fix(strix): accept legal Packrat fixture paths

[seonghobae]

Buyer-visible blocker

The organization-required Strix gate failed before security analysis for ContextualWisdomLab/aFIPC#160 exact head 804ea97cd83144f94c5020a9d42f2573cc8cb442. Its changed-file list contains the tracked historical Packrat fixture path:

packrat/lib/x86_64-pc-linux-gnu/3.4.1/packrat/tests/testthat/Ugly, but legal, path for a project (long)/bread/DESCRIPTION

The central normalizer rejected that legal path solely because comma and ASCII parentheses were absent from its bounded allowlist. This left a valid generated-dependency cleanup without exact-head Strix evidence.

Focused repair

• admit only comma plus ASCII ( and ) in the existing changed-path allowlist;
• reject raw .. components before posixpath.normpath() can collapse embedded traversal such as safe/../target.txt;
• retain rejection of empty/dot, absolute, CR/LF/NUL, leading or trailing whitespace, backslash, shell metacharacters, unsupported Unicode punctuation, and out-of-root resolution;
• continue passing normalized paths to Git and filesystem operations as quoted arguments, never shell source;
• execute the permanent regression at the literal pull-request head on Python 3.14 with immutable action pins, no persisted checkout credentials, read-only workflow permissions, full-repository pytest execution through coverage.py, compilation, Bash syntax, and worktree-cleanliness checks;
• install every network-fetched test dependency with pip hash-checking mode, binary-only resolution, exact versions, and the PyPI-published SHA-256 digest of the selected CPython 3.14 / Linux x86-64 wheel;
• trigger the contract for implementation, tests, workflow, CHANGELOG, and authoritative doctoring changes;
• record incident evidence, dependency hashes, the security boundary, rollback procedure, and APA 7 primary references; and
• leave reviewer credentials, scopes, identities, and key chains unchanged.

Test-first evidence

• Protected-main implementation f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae: historical Packrat path regression failed before the allowlist repair.
• Test-only exact head 27f632b5c7d350efdf6a19745eb787268d86e940: safe/../target.txt was proven to pass incorrectly, and Strix Changed Path Quality CI failed specifically on that candidate.
• Wheel-hash RED commit a4f810dd53f64fe0b3d7f403888d9f3b9ff7fd93 added the permanent dependency-integrity contract before the workflow implementation; it fails against the preceding workflow because --require-hashes, exact wheel digests, and its trigger path are absent.
• Materialized path-policy GREEN verification: 899 passed, 16 subtests passed after rejecting raw traversal components and running the complete repository test suite.
• A workflow-scoped GITHUB_TOKEN correctly refused to push a workflow-file modification without workflows permission. Authorized connector writes applied the workflow changes without broadening permissions, branch protections, credentials, or reviewer identities.
• Temporary materialization workflows were removed.

Exact current head: 10ae16200bd049f91f2c724b8608ef93280dbaeb.

Final scope

• .github/workflows/strix-changed-path-quality-ci.yml
• CHANGELOG.md
• docs/doctoring/strix-legal-git-paths.md
• scripts/ci/strix_quick_gate.sh
• tests/test_strix_changed_path_policy.py
• tests/test_strix_workflow_dependency_hashes.py

Merge gate

Merge only after every exact-current-head CI, security, supply-chain, CodeRabbit, OpenCode, Noema, unresolved-thread, independent non-author approval, and branch-protection gate passes. Pending, queued, cancelled, skipped-required, absent, stale-head, failed, author-only, or predecessor-head evidence is not success. After merge, rerun the failed Strix evidence for unchanged aFIPC#160 exact head; do not reuse its predecessor failure or bypass the required check.

[coderabbitai]

📝 Walkthrough

Walkthrough

Strix 변경 경로 정책이 쉼표와 ASCII 괄호를 허용하도록 변경되었습니다. 경로 순회와 셸 구문 문자는 계속 차단됩니다. 회귀 테스트와 GitHub Actions 품질 검사 워크플로가 추가되었습니다.

Changes

Strix 경로 정책

Layer / File(s)	Summary
경로 정책 및 회귀 검증 scripts/ci/strix_quick_gate.sh, tests/test_strix_changed_path_policy.py, docs/doctoring/strix-legal-git-paths.md, CHANGELOG.md	경로 정규화기가 쉼표와 ASCII 괄호를 허용합니다. 경로 순회, 절대 경로, 제어 문자, 공백 모호성, 백슬래시 및 셸 구문 문자는 계속 거부합니다. 회귀 테스트와 정책 문서를 추가했습니다.
품질 검사 워크플로 .github/workflows/strix-changed-path-quality-ci.yml	지정된 pull request와 수동 실행에서 정책 테스트, Python 및 Bash 구문 검사, 작업 트리 무변경 검증을 실행합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 쉼표와 ASCII 괄호를 포함한 합법적인 Packrat fixture 경로를 허용하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/strix-legal-packrat-paths

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review

Review-only exact-head request for 63fdd37232d471087ece807a9b9f7bd98991cb62. Validate the narrow Strix changed-path compatibility boundary, exact-head quality workflow, initiating aFIPC evidence, fail-closed path regressions, doctoring, and unchanged reviewer/security controls. Do not update the branch, approve from the author identity, enable bypass, or merge.

