Test alpha8 commit candidates before publication

test/client_candidate_test.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "minitest/autorun"
+require "open3"
+require "rbconfig"
+require "tmpdir"
+require_relative "../lib/opencode_compat/client_candidate"
+
+class ClientCandidateTest < Minitest::Test
+  ROOT = File.expand_path("..", __dir__)
+  RUBY_COMMIT = "9277646a4bb2cf25a8384ffc140b154f49ea5766"
+  RAILS_COMMIT = "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f"
+
+  def setup
+    @document = JSON.parse(File.binread(File.join(ROOT, "manifests/client-candidate.json")))
+  end
+
+  def test_accepts_exact_unpublished_commit_candidate_and_emits_safe_outputs
+    outputs = OpenCodeCompat::ClientCandidate.new(@document).github_outputs
+
+    assert_equal "unpublished", outputs.fetch("publication_state")
+    assert_equal "commit", outputs.fetch("ruby_provenance_kind")
+    assert_equal RUBY_COMMIT, outputs.fetch("ruby_ref")
+    assert_equal "", outputs.fetch("ruby_tag")
+    assert_equal "commit", outputs.fetch("rails_provenance_kind")
+    assert_equal RAILS_COMMIT, outputs.fetch("rails_ref")
+    assert_equal "", outputs.fetch("rails_tag_object")
+  end
+
+  def test_unpublished_candidate_rejects_mixed_or_mismatched_provenance
+    @document.dig("clients", "opencode-ruby", "provenance")["tag"] = "v0.0.1.alpha8"
+    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
+    assert_match(/commit provenance keys/, error.message)
+
+    @document.dig("clients", "opencode-ruby", "provenance").delete("tag")
+    @document.dig("clients", "opencode-ruby", "provenance")["commit"] = "f" * 40
+    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
+    assert_match(/provenance commit/, error.message)
+  end
+
+  def test_published_candidate_requires_annotated_tag_provenance_for_both_clients
+    publish_document!
+
+    candidate.verify!
+
+    @document.dig("clients", "opencode-ruby")["provenance"] = {
+      "kind" => "commit",
+      "commit" => RUBY_COMMIT
+    }
+    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
+    assert_match(/provenance kind must equal "annotated-tag"/, error.message)
+  end
+
+  def test_published_candidate_rejects_wrong_tag_object_shape_or_peel
+    publish_document!
+    ruby_provenance = @document.dig("clients", "opencode-ruby", "provenance")
+    ruby_provenance["annotated_tag_object"] = "short"
+    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
+    assert_match(/annotated tag object must be a full lowercase 40-character/, error.message)
+
+    ruby_provenance["annotated_tag_object"] = "3" * 40
+    ruby_provenance["peeled_commit"] = "f" * 40
+    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
+    assert_match(/peeled commit/, error.message)
+  end
+
+  def test_rejects_non_lockstep_runtime_dependency
+    dependency = @document.dig("clients", "opencode-rails", "runtime_dependencies", "opencode-ruby")
+    dependency["requirement"] = "~> 0.0.1.alpha8"
+    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
+    assert_match(/runtime dependency requirement/, error.message)
+
+    dependency["requirement"] = "= 0.0.1.alpha8"
+    dependency["ref"] = "f" * 40
+    error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
+    assert_match(/runtime dependency ref/, error.message)
+  end
+
+  def test_output_script_validates_the_repository_manifest
+    output, error, status = Open3.capture3(
+      RbConfig.ruby,
+      File.join(ROOT, "scripts/client_candidate_outputs.rb")
+    )
+
+    assert status.success?, error
+    assert_includes output.lines, "ruby_ref=#{RUBY_COMMIT}\n"
+    assert_includes output.lines, "rails_ref=#{RAILS_COMMIT}\n"
+    assert_includes output.lines, "publication_state=unpublished\n"
+  end
+
+  private
+
+  def candidate
+    OpenCodeCompat::ClientCandidate.new(@document)
+  end
+
+  def publish_document!
+    @document["publication_state"] = "published"
+    {
+      "opencode-ruby" => "3" * 40,
+      "opencode-rails" => "4" * 40
+    }.each do |name, tag_object|
+      client = @document.fetch("clients").fetch(name)
+      client["provenance"] = {
+        "kind" => "annotated-tag",
+        "tag" => "v#{client.fetch('version')}",
+        "annotated_tag_object" => tag_object,
+        "peeled_commit" => client.fetch("ref")
+      }
+    end
+  end
+end

