fix(strix): fail closed on incomplete provider evidence - #965
fix(strix): fail closed on incomplete provider evidence#965seonghobae wants to merge 30 commits into
Conversation
📝 WalkthroughWalkthroughStrix 실행은 동일한 PR head SHA와 구조화된 evidence binding을 검증합니다. 불완전한 결과와 provider 오류는 fail-closed로 실패 처리됩니다. OpenCode 승인은 검증된 default-branch repository_dispatch 증거가 없으면 보류됩니다. Requirements 입력과 프로세스 정리 규칙도 강화되었습니다. ChangesStrix 증거 검증 및 리뷰 게이트
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟠 High · up to Although the PR makes incomplete Strix evidence fail closed, the current workflow can still accept a success status not proven to belong to the exact trusted run, leave terminated model attempts running, and expose operational PII in uploaded artifacts. These issues could allow incomplete evidence to appear successful or cause runtime and data-handling problems, so merge should wait for fixes. Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant OpenCodeReviewDispatch
participant StrixWorkflow
participant RepositoryDispatch
participant EvidenceArtifacts
PullRequest->>OpenCodeReviewDispatch: request approval
OpenCodeReviewDispatch->>StrixWorkflow: evaluate Strix workflow changes
StrixWorkflow->>EvidenceArtifacts: validate same-head report provenance
StrixWorkflow->>RepositoryDispatch: publish structured evidence status
RepositoryDispatch-->>OpenCodeReviewDispatch: return status and Actions run URL
OpenCodeReviewDispatch-->>PullRequest: approve or wait for post-merge evidence
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Remediation pushed at exact head
This is evidence only, not an approval. Please review this exact head and rerun all required checks. |
|
@opencode-agent @coderabbitai Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='5215dc98ee36a30985d4f1f3477781cd05f172c5'
printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
git status --short
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD
printf '%s\n' '== PR metadata =='
gh pr view 965 --repo ContextualWisdomLab/.github \
--json number,title,state,headRefName,headRefOid,baseRefName,author,mergeable,reviewDecision,url
printf '%s\n' '== Requested commit exists locally =='
git cat-file -e "${expected}^{commit}"
git merge-base --is-ancestor "$expected" HEAD && echo 'requested_commit_is_ancestor_of_HEAD=true' || true
test "$(git rev-parse HEAD)" = "$expected" && echo 'HEAD_matches_requested_commit=true' || echo 'HEAD_matches_requested_commit=false'
printf '%s\n' '== Changed files and patch stat vs first parent =='
git diff --stat HEAD^ HEAD
git diff --name-status HEAD^ HEAD
git diff --check HEAD^ HEAD
printf '%s\n' '== Changed workflow and Strix-related hunks =='
git diff --unified=80 HEAD^ HEAD -- \
'.github/workflows/**' \
'scripts/**' \
'*strix*' \
':!**/.git/**'
printf '%s\n' '== Candidate file map =='
fd -HI -t f -i 'strix|workflow|actionlint|test' . | sed -n '1,240p'
printf '%s\n' '== Relevant identifiers and contracts =='
rg -n -C 5 -i \
'strix_quick_gate\.sh|quick.?gate|provider|fail.closed|neutraliz|NVIDIA NIM|GitHub Models|platform\.system|platform\.machine' \
.github scripts tests 2>/dev/null || true
printf '%s\n' '== Current-head check runs =='
gh api "repos/ContextualWisdomLab/.github/commits/${expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url,.started_at,.completed_at] | `@tsv`' || true
printf '%s\n' '== PR reviews and unresolved review threads =='
gh pr view 965 --repo ContextualWisdomLab/.github --json reviews \
--jq '.reviews[] | [.author.login,.state,.commit.oid,.submittedAt] | `@tsv`' || true
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=965 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
comments(first: 1) {
nodes { author { login } body path line originalLine }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | [.comments.nodes[0].author.login,.comments.nodes[0].path,(.comments.nodes[0].line // .comments.nodes[0].originalLine),.comments.nodes[0].body] | `@tsv`' || trueLength of output: 203009 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='5215dc98ee36a30985d4f1f3477781cd05f172c5'
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD HEAD^)"
printf 'HEAD=%s\n' "$(git rev-parse HEAD)"
printf 'EXPECTED=%s\n' "$expected"
printf 'BASE=%s\n' "$base"
printf 'HEAD_MATCHES_EXPECTED=%s\n' "$([ "$(git rev-parse HEAD)" = "$expected" ] && echo true || echo false)"
printf '%s\n' '== PR head and state =='
gh pr view 965 --repo ContextualWisdomLab/.github \
--json headRefOid,state,mergeable,reviewDecision,url \
--jq '{headRefOid,state,mergeable,reviewDecision,url}'
printf '%s\n' '== Changed files against PR base =='
git diff --name-status "$base" HEAD
printf '%s\n' '== Narrow patch against PR base =='
git diff --unified=35 "$base" HEAD -- \
'.github/workflows/strix.yml' \
'.github/workflows/strix-quick.yml' \
'.github/workflows/**strix**' \
'scripts/ci/test_strix_quick_gate.sh' \
'scripts/ci/strix_quick_gate.sh'
printf '%s\n' '== Wrapper invocations and exit-code handling =='
for f in $(fd -HI -t f '.*' .github/workflows scripts/ci 2>/dev/null | xargs -r grep -lE 'strix_quick_gate\.sh' 2>/dev/null); do
echo "--- $f"
grep -n -C 16E 'strix_quick_gate\.sh|quick gate|quick-gate|gate_rc|exit [0-9]+' "$f"
done
printf '%s\n' '== Changed lines only, test and workflow =='
git diff --unified=3 "$base" HEAD -- '.github/workflows/**' 'scripts/ci/test_strix_quick_gate.sh' \
| grep -nE '^[+-].*(strix_quick_gate|provider|exit|return|Darwin|Linux|x86_64|platform)' || true
printf '%s\n' '== Current exact-head reviews and unresolved-thread count =='
gh pr view 965 --repo ContextualWisdomLab/.github --json reviews \
--jq --arg sha "$expected" '[.reviews[] | {author:.author.login,state,commit:(.commit.oid // ""),submittedAt} | select(.commit == $sha)]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=965 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 25739 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='5215dc98ee36a30985d4f1f3477781cd05f172c5'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Remaining changed-file patches =='
