feat(coverage): add bounded PyO3 peer-evidence gate

[seonghobae]

Buyer-visible blocker

Central OpenCode coverage currently fails before pytest collection in mature maturin/PyO3 packages when the isolated source-only sandbox cannot import the compiled native extension. This leaves otherwise verified Python-only product PRs blocked even when the exact head passes repository Python, Rust/PyO3, package, GPU, and fuzz jobs.

This bounded slice

• add scripts/ci/python_native_extension_peer_gate.py;
• require exact maturin + PyO3 metadata and the declared dotted module-name;
• classify only complete pytest collection failures caused exclusively by that declared native module being absent;
• reject mixed imports, test failures, setup/teardown errors, pytest internal errors, crashes, truncation, malformed input, and unsafe paths;
• refuse deferral when Rust, Cargo, native crate, native stub, packaging, dependency lock, requirements, GitHub workflow/action, or maturin metadata changes;
• verify trusted CheckRun records by exact head SHA, workflow, check name, completed state, and success conclusion;
• reject pending, failed, stale-head, status-only, lookalike, missing, duplicate-requirement, or malformed evidence;
• add APA 7 doctoring and authoritative changelog material.

Verification

Focused local verification on the published source:

81 tests passed
220/220 production statements covered
98/98 production branches covered
Python compilation succeeded

The tests include the exact fast_mlsirm._core failure shape and adversarial native-boundary, filesystem, log, metadata, and check-evidence cases.

Security boundary

This PR does not skip tests, build a PR-selected extension, enable network access, add a Python compatibility stub, approve a pull request, or weaken branch protection. A successful classification is explicitly not passing evidence; the final central workflow must still prove trusted exact-head Python, Rust/PyO3, and package checks.

Remaining integration

Keep this PR Draft. A follow-up commit in this PR must wire the helper into the central coverage and approval workflow, add the permanent workflow contracts, and re-run fast-mlsirm#546 on its exact current head. Until that integration is reviewed, the current fail-closed coverage behavior remains authoritative.

Advances #784.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 499d82d6-3588-44d9-9063-d7c47b37f851

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent address

Integrate the published PyO3 native-extension helper into the protected central OpenCode coverage/review path on this same branch; keep the PR Draft until the integration is complete and exact-head evidence passes.

Mirror the existing fail-closed R peer-evidence pattern rather than creating a second privileged reviewer. Required behavior:

1. In .github/workflows/opencode-review-dispatch.yml, capture each Python pytest/coverage command's complete bounded log and exit status without changing successful behavior.
2. When and only when a Python suite fails, invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest against the exact log, the relevant regular non-symlink pyproject.toml, and the exact base-to-head changed-file list.
3. A successful classification must not be reported as ordinary passing coverage. Publish a distinct compact marker stating that source-only Python collection was deferred exclusively for the unchanged declared PyO3 module and requires exact-head native peer evidence.
4. In the trusted review/approval phase, query live CheckRun objects for the exact PR head and verify the repository-owned Python, Rust/PyO3, and package checks with require-checks. Do not accept statuses, stale heads, queued/cancelled/skipped checks, name lookalikes, duplicate requirements, or predecessor evidence. Preserve the existing R peer gate and all normal failure paths.
5. Approval must remain blocked if the classifier, changed-file trust boundary, check inventory, or required peer check is absent or malformed. The classifier is a deferral classifier, never approval evidence by itself.
6. Add permanent workflow-contract tests covering: pure declared-module collection failure; mixed missing imports; test/setup/teardown/internal/crash/truncated failures; native/Cargo/Rust/stub/packaging/lock/requirements/workflow changes; exact-head successful peer checks; stale/pending/failed/status/lookalike evidence; coexistence with R deferral; coverage summary wording; and approval-gate enforcement.
7. Include the helper and workflow contract tests in permanent Python 3.10/3.14, compilation, 100% production statement/branch coverage, and public-docstring gates. No temporary repair workflow, branch-selected privileged execution, Python compatibility stub, networked PR test, skipped test, synthesized approval, merge, release, or protection change may remain.
8. After exact-head central checks pass, rerun OpenCode/Noema review for unchanged fast-mlsirm heads build(deps): bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 #546 d111e2b1341b0daab6b813074c7a7dbcf5c24ff4, fix(deps): protobuf를 aiplatform 호환 범위로 유지 #549 12fc519ca798c8400840f04b3b19c07754ad7dfe, and build(deps): bump google-cloud-bigquery from 3.42.0 to 3.42.2 #550 8db4c235d466446429fc32bdeeef3ca1fdaa8827; do not reuse their failed source-only coverage verdicts.

Update the doctoring and CHANGELOG to distinguish source-only measurement, trusted native peer evidence, and remaining interpretation limits. Preserve immutable called-workflow source, reviewer credentials, NVIDIA/OpenCode model policy, independent approval, unresolved-thread, and branch-protection boundaries.

[seonghobae]

@jules Implement the remaining central workflow integration on this existing Draft PR. Preserve the published helper and fail-closed trust boundary; do not create another PR or temporary workflow.

Required scope:

• wire python_native_extension_peer_gate.py classify-pytest into .github/workflows/opencode-review-dispatch.yml only after a real bounded Python suite failure, using the exact pytest log, regular non-symlink pyproject, and exact base-to-head changed-file list;
• publish a distinct PyO3 deferral marker rather than ordinary passing coverage;
• in the trusted approval phase, query live exact-head CheckRun records and call require-checks for protected Python, Rust/PyO3, and package peer checks;
• reject stale/pending/failed/status/lookalike/missing/malformed evidence and preserve the existing R deferral independently;
• add permanent workflow-contract tests for classification, changed-boundary rejection, exact-head peer evidence, R/PyO3 coexistence, summary wording, and approval enforcement;
• include the helper and workflow integration in Python 3.10/3.14 compile, 100% statement/branch coverage, public docstrings, actionlint, security, and changelog/doctoring checks.

Do not build PR-selected native code in the central sandbox, add a compatibility stub, skip product tests, use networked PR execution, change reviewer tokens or NVIDIA/OpenCode policy, weaken approval/protection gates, mark Ready, merge, or release. Commit as normal descendants without force-push, and report exact verification commands and the final head SHA.

[seonghobae]

@jules Implement the remaining integration directly on this branch; do not create any temporary, self-modifying, encoded-patch, or branch-writing workflow.

Required GREEN slice:

1. Wire scripts/ci/python_native_extension_peer_gate.py into .github/workflows/opencode-review-dispatch.yml after the isolated pytest attempt has produced a complete bounded log and exact changed-file inventory.
2. Accept deferral only when classify-pytest proves the sole failure is the exact declared maturin/PyO3 module and require-checks proves trusted exact-head CI::python, CI::rust, and CI::package CheckRuns are completed/successful.
3. Treat classification as deferred peer evidence, never as a passing test; preserve all coverage/docstring gates for the Python-owned changed files and fail closed on mixed failures, native/package/lock/workflow changes, stale or status-only evidence.
4. Add permanent workflow-contract tests covering ordering, trusted workflow/check-name ownership, exact-head binding, malformed evidence, and the fast_mlsirm._core case.
5. Run the focused suite, complete central tests, 100% production statement/branch/docstring evidence, compilation, and exact-head security workflows. Keep Draft until all current-head evidence is GREEN.

After integration, rerun OpenCode review for unchanged fast-mlsirm PRs #546, #549, and #550; predecessor coverage failures are not reusable.

[seonghobae]

@jules Integrate the committed helper into the central opencode-review-dispatch.yml now; keep this PR Draft until end-to-end exact-head evidence is complete.