test/lockstep_client_contract_test.rb

@@ -8,10 +8,12 @@ require_relative "../ruby/lockstep_client_contract"
 
 module LockstepClientContractTestSources
   class Git
-    attr_reader :revision
+    attr_reader :ref, :revision, :uri
 
-    def initialize(revision)
+    def initialize(revision, ref: revision, uri: OpenCodeCompat::LockstepClientContract::OPENCODE_RUBY_GIT_URI)
       @revision = revision
+      @ref = ref
+      @uri = uri
     end
   end
 
@@ -36,13 +38,16 @@ class LockstepClientContractTest < Minitest::Test
     Dir.mkdir(@ruby_path)
     Dir.mkdir(@rails_path)
     @env = {
+      "OPENCODE_CLIENT_PUBLICATION_STATE" => "published",
       "OPENCODE_RUBY_PATH" => @ruby_path,
       "OPENCODE_RUBY_COMMIT" => RUBY_COMMIT,
+      "OPENCODE_RUBY_PROVENANCE_KIND" => "annotated-tag",
       "OPENCODE_RUBY_TAG" => RUBY_TAG,
       "OPENCODE_RUBY_TAG_OBJECT" => RUBY_TAG_OBJECT,
       "OPENCODE_RUBY_VERSION" => VERSION,
       "OPENCODE_RAILS_PATH" => @rails_path,
       "OPENCODE_RAILS_COMMIT" => RAILS_COMMIT,
+      "OPENCODE_RAILS_PROVENANCE_KIND" => "annotated-tag",
       "OPENCODE_RAILS_TAG" => RAILS_TAG,
       "OPENCODE_RAILS_TAG_OBJECT" => RAILS_TAG_OBJECT,
       "OPENCODE_RAILS_VERSION" => VERSION
@@ -79,20 +84,90 @@ class LockstepClientContractTest < Minitest::Test
     assert_equal "#{expected_json}\n", output.string
     assert_equal "#{expected_json}\n", File.binread(evidence_path)
     assert_equal "pass", document.fetch("status")
+    assert_equal 2, document.fetch("schema_version")
+    assert_equal "published", document.fetch("publication_state")
     assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "checkout_commit")
+    assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "bundler_git_ref")
     assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "bundler_git_revision")
-    assert_equal RUBY_TAG_OBJECT, document.dig("opencode_ruby", "tag_provenance", "annotated_tag_object")
-    assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "tag_provenance", "peeled_commit")
-    assert_equal RUBY_TAG, document.dig("opencode_ruby", "tag_provenance", "tag")
+    assert_equal OpenCodeCompat::LockstepClientContract::OPENCODE_RUBY_GIT_URI,
+      document.dig("opencode_ruby", "bundler_git_uri")
+    assert_equal "annotated-tag", document.dig("opencode_ruby", "source_provenance", "kind")
+    assert_equal RUBY_TAG_OBJECT, document.dig("opencode_ruby", "source_provenance", "annotated_tag_object")
+    assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "source_provenance", "peeled_commit")
+    assert_equal RUBY_TAG, document.dig("opencode_ruby", "source_provenance", "tag")
     assert_equal RAILS_COMMIT, document.dig("opencode_rails", "checkout_commit")
-    assert_equal RAILS_TAG_OBJECT, document.dig("opencode_rails", "tag_provenance", "annotated_tag_object")
-    assert_equal RAILS_COMMIT, document.dig("opencode_rails", "tag_provenance", "peeled_commit")
+    assert_equal RAILS_TAG_OBJECT, document.dig("opencode_rails", "source_provenance", "annotated_tag_object")
+    assert_equal RAILS_COMMIT, document.dig("opencode_rails", "source_provenance", "peeled_commit")
     assert_equal "= #{VERSION}", document.dig("opencode_rails", "runtime_dependency", "requirement")
     assert_equal RUBY_VERSION, document.fetch("ruby_runtime_version")
     assert_nil document.dig("workflow", "run_id")
     assert_equal expected_json, JSON.generate(JSON.parse(expected_json).sort.to_h)
   end
 
