fix(ci): let OpenCode resolve unreviewed merge conflicts

[seonghobae]

Root cause

The trusted OpenCode conflict worker was already bounded: it revalidates the live base and head, performs a no-commit merge, seals Git's unmerged paths as the only model-writable scope, snapshots the full worktree outside the repository, rejects unresolved markers and out-of-scope writes, rechecks the live head, and pushes only a merge commit.

The scheduler prevented that worker from running unless the conflicting head already had a current-head approval. That prerequisite is circular: conflict repair creates a new head, so the repaired combination must receive fresh review and required checks regardless of the old head's review state. An unreviewed conflict such as #1098 therefore remained permanently undispatchable.

Change

• add an explicit --resolve-unreviewed-conflicts policy to the scheduler while retaining the historical approval prerequisite for direct library callers that do not opt in;
• enable that policy in the trusted reusable scheduler;
• add a protected hourly .github self-caller at minute 21, one dispatch per pass and one-hour exact-head retry spacing;
• allow the protected same-repository caller without weakening the cross-repository target allowlist;
• keep drafts, fork heads, wrong-base PRs, live-head races, unresolved markers, out-of-scope writes, review requirements, required checks, and merge protection fail-closed;
• continue using PR_REVIEW_MERGE_TOKEN, OPENCODE_APPROVE_TOKEN, or the established OpenCode GitHub App OIDC exchange; COPILOT_GITHUB_TOKEN is not used;
• add focused regression contracts and an APA 7th doctoring record.

TDD and exact-head verification

The first commit introduced the conflict-selection and central-caller contracts before implementation. The initial GREEN attempts exposed two existing compatibility assumptions and one branch-coverage stub signature; each was repaired without weakening the new policy or changing direct-call defaults.

Final exact head: 408781c0f3d728418fae27f6858da60dd3c65bd8

Hourly NVIDIA NIM Review Repair run 32198763125 passed with:

• 1,202 tests passed
• 16 subtests passed
• scoped production statement and branch coverage: 100% (438 statements, 154 branches)
• public docstring gate: 100%
• compileall and git diff --check: passed

Resulting evidence order

GitHub reports DIRTY / CONFLICTING
→ bounded OpenCode conflict repair
→ new exact PR head
→ fresh reviews and required checks
→ guarded merge decision

This PR does not merge #1098 itself. Once this change reaches protected main, the central hourly caller can dispatch the existing conflict worker against #1098 and future same-repository conflicts under the preserved safety boundary.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a5c678c-9e2d-4c1a-a311-835724abe514

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent
@cwl-noema-review

Please review the exact current head 408781c0f3d728418fae27f6858da60dd3c65bd8. Focus on whether the explicit unreviewed-conflict eligibility preserves the existing exact-head, same-repository, conflict-only write-scope, fresh-review/check, and branch-protection boundaries.