git diff --unified=50 "$base" "$expected" -- \
'tests/test_materialize_base_python_requirements.py' \
'tests/test_required_workflow_queue_contract.py' \
'tests/test_strix_nvidia_nim_not_found_fallback.py' \
'docs/doctoring/strix-provider-evidence-fail-closed.md'
printf '%s\n' '== Complete Strix workflow call-site context =='
grep -n -C 20 -E 'TRUSTED_STRIX_GATE|strix_quick_gate\.sh|strix_rc|Treating as a neutral skip|backend_unavailable_signal' \
.github/workflows/strix.yml
printf '%s\n' '== All workflow references to the trusted Strix gate =='
rg -n -C 12 'TRUSTED_STRIX_GATE|strix_quick_gate\.sh' .github/workflows
printf '%s\n' '== Targeted static contract checks =='
python3 - <<'PY'
from pathlib import Path
workflow = Path(".github/workflows/strix.yml").read_text()
required = [
'strix_rc="${PIPESTATUS[0]}"',
'if [ "$strix_rc" -ne 0 ]; then',
'exit "$strix_rc"',
]
for text in required:
print(f"required={text!r} present={text in workflow}")
for text in ("Treating as a neutral skip", "backend_unavailable_signal", "reported_vulnerability_signal"):
print(f"removed={text!r} absent={text not in workflow}")
PY
printf '%s\n' '== Exact-head reviews and unresolved threads =='
gh pr view 965 --repo ContextualWisdomLab/.github --json reviews \
--jq --arg sha "$expected" \
'[.reviews[] | {author:.author.login,state,commit:(.commit.oid // ""),submittedAt} | select(.commit == $sha)]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=965 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'
printf '%s\n' '== Current exact-head non-success check count =='
gh api "repos/ContextualWisdomLab/.github/commits/${expected}/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or .conclusion != "success")] | length'Length of output: 59180
No actionable findings from the source review. The Strix wrapper now captures I also applied the repository merge-evidence guidance. At review time, the PR was 🧠 Learnings usedYou are interacting with an AI system. |
CWE-754: a zero process exit is not complete evidence if the trusted gate printed fail-closed or incomplete-evidence text. The required check must stay red.
|
Exact-head update: Additional remediation now included:
Local evidence: focused Strix/dependency tests passed; central suite previously passed with 100% statement/branch coverage; the full shell quick-gate completed @opencode-agent @coderabbitai Please review this exact head independently. Any actionable finding must be fixed and reviewed again on the resulting head. This comment and check success are evidence requests, not approvals. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='520f639426e0c40d3c064ea3ab5af03de8592d06'
repo='ContextualWisdomLab/.github'
printf '%s\n' '== Exact commit and PR metadata =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git show -s --format='subject=%s%nparents=%P' "$expected"
gh pr view 965 --repo "$repo" \
--json state,headRefOid,baseRefOid,mergeable,reviewDecision,url \
--jq '{state,headRefOid,baseRefOid,mergeable,reviewDecision,url}'
git cat-file -e "${expected}^{commit}"
test "$(git rev-parse HEAD)" = "$expected" && echo 'head_matches_requested=true' || echo 'head_matches_requested=false'
base="$(gh pr view 965 --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf 'base=%s\n' "$base"
printf '%s\n' '== Complete changed-file list =='
git diff --name-status "$base" "$expected"
printf '%s\n' '== Focused patch =='
git diff --unified=50 "$base" "$expected" -- \
'.github/workflows/**' 'scripts/**' 'tests/**' '*requirements*.txt' '*strix*' \
| sed -n '1,2200p'
printf '%s\n' '== Candidate file map =='
fd -HI -t f . | rg -i '(strix|requirement|dependabot|workflow|test)' | sed -n '1,300p'
printf '%s\n' '== Relevant symbols and call sites =='
rg -n -C 10 -i \
'scan.start|scan_start|head.*sha|github_sha|report.*(sha|metadata)|process.group|setsid|kill.*-|aiohttp==|cryptography==|strix_quick_gate' \
.github scripts tests requirements* 2>/dev/null || true
printf '%s\n' '== Current exact-head checks =='
gh api "repos/${repo}/commits/${expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`' || true
printf '%s\n' '== Exact-head reviews and unresolved review threads =='
gh pr view 965 --repo "$repo" --json reviews \
--jq --arg sha "$expected" '[.reviews[] | {author:.author.login,state,commit:(.commit.oid // ""),submittedAt} | select(.commit == $sha)]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=965 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false)] | length'Length of output: 202840 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='520f639426e0c40d3c064ea3ab5af03de8592d06'
repo='ContextualWisdomLab/.github'
base="$(git merge-base "$expected" origin/main 2>/dev/null || git merge-base "$expected" "$expected^")"
printf 'checked_out=%s\nexpected=%s\nbase=%s\n' "$(git rev-parse HEAD)" "$expected" "$base"
gh pr view 965 --repo "$repo" --json headRefOid,state,mergeable,reviewDecision,url
printf '%s\n' '== Files changed by the exact-head remediation commit =='
git diff --name-status "${expected}^" "$expected"
printf '%s\n' '== PR files related to Strix and dependency locks =='
git diff --name-only "$base" "$expected" | rg -i '(^|/)(strix|requirements-strix|dependabot)|test_.*strix|strix.*test' || true
printf '%s\n' '== Remediation commit patch =='
git diff --unified=45 "${expected}^" "$expected" -- \
.github/workflows/strix.yml \
scripts/ci/strix_quick_gate.sh \
scripts/ci/test_strix_quick_gate.sh \
requirements-strix-ci.txt \
requirements-strix-ci-hashes.txt \
tests \
| sed -n '1,1800p'
printf '%s\n' '== Strix workflow and gate structure =='
ast-grep outline .github/workflows/strix.yml --items all 2>/dev/null | sed -n '1,260p' || true
