fix(agent-mention): keep OpenCode dispatch under GitHub payload cap

[seonghobae]

Incident

route-local-agent-mention failed on the trusted @opencode-agent comment in .github#955 (run 32026573583, job 95379052395) before the wrapper could start. The router sent 14 top-level client_payload properties; GitHub repository dispatch accepts at most 10.

This is a transport-shape defect, not a seonghobae trust or permission failure.

Scope

Only the agent-mention OpenCode route is changed:

• cap router → trusted wrapper transport at 9 identity/claim fields;
• reconstruct the five immutable review-only controls in the trusted wrapper;
• keep the complete canonical invocation hash binding;
• cap wrapper → scheduler transport at the 10 fields actually consumed by the scheduler;
• add focused regression contracts for both hops.

No merge policy, reviewer identity, credential, branch update, auto-merge, scheduler decision logic, or repository allowlist is changed. .github#955 is not part of this PR and must not be merged by this work.

Test-first lineage

• RED f43fb27a5820acd0743c2e6759fe0e44a4a5b0d1: the permanent payload-cap regression failed exactly because the router emitted 14 properties.
• GREEN e95c42c116a6c4029bac78ad86e7e209d2b884ba: the router and trusted wrapper transports are narrowed without weakening complete claim binding.

Exact-head verification

Agent Mention Router Quality CI run 32029132676, job 95384907487 passed on the GREEN head:

• 1117 passed, 16 subtests passed
• agent_mention_router.py: 239/239 statements and 102/102 branches, 100%
• agent_mention_sweep.py: 162/162 statements and 66/66 branches, 100%
• combined production coverage: 401 statements and 168 branches, 100%
• public docstring gate: 100%
• compileall and git diff --check: passed

Merge gate

Ready for independent review. Do not bypass required protected checks or approval. Do not merge .github#955 as part of this work.

Summary by CodeRabbit

• 개선 사항

  • 자동화 요청 전달 시 검증 가능한 기본 설정과 표준 제어값을 적용해 요청 처리의 일관성과 안정성을 높였습니다.
  • 전달 정보가 필요한 항목 중심으로 정리되어 잘못된 설정이나 임의 변경으로 인한 처리 오류를 줄였습니다.

• 테스트

  • 자동화 요청의 전달 형식, 필수 정보, 설정값 및 필드 수 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 94856362-2a82-48c9-abb8-99e2720f9b56

📥 Commits

Reviewing files that changed from the base of the PR and between c47afc2 and e95c42c.

📒 Files selected for processing (4)

• .github/workflows/agent-mention-opencode-dispatch.yml
• scripts/ci/agent_mention_router.py
• tests/test_agent_mention_complete_payload_binding.py
• tests/test_agent_mention_router.py

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

OpenCode 디스패치 페이로드에서 리뷰 제어값을 제거했습니다. 워크플로는 해당 값을 기본값으로 재구성합니다. 테스트는 축소된 페이로드의 키 집합과 필드 수를 검증합니다.

Changes

OpenCode 디스패치 계약

Layer / File(s)	Summary
축소된 페이로드와 immutable 기본값 scripts/ci/agent_mention_router.py, .github/workflows/agent-mention-opencode-dispatch.yml	래퍼는 요청 식별 정보와 invocation key만 전달합니다. 리뷰 제어값은 페이로드에서 제거합니다. 워크플로는 리뷰 제어값에 기본값을 적용합니다.
디스패치 계약 검증 tests/test_agent_mention_complete_payload_binding.py, tests/test_agent_mention_router.py	테스트는 OpenCode 페이로드의 정확한 키 집합과 9개 필드를 검증합니다. 워크플로 기본값, 10개 속성 제한, 제한된 리뷰·병합 설정도 검증합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to e95c4

The change narrowly caps agent-mention dispatch payloads while preserving claim binding and adds regression coverage for both transport hops; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 GitHub payload 제한을 초과하는 OpenCode dispatch 문제를 해결하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/agent-mention-payload-cap-current-main-20260817

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Independent review request withdrawn after the existing Noema route returned an unrelated target-token HTTP 403. This PR remains limited to the OpenCode repository-dispatch payload-cap defect. Do not modify or merge .github#955, and do not involve .github#1081, .github#969, or ContextualWisdomLab/TEPP#47.