fix(opencode): support managed setup convergence

openspec/changes/archive/2026-07-20-opencode-managed-setup-convergence/archive-report.md

@@ -0,0 +1,32 @@
+# Archive Report: OpenCode managed setup convergence
+
+**Status**: ARCHIVED<br>
+**Oracle verdict**: PASS<br>
+**Archive path**: `openspec/changes/archive/2026-07-20-opencode-managed-setup-convergence/`
+
+## Completed scope
+
+- US1 / FR-001, FR-002, FR-003, FR-010, FR-011 / SC-001, SC-006: global and project OpenCode setup now converges older, newer, absent, malformed, and same-version-diverged state from current packed assets, replaces the whole managed target and plugin entry link-safely, and repeats as an exact no-op.
+- US2 / FR-005, FR-006, FR-007, FR-008 / SC-002, SC-004: temporary target-bound signed journals provide in-process and crash restoration, invalid evidence resets safely, successful setup removes durable rollback evidence, and cleanup faults return bounded success warnings with later retry.
+- US3 / FR-004 / SC-003: JSONC precedence, parseable unrelated-setting preservation, canonical MCP repair, and raw-byte non-colliding malformed-config quarantine are implemented.
+- US4 / FR-009, FR-010, FR-011 / SC-005, SC-006, SC-007: plan mode stays zero-write, human/JSON result semantics and restart guidance agree, packed global/project flows pass, and all repository gates pass.
+
+## Verification lineage
+
+- `plan-review.md` records optional Oracle `[OKAY]` before implementation.
+- The first `verify-report.md` result identified ORA-VERIFY-001, a junction-ancestor journal containment defect; convergence task T024 added physical trusted-root validation and global/project outside-sentinel regressions.
+- `verify-report.md` now records independent oracle PASS with executed evidence for FR-001 through FR-011 and SC-001 through SC-007.
+- Final Oracle coherence review confirmed the behavior-neutral `[ADDED cli]` and `[ADDED packaging]` delta refinement preserves the PASS result and has no canonical title collision.
+
+## Canonical specification sync
+
+- Updated: `cli`, `packaging`.
+## Deviations and residual warnings
+
+- The accepted contract intentionally permits destructive replacement, downgrade, and removal of post-success OpenCode rollback evidence; this is recorded as a scoped P5 justified exception while CLI names, fields, statuses, and exit codes remain stable.
+- One POSIX-only file-mode test was skipped on Windows; Oracle reviewed the explicit `0o600` request, while Windows junction security tests executed and passed.
+- No real user-home setup, host restart, publication, release, or generated `dist/` edit was performed.
+
+## Follow-up
+
+- None required for the verified change. Any real-host smoke or publication remains a separately authorized stateful operation.

openspec/changes/archive/2026-07-20-opencode-managed-setup-convergence/checklists/requirements.md

@@ -0,0 +1,24 @@
+# Requirements checklist: OpenCode managed setup convergence
+
+**Activation reason**: The confirmed contract intentionally permits destructive replacement, downgrade, malformed-config recreation, invalid-journal discard, and removal of durable rollback evidence across global and project OpenCode scopes. These choices require explicit completeness, security, recovery, and migration auditing before implementation.
+
+## Initial validation
+
+- [x] CHK001 [Completeness] Do US1-US4 cover the user, operator, normal convergence, exact no-op, config repair, interruption recovery, invalid evidence, cleanup failure, planning, packed delivery, and restart flows? Evidence: every named flow has at least one Given/When/Then scenario and maps to FR-001 through FR-011.
+- [x] CHK002 [Clarity] Does each FR state one observable policy without relying on “safe”, “managed”, or “current” as undefined authority? Evidence: FR-001 defines canonical path ownership, FR-002 defines exact no-op versus convergence, FR-003 defines full replacement/link behavior, and FR-005 through FR-008 define journal lifecycle and cleanup outcomes.
+- [x] CHK003 [Consistency] Are stories, requirements, assumptions, dependencies, and non-goals consistent about full-directory deletion, any-direction version convergence, no `--force`, transient-only rollback, and both OpenCode scopes? Evidence: US1/US2, FR-001/FR-002/FR-007, assumptions 1-2, and out-of-scope items use the same rules; Codex/Claude remain excluded.
+- [x] CHK004 [Measurability] Does every FR have a public or isolated verification seam and does every SC define countable/pass-fail evidence? Evidence: plan requirement mapping covers FR-001 through FR-011 and SC-001, SC-002, SC-003, SC-004, SC-005, SC-006, and SC-007; the spec passed the Full `specify` validator gate.
+- [x] CHK005 [Coverage] Is every US, FR, SC, actor, failure mode, and confirmed constraint represented in traceability? Evidence: every story has `Covers`, every FR appears in the plan table, every SC appears in the evidence table, and edge cases enumerate metadata, target kinds, config candidates, crash boundaries, receipt isolation, path spaces, and concurrency.
+
+## Domain lenses
+
+- [x] CHK006 [Security] Do requirements prevent link traversal, path escape, secret leakage, and cross-target receipt deletion despite permissive ownership? Evidence: FR-003 removes the final link without following it, FR-006 forbids embedded-path deletion, FR-007 is harness/scope/target bounded, FR-011 preflights boundaries, and SC-002/SC-003 require traversal and diagnostic checks.
+- [x] CHK007 [Migration] Are older, newer, missing, malformed, and same-version states all assigned deterministic outcomes, including legacy receipts? Evidence: US1 scenarios, FR-001/FR-002/FR-010, edge cases, and the plan's legacy receipt migration risk cover each state; downgrade is explicitly accepted.
+- [x] CHK008 [Recovery] Are live failure, process crash, valid journal, invalid journal, post-verification crash, and cleanup failure distinguishable? Evidence: US2 has five scenarios; FR-005 through FR-008 specify restoration, reset, verify-before-delete, warning, and retry semantics.
+- [x] CHK009 [User data] Is the exception for malformed external configuration explicit and recoverable? Evidence: US3 and FR-004 require a byte-exact non-colliding backup before recreation, path-only disclosure, unrelated-setting preservation for parseable input, and JSONC precedence.
+- [x] CHK010 [Public contract] Are changed and unchanged CLI behaviors explicit? Evidence: FR-009 preserves plan zero-write behavior, result status/changed semantics, and restart guidance; out of scope excludes process control, while the plan records the P5 justified exception for post-success rollback removal.
+- [x] CHK011 [Harness isolation] Can permissive OpenCode behavior leak into Codex or Claude? Evidence: affected capabilities are CLI/packaging, FRs name OpenCode, out of scope excludes both other harnesses, and plan design requires an OpenCode-only branch plus regression suites.
+
+## Revalidation
+
+- Not required: The checklist was created after the specification passed `specify` and the technical plan passed `plan`; the plan added implementation detail without changing any confirmed requirement, story, criterion, assumption, or non-goal.

