fix(strix): persist 1.5.3 reports without dropping cryptography 50 - #961
fix(strix): persist 1.5.3 reports without dropping cryptography 50#961seonghobae wants to merge 11 commits into
Conversation
Required Strix on 1.0.4 printed a finished penetration-test report and then exited before writing the artifact, so the fail-closed gate discarded real findings. Pin strix-agent 1.5.3 (atomic writes, quit after scan), keep cryptography 50.0.0 via a documented compile-time override, and install the complete hashed lock with --no-deps so pip does not re-apply the stale cryptography<49 bound. Closes #952.
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Required Strix failed on this head because Follow-up #969 lands |
Fail closed if importlib.metadata does not report both pins, so a drifted lock cannot scan with a dropped CVE floor.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
4ca51360e93925f8d6f2dfead0de8f9bc9443364. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (actions): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090685)
- CodeQL PR/CodeQL compatibility analysis (python): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090740)
- CodeQL PR/CodeQL merge preview (actions): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090765)
- CodeQL PR/CodeQL merge preview (python): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090729)
- CodeQL compatibility analysis (actions) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090685)
- CodeQL compatibility analysis (python) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090740)
- CodeQL merge preview (actions) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090765)
- CodeQL merge preview (python) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175804/job/94403090729)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175850/job/94404119722)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175827/job/94396268868)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175825/job/94396268565)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175825/job/94396268565)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268853)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268996)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268911)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268983)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175827/job/94396268868)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175333/job/94396265760)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175333/job/94396265760)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175340/job/94404270209)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268853)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268996)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175850/job/94404119722)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175340/job/94396265335)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268911)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31684175817/job/94396268983)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (7 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (7 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-agent-cryptography-override.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-agent-cryptography-override.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: compile_strix_ci_lock.sh"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: compile_strix_ci_lock.sh"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (11 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (11 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-agent-cryptography-override.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-agent-cryptography-override.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (5 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (5 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
Record the materialize include bound in ARCHITECTURE and doctoring with APA 7th MITRE and pip hash-checking references.
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7f5bd5295c00573e6e5eead1a53d9fc9c495916c. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Python Security/pip-audit (Python dependency audit): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31749863439/job/94630614560)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31749863708/job/94630616226)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31749863708/job/94630616226)
- pip-audit (Python dependency audit) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31749863439/job/94630614560)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (7 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (7 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs (2 files)"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs (2 files)"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
Returned to Draft because the Strix 1.5.3/cryptography override migration is mixed with the shared trusted-uv materializer branch and a separate test-platform concern. The supply-chain slice needs independent proof: immutable Rebuild from protected |
The org-queue-sweep contract requires the */15 cron to run the organization walk so late approvals do not sit unmerged. Restore that trigger alongside the hourly heartbeat. Do not treat the scheduler's own scan-pr-queue check or status as a merge blocker, including when workflow metadata is missing.
Keep 15-minute org-queue-sweep plus scan-pr-queue ignore, bounded requirement includes, and Strix 1.5.3 doctoring. Take main's hourly NVIDIA NIM repair callers and conflict-scope fail-closed parent-symlink rule. Use the linux x86_64 installer test helper that clears the uv cache.
Keep only the Strix lock, compile-time cryptography 50 override, hashed install, and fail-closed gate contracts. Restore scheduler, materializer, and trusted-uv files to protected main so this PR is independently reviewable after #969 lands --no-deps on main. Refs #952 Refs #969 Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Assessment
Do not merge this pull request. The 1.5.3 + cryptography 50 lock is the right buyer fix for #952, but this head is no longer the landing vehicle.
Use #1047 instead. That successor keeps this lock and adds the missing quality-CI watch on requirements-strix-ci.txt / requirements-strix-ci-hashes.txt, plus a contract that the unchanged gate still requires strix_runs/<run>/vulnerabilities/*.md and still rejects console TUI lines such as Penetration test completed.
Why this head stays blocked
Required Strix is pull_request_target. Protected main still installs with resolver-based pip install --require-hashes (no --no-deps). pip will re-apply strix-agent 1.5.3 depends on cryptography<49 and fail before any report can persist. #969 is the protected-main installer and hashed-lock pip-audit --disable-pip prerequisite. Land #969 first, rebase #1047, then re-run exact-head checks.
This head also left a supply-chain hole: a lock-only edit did not retrigger Strix quality CI, so the pin/override contract would not re-run when the install set changed.
Next action
- Review and land #969 on
main. - Continue on #1047, not here.
- Do not self-approve. Do not merge #961 and #1047 in parallel. Do not drop
cryptography==50.0.0or weaken the missing-artifact gate.
Independent focused contracts on the successor (tests/test_strix_agent_cryptography_override.py and the related quality-path tests) passed locally, 19/19.
Sent by Cursor Automation: Fix Issues
Keep the official Apache-2.0 1.5.3 bytes except the stale cryptography<49 Requires-Dist line so main's resolver can install cryptography 50.0.0 from the PR-head lock. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Required Strix is pull_request_target, so main still runs pip install --require-hashes without --no-deps and re-applies cryptography<49. Pin a METADATA-patched official 1.5.3 wheel by direct URL, keep cryptography 50.0.0, and audit this hashed lock with --disable-pip. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
pip-audit treated ResolutionImpossible on the unhashed 1.5.3 + cryptography 50 compile input as a vulnerability, then rejected the hashed URL pin under --disable-pip. Skip the compile input and audit a name==version rewrite of the published wheel lock. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
7ebbc707103731bd921904726cd4b0362b549ebd. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32050260245/job/95452049819)
- CodeQL PR/CodeQL merge preview (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32050260245/job/95452049955)
- CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32050260245/job/95452049819)
- CodeQL merge preview (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32050260245/job/95452049955)
- Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32050259630/job/95447681414)
- noema-review check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32050259630/job/95447681414)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (3 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (3 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (11 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (11 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-agent-cryptography-override.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-agent-cryptography-override.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (5 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (5 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
Both Python CodeQL jobs failed in codeql-action/init while asking GitHub for feature enablement (HTTP 503). Sibling actions jobs on the same run passed and produced no SARIF findings. Retry init once after 20s; keep the Medium+ gate and upload:false contract. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
Closing as superseded, not rejected on product intent. PR #1047 explicitly identifies itself as the landing successor to this Strix 1.5.3/cryptography 50 line, preserves the same fail-closed report-artifact contract, and adds the lock-watch/report-layout acceptance work. PR #969 remains the prerequisite that must first land the hashed-lock |
2 participants
Problem
Required Strix on
strix-agent==1.0.4finishes a real scan, printsPenetration test completedwith a vulnerability list, then exits non-zero before the report artifact is written. The fail-closed gate (#891) then fails the required check even though the console already listed findings. Reproduced on ContextualWisdomLab/contextual-orchestrator#136, #141, #144, and #137.That is a buyer-felt security-dashboard miss on every ruleset consumer. The fail-closed missing-artifact rule is not weakened.
Change
strix-agent==1.5.3(atomic CSV/MD writes; quit after scan instead of hosting a local viewer).cryptography==50.0.0(CVE-2026-39892 floor + CVE-2026-69247 PKCS#7 timing-oracle fix).cryptography<49metadata bound only at compile time viarequirements-strix-ci-overrides.txtand./scripts/ci/compile_strix_ci_lock.sh.pip install --require-hashes --no-depsso pip does not re-apply that bound.Live install of this lock imported
strix, ranstrix --help, and loadedcryptography==50.0.0withstrix-agent==1.5.3.Closes #952.
Do not self-approve. Merge remains subject to the sole-collaborator 2-approval deadlock (#948).