M0: canonical-opencode migration manifest + feasibility gates (sst → anomalyco alias fix)

[aarontrowbridge]

Part of #451 (not closing — this is M0 only).

What's here

The M0 deliverable: docs/migration-canonical-opencode.md — the migration manifest with all five feasibility gates answered with live evidence against stock canonical v1.18.19 (downloaded from the public release, sha256-verified against the GitHub API digest, booted in an isolated HOME):

Gate	Verdict
(a) plugin custom routes	Not supported → extension-host HTTP service confirmed as the M1 target
(b) per-boot route auth	Native — OPENCODE_SERVER_PASSWORD enforced (401 without / 200 with Basic)
(c) release digests	GitHub API digest field, sha256 verified byte-exact on download
(d) iframe origins	CSP frame-src widening at deck_panel.ts; per-pane origin tracking noted for M1
(e) adopt-gate signals	--version, boot line + authed /doc 200, and the plugin-load stamp all work on stock canonical

Plus: the full 31-route × consumer inventory (one mount file: fork httpapi/server.ts), the app-surface extraction list (packages/ui/src/amicode/*), the frozen e2e quarantine list, and an honest spec amendment — the amicode_context.ts refs are live WIP (the chat.system.transform hook exists upstream), not dead code, so nothing was removed.

The touch-up: stale sst/opencode (pre-rename alias) → anomalyco/opencode in the vendoring script defaults (fetch_opencode.mjs, opencode_dev.mjs), the test pinning those defaults, both READMEs, and the report-a-bug upstream check.

Verification

• pnpm vitest run test/fetch_opencode.test.ts test/opencode_dev.test.ts — 26/26 pass
• The live probe transcript (boot + curl 401/200 + plugin stamp) is summarized in the manifest §1

Not touched

Aaron's uncommitted WIP (src/extension.ts, src/opencode_config.ts, AGENTS.md, amico-slack skill) — deliberately left out of this branch's commit.

Summary by CodeRabbit

• Documentation

  • Updated repository links and attribution to reflect the canonical OpenCode repository.
  • Added migration documentation covering the transition, compatibility checks, and remaining implementation items.

• Improvements

  • Release downloads and development tooling now default to the canonical repository.
  • Bug-report guidance now checks the canonical upstream issue tracker.
  • Private mirror configurations remain supported.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: cdfa4225-e3d2-4c02-b32b-c120e801f33a

📥 Commits

Reviewing files that changed from the base of the PR and between 86712d7 and 974a1f4.

📒 Files selected for processing (7)

• README.md
• docs/migration-canonical-opencode.md
• packages/extension/README.md
• packages/extension/scripts/fetch_opencode.mjs
• packages/extension/scripts/opencode_dev.mjs
• packages/extension/skills/report-a-bug/SKILL.md
• packages/extension/test/fetch_opencode.test.ts

---

📝 Walkthrough

Walkthrough

The PR documents the migration to canonical anomalyco/opencode and updates repository defaults, release tests, documentation links, vendored-engine checks, and migration tracking details.

Changes

Canonical opencode migration

Layer / File(s)	Summary
Migration manifest docs/migration-canonical-opencode.md	The manifest records feasibility results, route and consumer mappings, app-surface extraction details, quarantined tests, WIP status, stale alias updates, and open M1 items.
Release coordinate defaults packages/extension/scripts/fetch_opencode.mjs, packages/extension/scripts/opencode_dev.mjs, packages/extension/test/fetch_opencode.test.ts	Release resolution and development pinning default to anomalyco/opencode. Tests expect the updated repository and release asset URL.
Repository references and reporting README.md, packages/extension/README.md, packages/extension/skills/report-a-bug/SKILL.md	Documentation links, vendored attribution, and upstream issue checks now reference anomalyco/opencode.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: jack-champagne

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 451-prd-ship-canonical-opencode-with-amicode-retire-the-fork-built-binary-from-user-machines

---

_{Comment @coderabbitai help to get the list of available commands.}