From 9effbb40c5a95cf220f6328a70023dba03d7a0c6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 29 Aug 2026 06:46:43 -0700 Subject: [PATCH 1/6] test(strix): cover auto orchestrator loopback route --- tests/test_strix_openai_fallback_api_base.py | 82 ++++++++++++++++++-- 1 file changed, 75 insertions(+), 7 deletions(-) diff --git a/tests/test_strix_openai_fallback_api_base.py b/tests/test_strix_openai_fallback_api_base.py index 57988048e9..4b20d35806 100644 --- a/tests/test_strix_openai_fallback_api_base.py +++ b/tests/test_strix_openai_fallback_api_base.py @@ -145,6 +145,43 @@ def _resolve_api_base(env: dict[str, str], model: str) -> tuple[int, str]: return completed.returncode, completed.stdout.strip() +def _resolve_child_model(model: str, api_base: str) -> tuple[int, str]: + """Execute the production child-model qualifier for one gateway route.""" + + gate_source = STRIX_GATE.read_text(encoding="utf-8") + helper_sources = [ + _function_block(gate_source, "is_contextual_orchestrator_model"), + _function_block(gate_source, "is_contextual_orchestrator_api_base"), + _function_block(gate_source, "is_github_models_api_base"), + _function_block(gate_source, "child_model_for_api_base"), + ] + with tempfile.TemporaryDirectory(prefix="strix-gateway-child-model-") as temp_dir: + completed = subprocess.run( + [ + "bash", + "-c", + "\n".join( + [ + "set -euo pipefail", + *helper_sources, + 'child_model_for_api_base "$1" "$2"', + ] + ), + "strix-child-model", + model, + api_base, + ], + check=False, + capture_output=True, + text=True, + env={ + "PATH": "/usr/bin:/bin:/usr/local/bin", + "HOME": temp_dir, + }, + ) + return completed.returncode, completed.stdout.strip() + + class ExplicitOpenAIFallbackRouting(unittest.TestCase): """Direct-OpenAI fallbacks must not inherit the primary provider base.""" @@ -269,21 +306,52 @@ def test_workflow_does_not_configure_an_external_fallback(self) -> None: self.assertIn("Provision contextual-orchestrator Strix sidecar", workflow) def test_workflow_gateway_base_is_the_only_http_exception(self) -> None: - """The local sidecar is accepted without allowing arbitrary HTTP bases.""" + """Both gateway pools accept only the pinned process-local HTTP base.""" - rc, api_base = _resolve_api_base( - {"LLM_API_BASE_FILE": "http://127.0.0.1:18080/v1"}, + for model in ( "orchestrator/free", - ) - self.assertEqual(rc, 0) - self.assertEqual(api_base, "http://127.0.0.1:18080/v1") + "contextual-orchestrator/orchestrator/free", + "orchestrator/auto", + "contextual-orchestrator/orchestrator/auto", + ): + with self.subTest(model=model): + rc, api_base = _resolve_api_base( + {"LLM_API_BASE_FILE": "http://127.0.0.1:18080/v1"}, + model, + ) + self.assertEqual(rc, 0) + self.assertEqual(api_base, "http://127.0.0.1:18080/v1") rc, _ = _resolve_api_base( {"LLM_API_BASE_FILE": "http://127.0.0.1:18081/v1"}, - "orchestrator/free", + "orchestrator/auto", ) self.assertEqual(rc, 2) + rc, _ = _resolve_api_base( + {"LLM_API_BASE_FILE": "http://127.0.0.1:18080/v1"}, + "orchestrator/unknown", + ) + self.assertEqual(rc, 2) + + def test_gateway_child_model_preserves_selected_virtual_pool(self) -> None: + """LiteLLM qualification must not rewrite auto back to free.""" + + expected_child_models = { + "orchestrator/free": "openai/orchestrator/free", + "contextual-orchestrator/orchestrator/free": "openai/orchestrator/free", + "orchestrator/auto": "openai/orchestrator/auto", + "contextual-orchestrator/orchestrator/auto": "openai/orchestrator/auto", + } + for model, expected_child_model in expected_child_models.items(): + with self.subTest(model=model): + rc, child_model = _resolve_child_model( + model, + "http://127.0.0.1:18080/v1", + ) + self.assertEqual(rc, 0) + self.assertEqual(child_model, expected_child_model) + def test_manual_status_job_has_status_write_permission(self) -> None: """OIDC target-app exchange may request the target commit status scope.""" From 687087b55b2f359501f29971ae834d986778d766 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 29 Aug 2026 06:54:46 -0700 Subject: [PATCH 2/6] fix(strix): preserve auto orchestrator gateway route --- scripts/ci/strix_quick_gate.