adjudicate_coverage.py \
+            tests/test_opencode_review_safe_io.py
+          git diff --exit-code

.github/workflows/opencode-review-decision-quality-ci.yml

@@ -0,0 +1,85 @@
+name: OpenCode Review Decision Quality CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/opencode-review-decision-quality-ci.yml"
+      - "scripts/ci/opencode_review_decision.py"
+      - "scripts/ci/opencode_review_decision_primitives.py"
+      - "scripts/ci/opencode_review_decision_validation.py"
+      - "tests/opencode_review_decision_test_support.py"
+      - "tests/test_opencode_review_decision_*.py"
+      - "docs/doctoring/opencode-review-decision-envelope.md"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-review-decision-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  decision-envelope-quality:
+    name: decision-envelope-quality
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install exact hash-verified test runner dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+          PIP_NO_INPUT: "1"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/opencode-review-decision-requirements.txt" <<'REQEOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          REQEOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/opencode-review-decision-requirements.txt"
+
+      - name: Verify independent decision channels
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run \
+            --branch \
+            --source=scripts/ci \
+            -m pytest \
+            tests/test_opencode_review_decision_channels.py \
+            tests/test_opencode_review_decision_validation.py \
+            tests/test_opencode_review_decision_cli.py \
+            -q
+          python -m coverage report \
+            --include='scripts/ci/opencode_review_decision.py,scripts/ci/opencode_review_decision_primitives.py,scripts/ci/opencode_review_decision_validation.py' \
+            --fail-under=100 \
+            --show-missing
+          python -m compileall -q \
+            scripts/ci/opencode_review_decision.py \
+            scripts/ci/opencode_review_decision_primitives.py \
+            scripts/ci/opencode_review_decision_validation.py \
+            tests/opencode_review_decision_test_support.py \
+            tests/test_opencode_review_decision_channels.py \
+            tests/test_opencode_review_decision_validation.py \
+            tests/test_opencode_review_decision_cli.py
+          git diff --exit-code

.github/workflows/opencode-review-quality-ci.yml

@@ -0,0 +1,96 @@
+name: OpenCode Review Quality CI
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/opencode-review-quality-ci.yml"
+      - "benchmarks/opencode_review/**"
+      - "scripts/ci/opencode_review_quality_score.py"
+      - "scripts/ci/opencode_review_safe_io.py"
+      - "tests/test_opencode_review_quality_score.py"
+      - "tests/test_opencode_review_safe_io.py"
+      - "tests/test_opencode_review_quality_evidence_contract.py"
+      - "docs/doctoring/opencode-review-quality-evaluation.md"
+      - "docs/superpowers/specs/2026-08-08-opencode-review-quality.md"
+      - "docs/superpowers/plans/2026-08-08-opencode-review-quality.md"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-review-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  empirical-review-quality:
+    name: empirical-review-quality
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install exact hash-verified test runner dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+          PIP_NO_INPUT: "1"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/opencode-review-quality-requirements.txt" <<'EOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          EOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/opencode-review-quality-requirements.txt"
+
+      - name: Verify empirical review quality contracts
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run \
+            --branch \
+            --source=scripts/ci \
+            -m pytest \
+            tests/test_opencode_review_quality_score.py \
+            tests/test_opencode_review_quality_evidence_contract.py \
+            tests/test_opencode_review_safe_io.py \
+            -q
+          python -m coverage report \
+            --include='scripts/ci/opencode_review_quality_score.py,scripts/ci/opencode_review_safe_io.py' \
+            --fail-under=100 \
+            --show-missing
+          python scripts/ci/opencode_review_quality_score.py \
+            --input-root "${GITHUB_WORKSPACE}" \
+            --output-root "${RUNNER_TEMP}" \
+            --input benchmarks/opencode_review/pilot_baseline_v1.json \
+            --json-output "${RUNNER_TEMP}/opencode-review-quality.json" \
+            --markdown-output "${RUNNER_TEMP}/opencode-review-quality.md"
+          python -m json.tool "${RUNNER_TEMP}/opencode-review-quality.json" >/dev/null
+          python -m json.tool benchmarks/opencode_review/pilot_baseline_v1.json >/dev/null
+          grep -Fq 'Parity gate: **INSUFFICIENT_EVIDENCE**' \
+            "${RUNNER_TEMP}/opencode-review-quality.md"
+          cat "${RUNNER_TEMP}/opencode-review-quality.md" >>"$GITHUB_STEP_SUMMARY"
+          python -m compileall -q \
+            scripts/ci/opencode_review_quality_score.py \
+            scripts/ci/opencode_review_safe_io.py \
+            tests/test_opencode_review_quality_score.py \
+            tests/test_opencode_review_safe_io.py \
+            tests/test_opencode_review_quality_evidence_contract.py
+          git diff --exit-code

.github/workflows/opencode-review-shadow-quality-ci.yml

@@ -0,0 +1,93 @@
+name: OpenCode Review Shadow Quality CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/opencode-review-shadow-quality-ci.yml"
+      - "scripts/ci/opencode_review_shadow.py"
+      - "scripts/ci/opencode_review_shadow_primitives.py"
+      - "scripts/ci/opencode_review_safe_io.py"
+      - "scripts/ci/opencode_review_verify.py"
+      - "scripts/ci/run_opencode_semantic_review_pool.sh"
+      - "tests/opencode_review_shadow_test_support.py"
+      - "tests/test_opencode_review_shadow_*.py"
+      - "docs/doctoring/opencode-review-shadow-orchestration.md"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-review-shadow-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  shadow-review-quality:
+    name: shadow-review-quality
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install exact hash-verified test runner dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+          PIP_NO_INPUT: "1"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/opencode-review-shadow-requirements.txt" <<'REQEOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          REQEOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/opencode-review-shadow-requirements.txt"
+
+      - name: Verify shadow detector-verifier contracts
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run \
+            --branch \
+            --source=scripts/ci \
+            -m pytest \
+            tests/test_opencode_review_shadow_routing.py \
+            tests/test_opencode_review_shadow_execution.py \
+            tests/test_opencode_review_shadow_verification.py \
+            tests/test_opencode_review_shadow_validation.py \
+            tests/test_opencode_review_safe_io.py \
+            -q
+          python -m coverage report \
+            --include='scripts/ci/opencode_review_shadow.py,scripts/ci/opencode_review_shadow_primitives.py,scripts/ci/opencode_review_verify.py,scripts/ci/opencode_review_safe_io.py' \
+            --fail-under=100 \
+            --show-missing
+          bash -n scripts/ci/run_opencode_semantic_review_pool.sh
+          python -m compileall -q \
+            scripts/ci/opencode_review_shadow.py \
+            scripts/ci/opencode_review_shadow_primitives.py \
+            scripts/ci/opencode_review_verify.py \
+            scripts/ci/opencode_review_safe_io.py \
+            tests/opencode_review_shadow_test_support.py \
+            tests/test_opencode_review_shadow_routing.py \
+            tests/test_opencode_review_shadow_execution.py \
+            tests/test_opencode_review_shadow_verification.py \
+            tests/test_opencode_review_shadow_validation.py \
+            tests/test_opencode_review_safe_io.py
+          git diff --exit-code