ContextualWisdomLab · seonghobae · Aug 13, 2026 · Aug 8, 2026 · Aug 8, 2026 · Aug 8, 2026
@@ -0,0 +1,86 @@
+name: OpenCode Review Decision Quality CI
+
+on:
+  pull_request:
+    branches:
+      - main
+      - feat/opencode-review-gold-corpus
+    paths:
+      - ".github/workflows/opencode-review-decision-quality-ci.yml"
+      - "scripts/ci/opencode_review_decision.py"
+      - "scripts/ci/opencode_review_decision_primitives.py"
+      - "scripts/ci/opencode_review_decision_validation.py"
+      - "tests/opencode_review_decision_test_support.py"
+      - "tests/test_opencode_review_decision_*.py"
+      - "docs/doctoring/opencode-review-decision-envelope.md"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-review-decision-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  decision-envelope-quality:
+    name: decision-envelope-quality
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install exact hash-verified test runner dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+          PIP_NO_INPUT: "1"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/opencode-review-decision-requirements.txt" <<'REQEOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          REQEOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/opencode-review-decision-requirements.txt"
+
+      - name: Verify independent decision channels
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run \
+            --branch \
+            --source=scripts/ci \
+            -m pytest \
+            tests/test_opencode_review_decision_channels.py \
+            tests/test_opencode_review_decision_validation.py \
+            tests/test_opencode_review_decision_cli.py \
+            -q
+          python -m coverage report \
+            --include='scripts/ci/opencode_review_decision.py,scripts/ci/opencode_review_decision_primitives.py,scripts/ci/opencode_review_decision_validation.py' \
+            --fail-under=100 \
+            --show-missing
+          python -m compileall -q \
+            scripts/ci/opencode_review_decision.py \
+            scripts/ci/opencode_review_decision_primitives.py \
+            scripts/ci/opencode_review_decision_validation.py \
+            tests/opencode_review_decision_test_support.py \
+            tests/test_opencode_review_decision_channels.py \
+            tests/test_opencode_review_decision_validation.py \
+            tests/test_opencode_review_decision_cli.py
+          git diff --exit-code
@@ -0,0 +1,90 @@
+name: OpenCode Review Shadow Quality CI
+
+on:
+  pull_request:
+    branches:
+      - main
+      - feat/opencode-review-decision-envelope
+    paths:
+      - ".github/workflows/opencode-review-shadow-quality-ci.yml"
+      - "scripts/ci/opencode_review_shadow.py"
+      - "scripts/ci/opencode_review_shadow_primitives.py"
+      - "scripts/ci/opencode_review_verify.py"
+      - "scripts/ci/run_opencode_semantic_review_pool.sh"
+      - "tests/opencode_review_shadow_test_support.py"
+      - "tests/test_opencode_review_shadow_*.py"
+      - "docs/doctoring/opencode-review-shadow-orchestration.md"
+      - "CHANGELOG.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: opencode-review-shadow-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  shadow-review-quality:
+    name: shadow-review-quality
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout exact source revision
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: Install exact hash-verified test runner dependencies
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+          PIP_NO_INPUT: "1"
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          cat >"${RUNNER_TEMP}/opencode-review-shadow-requirements.txt" <<'REQEOF'
+          coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
+          iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
+          packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+          pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+          pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+          pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+          REQEOF
+          python -m pip install \
+            --only-binary=:all: \
+            --require-hashes \
+            -r "${RUNNER_TEMP}/opencode-review-shadow-requirements.txt"
+
+      - name: Verify shadow detector-verifier contracts
+        shell: bash --noprofile --norc -e -o pipefail {0}
+        run: |
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+          python -m coverage run \
+            --branch \
+            --source=scripts/ci \
+            -m pytest \
+            tests/test_opencode_review_shadow_routing.py \
+            tests/test_opencode_review_shadow_execution.py \
+            tests/test_opencode_review_shadow_verification.py \
+            tests/test_opencode_review_shadow_validation.py \
+            -q
+          python -m coverage report \
+            --include='scripts/ci/opencode_review_shadow.py,scripts/ci/opencode_review_shadow_primitives.py,scripts/ci/opencode_review_verify.py' \
+            --fail-under=100 \
+            --show-missing
+          bash -n scripts/ci/run_opencode_semantic_review_pool.sh
+          python -m compileall -q \
+            scripts/ci/opencode_review_shadow.py \
+            scripts/ci/opencode_review_shadow_primitives.py \
+            scripts/ci/opencode_review_verify.py \
+            tests/opencode_review_shadow_test_support.py \
+            tests/test_opencode_review_shadow_routing.py \
+            tests/test_opencode_review_shadow_execution.py \
+            tests/test_opencode_review_shadow_verification.py \
+            tests/test_opencode_review_shadow_validation.py
+          git diff --exit-code
@@ -0,0 +1,87 @@
+# Architecture — ContextualWisdomLab `.github`
+
+This repository is the organization control plane. It is not naruon and it
+does not own product data. Sibling products remain standalone modules; this
+repo publishes org profile assets, reusable required workflows, and the
+review/merge schedulers those products consume.
+
+## System context
+
+```mermaid
+flowchart LR
+  Buyer["Commercial buyer / reviewer"]
+  Agents["Agents on AGENTS.md"]
+  Project["GitHub Project #1"]
+  Hub["This repo: org .github"]
+  Products["Owned products<br/>naruon · orchestrator · engines"]
+  Runner["Required workflows in each repo context"]
+
+  Buyer --> Hub
+  Agents --> Project
+  Agents --> Hub
+  Project --> Hub
+  Hub --> Runner
+  Runner --> Products
+  Products -->|"standalone or as module"| Buyer
+```
+
+## Shadow review pool
+
+```mermaid
+flowchart TD
+  Meta["Trusted PR metadata"]
+  Plan["Deterministic risk-adaptive plan"]
+  Detect["Bounded detector attempts"]
+  Verify["Independent verifier"]
+  Receipt["Immutable shadow findings"]
+  Block["No comment, review, check, approval, or merge"]
+
+  Meta --> Plan
+  Plan --> Detect
+  Detect --> Verify
+  Verify --> Receipt
+  Receipt --> Block
+```
+
+CWE-345: shadow findings are evaluation evidence, not authenticity
+evidence for merge. CWE-841: semantic source judgment and merge
+readiness stay independent. Reviewers stay `edit: deny`. Bind
+`NVIDIA_NIM_API_KEY`, never `COPILOT_GITHUB_TOKEN`.
+
+## Control-plane data flow
+
+```mermaid
+sequenceDiagram
+  participant PR as Pull request
+  participant RW as Required workflows
+  participant OC as OpenCode reviewer
+  participant SV as sandboxed_verify / web E2E
+  participant MS as Merge scheduler
+
+  PR->>RW: pull_request_target on trusted base
+  RW->>OC: bounded evidence + NVIDIA NIM / OpenCode
+  OC->>SV: PoC command in isolated copy
+  SV-->>OC: redacted stdout/stderr + command metadata
+  OC-->>PR: APPROVE or request changes
+  MS->>PR: merge only on current-head approval + green checks
+```
+
+## Trust boundaries
+
+- Required review workflows execute **base-branch** scripts.
+- Reviewer agents stay `edit: deny`.
+- Logs redact credential shapes. They do not mask operational PII.
+- LLM and scheduled agents bind `NVIDIA_NIM_API_KEY`. They never use
+  `COPILOT_GITHUB_TOKEN`.
+- Rust remains the psychometric arithmetic owner.
+
+## Quality gates
+
+`scripts/ci/` ships with 100% statement/branch coverage and 100%
+docstrings.
+
+## Related durable documents
+
+- [`docs/CWL-MASTER-CONTEXT.md`](docs/CWL-MASTER-CONTEXT.md)
+- [`PR_GOVERNANCE_AUDIT.md`](PR_GOVERNANCE_AUDIT.md)
+- [`docs/doctoring/opencode-review-shadow-orchestration.md`](docs/doctoring/opencode-review-shadow-orchestration.md)
@@ -8,6 +8,9 @@ Semantic Versioning where the repository publishes a release.
 
