Skip to content

fix(strix): install hashed locks without pip re-resolution - #969

Open
seonghobae wants to merge 6 commits into
mainfrom
fix/strix-no-deps-pip-audit-hashed-lock
Open

fix(strix): install hashed locks without pip re-resolution#969
seonghobae wants to merge 6 commits into
mainfrom
fix/strix-no-deps-pip-audit-hashed-lock

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Summary

Required Strix is pull_request_target, so the installer YAML comes from protected main. #961 already compiled strix-agent==1.5.3 + cryptography==50.0.0 and added --no-deps on the PR copy, but the live required job still ran main's pip install --require-hashes without --no-deps. pip re-applied cryptography<49 and failed ResolutionImpossible. The same resolver path made pip-audit print known-vulnerable even though no advisory was returned.

This PR lands --require-hashes --no-deps on main's installer without changing the lock (strix-agent==1.0.4 stays). After merge, #961 can install. python-security.yml (pull_request) now audits hashed complete locks through scripts/ci/pip_audit_requirements.py (pip-audit --disable-pip).

Does not drop cryptography==50.0.0. Does not weaken the missing-artifact fail-closed gate. Does not touch review-agent keys or COPILOT_GITHUB_TOKEN.

Refs #952
Refs #961

Developer experience

  • scripts/ci/pip_audit_requirements.py is a small pure selector: hashed lock → --disable-pip; override/input with hashed sibling → skip; other files unchanged.
  • Tests reconstruct the fix(strix): persist 1.5.3 reports without dropping cryptography 50 #961 lock shape (strix-agent==1.5.3 + cryptography==50.0.0 hashes) and require --disable-pip for that file.
  • Trusted-uv installer verification tests simulate linux/x86_64 so Darwin hosts can measure the version/cache path (CWE-670 cache clear). Production still fail-closes unsupported runners.

User experience

A buyer watching required security checks no longer sees a red pip-audit X that means "pip could not re-resolve a documented override lock." After this lands on main, required Strix can install the 1.5.3 crash-after-print fix without uninstalling cryptography 50.

Verification

Local (twice, consistent): 989 passed, 16 subtests passed; coverage fail_under = 100; interrogate fail-under = 100.

@seonghobae
fix(strix): install hashed locks without pip re-resolution
ad60bbc 
Required Strix is pull_request_target, so --no-deps must land on main
before a 1.5.3 + cryptography 50 lock can install. pip-audit now audits
hashed complete locks with --disable-pip instead of labeling
ResolutionImpossible as a known vulnerability.

Refs #952
Refs #961
@coderabbitai

coderabbitai Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 97 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bddf7083-9597-4119-adc5-74d1a07bad18

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb06cd and 77b380a.

📒 Files selected for processing (11)
  • .github/workflows/python-security.yml
  • .github/workflows/strix.yml
  • .gitignore
  • AGENTS.md
  • ARCHITECTURE.md
  • CHANGELOG.md
  • CLAUDE.md
  • docs/doctoring/strix-hashed-lock-no-deps.md
  • scripts/ci/pip_audit_requirements.py
  • tests/test_materialize_base_python_requirements.py
  • tests/test_pip_audit_requirements.py

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae enabled auto-merge (squash) August 13, 2026 07:43
@seonghobae

seonghobae commented Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review please review this current head. Required Strix is pull_request_target, so --no-deps must land on main before #961 can install strix-agent 1.5.3 with cryptography 50. pip-audit now uses --disable-pip on hashed locks so ResolutionImpossible is not labeled a known vulnerability.

@opencode-agent Independently review exact current head against protected main. Do not implement.

@seonghobae seonghobae mentioned this pull request Aug 13, 2026
Draft
@seonghobae
fix(strix): require hash evidence before disable-pip
5e8ac95 
A *-hashes.txt name is not a complete lock. Audit with --disable-pip
only when the file contains --hash= or --require-hashes, and skip
virtualenv trees during discovery.
@seonghobae seonghobae mentioned this pull request Aug 13, 2026
Closed
3 tasks
@seonghobae

seonghobae commented Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review Please review this exact current head (5e8ac9563813). The head now requires hash evidence before --disable-pip.

@seonghobae
fix(strix): require --hash= pins before disable-pip
89d0b64 
A lone --require-hashes directive without hash pins is an incomplete
lock. pip-audit must not --disable-pip that file, or an empty/pin-only
set is reported clean.
@seonghobae
fix(strix): require every package line hashed before disable-pip
1cf6117 
A mixed lock with one --hash= pin beside unhashed packages must not
skip pip's resolver. Join continuation lines first, then require
every package line to carry --hash=.
@seonghobae

seonghobae commented Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

@cwl-noema-review Please review this exact current head (1cf61170ee8ef8c74206330738d6723fdd25fa73). Independent Noema APPROVE on this SHA is required. Do not wait on two-approval.

