[seonghobae]

RCA boundary

Current-head runs #2261 and #2550 passed gateway health, provider-route, and chat preflight, then failed guest authentication against in-container Caido at 127.0.0.1:48080. The evidence identifies a sandbox-bootstrap failure, not provider 429 or an LLM failure. Historical logs do not contain an OCI image digest or lifecycle state, so they cannot distinguish slow startup from a terminal process failure.

Change

The trusted Strix launcher now records only already-cached, SDK-bound Docker metadata around guest authentication: phase, freshness=cached, image configuration ID, lifecycle status, exit code, and OOM flag. It does not reload Docker, query the daemon, read logs, look up images, change authentication, skip terminal containers, alter retries/deadlines/backend selection, or call settings loading. Unsupported SDK/ABI bindings emit a fixed unavailable marker and leave the scan behavior unchanged.

Verification

• 43 focused tests passed twice, including original token parsing, exact exception/cancellation identity, non-Docker non-interference, malformed metadata redaction, and no reload/remove behavior.
• scripts/ci/strix_timeout_compat.py: statement·branch coverage 100%; docstrings 100%; diff check passed.
• The fixture preserves the hashed pinned Strix 1.5.3 guest-authentication function and its Apache-2.0 attribution.
• Current OCI tag metadata is documented as current-tag evidence only, not historical execution identity or root-cause proof.

This diagnostic does not claim Caido recovery, a green Strix scan, hosted acceptance, or merge authorization.

Developer experience: future failed scans emit bounded lifecycle context instead of forcing operators to infer sandbox state from a connection refusal.
User experience: incomplete sandbox scans remain failed evidence; no zero-finding result is promoted to a security pass.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b9722540-f232-4d85-85d5-96752bfbd1d1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head hosted admission RCA

Exact #2573 head 41e9c45407e3f72d138da2ad24cdf934aa42fbe1 has common initial failures across CodeQL, Semgrep, and Security detection jobs. These jobs started and ended in about four seconds with no steps or retained run logs. The retained GitHub Actions check-run annotations provide the cause:

The job was not started because your account is locked due to a billing issue.

Observed check-run ids: 111362130332 (CodeQL detect), 111362130039 (Semgrep), 111362130130 (Security detect). This is account-level Actions admission, not a source finding in #2573, #2572, #2571, or #2531. No source change, retry, status synthesis, gate relaxation, or state toggle can make an unadmitted job valid.

The local exact-tree verification remains recorded separately; it does not replace hosted acceptance. The actionable recovery is to resolve the GitHub account billing lock, then trigger normal current-head admission on the active successor stack. After real Actions jobs start, current-head security results and non-author formal approval remain required. This comment is evidence only, not approval or merge authorization.

[cwl-noema-review]

Noema LLM review

The new reusable package-description gate reads its identity from unsupported Actions job-context properties, causing valid callers to fail before inspection. Static probes also checked shell-injection resistance, README path containment, and CodeQL runner selection. The truncated diff and allowed-location list prevent a complete verdict on the Strix implementation and tests.

Reviewed changed lines

• .github/workflows/package-description-boundary.yml:152 (RIGHT): job.workflow_repository and the adjacent job.workflow_sha are not supported properties of the Actions job context. Missing properties resolve to empty strings, which the following identity validation rejects.
• .github/workflows/package-description-boundary.yml:100 (RIGHT): The build selector is passed through the environment and restricted by an exact shell case statement. Caller-supplied shell syntax cannot become an executable build command.
• .github/workflows/package-description-boundary.yml:116 (RIGHT): Canonicalizing the README path before checking the caller-root prefix rejects both parent-directory traversal and symlinks resolving outside the checkout.
• .github/workflows/codeql-pr.yml:64 (RIGHT): The exact trusted-main workflow reference retains the central-control group; other references select the isolated group. The adjacent labels expression uses the same predicate, so the changed mapping does not mix groups and labels across branches.

Adversarial validation

• .github/workflows/package-description-boundary.yml:152 (RIGHT) confirmed: A legitimate reusable-workflow invocation fails identity validation because the selected job-context properties do not exist. — The Actions job context does not supply workflow_repository or workflow_sha. Missing-property evaluation produces empty strings. The subsequent repository comparison rejects the empty WORKFLOW_REPOSITORY and exits 2 before central checkout or description inspection. This is a static evaluation, not an executed workflow reproduction.
• .github/workflows/package-description-boundary.yml:100 (RIGHT) falsified: A caller can inject shell commands through the build input. — BUILD is an environment value rather than interpolated shell source. The value matches neither sdist nor wheel, so the default case exits 2 before uv runs; the embedded semicolon is not reparsed as shell syntax.
• .github/workflows/package-description-boundary.yml:116 (RIGHT) falsified: README staging can copy a file outside the caller checkout through traversal or a symlink. — realpath -e resolves the candidate before the case statement. An existing external target lacks the canonical caller-root-plus-slash prefix and is rejected before cp; a missing target fails under set -e.
• .github/workflows/codeql-pr.yml:64 (RIGHT) falsified: The runner-selection rewrite routes a PR-authored workflow revision into the central-control group. — The equality predicate is false, selecting CWL CI isolated and the cwlab-ci-isolated label. The labels expression repeats the same predicate; only the exact central main reference selects central control.
• Residual risk: Validation was static; no Actions runs or local tests were executed. Findings and probe citations are restricted to the supplied allowed locations. The omitted implementation and tests remain without a formal verdict, and runner disposability and group access require operational evidence.

