fix(opencode): emit redaction-safe provider failure envelope before approval settlement

[seonghobae]

Problem

Exact-head OpenCode on .github#2106@24bb6591ab7df23558cb793b4af60c567ff9da97 failed after the CodeQL bootstrap itself had converged. Run 34693400612 reached the model call through contextual-orchestrator/orchestrator/free, then published only:

OpenCode provider failure metadata: class=provider-error json-bytes=836 stderr-bytes=0; provider-controlled content suppressed.

The corresponding opencode-review commit status is failure: No validated exact-current-head OpenCode approval was published (model outcome: exhausted).

The current protected-main implementation is scripts/ci/run_opencode_review_model_pool.sh; its failure classifier collapses any non-empty JSON/stderr response into provider-error and emits byte counts only. That preserves redaction, but it discards the bounded machine-readable metadata needed to decide whether the causal owner is queue admission, route exhaustion, HTTP 429/5xx, malformed provider JSON, request size, served-model omission, or another gateway/provider class.

This matters because the same run spent about 486 s establishing sidecar health/provider-route preflight, invoked only the required contextual-orchestrator/orchestrator/free route, then failed roughly five seconds after the request. The current log does not contain enough safe evidence to attribute that five-second failure to the correct owner. It must not be guessed to be the separate 90-second implicit-timeout defect or repaired by source-neutral reruns.

Required repair

At the OpenCode adapter/normalization boundary, parse a bounded failure envelope from the orchestrator response and emit only redaction-safe fields:

• phase;
• normalized reason/class;
• provider identifier when present;
• HTTP status or exception class when present;
• request/response duration;
• served model when present;
• explicit absence markers for fields the gateway did not return.

Provider-controlled message/body text, prompts, credentials, headers, source contents, and arbitrary nested payloads remain suppressed.

The status/verdict contract remains fail-closed: richer telemetry is diagnostic evidence only and must not turn provider failure into approval, clean review evidence, or a merge bypass.

Test-first acceptance

Add production-shaped fixtures for at least:

1. HTTP 429 / queue-capacity or rate-limit response;
2. provider 5xx;
3. malformed/non-JSON body;
4. request-too-large / payload admission failure;
5. model-pool exhaustion or no eligible route;
6. response with missing served-model metadata;
7. a response containing secrets/body text proving none of that content reaches stdout/status/annotations.

For each fixture, assert the bounded normalized metadata that is emitted and assert raw provider-controlled content is absent. Preserve the existing single orchestrator/free route, gateway-token boundary, provider/model non-hard-coding, and no caller-side retry or timeout invention.

Exact evidence / non-goals

• consumer PR: .github#2106@24bb6591ab7df23558cb793b4af60c567ff9da97;
• OpenCode run: 34693400612;
• current CodeQL run on that same head: 34692079677, terminal success;
• current CodeQL dispatch contexts: codeql-dispatch/actions and codeql-dispatch/python, both success;
• current OpenCode status remains failure solely because no validated exact-head approval was published after model exhaustion.

Do not manually rerun #2106, manufacture a status, expose provider bodies, add provider/model/group fallbacks, enable paid routing, or weaken required review semantics to close this issue. The repair belongs in the central OpenCode adapter/telemetry owner and should be followed by an unchanged-head review replay only after the owner fix is protected/released according to the existing central contract.

[seonghobae]

I prototyped the smallest causal repair against exact protected source main@fb17ef556f94f673234aa557254ae52779e9a7b0 and exercised it locally before assigning a source owner. This is implementation evidence for this issue, not a merge or success claim.

Exact production boundary

Current scripts/ci/run_opencode_review_model_pool.sh::emit_sanitized_opencode_failure_detail only publishes class, JSON byte count, and stderr byte count. The #2106 incident therefore collapses a 5-second served-route failure into generic provider-error / model pool exhausted, even though the raw structured event may contain safe causal identity fields.

Prototype keeps the existing normalized failure class and adds one bounded structured-event parser. It reads only JSON lines whose top-level type == "error" and whose error value is an object. It never prints provider-controlled message, body, stderr, prompt, request payload, or credentials.

Safe envelope emitted by the prototype:

phase=model-run class=<normalized-class> reason=<normalized-class> provider=<token|absent> http-status=<100..599|absent> exception=<token|absent> duration-ms=<0..86400000|absent> served-model=<token|absent> json-bytes=<n> stderr-bytes=<n>

Structured aliases accepted only at this adapter boundary:

• provider: providerID | providerId | provider_id | provider
• served model: servedModel | served_model | modelID | modelId | model_id | model
• HTTP status: statusCode | status_code | httpStatus | http_status | status
• duration: durationMs | duration_ms | elapsedMs | elapsed_ms
• exception class: error.name

String fields must match ^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,95}$; unsafe/missing/malformed values become literal absent. HTTP status is bounded to 100–599, duration to 0–86,400,000 ms. This makes CR/LF/log-command/body injection fail closed at the publication boundary rather than trying to redact arbitrary prose after the fact.