Required fail-closed flow:

1. Preserve the current central source-only coverage run and capture its complete bounded combined stdout/stderr plus exit status. On success, continue unchanged.
2. On failure, write the exact base…head changed-file list to a bounded newline file and invoke python_native_extension_peer_gate.py classify-pytest. Deferral is allowed only when that helper proves the sole failure is absence of the exact unchanged maturin/PyO3 module-name; any native/Cargo/stub/packaging/lock/requirements/workflow/maturin-metadata change or mixed pytest failure remains blocking.
3. A successful classification is not a pass. Query CheckRun—not StatusContext—evidence for the exact PR head and invoke require-checks for these exact fast-mlsirm CI jobs before the central review may treat source-only coverage as peer-proven:
   • CI::python
   • CI::rust
   • CI::package
   • CI::gpu-smoke
   • CI::fuzz
     Keep Security Scan and SAST under the existing central gates. Reject absent, pending, failed, stale-head, lookalike-workflow, duplicate-requirement, or malformed evidence.
4. Emit an explicit non-success classification such as coverage_deferred_to_exact_head_native_peer_evidence; do not report the source-only sandbox as passing and do not lower the repository's 100% coverage contract.
5. Add workflow contract tests that exercise the exact fast_mlsirm._core collection failure, successful exact-head peer evidence, stale/pending/failed/status-only/check-name/workflow-name mismatches, native-boundary changes, mixed failures, truncation, and normal pure-Python pytest failures.
6. Re-run the central workflow against current exact heads of fast-mlsirm#546, #549, and #550. The integration is accepted only if those previously blocked Python-only PRs receive no coverage CHANGES_REQUESTED, while a synthetic native-code change and mixed pytest failure still block.

Do not build PR-selected native code inside the central sandbox, introduce a Python stub, auto-approve, weaken required checks, use COPILOT_GITHUB_TOKEN, or disturb the existing reviewer-agent secret contract. Update APA 7 doctoring and the authoritative changelog after GREEN.

[seonghobae]

@coderabbitai Review the current Draft head 68e8b1695280d11c58b5553457442527f9d0542c specifically as an implementation-design review for the remaining PyO3 workflow integration. Do not approve, mutate, or merge. Identify the exact existing R-deferral variables/functions/approval gates in .github/workflows/opencode-review-dispatch.yml, and provide a minimal patch plan that reuses them for python_native_extension_peer_gate.py while preserving ordinary Python failures, exact-head CheckRun validation, R/PyO3 coexistence, and all immutable-source/credential boundaries. Flag any defect in the published helper or tests before integration.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 5 minutes and 1 seconds before sending another message.

[seonghobae]

@opencode-agent

Prepare the next bounded integration only after .github#759 produces a GREEN exact head, because both changes touch the authoritative coverage workflow and stale-base integration would reintroduce or overwrite the LLVM runtime-boundary repair.

For the eventual current-main integration:

• invoke python_native_extension_peer_gate.py classify-pytest only after a real pytest collection failure has been captured completely and before converting that failure into deferred peer-evidence requirements;
• write changed paths from the exact base/head diff into a bounded regular file;
• require the declared maturin/PyO3 module and refuse deferral for every native, packaging, dependency, workflow, stub, or metadata change already covered by the helper;
• query CheckRun evidence from trusted GitHub metadata and require exact current head plus repository-owned Python, Rust/PyO3, and package checks, all completed/successful; statuses, stale heads, duplicates, lookalikes, and missing evidence remain blocking;
• keep classification explicitly non-passing until peer checks are proven;
• add permanent workflow-ordering, permission, exact-head, and fail-closed contracts; execute/cover/compile the helper through the exact-head quality lane;
• rerun fast-mlsirm#546 only after the central integration merges.

Keep Draft. Do not mutate the authoritative workflow from the pre-#759 base, approve, or merge.

[seonghobae]

@jules Implement the existing TDD RED workflow contracts on exact live head 5bc9ba4070866934ed819c2ff06f209b785d7b88 as normal descendant commits. Keep this PR Draft. Do not amend, rebase, force-push, create a repair workflow, mark Ready, merge, release, change branch protection, change reviewer credentials, or alter NVIDIA/OpenCode model policy.

Precondition: before every write, re-read the live head and stop without mutation unless it is the expected current head or your own direct descendant.

Coverage integration

In .github/workflows/opencode-review-dispatch.yml, preserve the existing sandbox, run_and_capture, R deferral, immutable-source, credential, and publication boundaries. Add a separate Python-suite runner that uses the identical timeout --kill-after=20 900 setpriv ... low-privilege environment but retains the complete bounded log long enough to classify a real nonzero Python suite exit.

Initialize exactly:

python_native_peer_check_required=0

Only after a Python configured/default pytest/coverage command actually fails:

1. snapshot changed_files_for_coverage to a bounded regular file;
2. require the relevant ${project_dir}/pyproject.toml to be regular and non-symlink;
3. invoke the trusted helper:

python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
  --log "$log_file" \
  --pyproject "$project_dir/pyproject.toml" \
  --changed-files "$changed_files_file" \
  --repo-root "$COVERAGE_SOURCE_WORKDIR"

4. on classifier success, do not report ordinary PASS and do not increment failures; emit a distinct section containing all these literal contracts:

### Python native-extension source-only deferral
- Result: DEFERRED
the unchanged declared PyO3 module was unavailable in the source-only sandbox
exact-head Python, Rust/PyO3, and package CheckRuns

and set python_native_peer_check_required=1;
5. on classifier rejection, retain the ordinary exact exit failure and increment failures;
6. any other Python suite failure in the same run remains blocking.

In the compact PASS decision, when the variable is 1, emit exactly:

- Python native-extension peer evidence: deferred source-only collection requires successful exact-head peer checks

Do not build/install PR-selected native code, add a Python stub, skip tests, or grant network access.

Approval integration

Mirror—but do not replace—the existing R peer-check pattern. Add independent functions that:

• detect only the exact compact Python deferral marker;
• query the live PR statusCheckRollup immediately before approval and normalize only CheckRun nodes with __typename, workflow name, check name, exact trusted $HEAD_SHA, status, and conclusion into a bounded JSON file;
• call:

python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" require-checks \
  --checks-json "$checks_file" \
  --head-sha "$HEAD_SHA" \
  --required-check "CI::python" \
  --required-check "CI::rust" \
  --required-check "CI::package"

• reject missing, pending, failed, skipped, cancelled, stale, status-only, lookalike, malformed, or lookup-failed evidence.

Call this gate in both approval paths that already call require_r_cmd_check_for_deferred_coverage: the deterministic model-unavailable blocker path and the normal APPROVE path. R and PyO3 deferrals must coexist independently. On failure, leave review state unchanged with a bounded WAITING_FOR_PYTHON_NATIVE_PEER_CHECKS explanation; never synthesize approval.

Permanent tests and verification

Make the current tests GREEN without weakening them:

python -m pytest -q \
  tests/test_python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate_nested_project.py \
  tests/test_python_native_extension_peer_gate_workflow_contract.py

Then run the permanent Python 3.10/3.14 quality workflow, focused and complete 100% production statement/branch coverage, interrogate 100%, compileall, actionlint, full central tests, security and supply-chain checks. Fix actual failures only. Preserve CHANGELOG.md and docs/doctoring/python-native-extension-peer-evidence.md; update them only where integration semantics or verified limitations changed.

After GREEN, report the exact final SHA and verification commands in a PR comment. Do not request approval or change Draft state.

[seonghobae]

Exact-head quality run 31133025300 confirms the intended integration RED: 87 focused tests passed and only the three workflow-contract tests failed because opencode-review-dispatch.yml still lacks python_native_peer_check_required, the distinct source-only deferral summary, and trusted require-checks enforcement. Python 3.10 compatibility passed; all security workflows passed.

@jules Implement the central workflow integration now rather than weakening these tests. Preserve the existing R peer gate and privileged reviewer chain. After GREEN, run full central coverage/docstrings/actionlint and replay OpenCode review against exact fast-mlsirm heads #546, #549, and #550.

[seonghobae]

@opencode-agent address

Fix the exact current-head quality failure on 5bc9ba4070866934ed819c2ff06f209b785d7b88 by completing the integration already required by this Draft PR; do not weaken or delete the three failing workflow-contract tests.

Run 31133025300, job 92726135563, proves 87/90 focused tests pass and these exact contracts remain RED:

1. python_native_peer_check_required=0 and the bounded classify-pytest invocation are absent from .github/workflows/opencode-review-dispatch.yml;
2. the coverage artifact lacks the distinct ### Python native-extension source-only deferral, - Result: DEFERRED, and exact-head peer-check requirement text;
3. the approval phase does not yet call require-checks for CI::python, CI::rust, and CI::package against PR_HEAD_SHA using live GraphQL CheckRun evidence.

