fix(strix): fail closed on incomplete provider evidence

.github/workflows/opencode-review-dispatch.yml

@@ -3371,7 +3371,7 @@ jobs:
           test files. Never approve material workflow, script, source, config, package, or test changes with a
           reason or summary that says simple typo fix, string-only change, no verification needed, or no tests
           needed. If bounded failed GitHub Check evidence contains active failed checks, treat it as a blocker
-          until diagnosed. A successful same-head default-branch repository_dispatch Strix run may supersede a stale failed
+          until diagnosed. A successful same-head default-branch repository_dispatch Strix run with a structured evidence binding may supersede a stale failed
           PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded
           failed checks with the exact target URL. Multiple Strix model reports must not be collapsed; preserve
           model name, report title, severity, endpoint, and Code Locations/path:line evidence. Full failed-check
@@ -3385,7 +3385,7 @@ jobs:
           Exact gate phrases: Coverage and Docstring coverage labels must cite Coverage execution evidence showing supported repository test suites passed.
           Exact gate phrases: or explicitly cite Coverage execution evidence as not applicable because no supported source files or package manifests were found.
           Exact gate phrases: If bounded failed GitHub Check evidence contains active failed checks, treat it as a blocker until diagnosed.
-          Exact gate phrases: A successful same-head default-branch repository_dispatch Strix run may supersede a stale failed PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded failed checks with the exact target URL.
+          Exact gate phrases: A successful same-head default-branch repository_dispatch Strix run with the exact structured evidence-binding status may supersede a stale failed PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded failed checks with the exact target URL.
           Exact gate phrases: Full failed-check evidence, when collected, is available as failed-check-evidence.md.
           Exact gate phrases: Do not request changes with only a check URL, workflow name, or generic failure summary.
           Exact gate phrases: Failed-check findings must be line-specific and concrete.
@@ -3518,7 +3518,7 @@ jobs:
           test files. Never approve material workflow, script, source, config, package, or test changes with a
           reason or summary that says simple typo fix, string-only change, no verification needed, or no tests
           needed. If bounded failed GitHub Check evidence contains active failed checks, treat it as a blocker
-          until diagnosed. A successful same-head default-branch repository_dispatch Strix run may supersede a stale failed
+          until diagnosed. A successful same-head default-branch repository_dispatch Strix run with a structured evidence binding may supersede a stale failed
           PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded
           failed checks with the exact target URL. Multiple Strix model reports must not be collapsed; preserve
           model name, report title, severity, endpoint, and Code Locations/path:line evidence. Full failed-check
@@ -3532,7 +3532,7 @@ jobs:
           Exact gate phrases: Coverage and Docstring coverage labels must cite Coverage execution evidence showing supported repository test suites passed.
           Exact gate phrases: or explicitly cite Coverage execution evidence as not applicable because no supported source files or package manifests were found.
           Exact gate phrases: If bounded failed GitHub Check evidence contains active failed checks, treat it as a blocker until diagnosed.
-          Exact gate phrases: A successful same-head default-branch repository_dispatch Strix run may supersede a stale failed PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded failed checks with the exact target URL.
+          Exact gate phrases: A successful same-head default-branch repository_dispatch Strix run with the exact structured evidence-binding status may supersede a stale failed PR statusCheckRollup Strix context only when failed-check evidence explicitly lists it under Superseded failed checks with the exact target URL.
           Exact gate phrases: Full failed-check evidence, when collected, is available as failed-check-evidence.md.
           Exact gate phrases: Do not request changes with only a check URL, workflow name, or generic failure summary.
           Exact gate phrases: Failed-check findings must be line-specific and concrete.
@@ -6230,6 +6230,55 @@ jobs:
             return 0
           }
 
+          self_modifying_strix_workflow_needs_structured_evidence() {
+            pr_changes_path ".github/workflows/strix.yml"
+          }
+
+          current_head_manual_strix_structured_success_status() {
+            timeout "$(check_lookup_api_timeout_seconds)s" \
+              gh api -X GET "repos/${GH_REPOSITORY}/commits/${HEAD_SHA}/status" \
+              --jq '
+                (.statuses // [])
+                | map(select((.context // "") == "strix"))
+                | sort_by(.created_at // "")
+                | last // empty
+                | select((.state // "" | ascii_downcase) == "success")
+                | select((.description // "") | contains("Default-branch repository_dispatch Strix structured evidence binding passed"))
+                | select((.target_url // "") | test("/actions/runs/[0-9]+"))
+                | .target_url // empty
+              '
+          }
+
+          hold_for_unverified_strix_workflow_update() {
+            local structured_status
+
+            if ! self_modifying_strix_workflow_needs_structured_evidence; then
+              return 1
+            fi
+            structured_status="$(current_head_manual_strix_structured_success_status || true)"
+            if [ -n "$structured_status" ]; then
+              return 1
+            fi
+            body="$(printf '%s\n' \
+              "## Pull request overview" \
+              "" \
+              "OpenCode did not approve because this PR changes the trusted Strix workflow, but no structured same-head default-branch evidence binding is available." \
+              "" \
+              "## Approval hold" \
+              "" \
+              "### The active pull_request_target workflow is base-branch code" \
+              "- Problem: pull_request_target evaluates the required workflow from the trusted base branch; PR-head workflow materialization is data-only self-test input and cannot prove the new wrapper ran." \
+              "- Root cause: A workflow-changing PR can otherwise receive a false-green result from the previous base workflow before its new provenance validator is active." \
+              "- Fix: merge only after independent review and protected checks, then rerun same-head repository_dispatch Strix evidence and require the structured evidence-binding status." \
+              "- Regression test: Keep the Strix status description and this approval hold tied to structured evidence binding, not to a generic success context." \
+              "" \
+              "- Result: WAITING_FOR_POST_MERGE_STRIX_EVIDENCE" \
+              "- Head SHA: \`${HEAD_SHA}\`" \
+              "- Required evidence: \`Default-branch repository_dispatch Strix structured evidence binding passed\`"
+            )"
+            hold_approval_without_review "WAITING_FOR_POST_MERGE_STRIX_EVIDENCE" "$body"
+          }
+
           build_pending_check_body() {
             local pending_checks_file="$1"
             local body_file="$2"
@@ -6558,13 +6607,6 @@ jobs:
           }
 
