Add OpenCode server cooperative execution

skills/autopilot/README.md

@@ -23,6 +23,8 @@ When using Pi's process-local backend, load `runtime/dist/src/pi-extension-entry
 
 Codex offers two explicit charter modes. `codex-app-server` binds an implementation to one per-attempt app-server instance and exact ephemeral thread/turn; connection or server loss becomes unknown. `codex` retains the direct CLI fallback and POSIX process-supervised restart reattachment. App-server independent review still uses the direct read-only CLI path.
 
+OpenCode also offers two explicit modes. `opencode-server` owns one authenticated loopback server, dedicated session, caller-selected message, and uninterrupted event stream per implementation attempt; any identity or stream gap becomes unknown. `opencode` remains the direct CLI mode. Server-mode independent review still uses the direct CLI path.
+
 Autopilot will:
 
 1. turn the request into explicit work items, completion predicates, budgets, and grants;

skills/autopilot/SKILL.md

@@ -7,7 +7,7 @@ disable-model-invocation: true
 
 # Autopilot
 
-Autopilot delegates bounded coding work to a fresh Claude Code, Codex, Pi, or OpenCode execution. Pi implementations prefer the packaged process-local extension backend. Codex charters select either the exact same-instance `codex-app-server` backend or the distinct direct `codex` CLI path. Other modes and fallbacks use their declared CLI boundaries. The runtime owns lifecycle state, Git commits, verification, remote delivery, and completion decisions.
+Autopilot delegates bounded coding work to a fresh Claude Code, Codex, Pi, or OpenCode execution. Pi implementations prefer the packaged process-local extension backend. Codex charters select either the exact same-instance `codex-app-server` backend or the distinct direct `codex` CLI path. OpenCode charters similarly select the same-instance `opencode-server` backend or distinct direct `opencode` CLI path. Other modes and fallbacks use their declared boundaries. The runtime owns lifecycle state, Git commits, verification, remote delivery, and completion decisions.
 
 ## New-run preconditions
 
@@ -19,6 +19,7 @@ For a new implementation run:
 4. Resolve how the repository selects each required build toolchain before sealing command gates. Prefer checked-in wrappers or toolchain configuration; when a gate or hook still requires a named environment selector, forward only that name and authorize it for the runtime.
 5. Do not install tools, download runtimes, authenticate providers, or modify global configuration.
 6. For Codex, select `codex-app-server` only when the operator accepts same-instance cooperative terminality; select `codex` for the distinct direct CLI mode. Never switch between them after admission or infer one mode's guarantees from the other.
+7. For OpenCode, select `opencode-server` only when the operator accepts one owned loopback server, an uninterrupted non-replayable event stream, and same-instance cooperative terminality; select `opencode` for the distinct direct CLI mode. Never reuse a shared server or switch modes after admission.
 
 Treat “I am going to sleep,” “work overnight,” and “have this ready in the morning” as explicit unattended-run intent. Preserve that intent in `sourceText`, but do not turn it into a deadline, merge grant, deployment grant, or guarantee of completion time.
 

skills/autopilot/docs/2026-08-30-continuity-evidence-implementation-plan.md

@@ -487,7 +487,7 @@ skills/autopilot/runtime/test/fault-injection.test.ts
 
 ## Phase 7: Finish documentation and packaging
 
-**Result:** Implemented for Phases 0–6A. Phase 6B is not promoted under the recorded no-receiver decision and is not a current release blocker. The current validation baseline is 205 Node tests locally after adding Codex app-server contract coverage. The earlier 187-test native-free, 200-test Pi process-local, 162-test, and 137-test baselines passed at their recorded revisions on Ubuntu and Windows.
+**Result:** Implemented for Phases 0–6A. Phase 6B is not promoted under the recorded no-receiver decision and is not a current release blocker. The current validation baseline is 234 Node tests locally after adding Codex app-server and OpenCode server contract coverage. The earlier 187-test native-free, 200-test Pi process-local, 162-test, and 137-test baselines passed at their recorded revisions on Ubuntu and Windows.
 
