Track OpenCode upstream drift

[777genius]

OpenCode upstream tracking

Status: UPDATE REQUIRED

What fork means here

GitHub records 777genius/opencode-anomaly as a fork, but architecturally it is not an independent OpenCode product. It is a temporary bounded downstream patch queue over an exact upstream stable release.

Upstream anomalyco/opencode remains authoritative for all normal product development. We carry only:

1. PR feat: use agent teams #1: the functional hosted approval delta that stock OpenCode does not currently provide atomically.
2. PR improvents(agent-teams): small  #2: a replaceable hardened source-to-binary release pipeline for the temporary delta.

Why PR #1 exists

The hosted actual-owner contract needs one conditional approval operation fenced by runtime instance, config generation, session incarnation, request incarnation and permission digest. A separate list-then-reply sequence cannot guarantee that the permission being approved is still the same permission at the settlement point.

Remove this patch when upstream provides an equivalent atomic API or a supported plugin boundary with the same fail-closed semantics.

Why PR #2 exists

PR #2 proves immutable source-to-binary identity, reproducibility and native platform verification for the pinned temporary patch line. Its implementation is replaceable. The invariant is not replaceable: product and orchestrator must bind the exact reviewed source and executable digest.

Current drift

• Downstream base: v1.18.4
• Latest upstream stable: v1.18.21
• Current prerelease: v1.18.4-agentteams.1
• Production eligibility: false
• Policy: docs/hosted-opencode-downstream-policy.md in Agent Teams PR refactor(hosted-web): establish runtime feature boundaries #252

The current v1.18.4 candidate must not become the production pin.

Required convergence checklist

• Port only PR feat: use agent teams #1 functional delta onto v1.18.21.
• Review semantic changes in permission, session and server behavior.
• Remove any delta now supplied safely by upstream.
• Run focused approval contract and adversarial tests.
• Build a new immutable candidate through the hardened pipeline.
• Pass reproducibility and Linux, macOS and Windows native verification.
• Update exact source and executable digests in Agent Teams PR refactor(hosted-web): establish runtime feature boundaries #252.
• Update the same exact source and executable digests in orchestrator PR dev -> main #44.
• Run one fresh sandbox-only no-fake actual-owner E2E.
• Keep all production capability gates false until the coordinated exact-head proof passes.

Continuous upstream policy

The scheduled OpenCode upstream tracker in Agent Teams PR #252 compares the immutable downstream base with the latest stable release and keeps this single issue synchronized. Every stable or security release requires an explicit compatibility decision, bounded port and fresh evidence before production promotion.

Exit criteria

Delete the downstream dependency when stock upstream passes the same atomic conditional-reply contract, adversarial tests and sandbox no-fake E2E, and both repository pins migrate together.

Related work:

• Agent Teams product: refactor(hosted-web): establish runtime feature boundaries #252
• Orchestrator actual-owner acceptance: 777genius/agent_teams_orchestrator#44
• OpenCode functional delta: feat(opencode): add atomic hosted approval v2 opencode-anomaly#1
• OpenCode artifact pipeline: chore(opencode): add hardened prerelease pipeline opencode-anomaly#2

[777genius]

Independent upstream-equivalence audit completed against exact OpenCode v1.18.21 commit 826d9ad46a22bef0294998e08daa3c4904fea28f.

Result:

• upstream still has no equivalent atomic conditional approval API or supported plugin boundary
• the existing 17-file downstream patch applies cleanly to v1.18.21
• no production hunk is currently removable
• however, PR feat: use agent teams #1 does not yet prove a distinct session-incarnation fence; it currently binds stable sessionId plus request incarnation

The v1.18.21 port must therefore add or rigorously prove session-incarnation semantics and cover session policy mutation, replay/race, real pending-request HTTP settlement, concurrency and restart/config interruption before a new artifact can be accepted. The current v1.18.4 prerelease remains ineligible for production.