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/scripts/ci/strix_quick_gate.sh b/scripts/ci/strix_quick_gate.sh index 1e0630b301..c4cd33cfa7 100755 --- a/scripts/ci/strix_quick_gate.sh +++ b/scripts/ci/strix_quick_gate.sh @@ -322,7 +322,8 @@ is_vertex_model() { is_contextual_orchestrator_model() { case "$1" in - orchestrator/free | contextual-orchestrator/orchestrator/free) + orchestrator/free | contextual-orchestrator/orchestrator/free | \ + orchestrator/auto | contextual-orchestrator/orchestrator/auto) return 0 ;; *) @@ -2561,12 +2562,14 @@ child_model_for_api_base() { local llm_api_base_value="$2" # LiteLLM requires an explicit provider prefix even when the gateway is an - # OpenAI-compatible local endpoint. Keep the public gateway model name, but - # qualify only the child process model so the request still carries - # orchestrator/free to contextual-orchestrator. + # OpenAI-compatible local endpoint. Strip only the connector-facing alias so + # the selected orchestrator/free or orchestrator/auto virtual pool reaches + # contextual-orchestrator unchanged. if is_contextual_orchestrator_model "$model" && is_contextual_orchestrator_api_base "$llm_api_base_value"; then - printf '%s\n' 'openai/orchestrator/free' + local contextual_orchestrator_model + contextual_orchestrator_model="${model#contextual-orchestrator/}" + printf 'openai/%s\n' "$contextual_orchestrator_model" return 0 fi From 17f695d82d7560d1ac523a0d3486679b321a043c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 30 Aug 2026 05:18:35 +0900 Subject: [PATCH 3/6] test(strix): align bootstrap path policy --- scripts/ci/test_strix_quick_gate.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index c44e82c5ab..b435c2cbc0 100644 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -519,9 +519,12 @@ assert_opencode_review_uses_codegraph_and_contextual_orchestrator() { assert_file_not_contains "$workflow_file" "Wait for trusted OpenCode approval review" "opencode pull_request bridge was removed to avoid duplicate required-check resource use" assert_file_not_contains "$workflow_file" "Trusted OpenCode requested changes for head" "opencode pull_request bridge no longer reconsumes stale trusted review state" assert_file_not_contains "$workflow_file" "github.event.pull_request.number == 240" "opencode review workflow must not hard-code repository-specific PR bypasses" - if awk '/^ required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep -q '^[[:space:]]*if:'; then - record_failure "opencode required workflow bootstrap must not depend on required-workflow event payload fields" - fi + local bootstrap_conditions + bootstrap_conditions="$(awk '/^ required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep '^[[:space:]]*if:' || true)" + assert_equals \ + " if: \${{ github.event_name == 'pull_request_target' }}" \ + "$bootstrap_conditions" \ + "opencode bootstrap permits only the explicit pull_request_target Pingora policy condition" assert_file_contains "$workflow_file" 'github.event.client_payload.target_repository || github.repository' "opencode review scopes concurrency by target repository" assert_file_contains "$workflow_file" "format('pr-{0}', github.event.client_payload.pr_number)" "opencode review scopes repository_dispatch concurrency by current PR" assert_file_not_contains "$workflow_file" "format('pr-{0}-{1}'" "opencode review does not keep stale head-specific concurrency groups" From 765732d47bc6855f0d1c5e7baab13f124c0542db Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 30 Aug 2026 05:26:56 +0900 Subject: [PATCH 4/6] test(strix): stop bootstrap scan at job boundary --- scripts/ci/test_strix_quick_gate.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index b435c2cbc0..65c045f1ca 100644 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -520,7 +520,7 @@ assert_opencode_review_uses_codegraph_and_contextual_orchestrator() { assert_file_not_contains "$workflow_file" "Trusted OpenCode requested changes for head" "opencode pull_request bridge no longer reconsumes stale trusted review state" assert_file_not_contains "$workflow_file" "github.event.pull_request.number == 240" "opencode review workflow must not hard-code repository-specific PR bypasses" local bootstrap_conditions - bootstrap_conditions="$(awk '/^ required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep '^[[:space:]]*if:' || true)" + bootstrap_conditions="$(awk '/^ required-workflow-bootstrap:$/ { in_bootstrap = 1; next } in_bootstrap && /^ [^ ]/ { exit } in_bootstrap' "$bootstrap_file" | grep '^[[:space:]]*if:' || true)" assert_equals \ " if: \${{ github.event_name == 'pull_request_target' }}" \ "$bootstrap_conditions" \ From 84451beb03d4a68d3d40b044550775d15facb9eb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 29 Aug 2026 19:09:44 -0700 Subject: [PATCH 5/6] chore(strix): remove unrelated OpenCode bootstrap test drift --- scripts/ci/test_strix_quick_gate.sh | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 65c045f1ca..c44e82c5ab 100644 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -519,12 +519,9 @@ assert_opencode_review_uses_codegraph_and_contextual_orchestrator() { assert_file_not_contains "$workflow_file" "Wait for trusted OpenCode approval review" "opencode pull_request bridge was removed to avoid duplicate required-check resource use" assert_file_not_contains "$workflow_file" "Trusted OpenCode requested changes for head" "opencode