Implement the documented fail-closed flow:

• initialize python_native_peer_check_required=0 and keep ordinary source-test failure authoritative;
• only after a real Python pytest failure, call scripts/ci/python_native_extension_peer_gate.py classify-pytest with the bounded pytest log, changed-file list, --repo-root "$COVERAGE_SOURCE_WORKDIR", and exact --pyproject "$project_dir/pyproject.toml";
• if and only if that classifier succeeds, serialize a distinct DEFERRED section, never PASS, stating the unchanged declared PyO3 module was unavailable in the source-only sandbox and that exact-head Python, Rust/PyO3, and package CheckRuns are mandatory;
• pass this state into the trusted approval job;
• query current live check runs, preserve __typename, require actual CheckRun values, and call the helper's require-checks for CI::python, CI::rust, and CI::package with --head-sha "$PR_HEAD_SHA";
• retain R CMD check deferral logic independently;
• reject mixed failures, changed native/package/workflow boundaries, missing/pending/failed/stale/status-only/lookalike evidence, malformed metadata, or any classifier error;
• keep all source handling read-only and bounded, no PR-selected build/install, no Python native stub, no token weakening, no approval or merge inside the helper.

After GREEN, run all 90 focused tests at 100% statement/branch coverage, the complete central suite, interrogate 100%, compileall, actionlint, Python 3.10 compatibility, security workflows, and exact-head review. Keep Draft, needs-revision, do-not-merge, and no auto-merge until integration and a live fast-mlsirm proof run are complete.

[seonghobae]

@jules Implement the missing production integration on current branch fix/pyo3-native-peer-gate; do not create a separate workflow-only substitute. Wire scripts/ci/python_native_extension_peer_gate.py into .github/workflows/opencode-review-dispatch.yml after the isolated pytest log and exact changed-file inventory exist. Deferral must remain non-PASS evidence and require exact-head successful trusted CheckRuns CI::python, CI::rust, and CI::package; preserve all Python coverage/docstring gates and the independent R peer gate; fail closed on mixed/native/package/lock/workflow changes or malformed/stale/status-only evidence. Add permanent ordering/ownership/exact-head workflow-contract tests, run focused/full quality and security, and keep Draft.

[seonghobae]

@opencode-agent address

Implement the committed workflow-integration RED contract on this Draft branch. Do not weaken the helper or tests. Preserve the existing R peer gate and reviewer credential chain.

The central coverage job must capture bounded combined pytest output and status, classify only the exact unchanged maturin/PyO3 module-absence collection failure, then require trusted exact-head CheckRun success for CI::python, CI::rust, CI::package, CI::gpu-smoke, and CI::fuzz. StatusContext, stale heads, lookalike workflow/check names, pending/failed/missing/malformed evidence, native-boundary changes, and mixed failures remain blocking. Emit an explicit non-success source-only deferral classification; never call it passing, never build PR-selected native code, and never auto-approve.

After GREEN, run the permanent workflow contracts, full central coverage/docstrings/actionlint/security, then replay exact current heads of fast-mlsirm #546, #549, and #550.

[seonghobae]

@opencode-agent address

Exact head 0948976a88888b8a06e27b42a4689bc5b478d59a is intentionally RED only because the permanent helper is not integrated into .github/workflows/opencode-review-dispatch.yml. Python Native Extension Peer Gate Quality CI run 31139377250, job 92745853221, reports 3 failed, 87 passed; Python 3.10 compatibility and every security/supply-chain workflow are successful.

Implement the three already-committed workflow contracts directly, without a patch artifact or writer workflow:

1. Initialize python_native_peer_check_required=0 beside r_peer_check_required=0 in the isolated coverage runtime.
2. Capture each real failed Python pytest invocation to a bounded regular log and an exact changed-file list. Only after an actual pytest failure, call:

python3 "$GITHUB_WORKSPACE/scripts/ci/python_native_extension_peer_gate.py" classify-pytest \
  --repo-root "$COVERAGE_SOURCE_WORKDIR" \
  --pyproject "$project_dir/pyproject.toml" \
  --pytest-log "$python_native_pytest_log" \
  --changed-files "$python_native_changed_files"

A successful classification must not become PASS. Emit the exact separate section ### Python native-extension source-only deferral, - Result: DEFERRED, state that the unchanged declared PyO3 module was unavailable in the source-only sandbox, set python_native_peer_check_required=1, and retain the failed-suite evidence for the final trusted peer-check gate. Every nonexclusive/malformed/mixed/error case remains an ordinary coverage failure.
3. In the trusted approval phase, when python_native_peer_check_required=1, query live GraphQL CheckRun evidence on literal $PR_HEAD_SHA and invoke the helper's require-checks command with exactly:

--required-check "CI::python"
--required-check "CI::rust"
--required-check "CI::package"

Require unique authoritative completed-success CheckRuns, never status contexts or stale/ambiguous reruns. Keep the R peer gate independent. A source-only deferral remains blocking until all three exact-head peer checks pass.

Also implement the previously requested descriptor-bound O_NOFOLLOW/fstat bounded read primitive and explicit latest-rerun semantics before GREEN. Preserve no-network source execution, no PR-selected native build, no stub, no skip, exact-head binding, 100% branch/docstrings, and all existing approval/security boundaries. Add no temporary workflow, source snapshot, patch generator, or branch writer.

[seonghobae]

@opencode-agent address

Implement the already-specified permanent central workflow integration on this same Draft branch and exact helper contract. Wire source-only PyO3 classification into the failed Python coverage path; publish DEFERRED rather than PASS; require live exact-head CheckRun success for CI::python, CI::rust, and CI::package during approval; preserve the independent R peer gate; add every focused workflow contract to the quality job; and keep all native-code, credential, reviewer-identity, branch-protection, and no-COPILOT_GITHUB_TOKEN boundaries unchanged. Do not create another PR or temporary repair machinery. Run the focused three failing contracts first, then Python 3.10/3.14, full suite, 100% coverage/docstrings, actionlint, and exact-head security gates. Keep Draft.

[seonghobae]

@opencode-agent

Continue development on the live Draft head 0948976a88888b8a06e27b42a4689bc5b478d59a. There are currently no submitted reviews or unresolved inline threads, so preserve Draft and complete the intentionally missing integration rather than treating the helper-only slice as mergeable.

Implement test-first, directly in permanent authoritative sources only:

1. Wire scripts/ci/python_native_extension_peer_gate.py into the central OpenCode coverage/approval path so native-extension collection deferral is considered only after a complete source-only pytest collection failure exclusively caused by the exact declared maturin/PyO3 module being absent.
2. Require trusted peer evidence bound to the same exact PR head: successful repository Python coverage, Rust/PyO3 native test, and package/build surfaces as explicitly named workflow/check contracts. Pending/failed/stale/status-only/lookalike/duplicate/malformed evidence must fail closed.
3. Never classify actual test failures, mixed missing imports, setup/teardown/internal pytest errors, crashes/truncation, unsafe paths, Rust/Cargo/native/package/lock/requirements/workflow/maturin changes, or incomplete metadata as deferrable.
4. Do not build or import PR-selected native code inside the central source-only coverage sandbox, do not enable network/model secrets there, and do not turn deferral into passing evidence; it may only allow the independently trusted exact-head peer gates to satisfy the native boundary.
5. Add permanent workflow-contract/regression tests that first fail without the integration, then pass after the source repair. Keep production statement/branch coverage and public docstrings at 100%, compile cleanly, update CHANGELOG and APA 7 doctoring, and remove any temporary writer/repair workflow before the final head.
6. After GREEN, rerun the real downstream ContextualWisdomLab/fast-mlsirm#546 exact-head review/coverage path and record only same-head evidence. Do not approve, merge, or release from the write-capable repair identity.

