fix(strix): persist 1.5.3 reports and watch the hashed lock

.github/workflows/strix-changed-path-quality-ci.yml

@@ -5,11 +5,18 @@ on:
     branches: [main]
     paths:
       - ".github/workflows/strix-changed-path-quality-ci.yml"
+      - ".github/workflows/strix.yml"
       - "CHANGELOG.md"
+      - "docs/doctoring/strix-agent-cryptography-override.md"
       - "docs/doctoring/strix-legal-git-paths.md"
       - "docs/doctoring/strix-quality-timeout-fixtures.md"
+      - "requirements-strix-ci-hashes.txt"
+      - "requirements-strix-ci-overrides.txt"
+      - "requirements-strix-ci.txt"
+      - "scripts/ci/compile_strix_ci_lock.sh"
       - "scripts/ci/strix_quick_gate.sh"
       - "scripts/ci/test_strix_quick_gate.sh"
+      - "tests/test_strix_agent_cryptography_override.py"
       - "tests/test_strix_changed_path_policy.py"
       - "tests/test_strix_workflow_dependency_hashes.py"
       - "tests/test_strix_quality_timeout_fixture_budget.py"
@@ -66,6 +73,6 @@ jobs:
           test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
           python -m coverage run -m pytest tests -q
           bash scripts/ci/test_strix_quick_gate.sh
-          python -m compileall -q tests/test_strix_changed_path_policy.py tests/test_strix_workflow_dependency_hashes.py tests/test_strix_quality_timeout_fixture_budget.py
+          python -m compileall -q tests/test_strix_agent_cryptography_override.py tests/test_strix_changed_path_policy.py tests/test_strix_workflow_dependency_hashes.py tests/test_strix_quality_timeout_fixture_budget.py
           bash -n scripts/ci/strix_quick_gate.sh
           git diff --exit-code

.github/workflows/strix.yml

@@ -543,7 +543,24 @@ jobs:
           # private install umask before creating the credential-bearing Strix
           # entry point; the runtime gate still rejects any later relaxation.
           umask 022
-          python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt
+          # The compiled lock is the complete closed set. --no-deps is required
+          # so pip does not re-apply strix-agent's stale cryptography<49 bound
+          # after the CVE-50 override was resolved at compile time.
+          python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes --no-deps -r requirements-strix-ci-hashes.txt
+          python3 - <<'PY'
+          import importlib.metadata as metadata
+          import sys
+
+          expected = {"strix-agent": "1.5.3", "cryptography": "50.0.0"}
+          for name, version in expected.items():
+              loaded = metadata.version(name)
+              if loaded != version:
+                  print(
+                      f"::error::Installed {name}=={loaded}, expected {version}.",
+                      file=sys.stderr,
+                  )
+                  sys.exit(1)
+          PY
           strix_executable="$(command -v strix || true)"
           if [ -z "$strix_executable" ] || [[ "$strix_executable" != /* ]] \
             || [ ! -f "$strix_executable" ] || [ -L "$strix_executable" ] \

AGENTS.md

@@ -5,3 +5,4 @@
 
 Materialize accepts only exact SHA-256 pins or a bounded relative `-r` include (no `.`/`..`); a lone `--require-hashes` directive is not trust evidence. See [`docs/doctoring/hourly-nvidia-nim-autofix.md`](docs/doctoring/hourly-nvidia-nim-autofix.md).
 Conflict-scope roots fail closed when the immediate parent directory is a symbolic link.
+Strix installs `strix-agent==1.5.3` with `cryptography==50.0.0` from the hashed lock using `--no-deps`. See [`docs/doctoring/strix-agent-cryptography-override.md`](docs/doctoring/strix-agent-cryptography-override.md).

ARCHITECTURE.md

@@ -25,6 +25,13 @@ flowchart LR
   Products -->|"standalone or as module"| Buyer
 ```
 
+## Strix 1.5.3 + cryptography 50 lock
+
+The required Strix installer consumes the complete hashed lock with
+`--no-deps` and fail-closes unless `strix-agent==1.5.3` and
+`cryptography==50.0.0` are the installed versions. Quality CI retriggers
+when the compile input, override, or lock changes.
+
 ## Hourly NVIDIA NIM repair gate
 
 ```mermaid

CHANGELOG.md

@@ -26,6 +26,7 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
+- Install the complete hashed Strix lock with `--no-deps` so `strix-agent==1.5.3` cannot re-apply `cryptography<49` after the CVE-50 override, and watch the compile inputs so lock drift retriggers quality CI.
 - Materialized base Python locks only when every package line is an exact SHA-256 pin or a bounded relative `-r`/`--requirement` include. A lone `--require-hashes` directive, a dotted include such as `./lock.txt`, or `-r other-hashes.txt` no longer enters the trusted build context.
 - Refused a conflict-scope repository root whose immediate parent is a symbolic link, so a swapped parent cannot redirect the canonical worktree after the last-component check (CWE-367).
 - Bounded the Strix quality self-test's deterministic timeout fixtures to 3-second process and 5-second fake-sleep budgets so exact-head policy evidence completes inside the existing job limit without changing production Strix scanner timeouts, providers, credentials, or review semantics.

