feat(strix): map official scan modes from dual-flow events

[seonghobae]

The org-required Strix workflow always inherited Quick because .github/workflows/strix.yml never set STRIX_SCAN_MODE. The gate already forwards that variable as strix -n -t . --scan-mode $SCAN_MODE.

CWL runs both GitHub Flow (main/master) and Git Flow (develop) without a consistent RC-tag, prerelease, or GitHub release-event convention. RankWeave forbids prerelease GitHub Releases. This PR therefore does not invent release: or v*-rc* triggers.

Event → official CLI mode

Official Strix modes are only quick, standard, and deep (no normal alias). CWL keeps choosing explicitly; the CLI default is deep.

Event	Mode	Budget
pull_request_target	quick	120 / 100 / 90 min / 95 min
repository_dispatch strix-scan	quick	same (PR-metadata-bound same-head evidence)
push to develop	quick	same (high-frequency Git Flow integration)
push to main or master	standard	same (closest thing to a release in both flows)
schedule (Monday 03:00 UTC)	standard	same (Standard is 30–60 min; current budget is honest)
workflow_dispatch scan_mode	chosen (quick / standard / deep, default standard)	Deep only: 360 / 340 / 4 h / 4.5 h

repository_dispatch cannot inherit Standard from github.ref. A dispatch SHA is the default branch and is often main; the mapping requires github.event_name == 'push' before treating main/master as Standard.

Deep is allowed only on the restored workflow_dispatch path. The required PR job stays on the 120-minute budget. The Deep raise uses the GitHub-hosted 360-minute ceiling and leaves about 20 minutes after the 340-minute step for artifact and status publication.

What did not change

• Fail-closed missing-artifact, unmapped-findings, and infrastructure-error behavior
• PR scoping and STRIX_FAIL_ON_MIN_SEVERITY: MEDIUM
• pull_request_target still executes trusted base scripts only
• repository_dispatch strix-scan remains PR-metadata-bound and cannot scan a branch/tag RC
• Hashed-lock installer line (pip install --require-hashes / the region PRs fix(strix): install hashed locks without pip re-resolution #969 and fix(strix): persist 1.5.3 reports without dropping cryptography 50 #961 edit)
• strix-agent version and lock files

require_safe_scan_mode now allowlists quick|standard|deep and rejects normal.

Overlap check (scan-mode policy unchanged)

This branch stays based on main and does not take neighbor work:

PR	Their hunk	This branch
#969 / #961 / #1047 / #1051	Install Strix pip install --require-hashes / --no-deps / cryptography 50 pin	Install step is byte-identical to main
#1009	STRIX_TARGET_PATH, STRIX_DISABLE_PR_SCOPING, fail-closed wrapper	Those env lines and the post-budget wrapper still match main
#955	STRIX_FALLBACK_MODELS Ultra-253B, nim_process_budget_seconds=1800	Fallback line matches main; no NIM process-cap lines added
#939	fail-closed backend-unavailable wrapper; PR-scope --instruction	Wrapper matches main; gate command line unchanged except the mode allowlist

Shared surface only: this PR renames Run Strix (quick) → Run Strix and replaces the 5400/5700 prelude with a Deep-only if/else in the same run: block. On merge, keep this mapping/timeout/workflow_dispatch and take their scoping / fallback / fail-closed / NIM-cap hunks as-is. Do not duplicate them here.

Tests

• tests/test_strix_scan_mode_policy.py pins the mapping expression and fails if Deep timeouts apply to the required PR job
• scripts/ci/test_strix_quick_gate.sh and the required-workflow smoke test assert the same contract
• Queue-contract tests allow workflow_dispatch only on strix.yml, and only as a scan_mode choice

Doctoring record: docs/doctoring/strix-scan-mode-dual-flow.md.

  

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b1ba4c6b-978a-40b9-934d-fccb8cbd792f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Verdict: COMMENT — do not mark ready until exact-head quality is green

No defect maps required pull_request_target / repository_dispatch to Standard or Deep, applies the 360/340/4h/4.5h budget to the required PR job, lets repository_dispatch inherit Standard from github.ref, or widens the pull_request_target job token. Official names are only quick|standard|deep; normal fails closed before the scanner starts.

Do not APPROVE while this PR is draft and exact-head strix-changed-path-quality-ci on 1e3f85c2835e1ef5a3cb951d377e147c214bb45e is unfinished. Do not REQUEST_CHANGES: the event→mode contract is correct.

CodeRabbit skipped this draft. Local mapping/queue/hash contracts passed (39).

What is sound

• STRIX_SCAN_MODE requires github.event_name == 'push' before main/master becomes Standard, so a repository_dispatch SHA on the default branch stays Quick.
• Job/step fromJSON(...) and the process/total budgets raise only when workflow_dispatch + scan_mode=deep. A mis-set STRIX_SCAN_MODE=deep on PRT keeps 5400/5700.
• Fail-closed PR scoping, STRIX_FAIL_ON_MIN_SEVERITY: MEDIUM, hashed-lock installer, and trusted-base script execution are unchanged.
• Commit 1e3f85c correctly replaced the newline grep needle that treated every file as a release trigger.

Residual risk to land on this head (not a second PR)

1. Branch-selected YAML. Restoring workflow_dispatch on privileged strix.yml re-opens GitHub's Branch dropdown / --ref path. After this file is on the default branch, a writer can dispatch a feature-branch revision; that revision supplies the workflow definition before the trusted checkout, with STRIX_* / NVIDIA_NIM_* / GCP_SA_KEY / merge tokens and id-token: write. A job-level if: on main does not stop a malicious selected revision. Write access is the only control. Record that residual in the doctoring record, or move Deep to a non-pull_request_target workflow that is not this privileged file.
2. Merge-scheduler parking. strix_evidence_state() treats any Strix Security Scan check run as required evidence. A manual Deep on a PR head can hold an approved PR for up to six hours. Do not fold the scheduler change into this slice; it is a follow-up on main.
3. Tautological mapping table. test_dual_flow_event_maps_to_official_mode reimplements the policy in Python if/elif and never evaluates the pinned expression. Keep the exact-string pin; bind the table to that string (or drop the Python mirror).
4. Org-wide minutes. Every sibling push to main/master moves from inherited Quick to official Standard. Any writer can start a 360-minute Deep job. Call that out as a capacity change before first org-wide use.

PR_GOVERNANCE_AUDIT.md and docs/org-required-workflow-rollout.md do not currently claim “Strix is always Quick” or “no workflow_dispatch on strix.yml”, so they are not stale in a failing-test sense. Durable policy for this change is the new doctoring record.

Next action

Keep #1054 as the only landing vehicle. After exact-head quality and the required Strix smoke are green on 1e3f85c, add the doctoring residual-risk sentences and bind the mapping table to SCAN_MODE_EXPRESSION on this branch, then mark ready. Do not add release:, v*-rc*, client_payload.scan_mode, or a second same-slice PR. Do not Deep-dispatch a PR head you want merged until the scheduler ignores workflow_dispatch check runs.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Restoring workflow_dispatch on this privileged file re-opens GitHub's Branch dropdown / gh workflow run --ref path (GitHub, n.d., Manually running a workflow). After this YAML is on the default branch, the selected revision supplies the workflow definition before the trusted-source checkout, with scanner secrets and id-token: write.

A job-level if: on main does not stop a malicious selected revision. Write access is the only control. Either record that residual in docs/doctoring/strix-scan-mode-dual-flow.md, or move Deep off this pull_request_target file. Do not add target_repository / pr_number inputs to “fix” it.