fix(strix): accept legal Packrat fixture paths

[seonghobae]

Buyer-visible blocker

The organization-required Strix gate failed before security analysis for ContextualWisdomLab/aFIPC#160 exact head 804ea97cd83144f94c5020a9d42f2573cc8cb442. Its changed-file list contains the tracked historical Packrat fixture path:

packrat/lib/x86_64-pc-linux-gnu/3.4.1/packrat/tests/testthat/Ugly, but legal, path for a project (long)/bread/DESCRIPTION

The central normalizer rejected that legal path solely because comma and ASCII parentheses were absent from its bounded allowlist. This left a valid generated-dependency cleanup without exact-head Strix evidence.

Focused repair

• admit only comma plus ASCII ( and ) in the existing changed-path allowlist;
• reject raw .. components before posixpath.normpath() can collapse embedded traversal such as safe/../target.txt;
• retain rejection of empty/dot, absolute, CR/LF/NUL, leading or trailing whitespace, backslash, shell metacharacters, unsupported Unicode punctuation, and out-of-root resolution;
• continue passing normalized paths to Git and filesystem operations as quoted arguments, never shell source;
• execute the permanent regression at the literal pull-request head on Python 3.14 with immutable action pins, no persisted checkout credentials, read-only workflow permissions, full-repository pytest execution through coverage.py, compilation, Bash syntax, and worktree-cleanliness checks;
• trigger that contract for implementation, test, workflow, CHANGELOG, and authoritative doctoring changes;
• record incident evidence, the security boundary, rollback procedure, and APA 7 primary references; and
• leave reviewer credentials, scopes, identities, and key chains unchanged.

Test-first evidence

• Protected-main implementation f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae: historical Packrat path regression failed before the allowlist repair.
• Test-only exact head 27f632b5c7d350efdf6a19745eb787268d86e940: safe/../target.txt was proven to pass incorrectly, and Strix Changed Path Quality CI failed specifically on AssertionError: 0 == 0 for that candidate.
• Materialized GREEN verification: 899 passed, 16 subtests passed after rejecting raw traversal components and running the complete repository test suite.
• A workflow-scoped GITHUB_TOKEN correctly refused to push a workflow-file modification without workflows permission. The workflow change was therefore applied through the authorized GitHub connector, while the product-code repair was committed separately with no workflow mutation; protections and credentials were not broadened.
• Temporary materialization workflows were removed. The final base-to-head diff contains exactly five authoritative files.

Exact current head: f48ee444097b741092c05fa99715b2a494550099.

Final scope

• .github/workflows/strix-changed-path-quality-ci.yml
• CHANGELOG.md
• docs/doctoring/strix-legal-git-paths.md
• scripts/ci/strix_quick_gate.sh
• tests/test_strix_changed_path_policy.py

Merge gate

Merge only after every exact-current-head CI, security, supply-chain, CodeRabbit, OpenCode, Noema, unresolved-thread, independent non-author approval, and branch-protection gate passes. Pending, queued, cancelled, skipped-required, absent, stale-head, failed, author-only, or predecessor-head evidence is not success. After merge, rerun the failed Strix evidence for unchanged aFIPC#160 exact head; do not reuse its predecessor failure or bypass the required check.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 12 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 70662aaf-ea89-4b63-aec1-1f9ec5f1372c

📥 Commits

Reviewing files that changed from the base of the PR and between 63fdd37 and f48ee44.

📒 Files selected for processing (5)

• .github/workflows/strix-changed-path-quality-ci.yml
• CHANGELOG.md
• docs/doctoring/strix-legal-git-paths.md
• scripts/ci/strix_quick_gate.sh
• tests/test_strix_changed_path_policy.py

📝 Walkthrough

Walkthrough

Strix 변경 경로 정책이 쉼표와 ASCII 괄호를 허용하도록 변경되었습니다. 경로 순회와 셸 구문 문자는 계속 차단됩니다. 회귀 테스트와 GitHub Actions 품질 검사 워크플로가 추가되었습니다.

