From 9a9e87b800e12cfb960b69b908a0bf4863f02330 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 18 Aug 2026 17:09:28 -0700
Subject: [PATCH 1/2] ci: add one-shot exact-head Strix 952 repair runner

---
 .github/workflows/apply-strix-952-repair.yml | 107 +++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 .github/workflows/apply-strix-952-repair.yml

diff --git a/.github/workflows/apply-strix-952-repair.yml b/.github/workflows/apply-strix-952-repair.yml
new file mode 100644
index 000000000..d0eb8ee0c
--- /dev/null
+++ b/.github/workflows/apply-strix-952-repair.yml
@@ -0,0 +1,107 @@
+name: Apply exact-head Strix 952 repair
+
+on:
+  pull_request_target:
+    types: [ready_for_review]
+    branches: [main]
+
+concurrency:
+  group: apply-strix-952-repair
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  apply:
+    if: >-
+      github.repository == 'ContextualWisdomLab/.github'
+      && github.event.pull_request.head.repo.full_name == github.repository
+      && github.event.pull_request.head.ref == 'fix/strix-base-runtime-contract-952'
+      && github.event.pull_request.head.sha == 'e6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04'
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact same-repository repair branch
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: fix/strix-base-runtime-contract-952
+          fetch-depth: 2
+          persist-credentials: true
+
+      - name: Verify immutable repair input
+        env:
+          EXPECTED_HEAD_SHA: e6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04
+        run: |
+          set -euo pipefail
+          actual_head_sha="$(git rev-parse HEAD)"
+          if [ "$actual_head_sha" != "$EXPECTED_HEAD_SHA" ]; then
+            echo "::error::Repair branch moved before trusted execution: expected $EXPECTED_HEAD_SHA, found $actual_head_sha."
+            exit 1
+          fi
+          test -f scripts/ci/apply_strix_952_repair_v2.py
+          test -f scripts/ci/strix_report_semantics.py
+          test -f scripts/ci/validate_strix_runtime_compatibility.py
+          test -f tests/test_strix_952_runtime_contract.py
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.13'
+
+      - name: Apply bounded production patch
+        run: |
+          set -euo pipefail
+          python3 scripts/ci/apply_strix_952_repair_v2.py
+          git diff --check
+
+      - name: Verify focused Python contracts
+        run: |
+          set -euo pipefail
+          python3 -m unittest \
+            tests.test_strix_952_runtime_contract \
+            tests.test_strix_nvidia_nim_not_found_fallback
+          python3 -m compileall -q \
+            scripts/ci/strix_report_semantics.py \
+            scripts/ci/validate_strix_runtime_compatibility.py \
+            tests/test_strix_952_runtime_contract.py \
+            tests/test_strix_nvidia_nim_not_found_fallback.py
+
+      - name: Verify trusted shell contracts
+        env:
+          STRIX_TEST_PROCESS_TIMEOUT_SECONDS: '1'
+          STRIX_TEST_FAKE_SLEEP_SECONDS: '2'
+        run: |
+          set -euo pipefail
+          bash -n scripts/ci/strix_quick_gate.sh
+          bash -n scripts/ci/test_strix_quick_gate.sh
+          bash scripts/ci/strix_required_workflow_smoke.sh
+          timeout 1200 bash scripts/ci/test_strix_quick_gate.sh
+
+      - name: Commit verified repair and delete all bootstrap tooling
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          rm -f \
+            .github/workflows/apply-strix-952-repair.yml \
+            .github/workflows/repair-strix-base-runtime-952.yml \
+            scripts/ci/apply_strix_952_repair.py \
+            scripts/ci/apply_strix_952_repair_v2.py
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add -A
+          git diff --cached --check
+          if git diff --cached --quiet; then
+            echo '::error::Expected verified Strix repair changes were not produced.'
+            exit 1
+          fi
+          git commit -m 'fix(strix): enforce complete runtime evidence'
+          git push origin HEAD:fix/strix-base-runtime-contract-952

From 92d13821f88d6bd9fd596edf6f4086eda9ca32f9 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 18 Aug 2026 17:29:31 -0700
Subject: [PATCH 2/2] ci: target one-shot Strix repair at isolated bootstrap
 base

---
 .github/workflows/apply-strix-952-repair.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/apply-strix-952-repair.yml b/.github/workflows/apply-strix-952-repair.yml
index d0eb8ee0c..853ede215 100644
--- a/.github/workflows/apply-strix-952-repair.yml
+++ b/.github/workflows/apply-strix-952-repair.yml
@@ -3,7 +3,7 @@ name: Apply exact-head Strix 952 repair
 on:
   pull_request_target:
     types: [ready_for_review]
-    branches: [main]
+    branches: [bootstrap/strix-952-branch-repair]
 
 concurrency:
   group: apply-strix-952-repair
@@ -16,6 +16,7 @@ jobs:
   apply:
     if: >-
       github.repository == 'ContextualWisdomLab/.github'
+      && github.event.pull_request.base.ref == 'bootstrap/strix-952-branch-repair'
       && github.event.pull_request.head.repo.full_name == github.repository
       && github.event.pull_request.head.ref == 'fix/strix-base-runtime-contract-952'
       && github.event.pull_request.head.sha == 'e6aadff4ea1ceefe2cc90fad45b66d1bf06b2d04'