feat(security): Strix 발견을 AppGuardrail 이슈로 중앙 집계 by seonghobae · Pull Request #560 · ContextualWisdomLab/.github

seonghobae · 2026-07-14T12:11:08Z

OpenCode receipt candidates

scripts/ci/strix_emit_appguardrail_issues.py:44 source-line-sha256=df6d83d7cef00f95021019d23122552853407da9156a32528e1ddc5435eed105
.github/workflows/strix.yml:797 source-line-sha256=f05ab3628ca4fe39800593c1f8406d4c0456a356ff85e40be210eadf96806190

These exact current-head receipts are normalizer-verifiable for adversarial probes.

변경 사항

Strix의 Medium 이상 실제 발견을 ContextualWisdomLab/appguardrail 이슈로 중앙 집계합니다.
저장소, 심각도, 안정적인 SHA-256 finding marker로 중복을 방지하고 동일 발견은 갱신합니다.
PR 범위 스캔은 누락 발견을 닫지 않으며, 성공한 전체 스캔에서만 해결된 발견을 닫습니다.
파서 오류, 알 수 없는 심각도, 토큰/권한/API 오류는 로그에 구체적인 이유를 남기고 fail-closed 합니다.
GitHub App 토큰은 appguardrail 한 저장소의 Issues write 권한으로 제한합니다.
repository_dispatch PR 스캔에서도 PR number/base/head 메타데이터를 인식해 PR-head blob만 스캔합니다. 이는 argos PR #252의 실제 실패 로그인 STRIX_TARGET_PATH=__PR_SCOPE__ requires PR scoping 회귀를 수정합니다.
Noema와 merge scheduler의 workflow_run은 OpenCode/Strix 두 upstream workflow만 허용하여 상호 재귀 queue를 차단합니다.
OpenCode adversarial probe는 봉인 digest가 여러 위치에 같아도 evidence가 그중 정확히 하나의 path:line을 인용할 때만 구조화 필드를 재결합하며, 모호한 경우 후보 수를 로그에 남기고 fail-closed 합니다.

검증

CodeGraph 초기화/동기화 및 호출 경로 검토
749 tests passed
scripts/ci 6,481 statements, 100.00% coverage
interrogate 100.0%
AppGuardrail 집계기 및 중앙 계약 115 tests passed
repository_dispatch PR-scope 동적 회귀 통과
queue recursion 및 same-repo exhausted retry 회귀 47 tests passed
Ruff, actionlint, bash -n 통과
current-head Trivy, OSV, dependency-review, Bandit, pip-audit, CodeQL, Semgrep, gitleaks, Scorecard 통과
current-head code-scanning alerts, comments, reviews, unresolved threads 0건 확인

실제 취약점이 없는 경우 가짜 이슈를 만들지 않습니다. 병합 후 첫 실제 Medium 이상 Strix finding부터 AppGuardrail에 생성됩니다.

opencode-agent

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ad0241e8efda55f42a6a1025e311ab410d180cec.
Head SHA: ad0241e8efda55f42a6a1025e311ab410d180cec
Workflow run: 29342501743
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (4 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (4 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (2 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (2 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: strix-appguardrail-issues.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: strix-appguardrail-issues.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script (7 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script (7 files)"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (5 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (5 files)"]
  R5 --> V5["targeted test run"]

opencode-agent · 2026-07-14T14:50:48Z

OpenCode Review Overview

Head SHA: ad0241e8efda55f42a6a1025e311ab410d180cec
Workflow run: 29342501743
Workflow attempt: 1
Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.
Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.
Result: REQUEST_CHANGES
Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ad0241e8efda55f42a6a1025e311ab410d180cec.
Head SHA: ad0241e8efda55f42a6a1025e311ab410d180cec
Workflow run: 29342501743
Workflow attempt: 1

Coverage evidence

Coverage Decision

Result: FAIL
Test evidence: not proven passing
Docstring evidence: not proven passing when configured
Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (4 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (4 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file (2 files)"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file (2 files)"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: strix-appguardrail-issues.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: strix-appguardrail-issues.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["CI script (7 files)"]
  S4 --> I4["review and security gate shell path"]
  I4 --> R4["Review risk: CI script (7 files)"]
  R4 --> V4["bash -n plus Strix self-test"]
  Evidence --> S5["Test (5 files)"]
  S5 --> I5["regression suite"]
  I5 --> R5["Review risk: Test (5 files)"]
  R5 --> V5["targeted test run"]