 ### Files
 

skills/autopilot/docs/2026-08-31-cooperative-harness-execution-plan.md

@@ -1,6 +1,6 @@
 # Cooperative harness execution implementation plan
 
-- **Status:** Implemented through the Codex app-server integration: decision/promotion shutdown, execution assurance, fenced unknown-execution recovery, Pi process-local integration, Windows native-path removal, and exact same-instance Codex turns are complete; the OpenCode server boundary has a separate implementation-ready evaluation, while Claude remains separate
+- **Status:** Implemented through the explicit OpenCode server backend and controlled fault matrix; the separate Claude boundary remains pending
 - **Date:** 2026-08-31
 - **Audience:** Autopilot implementers and reviewers
 - **Related:** [Architecture](architecture.md), [continuity implementation plan](2026-08-30-continuity-evidence-implementation-plan.md), [OpenCode server evaluation](2026-08-31-opencode-server-evaluation.md), [durable event engine ADR](adr/0001-durable-event-engine.md)
@@ -378,7 +378,7 @@ The default stdio transport cannot reconnect after coordinator loss. WebSocket t
 
 Investigate and implement each remaining provider as a separate boundary.
 
-- OpenCode: the [server evaluation](2026-08-31-opencode-server-evaluation.md) establishes an implementation-ready same-instance contract based on one owned server process, one dedicated session, one caller-selected message ID, uninterrupted live events, and fresh REST reconciliation. Production code and fault coverage remain unimplemented.
+- OpenCode: the [server evaluation](2026-08-31-opencode-server-evaluation.md) established the same-instance contract. The explicit `opencode-server` adapter owns one server process, dedicated session, caller-selected message ID, uninterrupted live events, and fresh REST reconciliation. Controlled fault coverage passes, and live completion and cancellation passed with OpenCode 1.18.28.
 - Claude Code: remain session-scoped until an active execution attachment surface exists.
 
 Do not add a provider-neutral durable-subject framework based only on hypothetical future consumers.
@@ -467,6 +467,6 @@ Pause and revisit the design if implementation shows any of the following:
 - Controlled Pi process-local tests cover exact admission, cancellation, terminal-before-shutdown precedence, reload/session invalidation, lost admission, late/mismatched result rejection, direct fallback, and runtime-core completion in one reused local repository fixture. Whole-process live fault evidence remains environment-specific and does not prove OS quiescence or provider parity.
 - No provider currently proves Windows process-tree quiescence through its public subagent contract.
 - Codex app-server 0.151.0 exact completion and interruption were exercised over one uninterrupted stdio connection. Cross-connection live rejoin is intentionally unimplemented because the default transport is not reconnectable; continuity loss remains unknown.
-- OpenCode 1.18.25 same-process completion and cancellation passed controlled live probes. Disconnect remains intentionally unrecoverable because SSE has no replay cursor; production fault handling and Claude interruption behavior remain unimplemented.
+- OpenCode 1.18.25 protocol probes and the production adapter's 1.18.28 live completion and cancellation passed. An earlier isolated probe process was later found still running after its parent harness had ended, invalidating that probe's cleanup claim and reinforcing the documented absence of whole-harness process containment. The production live run awaited cleanup and a post-run process scan found no remaining server. Disconnect remains intentionally unrecoverable because SSE has no replay cursor; Claude interruption behavior remains unimplemented.
 - Cooperative terminality does not prevent external effects performed by worker tools before terminal response.
 - The Pi entry point follows the documented package manifest at `runtime/dist/src/pi-extension-entry.js` and registers `/autopilot-start`, `/autopilot-resume`, and `/autopilot-recover`; callers must load it through Pi's normal package or extension mechanism.

