test(ci): lock local OpenCode small_model to NVIDIA NIM

[cursor]

Canonical local OpenCode NVIDIA NIM contract

This PR is the surviving landing vehicle for the local developer OpenCode provider contract. Closed predecessors/successors #879 and #885 must not be merged in parallel.

Exact current head: 4e07356d1ece6f22c040d6a0cd24c995800f88a9.
Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.

Held behavior:

• enabled_providers is exactly ["nvidia-nim"];
• default model is nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5;
• small_model is nvidia-nim/meta/llama-3.3-70b-instruct;
• provider endpoint is https://integrate.api.nvidia.com/v1;
• local binding remains {env:NVIDIA_API_KEY} while the organization GitHub secret remains NVIDIA_NIM_API_KEY and CI maps it to that process alias;
• GitHub Models, STRIX_GITHUB_MODELS_TOKEN, COPILOT_GITHUB_TOKEN, retired OpenAI model IDs, and models.github.ai remain forbidden in opencode.jsonc;
• OpenAI-style reasoningEffort is forbidden from the local OpenCode configuration; and
• central review-agent credentials and scheduler workflows remain owned by ContextualWisdomLab/.github and are not rewritten here.

Current-head review repair

Exact review on predecessor acf1f37e79dbc1f5df259583011962ce2edb82cf verified that the earlier model-level reasoningEffort defect was fixed but identified two low-severity contract-maintenance gaps: the focused NIM test duplicated the broader supply-chain contract, and the reasoningEffort ban only inspected the primary model's nested options object, so a future paste at another config level could evade that focused assertion.

This branch repaired those findings without changing production/provider configuration:

• e40172ec30f304dd61ce566e459a16618bc589c3 turns the formerly duplicated dedicated test into the unique whole-file invariant assert '"reasoningEffort"' not in opencode_text;
• current head 4e07356d1ece6f22c040d6a0cd24c995800f88a9 aligns doctoring so test_opencode_uses_nvidia_nim_only owns structured provider/model/secret assertions while test_opencode_forbids_reasoning_effort_anywhere independently owns the whole-config ban.

No product behavior, dependency, lockfile, workflow, database, filesystem/network authority, model credential name, MCP command surface, or review-agent credential changed in this follow-up.

Evidence boundary

Focused predecessor tests are implementation evidence only. The current exact head emitted a new repository workflow cycle: release 31960869272, sbom 31960869323, build-baseline 31960869319, ci 31960869350, bandit 31960869411, secret-scan-gate 31960869447, security-audit 31960869459, SAST Semgrep 31960869215, and Security Scan 31960869277 are currently queued and therefore non-passing.

Any failed exact-head job must be inspected at its job/check-run/annotation/log boundary before editing or rerunning. This branch has no JavaScript dependency/root-lock delta, so protected-base dependency failures belong to canonical #783 only after exact-log verification; they are not suppressed or pre-classified as success.

Security Notes

Attack surface

Local OpenCode sends repository context/prompts to NVIDIA NIM over HTTPS. No application-runtime surface changes.

Trust boundary

Untrusted model prompts/repository context cross the local developer client boundary. The repo-controlled provider/model allowlist and process-env alias are trusted configuration. The organization secret remains external to the file.

Mitigations / tests

Single enabled provider, exact endpoint/model contracts, process-env credential alias, deny-listed retired provider/token identifiers, whole-file reasoningEffort prohibition, and no generic MCP authority expansion. See docs/doctoring/opencode-nvidia-nim-contract.md.

Merge gate

Keep unmerged until the unchanged exact head has every applicable repository/central CI, coverage/docstring, SAST/security/SBOM/supply-chain/package/release gate terminal-success; zero valid unresolved findings; current central required-workflow prerequisites inherited from protected central main; a qualifying independent non-author last-push approval; and ordinary protected-branch acceptance. Queued/skipped/failed/predecessor/protected-base/model/self/author evidence is not success. Never self-approve, bypass protection, restore COPILOT_GITHUB_TOKEN, or disturb review-agent credentials.

---

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Stale comment

Review (8f3f1631)

#881 is SOUND for the NIM switch, small_model lock, leftover-id deny-list, and {env:NVIDIA_API_KEY} binding. The remaining gap is options.reasoningEffort: "high" on nvidia/llama-3.3-nemotron-super-49b-v1.5.

Landing vehicle is now #885 acf1f37e #885. It drops that knob, locks the absence plus {env:NVIDIA_NIM_API_KEY} rename, and keeps the env-split docs. Prefer #885 over #881 and #879. Do not merge these three in parallel.

