fix(strix): classify Caido sandbox startup failure

[seonghobae]

Summary

• classify the exact Caido loginAsGuest curl-exit-7 failure on local port 48080 as scanner infrastructure only when no vulnerability evidence exists
• preserve fail-closed handling for non-zero vulnerability counts, explicit severity markers, and arbitrary loopback failures
• document the bounded policy in the existing Strix doctoring and changelog

Root cause

ContextualWisdomLab/LineageWeave#314 run 32419230037 reported Vulnerabilities 0, then loginAsGuest failed after 10 attempts because the Strix Caido service did not accept connections on 127.0.0.1:48080. The central outer gate recognized provider outages but not this scanner-runtime startup signature, so it converted the infrastructure failure into a required-check failure.

Verification

Exact local head b172dfc16b7355c17004903de951d04f12327209 against protected main@55a8b576725451dfe0a21a57d36a2f1a41619b24:

• 1,286 pytest tests and 16 subtests passed
• 64 focused Strix workflow contracts passed
• Bash syntax and actionlint passed
• regression proves the exact zero-finding Caido signature is neutral, the same signature with a HIGH finding remains blocking, and port 48081 remains blocking

Closes #1185

---

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8eb03611-c314-46b9-b53c-6b5e6875e1ae

📥 Commits

Reviewing files that changed from the base of the PR and between 55a8b57 and b172dfc.

📒 Files selected for processing (4)

• .github/workflows/strix.yml
• CHANGELOG.md
• docs/doctoring/strix-nvidia-nim-not-found-fallback.md
• tests/test_strix_nvidia_nim_not_found_fallback.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@OpenCode review exact current head b172dfc16b7355c17004903de951d04f12327209; verify the bounded Caido signature remains subordinate to every vulnerability signal and that arbitrary loopback failures still fail closed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Closing as superseded by canonical Strix owner PR #1153. Current #1153 exact head a82b8012be5d57f99c1a2b029f08837d4d10d564 already matches the bounded one-line Caido loginAsGuest + retry count + curl exit 7 + 127.0.0.1:48080 signature and preserves real findings. Crucially, it emits typed STRIX_PROVIDER_UNAVAILABLE and retains the original nonzero result because a scan that never completed is not authoritative security success. This PR's neutral-success contract conflicts with issue #891 and recreates the false green removed by #1153.

[seonghobae]

Exact-head review renewal

• head: b172dfc16b7355c17004903de951d04f12327209
• reviewed the bounded Caido guest-login classification: only the exact loopback port 48080 startup signature is neutralized when no vulnerability evidence exists
• quality Checks are green; eight security/supply-chain Checks are queued
• no unresolved review threads and no qualifying independent approval are present

The vulnerability and arbitrary-loopback negative controls remain blocking. Merge stays subject to fresh protected Checks and independent approval.