From 493421ad1382bfd7e9200c01966c869dfbf9bf03 Mon Sep 17 00:00:00 2001 From: Ajay Krishnan Date: Tue, 18 Aug 2026 15:16:28 -0700 Subject: [PATCH] Certify OpenCode 1.18.18 shared-client contract Record Gitea run 4055 as the contract clock for the pending 1.18.18 image. Shared-client only: no consumer promotion, no GitHub artifact claim, rails persistence still unverified. --- ...-08-18-opencode-1.18.18-shared-client.json | 59 +++++++++++++++++++ manifests/image-matrix.json | 14 ++++- test/repository_test.rb | 55 ++++++++++++++++- 3 files changed, 126 insertions(+), 2 deletions(-) create mode 100644 evidence/2026-08-18-opencode-1.18.18-shared-client.json diff --git a/evidence/2026-08-18-opencode-1.18.18-shared-client.json b/evidence/2026-08-18-opencode-1.18.18-shared-client.json new file mode 100644 index 0000000..b16ba28 --- /dev/null +++ b/evidence/2026-08-18-opencode-1.18.18-shared-client.json @@ -0,0 +1,59 @@ +{ + "schema_version": 1, + "kind": "shared-client-image-certification", + "status": "pass", + "certification_scope": "shared-client-contract-only", + "publication_state": "unpublished", + "clients": { + "opencode_ruby": { + "version": "0.0.1.alpha8", + "commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766", + "executed": true + }, + "opencode_rails": { + "version": "0.0.1.alpha8", + "commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f", + "executed_by_image_contract": false + } + }, + "gitea_workflow": { + "run_id": "4055", + "run_attempt": 1, + "head_sha": "88809aa98dc6e76976bf42ba9ab28e86f1aca39b", + "repository": "ajaynomics/opencode-compat", + "run_url": "https://gitea.ajay.to/ajaynomics/opencode-compat/actions/runs/4055", + "completed_at": "2026-08-18T21:31:14Z", + "status": "pass", + "event": "workflow_dispatch", + "artifact_evidence_claimed": false + }, + "reviewed_local_contract": { + "checked_at": "2026-08-18T22:07:51Z", + "kind": "shared-client-image-contract", + "status": "pass", + "platform": "linux/amd64", + "docker_image_id": "sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f" + }, + "exact_image_contracts": [ + { + "id": "upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f", + "checked_at": "2026-08-18T21:31:08Z", + "image": "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f", + "reported_version": "1.18.18", + "status": "pass", + "expected_text": "compat-ok", + "full_text": "compat-ok", + "authoritative_assistant_message_count": 1, + "llm_request_count": 1, + "executed_profiles": ["ruby-rest-sse"], + "required_consumer_profiles": [] + } + ], + "certified_at": "2026-08-18T22:08:30Z", + "limitations": [ + "No GitHub artifact exists for this image. Gitea run 4055 executed the full exact-image matrix and claimed no durable artifacts.", + "The exact-image contract executes opencode-ruby, not opencode-rails.", + "Rails persistence and each consumer application profile remain unverified for this digest.", + "This certification does not promote any consumer runtime tuple." + ] +} diff --git a/manifests/image-matrix.json b/manifests/image-matrix.json index 6583b6c..d66a563 100644 --- a/manifests/image-matrix.json +++ b/manifests/image-matrix.json @@ -112,7 +112,19 @@ "profiles": ["ruby-rest-sse"], "required_consumer_profiles": [], "certification_scope": "shared-client-contract-only", - "certification_status": "pending" + "certification_status": "certified", + "current_certification": { + "status": "certified", + "client_commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766", + "rails_commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f", + "checked_at": "2026-08-18T21:31:08Z", + "expected_text": "compat-ok", + "full_text": "compat-ok", + "llm_request_count": 1, + "workflow_run_id": "4055", + "workflow_head_sha": "88809aa98dc6e76976bf42ba9ab28e86f1aca39b", + "evidence": "evidence/2026-08-18-opencode-1.18.18-shared-client.json" + } } ], "host_canary": [ diff --git a/test/repository_test.rb b/test/repository_test.rb index ec86b1a..d9f1ecb 100644 --- a/test/repository_test.rb +++ b/test/repository_test.rb @@ -53,8 +53,15 @@ class RepositoryTest < Minitest::Test end certified_rows = targets.select { |target| target.fetch("certification_status") == "certified" } - assert_equal %w[upstream-1.16.1 upstream-1.17.18 upstream-1.18.3], + assert_equal( + %w[ + upstream-1.16.1 + upstream-1.17.18 + upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f + upstream-1.18.3 + ], certified_rows.map { |target| target.fetch("id") }.sort + ) certified = certified_rows.to_h { |target| [target.fetch("id"), target] } travelwolf = certified.fetch("upstream-1.16.1") @@ -88,6 +95,20 @@ class RepositoryTest < Minitest::Test assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json", ajent_rails.dig("current_certification", "evidence") + newest = certified.fetch( + "upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f" + ) + assert_equal "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f", + newest.fetch("image") + assert_empty newest.fetch("consumers") + assert_empty newest.fetch("required_consumer_profiles") + assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766", + newest.dig("current_certification", "client_commit") + assert_equal "evidence/2026-08-18-opencode-1.18.18-shared-client.json", + newest.dig("current_certification", "evidence") + assert_equal "2026-08-18T21:31:08Z", newest.dig("current_certification", "checked_at") + assert_equal "4055", newest.dig("current_certification", "workflow_run_id") + certified.each_value do |target| current = target.fetch("current_certification") assert_equal "certified", current.fetch("status") @@ -213,6 +234,38 @@ class RepositoryTest < Minitest::Test assert evidence.fetch("limitations").any? { |entry| entry.include?("application profile") } end + def test_v1_18_18_evidence_certifies_shared_client_only + evidence = json("evidence/2026-08-18-opencode-1.18.18-shared-client.json") + candidate = json("manifests/client-candidate.json").fetch("clients") + contract = evidence.fetch("exact_image_contracts").fetch(0) + target = json("manifests/image-matrix.json").fetch("public_ci") + .find { |row| row.fetch("version") == "1.18.18" } + + assert_equal "pass", evidence.fetch("status") + assert_equal "shared-client-image-certification", evidence.fetch("kind") + assert_equal "shared-client-contract-only", evidence.fetch("certification_scope") + assert_equal "unpublished", evidence.fetch("publication_state") + refute evidence.key?("github_workflow") + assert_equal "4055", evidence.dig("gitea_workflow", "run_id") + assert_equal false, evidence.dig("gitea_workflow", "artifact_evidence_claimed") + assert_equal candidate.dig("opencode-ruby", "ref"), evidence.dig("clients", "opencode_ruby", "commit") + assert_equal candidate.dig("opencode-rails", "ref"), evidence.dig("clients", "opencode_rails", "commit") + assert_equal true, evidence.dig("clients", "opencode_ruby", "executed") + assert_equal false, evidence.dig("clients", "opencode_rails", "executed_by_image_contract") + assert_equal 1, evidence.fetch("exact_image_contracts").length + assert_equal target.fetch("id"), contract.fetch("id") + assert_equal target.fetch("image"), contract.fetch("image") + assert_equal target.dig("current_certification", "checked_at"), contract.fetch("checked_at") + assert_equal "2026-08-18T21:31:08Z", contract.fetch("checked_at") + assert_equal "compat-ok", contract.fetch("full_text") + assert_equal contract.fetch("expected_text"), contract.fetch("full_text") + assert_equal 1, contract.fetch("llm_request_count") + assert_equal 1, contract.fetch("authoritative_assistant_message_count") + assert_operator evidence.fetch("certified_at"), :>=, evidence.dig("gitea_workflow", "completed_at") + assert_operator evidence.fetch("certified_at"), :>=, evidence.dig("reviewed_local_contract", "checked_at") + assert evidence.fetch("limitations").any? { |entry| entry.include?("does not promote") } + end + def test_certified_migration_keeps_previous_tuple tuples = json("manifests/runtime-tuples.json") return unless tuples.fetch("migration_state") == "certified"