openspec/changes/archive/2026-07-20-opencode-managed-setup-convergence/plan-review.md

@@ -0,0 +1,78 @@
+---
+schema: thoth-agents/sdd-plan-review/v1
+artifact: plan-review
+change: opencode-managed-setup-convergence
+gate: oracle-review
+status: "[OKAY]"
+reviewer_role: oracle
+reviewed_at: 2026-07-20T21:47:38.384088200Z
+pipeline: full
+persistence_mode: openspec
+override:
+  occurred: false
+  at: null
+  surface: null
+  context: null
+reviewed_artifacts:
+  - role: spec
+    path: openspec/changes/opencode-managed-setup-convergence/spec.md
+    required: true
+    sha256: sha256:2db7e77062ecd8571a3c5b037517b9c67aefcf5683f53123fd635c8705aba3d3
+  - role: plan
+    path: openspec/changes/opencode-managed-setup-convergence/plan.md
+    required: true
+    sha256: sha256:3675b1bdda984180958f3307028bd0ecc2e721cfcb3203414030f735e004139c
+  - role: tasks
+    path: openspec/changes/opencode-managed-setup-convergence/tasks.md
+    required: true
+    sha256: sha256:70c3f9a399906e59614a1b5c74b4f6b3f1b02d0ba2fb084c557d116a0b0105ea
+  - role: checklist
+    path: openspec/changes/opencode-managed-setup-convergence/checklists/requirements.md
+    required: true
+    sha256: sha256:e11e63b9382a3c95c3c72b8f65820e40e167daf30d96bca6999cbda1520d380a
+  - role: constitution
+    path: openspec/memory/constitution.md
+    required: true
+    sha256: sha256:4203d40b3a13c45d6862beeee99eb762e76785a50f7e680f61bf5412a9bb04aa
+---
+
+# Plan Review: OpenCode managed setup convergence
+
+**Status**: [OKAY]
+
+## Oracle Result
+
+[OKAY]
+
+## Comments
+
+- FR-001 through FR-011 and SC-001 through SC-007 map to executable T001-T023 work.
+- Named engine, filesystem, receipt, lock, CLI, and test anchors exist with reusable transaction, checkpoint, fault-injection, isolation, and packed-install seams.
+- Tasks are sequential, one-writer safe, and production changes are preceded by failing tests.
+- Target-bound recovery, link-safe replacement, config quarantine, cleanup retry, both scopes, and harness isolation have viable implementation paths without external prerequisites.
+
+## Non-Blocking Notes
+
+- Honor FR-011 preflight ordering before any journal restoration that mutates targets; the sequence diagram is intentionally abbreviated.
+- Preserve malformed configuration as raw bytes rather than UTF-8 round-tripping; the current string-only filesystem payload may need a small byte/copy extension.
+- Use `integrations/inventory.json` as the canonical runtime asset preflight authority.
+
+## Blockers
+
+- None.
+
+## User Override Context
+
+None.
+
+## Source SHA-256
+
+- `openspec/changes/opencode-managed-setup-convergence/spec.md`: `sha256:2db7e77062ecd8571a3c5b037517b9c67aefcf5683f53123fd635c8705aba3d3`
+- `openspec/changes/opencode-managed-setup-convergence/plan.md`: `sha256:3675b1bdda984180958f3307028bd0ecc2e721cfcb3203414030f735e004139c`
+- `openspec/changes/opencode-managed-setup-convergence/tasks.md`: `sha256:70c3f9a399906e59614a1b5c74b4f6b3f1b02d0ba2fb084c557d116a0b0105ea`
+- `openspec/changes/opencode-managed-setup-convergence/checklists/requirements.md`: `sha256:e11e63b9382a3c95c3c72b8f65820e40e167daf30d96bca6999cbda1520d380a`
+- `openspec/memory/constitution.md`: `sha256:4203d40b3a13c45d6862beeee99eb762e76785a50f7e680f61bf5412a9bb04aa`
+
+## Recovery Decision
+
+This result satisfies only optional plan review while all source digests remain unchanged. It does not authorize implementation or satisfy final Oracle verify.