[seonghobae]

@jules Complete the declared integration slice directly on the Draft branch. Exact head 0948976a88888b8a06e27b42a4689bc5b478d59a; focused run 31139377250, job 92745853221, proves the helper is implemented and covered but the authoritative OpenCode workflow is not wired. The three failing permanent assertions require all of the following:

1. Initialize python_native_peer_check_required=0 in the isolated coverage measurement state.
2. When—and only when—the bounded classifier accepts a complete pytest collection failure caused exclusively by the declared maturin/PyO3 native module being absent, set the flag to 1, preserve the classifier's structured evidence, and record a distinct ### Python native-extension source-only deferral section. Never serialize this as ordinary passing coverage and never reduce the normal failure count for any mixed/import/test/setup/internal/crash/truncated case.
3. Propagate the flag/evidence across the authenticated sandbox-output boundary without exposing source or credentials.
4. In the trusted approval phase, if deferral is required, verify live GitHub CheckRun evidence for the exact current head and the exact allowlisted Python, Rust/PyO3, and package workflows/check names; require completed+success for all three. Reject status-only, pending, failed, skipped-required, stale-head, lookalike, missing, duplicate, or malformed records. Approval remains impossible without the normal security, coverage, review, and branch-protection gates.
5. Add the permanent workflow contracts, action pins, complete-source coverage, docstrings, compilation, and clean-state checks. Update the stale PR-body head/evidence.

Do not build PR-selected native code in the privileged workflow, enable network in untrusted execution, add a compatibility stub, skip pytest, create a branch writer, or change reviewer identities/credentials. Keep Draft until the integrated exact head passes all gates and independent approval.

[seonghobae]

@opencode-agent address

Complete only the explicitly pending integration on exact head 0948976a88888b8a06e27b42a4689bc5b478d59a; keep the PR Draft and preserve fail-closed coverage. The focused gate is correctly RED because the classifier exists but the protected review workflow never calls it.

Work test-first against tests/test_python_native_extension_peer_gate_workflow_contract.py and the existing 87 passing helper/adversarial tests:

1. In the coverage evidence script, initialize python_native_peer_check_required=0. Capture the actual failed pytest output in a bounded regular UTF-8 log and the exact validated changed-file list in a bounded file. Invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest only after a real Python suite failure, with --repo-root "$COVERAGE_SOURCE_WORKDIR", the current project --pyproject "$project_dir/pyproject.toml", and the exact log/changed-files paths.
2. When and only when the helper returns success, set python_native_peer_check_required=1, record a distinct ### Python native-extension source-only deferral section with - Result: DEFERRED, identify that the unchanged declared PyO3 module was unavailable in the source-only sandbox, and state that successful exact-head Python, Rust/PyO3, and package CheckRuns remain mandatory. Never serialize this classifier outcome as PASS, and never defer mixed imports, test/setup/teardown/internal/crash/truncated failures or native/trust-boundary changes.
3. Export the deferral flag through the existing coverage output/decision boundary. In the trusted approval phase, when the flag is 1, fetch live check-run records for the exact PR_HEAD_SHA and run the helper’s require-checks command with the literal contracts --required-check "CI::python", --required-check "CI::rust", and --required-check "CI::package". Require GraphQL CheckRun identity, exact workflow/check names, COMPLETED/SUCCESS, and the current head; reject statuses, duplicates in the requirement declaration, stale/pending/failed/missing/lookalike evidence. Preserve the existing R peer-check gate independently.
4. Do not build or import PR-selected native code in the source-only sandbox, grant network access, add compatibility stubs, turn deferred evidence into approval, relax exact-head or branch protection, or create temporary writer workflows.
5. Update existing doctoring/CHANGELOG only as needed to describe the integrated path. Run the focused Python 3.14 contract to GREEN, Python 3.10 compatibility, the complete central suite, 100% production statement/branch coverage, complete production docstrings, compilation, actionlint, clean patches, then all exact-head security and independent-review gates.

Keep this branch Draft until the integration itself is GREEN and a downstream exact-head PyO3 repository run proves the intended peer-check flow.

[seonghobae]

@opencode-agent address

Apply and delete docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch on this same Draft branch, then run the permanent PyO3 peer-gate contract and complete central quality surface.

The patch preserves the existing R deferral and adds a separate fail-closed Python native-extension boundary:

• captures the real pytest/coverage command log and exact changed-file list;
• calls the trusted classify-pytest helper only after a nonzero Python test exit;
• serializes the result as DEFERRED, never ordinary passing evidence;
• permits deferral only for an unchanged declared maturin/PyO3 module absent in the networkless source-only sandbox;
• re-queries the live current-head GraphQL CheckRun rollup before any approval;
• requires exact-head successful CI::python, CI::rust, and CI::package checks through the trusted helper;
• fails closed for stale, missing, pending, failed, status-only, lookalike, or malformed peer evidence.

git apply --check docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch
git apply docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch
rm docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch
python -m pytest \
  tests/test_python_native_extension_peer_gate.py \
  tests/test_python_native_extension_peer_gate_file_safety.py \
  tests/test_python_native_extension_peer_gate_nested_project.py \
  tests/test_python_native_extension_peer_gate_requirements.py \
  tests/test_python_native_extension_peer_gate_workflow_contract.py -q
python -m coverage erase
python -m coverage run -m pytest tests -q
python -m coverage report
python -m interrogate --fail-under 100 scripts/ci
python -m compileall -q scripts/ci tests
actionlint .github/workflows/opencode-review-dispatch.yml .github/workflows/python-native-extension-peer-gate-quality-ci.yml
git diff --check
test -z "$(git status --short)"

Commit ordinary reviewed workflow source and patch deletion only. Keep Draft until one unchanged head passes the dedicated quality workflow, complete central security/SAST/supply-chain surface, fresh automated review, zero actionable threads, and qualifying independent approval. Do not build a PR-selected extension in the coverage sandbox, add network access or stubs, weaken the exact native-boundary file list, create a writer workflow, force-push, merge, release, or mark Ready.

[seonghobae]

@opencode-agent address exact current head 6e723a2c85a1f87327b96b8bb3be6a70edb527ab by completing the permanent integration on this same Draft PR.

Wire scripts/ci/python_native_extension_peer_gate.py into the authoritative central coverage and approval flow without changing its narrow classifier boundary:

• invoke classify-pytest only after an otherwise complete pytest collection failure and only for the exact declared maturin/PyO3 module;
• emit a bounded deferred-evidence marker, never PASS, when classification succeeds;
• before approval, query normalized exact-head CheckRun evidence and require the documented trusted Python, Rust/PyO3, and package checks through require-checks;
• fail closed on missing, pending, failed, stale, status-only, lookalike, malformed, duplicate, mixed-import, changed-native-boundary, or untrusted evidence;
• preserve source-only sandbox isolation, no PR build hooks, no network or secret exposure, no compatibility stub, no test skipping, and all existing coverage/review/branch-protection gates;
• add permanent workflow contracts and doctoring/changelog updates only where needed.

Run the focused peer-gate suite, complete central tests with 100% statement/branch coverage and public docstrings, Python 3.10/3.14 compilation, actionlint, git diff --check, and the full security/supply-chain matrix. Keep Draft until fast-mlsirm#546 is rerun on its unchanged exact head and the peer evidence is proven. Do not create temporary workflows, patch artifacts, branch writers, approvals, merges, releases, or protection changes.

[seonghobae]

@opencode-agent Integrate the reviewed PyO3 peer-evidence gate directly into the authoritative central workflow on this PR branch, then remove the staged patch artifact.

Apply docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch only after rebasing its anchors against the current exact .github/workflows/opencode-review-dispatch.yml; do not import unrelated workflow history. Preserve these fail-closed boundaries:

• classification is allowed only for a complete pytest collection failure caused exclusively by the exact declared maturin/PyO3 module being absent;
• mixed imports, actual tests, setup/teardown/internal errors, crashes, truncation, unsafe paths, Rust/native/packaging/lock/workflow/maturin changes remain blocking;
• deferral is not pass evidence and requires exact-current-head completed-success CheckRun evidence for the canonical Python, Rust/PyO3, and package jobs;
• stale heads, status contexts, lookalike workflows/check names, pending/failed/skipped/duplicate/malformed evidence fail closed;
• no source-selected native build, network expansion, compatibility stub, approval synthesis, merge, or branch-protection change.

Before production integration, strengthen tests/test_python_native_extension_peer_gate_workflow_contract.py so the RED contract parses the actual coverage and approval step blocks, verifies the helper is invoked from trusted workflow source, proves classification happens only after a nonzero pytest result, and proves approval cannot proceed before exact-head peer evidence is validated. Then apply the integration, delete the patch file, run the focused 100% statement/branch/docstring suite and complete central test/compilation/security surfaces. Keep Draft until fast-mlsirm#546 is rerun through this exact head and all current-head reviews complete.