Superseded automated OpenCode change request from a previous head; current head 6900880 has passing coverage and security checks. Current-head model output remains a separate required-review state.

seonghobae · 2026-07-20T13:10:05Z

current HEAD 충돌 해소 및 재검증

Head SHA: de8391f23ca9815df22615f3be5109acf08343d4
최신 main (050e6d59b0de9e62c8413d5f8f26f4f2f9ebea09)을 merge해 DIRTY/CONFLICTING 상태를 해소했습니다.
Strix·Code Scanning → AppGuardrail 집계, PR 범위 비종결(close-on-fix 금지), full-scan 전용 종결, 저장소별 최소 권한 App 토큰, trusted changed-line receipt 기능을 보존했습니다.
오래된 PR 내부 opencode-exhausted-retry write-token job은 최신 중앙 정책에 맞춰 제거했습니다. 모델 고갈 재시도는 최소 권한 중앙 scheduler가 소유합니다.

검증:

CodeGraph 초기화·동기화·호출 경로 재검토
전체 749 passed
집중 계약 321 passed
scripts/ci: 6,481 statements, 100% coverage
interrogate: 100.0%
repository_dispatch PR-head scope 셸 회귀 통과
Ruff, Bandit Medium+, compileall, bash syntax, 전체 workflow YAML parse 통과
actionlint core(-shellcheck= -pyflakes=) 통과; 외부 shellcheck 연동 전체 실행은 90초 무출력 정지하여 hosted current-head checks를 권위로 둡니다.
push 전 PR code-scanning alerts 0건, unresolved review threads 0건

Copilot

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Strix의 Medium+ 발견(및 선택적으로 GitHub Code Scanning alert)을 ContextualWisdomLab/appguardrail 이슈로 중앙 집계하고, PR-scope vs full-scope 스캔에 따라 close-on-fix를 안전하게 제어하며, OpenCode의 “current-head source-line receipt” 기반 증거 바인딩을 강화합니다.

Changes:

Strix report/Code Scanning alert를 파싱·중복제거·이슈 reconcile(create/update/comment/close)하는 emitter 추가 및 워크플로우 연결
PR 스캔에서 close-on-fix 금지, full+complete 스캔에서만 stale 이슈 자동 close
OpenCode에 trusted changed-line source receipt 생성/검증 및 adversarial probe evidence 바인딩 repair 로직 추가

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`tests/test_strix_emit_appguardrail_issues.py`	Strix→AppGuardrail emitter의 파싱/해싱/플래닝/실행/CLI 경로를 포괄 테스트로 고정
`tests/test_required_workflow_queue_contract.py`	workflow_run 소비자(Noema/merge scheduler)의 upstream allowlist 및 Strix emitter 워크플로우 계약 테스트 추가
`tests/test_opencode_source_line_receipts.py`	current-head changed-line source receipt 생성기의 fail-closed/경계 조건 테스트 추가
`tests/test_opencode_review_normalize_output.py`	sealed receipt 인덱싱 및 probe evidence 바인딩 repair/거부 규칙 테스트 추가
`tests/test_opencode_model_pool_runner.py`	모델 프롬프트에 “path:line 인용 + receipt 복사” 규칙이 포함됨을 고정
`tests/test_opencode_agent_contract.py`	워크플로우가 receipt 생성/증거 패킷 wiring을 포함함을 계약 테스트로 고정
`scripts/ci/test_strix_quick_gate.sh`	Strix 워크플로우의 emitter/토큰/scan_complete/Code Scanning wiring 계약 검사 추가(일부 권한 가드 제거)
`scripts/ci/strix_emit_appguardrail_issues.py`	Strix/Code Scanning findings를 AppGuardrail 이슈로 중앙 집계하는 신규 emitter 구현
`scripts/ci/run_opencode_review_model_pool.sh`	프롬프트 계약에 trusted receipts 섹션 및 “digest 계산 금지/인용 강제” 규칙 추가
`scripts/ci/opencode_source_line_receipts.py`	current-head changed-line의 SHA-256 receipt를 bounded + fail-closed로 생성하는 신규 CLI 추가
`scripts/ci/opencode_review_prompt_template.md`	review 프롬프트에 trusted changed-line source receipts 섹션 반영
`scripts/ci/opencode_review_normalize_output.py`	sealed evidence에서 receipts를 검증·인덱싱하고 probe evidence 바인딩을 보수적으로 repair
`docs/strix-appguardrail-issues.md`	Strix→AppGuardrail 중앙 집계/권한/close-on-fix 가드에 대한 운영 문서 추가
`code-reviewer-prompt.md`	adversarial evidence에서 receipt “복사” 요구로 계약 강화
`ci-review-prompt.md`	adversarial evidence에서 receipt “복사” 요구로 계약 강화
`.github/workflows/strix.yml`	scan_complete 출력 추가 및 AppGuardrail issue token/Code Scanning token mint + emitter 실행 단계 추가
`.github/workflows/pr-review-merge-scheduler.yml`	workflow_run 트리거에서 upstream workflow path allowlist 추가
`.github/workflows/opencode-review.yml`	evidence에 trusted changed-line source receipts 섹션 생성/인라인 발췌 포함
`.github/workflows/noema-review.yml`	workflow_run 트리거에서 upstream workflow path allowlist 추가