CLAUDE.md

@@ -114,6 +114,9 @@ repeatable compile command.
   without running the test suite will break CI.
 - **100% coverage and 100% docstrings on `scripts/ci/`** are hard gates, not aspirations. New helper
   code needs matching tests and docstrings.
+- **Strix lock:** compile with `scripts/ci/compile_strix_ci_lock.sh` and
+  `requirements-strix-ci-overrides.txt`. Install with `--require-hashes --no-deps`.
+  Do not let pip re-resolve `cryptography<49`.
 - **`pull_request_target` trust boundary.** The required review workflows run the *base branch's*
   trusted scripts. A PR that edits the trusted review workflows can fail its own checks until the
   base branch catches up; a same-head manual `workflow_dispatch` Strix run may supply review evidence

docs/doctoring/strix-agent-cryptography-override.md

@@ -0,0 +1,129 @@
+# Strix 1.5.3 atomic report persist + cryptography 50 override
+
+검토 기준일: **2026-08-16**
+
+## Incident
+
+The required Strix check is the central `pull_request_target` /
+`repository_dispatch` workflow in this repository. On current `main`
+(`c47afc2dc68488292c1db7c9d6f82dcd5360f181`) consumer runs still install
+`strix-agent==1.0.4` with `cryptography==50.0.0`. Recent failures that
+were re-read for this increment, not only ContextualWisdomLab/.github#952:
+
+| Consumer | Run | Observed terminal shape |
+|---|---|---|
+| ContextualWisdomLab/mightyETL#315 | [31950271564](https://github.com/ContextualWisdomLab/.github/actions/runs/31950271564) / job 95172565509 | `Tool execute not found in agent strix`, then `No Strix vulnerability report artifact was produced; log-only severity markers are incomplete evidence` |
+| ContextualWisdomLab/.github#1023 | [31952135549](https://github.com/ContextualWisdomLab/.github/actions/runs/31952135549) / job 95177171349 | `Penetration test completed` / `Vulnerabilities MEDIUM: 1`, then exit 2 and `Strix report artifacts emitted warning/fatal/denied/timeout output; failing closed` |
+| ContextualWisdomLab/noema#392 | [31950935010](https://github.com/ContextualWisdomLab/.github/actions/runs/31950935010) | required `strix` red on the same 1.0.4 lock |
+
+The fail-closed missing-artifact rule in `scripts/ci/strix_quick_gate.sh`
+(ContextualWisdomLab/.github#891) is working as designed and is not
+weakened here. Console TUI lines such as `Vulnerabilities MEDIUM: 1` are
+not a passing report.
+
+The crash-after-print shape is the 1.0.4 scanner. Upstream 1.1.0 added
+atomic CSV/MD writes, and 1.4.0+ quit after scan instead of hosting a
+local viewer. Latest PyPI release remains `strix-agent==1.5.3` and still
+declares `cryptography>=48.0.1,<49` (usestrix/strix#859, Intel macOS
+universal2 wheel). See ContextualWisdomLab/.github#952.
+
+A one-line bump is blocked because `uv pip compile` without an override
+refuses `strix-agent==1.5.3` + `cryptography==50.0.0`. Cryptography 50.0.0
+is the floor that closes CVE-2026-69247 (PKCS#7 EnvelopedData
+Bleichenbacher-style timing/error oracle in `pkcs7_decrypt_der` /
+`pkcs7_decrypt_pem` / `pkcs7_decrypt_smime`, introduced in 44.0.0). It
+also sits above CVE-2026-39892 (non-contiguous buffer overflow, fixed in
+46.0.7).
+
+## Decision
+
+1. Pin `strix-agent==1.5.3` and keep `cryptography==50.0.0`. Materialize
+   only exact SHA-256 pins or a bounded relative `-r` include; a lone
+   `--require-hashes` line is not lock evidence.
+2. Resolve the declared upper bound only at compile time through
+   `requirements-strix-ci-overrides.txt` and
+   `scripts/ci/compile_strix_ci_lock.sh`.
+3. Install the complete hashed lock with
+   `pip install --require-hashes --no-deps`. The lock already lists every
+   wheel; `--no-deps` prevents pip from re-applying the stale
+   `cryptography<49` metadata bound that would otherwise make CI