ast-grep outline scripts/ci/strix_quick_gate.sh --items all 2>/dev/null | sed -n '1,260p' || true
printf '%s\n' '== Relevant final implementation sections =='
rg -n -C 18 \
'scan.*(sha|start)|report.*(sha|metadata)|metadata|setsid|process.group|kill -- -|kill -TERM -|PIPESTATUS|strix_rc|aiohttp==|cryptography==' \
.github/workflows/strix.yml scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh \
requirements-strix-ci.txt requirements-strix-ci-hashes.txt 2>/dev/null | sed -n '1,2200p' || true
printf '%s\n' '== Focused static contract checks =='
python3 - <<'PY'
from pathlib import Path
files = {
"workflow": Path(".github/workflows/strix.yml"),
"gate": Path("scripts/ci/strix_quick_gate.sh"),
"test": Path("scripts/ci/test_strix_quick_gate.sh"),
"requirements": Path("requirements-strix-ci.txt"),
"hashes": Path("requirements-strix-ci-hashes.txt"),
}
for name, path in files.items():
print(f"{name}: exists={path.exists()} size={path.stat().st_size if path.exists() else 0}")
if path.exists() and name in {"requirements", "hashes"}:
content = path.read_text()
for pin in ("aiohttp==3.14.3", "cryptography==50.0.0"):
print(f" {pin}={pin in content}")
PY
printf '%s\n' '== Exact-head reviews and unresolved threads =='
gh api "repos/${repo}/pulls/965/reviews?per_page=100" --paginate \
--jq --arg sha "$expected" '[.[] | select(.commit_id == $sha) | {user:.user.login,state,commit_id,submitted_at}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=965 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated path line } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)] | length'Length of output: 196779
High — scan-start SHA is not bound to the PR head In A different valid SHA therefore passes this check. If Reject the evidence unless these values match, case-insensitively: if [ "${scan_stage_head_sha,,}" != "${evidence_head_sha,,}" ]; then
echo "::error::Strix scan-start SHA does not match the exact PR head SHA."
exit 1
fiAdd a regression case for a valid but different 40-character scan-start SHA. I used the repository merge-evidence guidance. The PR is still 🧠 Learnings usedYou are interacting with an AI system. |
|
Remediation pushed at exact head |
|
Exact current head is |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='965'
expected='c7d8d234b7da55a5224ecfb3b295a74336b7b6e3'
printf '%s\n' '== Exact head and pull request metadata =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git cat-file -e "${expected}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$expected"
gh pr view "$pr" --repo "$repo" \
--json state,headRefOid,baseRefOid,mergeable,reviewDecision,url \
--jq '{state,headRefOid,baseRefOid,mergeable,reviewDecision,url}'
printf 'checked_out_matches_expected=%s\n' "$([ "$(git rev-parse HEAD)" = "$expected" ] && echo true || echo false)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf 'base=%s\n' "$base"
printf '%s\n' '== Changed files in requested remediation commit =='
git diff --name-status "${expected}^" "$expected"
printf '%s\n' '== Complete pull request file list =='
git diff --name-status "$base" "$expected"
printf '%s\n' '== Remediation patch and relevant pull request patch =='
git diff --unified=60 "${expected}^" "$expected" -- \
'.github/workflows/strix.yml' \
'scripts/ci/strix_quick_gate.sh' \
'scripts/ci/test_strix_quick_gate.sh' \
'scripts/ci/strix_required_workflow_smoke.sh' \
'tests/**' \
'*requirements*'
git diff --unified=25 "$base" "$expected" -- \
'.github/workflows/strix.yml' \
'scripts/ci/strix_quick_gate.sh' \
'scripts/ci/test_strix_quick_gate.sh' \
'scripts/ci/strix_required_workflow_smoke.sh' \
'tests/**' \
'*requirements*' | sed -n '1,2600p'
printf '%s\n' '== Candidate structure =='
fd -HI -t f . | rg -i '(^|/)(strix|requirement|dependabot|workflow|test)' | sed -n '1,360p'
printf '%s\n' '== Final implementation and test contract context =='
rg -n -C 18 -i \
'Nvidia_nimException|scan.stage.head.sha|scan_start|evidence_head_sha|candidate_head_sha|report.*metadata|PIPESTATUS|strix_rc|setsid|process.group|kill -- -|aiohttp==3\.14\.3|cryptography==50\.0\.0|fail.closed|neutral' \
.github/workflows scripts/ci tests requirements-strix-ci.txt requirements-strix-ci-hashes.txt 2>/dev/null \
| sed -n '1,3000p' || true
printf '%s\n' '== Static contract assertions =='
python3 - <<'PY'
from pathlib import Path
workflow_path = Path(".github/workflows/strix.yml")
smoke_paths = list(Path("scripts/ci").glob("*strix*smoke*.sh"))
workflow = workflow_path.read_text() if workflow_path.exists() else ""
print(f"workflow_exists={workflow_path.exists()}")
for token in (
'strix_rc="${PIPESTATUS[0]}"',
'if [ "$strix_rc" -ne 0 ]; then',
'exit "$strix_rc"',
'Nvidia_nimException',
'scan_stage_head_sha',
'evidence_head_sha',
):
print(f"workflow_contains_{token!r}={token in workflow}")
print("smoke_files=" + ",".join(map(str, smoke_paths)))
for path in smoke_paths:
text = path.read_text()
print(f"{path}: contains_provider_marker={'Nvidia_nimException' in text}")
PY
printf '%s\n' '== Exact-head checks =='
gh api "repos/${repo}/commits/${expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url,.started_at,.completed_at] | `@tsv`' || true
printf '%s\n' '== Exact-head reviews and unresolved current threads =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
--jq --arg sha "$expected" \
'[.[] | select(.commit_id == $sha) | {user:.user.login,state,commit_id,submitted_at}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line comments(first: 1) { nodes { author { login } body } } }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false) | {path,line,author:.comments.nodes[0].author.login,body:.comments.nodes[0].body}'Length of output: 204655 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr=965
expected='c7d8d234b7da55a5224ecfb3b295a74336b7b6e3'