           current_head_manual_strix_success_status() {
-            local status_target
-            local manual_run_line
-            local manual_run_status
-            local manual_run_conclusion
-            local manual_run_url
-
-            status_target="$(
             timeout "$(check_lookup_api_timeout_seconds)s" \
               gh api -X GET "repos/${GH_REPOSITORY}/commits/${HEAD_SHA}/status" \
               --jq '
@@ -6573,74 +6615,10 @@ jobs:
                 | sort_by(.created_at // "")
                 | last // empty
                 | select((.state // "" | ascii_downcase) == "success")
-                | select((.description // "") | contains("Default-branch repository_dispatch Strix evidence passed"))
+                | select((.description // "") | contains("Default-branch repository_dispatch Strix structured evidence binding passed"))
                 | select((.target_url // "") | test("/actions/runs/[0-9]+"))
                 | .target_url
               '
-            )"
-            if [ -n "$status_target" ]; then
-              printf '%s\n' "$status_target"
-              return 0
-            fi
-
-            manual_run_line="$(latest_current_head_manual_strix_run || true)"
-            IFS="$(printf '\t')" read -r manual_run_status manual_run_conclusion manual_run_url <<<"$manual_run_line" || true
-            if [ "$manual_run_status" = "completed" ] &&
-              [ "$manual_run_conclusion" = "success" ] &&
-              [ -n "$manual_run_url" ]; then
-              printf '%s\n' "$manual_run_url"
-            fi
-          }
-
-          current_head_successful_strix_check_run() {
-            local owner="${GH_REPOSITORY%%/*}"
-            local name="${GH_REPOSITORY#*/}"
-
-            timeout "$(check_lookup_api_timeout_seconds)s" gh api graphql \
-              -f owner="$owner" \
-              -f name="$name" \
-              -F number="$PR_NUMBER" \
-              -f query='
-                query($owner:String!,$name:String!,$number:Int!) {
-                  repository(owner:$owner,name:$name) {
-                    pullRequest(number:$number) {
-                      statusCheckRollup {
-                        contexts(first: 100) {
-                          nodes {
-                            __typename
-                            ... on CheckRun {
-                              name
-                              status
-                              conclusion
-                              completedAt
-                              detailsUrl
-                              checkSuite {
-                                workflowRun {
-                                  workflow {
-                                    name
-                                  }
-                                }
-                              }
-                            }
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-              ' \
-              --jq '
-                (.data.repository.pullRequest.statusCheckRollup.contexts.nodes // [])
-                | map(
-                    select(.__typename == "CheckRun")
-                    | select((.status // "") == "COMPLETED")
-                    | select((.conclusion // "" | ascii_upcase) == "SUCCESS")
-                    | select((.name // "" | ascii_downcase) == "strix")
-                    | select((.checkSuite.workflowRun.workflow.name // "") == "Strix Security Scan" or (.checkSuite.workflowRun.workflow.name // "") == "Strix")
-                  )
-                | sort_by(.completedAt // "")
-                | last.detailsUrl // empty
-              '
           }
 
           latest_current_head_manual_strix_run() {
@@ -6692,25 +6670,9 @@ jobs:
             local output_file="$2"
             local manual_strix_success_target
             local manual_strix_success_run_id
-            local manual_strix_run_info
-            local manual_strix_status
-            local manual_strix_conclusion
-            local manual_strix_url
             local failed_strix_run_id
 
             manual_strix_success_target="$(current_head_manual_strix_success_status || true)"
-            if [ -z "$manual_strix_success_target" ]; then
-              manual_strix_success_target="$(current_head_successful_strix_check_run || true)"
-            fi
-            if [ -z "$manual_strix_success_target" ]; then
-              manual_strix_run_info="$(latest_current_head_manual_strix_run || true)"
-              IFS=$'\t' read -r manual_strix_status manual_strix_conclusion manual_strix_url <<<"$manual_strix_run_info" || true
-              if [ "$manual_strix_status" = "completed" ] &&
-                [ "$manual_strix_conclusion" = "success" ] &&
-                [ -n "$manual_strix_url" ]; then
-                manual_strix_success_target="$manual_strix_url"
-              fi
-            fi
             if [ -n "$manual_strix_success_target" ]; then
               manual_strix_success_run_id="$(printf '%s' "$manual_strix_success_target" | sed -n 's#.*/actions/runs/\([0-9][0-9]*\).*#\1#p')"
               while IFS= read -r rollup_line; do
@@ -7658,6 +7620,9 @@ jobs:
                   stop_failed_check_fallback_unavailable
                 fi
               fi
+              if hold_for_unverified_strix_workflow_update; then
+                :
+              fi
               if ! require_r_cmd_check_for_deferred_coverage; then
                 body="$(printf '%s\n' \
                   "## Pull request overview" \