Fix Strix Vertex model warning contract

[seonghobae]

Summary

• default Strix to the configured organization Vertex model vertex_ai/gemini-3.1-pro-preview-customtools while keeping vertex_ai/gemini-2.5-flash as the exact approved fallback
• forward a narrow PYTHONWARNINGS filter into the Strix child process for the known third-party pydantic.main serializer warning observed in PR Add source-linked Data repository assets #302 run 26633823390
• lock the Strix provider/warning contract in shell and release-governance tests plus README/AGENTS/plans docs

Verification

• PYTHONDONTWRITEBYTECODE=1 python3 -m pytest backend/tests/test_release_governance.py -q
• bash scripts/ci/test_strix_quick_gate.sh
• git diff --check

Notes

• GitHub Models remains disabled for Strix.
• No security finding, timeout, denial, or scanner error is suppressed; only the known third-party Pydantic serializer warning is filtered by module/message/category.

Summary by CodeRabbit

• Documentation

  • Updated Strix security scanning governance with refined model configuration and warning filtering requirements.

• Chores

  • Upgraded Strix scanning to use Gemini 3.1 Pro Preview model with Gemini 2.5 Flash as fallback.
  • Implemented narrow Python warning filtering for known third-party serializer warnings.

• Tests

  • Added regression test to validate Strix workflow configuration and warning filter enforcement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c152984d-04e8-497a-9f9e-3c717d3fe621

📥 Commits

Reviewing files that changed from the base of the PR and between 5a60dc9 and d9ef15b.

📒 Files selected for processing (7)

• .github/workflows/strix.yml
• AGENTS.md
• README.md
• backend/tests/test_release_governance.py
• docs/plans/2026-05-29-strix-vertex-model-warning-filter.md
• scripts/ci/strix_quick_gate.sh
• scripts/ci/test_strix_quick_gate.sh

---

📝 Walkthrough

Walkthrough

This PR upgrades the Strix security-scanning workflow to use Vertex AI Gemini 3.1 Pro Preview Customtools as the default model, adds narrow Pydantic serializer warning suppression, propagates the warning configuration through the gate script subprocess, and locks the configuration via new regression tests and governance documentation.

Changes

Strix Vertex model upgrade and warning filtering

Layer / File(s)	Summary
Workflow model and warning configuration .github/workflows/strix.yml	Workflow updates default STRIX_MODEL from vertex_ai/gemini-2.5-flash to vertex_ai/gemini-3.1-pro-preview-customtools in both the Gate Strix secrets and Prepare Strix model input steps, extends the Vertex AI case allowlist to accept the new model variant alongside the fallback, and sets PYTHONWARNINGS to ignore a specific Pydantic serializer UserWarning during the Run Strix step.
Environment variable propagation to subprocess scripts/ci/strix_quick_gate.sh	Gate script adds PYTHONWARNINGS to the whitelisted set of environment variables forwarded from the parent workflow into the Python subprocess used for Strix invocations.
Regression test for workflow model and warning constraints backend/tests/test_release_governance.py	New test test_strix_workflow_uses_configured_vertex_model_and_narrow_warning_filter validates that the workflow enforces specific Vertex model allow-list entries, excludes wildcard patterns, disallows broad model-access configuration, and enforces a narrow PYTHONWARNINGS filter for Pydantic serializer warnings only.
Test script updates for model guard and runtime environment scripts/ci/test_strix_quick_gate.sh	Test script updates workflow assertions to validate the new default Vertex model and narrow PYTHONWARNINGS filtering, extends GPT-5.4 model guard logic to accept both the new Vertex customtools and fallback flash models, sets PYTHONWARNINGS in the runtime-env-forwarding test scenario, and updates expected runtime logs to include the forwarded PYTHONWARNINGS value.
Governance and scope documentation AGENTS.md, README.md, docs/plans/2026-05-29-strix-vertex-model-warning-filter.md	Documentation specifies the Vertex AI Gemini model contract with exact approved fallback, clarifies fail-closed behavior against unauthorized model routing, narrows warning filtering to specific third-party Pydantic serializer warnings, and establishes the sequenced requirements for model routing defaults, environment propagation, and test enforcement.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Seongho-Bae/naruon#232: Both PRs modify the Strix CI workflow's gating model and provider configuration with warning/environment handling changes.
• Seongho-Bae/naruon#288: Both PRs extend the Vertex AI model allow-list and update corresponding workflow and test assertions for Strix provider routing.
• Seongho-Bae/naruon#238: Both PRs modify Strix provider/model-selection paths in workflow and test assertions, though toward different routing constraints.

Poem

🐰 A model upgrade hops in,
From Flash to Customtools so bright,
Warnings filtered thin and neat,
Environment forwarding takes flight!
Tests lock it down, docs gleam true—
Strix's vision crystalline and true. 🌟

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: fixing the Strix Vertex model and warning filter contract by configuring the proper model, fallback, and warning suppression.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/strix-pydantic-warning-filter-20260529

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

PR governance metadata gate is not ready for d9ef15bd8124547a94db62c9b3a25ce19b412ca3:

• Merge state is UNKNOWN; resolve conflicts or refresh mergeability.
• Current-head CodeRabbit issue comment has blocking warning/failure evidence on d9ef15b.