printf '%s\n' '== Exact revision and pull request state =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git show -s --format='commit=%H%nsubject=%s' "$expected"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,state,mergeable,reviewDecision,url \
--jq '{headRefOid,state,mergeable,reviewDecision,url}'
printf '%s\n' '== Requested-commit patch only =='
git diff --unified=35 "${expected}^" "$expected" -- \
'.github/workflows/strix.yml' \
'scripts/ci/strix_required_workflow_smoke.sh' \
'scripts/ci/test_strix_quick_gate.sh' \
'tests/test_strix_nvidia_nim_not_found_fallback.py'
printf '%s\n' '== Scan-start provenance implementation =='
sed -n '900,970p' .github/workflows/strix.yml
printf '%s\n' '== Scan-start provenance tests and smoke assertions =='
rg -n -C 12 \
'scan_stage_head_sha|scan-head-sha|evidence_head_sha|candidate_head_sha|different.{0,40}SHA|mismatch|Nvidia_nimException' \
scripts/ci/strix_required_workflow_smoke.sh \
scripts/ci/test_strix_quick_gate.sh \
tests/test_strix_nvidia_nim_not_found_fallback.py \
tests 2>/dev/null | sed -n '1,1600p' || true
printf '%s\n' '== Equality-contract search =='
rg -n -P -C 4 \
'scan_stage_head_sha.*evidence_head_sha|evidence_head_sha.*scan_stage_head_sha' \
.github/workflows/strix.yml scripts/ci tests 2>/dev/null || true
printf '%s\n' '== Current exact-head reviews =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
--jq --arg sha "$expected" \
'[.[] | select(.commit_id == $sha) | {user:.user.login,state,commit_id,submitted_at}]'
printf '%s\n' '== Unresolved non-outdated thread count =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)] | length'
printf '%s\n' '== Current exact-head non-success checks =='
gh api "repos/${repo}/commits/${expected}/check-runs?per_page=100" \
--jq '[.check_runs[] | select(.status != "completed" or .conclusion != "success") | {name,status,conclusion}]'Length of output: 62775
I found one actionable issue. High — scan-stage SHA is still not bound to the exact PR head In The workflow does not compare Reject the evidence when the scan-stage SHA differs from the exact PR head: if [ "${scan_stage_head_sha,,}" != "${evidence_head_sha,,}" ]; then
echo "::error::Strix scan-start SHA does not match the exact PR head SHA."
exit 1
fiAdd a regression assertion that supplies a valid but different 40-character The smoke-contract remediation correctly restores I also used the repository merge-evidence guidance. The PR is 🧠 Learnings usedYou are interacting with an AI system. |
Treat fail-closed, fail closed, incomplete-evidence, and incomplete evidence the same as failing closed so a zero-exit log cannot become a green required check.
|
Remote exact head advanced to |
|
@opencode-agent @coderabbitai Exact current head is now |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='965'
expected='5489c5106123f150a3bd77cfb3759de7de4219b1'
printf '%s\n' '== Exact commit and PR state =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git cat-file -e "${expected}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$expected"
gh pr view "$pr" --repo "$repo" \
--json state,headRefOid,baseRefOid,mergeable,reviewDecision,url \
--jq '{state,headRefOid,baseRefOid,mergeable,reviewDecision,url}'
printf 'checked_out_matches_expected=%s\n' \
"$([ "$(git rev-parse HEAD)" = "$expected" ] && echo true || echo false)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'base=%s\n' "$base"
printf '%s\n' '== Requested remediation patch =='
git diff --unified=70 "${expected}^" "$expected" -- \
'.github/workflows/strix.yml' \
'scripts/ci/strix_required_workflow_smoke.sh' \
'scripts/ci/test_strix_quick_gate.sh' \
'scripts/ci/strix_quick_gate.sh' \
'tests/**'
printf '%s\n' '== Relevant complete PR patch =='
git diff --unified=30 "$base" "$expected" -- \
'.github/workflows/strix.yml' \
'scripts/ci/strix_required_workflow_smoke.sh' \
'scripts/ci/test_strix_quick_gate.sh' \
'scripts/ci/strix_quick_gate.sh' \
'tests/**' \
'*requirements*' | sed -n '1,3000p'
printf '%s\n' '== Final marker and provenance contexts =='
rg -n -i -C 24 \
'Nvidia[ _-]?nimException|fail.closed|neutral skip|scan_stage_head_sha|evidence_head_sha|candidate_head_sha|scan-head-sha|PIPESTATUS|strix_rc|process.group|setsid|kill -- -' \
.github/workflows/strix.yml \
scripts/ci/strix_required_workflow_smoke.sh \
scripts/ci/test_strix_quick_gate.sh \
scripts/ci/strix_quick_gate.sh 2>/dev/null | sed -n '1,3200p' || true
printf '%s\n' '== Static marker and equality contract checks =='
python3 - <<'PY'
from pathlib import Path
workflow = Path(".github/workflows/strix.yml").read_text()
smoke = Path("scripts/ci/strix_required_workflow_smoke.sh").read_text()
for name, text in {"workflow": workflow, "smoke": smoke}.items():
print(f"-- {name}")
for token in (
"Nvidia_nimException",
"Nvidia nimException",
"Nvidia-nimException",
'strix_rc="${PIPESTATUS[0]}"',
'exit "$strix_rc"',
"scan_stage_head_sha",
"evidence_head_sha",
):
print(f"{token!r}={token in text}")
PY
printf '%s\n' '== Exact-head check runs =='
gh api "repos/${repo}/commits/${expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`' || true
printf '%s\n' '== Exact-head reviews and unresolved current threads =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
--jq --arg sha "$expected" \
'[.[] | select(.commit_id == $sha) | {user:.user.login,state,commit_id,submitted_at}]'
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes { isResolved isOutdated path line comments(first: 1) { nodes { author { login } body } } }
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]'Length of output: 227571
I found one actionable issue. High — scan-stage SHA is not bound to the exact PR head In The workflow compares structured Reject evidence when these values differ, case-insensitively: if [ "${scan_stage_head_sha,,}" != "${evidence_head_sha,,}" ]; then
echo "::error::Strix scan-start SHA does not match the exact PR head SHA."
