Merge pull request 'Certify OpenCode 1.18.18 shared-client contract' (#7) from certify/upstream-1.18.18-shared-client into main

Record Gitea run 4055 as the contract clock for the pending 1.18.18
image. Shared-client only: no consumer promotion, no GitHub artifact
claim, rails persistence still unverified.

evidence/2026-08-18-opencode-1.18.18-shared-client.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": 1,
+  "kind": "shared-client-image-certification",
+  "status": "pass",
+  "certification_scope": "shared-client-contract-only",
+  "publication_state": "unpublished",
+  "clients": {
+    "opencode_ruby": {
+      "version": "0.0.1.alpha8",
+      "commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
+      "executed": true
+    },
+    "opencode_rails": {
+      "version": "0.0.1.alpha8",
+      "commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
+      "executed_by_image_contract": false
+    }
+  },
+  "gitea_workflow": {
+    "run_id": "4055",
+    "run_attempt": 1,
+    "head_sha": "88809aa98dc6e76976bf42ba9ab28e86f1aca39b",
+    "repository": "ajaynomics/opencode-compat",
+    "run_url": "https://gitea.ajay.to/ajaynomics/opencode-compat/actions/runs/4055",
+    "completed_at": "2026-08-18T21:31:14Z",
+    "status": "pass",
+    "event": "workflow_dispatch",
+    "artifact_evidence_claimed": false
+  },
+  "reviewed_local_contract": {
+    "checked_at": "2026-08-18T22:07:51Z",
+    "kind": "shared-client-image-contract",
+    "status": "pass",
+    "platform": "linux/amd64",
+    "docker_image_id": "sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f"
+  },
+  "exact_image_contracts": [
+    {
+      "id": "upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f",
+      "checked_at": "2026-08-18T21:31:08Z",
+      "image": "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f",
+      "reported_version": "1.18.18",
+      "status": "pass",
+      "expected_text": "compat-ok",
+      "full_text": "compat-ok",
+      "authoritative_assistant_message_count": 1,
+      "llm_request_count": 1,
+      "executed_profiles": ["ruby-rest-sse"],
+      "required_consumer_profiles": []
+    }
+  ],
+  "certified_at": "2026-08-18T22:08:30Z",
+  "limitations": [
+    "No GitHub artifact exists for this image. Gitea run 4055 executed the full exact-image matrix and claimed no durable artifacts.",
+    "The exact-image contract executes opencode-ruby, not opencode-rails.",
+    "Rails persistence and each consumer application profile remain unverified for this digest.",
+    "This certification does not promote any consumer runtime tuple."
+  ]
+}

manifests/image-matrix.json

@@ -112,7 +112,19 @@
       "profiles": ["ruby-rest-sse"],
       "required_consumer_profiles": [],
       "certification_scope": "shared-client-contract-only",
-      "certification_status": "pending"
+      "certification_status": "certified",
+      "current_certification": {
+        "status": "certified",
+        "client_commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
+        "rails_commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
+        "checked_at": "2026-08-18T21:31:08Z",
+        "expected_text": "compat-ok",
+        "full_text": "compat-ok",
+        "llm_request_count": 1,
+        "workflow_run_id": "4055",
+        "workflow_head_sha": "88809aa98dc6e76976bf42ba9ab28e86f1aca39b",
+        "evidence": "evidence/2026-08-18-opencode-1.18.18-shared-client.json"
+      }
     }
   ],
   "host_canary": [

test/repository_test.rb

@@ -53,8 +53,15 @@ class RepositoryTest < Minitest::Test
     end
 
     certified_rows = targets.select { |target| target.fetch("certification_status") == "certified" }
-    assert_equal %w[upstream-1.16.1 upstream-1.17.18 upstream-1.18.3],
+    assert_equal(
+      %w[
+        upstream-1.16.1
+        upstream-1.17.18
+        upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f
+        upstream-1.18.3
+      ],
       certified_rows.map { |target| target.fetch("id") }.sort
+    )
     certified = certified_rows.to_h { |target| [target.fetch("id"), target] }
 
     travelwolf = certified.fetch("upstream-1.16.1")
@@ -88,6 +95,20 @@ class RepositoryTest < Minitest::Test
     assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json",
       ajent_rails.dig("current_certification", "evidence")
 
