-
Notifications
You must be signed in to change notification settings - Fork 0
fix(strix): classify module-qualified ModelBehaviorError on current main #1195
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
seonghobae
wants to merge
4
commits into
main
from
fix/strix-modelbehaviorerror-current-main-20260821
Closed
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
2cd1d34
fix(strix): classify ModelBehaviorError as retryable protocol evidence
seonghobae d8d0546
fix(strix): require module-qualified ModelBehaviorError context
seonghobae 48e5b61
fix(strix): preserve behavior error case sensitivity
seonghobae 8d69548
Merge remote-tracking branch 'origin/main' into HEAD
seonghobae File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| # Strix ModelBehaviorError classifier | ||
|
|
||
| 기준일: **2026-08-21** | ||
|
|
||
| ## Incident | ||
|
|
||
| Required Strix scans can fail closed after the agent runtime raises | ||
| `ModelBehaviorError` even when the log reports `Vulnerabilities 0`. The | ||
| exception means the selected model did not follow Strix's tool-calling | ||
| protocol. Treating that protocol failure as a security finding blocked | ||
| current-head progress on otherwise empty scans. | ||
|
|
||
| ## Decision | ||
|
|
||
| `scripts/ci/strix_quick_gate.sh` recognizes a **module-qualified** | ||
| `ModelBehaviorError` from `agents`, `pydantic_ai`, or `strix` as retryable | ||
| model evidence. A bare source-file mention is not enough. The gate moves to | ||
| the configured fallback sequence and does not retry the same model. The outer | ||
| `.github/workflows/strix.yml` neutralization path may skip only when that | ||
| signal is present **and** the log contains no vulnerability evidence. | ||
|
|
||
| `Vulnerabilities[[:space:]]+[1-9]` and `severity:` markers remain blocking. | ||
| Generic warnings, timeouts, provider failures, and MEDIUM-or-higher findings | ||
| are unchanged. | ||
|
|
||
| ## Verification contract | ||
|
|
||
| `tests/test_strix_model_behavior_error.py` executes the production classifier | ||
| and the outer workflow neutralization condition against bounded synthetic | ||
| logs. It proves: | ||
|
|
||
| 1. a module-qualified `agents`/`pydantic_ai`/`strix` `ModelBehaviorError` | ||
| plus `Vulnerabilities 0` is retryable and may neutralize; | ||
| 2. the same exception plus `Vulnerabilities 1` stays fail-closed; | ||
| 3. lowercase application prose or a bare `ModelBehaviorError` token is not | ||
| classified as the runtime exception; | ||
| 4. the identifier is wired into infrastructure detection and cross-model | ||
| fallback, never same-model retry. | ||
|
|
||
| ## Rollback | ||
|
|
||
| If a future Strix release renames the exception, add the exact new identifier | ||
| and a matching regression. Do not remove the vulnerability fail-closed guard. | ||
|
|
||
| ## References (APA 7th) | ||
|
|
||
| GitHub. (n.d.). *Workflow syntax for GitHub Actions*. GitHub Docs. Retrieved | ||
| August 21, 2026, from | ||
| https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax | ||
|
|
||
| GitHub. (n.d.). *Using workflow run logs*. GitHub Docs. Retrieved August 21, | ||
| 2026, from https://docs.github.com/en/actions/how-tos/monitor-workflows/use-workflow-run-logs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,226 @@ | ||
| """Regression contract for Strix ModelBehaviorError protocol flakes. | ||
|
|
||
| A ModelBehaviorError with zero reported vulnerabilities is retryable model | ||
| evidence. Real vulnerability counts remain fail-closed. | ||
| """ | ||
|
|
||
| from __future__ import annotations | ||
|
|
||
| import re | ||
| import subprocess | ||
| import tempfile | ||
| import unittest | ||
| from pathlib import Path | ||
|
|
||
|
|
||
| REPOSITORY_ROOT = Path(__file__).resolve().parents[1] | ||
| STRIX_GATE = REPOSITORY_ROOT / "scripts" / "ci" / "strix_quick_gate.sh" | ||
| STRIX_WORKFLOW = REPOSITORY_ROOT / ".github" / "workflows" / "strix.yml" | ||