[seonghobae]

@jules Apply the already reviewed patch docs/superpowers/patches/2026-08-07-python-native-peer-workflow-integration.patch to .github/workflows/opencode-review-dispatch.yml, delete the patch file, and commit ordinary workflow source. Do not merely delete the patch or update the PR body. The resulting diff must contain the permanent coverage-phase classifier/DEFERRED path and the approval-phase live exact-head CI::python, CI::rust, and CI::package CheckRun gate while preserving the existing R CMD check deferral. Run the focused workflow contract first, then full central coverage/docstrings/compile/actionlint/security gates. Keep Draft; do not add network or build the PR-selected extension, create a writer workflow, force-push, merge, release, or mark Ready.

[seonghobae]

@opencode-agent Implement the bounded PyO3 peer-evidence integration on exact current head 247ebc6e89b6948b1848794cb52901dbac5e3c66 of branch fix/pyo3-native-peer-gate; stop without writing if the live head differs.

The helper and adversarial tests are complete, but exact-head quality run 31150926881 correctly failed three workflow-contract tests because .github/workflows/opencode-review-dispatch.yml does not yet integrate the gate. Keep this PR Draft and implement the permanent integration without weakening source-only coverage.

Modify the protected workflow and only directly necessary permanent tests/docs/CHANGELOG:

1. Initialize python_native_peer_check_required=0 beside the existing r_peer_check_required=0.
2. For each Python project test command, capture the exact sandbox log and changed-file inventory. On ordinary success, keep PASS behavior. On failure, invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest with the exact log, ${project_dir}/pyproject.toml, a validated newline-delimited changed-file file, and --repo-root "$COVERAGE_SOURCE_WORKDIR".
3. A successful classifier must not become PASS and must not decrement other failures. Emit a distinct section headed ### Python native-extension source-only deferral, - Result: DEFERRED, state that the unchanged declared PyO3 module was unavailable in the source-only sandbox, set python_native_peer_check_required=1, and preserve the failed command/log evidence. Any classifier rejection remains the original FAIL.
4. Export the deferral flag through the authenticated coverage output and summary with the exact message Python native-extension peer evidence: deferred source-only collection requires successful exact-head peer checks.
5. In the trusted approval phase, when the flag is set, fetch normalized CheckRun records for the exact PR head and run the helper’s require-checks command with exact --head-sha "$PR_HEAD_SHA" and all three requirements: CI::python, CI::rust, and CI::package. Require __typename=CheckRun, exact workflow/check names, COMPLETED/SUCCESS, and exact head; reject statuses, pending/failed/stale/lookalike/missing evidence. Preserve the existing R peer-check path independently.
6. Do not build/import/install a PR-selected extension, do not grant network/model/token/OIDC authority to untrusted tests, and do not classify mixed imports, test/setup/teardown failures, internal errors, crashes, truncation, or any native/trust-boundary-changing diff.
7. Ensure the permanent quality workflow runs all peer-gate files, the integration contracts, the complete central suite, 100% statement/branch coverage, 100% public docstrings, Python 3.10/3.14 compilation, actionlint, and git diff --check.

Run the exact three failing workflow contracts first, then the complete focused and central quality gates. Final diff must contain only permanent integration/helper/tests/quality/doctoring/CHANGELOG files; no staged patch, one-shot writer, trigger, or repair workflow. Do not approve, merge, mark Ready, rebase, retarget, release, or publish.

[seonghobae]

@opencode-agent address

Exact head 247ebc6e89b6948b1848794cb52901dbac5e3c66 remains an intentional incomplete integration: quality run 31150926881 passes 87 helper tests but fails the three permanent workflow contracts because opencode-review-dispatch.yml never invokes the classifier or requires exact-head peer CheckRuns.

Do not patch the stale workflow lineage independently. PR #812 currently owns attempt-scoped coverage-artifact control flow in the same workflow. After #812 is protected, merge the resulting main into fix/pyo3-native-peer-gate without force-push and implement the bounded integration directly:

1. Initialize python_native_peer_check_required=0 in the coverage measurement path.
2. Invoke python_native_extension_peer_gate.py classify-pytest only after a real Python pytest collection failure, with exact repo root, project pyproject.toml, bounded changed-file inventory, and captured complete pytest log.
3. On the one accepted source-only native-module absence, emit a distinct DEFERRED section—not PASS—and set a sealed output requiring peer checks.
4. In the trusted approval phase, when that sealed requirement is present, query live exact-head CheckRun evidence and require uniquely matched successful CI::python, CI::rust, and CI::package; reject status contexts, stale heads, pending/failed/skipped/lookalike/duplicate/missing evidence.
5. Preserve all existing coverage failures, archive/artifact safety, no-network sandboxing, reviewer credentials, and branch protection. A classifier success must never itself approve or reinterpret tests as green.
6. Run all focused helper/file-safety/nested-project/requirements-directory/workflow contracts, then the complete central 100% statement/branch/docstring suite and every exact-head security/supply-chain gate.

Keep Draft. Do not add a compatibility stub, build PR-selected native code, weaken coverage, create a patch/writer workflow, merge, or release.

[seonghobae]

/oc Refetch the exact live head and keep this PR Draft until integration evidence is green. Complete the bounded PyO3 gate in this same branch by wiring scripts/ci/python_native_extension_peer_gate.py into .github/workflows/opencode-review-dispatch.yml exactly as required by tests/test_python_native_extension_peer_gate_workflow_contract.py: capture the real failed pytest log and exact changed-file inventory; call classify-pytest with the bounded repository root and each project pyproject; publish a distinct DEFERRED source-only native-extension result only for a successful classifier; carry a python_native_peer_check_required output into the trusted approval phase; and require live exact-head successful CheckRuns for CI::python, CI::rust, and CI::package through the helper’s require-checks command before approval. Preserve ordinary Python failures as failures, existing R deferred-peer logic, no-network/no-credential source sandbox, exact-head binding, and 100% coverage/docstrings. Add no bypass, compatibility stub, PR-selected native build, temporary workflow, patch artifact, or branch writer. Run the workflow-contract test first, then the complete PyO3 quality workflow and central regression/security suite, and update the PR evidence only from the new exact head.

[seonghobae]

@opencode-agent Complete the missing production integration on exact current head 247ebc6e89b6948b1848794cb52901dbac5e3c66 directly in this PR. The helper and adversarial tests exist; the exact-head quality failure proves .github/workflows/opencode-review-dispatch.yml still has no integration. Do not open a stacked PR, stage a patch artifact, or add any repair/branch-writer workflow.

Implement the bounded fail-closed flow required by tests/test_python_native_extension_peer_gate_workflow_contract.py:

1. Initialize python_native_peer_check_required=0 beside the existing coverage-defer state.
2. Only after a real Python pytest/coverage command exits nonzero, retain its bounded log and current validated changed-file list, then invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest with:
   • --repo-root "$COVERAGE_SOURCE_WORKDIR"
   • --pyproject "$project_dir/pyproject.toml"
   • the exact bounded pytest log and changed-files file.
     Do not invoke the classifier after a passing command or for non-pytest failures.
3. If and only if classification succeeds, do not convert the run to PASS. Append a distinct section headed exactly ### Python native-extension source-only deferral, mark - Result: DEFERRED, explain that the unchanged declared PyO3 module was unavailable in the source-only sandbox, state that exact-head Python, Rust/PyO3, and package CheckRuns are still required, set python_native_peer_check_required=1, and publish the compact marker Python native-extension peer evidence: deferred source-only collection requires successful exact-head peer checks. Any malformed/mixed/native-boundary-changing case remains an ordinary coverage failure.
4. In the trusted approval phase, when that marker is present, fetch live current-head check-run objects—not status-only contexts—and run the helper require-checks with --head-sha "$PR_HEAD_SHA" and all three exact requirements:
   • --required-check "CI::python"
   • --required-check "CI::rust"
   • --required-check "CI::package"
     Fail closed for missing, duplicate, pending, failed, stale-head, lookalike, malformed or status-only evidence. Preserve the existing R peer-check gate independently.
5. Add the authoritative workflow source to the focused quality/compile/actionlint contract and keep Python 3.10/3.14, 100% production statement/branch/docstring coverage, no-network source-only sandbox, no PR-selected native build, and no approval from classification alone.

