Test 575 — OpenCode TUI network reply ownership and message ordering
Date: 2026-08-03 Asia/Shanghai
Status: PASS (isolated candidate; not deployed/published)

Candidate
---------
Worktree: /tmp/commniu-opencode-correlate
Branch: fix/opencode-correlated-network-reply
Base: 849a851949e8a72ba857c737849771421516c852
Source head: 925a2a5e220d1a3c06c51d44fab255d5d31ae05a
Fixed Docker tags: anet-tui-audit-opencode:dev, anet-test227:dev
Focused image ENV:
TEST575_SOURCE_COMMIT=925a2a5e220d1a3c06c51d44fab255d5d31ae05a

Findings and fixes
------------------
1. Reply ownership race
   The bridge checked that the shared session was idle and then submitted a
   network turn. OpenCode 1.18.1 has no atomic human/network claim, so a human
   TUI turn can win that interval. The old bridge accepted whichever assistant
   response the POST returned. The candidate gives each network turn a unique
   message ID and accepts only an assistant whose parentID is that exact ID.
   Any human-owned or uncorrelated response fails closed.

2. Chronological message-ID invariant
   The first version of the ownership fix used msg_anet_<random>. Real
   OpenCode 1.18.1 accepted and persisted that ID, but its prompt loop compares
   message IDs lexicographically to determine whether a user turn has already
   been answered. On a later sequential POST, msg_anet_* sorted incorrectly;
   OpenCode returned the preceding assistant response and left the new user
   turn unanswered. The ownership guard prevented a wrong CommHub reply, but
   normal sequential work failed.

   The final candidate generates the exact OpenCode 1.18.1 ascending ID shape:
   msg_ + 12 lowercase hex timestamp/counter characters + 14 base62 entropy
   characters. This preserves OpenCode's chronological ordering while retaining
   exact parentID correlation.

Witnessed red / green
---------------------
1. Before the ownership guard, a fake OpenCode server returned an assistant
   parented by msg_human_race. The bridge resolved it; the rejection test failed.
2. With the initial msg_anet_* guard, the real OpenCode 1.18.1 Docker harness
   failed (rc=1): the next user message was persisted without an assistant and
   POST returned the previous assistant parentID. A --network none attempt was
   rejected as invalid evidence because the harness uses OpenCode's free model.
3. Final focused Docker gate passed (rc=0) on source head 925a2a5e.
4. Mutation drop-reply-ownership produced rc=1 at the human-race assertion.
5. Mutation use-unordered-message-id restored msg_anet_* and produced rc=1 at
   the second sequential network-turn assertion. Both mutations changed the
   intended production gate and left test code unchanged.

Docker verification
-------------------
- Focused test575: PASS for the human race and sequential ordering cases.
- Full non-ACP OpenCode unit set: 27 pass, 0 fail, 103 assertions across four
  files; production bundle: 238 modules, cli.js 0.95 MB.
- Real test227 with opencode-ai 1.18.1: OVERALL PASS (rc=0).
  Layer 0: 34 tests pass across runtime, inbox wiring, drain lanes,
  single-flight, and CLI wiring. Live layers verified authenticated CommHub MCP
  outbound, official attach TUI rendering, informational toast isolation,
  three sequential network submissions, shared-turn visibility, and lifecycle.
  All 19 harness checks were true.

Safety
------
All test execution was isolated in Docker. No global npm package, existing node
process, token, Hub state, remote branch, merge, publish, or deployment was
changed. The live opencode-指挥狗, 指挥狗, and TM副责人 processes were not restarted
or pointed at this candidate.
