fix(strix): normalize direct fallback and redaction pass

[seonghobae]

Summary

• normalize the Strix direct-OpenAI fallback model identifier to the provider prefix consumed by the gate
• retain the current trusted cross-provider fallback credential boundary and current-main governance documents
• combine identical provider-token redaction substitutions into one compiled regex

Verification

• current protected main base: 613a33e
• exact tree: 72fbf8a
• 1406 passed, 1 skipped, 16 subtests
• 100% statement and branch coverage
• targeted Strix smoke, bash syntax, actionlint, compileall, and diff checks pass

Supersedes the stale-history PR #1269, whose merge commit remains GitHub-DIRTY despite a clean local merge-tree. No force push or protected-branch bypass is used.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 33 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c226b870-7aa6-4b5c-81fd-36c13c486135

📥 Commits

Reviewing files that changed from the base of the PR and between 613a33e and 72fbf8a.

📒 Files selected for processing (6)

• .github/workflows/strix.yml
• .jules/bolt.md
• PR_GOVERNANCE_AUDIT.md
• scripts/ci/redact_sensitive_log.py
• scripts/ci/test_strix_quick_gate.sh
• tests/test_strix_nvidia_nim_not_found_fallback.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.

[seonghobae]

Current-head review loop

• Pull request: fix(strix): normalize direct fallback and redaction pass #1298
• Exact head checked: 72fbf8a628533bcb8f6bf6eb0e7c9d98364f5a57
• Current source review found no unresolved source defect: the fallback alias normalization and combined provider-token redaction are covered by the current gate contracts, and the current CodeRabbit/Devin findings are informational.
• The exact-head path policy is successful; the remaining scan-queue entries are queued control-plane evidence and do not justify a force merge.

Please publish a fresh substantive current-head review and eligible approval. Keep the PR on the protected path until all required evidence is current.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 72fbf8a628533bcb8f6bf6eb0e7c9d98364f5a57.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32711660221/job/97384158650)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32711660221/job/97384158650)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: strix.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: strix.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (2 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (2 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["CI script (2 files)"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script (2 files)"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test: test_strix_nvidia_nim_not_found_fallback.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_strix_nvidia_nim_not_found_fallback.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 72fbf8a628533bcb8f6bf6eb0e7c9d98364f5a57
• Workflow run: 32744627239
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 72fbf8a628533bcb8f6bf6eb0e7c9d98364f5a57.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32711660221/job/97384158650)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32711660221/job/97384158650)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: strix.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: strix.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (2 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (2 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["CI script (2 files)"]
  S3 --> I3["review and security gate shell path"]
  I3 --> R3["Review risk: CI script (2 files)"]
  R3 --> V3["bash -n plus Strix self-test"]
  Evidence --> S4["Test: test_strix_nvidia_nim_not_found_fallback.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_strix_nvidia_nim_not_found_fallback.py"]
  R4 --> V4["targeted test run"]

Loading