feat(automation): add bounded source-fix command lane

[seonghobae]

Problem

@opencode-agent is intentionally review-only. Appending fix or repair therefore produces review evidence but no repository mutation, which made repair intent easy to misclassify as source progress.

Change

Add a separate organization-wide source-fix lane with the canonical @cwl-source-fix command and compatibility recognition for @opencode-agent fix|repair.

The lane binds each request to actor + source comment + repository + PR + exact base/head tuple, deduplicates with a durable Actions-artifact receipt, revalidates the live command before mutation, seals the editable set from the complete GitHub PR Files receipt, and only permits a normal non-force descendant push if the live head is still unchanged.

OpenCode runs only through the released contextual-orchestrator sidecar using contextual-orchestrator/orchestrator/free. Shell, web, nested task, and external-directory access are denied. The requested outcome is treated as untrusted task text rather than permission to weaken tests, review gates, security policy, or ownership boundaries.

Deliberate boundaries

• no ContextualWisdomLab/.github self-modification;
• no fork-head mutation;
• no .github/ or scripts/ci/ edits in target repositories;
• no new paths in v1; only existing PR-authored paths from a complete authenticated PR Files receipt;
• no force push, destructive rebase, auto-approval, merge, or gate weakening;
• successful mutation only creates a new PR head; normal protected checks and independent review remain authoritative.

@opencode-agent fix|repair remains a compatibility form and can still also trigger the review router. @cwl-source-fix is the source-mutation-only form.

Verification

Local contract validation before publication:

• workflow YAML parsed successfully;
• tests/test_agent_source_fix_workflow_contract.py: 6 passed;
• contract covers exact identity binding, trusted association, self/control-plane exclusion, complete PR Files receipt, CO/free-only model routing, denied tools, workspace restore + scope verification ordering, exact-head recheck, pinned actions, bounded/fair sweep, and absence of force/rebase behavior.

This PR is intentionally Draft until hosted checks and an independent exact-head review validate the new write-capable control path.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent
@cwl-noema-review

Review exact head 92c23231f9471655b5266e322ed13360c7338cfb. Focus on the new write-capable source-fix trust boundary: immutable actor/comment/base/head binding, allowlist and same-repo enforcement, PR Files completeness, control-plane exclusion, model/tool isolation, temporary config restoration, exact-head recheck, and normal non-force descendant push. Treat the PR as Draft; do not approve or merge on stale/head-mismatched evidence.

[seonghobae]

Preservation/consolidation note: #2173, #2174, and #2175 are parallel source-fix control-plane implementations from the same protected-main merge base. Keep this PR Open/Draft; do not merge independently or close as duplicate until its unique compatibility/contract deltas are compared against canonical candidate #2174. In particular, preserve any non-duplicated @opencode-agent fix|repair compatibility behavior and workflow-contract evidence. A valid successor must carry or explicitly reject each semantic delta with exact evidence; title similarity alone is not succession.