exit 1
fiAdd a regression case with a valid but different The hyphenated marker remediation is correct. The wrapper now detects I also used the repository merge-evidence guidance. The PR remains 🧠 Learnings usedThe repository guidance requires successful checks on the exact current head before merge evidence is valid. 🧠 Learnings usedYou are interacting with an AI system. |
|
Updated exact head: 1fa2c5f (Fail closed on unbound Strix workflow evidence). The prior exact-head run 31681226640 / job 94386887113 was rejected as clean evidence: GitHub reported success, but the artifact contained NVIDIA NIM 429, GitHub Models 410, No Strix vulnerability report was produced, and no evidence-binding.json; its active step list also lacked Validate Strix report provenance because pull_request_target executed the trusted base workflow. This update: (1) distinguishes structured evidence-binding status from generic Strix success, (2) holds workflow-changing PR approval until exact same-head post-merge structured status exists, (3) prevents failed-check supersession from accepting an unbound generic success, and (4) requires downloaded artifact head/run binding, report presence, and SHA-256 match. ADR/doctoring evidence and regression contracts were updated. Local verification: Python 58 targeted tests passed; Strix required-workflow smoke passed; Strix YAML actionlint passed; embedded OpenCode shell parse passed; bash syntax and diff checks passed. The full long-form Strix harness exceeded a bounded 180-second local run and was not treated as a pass. Merge remains intentionally pending independent current-head review and protected checks. After normal protected merge, rerun repository_dispatch Strix for the exact merged head and require the structured evidence-binding status plus artifact before calling security evidence clean. |
|
@opencode-agent @coderabbitai Please review only current exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='965'
expected='1fa2c5fa5466d1a641d1736c8de554d9a4477ed6'
printf '%s\n' '== Exact revision and PR state =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git cat-file -e "${expected}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$expected"
gh pr view "$pr" --repo "$repo" \
--json state,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,url \
--jq '{state,headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,url}'
printf 'checked_out_matches_expected=%s\n' \
"$([ "$(git rev-parse HEAD)" = "$expected" ] && echo true || echo false)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf 'base=%s\n' "$base"
printf '%s\n' '== Complete PR file list =='
git diff --name-status "$base" "$expected"
printf '%s\n' '== Exact-head remediation patch =='
git diff --unified=45 "${expected}^" "$expected" -- \
'.github/workflows/**' 'scripts/ci/**' 'tests/**' 'docs/**' 'CHANGELOG.md' \
| sed -n '1,3200p'
printf '%s\n' '== Relevant complete PR patch =='
git diff --unified=25 "$base" "$expected" -- \
'.github/workflows/**' 'scripts/ci/**' 'tests/**' 'docs/**' 'CHANGELOG.md' \
| sed -n '1,5000p'
printf '%s\n' '== Candidate source map =='
fd -HI -t f . | rg -i '(strix|evidence.binding|merge.scheduler|review.*merge|scheduler|workflow.*queue|queue.*workflow|cancel)' \
| sed -n '1,500p'
printf '%s\n' '== Workflow, collector, and scheduler contract contexts =='
rg -n -i -C 18 \
'evidence.binding|binding.*(status|artifact|sha|head|run)|scan_stage_head_sha|evidence_head_sha|candidate_head_sha|run.json|repository_dispatch|pull_request_target|workflow_run|cancelled|canceled|queued|in_progress|success|conclusion|mergeStateStatus|reviewDecision|current_head_can_attempt_merge|same.tree|restamp' \
.github/workflows scripts/ci tests docs CHANGELOG.md 2>/dev/null \
| sed -n '1,7000p' || true
printf '%s\n' '== File outlines before detailed reading =='
for f in \
.github/workflows/strix.yml \
scripts/ci/pr_review_merge_scheduler.py \
scripts/ci/_pr_review_merge_scheduler_core.py
do
if [ -f "$f" ]; then
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null | sed -n '1,500p' || true
fi
done
printf '%s\n' '== Exact-head checks =='
gh api "repos/${repo}/commits/${expected}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | [.name,.status,.conclusion,.app.slug,.details_url,.started_at,.completed_at] | `@tsv`' || true
printf '%s\n' '== Exact-head reviews =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
--jq --arg sha "$expected" \
'[.[] | select(.commit_id == $sha) | {user:.user.login,state,commit_id,submitted_at}]'
printf '%s\n' '== Unresolved non-outdated review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
originalLine
comments(first: 1) {
nodes { author { login } body }
}
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false and .isOutdated == false)
| {path,line:(.line // .originalLine),author:.comments.nodes[0].author.login,body:.comments.nodes[0].body}' || trueLength of output: 204155 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='965'
expected='1fa2c5fa5466d1a641d1736c8de554d9a4477ed6'
printf '%s\n' '== Identity =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
gh pr view "$pr" --repo "$repo" \
--json headRefOid,baseRefOid,state,mergeable,mergeStateStatus,reviewDecision \
--jq '{headRefOid,baseRefOid,state,mergeable,mergeStateStatus,reviewDecision}'
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
printf 'requested=%s\nbase=%s\n' "$expected" "$base"
printf 'head_matches_requested=%s\n' \
"$([ "$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)" = "$expected" ] && echo true || echo false)"
printf '%s\n' '== Changed files relevant to requested scope =='
git diff --name-only "$base" "$expected" \
| rg -i '(strix|evidence|merge.scheduler|review.*merge|scheduler|workflow.*queue|queue.*workflow|cancel)' \
|| true
printf '%s\n' '== Changed identifiers and exact line locations =='
rg -n -i \
'evidence-binding|structured evidence|strix_evidence_state|dispatch_strix_evidence|failed.?check|artifact.*(download|digest|sha|head|run)|workflow.chang|pull_request_target|repository_dispatch|force_cancel|cancel_stale|RUNNING_CHECK_STATES|current_head_can_attempt_merge' \