Run the three failing workflow-contract tests first, then the complete focused peer-gate suite, full central suite, docstrings, compileall, actionlint, and security gates. Keep Draft until a new exact head is GREEN and fast-mlsirm#546 is rerun against the integrated central workflow.

[seonghobae]

/oc Refetch the live PR and stop without writing unless exact head is 247ebc6e89b6948b1848794cb52901dbac5e3c66. Keep the PR Draft. Exact-head quality run 31150926881, job 92831594429, is the required RED evidence: 87 focused tests passed and only the three permanent workflow-integration contracts failed because .github/workflows/opencode-review-dispatch.yml has not yet integrated the bounded PyO3 source-only deferral and trusted exact-head peer-check gate.

Implement the minimum production integration directly in the existing branch, preserving the helper’s current fail-closed classifier semantics. In the isolated Python coverage path, capture the real failed pytest log, changed-file inventory, repo root, exact project pyproject.toml, and invoke scripts/ci/python_native_extension_peer_gate.py classify-pytest only after an actual suite failure. A successful classification must publish a distinct DEFERRED section, set a sealed python_native_peer_check_required signal, and never be represented as ordinary PASS. Every mixed import, test/setup/teardown/internal error, unsafe path, changed native/package/workflow surface, malformed or truncated evidence, or classifier error remains a hard failure. In the trusted approval phase, when the signal is set, invoke the helper’s exact-head require-checks mode and require successful completed GitHub CheckRun evidence for CI::python, CI::rust, and CI::package at the same PR_HEAD_SHA; reject statuses, stale heads, lookalikes, pending/failing/missing/duplicate evidence. Preserve the existing R peer gate independently.

Before editing, reconcile the latest protected main by ordinary non-force ancestry only if it can be done without discarding this PR’s ten permanent files; retain all newer trusted coverage, sandbox, artifact, dependency, credential, and approval hardening. Add .github/workflows/opencode-review-dispatch.yml to the permanent PR diff and update body/doctoring/changelog to describe the integrated exact-head boundary. Do not use temporary/self-modifying/branch-writer workflows, encoded patches, compatibility stubs, networked PR-selected builds, skipped tests, or COPILOT_GITHUB_TOKEN.

Run the three failing integration contracts first, the complete 90-test peer-gate suite, full repository tests, 100% production statement/branch coverage, 100% public docstrings, Python 3.10/3.14 contracts, compileall, actionlint, shell syntax, and git diff --check. Do not mark Ready, approve, merge, release, retarget, force-push, or change reviewer/model credential chains.

[seonghobae]

@opencode-agent address

Continue directly on exact head 247ebc6e89b6948b1848794cb52901dbac5e3c66. The staged PyO3 integration patch artifact has been correctly removed, but the canonical .github/workflows/opencode-review-dispatch.yml integration remains absent. Implement it as ordinary source/test/doc commits on this branch; do not recreate a staged patch, one-shot writer, compatibility stub, or second reviewer.

Required fail-closed behavior:

• capture each real Python pytest/coverage command's bounded complete log and exit status;
• only after a nonzero Python suite result, invoke python_native_extension_peer_gate.py classify-pytest with the exact log, regular non-symlink pyproject.toml, exact base-to-head changed-file list, and repository root;
• emit a distinct DEFERRED marker, never PASS, only for exclusive missing-import collection failure of the unchanged declared maturin/PyO3 module;
• preserve ordinary failure for mixed imports, tests, setup/teardown/internal errors, crashes, truncation, malformed metadata, and native/Cargo/Rust/stub/packaging/lock/requirements/workflow changes;
• before approval, query live exact-head CheckRun records and call require-checks for repository-owned Python, Rust/PyO3, and package checks; reject statuses, stale/pending/failed/skipped/lookalike/duplicate/missing/malformed evidence;
• preserve the independent R deferral and require both evidence sets when both apply;
• add permanent workflow-contract coverage for summary wording and approval enforcement and keep Python 3.10/3.14, 100% statement/branch, public-docstring, compile, security, and clean-tree gates.

Keep Draft until canonical integration and exact-head checks are GREEN. After protected integration, rerun unchanged fast-mlsirm heads rather than reusing source-only failures.

[seonghobae]

/oc Refetch the live PR head and stop without writing unless it is exactly 247ebc6e89b6948b1848794cb52901dbac5e3c66. Fresh exact-head quality run 31150926881, job 92831594429, gives the required RED evidence: 87 focused tests pass and only the three permanent integration contracts fail because .github/workflows/opencode-review-dispatch.yml does not yet call the reviewed helper. Implement the bounded production integration directly on this branch; do not weaken the tests.

In the isolated coverage-evidence runtime:

1. Initialize python_native_peer_check_required=0 alongside the existing r_peer_check_required state before Python measurement.
2. Refactor only the Python test execution path so each real pytest/coverage command captures its complete bounded log and exit status. A zero exit remains ordinary PASS. A nonzero exit may be classified only by scripts/ci/python_native_extension_peer_gate.py classify-pytest using the exact project pyproject.toml, --repo-root "$COVERAGE_SOURCE_WORKDIR", and a read-only newline-delimited snapshot from changed_files_for_coverage. Never classify a configured non-pytest command, a successful run, a truncated log, mixed failures, changed native/packaging/workflow boundaries, or missing/malformed metadata.
3. On successful classification, do not serialize PASS and do not increment the ordinary failure count. Emit a distinct section headed ### Python native-extension source-only deferral, - Result: DEFERRED, explain that the unchanged declared PyO3 module was unavailable in the source-only sandbox, state that exact-head Python, Rust/PyO3, and package CheckRuns are mandatory, and set python_native_peer_check_required=1. Preserve the original command/log evidence and remove all temporary files.
4. Propagate one compact, machine-readable coverage-summary marker exactly matching Python native-extension peer evidence: deferred source-only collection requires successful exact-head peer checks; preserve the existing R deferral marker and all PASS/FAIL semantics.
5. In both trusted approval/publication paths that currently enforce deferred R evidence, detect that marker fail-closed. Collect live current-head REST/GraphQL CheckRun records (never status-only evidence), snapshot them to a bounded regular non-symlink JSON file, and run the helper’s require-checks subcommand with --head-sha "$PR_HEAD_SHA" and exact requirements CI::python, CI::rust, and CI::package. Pending, duplicate/conflicting, stale-head, missing, failed, neutral, skipped, lookalike, malformed, or unavailable evidence must block approval with an explicit WAITING_FOR_PYTHON_NATIVE_PEER_CHECKS/equivalent source-backed reason. Keep the existing R peer gate independent; both gates must pass when both are required.
6. Add/retain permanent workflow contracts proving classifier ordering, separate DEFERRED evidence, exact three-check approval enforcement in both publication paths, and absence of any path that reclassifies deferral as direct coverage success.

Preserve --network=none, exact-head source materialization, credential-free PR test execution, immutable action/tool pins, one-day artifact retention, archive validation, OpenCode/Noema identities and credentials, NVIDIA NIM boundaries, 100% statement/branch/public-docstring gates, and all existing failed-check/approval logic. Do not build or install PR-selected native code in the source-only sandbox, add a stub, add a one-shot/self-modifying workflow, branch writer, encoded patch, approval, merge, release, or force push.

Run the three RED workflow-contract tests first; then all 90+ focused peer-gate tests with 100% helper statement/branch coverage, the complete central suite, production docstrings 100%, Python 3.10 and 3.14 compatibility, actionlint, compileall, and git diff --check. Keep Draft until the new exact head is fully green and then request fresh current-head CodeRabbit/OpenCode/Noema review.

[seonghobae]

@coderabbitai autofix

Complete the existing production integration directly on exact head 247ebc6e89b6948b1848794cb52901dbac5e3c66; do not open a stacked PR or add a repair workflow. Wire python_native_extension_peer_gate.py classify-pytest only after a real failed Python pytest/coverage run, emit a distinct DEFERRED marker without converting failure to PASS, and require exact current-head successful CheckRuns for CI::python, CI::rust, and CI::package before approval. Preserve the independent R peer gate, source-only/no-network sandbox, no PR-selected native build, all exact-head/action-pin/100% coverage/docstring contracts, and fail closed on mixed/malformed/native-boundary-changing or missing/duplicate/pending/stale/status-only evidence. Run the existing workflow-contract tests first and commit directly to this branch.