@seonghobae
fix(strix): reject dotted requirement includes from materialize
3caf51f 
Materialize a base Python lock only when every package line is an exact
SHA-256 pin or a bounded relative -r include. A lone --require-hashes
directive, ./lock.txt, or -r other-hashes.txt cannot enter the trusted
build context (CWE-22).
opencode-agent[bot]
opencode-agent Bot requested changes Aug 14, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for 3caf51ffe625f0a6f2c9b945215175b12dc88973.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (5 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (5 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: strix-hashed-lock-no-deps.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: strix-hashed-lock-no-deps.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script (2 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script (2 files)"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (2 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (2 files)"]
  R5 --> V5["targeted test run"]
Loading

@opencode-agent

opencode-agent Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 3caf51ffe625f0a6f2c9b945215175b12dc88973
  • Workflow run: 31753525476
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for 3caf51ffe625f0a6f2c9b945215175b12dc88973.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (5 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (5 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: strix-hashed-lock-no-deps.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: strix-hashed-lock-no-deps.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script (2 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script (2 files)"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (2 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (2 files)"]
  R5 --> V5["targeted test run"]
Loading

@opencode-agent
opencode-agent Bot disabled auto-merge August 14, 2026 01:29
@seonghobae seonghobae mentioned this pull request Aug 14, 2026
Draft
@seonghobae
seonghobae marked this pull request as draft August 14, 2026 09:14
@seonghobae ChatGPT Codex Connector

seonghobae commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Returned to Draft because this protected-main prerequisite mixes the hashed-lock/no-re-resolution policy with the common trusted-uv materializer branch and the duplicate Darwin test workaround.

The intended dependency contract must remain independently reviewable: complete hash locks install with --require-hashes --no-deps; pip-audit evaluates those locks with --disable-pip; source/override inputs with a hashed sibling are not audited as operational lockfiles; ordinary requirements retain existing behavior. Head 3caf51ffe625f0a6f2c9b945215175b12dc88973 additionally changes the materializer and platform tests.

Rebuild from protected main retaining only strix.yml, python-security.yml, pip_audit_requirements.py, focused selector/real-lock regressions, doctoring, directly attributable governance/changelog evidence, and no materializer/platform changes. This clean prerequisite should land before a rebuilt #961, then both must reacquire exact-head install/audit/Strix/security/SBOM and independent-review evidence.

@seonghobae
seonghobae marked this pull request as ready for review August 14, 2026 14:01
@seonghobae ChatGPT Codex Connector

seonghobae commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

Review only exact current head 77b380aad4a8ea89f79664cf7ae66a13ccb14ba6 against live protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. I removed the overlapping materializer-path delta owned by #790 while preserving this PR's intended Strix installer and audit boundary: protected-main required Strix installs a complete hash-locked environment with --no-deps, and Python Security uses pip-audit --disable-pip only when every package requirement is hash-pinned; mixed locks do not bypass dependency resolution. The Strix lock itself remains unchanged on this prerequisite. No review thread exists. Exact-head checks are regenerating; nonterminal evidence is not acceptance. Review read-only; do not mutate source, synthesize approval, weaken the missing-artifact fail-closed gate, or merge.

@seonghobae
seonghobae enabled auto-merge (squash) August 14, 2026 14:02
@coderabbitai

coderabbitai Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

@seonghobae Review requested for exact head 77b380aad4a8ea89f79664cf7ae66a13ccb14ba6 against protected main 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba. The review will be read-only.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@seonghobae ChatGPT Codex Connector

seonghobae commented Aug 15, 2026

Copy link
Copy Markdown
Contributor Author

@opencode-agent @cwl-noema-review @coderabbitai review

Review exact head 77b380aad4a8ea89f79664cf7ae66a13ccb14ba6. The only formal change request is predecessor-head cancellation evidence. Current-head workflow inventory has no queued or failed run and zero unresolved threads. Verify pip install --require-hashes --no-deps for the complete protected-main Strix lock, pip-audit --disable-pip only for independently complete hashed locks, preservation of cryptography 50 and the missing-artifact fail-closed gate, no review-agent credential changes, and the bounded selector tests. Submit a formal exact-head verdict.

@coderabbitai

coderabbitai Bot commented Aug 15, 2026

Copy link
Copy Markdown

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 18 minutes and 18 seconds before sending another message.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@opencode-agent opencode-agent[bot] opencode-agent[bot] requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

naruon Platform Roadmap
Status: Todo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seonghobae