fix(strix): reserve NIM budget after GitHub Models 410 brownout - #955
fix(strix): reserve NIM budget after GitHub Models 410 brownout#955seonghobae wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughStrix의 NVIDIA NIM fallback에 Nemotron Ultra 모델과 1,800초 전용 제한을 추가했다. GitHub Models retirement brownout을 정확한 HTTP 410 증거로 분류하고, 감지 후 남은 GitHub Models fallback을 건너뛰도록 변경했다. 관련 워크플로와 회귀 테스트도 갱신했다. ChangesStrix availability flow
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: 🔴 Critical · up to Required security checks can still report success when the scan did not complete, and malformed provider-retirement signals may incorrectly alter fallback behavior. This can allow merges without authoritative security evidence, so the PR is not ready to merge until these paths are corrected. Sequence Diagram(s)sequenceDiagram
participant StrixWorkflow
participant StrixQuickGate
participant NVIDIA_NIM
participant GitHubModels
StrixWorkflow->>StrixQuickGate: fallback 모델과 프로세스 제한 전달
StrixQuickGate->>NVIDIA_NIM: Nemotron Ultra 실행
NVIDIA_NIM-->>StrixQuickGate: 실패 또는 결과 반환
StrixQuickGate->>NVIDIA_NIM: 다음 NVIDIA fallback 실행
NVIDIA_NIM-->>StrixQuickGate: 실패 또는 결과 반환
StrixQuickGate->>GitHubModels: 남은 fallback 실행
GitHubModels-->>StrixQuickGate: retirement brownout 오류 반환
StrixQuickGate->>StrixQuickGate: brownout 상태 설정
StrixQuickGate-->>StrixWorkflow: 남은 GitHub Models fallback 생략
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent Review-only request for exact current head |
|
@opencode-agent @cwl-noema-review Review-only request for exact current head |
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-github-models-retirement-brownout.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-github-models-retirement-brownout.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
13118614c6699a94aa8d60316c70406c59a7a178. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Bandit (Python SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613679/job/94496993610)
- Close Empty PR/close-empty: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613281/job/94496013532)
- CodeQL PR/Detect CodeQL languages: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613759/job/94496015256)
- Detect CodeQL languages check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613759/job/94496015256)
- Detect Python check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613679/job/94496015018)
- OSV-Scanner PR/osv-scan / osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714614164/job/94496017154)
- Python 3.10 compatibility contract check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613633/job/94496014833)
- Python 3.14 full quality gate check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613633/job/94496014574)
- Python Security/Bandit (Python SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613679/job/94496993610)
- Python Security/Detect Python: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613679/job/94496015018)
- Python Security/pip-audit (Python dependency audit): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613679/job/94496993822)
- SAST Semgrep/Semgrep (multi-language SAST): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613617/job/94496014640)
- SBOM Generation/generate-sbom: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613699/job/94496015159)
- Scorecard PR/Scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613757/job/94496015129)
- Scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613757/job/94496015129)
- Secret Scan/gitleaks (secret scan): CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613651/job/94496015124)
- Security Scan/dependency-review: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015214)
- Security Scan/osv-scan: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015211)
- Security Scan/scorecard: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015240)
- Security Scan/trivy-fs: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015278)
- Semgrep (multi-language SAST) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613617/job/94496014640)
- Strix Changed Path Quality CI/exact-head-path-policy: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613636/job/94496014766)
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613227/job/94614112964)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613227/job/94614112964)
- Trusted uv Materializer Quality CI/Python 3.10 compatibility contract: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613633/job/94496014833)
- Trusted uv Materializer Quality CI/Python 3.14 full quality gate: CANCELLED (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613633/job/94496014574)
- close-empty check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613281/job/94496013532)
- coverage-source-tree check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613239/job/94496985204)
- dependency-review check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015214)
- exact-head-path-policy check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613636/job/94496014766)
- generate-sbom check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613699/job/94496015159)
- gitleaks (secret scan) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613651/job/94496015124)
- osv-scan / osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714614164/job/94496017154)
