fix(strix): fail closed on provider evidence gaps

[seonghobae]

Summary

• fail the required Strix check whenever the trusted gate returns provider-infrastructure or report-failure evidence
• remove the outer workflow neutral-skip path that converted incomplete scans into success
• update central regression tests so provider evidence cannot be downgraded again

Evidence

• pytest -q: 1230 passed, 16 subtests passed
• bash -n scripts/ci/strix_quick_gate.sh
• actionlint .github/workflows/strix.yml
• git diff --check

This restores the repository contract that Timeout, Fatal, Warn, Denied, provider outage, and incomplete scan evidence are hard failures. No confidential local dataset was uploaded or included.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 44 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bb4b32e3-33a2-4ee4-81b3-7999d810a0c0

📥 Commits

Reviewing files that changed from the base of the PR and between 2cce96f and 13c8e17.

📒 Files selected for processing (4)

• .github/workflows/strix.yml
• scripts/ci/test_strix_quick_gate.sh
• tests/test_required_workflow_queue_contract.py
• tests/test_strix_nvidia_nim_not_found_fallback.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Review exact current head SHA 13c8e17. The outer Strix wrapper now fails closed on provider/report evidence gaps, and central regression tests were updated to assert that contract. Full central pytest passed 1230 tests plus 16 subtests; actionlint, bash syntax, and diff checks pass. Return a formal current-head verdict.

[seonghobae]

Closing as superseded by the pre-existing canonical Strix repair #1153. #1153 preserves the useful provider classification as typed STRIX_PROVIDER_UNAVAILABLE evidence while keeping the required result nonzero, covers ModelBehaviorError, updates operator documentation, and has exact-head hosted GREEN at 86c262cd9385bc9b39cf9b93fabb081f3f07bbc5 (run 32333811954, job 96319358533: 1236 passed, 16 subtests passed, quick-gate harness PASS). This PR has no unique source boundary beyond that stronger contract and its full harness is not complete.

[seonghobae]

Superseded by canonical PR #1153, which carries the typed provider-unavailable evidence and the required fail-closed result. Keeping one authoritative Strix repair avoids duplicate merge paths.