.github/workflows/strix.yml scripts/ci/pr_review_merge_scheduler.py \
tests docs/doctoring/strix-provider-evidence-fail-closed.md 2>/dev/null \
| sed -n '1,1800p'
printf '%s\n' '== Workflow provenance and evidence-binding sections =='
rg -n -i -C 8 \
'evidence-binding|upload-artifact|Validate Strix report provenance|scan_stage_head_sha|evidence_head_sha|candidate_head_sha|repository_dispatch|pull_request_target' \
.github/workflows/strix.yml 2>/dev/null \
| sed -n '1,2200p'
printf '%s\n' '== Scheduler exact Strix and merge-control sections =='
sed -n '930,1090p' scripts/ci/pr_review_merge_scheduler.py
sed -n '1360,1468p' scripts/ci/pr_review_merge_scheduler.py
sed -n '1820,2185p' scripts/ci/pr_review_merge_scheduler.py
sed -n '2230,2745p' scripts/ci/pr_review_merge_scheduler.py
printf '%s\n' '== Changed test names and targeted test assertions =='
git diff --name-only "$base" "$expected" -- tests \
| rg -i '(strix|merge.scheduler|review.merge|evidence|queue|cancel)' \
| while IFS= read -r f; do
echo "--- $f"
rg -n -i -C 4 \
'evidence.binding|artifact|digest|sha|run.id|workflow.chang|repository_dispatch|cancel|queued|in_progress|strix' \
"$f" | sed -n '1,900p'
done
printf '%s\n' '== Exact-head reviews =='
gh api "repos/${repo}/pulls/${pr}/reviews?per_page=100" --paginate \
--jq --arg sha "$expected" \
'.[] | select(.commit_id == $sha) | {user:.user.login,state,commit_id,submitted_at,body}' \
|| true
printf '%s\n' '== Unresolved non-outdated review-thread count =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) { nodes { isResolved isOutdated } }
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false and .isOutdated == false)] | length' || trueLength of output: 148177
I found one actionable issue. High — In The workflow does not compare Reject the evidence before processing if [ "${scan_stage_head_sha,,}" != "${evidence_head_sha,,}" ]; then
echo "::error::Strix scan-start SHA does not match the exact PR head SHA."
exit 1
fiAdd a regression case where The live PR head matched the requested SHA. The PR remains I used the repository merge-evidence guidance: only successful checks on the exact current head can support merge evidence. This is not an approval. 🧠 Learnings usedYou are interacting with an AI system. |
scan-head-sha.txt is incomplete evidence unless it matches the current PR head. Refuse provenance publish when the scan started elsewhere.
|
@cwl-noema-review Please review this exact current head ( |
|
Please perform a fresh formal semantic review of exact head |
|
@cwl-noema-review After a qualifying exact-head OpenCode verdict, independently review |
|
@coderabbitai review Please review exact head |
Rate Limit Exceeded
|
|
Returned to Draft because the fail-closed provider-evidence correction has grown into a 22-file mixed control-plane branch. The authoritative security invariant should be small and explicit: the outer required workflow must propagate every non-zero trusted Rebuild from protected |
|
Please perform a fresh exact-head semantic review of |
|
@cwl-noema-review After a qualifying exact-head OpenCode verdict, independently review |
|
@coderabbitai review Review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
expected='33a6094adbe13969facf809ce7b980e2c2017e88'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Exact-ref verification =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git cat-file -e "${expected}^{commit}"
git cat-file -e "${expected_base}^{commit}"
git show -s --format='requested_head=%H%nsubject=%s%nparents=%P' "$expected"
printf 'checked_out_matches_requested=%s\n' "$([ "$(git rev-parse HEAD)" = "$expected" ] && echo true || echo false)"
printf 'base_is_ancestor_of_head=%s\n' \
"$(git merge-base --is-ancestor "$expected_base" "$expected" && echo true || echo false)"
printf '%s\n' '== Pull request metadata and live refs =='
gh pr view 965 --repo "$repo" \
--json state,isDraft,headRefOid,baseRefOid,mergeable,reviewDecision,url \
--jq '{state,isDraft,headRefOid,baseRefOid,mergeable,reviewDecision,url}'
gh api "repos/${repo}/git/ref/pulls/965/head" --jq '.object.sha' || true
gh api "repos/${repo}/git/ref/heads/main" --jq '.object.sha' || true
printf '%s\n' '== Changed files and mode changes against requested base =='
git diff --name-status "$expected_base" "$expected"
git diff --summary "$expected_base" "$expected"
printf '%s\n' '== Materializer source changes =='
git diff --name-status "$expected_base" "$expected" -- 'scripts/ci/materialize_base_python_requirements.py'
printf '%s\n' '== Changed source map =='
fd -HI -t f .github scripts tests | sort | sed -n '1,240p'
printf '%s\n' '== Focused final diff =='
git diff --unified=35 "$expected_base" "$expected" -- \
'.github/workflows/strix.yml' \
'.github/workflows/opencode-review-dispatch.yml' \
'scripts/ci/strix_quick_gate.sh' \
'scripts/ci/run_opencode_review_model_pool.sh' \
'scripts/ci/collect_failed_check_evidence.sh' \
'scripts/ci/strix_required_workflow_smoke.sh' \
'scripts/ci/test_strix_quick_gate.sh' \
'tests/test_strix_workflow_dependency_hashes.py' \
'tests/test_required_workflow_queue_contract.py' \
'tests/test_opencode_model_pool_runner.py' \
| sed -n '1,3000p'
printf '%s\n' '== Final implementation anchors =='
rg -n -C 14 -i \
'evidence-binding|scan.start|scan_start|evidence_head|candidate_head|report.*(sha|digest)|run_id|repository_dispatch|terminal|source.status|neutral.skip|fail.closed|incomplete|provider|retry|backoff|process.group|setsid|kill -- -|redact|minimum.disclosure|PIPESTATUS|strix_rc' \
.github/workflows scripts/ci tests 2>/dev/null | sed -n '1,3600p'
printf '%s\n' '== Workflow and shell syntax structure =='
ast-grep outline .github/workflows/strix.yml --items all 2>/dev/null | sed -n '1,320p' || true
ast-grep outline scripts/ci/strix_quick_gate.sh --items all 2>/dev/null | sed -n '1,320p' || true
ast-grep outline scripts/ci/run_opencode_review_model_pool.sh --items all 2>/dev/null | sed -n '1,320p' || true