Findings

• [medium] .github/workflows/package-description-boundary.yml:152 (RIGHT): Resolve the called workflow's identity through a supported mechanism. The Actions job context has neither workflow_repository nor workflow_sha; these are not equivalents of the reusable-workflow OIDC claims job_workflow_ref and job_workflow_sha. Both environment values therefore resolve to empty strings, and every otherwise valid invocation fails the repository check before running the inspector. Obtain and validate the called-workflow identity through an authenticated supported source, retain the exact-SHA checkout, and add a real cross-repository invocation regression. Do not substitute github.workflow_sha, which identifies the caller in a reusable workflow.

• Result: REQUEST_CHANGES
• Head SHA: 44eba247e76ae5be5c32927a1374c70aca328557
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• .github/actionlint.yaml — repository behavior
• .github/workflows/codeql-pr.yml — GitHub Actions review job
• .github/workflows/package-description-boundary.yml — GitHub Actions review job
• CHANGELOG.d/20260920-strix-trusted-binder-runtime-fixture.md — repository behavior
• CHANGELOG.d/20261002-strix-sandbox-lifecycle-diagnostics.md — repository behavior
• CHANGELOG.md — repository behavior
• docs/doctoring/package-description-boundary.md — operator or user guidance
• docs/doctoring/strix-sandbox-lifecycle-diagnostics-20261002.md — operator or user guidance
• docs/product-technical-gap-baseline.md — operator or user guidance
• scripts/ci/package_description_boundary.py — review and security gate shell path
• scripts/ci/strix_quick_gate.sh — review and security gate shell path
• scripts/ci/strix_timeout_compat.py — review and security gate shell path
• scripts/ci/test_strix_quick_gate.sh — review and security gate shell path
• tests/fixtures/strix_login_as_guest_1_5_3.LICENSE.txt — regression suite
• tests/fixtures/strix_login_as_guest_1_5_3.py — regression suite
• tests/test_audit_org_codeql_coverage.py — regression suite
• tests/test_codeql_pr_workflow_contract.py — regression suite
• tests/test_materialize_base_python_requirements.py — regression suite
• tests/test_organization_commercial_readiness_loop_receipt_contract.py — regression suite
• tests/test_package_description_boundary.py — regression suite
• tests/test_required_review_runner_image_contract.py — regression suite
• tests/test_sandboxed_web_e2e.py — regression suite
• tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py — regression suite
• tests/test_strix_llm_timeout_contract.py — regression suite
• tests/test_strix_sandbox_diagnostics.py — regression suite