RED/GREEN fixtures exercised

Focused production-shaped fixtures cover:

• HTTP 429 with provider/model/status/duration;
• provider HTTP 503;
• request-body/context-window overflow;
• malformed JSON;
• model-pool exhaustion / no route;
• missing served-model;
• secret/body text embedded in provider error objects;
• malicious structured tokens containing newline / log-forging text, invalid model text, and negative duration.

Observed local results on the exact protected-source snapshot:

• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -W error -m pytest -q tests/test_opencode_model_pool_runner.py -k 'failed_provider' → 8 passed / 27 deselected.
• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -W error -m pytest -q tests/test_opencode_model_pool_runner.py -k 'failed_provider or model_unavailable or credit_exhausted or context_overflow' → 9 passed / 26 deselected.
• bash -n scripts/ci/run_opencode_review_model_pool.sh → PASS.
• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -W error -m pytest -q tests/test_opencode_agent_contract.py -k 'model_pool or provider_failure' → 3 passed / 51 deselected.
• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python3 -W error -m pytest -q tests/test_product_technical_gap_baseline.py tests/test_contextual_orchestrator_review_policy.py → 52 passed.

The full test_opencode_model_pool_runner.py file was not claimed GREEN: its long-lived process cases exceeded the local execution window after 14 tests, and Ruff is not installed in this local validation environment. Hosted exact-head CI/security/review therefore remains mandatory.

Owner/architecture constraint

The same prototype updates ADR-0003, central product-gap doctoring, and CHANGELOG to state that the envelope is observability only. It does not add provider/model/group selection, direct provider fallback, paid fallback, elapsed-time-only termination, or any success path when review output is absent. orchestrator/free and contextual-orchestrator remain routing/admission owners.

Please use this as the RED→GREEN implementation contract for the canonical #2112 source lane. Before publishing a branch, re-read protected main, preserve any intervening owner changes, and require fresh exact-head hosted tests plus independent review. Do not manufacture a source-neutral rerun of #2106: that incident is a canary for this repair, not authorization evidence.

[seonghobae]

Canonical owner progress at #2114 current head 4c96d604c6962a6faea773eaaff109cfc398d227:

• RED 7f9489ea…: provider prose overrode a structured 502/provider_unavailable receipt as credit-exhausted (exact-source exit 1).
• RED 2e2d61d2…: a bounded 20,001-byte / 10,000-depth gateway body raised RecursionError (exact-source exit 1).
• RED fc13c6cd…: non-denylisted BYTEZ_TEST_SECRET_1234567890 reached all five identifier fields verbatim (exact-source exit 1), proving string-shape denial is not provenance.
• GREEN a8eb1353… through 4c96d604…: causal class uses only exact phase/reason enums plus validated status, contradictory evidence fails closed, deep JSON is bounded, and provider/model/exception identities remain unknown until a versioned CO receipt/catalog proves non-secret provenance. Exact-head source and three changed test files compile; the combined source probe exits 0.

CHANGELOG, doctoring, and docs/product-technical-gap-baseline.md now state that boundary. Exact hosted Runtime Quality 34698665121, Python Security 34698665155, Security 34698665119, Semgrep 34698665172, and CodeQL 34698665107 are queued, so this remains Draft/Proposed and is not release or consumer GREEN.

[seonghobae]

Fresh independent reproduction on .github#2117@d2d2410092a27b1d82af4ec1857efa657bf5838b: OpenCode repository-dispatch run 34702738897 reached the correct PR source and completed Run OpenCode PR Review model pool, but bounded review-comment/fast-approval publication was skipped, Publish OpenCode review outcome and Enforce current-head formal OpenCode review receipt failed, and the exact-head commit status is No validated exact-current-head OpenCode approval was published (model outcome: exhausted).

This narrows the classification: elapsed runtime alone is not a caller-side timeout signal, and the workflow did not fail before entering the model pool. The same exhausted outcome now blocks a second unrelated exact head whose deterministic Runtime Quality/Security/SAST/Python Security/CodeQL lanes are GREEN. Do not repair this with direct provider/model selection, paid fallback, timeout expansion, synthetic approval, or source-neutral retry storms.

Canonical telemetry successor #2114 is now exact 3c43dd165009d503b2ebf56324b975db440e2fdb; its Runtime Quality/Security/Python Security/SAST are GREEN, while CodeQL is RED only at the #2106/#2040 protected-handler settlement/order boundary and current-head independent APPROVED review is absent. After that owner line is protected/current, replaying an unchanged exhausted consumer head is the meaningful proof point.