fix(strix): record cached sandbox lifecycle diagnostics

[seonghobae]

RCA boundary

Current-head runs #2261 and #2550 passed gateway health, provider-route, and chat preflight, then failed guest authentication against in-container Caido at 127.0.0.1:48080. The evidence identifies a sandbox-bootstrap failure, not provider 429 or an LLM failure. Historical logs do not contain an OCI image digest or lifecycle state, so they cannot distinguish slow startup from a terminal process failure.

Change

The trusted Strix launcher now records only already-cached, SDK-bound Docker metadata around guest authentication: phase, freshness=cached, image configuration ID, lifecycle status, exit code, and OOM flag. It does not reload Docker, query the daemon, read logs, look up images, change authentication, skip terminal containers, alter retries/deadlines/backend selection, or call settings loading. Unsupported SDK/ABI bindings emit a fixed unavailable marker and leave the scan behavior unchanged.

Verification

• 43 focused tests passed twice, including original token parsing, exact exception/cancellation identity, non-Docker non-interference, malformed metadata redaction, and no reload/remove behavior.
• scripts/ci/strix_timeout_compat.py: statement·branch coverage 100%; docstrings 100%; diff check passed.
• The fixture preserves the hashed pinned Strix 1.5.3 guest-authentication function and its Apache-2.0 attribution.
• Current OCI tag metadata is documented as current-tag evidence only, not historical execution identity or root-cause proof.

This diagnostic does not claim Caido recovery, a green Strix scan, hosted acceptance, or merge authorization.

Developer experience: future failed scans emit bounded lifecycle context instead of forcing operators to infer sandbox state from a connection refusal.
User experience: incomplete sandbox scans remain failed evidence; no zero-finding result is promoted to a security pass.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 10673ceb-5fe2-4c48-9e34-921413d8f001

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head hosted admission RCA

Exact #2573 head 41e9c45407e3f72d138da2ad24cdf934aa42fbe1 has common initial failures across CodeQL, Semgrep, and Security detection jobs. These jobs started and ended in about four seconds with no steps or retained run logs. The retained GitHub Actions check-run annotations provide the cause:

The job was not started because your account is locked due to a billing issue.

Observed check-run ids: 111362130332 (CodeQL detect), 111362130039 (Semgrep), 111362130130 (Security detect). This is account-level Actions admission, not a source finding in #2573, #2572, #2571, or #2531. No source change, retry, status synthesis, gate relaxation, or state toggle can make an unadmitted job valid.

The local exact-tree verification remains recorded separately; it does not replace hosted acceptance. The actionable recovery is to resolve the GitHub account billing lock, then trigger normal current-head admission on the active successor stack. After real Actions jobs start, current-head security results and non-author formal approval remain required. This comment is evidence only, not approval or merge authorization.