[Hyperkid123]

Description

REHOR-199

Restore operational environment required by OpenCode Bash tools and canonical helpers. REHOR-193 transcripts showed gh calls falling back to a nonexistent Unix executor socket and claim helpers reporting missing bot email despite both settings being present in the pod.

• Automatically forward 12 explicitly approved operational names: EXECUTOR_ADDR, BOT_JIRA_EMAIL, BOT_INSTANCE_ID, BOT_MEMORY_URL, GH_USER_NAME, GL_USER_NAME, BOT_CONFIG_PATH, SLACK_NOTIFY_MODE, GH_RELEASE_UPLOAD_URL, BOT_BOARD_ID, BOT_BOARD_NAME, and SLACK_WEBHOOK_URL when present.
• Keep absent values absent, provider passthrough opt-in separate, and unrelated ambient variables/secrets/runner-controlled settings excluded. SLACK_WEBHOOK_URL is an intentional configured-credential exception preserving the existing agent → helper → MCP notification contract. Missing or empty webhook retains optional no-op behavior.
• Add unit, actual spawned-server, and opt-in native root/child regression coverage.
• Document environment contract and image/submodule/fresh-Sandbox rollout.

Blast radius

Shared OpenCode child environment used by onboarding and other native consumers. Production change is limited to 12 explicit operational names; no broad BOT_/EXECUTOR_ prefix forwarding.

Verification:

• Coordinator suite: 506 passed, 7 skipped; typecheck/build passed.
• Explicit pinned OpenCode 1.18.29 native regression: 1 passed. Real supervisor, root and native child Bash/Python helpers retained all 12 synthetic operational values; real Go executor thin client completed two localhost gRPC calls using configured address.
• Canonical Slack helper argument capture verifies configured webhook/message/mode reach the MCP tool; mocked Slack backend tests passed. Unrelated blocked-secret absence and provider isolation verified; no paid inference or real Jira/memory mutations.
• Scoped Biome, strict MkDocs and diff checks passed; independent review found no issues.

Live service connectivity and deployment remain rollout checks. Onboarding must pin the merged runner commit, rebuild an immutable image and obtain a fresh Sandbox. Existing template values need no YAML change.

Rollback plan

Revert this commit, rebuild affected runner images and restore the previous immutable image reference/pin. No database migration or API change.

Checklist

• Tested against at least one consuming repo/service (native root/child helper and real executor-client fixtures)
• No breaking changes to existing consumers (or migration path documented)
• No hardcoded secrets, tokens, or passwords
• Container images pinned to specific tags, not latest (image references unchanged)

AI disclosure

Assisted by: OpenCode (OpenAI).

[petrsimon]

The change itself is correct and nicely scoped: exact-name list, absent stays absent, base isn't mutated, and runner-owned settings still win. Main concern is coverage: the same bug class remains for other non-secret variables the helpers read (see inline comment on the allowlist). The rest are nits.