Repository navigation
Strix required workflow resolves evidence binder from target trusted workspace instead of protected central owner #2292
Description
Symptom
BandScope PR #865 exact head 1f4877413e2eed30b224eaf1b095af3b0b905cb0 has a terminal Strix failure in job 105972205103 even though the protected central .github owner at e6334e229581a918e2f22de18733b76fa65d7e71 contains scripts/ci/strix_evidence_binding.py.
The job first passes required-workflow smoke and materializes the protected BandScope base as the trusted workspace. The model provider preflight reaches contextual-orchestrator / orchestrator/free; a later Strix model call times out, but the terminal policy failure is independent and deterministic:
ERROR: Strix evidence binder is missing: .../trusted-workspace/scripts/ci/strix_evidence_binding.py
The protected central quick gate itself documents the binder as scripts/ci/strix_evidence_binding.py. Current scripts/ci/strix_quick_gate.sh derives binder="$REPO_ROOT/scripts/ci/strix_evidence_binding.py"; under the reusable target-repository job, REPO_ROOT is the target trusted workspace rather than the protected central workflow checkout. BandScope correctly does not carry this central CI implementation file, so the required gate exits 2 before it can produce/classify review evidence.
Why this is an owner defect
This binder is part of the central Strix evidence-binding/runtime contract, not application source. Copying it into every consumer repository would duplicate the canonical owner and make required-workflow behavior depend on an undeclared target-repository implementation detail. Weakening or skipping the binder is also invalid because it is the mechanism that classifies pr_delta / repository_baseline / context_dependency and sanitizes unsupported remediation claims.
The BandScope #865 lane has therefore recorded this as a central owner prerequisite and is not adding a local copy or blind-rerunning Strix.
Expected repair
Resolve the binder (and any companion central runtime dependency) from the exact protected .github checkout/materialized central runtime used by the required workflow, while continuing to evaluate target-repository changed-file/base evidence against the trusted target workspace. Add a contract test proving a consumer repo with no scripts/ci/strix_evidence_binding.py can still run the required Strix gate from the protected central owner.
Do not change failure semantics for a genuinely missing binder in the central owner and do not fall back to mutable target-branch source.
Evidence / scope
- Consumer:
ContextualWisdomLab/bandscope#865 - Consumer exact head:
1f4877413e2eed30b224eaf1b095af3b0b905cb0 - Failed job:
105972205103 - Protected central owner inspected:
.github@e6334e229581a918e2f22de18733b76fa65d7e71 - Protected central owner does contain
scripts/ci/strix_evidence_binding.pyand its doctoring/tests. - No open
.githubissue/PR matching the exact missing-binder/trusted-workspace failure was found at filing time.
This issue is only the central required-workflow path defect. The provider timeout in the same job is a separate transient/service outcome and should not be conflated with the deterministic missing-binder exit.
Activity
test(strix): materialize specialized fixtures' trusted runtime outsid…
seonghobae commentedon Sep 21, 2026
LineageWeave provides a second exact consumer specimen for this same owner defect.
Consumer:
ContextualWisdomLab/LineageWeave#899Exact head:
c943060c7c16f74faf48d1ee40eaa5301c830065Strix workflow:
35558853933Strix job:
106321781463Artifact:
strix-reports(10656007820, SHA-256169a527d7d13852d4ffcaf99c83551893d70449c7dd89608ecc695918d211a7b)The runner, central Strix source checkout, target workspace materialization, CO sidecar provisioning,
orchestrator/freemodel path, and Strix installation all succeeded. The Strix scan itself reachedstatus=completed,scan_results.success=true, emitted a penetration report, and produced SARIF with 0 results. The wrapper still made the job terminal FAILURE because the post-scan evidence-binding stage reported:This cleanly separates the defect from provider/model execution: unlike the earlier BandScope specimen, LineageWeave completed the actual scan successfully. The failure is therefore deterministic central-runtime path ownership after scan completion, not a LineageWeave source/security finding and not a reason to copy
strix_evidence_binding.pyinto the consumer repo.Please keep the repair owner-side: resolve the binder from the protected
.githubruntime checkout, preserve target-workspace evidence as data only, add a consumer-without-local-binder regression, and retain fail-closed behavior if the protected central binder is genuinely absent. No leaf rerun/no-op wake commit is being used.seonghobae commentedon Sep 21, 2026
Additional LineageWeave canary: translation-ledger PR #929 exact
d4f42f579663e88a0c9af0cc492aa6ff7cae96ee, Strix workflow35236142575, job105329535481, artifactstrix-reports10524752712(SHA-25677af2e4db1983311a37a8d0727008bf6aae1eaee5e68563f530ee857ce6c27ff).Again, the Strix engine itself completed and emitted a report plus SARIF with 0 results; the report explicitly assessed the new translation-ledger endpoint/cache/migrations and recorded scope limitations. The wrapper then terminated on the same deterministic post-scan path error:
This specimen is particularly useful because the raw Strix report contains scope-qualified and some broader security claims. The missing central binder means the workflow never reaches the canonical evidence-classification/sanitization step that should bind those claims to
pr_delta/ repository baseline / context dependency. Therefore neither the 0-result SARIF nor broad prose claims should be promoted as authoritative required-gate acceptance until #2291/#2292 lands and the unchanged consumer head is revalidated normally.LineageWeave will keep #929 Draft and will not vendor the binder or convert the raw report into a synthetic pass.