+  def test_accepts_unpublished_commit_only_provenance_without_tag_lookup
+    use_commit_only_provenance!
+
+    document = contract.verify
+
+    assert_equal "unpublished", document.fetch("publication_state")
+    assert_equal({"commit" => RUBY_COMMIT, "kind" => "commit"},
+      document.dig("opencode_ruby", "source_provenance"))
+    assert_equal({"commit" => RAILS_COMMIT, "kind" => "commit"},
+      document.dig("opencode_rails", "source_provenance"))
+  end
+
+  def test_publication_state_cannot_weaken_published_tag_binding
+    @env["OPENCODE_RUBY_PROVENANCE_KIND"] = "commit"
+    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
+    assert_match(/published candidate/, error.message)
+
+    use_commit_only_provenance!
+    @env["OPENCODE_RAILS_PROVENANCE_KIND"] = "annotated-tag"
+    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
+    assert_match(/unpublished candidate/, error.message)
+  end
+
+  def test_commit_only_provenance_rejects_residual_tag_coordinates
+    use_commit_only_provenance!
+    @env["OPENCODE_RUBY_TAG"] = RUBY_TAG
+
+    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
+
+    assert_match(/must not supply OPENCODE_RUBY_TAG/, error.message)
+  end
+
+  def test_commit_only_provenance_stops_when_the_release_tag_appears
+    use_commit_only_provenance!
+    set_git_result(
+      @ruby_path,
+      ["rev-parse", "--verify", "--quiet", "refs/tags/#{RUBY_TAG}"],
+      RUBY_TAG_OBJECT
+    )
+
+    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
+
+    assert_match(/release tag #{Regexp.escape(RUBY_TAG)} already exists/, error.message)
+    assert_match(/publication_state must be published/, error.message)
+  end
+
+  def test_commit_only_provenance_does_not_treat_git_errors_as_an_absent_tag
+    use_commit_only_provenance!
+    @git_results[[@ruby_path, ["rev-parse", "--verify", "--quiet", "refs/tags/#{RUBY_TAG}"]]] =
+      OpenCodeCompat::LockstepClientContract::GitCommandError.new("corrupt ref", exitstatus: 128)
+
+    resolver = lambda do |path, *arguments|
+      result = resolve_git(path, *arguments)
+      raise result if result.is_a?(Exception)
+
+      result
+    end
+    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) do
+      contract(git_resolver: resolver).verify
+    end
+
+    assert_match(/could not check opencode-ruby release tag: corrupt ref/, error.message)
+  end
+
   def test_rejects_checkout_commit_mismatch_for_either_client
     {
       @ruby_path => "opencode-ruby checkout commit",
@@ -223,6 +298,17 @@ class LockstepClientContractTest < Minitest::Test
     @bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new("f" * 40)
     error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
     assert_match(/Bundler opencode-ruby revision/, error.message)
+
+    @bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new(RUBY_COMMIT, ref: "main")
+    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
+    assert_match(/Bundler opencode-ruby ref/, error.message)
+
+    @bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new(
+      RUBY_COMMIT,
+      uri: "https://example.test/opencode-ruby.git"
+    )
+    error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
+    assert_match(/Bundler opencode-ruby URI/, error.message)
   end
 
