[snarkipus]

Summary

• Add an independent daily/manual OpenCode V2+ stable-release and exact-SDK check to the existing Beads watcher. Legacy 1.x/component/draft/prerelease tags are excluded; new stable releases require deliberate review even if SDK checks pass.
• Keep SDK pins, host admission, plugin runtime and packaged guidance unchanged. No package release or consumer upgrade.
• Add failure-only Discord notifications for ci and beads-contract using trusted workflow metadata, no checkout/artifacts, no GitHub permissions, no mentions, bounded secret-safe transport and no retries.
• Incorporate Claude Opus 5.5 findings and additional monitor regressions. Same-session corrected source verdict: READY.

Verification

• Local full suite: 231 tests / 12,300 assertions pass; typecheck, package smoke, actionlint and strict canonical specs pass.
• Pinned zizmor 1.29.0 passes; workflow_run trigger has a documented line-scoped metadata-only exception.
• Actual monitor shell exercised against GitHub and published 2.2.7 SDK. Hosted Linux, Windows and zizmor checks passed at the exact final head. The hosted maintenance workflow also passed all three jobs, including default OpenCode discovery via GitHub Actions token and published SDK checks. Six literal Ubuntu-workflow fixtures are scoped to Linux after an observed Windows shell-harness failure; product Windows and portable notifier coverage remain enabled.

Operator setup / limits

• Create an incoming Discord webhook for the intended channel and save its standard URL directly as repository Actions secret DISCORD_CI_WEBHOOK_URL. The repo does not currently have that secret. Never paste the value in an issue, PR, source or chat.
• No Discord send or first-delivery claim is made. Missing configuration is reported as notifier failure. Successful CI runs do not post.
• Tracker: opencode-beads-pan; independent review opencode-beads-zqo.