Record OpenCode host decision-honoring evidence for #92

[carloshvp]

What changed

Add a host-level dogfooding report for OpenCode 1.18.30 against the ACS reference Guardian and pinned AGT policy engine. The report includes three evidence captures and an opt-in reproduction fixture for live ALLOW/DENY decisions and established-session Guardian loss under both negotiated failure postures.

The real host executes or rejects harmless marker commands. A local scripted model supplies those commands; the Guardian and policy engine remain unchanged. The captures agree with the specification for this slice, without establishing full ACS-Core conformance.

Which issue does this implement

Contributes to #92, which is labeled status:accepted and help wanted. This leaves #92 open for further dogfooding reports.

Base branch

• integration, because this touches reference-implementation documentation and a manual reproduction fixture

Type of change

• Documentation
• Tooling or CI (opt-in local tooling only)

I tested this

• Synced with integration; tested implementation head 7d2dd3c69f82ec7565eef49b1609906deba1ef6b
• uv run pytest -v: 278 passed, 1 skipped
• uv run mkdocs build --strict: passed
• Bun 1.3.11: bun test: 1,110 passed, 1 skipped; bun run typecheck: passed
• bun run verify:pin: 5 passed, including upstream Rego byte identity
• All three manual OpenCode scenarios passed, checking tool outcomes, marker contents, wire decisions, session continuity, and failure-audit fields
• The exact denied command creates its marker in a separate ungoverned control directory
• Removing the ACS plugin lets both shell calls complete but makes the fixture fail on missing Guardian evidence
• git diff --check: passed

The Python skip requires a case-sensitive filesystem. The Bun suite's skipped pin test requires UPSTREAM_BUNDLE; verify:pin supplied the upstream bundle and passed that check separately. The manual host fixture is outside CI because it requires an installed OpenCode host.

Checklist

• Commits carry a human Signed-off-by line via git commit -s
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

The fixture uses a scratch directory, loopback servers, a local scripted model, and harmless file markers. It stops only the Guardian process it starts. It does not change production behavior or report a new vulnerability. The report retains the reference implementation's documented authentication and conformance limits; its local logs are not independent attestation.