   def test_rejects_loaded_rails_gem_from_another_checkout
@@ -278,6 +364,7 @@ class LockstepClientContractTest < Minitest::Test
     assert_equal 1, status.exitstatus
     failure = JSON.parse(File.binread(evidence_path))
     assert_equal "opencode-client-lockstep", failure.fetch("contract")
+    assert_equal 2, failure.fetch("schema_version")
     assert_equal "fail", failure.fetch("status")
     assert_match(/missing required environment/, failure.fetch("error"))
     assert_equal failure, JSON.parse(stderr)
@@ -285,10 +372,10 @@ class LockstepClientContractTest < Minitest::Test
 
   private
 
-  def contract(ruby_version: VERSION, rails_version: VERSION)
+  def contract(ruby_version: VERSION, rails_version: VERSION, git_resolver: method(:resolve_git))
     OpenCodeCompat::LockstepClientContract.new(
       env: @env,
-      git_resolver: method(:resolve_git),
+      git_resolver: git_resolver,
       loaded_specs: {
         "opencode-ruby" => @ruby_spec,
         "opencode-rails" => @rails_spec
@@ -315,4 +402,14 @@ class LockstepClientContractTest < Minitest::Test
   def set_git_result(path, arguments, result)
     @git_results[[path, arguments]] = result
   end
+
+  def use_commit_only_provenance!
+    @env["OPENCODE_CLIENT_PUBLICATION_STATE"] = "unpublished"
+    @env["OPENCODE_RUBY_PROVENANCE_KIND"] = "commit"
+    @env["OPENCODE_RAILS_PROVENANCE_KIND"] = "commit"
+    @env.delete("OPENCODE_RUBY_TAG")
+    @env.delete("OPENCODE_RUBY_TAG_OBJECT")
+    @env.delete("OPENCODE_RAILS_TAG")
+    @env.delete("OPENCODE_RAILS_TAG_OBJECT")
+  end
 end

test/matrix_json_test.rb

@@ -12,9 +12,18 @@ class MatrixJsonTest < Minitest::Test
 
   def setup
     @tmp = Dir.mktmpdir("opencode-matrix-json")
+    FileUtils.mkdir_p(File.join(@tmp, "lib/opencode_compat"))
     FileUtils.mkdir_p(File.join(@tmp, "scripts"))
     FileUtils.mkdir_p(File.join(@tmp, "manifests"))
     FileUtils.cp(File.join(ROOT, "scripts/matrix_json.rb"), File.join(@tmp, "scripts"))
+    FileUtils.cp(
+      File.join(ROOT, "lib/opencode_compat/client_candidate.rb"),
+      File.join(@tmp, "lib/opencode_compat")
+    )
+    FileUtils.cp(
+      File.join(ROOT, "manifests/client-candidate.json"),
+      File.join(@tmp, "manifests")
+    )
     @manifest = JSON.parse(File.read(File.join(ROOT, "manifests/image-matrix.json")))
   end
 
@@ -50,6 +59,32 @@ class MatrixJsonTest < Minitest::Test
     assert_match(/certification_scope must be shared-client-contract-only/, error)
   end
 
+  def test_rejects_a_matrix_bound_to_another_client_candidate
+    @manifest.fetch("client_candidate")["opencode_ruby_commit"] = "f" * 40
+
+    _output, error, status = run_matrix(@manifest)
+
+    refute status.success?
+    assert_match(/must equal the exact client candidate/, error)
+  end
+
+  def test_allows_reviewed_candidate_certification_without_changing_coordinates
+    @manifest.fetch("client_candidate")["certification_status"] = "certified"
+
+    _output, error, status = run_matrix(@manifest)
+
+    assert status.success?, error
+  end
+
+  def test_rejects_unknown_candidate_certification_status
+    @manifest.fetch("client_candidate")["certification_status"] = "deployed"
+
+    _output, error, status = run_matrix(@manifest)
+
+    refute status.success?
+    assert_match(/certification_status must be pending or certified/, error)
+  end
+
   private
 