[coderabbitai]

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

[seonghobae]

/oc Refetch the exact live PR head and abort unless it is 247ebc6e89b6948b1848794cb52901dbac5e3c66. Complete the permanent integration already required by this Draft PR; do not weaken the RED workflow contract and do not add a branch-writer or temporary workflow. Fix Python Native Extension Peer Gate Quality CI run 31150926881 by wiring scripts/ci/python_native_extension_peer_gate.py into .github/workflows/opencode-review-dispatch.yml exactly as the permanent tests require. Initialize python_native_peer_check_required=0; capture the real failed pytest collection log and exact changed-file inventory as bounded regular files; invoke classify-pytest only after the ordinary Python suite actually fails, with --repo-root "$COVERAGE_SOURCE_WORKDIR", the exact project pyproject.toml, and no shell interpolation of untrusted paths. A successful classifier must produce a distinct ### Python native-extension source-only deferral / - Result: DEFERRED evidence section, never normal passing coverage, and must state that unchanged declared PyO3 module absence still requires successful exact-head Python, Rust/PyO3, and package CheckRuns. In the trusted approval phase, when python_native_peer_check_required is set, fetch live exact-head CheckRun data and invoke require-checks --head-sha "$PR_HEAD_SHA" with exact requirements CI::python, CI::rust, and CI::package; reject StatusContext/lookalikes, pending/failed/stale/malformed evidence, and preserve the existing R peer-check path. Do not build or import the PR-selected extension in the credentialed/source-only sandbox, skip tests, treat deferral as success by itself, or change reviewer/model credentials. Run the three failing workflow-contract tests first, then all peer-gate tests and the complete central suite with 100% statement/branch coverage, public docstrings, compileall, actionlint, clean diff, and exact-head security checks. Keep Draft until GREEN.

[seonghobae]

@opencode-agent Complete the permanent central integration directly on exact Draft head 247ebc6e89b6948b1848794cb52901dbac5e3c66; do not create temporary/self-removing/encoded-patch/branch-writing workflows.

Exact-head run 31150926881 proves the standalone bounded classifier tests are green except for three intentionally unmet workflow contracts. Wire the reviewed helper into .github/workflows/opencode-review-dispatch.yml so that:

1. Before running the supported Python suite, initialize python_native_peer_check_required=0 in trusted shell state.
2. Only after a genuine Python pytest collection failure, invoke scripts/ci/python_native_extension_peer_gate.py with the exact materialized repository root, bounded captured pytest output, authenticated changed-file set, and exact PR head metadata.
3. A valid source-only native-module classification emits a distinct ### Python native-extension source-only deferral evidence section and sets python_native_peer_check_required=1; it must never serialize ordinary Python coverage as passing.
4. Mixed imports, runtime test failures, setup/teardown/internal pytest failures, malformed/truncated logs, native/Rust/Cargo/stub/packaging/lock/workflow changes, unsafe paths, or uncertain classification remain hard failures.
5. The trusted approval phase, only when the deferral flag is set, fetches live GitHub CheckRun evidence for the exact unchanged head and requires exact configured successful Python, Rust/PyO3, and package-install/build checks. Reject statuses, stale heads, lookalike names, pending/failed/skipped/neutral checks, missing or duplicate requirements, and malformed API responses.
6. A classifier result remains non-approval evidence until all three trusted peer checks pass; no token/model/write credential enters the untrusted coverage consumer.
7. Add permanent workflow contracts and update doctoring/CHANGELOG only as needed. Run focused tests, complete central statement/branch coverage, public docstrings, Python 3.10 compatibility, compileall, actionlint, and clean-tree checks.

Keep Draft and do not approve, merge, release, alter reviewer credentials, or weaken protection.

[seonghobae]

/oc

Refetch PR #789 and implement the PyO3 peer-evidence integration directly on the live Draft branch; abort on movement. Keep the staged patch artifact deleted. Wire python_native_extension_peer_gate.py classify-pytest into the canonical coverage workflow only after a real bounded Python-suite failure, using the exact log, regular non-symlink pyproject, exact changed-file list, and repository root. Emit DEFERRED rather than PASS only for exclusive missing collection import of the unchanged declared module. Before approval, require live exact-head repository-owned Python, Rust/PyO3, and package CheckRuns via require-checks, rejecting status/stale/pending/failed/skipped/lookalike/duplicate/malformed evidence; preserve independent R deferral and require both when applicable. Add permanent workflow contracts, run Python 3.10/3.14, 100% statement/branch/docstrings/compile/security gates, and commit directly. No compatibility stub, native build in the source-only sandbox, repair workflow, or force-push.

[seonghobae]

@opencode-agent

Complete the planned production integration directly on fix/pyo3-native-peer-gate; refetch and abort unless the live head is 247ebc6e89b6948b1848794cb52901dbac5e3c66. Exact failing run 31150926881, job 92831594429, proves the helper is not wired into .github/workflows/opencode-review-dispatch.yml: 87 focused tests pass and only the three permanent workflow contracts fail.

Implement test-first and fail closed:

1. In coverage-evidence initialize python_native_peer_check_required=0. When a real supported Python suite command fails, retain its bounded captured log and repository-relative changed-file list; call scripts/ci/python_native_extension_peer_gate.py classify-pytest with --repo-root "$COVERAGE_SOURCE_WORKDIR", the exact project --pyproject "$project_dir/pyproject.toml", --log "$python_native_pytest_log", and --changed-files "$python_native_changed_files". Deferral is allowed only when that command returns success; every other Python failure remains an ordinary coverage blocker.
2. Serialize a successful classification as a distinct ### Python native-extension source-only deferral section with - Result: DEFERRED, the statement that the unchanged declared PyO3 module was unavailable in the source-only sandbox, and that exact-head Python, Rust/PyO3, and package CheckRuns are still required. Do not count it as passed test or coverage evidence. Emit the permanent summary marker Python native-extension peer evidence: deferred source-only collection requires successful exact-head peer checks and export the required flag for the trusted approval phase.
3. In the credentialed trusted approval phase, only when python_native_peer_check_required is set, collect live check-runs for exact $PR_HEAD_SHA through the existing bounded check API path, preserve __typename, workflow identity, check name, head SHA, status, and conclusion, write them as bounded JSON, and run python_native_extension_peer_gate.py require-checks --head-sha "$PR_HEAD_SHA" with exactly --required-check "CI::python", --required-check "CI::rust", and --required-check "CI::package". Missing, duplicate, status-only, lookalike, stale-head, queued, failed, malformed, or unavailable evidence must block approval.
4. Keep the existing R deferred-evidence gate independent; do not conflate r_peer_check_required with the native flag. Preserve the source-only sandbox, no PR-selected build/install/network, credential separation, and every existing 100% coverage/docstring/security gate.
5. Update the PR body/doctoring/changelog only after the implementation exists. Do not add staged patch artifacts, temporary/one-shot/self-modifying branch writers, compatibility stubs, extension builds, test skips, or approval fallbacks.

Run the three failing workflow contracts first, all focused peer-gate/file-safety/nested-project/requirements-directory tests, then the complete central suite, 100% production statement/branch coverage, interrogate, compileall, actionlint, and clean-tree checks. Keep Draft until the new exact head is green.

[seonghobae]

/oc

Complete the missing permanent workflow integration on exact head 247ebc6e89b6948b1848794cb52901dbac5e3c66; keep the PR Draft and do not add a staged patch, one-shot, self-mutating, or branch-writer workflow.

Run 31150926881 proves 87 focused behavior tests pass and only three intentional workflow-contract tests remain RED because .github/workflows/opencode-review-dispatch.yml still lacks the bounded PyO3 peer-evidence path.

