Separate Strix full-scan model contract

[seonghobae]

Summary

• keep PR-scoped Strix scans on the organization STRIX_LLM route so vertex_ai/gemini-3.1-pro-preview-customtools remains available after secret visibility correction
• route protected-branch full scans (push, schedule, and manual non-PR workflow_dispatch) to the exact stable Vertex model vertex_ai/gemini-2.5-flash
• add regression assertions and docs so full-repo Strix scans do not silently use an unproven preview model

Evidence

• PR Fix Strix Vertex model warning contract #303 merged at c3d454872ec1c15e51b8c45f669e1ff4b0dd15be.
• Its protected-branch push Strix run 26635699207 started Run Strix (quick) at 2026-05-29T11:56:22Z and remained in progress past the intended 40-minute process budget, which is not acceptable under the no Timeout/Fatal/Warn/Denied policy.

Verification

• PYTHONDONTWRITEBYTECODE=1 python3 -m pytest backend/tests/test_release_governance.py -q
• bash scripts/ci/test_strix_quick_gate.sh
• git diff --check

Notes

• GitHub Models remains disabled.
• This does not suppress Strix findings or warning/error output; it separates PR-scoped model evidence from protected-branch full-scan evidence.

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow to dynamically select AI scanning models based on event type: protected-branch scans use a stable model, while PR-scoped scans use the configured organizational model.
  • Enhanced test coverage for workflow model-selection logic.
  • Updated governance and operational documentation for scanning model routing.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR implements conditional Strix model selection based on GitHub event type and workflow inputs. Protected-branch scans (push, schedule, non-PR manual runs) use vertex_ai/gemini-2.5-flash, while PR-scoped scans use the configured vertex_ai/gemini-3.1-pro-preview-customtools. Documentation, tests, and a roadmap detail the policy and constraints.

Changes

Strix Conditional Model Selection

Layer / File(s)	Summary
Routing contract and policy definition README.md, AGENTS.md	PR-scoped scans use vertex_ai/gemini-3.1-pro-preview-customtools via organization secrets; protected-branch full scans remain on vertex_ai/gemini-2.5-flash until 3.1 full-scan evidence is stable.
Workflow model selection logic .github/workflows/strix.yml	STRIX_MODEL environment variable assignment in "Gate Strix secrets" and "Prepare Strix model input file" steps now branches on GitHub event type (push, schedule) and pr_number input presence to route to either stable 2.5-flash or secrets-configured 3.1 model.
Test assertions for routing logic backend/tests/test_release_governance.py, scripts/ci/test_strix_quick_gate.sh	Governance and quick-gate tests validate event-driven routing conditions (push/schedule and empty pr_number trigger 2.5-flash path) and verify the presence of the multi-branch vertex_ai model selection expression.
Operational model roadmap and constraints docs/plans/2026-05-29-strix-full-scan-operational-model.md	New roadmap detailing evidence from prior PR #303, allowed Vertex model patterns, preservation of warning filters and child-process forwarding, regression assertion requirements, and non-goals (no GitHub Models, no finding/timeout suppression, no removal of 3.1 PR-scoped evidence path).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related issues

• Seongho-Bae/naruon#286: Both address STRIX_LLM routing for PR-scoped Strix scans; this PR enforces Vertex for protected-branch paths while maintaining STRIX_LLM for PR scans.

Possibly related PRs

• Seongho-Bae/naruon#303: Both update .github/workflows/strix.yml Strix gating and model-routing logic to adjust gemini-3.1-pro-preview-customtools vs fallback selection, and tighten the same quick-gate test assertions around the routing contract.
• Seongho-Bae/naruon#238: Both directly change .github/workflows/strix.yml Strix routing/model-selection at the same workflow decision points, though with opposite provider direction (this PR enforces Vertex, that PR restricts to OpenAI direct).
• Seongho-Bae/naruon#288: This PR further tweaks .github/workflows/strix.yml STRIX_MODEL/provider_mode selection and test_strix_quick_gate.sh assertions for push/schedule and workflow_dispatch pr_number handling, building on similar org-secret-driven routing foundations.

Poem

🐰 A rabbit hops through Strix's garden,
Full scans pick the steady flash,
While PR scouts take the preview path,
Each route now clear, no more to pardon!
Tests ensure the models dash correctly home. 🌿✨

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: separating the Strix model contract between PR-scoped scans and protected-branch full scans. It directly reflects the primary objectives and all file changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/strix-full-scan-operational-model-20260529

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/strix.yml (1)

103-103: ⚡ Quick win

Centralize STRIX_MODEL selection to one workflow-level env to prevent policy drift.

The same governance-critical expression is duplicated in two steps; a future one-sided edit can silently desync gate behavior vs runtime model file generation.

♻️ Suggested refactor

 jobs:
   strix:
     timeout-minutes: 90
     runs-on: ubuntu-latest
+    env:
+      STRIX_MODEL: ${{ (github.event_name == 'push' || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.pr_number == '')) && 'vertex_ai/gemini-2.5-flash' || secrets.STRIX_LLM || 'vertex_ai/gemini-3.1-pro-preview-customtools' }}
     steps:
@@
       - name: Gate Strix secrets
         id: gate
         env:
-          STRIX_MODEL: ${{ (github.event_name == 'push' || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.pr_number == '')) && 'vertex_ai/gemini-2.5-flash' || secrets.STRIX_LLM || 'vertex_ai/gemini-3.1-pro-preview-customtools' }}
           STRIX_OPENAI_API_KEY: ${{ secrets.STRIX_OPENAI_API_KEY }}
           STRIX_VERTEX_CREDENTIALS: ${{ secrets.GCP_SA_KEY }}
@@
       - name: Prepare Strix model input file
         if: steps.gate.outputs.enabled == 'true'
-        env:
-          STRIX_MODEL: ${{ (github.event_name == 'push' || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.pr_number == '')) && 'vertex_ai/gemini-2.5-flash' || secrets.STRIX_LLM || 'vertex_ai/gemini-3.1-pro-preview-customtools' }}
         run: |

Based on learnings: Keep Strix architecture docs and reusable gate tests aligned with LLM provider rules so stale GitHub Models, OpenAI-only, unavailable-model, blanket-warning, or generic-key examples cannot re-enter copied workflow guidance.

Also applies to: 206-206

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/strix.yml at line 103, The STRIX_MODEL selection
expression is duplicated across steps; centralize it by defining a single
workflow-level environment variable named STRIX_MODEL with the existing
conditional expression and change all step-level usages to reference that
workflow env (use ${{ env.STRIX_MODEL }} wherever the duplicated expression
appears) so the governance rule is maintained in one place and cannot drift
between step definitions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/strix.yml:
- Line 103: The STRIX_MODEL selection expression is duplicated across steps;
centralize it by defining a single workflow-level environment variable named
STRIX_MODEL with the existing conditional expression and change all step-level
usages to reference that workflow env (use ${{ env.STRIX_MODEL }} wherever the
duplicated expression appears) so the governance rule is maintained in one place
and cannot drift between step definitions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: df20b0a2-5669-45bf-9750-9db974df015f

📥 Commits

Reviewing files that changed from the base of the PR and between c3d4548 and 80e2568.

📒 Files selected for processing (6)

• .github/workflows/strix.yml
• AGENTS.md
• README.md
• backend/tests/test_release_governance.py
• docs/plans/2026-05-29-strix-full-scan-operational-model.md
• scripts/ci/test_strix_quick_gate.sh