fix(strix): keep required smoke independent from AGENTS prose

[seonghobae]

Root cause

ContextualWisdomLab/learning-content-studio run 33550889631, job 99999752053 never reached Strix installation or scanning. The central required-path smoke test exited first because it required the exact non-executable sentence Strix uses the zero-cost \orchestrator/free`inAGENTS.md. Current guidance already records the same route as “OpenCode, Noema, and Strix all use the fail-closed zero-cost pool \orchestrator/free`”, but the wording and line wrapping differ.

That made organization-wide Strix availability depend on one exact documentation phrase. A prose edit could therefore skip every downstream install, scan, report, and status step even when the executable workflow, gateway route, ZDR requirement, permissions, dependency locks, and gate scripts were valid.

Test-first repair

• 587c4a6dd0d5556bb96c140833c272160fcce85e adds the regression first. A copied, otherwise-valid required-smoke fixture replaces only AGENTS.md prose and requires the smoke test to continue. Against the protected base implementation it reproduces the incident and exits 1 with the same missing-sentence diagnostic.
• 87d825182a37a732a503e9f7a480b13eb3f25e0b removes only the runtime read/assertion of AGENTS.md from strix_required_workflow_smoke.sh.
• 5905197e6ef0410d74debe3ac3e35ce71df97b98 bounds the fixture subprocess and tightens the separate documentation assertion: Strix, zero-cost, and orchestrator/free must appear together in one normalized paragraph.

This keeps documentation drift testable in central quality CI without blocking consumer security scans on exact wording.

Scope and invariants

Base: main@83ae03f67ebaef5ac2840fb9b7c3bffc72e20508

Head: 5905197e6ef0410d74debe3ac3e35ce71df97b98

Diff: 2 files, 3 commits, 83 additions, 2 deletions.

Unchanged:

• STRIX_MODEL=contextual-orchestrator/orchestrator/free;
• private-target ZDR enforcement;
• trusted-source checkout and target-workspace isolation;
• token and status permissions;
• dependency hash locks;
• provider failure and incomplete-evidence fail-closed behavior;
• scan severity, report, and merge semantics.

Local verification

• RED: new regression against the pre-fix smoke script failed with Repository guidance agrees with the binding Strix route.
• GREEN: bash -n scripts/ci/strix_required_workflow_smoke.sh succeeded.
• GREEN: python3 -m py_compile tests/test_strix_required_smoke_availability.py succeeded.
• GREEN: python3 -m unittest -v tests/test_strix_required_smoke_availability.py — 2 tests passed.

Hosted exact-head Checks and reviews remain authoritative. After protected-main integration, the affected Learning Content Studio PR must acquire a new Strix run; the historical failed job is not reclassified as passing evidence.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: b63304ea-ea65-4051-8ded-3410114c60ce

📥 Commits

Reviewing files that changed from the base of the PR and between 83ae03f and 5905197.

📒 Files selected for processing (2)

• scripts/ci/strix_required_workflow_smoke.sh
• tests/test_strix_required_smoke_availability.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

QUEUE_SATURATION_CHICKEN_EGG admission decision for exact head 5905197e6ef0410d74debe3ac3e35ce71df97b98. Fresh live verification: GitHub reports Ready and mechanically mergeable with no conflict; changed scope is exactly scripts/ci/strix_required_workflow_smoke.sh plus its new regression; there are zero inline review threads; Devin Review reports no issues and both Devin/CodeRabbit current-head statuses are success. The repair is test-first and narrowly removes only the runtime dependency on one exact AGENTS.md sentence while retaining the executable STRIX_MODEL=contextual-orchestrator/orchestrator/free, private-target ZDR, trusted-source isolation, hash locks, permissions, scan/report/severity semantics, and fail-closed provider/incomplete-evidence behavior. Current-head Security Scan, CodeQL, Python Security, Semgrep, Secret Scan, OSV, Scorecard and SBOM runs are queued, and the .github Actions fleet currently reports 1,259 queued runs. This PR removes a central required-Strix false blocker that prevents downstream scans from starting at all, so waiting in the saturated fleet preserves the control-plane defect. Using the owner-authorized minimum-safe bypass with exact expected head; no substantive failing test/security finding/CHANGES_REQUESTED/provenance defect/conflict is bypassed.