experiment: construct TRUST-001 stock OpenCode candidate

.github/workflows/trust001-preflight.yml

@@ -0,0 +1,77 @@
+name: TRUST-001 provider-free preflight
+
+on:
+  pull_request:
+    paths:
+      - "Containerfile"
+      - "runner/trust001/**"
+      - "container/trust001/**"
+      - "trust001/**"
+      - "tests/test_trust001_*.py"
+      - "tests/trust001/**"
+      - ".github/workflows/trust001-preflight.yml"
+      - "docs/experiments/trust-001/checkpoints/**"
+
+concurrency:
+  group: trust001-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  unit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Verify forbidden OpenCode patch tree absent
+        run: |
+          test ! -e runtime-patches
+          test ! -e opencode-patches
+
+      - name: Compile TRUST-001 Python
+        run: |
+          python3 -m py_compile runner/trust001/*.py
+
+      - name: Run provider-free TRUST-001 unit tests
+        run: |
+          python3 -m unittest discover -s tests -p 'test_trust001_*.py'
+
+      - name: Check dependency-free bridge scripts
+        run: |
+          node --check trust001/bridge.mjs
+          node --check trust001/isolated-host.mjs
+          node --check trust001/synthetic-loom-peer.mjs
+          node --check trust001/synthetic-remote-plugin.mjs
+          python3 -m py_compile tests/trust001/run_stock_bridge_preflight.py
+          python3 -m py_compile tests/trust001/run_remote_context_preflight.py
+
+  stock-opencode:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Build stock OpenCode candidate image
+        run: |
+          docker build             -f Containerfile             --target opencode             --build-arg OPENCODE_VERSION=2.0.23             -t trust001-stock-opencode:preflight             .
+
+      - name: Verify exact stock version and labels
+        run: |
+          test "$(docker run --rm --entrypoint opencode trust001-stock-opencode:preflight --version)" = "opencode v2.0.23"
+          test "$(docker image inspect trust001-stock-opencode:preflight --format '{{ index .Config.Labels "io.opencode-eval.stock-opencode-version" }}')" = "2.0.23"
+          test "$(docker image inspect trust001-stock-opencode:preflight --format '{{ index .Config.Labels "io.opencode-eval.stock-opencode-package" }}')" = "@opencode/cli"
+
+      - name: Exercise stock bridge handshake without inference
+        run: |
+          python3 tests/trust001/run_stock_bridge_preflight.py \
+            --image trust001-stock-opencode:preflight
+
+      - name: Exercise bounded remote context without inference
+        run: |
+          python3 tests/trust001/run_remote_context_preflight.py \
+            --image trust001-stock-opencode:preflight
+
+      - name: Record provider-free image identity
+        run: |
+          docker image inspect trust001-stock-opencode:preflight             --format 'image={{.Id}} config={{.Config.Image}} version={{ index .Config.Labels "io.opencode-eval.stock-opencode-version" }}'

Containerfile

@@ -1,5 +1,5 @@
 FROM node:24-bookworm-slim@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 AS opencode-builder
-ARG OPENCODE_VERSION=2.0.18
+ARG OPENCODE_VERSION=2.0.23
 RUN npm install --global "@opencode/cli@${OPENCODE_VERSION}" \
     && resolved="$(readlink -f "$(command -v opencode)")" \
     && test -x "$resolved" \
@@ -53,8 +53,11 @@ ENTRYPOINT ["python3", "/opt/opencode-eval-runner/container/invoke.py"]
 USER 1000:1000
 
 FROM runtime-base AS opencode
+ARG OPENCODE_VERSION=2.0.23
+LABEL io.opencode-eval.stock-opencode-version="${OPENCODE_VERSION}" \
+      io.opencode-eval.stock-opencode-package="@opencode/cli"
 COPY --from=opencode-builder /opencode /usr/local/bin/opencode
-RUN opencode --version
+RUN test "$(opencode --version)" = "opencode v${OPENCODE_VERSION}"
 
 FROM runtime-base AS copilot
 COPY --from=copilot-builder /opt/copilot/bin/copilot /usr/local/bin/copilot