+   uninstallable. Immediately after install, the workflow fail-closes
+   unless `importlib.metadata` reports `strix-agent==1.5.3` and
+   `cryptography==50.0.0`.
+4. Do not scrape console TUI lines as a substitute report. The gate still
+   requires a durable artifact and still fail-closes on warning / fatal /
+   denied / timeout report signals.
+
+A live `pip`/`uv` install of this hashed lock with `--require-hashes
+--no-deps` imported `strix`, ran `strix --help` (including the
+non-interactive “exits on completion” path), and loaded
+`cryptography==50.0.0` together with `strix-agent==1.5.3` on CPython
+3.12.3 and 3.13.15.
+
+## Trust boundary
+
+- The fail-closed missing-artifact rule is unchanged.
+- The override file may contain only `cryptography==50.0.0`.
+- Hashes remain required. `--no-deps` is not an unhashed install.
+- NVIDIA NIM / OpenCode credentials are untouched. This path never uses
+  `COPILOT_GITHUB_TOKEN`.
+
+## Verification contract
+
+`tests/test_strix_agent_cryptography_override.py` proves the input pin,
+the singleton override, both versions in the compiled lock, the compile
+script flags, the `--no-deps` install line, the post-install
+`strix-agent==1.5.3` / `cryptography==50.0.0` metadata check, that
+quality CI retriggers when the compile input, hashed lock, override,
+or doctoring changes, and that the unchanged gate still requires
+durable `vulnerabilities/*.md` files rather than console TUI lines.
+
+## Rollback
+
+If 1.5.3 regresses a required scan, revert the pin to 1.0.4 and the
+`--no-deps` install together. Do not drop cryptography 50.0.0 to satisfy
+the stale `<49` bound.
+
+## After merge
+
+Protected `main` still installs the 1.0.4 lock with a resolver-based
+`pip install --require-hashes` (no `--no-deps`). Required Strix is
+`pull_request_target`, so this lock cannot install until
+ContextualWisdomLab/.github#969 lands the installer and hashed-lock
+`pip-audit --disable-pip` path on `main`. After both land, rebase this
+head, then a new same-head scan installs 1.5.3, persists
+`strix_runs/<run>/vulnerabilities/*.md`, and lets the existing gate
+judge that artifact (NIST SP 800-218 PW.8 third-party verification;
+CWE-754 fail-closed on missing evidence). Findings at or above
+`STRIX_FAIL_ON_MIN_SEVERITY` still fail the check. A completed scan
+with no threshold finding can go green. Do not treat console TUI
+lines such as `Penetration test completed` as a passing report.
+
+## References (APA 7th)
+
+GitHub. (2026). *Cryptography vulnerable to buffer overflow if
+non-contiguous buffers were passed to APIs (CVE-2026-39892,
+GHSA-p423-j2cm-9vmq)*. GitHub Advisory Database.
+https://github.com/advisories/GHSA-p423-j2cm-9vmq
+
+GitHub. (2026). *PKCS#7 decryption timing oracle in pyca/cryptography
+(CVE-2026-69247, GHSA-g6cj-pr64-35w5)*. GitHub Advisory Database.
+https://github.com/advisories/GHSA-g6cj-pr64-35w5
+
+MITRE. (n.d.). *CWE-208: Observable timing discrepancy*. CWE List.
+https://cwe.mitre.org/data/definitions/208.html
+
+MITRE. (n.d.). *CWE-754: Improper check for unusual or exceptional
+conditions*. CWE List. https://cwe.mitre.org/data/definitions/754.html
+
+National Institute of Standards and Technology. (2022). *Secure software
+development framework (SSDF) version 1.1: Recommendations for mitigating
+the risk of software vulnerabilities* (NIST Special Publication 800-218).
+https://doi.org/10.6028/NIST.SP.800-218
+
+National Institute of Standards and Technology. (2026).
+*CVE-2026-69247*. National Vulnerability Database.
+https://nvd.nist.gov/vuln/detail/CVE-2026-69247
+
+Strix. (2026). *strix-agent 1.5.3 release notes* (atomic CSV/MD writes;
+quit after scan). https://github.com/usestrix/strix/releases