fix(opencode): execute repository asyncio tests in coverage sandbox

[seonghobae]

Root cause

The trusted OpenCode coverage image installs the repository's production lock plus the central review toolchain, but the central toolchain omits pytest-asyncio. Repositories that correctly configure asyncio_mode and mark coroutine tests therefore collect normally and then fail every async test with async def functions are not natively supported, while pytest also reports Unknown config option: asyncio_mode.

This is infrastructure evidence, not a product-code regression. It currently blocks exact-head review evidence in downstream repositories including ContextualWisdomLab/pg-erd-cloud.

Test-first state

Commit fc43514b2ac9bfb15d7a85aaeb2fbfd5c77f7166 adds a failing contract that requires:

• pytest-asyncio==1.4.0 in the trusted review requirements;
• the same version in the generated hash lock; and
• an explicit pytest_asyncio import in the offline toolchain smoke check.

Minimal implementation contract

• add the current stable Python 3.14-compatible pytest-asyncio release;
• regenerate requirements-opencode-review-ci-hashes.txt only through scripts/ci/compile_opencode_review_lock.sh;
• extend the trusted offline import smoke check;
• retain the networkless, non-root PR execution boundary and all existing hash, source, and artifact validation;
• add no mutable installer or consumer-selected dependency resolution;
• rerun the central quality/security gates and a downstream async repository dispatch on the exact final head.

Authoritative evidence

PyPI identifies pytest-asyncio 1.4.0 as the current stable release (May 26, 2026), supports Python 3.10–3.14, and publishes Trusted Publishing provenance. The tagged project metadata requires pytest>=8.4,<10, which is compatible with the pinned central pytest==9.1.1.

No downstream branch-protection gate should be bypassed while this infrastructure correction is pending.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d3d0f6e7-d62f-4893-bd0b-9761c54d4c3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please implement the failing test-first contract on this branch: add pytest-asyncio==1.4.0, regenerate requirements-opencode-review-ci-hashes.txt only with scripts/ci/compile_opencode_review_lock.sh, add pytest_asyncio to the trusted offline import smoke check, run focused and complete quality gates, and keep the change bounded to the central trusted coverage toolchain. Do not weaken hash locking, sandbox isolation, or downstream required checks.

[seonghobae]

@opencode-agent address

Complete the test-first asyncio coverage-toolchain repair on the current protected base. Exact PR head is fc43514b2ac9bfb15d7a85aaeb2fbfd5c77f7166; protected main is 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. The only current PR change is fail-first tests/test_opencode_asyncio_toolchain_contract.py blob 4b35ee94f29a801fb1561b40bf2a78ae1bf2590a. requirements-opencode-review-ci.txt is still blob 0b585231f67de35a2172da3b21272788bd631bf6 on both this head and protected main, and .github/workflows/opencode-review-dispatch.yml is still 83f6830d5c21a324b4dbcd4e5c21a07968994b81. Do not write if any head/base/target identity moves.

First normally merge exact protected main into the existing branch without rewriting history. Then implement only the permanent toolchain requirement already captured by the RED contract:

1. Add exact pytest-asyncio==1.4.0 to requirements-opencode-review-ci.txt alongside the existing pytest toolchain. Current PyPI release metadata (May 26, 2026) identifies 1.4.0 as stable, Python >=3.10 with Python 3.14 classifier support, and Trusted Publishing provenance; do not broaden it to an unpinned range.
2. Regenerate requirements-opencode-review-ci-hashes.txt only via the repository-authoritative scripts/ci/compile_opencode_review_lock.sh; do not hand-edit hashes or resolve from pull-request-controlled metadata.
3. Extend the existing trusted offline toolchain smoke import in .github/workflows/opencode-review-dispatch.yml to import pytest_asyncio together with coverage/interrogate/pytest/pytest_cov before the networkless/non-root PR test execution.
4. Add the minimal changelog/doctoring trace needed to record the infrastructure boundary and primary release metadata if not already present. Do not claim that adding the plugin makes arbitrary async frameworks supported; it only supplies pytest's asyncio plugin for repositories that declare/use it.

Preserve the digest-pinned trusted image, exact base-owned lock materialization, hash verification, networkless/non-root PR execution, source/archive bounds, credential isolation, reviewer identities, model routing, and branch protection. Do not add mutable installers, consumer-selected dependency resolution, COPILOT_GITHUB_TOKEN, temporary/self-modifying/write-capable workflows, or bypasses.

Run the fail-first asyncio toolchain contract, lock-compiler/hash-lock consistency contracts, offline import smoke, complete central suite and Strix quick gate, Python 3.10/3.14 compatibility, exact 100% production statement/branch/public-docstring gates, then all exact-head security/supply-chain checks. Keep Draft until current-head automated and qualifying independent review are clean; do not merge or synthesize approval.

[seonghobae]

/oc Refetch the live PR and abort without writing unless exact head is still fc43514b2ac9bfb15d7a85aaeb2fbfd5c77f7166. This branch is test-only and is based on an old protected-main generation; use its RED contract as historical ordering evidence, not as a merge candidate. The missing runtime dependency is still real: as of 2026-08-09 the official PyPI/GitHub release is pytest-asyncio==1.4.0, published 2026-05-26, requiring Python >=3.10 with Python 3.14 support.

First reconcile the latest protected main into this existing branch by ordinary non-force ancestry only. If current-main already contains an equivalent fix, close this PR as superseded after exact proof. Otherwise implement the smallest permanent correction on the reconciled branch:

1. Add exact pytest-asyncio==1.4.0 to the trusted OpenCode review tooling source manifest.
2. Regenerate requirements-opencode-review-ci-hashes.txt only through the repository's reviewed lock compiler; do not hand-edit hashes or introduce a mutable installer.
3. Extend the trusted offline Python toolchain smoke to import pytest_asyncio explicitly.
4. Preserve networkless/non-root PR execution, immutable source/materialization, hash verification, no PR-selected builds, credential isolation, reviewer identities, model routing, and branch protection.
5. Keep this an infrastructure correction: async-plugin absence may block merge readiness, but must not be published as an invented source-code defect.

Verify test-first after reconciliation: the permanent plugin contract, Python 3.10 and 3.14 compatibility, the complete central suite, 100% owned production statement/branch coverage and public docstrings, compileall, lock reproducibility, Strix quick gate, and git diff --check. Then run a real protected-main or exact trusted-dispatch canary against an async-test consumer such as ContextualWisdomLab/pg-erd-cloud before declaring the operational incident closed. Do not create a one-shot writer workflow, use COPILOT_GITHUB_TOKEN, force-push, weaken coverage, merge, or mark Ready until exact-head gates are regenerated.