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: actionlint.yaml"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: actionlint.yaml"]
  R1 --> V1["required checks"]
  Evidence --> S2["Workflow: codeql-pr.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: codeql-pr.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Workflow: package-description-boundary.yml"]
  S3 --> I3["GitHub Actions review job"]
  I3 --> R3["Review risk: Workflow: package-description-boundary.yml"]
  R3 --> V3["actionlint plus required checks"]
  Evidence --> S4["Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  S4 --> I4["repository behavior"]
  I4 --> R4["Review risk: Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  R4 --> V4["required checks"]
  Evidence --> S5["Repository file: 20261002-strix-sandbox-lifecycle-diagnostics.md"]
  S5 --> I5["repository behavior"]
  I5 --> R5["Review risk: Repository file: 20261002-strix-sandbox-lifecycle-diagnostics.md"]
  R5 --> V5["required checks"]
  Evidence --> S6["Repository file: CHANGELOG.md"]
  S6 --> I6["repository behavior"]
  I6 --> R6["Review risk: Repository file: CHANGELOG.md"]
  R6 --> V6["required checks"]
  Evidence --> S7["Docs: package-description-boundary.md (3 files)"]
  S7 --> I7["operator or user guidance"]
  I7 --> R7["Review risk: Docs: package-description-boundary.md (3 files)"]
  R7 --> V7["docs review"]
  Evidence --> S8["CI script: package_description_boundary.py"]
  S8 --> I8["review and security gate shell path"]
  I8 --> R8["Review risk: CI script: package_description_boundary.py"]
  R8 --> V8["bash -n plus Strix self-test"]
  Evidence --> S9["CI script: strix_quick_gate.sh"]
  S9 --> I9["review and security gate shell path"]
  I9 --> R9["Review risk: CI script: strix_quick_gate.sh"]
  R9 --> V9["bash -n plus Strix self-test"]
  Evidence --> S10["CI script: strix_timeout_compat.py"]
  S10 --> I10["review and security gate shell path"]
  I10 --> R10["Review risk: CI script: strix_timeout_compat.py"]
  R10 --> V10["bash -n plus Strix self-test"]
  Evidence --> S11["CI script: test_strix_quick_gate.sh"]
  S11 --> I11["review and security gate shell path"]
  I11 --> R11["Review risk: CI script: test_strix_quick_gate.sh"]
  R11 --> V11["bash -n plus Strix self-test"]
  Evidence --> S12["Test: strix_login_as_guest_1_5_3.LICENSE.txt (2 files)"]
  S12 --> I12["regression suite"]
  I12 --> R12["Review risk: Test: strix_login_as_guest_1_5_3.LICENSE.txt (2 files)"]
  R12 --> V12["targeted test run"]
  Evidence --> S13["Test: test_audit_org_codeql_coverage.py (10 files)"]
  S13 --> I13["regression suite"]
  I13 --> R13["Review risk: Test: test_audit_org_codeql_coverage.py (10 files)"]
  R13 --> V13["targeted test run"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 44eba247e76ae5be5c32927a1374c70aca328557
• Workflow run: 38507530699
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: actionlint.yaml"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: actionlint.yaml"]
  R1 --> V1["required checks"]
  Evidence --> S2["Workflow: codeql-pr.yml"]
  S2 --> I2["GitHub Actions review job"]
  I2 --> R2["Review risk: Workflow: codeql-pr.yml"]
  R2 --> V2["actionlint plus required checks"]
  Evidence --> S3["Workflow: package-description-boundary.yml"]
  S3 --> I3["GitHub Actions review job"]
  I3 --> R3["Review risk: Workflow: package-description-boundary.yml"]
  R3 --> V3["actionlint plus required checks"]
  Evidence --> S4["Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  S4 --> I4["repository behavior"]
  I4 --> R4["Review risk: Repository file: 20260920-strix-trusted-binder-runtime-fixture.md"]
  R4 --> V4["required checks"]
  Evidence --> S5["Repository file: 20261002-strix-sandbox-lifecycle-diagnostics.md"]
  S5 --> I5["repository behavior"]
  I5 --> R5["Review risk: Repository file: 20261002-strix-sandbox-lifecycle-diagnostics.md"]
  R5 --> V5["required checks"]
  Evidence --> S6["Repository file: CHANGELOG.md"]
  S6 --> I6["repository behavior"]
  I6 --> R6["Review risk: Repository file: CHANGELOG.md"]
  R6 --> V6["required checks"]
  Evidence --> S7["Docs: package-description-boundary.md (3 files)"]
  S7 --> I7["operator or user guidance"]
  I7 --> R7["Review risk: Docs: package-description-boundary.md (3 files)"]
  R7 --> V7["docs review"]
  Evidence --> S8["CI script: package_description_boundary.py"]
  S8 --> I8["review and security gate shell path"]
  I8 --> R8["Review risk: CI script: package_description_boundary.py"]
  R8 --> V8["bash -n plus Strix self-test"]
  Evidence --> S9["CI script: strix_quick_gate.sh"]
  S9 --> I9["review and security gate shell path"]
  I9 --> R9["Review risk: CI script: strix_quick_gate.sh"]
  R9 --> V9["bash -n plus Strix self-test"]
  Evidence --> S10["CI script: strix_timeout_compat.py"]
  S10 --> I10["review and security gate shell path"]
  I10 --> R10["Review risk: CI script: strix_timeout_compat.py"]
  R10 --> V10["bash -n plus Strix self-test"]
  Evidence --> S11["CI script: test_strix_quick_gate.sh"]
  S11 --> I11["review and security gate shell path"]
  I11 --> R11["Review risk: CI script: test_strix_quick_gate.sh"]
  R11 --> V11["bash -n plus Strix self-test"]
  Evidence --> S12["Test: strix_login_as_guest_1_5_3.LICENSE.txt (2 files)"]
  S12 --> I12["regression suite"]
  I12 --> R12["Review risk: Test: strix_login_as_guest_1_5_3.LICENSE.txt (2 files)"]
  R12 --> V12["targeted test run"]
  Evidence --> S13["Test: test_audit_org_codeql_coverage.py (10 files)"]
  S13 --> I13["regression suite"]
  I13 --> R13["Review risk: Test: test_audit_org_codeql_coverage.py (10 files)"]
  R13 --> V13["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 44eba247e76ae5be5c32927a1374c70aca328557
• Workflow run: 38507530699
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: fix(strix): record cached sandbox lifecycle diagnostics #2573 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.