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

+          STRIX_PR_NUMBER: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.event.client_payload.pr_number || '' }}
+          STRIX_HEAD_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.event.client_payload.pr_head_sha || github.sha }}
+          STRIX_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          STRIX_SCAN_SCOPE: ${{ (github.event_name == 'pull_request_target' || github.event.client_payload.pr_number != '') && 'pr' || 'full' }}


+            --scope "$STRIX_SCAN_SCOPE"
+            --include-code-scanning
+          )


seonghobae added 4 commits July 14, 2026 21:10

feat(security): aggregate Strix findings in appguardrail

23ddbe4

fix(ci): stop review workflow recursion

16d687a

fix(ci): parse repository dispatch review context

d2ce7d8

fix(ci): precompute trusted review line receipts

ad0241e

opencode-agent Bot previously requested changes Jul 14, 2026

View reviewed changes

seonghobae added 5 commits July 14, 2026 23:55

test(ci): cover receipt generator failure paths

674a4bc

fix(review): repair verified adversarial line bindings

b422460

feat(security): mirror code scanning alerts to AppGuardrail

c8a0d66

fix(opencode): bind probe locations to sealed receipts

e8ff150

fix(opencode): rebind sealed cited probe locations

6900880

seonghobae mentioned this pull request Jul 15, 2026

fix(review): bind verified evidence in scripts/ci/opencode_review_normalize_output.py #563

Open

merge(main): AppGuardrail 보안 집계 최신화

de8391f

seonghobae requested a review from Copilot July 22, 2026 02:48

Copilot started reviewing on behalf of seonghobae July 22, 2026 03:05 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

fix(strix): fail closed during issue reconciliation

e543d49

Copilot AI review requested due to automatic review settings July 22, 2026 15:57

Copilot started reviewing on behalf of seonghobae July 22, 2026 15:57 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(security): Strix 발견을 AppGuardrail 이슈로 중앙 집계#560

feat(security): Strix 발견을 AppGuardrail 이슈로 중앙 집계#560
seonghobae wants to merge 11 commits into
mainfrom
agent/appguardrail-security-aggregation

seonghobae commented Jul 14, 2026 •

edited

Loading

Uh oh!

opencode-agent Bot left a comment

Uh oh!

opencode-agent Bot commented Jul 14, 2026

Uh oh!

seonghobae commented Jul 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

seonghobae commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OpenCode receipt candidates

변경 사항

검증

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

opencode-agent Bot commented Jul 14, 2026

OpenCode Review Overview

Pull request overview

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

Coverage evidence

Coverage Decision

Changed-File Evidence Map

Uh oh!

seonghobae commented Jul 20, 2026

current HEAD 충돌 해소 및 재검증

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

seonghobae commented Jul 14, 2026 •

edited

Loading