fix(strix): include backend app dependency context

[seonghobae]

Summary

• include backend/app/*.py as trusted context when a PR changes a Python module in that package
• enumerate the package from the exact PR head tree and keep changed-file attribution unchanged
• add an exact-head regression for a changed knowledge_graph.py importing an unchanged post_eligibility.py
• document the Strix context boundary and the observed LineageWeave Run eligible review dispatches immediately #192 failure

Root cause

The Strix PR scope contained changed files only. The central context list covered a different backend/api layout, so backend.app.post_eligibility was absent from the scanner input even though it existed in the PR head and base repository. Strix then reported a false MEDIUM missing-module finding. The same run also recorded NVIDIA NIM rate limits; this change does not neutralize provider failures or vulnerability findings.

Security boundary

The scanner still executes trusted central code. PR-head blobs are copied as non-executable data. The context package is not a changed-file finding boundary: only the original changed-file list is used for attribution. No credentials or untrusted workflow code are executed.

Verification

• bash -n scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh
• python3 -m unittest tests.test_strix_changed_path_policy tests.test_strix_nvidia_nim_not_found_fallback -> 14 passed
• exact-head production-gate regression with changed backend/app/knowledge_graph.py and unchanged local import -> exit 0
• git diff --check

---

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7cb8390b-09dc-4fd8-971b-f0d5f701bd88

📥 Commits

Reviewing files that changed from the base of the PR and between 55a8b57 and d9479cf.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/doctoring/strix-pr-head-context-boundary.md
• scripts/ci/strix_quick_gate.sh
• scripts/ci/test_strix_quick_gate.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Addressed the current-head review finding in commit d9479cf4.

• Trim PR_HEAD_SHA into backend_app_head_sha before validation and ls-tree enumeration.
• Fail closed if the normalized SHA is absent or invalid.
• Extended the backend/app scope regression invocation to pass surrounding whitespace, covering the previously silent dependency-context omission.

Local evidence: bash -n scripts/ci/strix_quick_gate.sh scripts/ci/test_strix_quick_gate.sh, git diff --check, and focused Python tests (14 passed). The protected current-head Checks are the final gate.

[seonghobae]

Current-head review completed at d9479cf486f731e8efe582e7b029234e05b36cae: the backend/app context block now trims PR_HEAD_SHA before validation and git ls-tree, and the Devin thread is resolved. No source change required. Continuing with exact-head Checks and the next open PR.

[seonghobae]

Stacked follow-up opened: #1192 extends the exact PR-head import-context resolver to contextual_orchestrator/*.py and covers contextual-orchestrator PR #801. Parent #1191 remains the backend/app context change.

[seonghobae]

Closing as a duplicate writer after absorbing the verified repair into the canonical Strix owner PR #1153 at exact commit 945d5d56ff826b8642c634e6cf0d14a8ec9be38a.

The canonical implementation preserves this PR's exact-head backend/app/*.py dependency-context contract and the resolved PR_HEAD_SHA whitespace regression. It additionally enumerates Git paths with git ls-tree -z and validates each path before emitting newline-delimited scanner input, so newline/control-path ambiguity fails closed. Local canonical evidence: realistic RED before the repair; complete test_strix_quick_gate: PASS; 18 related Python contracts; full central 1288 passed, 16 subtests passed; shell syntax, compileall, and git diff --check all pass. No consumer source was changed.