Implement directly in the permanent workflow:

1. Initialize python_native_peer_check_required=0 and the associated exact declared-module/repository evidence before Python coverage classification.
2. Invoke scripts/ci/python_native_extension_peer_gate.py only after a real, complete Python pytest collection failure, with the bounded repository root, exact changed-path set, declared maturin/PyO3 module, and complete log/evidence inputs.
3. Serialize a distinct ### Python native-extension source-only deferral evidence section. A valid classifier result is DEFERRED, never ordinary passing coverage.
4. Set the peer-check-required flag only for an exclusive, valid absence of the exact declared native module. Mixed imports, test/setup/teardown/internal failures, malformed/truncated logs, unsafe paths, or changes to Rust/native/packaging/dependency/workflow surfaces remain blockers.
5. Before formal approval, query live GitHub CheckRun evidence for the exact current head and require the configured Python, Rust/PyO3, and package workflow/check identities to be completed with success. Reject stale-head, queued, pending, failed, skipped-required, status-only, lookalike, missing, duplicate, or malformed evidence.
6. Preserve all existing exact-head, source, credential, dependency, native-fuzz, coverage, reviewer, and branch-protection gates. Do not build pull-request-selected native code inside the central source-only sandbox.

Run all five peer-gate test files, then complete central 100% statement/branch coverage and production docstrings, Python 3.10/3.14 compilation, actionlint, security/supply-chain workflows, and git diff --check. Keep the final permanent scope limited to the existing helper/tests/docs/quality workflow plus the necessary direct modification to opencode-review-dispatch.yml.

[seonghobae]

/oc Refetch the live head and continue only if it is 247ebc6e89b6948b1848794cb52901dbac5e3c66. Complete the existing PyO3 peer-gate integration directly in .github/workflows/opencode-review-dispatch.yml. Invoke python_native_extension_peer_gate.py classify-pytest only after a real failed Python pytest/coverage command, using the validated repo root, project pyproject, bounded log and current changed-file inventory. On successful classification emit the exact ### Python native-extension source-only deferral / - Result: DEFERRED marker and set a peer-check-required flag; never convert it to PASS. Before approval, if deferred, require live exact-head successful CheckRuns CI::python, CI::rust, and CI::package via require-checks --head-sha "$PR_HEAD_SHA", rejecting missing/duplicate/pending/failed/stale/lookalike/status-only evidence. Preserve the independent R peer gate, source-only no-network sandbox, no PR-selected native build, all pins and 100% gates. Run the three failing workflow-contract tests, the full focused suite, then complete central quality/security. Commit directly here; no stacked PR or repair workflow.

[seonghobae]

/oc

Continue from the exact current head and finish the permanent PyO3 peer-evidence integration if it is still incomplete. Classify only a complete pytest collection failure caused exclusively by the declared maturin/PyO3 module being absent, serialize it as distinct DEFERRED evidence rather than PASS, and require live successful exact-head Python, Rust/PyO3, and package CheckRuns before approval. Reject mixed imports, test failures, changed native/packaging/lock/workflow surfaces, stale or lookalike checks, status-only evidence, malformed logs, and unsafe paths. Do not build PR-selected native code in the central sandbox. Run all focused peer-gate tests, complete central 100% statement/branch coverage and public docstrings, Python 3.10/3.14 compilation, actionlint, and security/supply-chain gates. Remove temporary workflows, resolve only addressed threads, and mark Ready only on a fully green workflow-free head. Do not merge or bypass protection.

[seonghobae]

@opencode-agent address

Complete the bounded PyO3 peer-evidence integration on exact current Draft head 247ebc6e89b6948b1848794cb52901dbac5e3c66. The authoritative .github/workflows/opencode-review-dispatch.yml blob observed on that head is 83f6830d5c21a324b4dbcd4e5c21a07968994b81. Protected main has advanced since this branch's recorded base, so refetch the live protected base before mutation; if a non-forced merge/replacement from current main is required, preserve the fail-first history and re-run all evidence on the resulting exact head rather than editing against stale assumptions.

Exact failing quality evidence is run 31150926881, job 92843314735: Python 3.10 compatibility is GREEN; the Python 3.14 focused gate has 87 passed and exactly 3 intended workflow-integration failures. Implement the production workflow contract rather than weakening these tests:

1. Initialize a fail-closed python_native_peer_check_required=0 state and invoke scripts/ci/python_native_extension_peer_gate.py only after an actual Python suite/collection failure and only with bounded repository-root-aware evidence. A successful classifier result is deferred evidence, never passing Python coverage.
2. Serialize that state distinctly in evidence/reporting with the permanent heading ### Python native-extension source-only deferral; preserve the original failed Python evidence and do not convert it to success.
3. In the approval/evidence phase, when deferral is required, verify live GitHub CheckRun evidence for the exact unchanged PR head for all required Python, Rust/PyO3, and package checks using the helper's exact workflow/check allowlist. Require completed+success on the exact head; reject pending, failed, stale-head, status-only, duplicate/lookalike, missing, malformed, or predecessor evidence before approval.

Preserve the existing source-only/networkless sandbox, no PR-selected extension build or import stub, exact-head/base materialization, credential isolation, NVIDIA NIM/reviewer credential chain, native-fuzz separation, 100% production statement/branch/public-docstring policy, and branch protection. Do not add a temporary, one-shot, self-modifying, encoded-patch, staged-patch, branch-local repair, or competing writer workflow.

After the minimal integration, rerun the focused peer-gate suite, complete central suite, Python 3.10/3.14 compilation, actionlint/Bash checks, exact 100% production statement/branch/docstring gates, security/supply-chain workflows, clean-diff checks, and current-head automated review. Keep Draft until all exact-head gates and qualifying independent non-author approval are satisfied.

[seonghobae]

@opencode-agent address

Finish the bounded PyO3 native peer-evidence integration from a fresh protected-main base. Exact PR head is 247ebc6e89b6948b1848794cb52901dbac5e3c66; current protected main tip is 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. The central .github/workflows/opencode-review-dispatch.yml blob is identically 83f6830d5c21a324b4dbcd4e5c21a07968994b81 on both revisions, proving this branch has not yet wired the helper into production. Exact helper blob is scripts/ci/python_native_extension_peer_gate.py=a4b12c9fe7c0253afa4beb67ca010bc5ab553ac0. Do not write if the PR head, protected-main tip, or these relevant blobs move.

First normally merge exact protected main into this existing branch without rewriting history. Then satisfy only the three intentional integration RED contracts from exact-head Python Native Extension Peer Gate Quality CI run 31150926881, job 92843314735 (3 failed, 87 passed):

1. In the bounded Python coverage execution path, initialize python_native_peer_check_required=0. Only after an actual nonzero Python test execution, invoke the committed classifier with the exact repository root, bounded complete pytest log, exact changed-file set, and immutable pyproject.toml; never invoke it for a passing suite.
2. A successful classification is distinct deferred evidence, never ordinary passing coverage. Emit an explicit ### Python native-extension source-only deferral section and set the peer-check-required signal; preserve the original Python failure evidence and do not manufacture tests_passed=true from the classifier alone.
3. Before any approval path can treat that deferral as sufficient, collect live GitHub CheckRun evidence for the exact current PR head and run the committed require-checks verifier for all trusted peer requirements (CI::python, CI::rust, CI::package under the configured trusted workflow/check identities). Pending, failed, cancelled, skipped-required, stale-head, status-only, duplicate/lookalike, malformed, or missing evidence remains blocking.

Preserve every classifier refusal boundary already covered by the 87 focused tests: any Rust/Cargo/native crate/stub/maturin metadata/package/lock/requirements/workflow change, mixed imports, actual test/setup/teardown/internal failures, truncation/crash, malformed or unsafe path must remain an ordinary blocking test failure. Do not build or import PR-selected native code in the source-only sandbox, add network access, create a compatibility stub, weaken coverage, or let peer evidence approve by itself.

Do not force-push, use -X ours/-X theirs, alter reviewer credentials/model routing/branch protection, or create temporary/self-modifying/write-capable workflows. After integration run the focused peer-gate suite with exact 100% production statement/branch/docstring coverage, complete central suite and Strix quick gate, actionlint/compilation, then all exact-head Security Scan, SAST, CodeQL, Python Security, Secret Scan, OSV, Scorecard, and SBOM gates. Keep Draft until exact-head automated and qualifying independent review are clean; do not merge or synthesize approval.