printf '%s\n' '== Current-head checks, reviews, and unresolved threads =='
gh api "repos/${repo}/commits/${expected}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`' || true
gh api "repos/${repo}/pulls/965/reviews?per_page=100" --paginate \
--jq --arg sha "$expected" '[.[] | select(.commit_id == $sha) | {user:.user.login,state,commit_id,submitted_at}]' || true
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number=965 -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '[.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false and .isOutdated == false)]' || trueLength of output: 204335 🏁 Script executed: #!/bin/bash
set -euo pipefail
log='/tmp/coderabbit-shell-logs/shell-output-FwNUHf'
expected='33a6094adbe13969facf809ce7b980e2c2017e88'
base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== Prior log: exact ref and changed-file sections =='
rg -n '^== (Exact-ref verification|Pull request metadata and live refs|Changed files and mode changes against requested base|Materializer source changes|Focused final diff) ==' "$log"
sed -n '1,260p' "$log"
printf '%s\n' '== Final changed-file list and mode-only changes =='
git diff --name-status "$base" "$expected"
git diff --summary "$base" "$expected"
printf '%s\n' '== Materializer source diff must be empty =='
git diff --exit-code "$base" "$expected" -- scripts/ci/materialize_base_python_requirements.py \
&& echo 'materialize_base_python_requirements.py: unchanged'
printf '%s\n' '== Strix evidence and publication sections =='
nl -ba .github/workflows/strix.yml | sed -n '780,1305p'
printf '%s\n' '== Trusted gate error/retry and report contracts =='
rg -n -C 12 \
'is_strix_model_tool_contract_error|STRIX_TRANSIENT_RETRY|backoff|retry|fail.closed|incomplete|neutral|run\.json|penetration_test_report|scan_completed|success|exit [0-9]+|return [0-9]+' \
scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh | sed -n '1,2800p'
printf '%s\n' '== Model-pool process cleanup implementation =='
rg -n -C 14 \
'signal_process_tree|process_group_id_for_pid|signal_process_group|capture_process_group_ids|signal_captured_process_groups|setsid|kill ' \
scripts/ci/run_opencode_review_model_pool.sh tests/test_opencode_model_pool_runner.py | sed -n '1,2200p'
printf '%s\n' '== Redaction implementation and regression coverage =='
rg -n -C 10 \
'redact_sensitive_log|REDACTED|redact_text|artifact|evidence|token|secret|email|IPV4|RUNNER_PATH' \
scripts/ci/redact_sensitive_log.py tests .github/workflows/strix.yml | sed -n '1,1800p'
printf '%s\n' '== Static evidence-binding assertions =='
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/strix.yml")
text = p.read_text(encoding="utf-8")
checks = {
"nonzero_gate_propagation": 'if [ "$strix_rc" -ne 0 ]; then' in text and 'exit "$strix_rc"' in text,
"zero_exit_marker_rejection": 'neutral[[:space:]]+skip' in text and 'exit 1' in text,
"scan_start_equals_evidence_head": '[ "${scan_stage_head_sha,,}" != "${evidence_head_sha,,}" ]' in text,
"metadata_required": 'if [ "$candidate_metadata_count" -eq 0 ]; then' in text,
"invalid_metadata_rejected": '__invalid_metadata_type__' in text,
"completed_success_required": '(.status == "completed") and (.scan_results.scan_completed == true) and (.scan_results.success == true)' in text,
"report_required": 'non-empty penetration_test_report.md' in text,
"binding_has_digest": 'report_sha256:$report_sha256' in text,
"status_is_dispatch_only": "github.event_name == 'repository_dispatch'" in text,
"status_description_is_structured": 'Default-branch repository_dispatch Strix structured evidence binding passed' in text,
}
for key, value in checks.items():
print(f"{key}={value}")
PYLength of output: 30992 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Strix provenance, evidence binding, and manual status publication =='
sed -n '923,1028p' .github/workflows/strix.yml
sed -n '1038,1115p' .github/workflows/strix.yml
sed -n '1190,1325p' .github/workflows/strix.yml
printf '%s\n' '== Structured-status consumer in OpenCode dispatch workflow =='
sed -n '6180,6425p' .github/workflows/opencode-review-dispatch.yml
printf '%s\n' '== Failed-check evidence validator =='
rg -n -C 8 'evidence-binding|report_sha256|artifact.*download|workflow_run|head_sha|run_id|structured' \
scripts/ci/collect_failed_check_evidence.sh | sed -n '1,1800p'
printf '%s\n' '== Process-group cleanup symbols and full local contexts =='
rg -n '^(signal_process_tree|process_group_id_for_pid|signal_process_group|capture_process_group_ids|signal_captured_process_groups|run_model|main)\(\)' \
scripts/ci/run_opencode_review_model_pool.sh
sed -n '1,300p' scripts/ci/run_opencode_review_model_pool.sh
rg -n -C 8 'fatal_cleanup_kills_term_ignoring_child|process group|TERM|KILL|child' \
tests/test_opencode_model_pool_runner.py | sed -n '1,1300p'
printf '%s\n' '== Quick-gate classifier and bounded retry contexts =='
rg -n '^(is_strix_model_tool_contract_error|is_infrastructure_error|is_retryable|run_strix|main)\(\)' \
scripts/ci/strix_quick_gate.sh
rg -n -C 10 'is_strix_model_tool_contract_error|STRIX_TRANSIENT_RETRY_PER_MODEL|STRIX_TRANSIENT_RETRY_BACKOFF_SECONDS|sleep |fallback|retry|infrastructure' \
scripts/ci/strix_quick_gate.sh | sed -n '1,2200p'
printf '%s\n' '== Redaction tests and executable modes =='
sed -n '1,360p' tests/test_redact_sensitive_log.py
git diff --raw "$(
git merge-base 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba \
33a6094adbe13969facf809ce7b980e2c2017e88
)" 33a6094adbe13969facf809ce7b980e2c2017e88
printf '%s\n' '== Concise static contract results =='
python3 - <<'PY'
from pathlib import Path
workflow = Path(".github/workflows/strix.yml").read_text(encoding="utf-8")
dispatch = Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
collector = Path("scripts/ci/collect_failed_check_evidence.sh").read_text(encoding="utf-8")
pool = Path("scripts/ci/run_opencode_review_model_pool.sh").read_text(encoding="utf-8")