+    newest = certified.fetch(
+      "upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f"
+    )
+    assert_equal "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f",
+      newest.fetch("image")
+    assert_empty newest.fetch("consumers")
+    assert_empty newest.fetch("required_consumer_profiles")
+    assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766",
+      newest.dig("current_certification", "client_commit")
+    assert_equal "evidence/2026-08-18-opencode-1.18.18-shared-client.json",
+      newest.dig("current_certification", "evidence")
+    assert_equal "2026-08-18T21:31:08Z", newest.dig("current_certification", "checked_at")
+    assert_equal "4055", newest.dig("current_certification", "workflow_run_id")
+
     certified.each_value do |target|
       current = target.fetch("current_certification")
       assert_equal "certified", current.fetch("status")
@@ -213,6 +234,38 @@ class RepositoryTest < Minitest::Test
     assert evidence.fetch("limitations").any? { |entry| entry.include?("application profile") }
   end
 
+  def test_v1_18_18_evidence_certifies_shared_client_only
+    evidence = json("evidence/2026-08-18-opencode-1.18.18-shared-client.json")
+    candidate = json("manifests/client-candidate.json").fetch("clients")
+    contract = evidence.fetch("exact_image_contracts").fetch(0)
+    target = json("manifests/image-matrix.json").fetch("public_ci")
+      .find { |row| row.fetch("version") == "1.18.18" }
+
+    assert_equal "pass", evidence.fetch("status")
+    assert_equal "shared-client-image-certification", evidence.fetch("kind")
+    assert_equal "shared-client-contract-only", evidence.fetch("certification_scope")
+    assert_equal "unpublished", evidence.fetch("publication_state")
+    refute evidence.key?("github_workflow")
+    assert_equal "4055", evidence.dig("gitea_workflow", "run_id")
+    assert_equal false, evidence.dig("gitea_workflow", "artifact_evidence_claimed")
+    assert_equal candidate.dig("opencode-ruby", "ref"), evidence.dig("clients", "opencode_ruby", "commit")
+    assert_equal candidate.dig("opencode-rails", "ref"), evidence.dig("clients", "opencode_rails", "commit")
+    assert_equal true, evidence.dig("clients", "opencode_ruby", "executed")
+    assert_equal false, evidence.dig("clients", "opencode_rails", "executed_by_image_contract")
+    assert_equal 1, evidence.fetch("exact_image_contracts").length
+    assert_equal target.fetch("id"), contract.fetch("id")
+    assert_equal target.fetch("image"), contract.fetch("image")
+    assert_equal target.dig("current_certification", "checked_at"), contract.fetch("checked_at")
+    assert_equal "2026-08-18T21:31:08Z", contract.fetch("checked_at")
+    assert_equal "compat-ok", contract.fetch("full_text")
+    assert_equal contract.fetch("expected_text"), contract.fetch("full_text")
+    assert_equal 1, contract.fetch("llm_request_count")
+    assert_equal 1, contract.fetch("authoritative_assistant_message_count")
+    assert_operator evidence.fetch("certified_at"), :>=, evidence.dig("gitea_workflow", "completed_at")
+    assert_operator evidence.fetch("certified_at"), :>=, evidence.dig("reviewed_local_contract", "checked_at")
+    assert evidence.fetch("limitations").any? { |entry| entry.include?("does not promote") }
+  end
+
   def test_certified_migration_keeps_previous_tuple
     tuples = json("manifests/runtime-tuples.json")
     return unless tuples.fetch("migration_state") == "certified"