Changes

Strix 경로 정책

Layer / File(s)	Summary
경로 정책 및 회귀 검증 scripts/ci/strix_quick_gate.sh, tests/test_strix_changed_path_policy.py, docs/doctoring/strix-legal-git-paths.md, CHANGELOG.md	경로 정규화기가 쉼표와 ASCII 괄호를 허용합니다. 경로 순회, 절대 경로, 제어 문자, 공백 모호성, 백슬래시 및 셸 구문 문자는 계속 거부합니다. 회귀 테스트와 정책 문서를 추가했습니다.
품질 검사 워크플로 .github/workflows/strix-changed-path-quality-ci.yml	지정된 pull request와 수동 실행에서 정책 테스트, Python 및 Bash 구문 검사, 작업 트리 무변경 검증을 실행합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 쉼표와 괄호를 포함한 합법적인 Packrat fixture 경로를 허용하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/strix-legal-packrat-paths

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review

Review-only exact-head request for 63fdd37232d471087ece807a9b9f7bd98991cb62. Validate the narrow Strix changed-path compatibility boundary, exact-head quality workflow, initiating aFIPC evidence, fail-closed path regressions, doctoring, and unchanged reviewer/security controls. Do not update the branch, approve from the author identity, enable bypass, or merge.

[seonghobae]

@coderabbitai review

Review exact current head 63fdd37232d471087ece807a9b9f7bd98991cb62; predecessor-head review or check evidence is historical only.

[coderabbitai]

@seonghobae I will review exact head 63fdd37232d471087ece807a9b9f7bd98991cb62. I will treat predecessor-head evidence as historical only.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/strix-changed-path-quality-ci.yml:
- Around line 6-9: Update the workflow’s paths configuration to include
docs/doctoring/strix-legal-git-paths.md and CHANGELOG.md so changes to either
contract file trigger validation. In the workflow test step, replace the
single-test-file invocation with the full suite command using coverage and
pytest against tests in quiet mode.

In `@tests/test_strix_changed_path_policy.py`:
- Around line 65-84: Reject raw “..” path components before normalization in the
changed-path normalizer, and add “safe/../target.txt” to the rejected cases in
tests/test_strix_changed_path_policy.py:65-84. Update
docs/doctoring/strix-legal-git-paths.md:20-29 to retain the traversal-rejection
claim only after this fix, and remove or limit the same fail-closed claim in
CHANGELOG.md:15 until the fix is applied.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 306ffc18-d8b4-4332-a38e-0f618add47b9

📥 Commits

Reviewing files that changed from the base of the PR and between f070c50 and 63fdd37.

📒 Files selected for processing (5)

• .github/workflows/strix-changed-path-quality-ci.yml
• CHANGELOG.md
• docs/doctoring/strix-legal-git-paths.md
• scripts/ci/strix_quick_gate.sh
• tests/test_strix_changed_path_policy.py

[seonghobae]

@coderabbitai review

Review exact current head f48ee444097b741092c05fa99715b2a494550099. The prior actionable findings are now implemented: raw .. components are rejected before normalization, the full repository suite runs through coverage.py and pytest, and implementation plus authoritative contract files trigger the exact-head workflow. Treat all predecessor-head evidence as historical.

[seonghobae]

@opencode-agent @cwl-noema-review

Review-only exact-head request for f48ee444097b741092c05fa99715b2a494550099. Validate the legal Packrat path compatibility boundary, raw traversal rejection before normalization, immutable/read-only exact-head full-suite workflow, initiating aFIPC evidence, APA 7 doctoring, and unchanged reviewer/security controls. Do not update the branch, approve from the author identity, weaken gates, or merge.

[coderabbitai]

@seonghobae I will review exact head f48ee444097b741092c05fa99715b2a494550099. I will treat all predecessor-head evidence as historical only.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please retry the exact-current-head review for f48ee444097b741092c05fa99715b2a494550099; the earlier retry was rate-limited. All exact-head workflows are now complete and successful, and both predecessor review findings are implemented and resolved.

[coderabbitai]

@seonghobae I will retry the review for exact head f48ee444097b741092c05fa99715b2a494550099. I will treat all predecessor-head evidence as historical.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Review exact current head f48ee444097b741092c05fa99715b2a494550099. The previous two findings are implemented and their threads are resolved; verify the corrected raw-traversal boundary and full-suite exact-head workflow rather than predecessor head 63fdd37232d471087ece807a9b9f7bd98991cb62.

[coderabbitai]

@seonghobae I will review exact head f48ee444097b741092c05fa99715b2a494550099.

I will verify the raw-traversal rejection boundary and the full-suite exact-head workflow. I will treat 63fdd37232d471087ece807a9b9f7bd98991cb62 as historical only.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.