skills/autopilot/docs/2026-08-31-opencode-server-evaluation.md

@@ -1,6 +1,6 @@
 # OpenCode server execution evaluation
 
-- **Status:** Complete
+- **Status:** Implemented with controlled fault coverage and live production-adapter validation
 - **Decision:** GO for a controlled implementation of a distinct `opencode-server` backend
 - **Evidence baseline:** OpenCode 1.18.25, upstream tag `v1.18.25` at commit `cb7d8b2f5e44876ef98b661dc10590c915af3a9f`
 - **Scope:** Implementation execution only; independent review remains on the direct `opencode` CLI adapter
@@ -11,7 +11,7 @@ OpenCode 1.18.25 provides enough identity and lifecycle information for a same-h
 
 The implementation must remain separate from the current `opencode` charter value. It must not claim restart reattachment, replayable event delivery, operating-system process-tree quiescence, path sandboxing, or durable recovery after loss of the owning Autopilot process.
 
-This is not approval to reuse a global OpenCode server. Autopilot must start and stop one loopback server for each attempt.
+This is not approval to reuse a global OpenCode server. Autopilot must start one loopback server for each attempt and await direct-child cleanup on every path while the owning harness survives. Whole-harness loss remains unknown and can leave the process running because no OS containment is claimed.
 
 ## Constraints
 
@@ -138,9 +138,9 @@ A temporary home and temporary XDG data, config, cache, and state roots were use
 4. created and read a dedicated session with explicit deny-all permissions;
 5. deleted the session;
 6. disposed the directory instance; and
-7. stopped the server process.
+7. attempted to stop the server process.
 
-All OpenCode files created by this probe remained under the temporary root.
+The process was later found orphaned under PID 42930 after the probe's parent harness had ended and was removed manually. That invalidates the probe's process-cleanup claim, though not its HTTP/SSE protocol observations. It also confirms the stated boundary: whole-harness loss does not provide process containment or descendant quiescence. All OpenCode files created by this probe remained under the temporary root.
 
 ### Version-pinned live probe
 
@@ -165,9 +165,15 @@ Cancellation produced:
 
 The tracked repository tree remained clean. The digest of files under `~/.config/opencode` was unchanged. These probes establish the normal same-process path; they do not establish restart recovery or descendant quiescence.
 
+### Production adapter validation
+
+The implemented adapter was then exercised with auto-update disabled against installed OpenCode 1.18.28 in a disposable local Git repository. A completion attempt created only the requested untracked `result.txt` containing `validation`, returned an exact completed observation, and left tracked files unchanged. A second attempt ran a long shell command; cancellation returned accepted only after fresh reconciliation produced the exact assistant `MessageAbortedError` and exit code 130.
+
+The adapter reported `opencode-server@1.18.28`, `same-harness-instance` continuity, cooperative terminality, single-shot admission, and no restart reattachment. The digest under `~/.config/opencode` was unchanged. Awaited cleanup completed, and a post-run process scan found no OpenCode server. This validates normal live cleanup while the owning harness survives; it does not supersede the whole-harness-loss limitation demonstrated by the orphaned earlier probe.
+
 ## Required backend contract
 
