From 5d8f6df075eceeb821bdcca9b71763150a6ee8c5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 22:11:26 +0900 Subject: [PATCH 1/2] fix(strix): admit the scoped Hyosung MLLO consumer Signed-off-by: Seongho Bae Commit-Message-Assisted-by: Codex (OpenAI Codex) --- .github/workflows/strix.yml | 6 ++-- .../hyosung-strix-consumer-admission.md | 33 +++++++++++++++++++ ...test_strix_hyosung_repository_admission.py | 31 +++++++++++++++++ 3 files changed, 67 insertions(+), 3 deletions(-) create mode 100644 docs/doctoring/hyosung-strix-consumer-admission.md create mode 100644 tests/test_strix_hyosung_repository_admission.py diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index f15b29f564..b4f902e861 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -543,8 +543,8 @@ jobs: EVENT_REPOSITORY_VISIBILITY: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.repo.visibility || github.event_name != 'repository_dispatch' && github.event.repository.visibility || '' }} run: | set -euo pipefail - if [[ ! "$TARGET_REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]]; then - echo "::error::Strix target repository must belong to ContextualWisdomLab." + if [[ ! "$TARGET_REPOSITORY" =~ ^(ContextualWisdomLab/[A-Za-z0-9_.-]+|HYOSUNG-ITX-AI-Business-Department/llm-gateway-console)$ ]]; then + echo "::error::Strix target repository is outside the approved consumer scope." exit 1 fi case "$EVENT_REPOSITORY_VISIBILITY" in @@ -617,7 +617,7 @@ jobs: SUPPLIED_HEAD_SHA: ${{ github.event.client_payload.pr_head_sha }} run: | set -euo pipefail - if ! [[ "$REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]] || + if ! [[ "$REPOSITORY" =~ ^(ContextualWisdomLab/[A-Za-z0-9_.-]+|HYOSUNG-ITX-AI-Business-Department/llm-gateway-console)$ ]] || ! [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]] || ! [[ "$SUPPLIED_BASE_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || ! [[ "$SUPPLIED_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || diff --git a/docs/doctoring/hyosung-strix-consumer-admission.md b/docs/doctoring/hyosung-strix-consumer-admission.md new file mode 100644 index 0000000000..93ac9a450a --- /dev/null +++ b/docs/doctoring/hyosung-strix-consumer-admission.md @@ -0,0 +1,33 @@ +# Hyosung Strix consumer admission + +Status: Proposed; no runtime authorization or successful cross-organization scan. + +The MLLO consumer `HYOSUNG-ITX-AI-Business-Department/llm-gateway-console` +currently uses a local review workflow whose GitHub Models request returned +HTTP 410 (`github_models_retirement_brownout`, run 34690093150, job +103543712323). The central main Strix workflow already selects +`contextual-orchestrator/orchestrator/free`, but its visibility and dispatch +metadata checks reject the Hyosung repository before a governed scan can run. + +This change adds exactly that repository to both existing checks. Other Hyosung +repositories remain rejected. The shared review admission controller is not on +this workflow's direct path and is unchanged. No credentials, installation +permissions, provider routes, review verdicts or branch rules are changed. +Existing live PR base/head comparison, private-target handling and separated +status credentials remain mandatory. An allowlisted name is not proof of access. + +The extracted workflow regexes failed both regression cases before the change. +After the change, 97 focused tests and one subtest passed, including repository +visibility, orchestrator, queue and documentation-only admission contracts; +actionlint passed. These tests do not prove target App installation, cross-org +read/status permissions, private-target ZDR or a valid current-head scan. + +Before adoption, independently review and merge the owner change, establish the +existing scoped credential's target access without exposing its value, and run +one exact-revision dispatch. Require matching source/base/head and authoritative +review evidence before replacing the consumer's local workflow. Do not broaden +an App installation, copy central source, suppress failed checks or treat a +successful dispatch response as completed review. If access is unavailable, +retain the failed/incomplete integration state and repair the owner capability. +Rollback removes this exact consumer alternative from both checks; it does not +revoke or alter any credential. No dispatch has been sent by this change. diff --git a/tests/test_strix_hyosung_repository_admission.py b/tests/test_strix_hyosung_repository_admission.py new file mode 100644 index 0000000000..6b0f376cc2 --- /dev/null +++ b/tests/test_strix_hyosung_repository_admission.py @@ -0,0 +1,31 @@ +"""The two Strix repository checks admit only the scoped Hyosung consumer.""" + +import os +from pathlib import Path +import re +import subprocess + +import pytest + + +@pytest.mark.parametrize('variable', ['TARGET_REPOSITORY', 'REPOSITORY']) +def test_strix_repository_boundary(variable): + """Execute each workflow regex against legitimate and out-of-scope names.""" + workflow = Path('.github/workflows/strix.yml').read_text() + patterns = [pattern for pattern in re.findall(r'"\$' + variable + r'" =~ (\^[^ ]+)', workflow) + if 'ContextualWisdomLab' in pattern] + assert len(patterns) == 1 + for repository, accepted in ( + ('ContextualWisdomLab/.github', True), + ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console', True), + ('HYOSUNG-ITX-AI-Business-Department/another-service', False), + ('other/llm-gateway-console', False), + ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-extra', False), + ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console\n', False), + ): + result = subprocess.run( + ['bash', '-c', '[[ "$REPOSITORY" =~ ' + patterns[0] + ' ]]'], + env=dict(os.environ, REPOSITORY=repository), capture_output=True, + text=True, timeout=5, + ) + assert (result.returncode == 0) == accepted, repository From 095c971725682d0a0eaa76e8475ddfd4dc9273d0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 13 Sep 2026 02:14:07 +0900 Subject: [PATCH 2/2] fix(review): admit exact MLLO design consumer Commit-Message-Assisted-by: Codex (OpenAI Codex) Signed-off-by: Seongho Bae --- .github/workflows/strix.yml | 4 ++-- .../hyosung-strix-consumer-admission.md | 21 +++++++++++++++++-- ...test_strix_hyosung_repository_admission.py | 5 +++++ 3 files changed, 26 insertions(+), 4 deletions(-) diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index b4f902e861..5539d4a247 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -543,7 +543,7 @@ jobs: EVENT_REPOSITORY_VISIBILITY: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.repo.visibility || github.event_name != 'repository_dispatch' && github.event.repository.visibility || '' }} run: | set -euo pipefail - if [[ ! "$TARGET_REPOSITORY" =~ ^(ContextualWisdomLab/[A-Za-z0-9_.-]+|HYOSUNG-ITX-AI-Business-Department/llm-gateway-console)$ ]]; then + if [[ ! "$TARGET_REPOSITORY" =~ ^(ContextualWisdomLab/[A-Za-z0-9_.-]+|HYOSUNG-ITX-AI-Business-Department/llm-gateway-console(-design)?)$ ]]; then echo "::error::Strix target repository is outside the approved consumer scope." exit 1 fi @@ -617,7 +617,7 @@ jobs: SUPPLIED_HEAD_SHA: ${{ github.event.client_payload.pr_head_sha }} run: | set -euo pipefail - if ! [[ "$REPOSITORY" =~ ^(ContextualWisdomLab/[A-Za-z0-9_.-]+|HYOSUNG-ITX-AI-Business-Department/llm-gateway-console)$ ]] || + if ! [[ "$REPOSITORY" =~ ^(ContextualWisdomLab/[A-Za-z0-9_.-]+|HYOSUNG-ITX-AI-Business-Department/llm-gateway-console(-design)?)$ ]] || ! [[ "$PR_NUMBER" =~ ^[1-9][0-9]*$ ]] || ! [[ "$SUPPLIED_BASE_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || ! [[ "$SUPPLIED_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || diff --git a/docs/doctoring/hyosung-strix-consumer-admission.md b/docs/doctoring/hyosung-strix-consumer-admission.md index 93ac9a450a..138d6bbaf8 100644 --- a/docs/doctoring/hyosung-strix-consumer-admission.md +++ b/docs/doctoring/hyosung-strix-consumer-admission.md @@ -9,8 +9,11 @@ HTTP 410 (`github_models_retirement_brownout`, run 34690093150, job `contextual-orchestrator/orchestrator/free`, but its visibility and dispatch metadata checks reject the Hyosung repository before a governed scan can run. -This change adds exactly that repository to both existing checks. Other Hyosung -repositories remain rejected. The shared review admission controller is not on +This change adds exactly the console repository and its UI owner +`HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-design` to both existing +checks. The design owner supplies the MLLO navigation surface; reviewing its +change is required for the key-management UI integration. Other Hyosung +repositories and similarly prefixed names remain rejected. The shared review admission controller is not on this workflow's direct path and is unchanged. No credentials, installation permissions, provider routes, review verdicts or branch rules are changed. Existing live PR base/head comparison, private-target handling and separated @@ -31,3 +34,17 @@ successful dispatch response as completed review. If access is unavailable, retain the failed/incomplete integration state and repair the owner capability. Rollback removes this exact consumer alternative from both checks; it does not revoke or alter any credential. No dispatch has been sent by this change. + +## Design-owner extension + +Both extracted shell admission expressions rejected the exact design-owner +repository before this extension (two RED cases). The extension admits only the +optional literal `-design` suffix, retaining anchored owner/name matching. +Tests reject extra suffixes, paths, trailing newlines, and another owner. + +OpenCode remains a separate integration gap: the current dispatch workflow +rejects non-ContextualWisdomLab targets at its metadata guard, and the required +caller has the same organization restriction. The dispatch-target inventory also +lacks both Hyosung consumers. Strix admission does not repair those boundaries +or establish App installation/read/status authority; no OpenCode adoption or +cross-organization scan is claimed by this change. diff --git a/tests/test_strix_hyosung_repository_admission.py b/tests/test_strix_hyosung_repository_admission.py index 6b0f376cc2..77285b3bd8 100644 --- a/tests/test_strix_hyosung_repository_admission.py +++ b/tests/test_strix_hyosung_repository_admission.py @@ -18,6 +18,11 @@ def test_strix_repository_boundary(variable): for repository, accepted in ( ('ContextualWisdomLab/.github', True), ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console', True), + ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-design', True), + ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-design-extra', False), + ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-design/extra', False), + ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-design\n', False), + ('other/llm-gateway-console-design', False), ('HYOSUNG-ITX-AI-Business-Department/another-service', False), ('other/llm-gateway-console', False), ('HYOSUNG-ITX-AI-Business-Department/llm-gateway-console-extra', False),