fix(security): update the central Strix dependency closure

.github/workflows/strix-security-closure.yml

@@ -0,0 +1,39 @@
+name: Strix Security Closure
+
+on:
+  pull_request:
+    paths:
+      - requirements-strix-ci.txt
+      - requirements-strix-ci-hashes.txt
+      - tests/test_strix_security_closure.py
+      - .github/workflows/strix-security-closure.yml
+
+concurrency:
+  group: strix-security-closure-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  closure-contract:
+    name: closure-contract
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+      - name: Checkout exact pull-request head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Verify reviewed security closure
+        run: python tests/test_strix_security_closure.py
+      - name: Verify hash-locked installation
+        run: python -m pip install --require-hashes -r requirements-strix-ci-hashes.txt

CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to the ContextualWisdomLab central GitHub control plane are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versioned releases follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Security
+
+- Upgrade the central Strix dependency closure to `aiohttp==3.14.3`, `cryptography==50.0.0`, and the compatible `pyOpenSSL==26.4.0` transitive release so the hard Python advisory gate no longer installs the affected prior versions.
+- Add a permanent read-only exact-head closure contract that verifies the reviewed security floor and performs a real `--require-hashes` installation.
+
+### Documentation
+
+- Add APA 7 doctoring for the advisory evidence, generated-lock trust boundary, scope separation, verification requirements, and rollback prohibition.

docs/doctoring/central-strix-security-closure.md

@@ -0,0 +1,59 @@
+# Central Strix security dependency closure
+
+## Decision
+
+The central Strix security lane uses one reviewed, generated, hash-locked Python dependency closure. The direct input now fixes the security-sensitive packages at:
+
+- `aiohttp==3.14.3`;
+- `cryptography==50.0.0`;
+- `strix-agent==1.0.4` and the existing reviewed direct dependencies.
+
+The generated lock resolves the compatible transitive `pyOpenSSL==26.4.0` release. The complete lock is replaced as one artifact rather than editing individual hashes or transitive versions by hand.
+
+## Triggering evidence
+
+The central Python Security job on August 5, 2026 failed on the existing protected base because:
+
+- `aiohttp==3.14.1` was within ranges affected by three 2026 advisories covering a malformed chunked-response parser out-of-bounds read, unnegotiated WebSocket compression acceptance, and request smuggling through WebSocket upgrade handling;
+- `cryptography==49.0.0` was within the range reported by `PYSEC-2026-3552` for a PKCS7 decryption timing-oracle issue;
+- the published fixed floors were `aiohttp>=3.14.2` for the affected aiohttp advisories and `cryptography>=50.0.0` for the cryptography advisory.
+
+The branch first added an executable regression contract. Exact head `768cc63e58ff6b2c3900585258d5e873c3755e1d` failed before dependency replacement because the direct input still selected `aiohttp==3.14.1`. This proves the test detects the vulnerable baseline rather than merely documenting the final state.
+
+## Trust boundary
+
+- The direct input and generated hash lock are both reviewed source artifacts.
+- CI installs with `python -m pip install --require-hashes` and therefore cannot silently resolve an unhashed replacement.
+- The exact-head closure workflow receives no repository-write permission, secret, OIDC token, or reviewer credential.
+- The workflow checks out the immutable pull-request head SHA and verifies both the declared security floor and a real hash-locked installation.
+- No advisory is ignored, suppressed, or reclassified.
+- OpenCode, Noema, Strix, NVIDIA NIM, and reviewer credential names and scopes are unchanged.
+
+## Scope separation
+
+This security closure is deliberately separated from the generic coverage/native-fuzz boundary in pull request #763. A dependency lifecycle update and a coverage materialization policy are independently reviewable changes and may be rejected or rolled back separately.
+
+## Verification and rollback
+
+Merge requires the exact current head to pass:
+
+- the dedicated Strix closure contract and hash-locked installation;
+- Python Security and dependency review;
+- OSV, CodeQL, Semgrep, Secret Scan, SBOM, and Scorecard;
+- repository tests and exact-head independent review.
+
+Rollback is prohibited while the prior versions remain advisory-affected. A future replacement must provide a newly generated hash lock, a passing advisory scan, an updated regression contract if the security floor changes, and a new doctoring entry.
+
+## APA 7 references
+
+GitHub. (2026a). *AIOHTTP: HTTP request smuggling via WebSocket upgrade* [Security advisory, GHSA-mfx4-hv73-q22v]. GitHub Advisory Database. https://github.com/advisories/GHSA-mfx4-hv73-q22v
+
+GitHub. (2026b). *AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path* [Security advisory, GHSA-cq5v-8q36-5273]. GitHub Advisory Database. https://github.com/advisories/GHSA-cq5v-8q36-5273
+
+GitHub. (2026c). *AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate* [Security advisory, GHSA-mq44-7p77-q5h7]. GitHub Advisory Database. https://github.com/advisories/GHSA-mq44-7p77-q5h7
+
+Open Source Vulnerabilities. (2026). *PYSEC-2026-3552* [Security advisory]. https://osv.dev/vulnerability/PYSEC-2026-3552
+
+Python Packaging Authority. (2026). *Python Packaging Advisory Database* [Data set]. GitHub. https://github.com/pypa/advisory-database
+
+Python Packaging Authority. (2026). *pip-audit* [Computer software]. GitHub. https://github.com/pypa/pip-audit