Do not mix Stem Lab onto this PR. Stem Lab landing is #884. Do not self-approve or merge #881 from this run. Exact-head CI on #885 is still required.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review (acf1f37e)

#885 is closed. This head is now the NIM landing vehicle. Prefer it over #879 6ca06d3f. Do not merge #879 in parallel. Do not open a fourth NIM PR.

Previous reasoningEffort finding on opencode.jsonc is addressed: the knob is gone. NVIDIA's Llama 3.3 Nemotron Super 49B v1.5 card documents reasoning ON/OFF via the system prompt (/no_think), not OpenAI-style reasoningEffort (NVIDIA, n.d.).

Held

• enabled_providers is ["nvidia-nim"].
• Default model is nvidia-nim/nvidia/llama-3.3-nemotron-super-49b-v1.5.
• small_model is nvidia-nim/meta/llama-3.3-70b-instruct.
• Binding stays {env:NVIDIA_API_KEY} at https://integrate.api.nvidia.com/v1.
• {env:NVIDIA_NIM_API_KEY} is rejected in config text. Org secret name is unchanged; CI still maps it onto the process alias.
• Leftover deny-list still rejects github-models, STRIX_GITHUB_MODELS_TOKEN, COPILOT_GITHUB_TOKEN, openai/gpt-5, openai/o3, openai/o4-mini, and models.github.ai.
• Central review-agent credentials and scheduler workflows are not rewritten.
• Doctoring is in docs/doctoring/opencode-nvidia-nim-contract.md with APA 7th NVIDIA citations.

Residual (not a merge blocker)

• reasoningEffort is locked only on the primary model options object. A file-level "reasoningEffort" not in opencode_text assert would catch a later paste at provider or model root. Do not add that on a new PR; fold it here if this head moves again.
• PR body still names 8f3f1631. Update the exact-head line to acf1f37e when you next edit the description.

Merge gate

SOUND for the NIM switch, small_model lock, leftover-id deny-list, secret-name split, and reasoningEffort removal. Keep unmerged until exact-head required checks and a qualifying independent non-author last-push approval exist. This review is not that approval.

Do not mix workspace, stem-lane, or lock-in-first work onto this PR.

  

_{Sent by Cursor Automation: Fix Issues}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 4e07356d1ece6f22c040d6a0cd24c995800f88a9.

• Head SHA: 4e07356d1ece6f22c040d6a0cd24c995800f88a9

• Workflow run: 31982819577

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 4e07356d1ece6f22c040d6a0cd24c995800f88a9
• Workflow run: 31982819577
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 4e07356d1ece6f22c040d6a0cd24c995800f88a9.

• Head SHA: 4e07356d1ece6f22c040d6a0cd24c995800f88a9

• Workflow run: 31982819577

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (2 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (2 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading

[seonghobae]

Reviewed exact head 4e07356 against protected develop and the current OpenCode/NVIDIA NIM contract. The NIM-only provider, model IDs, OpenAI-compatible NVIDIA endpoint, environment-key substitution, whole-config reasoningEffort prohibition, leftover GitHub Models/Copilot deny-list, documentation, and regression tests are internally consistent; current NVIDIA NIM/OpenCode primary documentation supports the model/endpoint and chat-template reasoning boundary. Existing inline findings are resolved/outdated. This approval does not classify inherited protected-base npm findings or the central coverage-evidence failure as passing; #783 and the central required-workflow prerequisite still have to integrate and exact-head evidence must be regenerated before merge.

Self/author approval is non-qualifying under the BandScope protected-review contract and must not appear as merge evidence. Dismissing it without changing the exact head; independent non-author approval remains required.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: opencode.jsonc parses as strict JSON

test_opencode_uses_nvidia_nim_only calls json.loads on opencode.jsonc. Despite the .jsonc extension the file has no comments or trailing commas, so strict parsing succeeds. json is imported and parents[3] resolves to the repo root.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Re-review request for exact head 13306c64e647b1d43bd9234061687d5a1a91fc35: all required status contexts are green on this head (including coverage-evidence and security scans) and all review threads are resolved. @opencode-agent please review current head 13306c64e647b1d43bd9234061687d5a1a91fc35 and update the review decision.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

📝 Info: json.loads on .jsonc breaks if comments are added

test_opencode_uses_nvidia_nim_only parses opencode.jsonc with json.loads (services/analysis-engine/tests/test_supply_chain_policy.py:5080). The .jsonc format allows comments and trailing commas; the file currently has none. Adding either later would fail parsing with a decode error rather than a clear contract assertion.

---

Was this helpful? React with 👍 or 👎 to provide feedback.