   def run_matrix(manifest)

test/repository_test.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "minitest/autorun"
+require_relative "../lib/opencode_compat/client_candidate"
 require_relative "../lib/opencode_compat/runtime_tuple_promoter"
 
 class RepositoryTest < Minitest::Test
@@ -37,7 +38,9 @@ class RepositoryTest < Minitest::Test
   end
 
   def test_public_matrix_uses_only_immutable_oci_digests
-    targets = json("manifests/image-matrix.json").fetch("public_ci")
+    manifest = json("manifests/image-matrix.json")
+    assert_equal 2, manifest.fetch("schema_version")
+    targets = manifest.fetch("public_ci")
     refute_empty targets
     targets.each do |target|
       assert_match %r{\Aghcr\.io/anomalyco/opencode@sha256:[0-9a-f]{64}\z}, target.fetch("image")
@@ -45,38 +48,87 @@ class RepositoryTest < Minitest::Test
       assert_equal ["ruby-rest-sse"], target.fetch("profiles")
       assert_equal "shared-client-contract-only",
         target.fetch("certification_scope", "shared-client-contract-only")
-      next unless target.fetch("certification_status") == "certified"
+      assert_equal "pending", target.fetch("certification_status")
+      previous = target["previous_certification"]
+      next unless previous
 
-      assert_match(/\A[0-9a-f]{40}\z/, target.fetch("certified_client_commit"))
-      assert_equal target.fetch("expected_text"), target.fetch("full_text")
-      assert_equal 1, target.fetch("llm_request_count")
+      assert_equal "certified", previous.fetch("status")
+      assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
+      assert_equal previous.fetch("expected_text"), previous.fetch("full_text")
+      assert_equal 1, previous.fetch("llm_request_count")
     end
   end
 
-  def test_candidate_client_train_is_lockstep_and_bound_to_annotated_tags
+  def test_candidate_client_train_is_lockstep_and_bound_to_unpublished_commits
     candidate = json("manifests/client-candidate.json")
+    OpenCodeCompat::ClientCandidate.new(candidate).verify!
     clients = candidate.fetch("clients")
     release_train = candidate.fetch("release_train")
 
-    assert_equal 2, candidate.fetch("schema_version")
+    assert_equal 3, candidate.fetch("schema_version")
     assert_equal "candidate", candidate.fetch("status")
+    assert_equal "unpublished", candidate.fetch("publication_state")
+    assert_equal "0.0.1.alpha8", release_train
     assert_equal %w[opencode-rails opencode-ruby], clients.keys.sort
 
     clients.each do |name, client|
-      provenance = client.fetch("tag_provenance")
+      provenance = client.fetch("provenance")
       assert_equal "ajaynomics/#{name}", client.fetch("repository")
       assert_equal release_train, client.fetch("version")
       assert_match(/\A[0-9a-f]{40}\z/, client.fetch("ref"))
-      assert_equal "v#{release_train}", provenance.fetch("tag")
-      assert_match(/\A[0-9a-f]{40}\z/, provenance.fetch("annotated_tag_object"))
-      assert_equal client.fetch("ref"), provenance.fetch("peeled_commit")
+      assert_equal "commit", provenance.fetch("kind")
+      assert_equal client.fetch("ref"), provenance.fetch("commit")
+      refute provenance.key?("tag")
     end
 
+    assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766", clients.dig("opencode-ruby", "ref")
+    assert_equal "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f", clients.dig("opencode-rails", "ref")
     dependency = clients.fetch("opencode-rails").fetch("runtime_dependencies").fetch("opencode-ruby")
     assert_equal "= #{release_train}", dependency.fetch("requirement")
     assert_equal clients.fetch("opencode-ruby").fetch("ref"), dependency.fetch("ref")
   end
 