| QUALITY_WORKFLOW = ( | ||
| REPOSITORY_ROOT / ".github" / "workflows" / "strix-changed-path-quality-ci.yml" | ||
| ) | ||
|
|
||
|
|
||
| def _function_block(source: str, function_name: str) -> str: | ||
| """Return one top-level Bash function, including its closing brace.""" | ||
|
|
||
| match = re.search( | ||
| rf"(?ms)^{re.escape(function_name)}\(\) {{\n.*?^}}\n", | ||
| source, | ||
| ) | ||
| if match is None: | ||
| raise AssertionError(f"missing Bash function: {function_name}") | ||
| return match.group(0) | ||
|
|
||
|
|
||
| def _classifies_as_model_behavior_error(log_text: str) -> bool: | ||
| """Execute the production classifier against a bounded synthetic log.""" | ||
|
|
||
| gate_source = STRIX_GATE.read_text(encoding="utf-8") | ||
| function_source = _function_block(gate_source, "is_model_behavior_error") | ||
| with tempfile.TemporaryDirectory(prefix="strix-model-behavior-") as temp_dir: | ||
| log_path = Path(temp_dir) / "strix.log" | ||
| log_path.write_text(log_text, encoding="utf-8") | ||
| script = "\n".join( | ||
| ( | ||
| "set -euo pipefail", | ||
| 'STRIX_LOG="$1"', | ||
| function_source, | ||
| "is_model_behavior_error", | ||
| ) | ||
| ) | ||
| completed = subprocess.run( | ||
| ["bash", "-c", script, "strix-classifier", str(log_path)], | ||
| check=False, | ||
| capture_output=True, | ||
| text=True, | ||
| ) | ||
| if completed.returncode not in {0, 1}: | ||
| raise AssertionError(completed.stderr) | ||
| return completed.returncode == 0 | ||
|
|
||
|
|
||
| def _workflow_signal_pattern(workflow: str, variable_name: str) -> str: | ||
| """Extract one single-quoted POSIX ERE assigned in the Strix workflow.""" | ||
|
|
||
| match = re.search( | ||
| rf"(?m)^\s+{re.escape(variable_name)}='([^']+)'$", | ||
| workflow, | ||
| ) | ||
| if match is None: | ||
| raise AssertionError(f"missing workflow signal: {variable_name}") | ||
| return match.group(1) | ||
|
|
||
|
|
||
| def _workflow_neutralizes(log_text: str) -> bool: | ||
| """Execute the outer workflow's backend-neutralization condition.""" | ||
|
|
||
| workflow = STRIX_WORKFLOW.read_text(encoding="utf-8") | ||
| backend_pattern = _workflow_signal_pattern( | ||
| workflow, | ||
| "backend_unavailable_signal", | ||
| ) | ||
| model_behavior_pattern = _workflow_signal_pattern( | ||
| workflow, | ||
| "model_behavior_error_signal", | ||
| ) | ||
| vulnerability_pattern = _workflow_signal_pattern( | ||
| workflow, | ||
| "reported_vulnerability_signal", | ||
| ) | ||
| with tempfile.TemporaryDirectory(prefix="strix-workflow-mbe-") as temp_dir: | ||
| log_path = Path(temp_dir) / "strix.log" | ||
| log_path.write_text(log_text, encoding="utf-8") | ||
| backend = subprocess.run( | ||
| ["grep", "-Eiq", backend_pattern, str(log_path)], | ||
| check=False, | ||
| capture_output=True, | ||
| text=True, | ||
| ) | ||
| model_behavior = subprocess.run( | ||
| ["grep", "-Eq", model_behavior_pattern, str(log_path)], | ||
| check=False, | ||
| capture_output=True, | ||
| text=True, | ||
| ) | ||
| vulnerability = subprocess.run( | ||
| ["grep", "-Eiq", vulnerability_pattern, str(log_path)], | ||
| check=False, | ||
| capture_output=True, | ||
| text=True, | ||
| ) | ||
| if backend.returncode not in {0, 1}: | ||
| raise AssertionError(backend.stderr) | ||
| if model_behavior.returncode not in {0, 1}: | ||
| raise AssertionError(model_behavior.stderr) | ||
| if vulnerability.returncode not in {0, 1}: | ||
| raise AssertionError(vulnerability.stderr) | ||
| return ( | ||
| (backend.returncode == 0 or model_behavior.returncode == 0) | ||
| and vulnerability.returncode == 1 | ||
| ) | ||
|
|
||
|
|
||
| class StrixModelBehaviorErrorTests(unittest.TestCase): | ||
| """Protect protocol flakes without weakening vulnerability fail-closed.""" | ||
|
|
||
| def test_runtime_model_behavior_error_is_retryable(self) -> None: | ||
| """Recognize the exact PascalCase Strix agent-protocol exception.""" | ||