seonghobae commentedon Sep 22, 2026
Additional exact-head LineageWeave canary:
LineageWeave#1039@9da817da8306c8ac8c631ff1c19f6c74dd6e35a1, Strix run34671908661attempt 2, job106391096873.The job admitted/materialized the exact target, self-tested the required workflow, provisioned contextual-orchestrator, installed Strix, and reached
Run Strix (quick). Attempt 2 then failed there after the model path timed out, and artifactstrix-reports10661318604(sha256:62411f81faafbee2e39b3ddc9d511e89caafd6eecf5f061d83abbc3872ad9d45) was uploaded. Its gate console independently ends with the same deterministic owner-path failure:ERROR: Strix evidence binder is missing: /home/runner/work/_temp/trusted-workspace/scripts/ci/strix_evidence_binding.pyThis exact-head rerun must be kept separate from run attempt 1 / job
103494782412, whose now-expired artifact was the historical exact-head security report that had already yielded three Medium product findings. Attempt 2 did not produce a replacement vulnerability verdict, so it neither clears nor supersedes those historical findings; it adds another consumer reproduction of the central binder defect plus a separate transient/provider timeout outcome.Do not copy the binder into LineageWeave or reinterpret the attempt-2 failure as an application finding. Canonical repair remains #2291 exact-head acceptance/protected integration, then unchanged consumer revalidation.
seonghobae commentedon Sep 22, 2026
Additional exact consumer reproduction from Wardnet confirms this is the same deterministic central-owner defect, independent of the scanner result.
Consumer:
ContextualWisdomLab/wardnet#435Exact consumer head:
11e7fabfca76e0051fa883905228a0dbe472f4dfRequired-workflow run/job:
35751756065/106864846606Protected central workflow SHA:
.github@e6334e229581a918e2f22de18733b76fa65d7e71The trusted Strix run completed its PR-scope scan and reported:
It then exited 2 solely because the central quick gate resolved the binder from the target trusted workspace:
Wardnet intentionally does not carry the central binder and will not copy it locally or weaken/bypass the required check.
RED→GREEN acceptance for this reproduction:
strix_evidence_binding.py(and any companion central runtime dependency) from the exact protected.githubworkflow/runtime checkout, not from consumer source;wardnet#435@11e7fabfca76e0051fa883905228a0dbe472f4df, the required Strix run reaches terminal success after binding the zero-finding report to the exact consumer evidence.This is a central required-workflow/runtime repair; no Wardnet product-security change is authorized by this failure.
seonghobae commentedon Sep 23, 2026
OriginWeave now reproduces this owner defect with a stronger exact-head specimen.
Consumer:
ContextualWisdomLab/OriginWeave#37Consumer exact head:
219b43bfa87ab4fd90a77bb962df2797925bf661Required Strix run/job:
35816714371/107075508403Protected central workflow source:
.github@e6334e229581a918e2f22de18733b76fa65d7e71The scan itself completed and reported
Vulnerabilities 0 (No exploitable vulnerabilities detected). The required job nevertheless terminated immediately afterward with exit 2:ERROR: Strix evidence binder is missing: /home/runner/work/_temp/trusted-workspace/scripts/ci/strix_evidence_binding.pyThis isolates the deterministic failure from provider/Caido availability for this specimen: contextual-orchestrator preflight reached
gateway.status=ready, Strix completed its PR-scope analysis, and the failure occurred only when post-scan evidence binding resolved the binder from the target repository trusted workspace. Organization code search confirms the binder exists in the protected central owner atscripts/ci/strix_evidence_binding.py, not in OriginWeave.OriginWeave will not copy the central binder locally or blind-rerun the failed required job. Please keep acceptance on the owner repair: resolve the binder from the exact protected central checkout, preserve target-workspace evidence inputs, and prove the reusable workflow works for a consumer that intentionally has no local binder. No clean-scan result from this failed job is being promoted to required-check GREEN.
seonghobae commentedon Sep 26, 2026
새 소비자 재현:
fast-mlsirmPR #2130, exact head6a2fa9a827f9f975952c7c800dfc98086ff0a733. Required Strix run/job: 36230578269 / 108391060179.관측: Strix의 PR 범위 검사가 끝나며
Vulnerabilities 0을 출력한 뒤, 필수 job이ERROR: Strix evidence binder is missing: /home/runner/work/_temp/trusted-workspace/scripts/ci/strix_evidence_binding.py로 exit 2를 기록했습니다. 원인은 이 이슈에 적힌 중앙 binder 경로 결함과 같습니다. 이 실패를 취약점 없음의 통과 증거로 취급하지 않고 PR 병합을 막는 검사 실패로 유지합니다.담당: 중앙 필수 워크플로 소유자. 다음 작업/수용 기준: 보호된 중앙 소스에서 binder를 찾아 실행하도록 수정한 뒤, PR #2130의 같은 SHA에서 Strix 검사와 증거 결박이 모두 terminal success를 내는지 확인합니다. 현재 재시도 가능한 검사들은 별도로 대기 중입니다.