[opencode-agent]

Current exact authority (2026-10-01)

• Exact head: 7598436eb9126db7bdff00fcf31f6fda15d0f58f; the PR remains open, Draft, and mechanically mergeable. This supersedes the older head records below.
• Scheduler run 36836856075, job 110286232014, retained prior repair commits as ancestors with git merge --strategy=ours but discarded 23 non-inventory paths from the resulting tree. Ancestry therefore did not prove complete delta succession.
• Exact-head Security Scan 36836916798 and Python Security 36836916879 are terminal failures; SAST 36836916787 succeeded, while CodeQL 36836916661 was skipped and is not merge authority.
• Canonical owner repair #2549 removes the ancestry-only merge and fails closed before a publication can overwrite any non-inventory owner delta. It is Draft on fix(ci): integrate parser, security, response, and coverage gates #2530 at exact head 1e2d7533a4b8acd04a9bb53e91bc24e0f7769a6a and exact tree b25d761ec7af723523d692df2f647bc76351f474; Security, SAST, Trusted uv, and Runtime Quality are terminal SUCCESS, while CodeQL is Draft-policy SKIPPED and approval remains absent.
• Keep this PR Draft. After fix(sbom): preserve publication tree authority #2549 and its fix(ci): integrate parser, security, response, and coverage gates #2530 prerequisite integrate through ordinary protection, forward-repair this branch without Force Push, reproduce current inventory from protected main, and require a fresh tree comparison plus exact-head security/review evidence. The current vulnerable tree is not accepted merely because its owner repair is proposed.

Automated central SBOM inventory refresh for live non-fork repositories. Review reciprocal, restricted, and NOASSERTION license evidence in docs/sbom/inventory.md against the product's actual distribution and hosted-service model.

---

Current exact authority (2026-09-30)

• Exact head: f879b4b43abfb9487bd2be500bff5b23f3223a8b; the PR is open, Draft, and mergeable.
• The branch now spans 969 commits and 324 changed files. Do not treat the effective delta as inventory-only until a fresh ancestry and diff reconciliation proves that scope.
• Exact-head Security Scan 36668036357, Python Security 36668036434, and SAST Semgrep 36668036390 are queued. CodeQL PR 36668036431 is terminal skipped, not GREEN and not merge authority.
• Two security review threads remain unresolved: the current Scorecard pipCommand not pinned by hash finding in .github/workflows/opencode-review-dispatch.yml, and an outdated-but-unresolved Semgrep dynamic-urllib finding in scripts/ci/verify_release_maturin_tool_assets.py.
• There is no qualifying current-head approval. Keep this PR Draft; reconcile branch scope and both findings, then reacquire exact-head terminal checks and independent review.

Historical blocking state (2026-09-08)

• Exact head: e6b292ce5e104212eaa032579afff1514b865019; live main comparison is ahead 70 / behind 0. The effective customer-evidence delta remains docs/sbom/inventory.json and docs/sbom/inventory.md.
• required-workflow-bootstrap is deterministically RED before policy analysis because the Contents API does not inline the 1,148,611-byte JSON and protected main's policy caps that evidence path at 1 MiB. This is not an Nginx finding.
• Canonical owner repair #1946 sits at exact head 1cb8cceb8719eb054979d84141cda9a95c0c6873, ahead 5 / behind 0, with bounded Git Blobs fallback plus malicious-content and malformed-evidence tests. Both original and Ready-event same-head Security, SAST, Python Security, and CodeQL PR runs are terminal GREEN. Noema and Strix were materialized but failed on central orchestrator/free availability (HTTP 429 / zero ready routes); OpenCode's derived CHANGES_REQUESTED contains no leaf-source finding. Keep this inventory PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protected main, this branch non-force integrates that release, and new exact-head checks plus independent review are valid.
• Noema's orchestrator/free HTTP 429 is a separate review-transport blocker. Keep this PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protected main, this branch non-force integrates that release, and all new exact-head checks plus independent review are valid.