+  def test_image_matrix_is_pending_and_bound_to_the_exact_client_candidate
+    candidate = json("manifests/client-candidate.json")
+    clients = candidate.fetch("clients")
+    matrix_candidate = json("manifests/image-matrix.json").fetch("client_candidate")
+
+    assert_equal "pending", matrix_candidate.fetch("certification_status")
+    assert_equal candidate.fetch("release_train"), matrix_candidate.fetch("release_train")
+    assert_equal candidate.fetch("publication_state"), matrix_candidate.fetch("publication_state")
+    assert_equal clients.dig("opencode-ruby", "ref"), matrix_candidate.fetch("opencode_ruby_commit")
+    assert_equal clients.dig("opencode-rails", "ref"), matrix_candidate.fetch("opencode_rails_commit")
+
+    json("manifests/image-matrix.json").fetch("host_canary").each do |target|
+      assert_equal "pending", target.fetch("certification_status")
+      previous = target.fetch("previous_certification")
+      assert_includes %w[candidate-certified certified], previous.fetch("status")
+      assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
+    end
+  end
+
+  def test_alpha8_local_image_evidence_is_review_input_not_app_certification
+    evidence = json("evidence/2026-07-20-opencode-alpha8-pre-release-shared-client.json")
+    candidate = json("manifests/client-candidate.json").fetch("clients")
+
+    assert_equal "not-certified", evidence.fetch("certification_status")
+    assert_equal "shared-client-contract-only", evidence.fetch("coverage_scope")
+    assert_equal "unpublished", evidence.fetch("publication_state")
+    assert_equal candidate.dig("opencode-ruby", "ref"), evidence.dig("clients", "opencode_ruby", "commit")
+    assert_equal candidate.dig("opencode-rails", "ref"), evidence.dig("clients", "opencode_rails", "commit")
+    assert_equal true, evidence.dig("clients", "opencode_ruby", "executed")
+    assert_equal false, evidence.dig("clients", "opencode_rails", "executed_by_image_contract")
+    assert_equal 5, evidence.fetch("checks").length
+    evidence.fetch("checks").each do |check|
+      assert_equal "pass", check.fetch("status")
+      assert_equal ["ruby-rest-sse"], check.fetch("executed_profiles")
+      assert_equal check.fetch("expected_text"), check.fetch("full_text")
+      assert_equal 1, check.fetch("authoritative_assistant_message_count")
+      assert_equal 1, check.fetch("llm_request_count")
+    end
+    assert evidence.fetch("limitations").any? { |entry| entry.include?("remain unverified") }
+  end
+
   def test_certified_migration_keeps_previous_tuple
     tuples = json("manifests/runtime-tuples.json")
     return unless tuples.fetch("migration_state") == "certified"
@@ -204,7 +256,11 @@ class RepositoryTest < Minitest::Test
     assert_includes workflow, "repository: ajaynomics/opencode-ruby"
     assert_includes workflow, "repository: ajaynomics/opencode-rails"
     assert_includes workflow, "path: opencode-rails"
-    assert_includes workflow, "ruby: [\"3.2\", \"3.3\", \"3.4\"]"
+    assert_includes workflow, "ruby: [\"3.2\", \"3.3\", \"3.4\", \"4.0\"]"
+    assert_includes workflow, "scripts/client_candidate_outputs.rb"
+    assert_includes workflow, "OPENCODE_CLIENT_PUBLICATION_STATE"
+    assert_includes workflow, "OPENCODE_RUBY_PROVENANCE_KIND"
+    assert_includes workflow, "OPENCODE_RAILS_PROVENANCE_KIND"
     assert_includes workflow, "ruby/lockstep_client_contract.rb"
     assert_includes workflow, "OPENCODE_RUBY_TAG_OBJECT"
     assert_includes workflow, "OPENCODE_RAILS_TAG_OBJECT"