[seonghobae]

@coderabbitai review

Review exact current head 63fdd37232d471087ece807a9b9f7bd98991cb62; predecessor-head review or check evidence is historical only.

[coderabbitai]

@seonghobae I will review exact head 63fdd37232d471087ece807a9b9f7bd98991cb62. I will treat predecessor-head evidence as historical only.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/strix-changed-path-quality-ci.yml:
- Around line 6-9: Update the workflow’s paths configuration to include
docs/doctoring/strix-legal-git-paths.md and CHANGELOG.md so changes to either
contract file trigger validation. In the workflow test step, replace the
single-test-file invocation with the full suite command using coverage and
pytest against tests in quiet mode.

In `@tests/test_strix_changed_path_policy.py`:
- Around line 65-84: Reject raw “..” path components before normalization in the
changed-path normalizer, and add “safe/../target.txt” to the rejected cases in
tests/test_strix_changed_path_policy.py:65-84. Update
docs/doctoring/strix-legal-git-paths.md:20-29 to retain the traversal-rejection
claim only after this fix, and remove or limit the same fail-closed claim in
CHANGELOG.md:15 until the fix is applied.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 306ffc18-d8b4-4332-a38e-0f618add47b9

📥 Commits

Reviewing files that changed from the base of the PR and between f070c50 and 63fdd37.

📒 Files selected for processing (5)

• .github/workflows/strix-changed-path-quality-ci.yml
• CHANGELOG.md
• docs/doctoring/strix-legal-git-paths.md
• scripts/ci/strix_quick_gate.sh
• tests/test_strix_changed_path_policy.py

[seonghobae]

@coderabbitai review

Review exact current head f48ee444097b741092c05fa99715b2a494550099. The prior actionable findings are now implemented: raw .. components are rejected before normalization, the full repository suite runs through coverage.py and pytest, and implementation plus authoritative contract files trigger the exact-head workflow. Treat all predecessor-head evidence as historical.

[seonghobae]

@opencode-agent @cwl-noema-review

Review-only exact-head request for f48ee444097b741092c05fa99715b2a494550099. Validate the legal Packrat path compatibility boundary, raw traversal rejection before normalization, immutable/read-only exact-head full-suite workflow, initiating aFIPC evidence, APA 7 doctoring, and unchanged reviewer/security controls. Do not update the branch, approve from the author identity, weaken gates, or merge.

[coderabbitai]

@seonghobae I will review exact head f48ee444097b741092c05fa99715b2a494550099. I will treat all predecessor-head evidence as historical only.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please retry the exact-current-head review for f48ee444097b741092c05fa99715b2a494550099; the earlier retry was rate-limited. All exact-head workflows are now complete and successful, and both predecessor review findings are implemented and resolved.

[coderabbitai]

@seonghobae I will retry the review for exact head f48ee444097b741092c05fa99715b2a494550099. I will treat all predecessor-head evidence as historical.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Review exact current head f48ee444097b741092c05fa99715b2a494550099. The previous two findings are implemented and their threads are resolved; verify the corrected raw-traversal boundary and full-suite exact-head workflow rather than predecessor head 63fdd37232d471087ece807a9b9f7bd98991cb62.

[coderabbitai]

@seonghobae I will review exact head f48ee444097b741092c05fa99715b2a494550099.

I will verify the raw-traversal rejection boundary and the full-suite exact-head workflow. I will treat 63fdd37232d471087ece807a9b9f7bd98991cb62 as historical only.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Addressed the remaining Scorecard Pinned-Dependencies finding on exact head 10ae16200bd049f91f2c724b8608ef93280dbaeb. Test-first commit a4f810dd53f64fe0b3d7f403888d9f3b9ff7fd93 introduced a failing permanent contract for pip hash-checking mode, all six exact wheel digests, and workflow trigger coverage. Implementation commit 968b57b833ef473fccdd60db0bbf362e8b398f94 now uses --only-binary=:all: --require-hashes and PyPI-published SHA-256 values for the CPython 3.14/Linux x86-64 artifacts; doctoring commit 10ae16200bd049f91f2c724b8608ef93280dbaeb records the trust boundary, rollback procedure, and APA 7 primary references. The thread is intentionally left for independent automated disposition because the thread-resolution mutation was unavailable; no review evidence is being treated as resolved until GitHub records it so.