 ### Added
 
+- Added a production-independent OpenCode shadow review pool with deterministic risk-adaptive routing, bounded non-shell detector and verifier execution, child-only NVIDIA credential mapping, secret redaction, immutable evidence receipts, strict output-directory boundaries, partial-failure isolation, and non-publishing verified findings backed by 100% owned production statement, branch, and callable-docstring evidence. The decision record now cites CWE-345 so shadow findings cannot be treated as authenticity evidence for merge.
+- Recorded the org control-plane architecture, including the shadow review pool, so agents reconstruct the evaluation-versus-merge trust boundary from the repo instead of private memory.
+- Added an exact-head OpenCode decision envelope that keeps semantic source verdicts independent from coverage, checks, approval, and branch-protection merge readiness; emits path-free infrastructure blockers; fails closed on stale or malformed evidence; and preserves 100% production statement, branch, and public-docstring evidence. The decision record now cites CWE-841 so a coverage or policy failure cannot be converted into a source defect.
 - Added deterministic exact-head corpus sampling and blinded two-expert-plus-adjudicator gold-freeze tooling, with strict JSON, immutable evidence receipts, hard language/size/risk/defect coverage, atomic outputs, stable failure classes, and permanent 100% production statement/branch/docstring evidence.
 - Added an empirical OpenCode review-quality benchmark, fail-closed scorer, exact-head quality workflow, and APA 7th doctoring that keep lifecycle-yield evidence separate from head-matched expert-gold precision and recall, require Wilson-bound non-inferiority before any CodeRabbit-parity claim, and preserve 100% production statement/branch/docstring evidence.
 - Added a trusted pull-request comment router for `@cwl-noema-review` and review-only `@opencode-agent` dispatches, with an organization sweep, exact-head receipts, repository allowlisting, fixed runners, immutable checkout pins, and a permanent 100% statement/branch/docstring quality gate.

@@ -64,7 +64,9 @@ Details: `README.md` and `PR_GOVERNANCE_AUDIT.md`.
 - `fuzz/` + `.clusterfuzzlite/` — Atheris fuzz targets for the review-output normalizer and the
   ClusterFuzzLite discovery marker.
 - `docs/` — master context, Project protocol, `org-required-workflow-rollout.md`,
-  `scorecard-governance.md`, SBOM inventory.
+  `scorecard-governance.md`, SBOM inventory. Doctoring records live under
+  `docs/doctoring/`. [`ARCHITECTURE.md`](ARCHITECTURE.md) is the control-plane
+  diagram for the shadow review pool and merge trust boundaries.
 - `.jules/` — recorded performance (`bolt.md`) and security (`sentinel.md`) learnings from past work
   on `scripts/ci/`; worth scanning before optimizing or hardening those scripts.