- osv-scan check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015211)
- pip-audit (Python dependency audit) check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613679/job/94496993822)
- required-workflow-bootstrap check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613239/job/94496014164)
- scorecard check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015240)
- trivy-fs check run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/31714613706/job/94496015278)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-github-models-retirement-brownout.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-github-models-retirement-brownout.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (4 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (4 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
Returned to Draft because the exact current tree mixes the Strix provider-family/budget repair with an unrelated trusted-uv materializer branch. The intended resilience boundary is narrow: reserve bounded compute for multiple hosted NIM candidates, classify only the exact same-line GitHub Models HTTP-410 retirement brownout as family-dead, and never neutralize vulnerability findings or generic application 410s. Head Rebuild from protected |
|
Additional exact downstream evidence for this central fix:
This is owning-layer provider-budget evidence, not a backend/source finding in fast-mlsirm #831. The observed 5,400-second first NIM attempt exhausted the entire scan budget exactly as this PR's 1,800-second per-attempt cap is intended to prevent. Preserve fail-closed missing-report behavior; after protected integration, rerun the unchanged #831 head and require either an authoritative clean/finding report or bounded fallback exhaustion rather than a single-model full-budget timeout. |
|
@coderabbitai review Review only exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head_expected='2efd7d8607527cacde2aeeb33f3accc02c8367c3'
base_expected='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
printf '%s\n' '== checked-out HEAD =='
git rev-parse HEAD
printf '%s\n' '== expected objects =='
git cat-file -t "$head_expected"
git cat-file -t "$base_expected"
printf '%s\n' '== ancestry and merge base =='
git merge-base "$base_expected" "$head_expected"
git merge-base --is-ancestor "$base_expected" "$head_expected" && echo 'base-is-ancestor=yes'
printf '%s\n' '== changed files =='
git diff --name-status "$base_expected" "$head_expected"
printf '%s\n' '== changed paths: outlines =='
git diff --name-only "$base_expected" "$head_expected" | while IFS= read -r path; do
printf '\n--- %s ---\n' "$path"
case "$path" in
*.yml|*.yaml) ast-grep outline "$path" --lang yaml --items all 2>/dev/null || true ;;
*.py) ast-grep outline "$path" --lang python --items all 2>/dev/null || true ;;
*.sh) ast-grep outline "$path" --lang bash --items all 2>/dev/null || true ;;
*) sed -n '1,80p' "$path" ;;
esac
done
printf '%s\n' '== full scoped diff =='
git diff --find-renames --find-copies --unified=80 "$base_expected" "$head_expected"Length of output: 164645 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='2efd7d8607527cacde2aeeb33f3accc02c8367c3'
printf '%s\n' '== workflow neutralization block with line numbers =='
git show "$head:.github/workflows/strix.yml" |
nl -ba |
sed -n '/backend_unavailable_signal=/,/exit "\$strix_rc"/p'
printf '%s\n' '== gate brownout classifier and fallback handling with line numbers =='
git show "$head:scripts/ci/strix_quick_gate.sh" |
nl -ba |
sed -n '/is_github_models_retirement_brownout_error()/,/^}/p;/skip_remaining_github_models=0/,/if should_fail_pull_request_infra_zero_findings/p'
printf '%s\n' '== regression assertions for workflow-level neutralization =='
git show "$head:tests/test_strix_github_models_retirement_brownout.py" |
nl -ba |
sed -n '1,220p'
printf '%s\n' '== current PR status checks =='
gh api "repos/ContextualWisdomLab/.github/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // ""), .details_url] | `@tsv`' || trueLength of output: 1372 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='2efd7d8607527cacde2aeeb33f3accc02c8367c3'
printf '%s\n' '== workflow neutralization block with line numbers =='
git show "$head:.github/workflows/strix.yml" |
awk '
/backend_unavailable_signal=/ {show=1}
show {printf "%6d %s\n", NR, $0}
show && /exit "\$strix_rc"/ {exit}
'
printf '%s\n' '== gate brownout classifier with line numbers =='
git show "$head:scripts/ci/strix_quick_gate.sh" |
awk '
/^is_github_models_retirement_brownout_error\(\)/ {show=1}
show {printf "%6d %s\n", NR, $0}
show && /^}$/ {exit}
'
printf '%s\n' '== workflow-level brownout regression coverage =='
git show "$head:tests/test_strix_github_models_retirement_brownout.py" |
awk '{printf "%6d %s\n", NR, $0}'
printf '%s\n' '== current PR status checks =='
if command -v gh >/dev/null 2>&1; then
gh api "repos/ContextualWisdomLab/.github/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // ""), .details_url] | `@tsv`' || \
echo 'GitHub check query was unavailable.'
else
echo 'GitHub CLI is unavailable in this sandbox.'
fiLength of output: 21690
The reviewed checkout equals the requested head. The requested base is its ancestor. Current required checks are queued or in progress, so they are not acceptance evidence.
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
2efd7d8607527cacde2aeeb33f3accc02c8367c3. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31808101914/job/94791817357)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31808101914/job/94791817357)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-github-models-retirement-brownout.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-github-models-retirement-brownout.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
2efd7d8607527cacde2aeeb33f3accc02c8367c3. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31808101914/job/94791817357)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31808101914/job/94791817357)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (4 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (4 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-github-models-retirement-brownout.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-github-models-retirement-brownout.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
@opencode-agent @cwl-noema-review @coderabbitai review Review exact head |
Rate Limit Exceeded
|
|
Exact-current-head read-only review request for The current head is an owner-authored metadata-only rebind of the verified Submit a verdict for this unchanged content/current head only. Treat predecessor checks/reviews as historical. Do not mutate or merge the branch, synthesize author approval, or weaken protection. @opencode-agent review |
Rate Limit Exceeded
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
1eb99cdff72fa30ea4df1ea45a2643759ef3f876. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31887079389/job/95017850623)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31887079389/job/95017850623)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-github-models-retirement-brownout.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-github-models-retirement-brownout.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
1eb99cdff72fa30ea4df1ea45a2643759ef3f876. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31887079389/job/95017850623)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31887079389/job/95017850623)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: strix.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: strix.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: strix-github-models-retirement-brownout.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: strix-github-models-retirement-brownout.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (3 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (3 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
New same-class canary from ContextualWisdomLab/scopeweave#523: exact head |
|
The bounded no-head-churn retry has now reproduced the same false-green contract on a second ScopeWeave canary. |
|
A third unchanged-head ScopeWeave canary reproduces the same false-green security contract: |
|
Fresh ScopeWeave #508 also reproduces the same false-green contract on a materially different product slice. Exact unchanged head |
|
Fresh same-class consumer evidence from ScopeWeave confirms this central Strix contract defect on a third repository/head and gives an exact acceptance canary.
This is infrastructure/provider evidence, not a ScopeWeave source vulnerability. ScopeWeave deliberately treats that exact check as non-passing despite GitHub's Please include this exact consumer identity in the protected-main acceptance set for the central repair: after this PR integrates, rerun Strix against the unchanged #523 head if it still exists (or its freshly reconciled successor). Acceptance is either (a) a real complete source-backed scan with coherent passing evidence or (b) explicit non-passing provider/infrastructure unavailability; |
|
Fresh ScopeWeave canaries reproduce the same central false-green Strix contract on exact current heads. |
|
Fresh ScopeWeave consumer reproductions for the current Strix false-green contract: ScopeWeave #545 — repeated exact-head retry still false-green
This is stronger than a one-off transient observation: an exact-head rerun produced the same contradiction. Under fail-closed merge evidence, neither ScopeWeave #523
These are independent current ScopeWeave consumer heads demonstrating the same control-plane evidence contradiction #955 is intended to eliminate. They are not ScopeWeave source vulnerabilities and should not generate fabricated path/line findings. Acceptance after the central repair reaches protected |
|
Fresh ScopeWeave canary for the existing Strix false-green repair matrix:
This head is otherwise mechanically current against protected |
|
Fresh ScopeWeave canary evidence reproduces the same central Strix false-green contract on two independent unchanged exact heads. This is control-plane evidence only; no ScopeWeave source vulnerability is inferred.
Acceptance for these ScopeWeave canaries after #955 reaches protected |
|
@opencode-agent Please repair the EXISTING owner branch for exact current head |
|
Fresh ScopeWeave consumer reproduction for the existing Strix false-green boundary:
This is the same control-plane contradiction already described in this PR: no completed security scan exists, so the green conclusion is non-authoritative merge-readiness evidence. I have rerun the exact ScopeWeave Strix job without changing its clean head; acceptance is either a real completed exact-head scan or an explicit non-passing provider/infrastructure outcome under this central repair. No ScopeWeave leaf workaround or fabricated source finding was introduced. |
|
Fresh same-class consumer evidence from
This is infrastructure/provider evidence, not a ScopeWeave source vulnerability. Acceptance for this exact defect class remains: provider exhaustion before a complete scan must yield an explicit non-passing unavailable/infrastructure result and must not satisfy required merge-readiness. After this central repair reaches protected |
|
Fresh ScopeWeave consumer canary for this central Strix contract (2026-08-18 KST): |
|
Fresh ScopeWeave consumer evidence reproduces this exact false-green provider-unavailability boundary and should be included in the existing owner acceptance lane.
This is control-plane evidence contradiction, not a ScopeWeave source vulnerability. ScopeWeave is therefore treating that check as non-passing despite the GitHub Acceptance after this central repair reaches protected |
|
Fresh ScopeWeave canary for the same false-green Strix provider-unavailable contract: |
|
Fresh ScopeWeave consumer canary for the same fail-closed Strix contract:
This reproduces the same evidence contradiction already described here from another dedicated consumer repository; it is not a ScopeWeave source vulnerability. Please include this unchanged (or freshly reconciled descendant) ScopeWeave head in post-merge operational acceptance for this owner repair. Acceptance is either a real complete source-backed Strix scan or an explicit non-passing provider/infrastructure state; Also note the current CodeRabbit review on this exact central head |
|
Fresh ScopeWeave canary after both consumer head and protected base moved; this supersedes the earlier ScopeWeave #523 identities for operational revalidation only.
This is the same central false-green contract, now reproduced on the current #523 head. Acceptance for the owner repair remains test-first: provider exhaustion before a complete scan must yield a typed non-passing provider/infrastructure result; complete clean scans may pass; real source findings remain fail-closed and source-backed. After #955 integrates to protected |
|
Fresh consumer-owner evidence from ScopeWeave: central protected |
|
Fresh Context Fabric consumer reproduction on Exact identities
Observed first failing boundary The trusted wrapper correctly logged that this was not clean evidence — RED acceptance Smallest central remedy GREEN / Context Fabric revalidation |
2 participants
Purpose
Required Strix runs can fail before producing source-backed security evidence when a hosted model/provider consumes the scan budget, a provider family becomes unavailable, or the backend cannot warm/connect/rate-limit successfully. The control plane must distinguish those provider/infrastructure failures from both actionable source vulnerabilities and successful security scans.
The original incident was a primary hosted NVIDIA attempt consuming nearly the full process budget followed by the GitHub Models scheduled-retirement HTTP 410 signal. Fresh Inkspan consumer evidence now proves a second same-class contract defect: required Strix checks can conclude
successwhile their own annotations say the Strix backend was unavailable and the scan was treated as a neutral skip so the outage would not block merges.Bounded repair
Ultra-253B → Super-49B → GitHub Models, preserving the protected-mainSuper-49B → GitHub Modelssmoke contract while reserving a second hosted NVIDIA attempt;github_models_retirement_brownoutplus GitHub Models context plus HTTP 410 as family-dead, then skip remaininggithub_models/*candidates;NVIDIA_NIM_API_KEY; never addCOPILOT_GITHUB_TOKENor merge reviewer credential chains.A provider/backend outage may trigger bounded provider fallback, but it must never become successful merge-readiness evidence merely because no vulnerability report was produced. If all governed providers are exhausted or unavailable before a complete scan, emit an explicit typed non-passing infrastructure/provider state that remains separate from source vulnerability findings.
Exact identity and scope
main@c47afc2dc68488292c1db7c9d6f82dcd5360f181;69850cdbb8b9f5791ae6b216366ee630bff24721;CHANGELOG.md.The body previously named predecessor head
1eb99cdff72fa30ea4df1ea45a2643759ef3f876as current. That claim is superseded; no check, review, or approval from that or any earlier head transfers to69850cdb....Fresh Inkspan consumer contradictions
Two independent current Inkspan heads reproduce the same false-green provider-unavailability boundary.
Inkspan #188
ContextualWisdomLab/inkspan#188exact headc72e9255aaa8865c6e01708c5bc3626136dfc973has required Strix workflow run31951728796recorded as successful, but the bound Strix check annotation states:Strix backend unavailable;Inkspan #155
ContextualWisdomLab/inkspan#155exact head52f7a1c3c0d0c59b27f7bef7168905a728a77da5independently reproduces the same semantics. Strix check run95155716435/ workflow run31943399053concludedsuccess, while its annotation saysStrix backend unavailableand explicitly states the incomplete scan was treated as a neutral skip so the outage would not block merges.These are control-plane evidence contradictions, not Inkspan source vulnerabilities. A required security scan did not complete on either head, so
successcannot be authoritative merge-readiness evidence for those executions.Required test-first convergence
Before this lane can be treated as operationally complete, add or preserve deterministic regressions proving all of the following:
success,neutral-success, or a fabricated source finding;The regression must include at least the exact neutral-skip outcome now demonstrated by Inkspan #188 and #155 so this cannot regress to a green required check under another provider outage.
Do not broadly catch provider/model exceptions, convert unknown failures to success, weaken the required Strix workflow, or invent
path:linefindings from infrastructure evidence.Evidence lineage
Predecessor trees passed focused brownout regressions and required-workflow smoke contracts. Those results establish lineage only. The current head
69850cdb...must regenerate terminal-success exact-head quality, security, SAST, dependency/SBOM, supply-chain, and semantic-review evidence after any source change.GREEN operational acceptance
After the central repair reaches protected
main, rerun then-current unchanged affected Inkspan heads. Acceptance requires one of two explicit outcomes for each canary:A successful workflow whose own bound annotation says the security scan never completed is not acceptance.
Merge gate
Merge or auto-merge only after the unchanged final head has terminal required gates whose security semantics actually completed, zero valid unresolved findings, a qualifying current-head semantic verdict, the independent non-author approvals and last-push approval required by live protection, a compatible live base, and ordinary expected-head merge authority. No admin merge, self-approval, review dismissal, predecessor-evidence transfer, or ruleset bypass is requested.
Summary by CodeRabbit
개선 사항
문서