|
|
||
| log = ( | ||
| "strix.agents.base.ModelBehaviorError: tool protocol mismatch\n" | ||
| "Vulnerabilities 0\n" | ||
| ) | ||
| self.assertTrue(_classifies_as_model_behavior_error(log)) | ||
|
|
||
| def test_lowercase_application_prose_is_not_retryable(self) -> None: | ||
| """Reject target-application text that only resembles the exception.""" | ||
|
|
||
| log = "the model behavior error was logged by the scanned service\n" | ||
| self.assertFalse(_classifies_as_model_behavior_error(log)) | ||
| self.assertFalse(_classifies_as_model_behavior_error("ModelBehaviorError\n")) | ||
|
|
||
| def test_agents_sdk_tool_protocol_failure_is_retryable(self) -> None: | ||
| """Recognize the OpenAI Agents SDK exception observed in required CI.""" | ||
|
|
||
| log = ( | ||
| "agents.exceptions.ModelBehaviorError: Tool ls not found in agent strix\n" | ||
| "Vulnerabilities 0\n" | ||
| ) | ||
| self.assertTrue(_classifies_as_model_behavior_error(log)) | ||
|
|
||
| def test_behavior_error_skips_same_model_and_enters_fallback(self) -> None: | ||
| """Wire the classifier into infrastructure and cross-model fallback.""" | ||
|
|
||
| gate_source = STRIX_GATE.read_text(encoding="utf-8") | ||
| infrastructure = _function_block( | ||
| gate_source, | ||
| "has_detected_infrastructure_error", | ||
| ) | ||
| retryable = _function_block(gate_source, "is_model_retryable_error") | ||
| same_model_retry = _function_block( | ||
| gate_source, | ||
| "is_transient_same_model_retry_error", | ||
| ) | ||
|
|
||
| self.assertIn("is_model_behavior_error", infrastructure) | ||
| self.assertIn("is_model_behavior_error", retryable) | ||
| self.assertNotIn("is_model_behavior_error", same_model_retry) | ||
|
|
||
| def test_outer_workflow_neutralizes_zero_finding_protocol_flake(self) -> None: | ||
| """Empty scans that only hit ModelBehaviorError may skip.""" | ||
|
|
||
| self.assertTrue( | ||
| _workflow_neutralizes( | ||
| "strix.agents.base.ModelBehaviorError: tool protocol mismatch\n" | ||
| "Vulnerabilities 0\n" | ||
| ) | ||
| ) | ||
| self.assertFalse( | ||
| _workflow_neutralizes("ModelBehaviorError\nVulnerabilities 0\n") | ||
| ) | ||
| self.assertFalse( | ||
| _workflow_neutralizes( | ||
| "agents.foo.modelbehaviorerror\nVulnerabilities 0\n" | ||
| ) | ||
| ) | ||
|
|
||
| def test_outer_workflow_never_neutralizes_reported_vulnerabilities(self) -> None: | ||
| """Keep a real vulnerability signal blocking despite protocol failure.""" | ||
|
|
||
| self.assertFalse( | ||
| _workflow_neutralizes( | ||
| "strix.agents.base.ModelBehaviorError: tool protocol mismatch\n" | ||
| "Vulnerabilities 1\n" | ||
| ) | ||
| ) | ||
| self.assertFalse( | ||
| _workflow_neutralizes( | ||
| "strix.agents.base.ModelBehaviorError: tool protocol mismatch\n" | ||
| "Vulnerabilities 9\n" | ||
| ) | ||
| ) | ||
|
|
||
| def test_workflow_keeps_fail_closed_vulnerability_contract(self) -> None: | ||
| """Retain the static fail-closed vulnerability evidence contract.""" | ||
|
|
||
| workflow = STRIX_WORKFLOW.read_text(encoding="utf-8") | ||
| self.assertIn("ModelBehaviorError", workflow) | ||
| self.assertIn("model_behavior_error_signal", workflow) | ||
| self.assertIn("reported_vulnerability_signal", workflow) | ||
| self.assertIn("Vulnerabilities[[:space:]]+[1-9]", workflow) | ||
| self.assertIn( | ||
| '! grep -Eiq "$reported_vulnerability_signal"', | ||
| workflow, | ||
| ) | ||
|
|
||
| def test_quality_trigger_includes_model_behavior_contracts(self) -> None: | ||
| """Keep classifier, doctoring, and workflow edits on the quality path.""" | ||
|
|
||
| workflow = QUALITY_WORKFLOW.read_text(encoding="utf-8") | ||
| self.assertIn(' - "docs/doctoring/strix-model-behavior-error.md"', workflow) | ||
| self.assertIn(' - "tests/test_strix_model_behavior_error.py"', workflow) | ||
|
|
||
|
|
||
| if __name__ == "__main__": | ||
| unittest.main() |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.