pull_request bridge no longer reconsumes stale trusted review state" assert_file_not_contains "$workflow_file" "github.event.pull_request.number == 240" "opencode review workflow must not hard-code repository-specific PR bypasses" - local bootstrap_conditions - bootstrap_conditions="$(awk '/^ required-workflow-bootstrap:$/ { in_bootstrap = 1; next } in_bootstrap && /^ [^ ]/ { exit } in_bootstrap' "$bootstrap_file" | grep '^[[:space:]]*if:' || true)" - assert_equals \ - " if: \${{ github.event_name == 'pull_request_target' }}" \ - "$bootstrap_conditions" \ - "opencode bootstrap permits only the explicit pull_request_target Pingora policy condition" + if awk '/^ required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep -q '^[[:space:]]*if:'; then + record_failure "opencode required workflow bootstrap must not depend on required-workflow event payload fields" + fi assert_file_contains "$workflow_file" 'github.event.client_payload.target_repository || github.repository' "opencode review scopes concurrency by target repository" assert_file_contains "$workflow_file" "format('pr-{0}', github.event.client_payload.pr_number)" "opencode review scopes repository_dispatch concurrency by current PR" assert_file_not_contains "$workflow_file" "format('pr-{0}-{1}'" "opencode review does not keep stale head-specific concurrency groups" From fab69fd0640d4afcc0a100788b9453dc6683cf11 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 30 Aug 2026 04:52:26 +0000 Subject: [PATCH 6/6] fix(opencode): remove redundant bootstrap event guard Ports the fix from PR #1414 into this branch: the required-workflow-bootstrap job's "Enforce Cloudflare Pingora edge policy" step carried a redundant if: ${{ github.event_name == 'pull_request_target' }} guard, even though opencode-review.yml's only trigger is pull_request_target. The bootstrap contract (scripts/ci/test_strix_quick_gate.sh) correctly rejects any if: inside required-workflow-bootstrap, since a required-workflow check must never depend on event payload fields to materialize. This PR's own description already documents a live circular dependency with #1414 (this PR needs #1414's bootstrap fix; #1414's own Strix check needs this PR's orchestrator/auto fix on main first). Porting the fix here breaks that cycle for this branch without waiting on #1414's merge -- it becomes a no-op once either PR's fix reaches main. Full local suite green: 1874 passed / 1 skipped (pytest), full test_strix_quick_gate.sh PASS. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_015Gs7KmNvH75nxz1sL8mKjw --- .github/workflows/opencode-review.yml | 1 - CHANGELOG.md | 4 ++++ tests/test_pingora_edge_workflow_contract.py | 3 ++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml index f3e3c24996..d66979d406 100644 --- a/.github/workflows/opencode-review.yml +++ b/.github/workflows/opencode-review.yml @@ -197,7 +197,6 @@ jobs: fi - name: Enforce Cloudflare Pingora edge policy - if: ${{ github.event_name == 'pull_request_target' }} env: GITHUB_TOKEN: ${{ github.token }} TARGET_REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.repository }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 3eab104fc2..fa8778d695 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,10 @@ this file. The format follows Keep a Changelog, and versioned releases follow Semantic Versioning where the repository publishes a release. ## [Unreleased] +- Keep the required OpenCode bootstrap's Pingora policy step unconditional + within its pull-request-only workflow, so the static bootstrap contract does + not depend on event payload fields. (Ported from #1414, not yet merged, so + this PR's own trusted-source cycle no longer needs #1414 to merge first.) - Skip trusted base Python lock materialization for exact-head reviews with no Python source or dependency-manifest changes, while preserving the fail-closed wheel-only path when Python coverage is relevant. diff --git a/tests/test_pingora_edge_workflow_contract.py b/tests/test_pingora_edge_workflow_contract.py index 82a85986a0..ad0667cc6b 100644 --- a/tests/test_pingora_edge_workflow_contract.py +++ b/tests/test_pingora_edge_workflow_contract.py @@ -40,7 +40,8 @@ def test_required_workflow_enforces_pingora_without_executing_pr_content() -> No assert '[ -L "$trusted_source_dir/$EXPECTED_FILE" ]' in text assert '[ ! -f "$trusted_source_dir/scripts/ci/pingora_edge_policy.py" ]' in text assert '[ -L "$trusted_source_dir/scripts/ci/pingora_edge_policy.py" ]' in text - assert "if: ${{ github.event_name == 'pull_request_target' }}" in text + assert "pull_request_target:" in text + assert "if: ${{ github.event_name == 'pull_request_target' }}" not in text assert text.index("Verify immutable central policy source") < text.index( "Enforce Cloudflare Pingora edge policy" )