gate = Path("scripts/ci/strix_quick_gate.sh").read_text(encoding="utf-8")
checks = {
"workflow_requires_scan_start_equals_head":
'[ "${scan_stage_head_sha,,}" != "${evidence_head_sha,,}" ]' in workflow,
"workflow_rejects_metadata_less_success":
'if [ "$candidate_metadata_count" -eq 0 ]; then' in workflow,
"workflow_binds_report_digest":
'report_sha256:$report_sha256' in workflow,
"workflow_rejects_zero_exit_incomplete_marker":
'neutral[[:space:]]+skip' in workflow and 'refusing to convert that into a successful required check' in workflow,
"dispatch_requires_structured_description":
'Default-branch repository_dispatch Strix structured evidence binding passed' in dispatch,
"collector_validates_binding_digest":
'report_sha256' in collector and 'evidence-binding.json' in collector,
"pool_captures_and_signals_process_groups":
all(symbol in pool for symbol in ('capture_process_group_ids', 'signal_captured_process_groups', 'signal_process_group')),
"gate_has_bounded_transient_retry_controls":
'STRIX_TRANSIENT_RETRY_PER_MODEL' in gate and 'STRIX_TRANSIENT_RETRY_BACKOFF_SECONDS' in gate,
}
for name, result in checks.items():
print(f"{name}={result}")
PYLength of output: 112278 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Numbered status-only acceptance function and callers =='
awk '
/current_head_manual_strix_structured_success_status\(\)/ {show=1}
show {printf "%d:%s\n", NR, $0}
show && /hold_for_unverified_strix_workflow_update\(\)/ && NR > 1 {exit}
' .github/workflows/opencode-review-dispatch.yml
rg -n -C 10 \
'current_head_manual_strix_structured_success_status|hold_for_unverified_strix_workflow_update|WAITING_FOR_POST_MERGE_STRIX_EVIDENCE|manual_strix_run_has_structured_binding' \
.github/workflows/opencode-review-dispatch.yml scripts/ci/collect_failed_check_evidence.sh tests .github/workflows
printf '%s\n' '== Numbered artifact-binding validator =='
awk '
/manual_strix_run_has_structured_binding\(\)/ {show=1}
show {printf "%d:%s\n", NR, $0}
show && /^}/ {exit}
' scripts/ci/collect_failed_check_evidence.sh
printf '%s\n' '== Tests for structured status, run identity, and artifact binding =='
rg -n -C 12 \
'structured evidence|evidence-binding|report_sha256|WAITING_FOR_POST_MERGE_STRIX_EVIDENCE|repository_dispatch Strix|manual_strix_run_has_structured_binding|status.*binding|binding.*status' \
tests/test_required_workflow_queue_contract.py scripts/ci/test_strix_quick_gate.sh
printf '%s\n' '== Static call-boundary check =='
python3 - <<'PY'
from pathlib import Path
text = Path(".github/workflows/opencode-review-dispatch.yml").read_text(encoding="utf-8")
start = text.index("current_head_manual_strix_structured_success_status()")
end = text.index("\n hold_for_unverified_strix_workflow_update()", start)
body = text[start:end]
for term in ("gh run download", "evidence-binding.json", "report_sha256", "manual_strix_run_has_structured_binding"):
print(f"status_consumer_contains_{term!r}={term in body}")
print("status_consumer_calls=", text.count("current_head_manual_strix_structured_success_status"))
PYLength of output: 72674
I found one actionable issue. P1 — Do not release the post-merge evidence hold from a commit status alone
Line 6296 uses this status-only result to stop The repository already has the required artifact validation in Make Add a regression case in The scan-start SHA comparison, fail-closed marker handling, report metadata checks, bounded retry behavior, process-group cleanup, redaction coverage, executable-mode preservation, and lack of materializer source changes look correct in the reviewed source. The PR remains
|
|
@opencode-agent review Review exact current head |
|
@opencode-agent review Review exact current head 88aa747 against protected main 6eb06cd. Validate the aggregate review gate, exact-head checks, structured Strix status URL/run/workflow/head binding, downloaded strix-reports/evidence-binding.json, report path and SHA-256 digest, fail-closed provider evidence, bounded retry/backoff, process-group cleanup, minimum-disclosure evidence, and the Linux-only trusted-uv test contract. Re-check the prior P1 about status-only post-merge hold release. Submit a formal current-head verdict only after all required checks are terminal. Do not mutate, merge, bypass protections, or self-approve. |
|
Local verification for exact head 88aa747:
|
|
@opencode-agent review Review exact current head c192ad2 only against protected main 6eb06cd. The current correction binds the target repository, exact strix-reports artifact name, outer GitHub Actions run ID, full head, report path, and digest; consumers require exactly one non-expired artifact before download and reject provider-internal run IDs, duplicates, expiry, or mismatches. Re-run all relevant checks and submit a formal current-head verdict. This is a request only: do not mutate, approve, merge, bypass protection, or treat local tests as approval. |
|
@opencode-agent review The PR advanced after a cleanup fix. Review exact current head a42e1e6 only against protected main 6eb06cd. Verify the outer-run artifact binding and the new fail-closed cleanup path; predecessor head c192ad2 is historical only. This is request-only: do not mutate, approve, merge, bypass protection, or treat local tests as approval. |
|
Closed as the author-marked broad predecessor of #1009. Fresh exact-diff comparison proves all 12 files in #1009 are byte-for-byte identical to the corresponding #965 patches. The remaining mixed scopes are intentionally excluded from the focused Strix lane and already map to separate canonical work (aggregate-review gating, trusted-uv materialization, dependency-hash governance, and redaction). The branch and discussion remain available as audit history. |
1 participant
Superseded
This broad mixed-scope branch is superseded by PR #1009, which is the bounded exact-head Strix evidence successor. This PR is closed unmerged and retained only as historical audit context. No checks, reviews, approvals, artifacts, or merge authority from this branch transfer to #1009.