-A future implementation should advertise:
+The controlled implementation advertises:
 
 ```json
 {
@@ -185,7 +191,7 @@ The direct `opencode` backend remains unchanged. It retains POSIX process-superv
 
 ## Implementation acceptance criteria
 
-Production promotion requires controlled tests for:
+Production promotion used controlled tests for:
 
 - exact loopback server startup, Basic Auth, health version, and worktree routing;
 - durable admission intent followed by one session and one caller-selected message ID;

skills/autopilot/docs/README.md

@@ -40,4 +40,4 @@ Both figures use the vendored Diagram Design default profile. The PNG exports ar
 
 ## Verification status
 
-The runtime has 205 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, POSIX descendant process cancellation, native-free package inventory, Codex app-server continuity contracts, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository. Codex app-server 0.151.0 live completion and interruption passed on one uninterrupted stdio connection without changing the tested Codex config digest; its connection-loss behavior has controlled fault coverage. Disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `glab` 1.115.0.
+The runtime has 234 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, POSIX descendant process cancellation, native-free package inventory, Codex app-server and OpenCode server continuity contracts, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository. Codex app-server 0.151.0 live completion and interruption passed on one uninterrupted stdio connection without changing the tested Codex config digest; its connection-loss behavior has controlled fault coverage. OpenCode server live completion and exact aborted-message cancellation passed with 1.18.28 without changing the OpenCode config digest or leaving a server process after normal cleanup; whole-harness loss remains intentionally uncontained and unknown. Disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `glab` 1.115.0.

skills/autopilot/docs/architecture.md

@@ -136,7 +136,7 @@ interface RunCharter {
     readonly baseCommit: string;
     readonly writableRoots: readonly string[];
   };
-  readonly harnessAdapter: "pi" | "claude-code" | "codex" | "codex-app-server" | "opencode";
+  readonly harnessAdapter: "pi" | "claude-code" | "codex" | "codex-app-server" | "opencode" | "opencode-server";
   readonly mode: "single" | "independent-queue" | "ordered-stack";
   readonly work: readonly WorkItem[];
   readonly delivery: "local-commits" | "change-request-ready" | "merge-verified";
@@ -310,7 +310,7 @@ Capability degradation is explicit:
 - Missing or incomplete attempt-supervisor evidence fails closed as `EXECUTION_STATE_UNKNOWN`; the runtime never spends another attempt on a speculative replacement.
 - Missing a required delivery or enforcement capability stops before edits.
 
-The first adapters target Claude Code, Codex, Pi, and OpenCode. They share one conformance suite. The `codex` and `codex-app-server` charter values are distinct execution modes: direct Codex CLI retains runtime-owned POSIX supervision, while app-server implementation turns use harness-owned same-instance cooperative terminality.
+The first adapters target Claude Code, Codex, Pi, and OpenCode. They share one conformance suite. The `codex`/`codex-app-server` and `opencode`/`opencode-server` charter pairs are distinct execution modes: direct CLIs retain runtime-owned POSIX supervision, while server-backed implementation attempts use harness-owned same-instance cooperative terminality. OpenCode server terminality additionally requires an uninterrupted non-replayable SSE stream and fresh exact-message REST reconciliation.
 
 The Codex app-server adapter starts one per-attempt stdio server with its process working directory set to the dedicated worktree. After `initialize`, it creates an ephemeral workspace-write thread with unattended approvals and deliberately omits the `cwd` request field, avoiding Codex's persistent project-trust update while still verifying the returned working directory. It journals an exact subject derived from the app-server instance nonce, thread ID, and turn ID. Only the matching `turn/completed` notification on the same connection is terminal; interruption must finish that turn as `interrupted`. Server requests are denied. The stdio connection cannot be reattached, while reconnectable Codex transports remain experimental or require separately managed daemon state, so any coordinator, connection, or server loss is `EXECUTION_STATE_UNKNOWN`. Independent review remains on the direct read-only Codex CLI adapter.
 

skills/autopilot/docs/getting-started.md

@@ -40,6 +40,8 @@ For the Pi process-local backend, load the packaged runtime extension through Pi
 
 For Codex, choose the charter adapter deliberately. `codex-app-server` runs one exact ephemeral thread and turn over a per-attempt stdio app-server connection; losing that coordinator, connection, or server makes the attempt unknown. `codex` keeps the direct CLI boundary, including POSIX process-supervised restart reattachment. The app-server mode never bootstraps a daemon or changes Codex authentication. It starts the server in the worktree and omits explicit thread `cwd` so Codex does not persist project trust.
 
+For OpenCode, `opencode-server` starts one authenticated `--pure` loopback server and dedicated session for each implementation attempt. It requires one uninterrupted event stream and fresh reconciliation of the exact caller-selected message and terminal assistant. Stream or identity loss makes the attempt unknown; OpenCode events and abort acknowledgments alone never prove terminality. `opencode` preserves the distinct direct CLI mode, and independent review remains direct in both cases. Autopilot never reuses or bootstraps a shared OpenCode server.
+
 ## Understand the run
 
 A run uses one of three graph modes: