fix(strix): bump strix-agent 1.0.4 -> 1.5.3, override its cryptography<49 pin

.github/workflows/python-security.yml

@@ -236,9 +236,37 @@ jobs:
 
           # Audit every discovered requirements file.
           while IFS= read -r req; do
-            echo "::group::pip-audit -r ${req}"
-            pip-audit --strict --desc=on -r "${req}" || status=1
-            echo "::endgroup::"
+            # A matching requirements-<tool>-ci-overrides.txt (a `uv pip compile --override`
+            # input, e.g. requirements-strix-ci-overrides.txt) means the *-hashes.txt this
+            # override applies to pins a version whose declared metadata range intentionally
+            # conflicts with another pin in the same file (verified safe at override time, not a
+            # resolution mistake). pip's own dependency resolver -- which pip-audit's default
+            # `-r` mode still calls even for fully hash-pinned files -- fails on that same
+            # declared-range conflict regardless of --require-hashes, and plain --no-deps does
+            # not suppress it (confirmed: --no-deps only skips fetching undeclared transitive
+            # packages, pip's resolver still cross-checks the packages that *are* listed
+            # together). --disable-pip bypasses pip's resolver entirely and audits the exact
+            # pins directly, but it requires every requirement to be an exact version (raises on
+            # any bare range) -- true for the compiled *-hashes.txt, not necessarily true for the
+            # hand-maintained raw input (e.g. requirements-strix-ci.txt intentionally leaves
+            # protobuf as a range). So: hashed output files with an override get
+            # --disable-pip --no-deps; their raw, non-hash input counterpart is skipped here
+            # (it is never itself a `pip install --require-hashes` target -- only its compiled
+            # *-hashes.txt is installed -- and that compiled file is the one audited with full
+            # transitive coverage).
+            base="${req%.txt}"
+            unhashed_base="${base%-hashes}"
+            if [ "$base" != "$unhashed_base" ] && [ -f "${unhashed_base}-overrides.txt" ]; then
+              echo "::group::pip-audit -r ${req} (--disable-pip --no-deps: overridden lock)"
+              pip-audit --strict --desc=on --no-deps --disable-pip -r "${req}" || status=1
+              echo "::endgroup::"
+            elif [ "$base" = "$unhashed_base" ] && [ -f "${unhashed_base}-overrides.txt" ]; then
+              echo "::notice::Skipping pip-audit for ${req}: it is the raw input to an overridden lock (${unhashed_base}-hashes.txt), never itself a pip install --require-hashes target, and its compiled hashes file is audited separately with full resolution."
+            else
+              echo "::group::pip-audit -r ${req}"
+              pip-audit --strict --desc=on -r "${req}" || status=1
+              echo "::endgroup::"
+            fi
           done < <(find . -type f -name 'requirements*.txt' -not -path './.git/*')
 
           # Audit the project itself when a PEP 621 / lock manifest exists.

.github/workflows/strix.yml

@@ -543,7 +543,12 @@ jobs:
           # private install umask before creating the credential-bearing Strix
           # entry point; the runtime gate still rejects any later relaxation.
           umask 022
-          python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes -r requirements-strix-ci-hashes.txt
+          # --no-deps: strix-agent declares cryptography<49, conflicting with this repo's
+          # cryptography==50.0.0 pin (CVE-2026-39892 fix, see requirements-strix-ci-overrides.txt).
+          # --require-hashes already pins every package (including transitive deps) to an exact,
+          # hash-verified version, so skipping pip's redundant declared-range resolution here is
+          # safe -- verified locally with --dry-run against this exact file before pushing.
+          python3 -m pip install --disable-pip-version-check --no-cache-dir --require-hashes --no-deps -r requirements-strix-ci-hashes.txt
           strix_executable="$(command -v strix || true)"
           if [ -z "$strix_executable" ] || [[ "$strix_executable" != /* ]] \
             || [ ! -f "$strix_executable" ] || [ -L "$strix_executable" ] \

CLAUDE.md

@@ -60,7 +60,9 @@ Details: `README.md` and `PR_GOVERNANCE_AUDIT.md`.
   configuration (GitHub Models provider, CodeGraph/DeepWiki/Context7/web-search MCP). All reviewer
   agents have `"edit": "deny"`: they are reviewers, never implementers. Keep it that way.
 - `requirements-{bandit,pip-audit,strix,opencode-review}-ci.txt` + `*-hashes.txt` — pinned CI
-  dependency sets (see below).
+  dependency sets (see below). `requirements-strix-ci-overrides.txt` documents one deliberate
+  `uv pip compile --override` (strix-agent's declared `cryptography<49` vs. this repo's
+  `cryptography==50.0.0` security pin; see #952) — re-verify it whenever strix-agent bumps again.
 - `fuzz/` + `.clusterfuzzlite/` — Atheris fuzz targets for the review-output normalizer and the
   ClusterFuzzLite discovery marker.
 - `docs/` — master context, Project protocol, `org-required-workflow-rollout.md`,
@@ -96,7 +98,7 @@ e.g.:
 ```bash
 uv pip compile --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 requirements-bandit-ci.txt -o requirements-bandit-ci-hashes.txt
 uv pip compile --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 requirements-pip-audit-ci.txt -o requirements-pip-audit-ci-hashes.txt
-uv pip compile --generate-hashes --python-version 3.13 --python-platform x86_64-manylinux_2_28 --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt
+uv pip compile --generate-hashes --python-version 3.13 --python-platform x86_64-manylinux_2_28 --override requirements-strix-ci-overrides.txt --output-file requirements-strix-ci-hashes.txt requirements-strix-ci.txt
 ./scripts/ci/compile_opencode_review_lock.sh
 ```