The owner requested Strix alongside the optional security-audit integration. Use the same opt-in, fixed-revision, short-entry-point approach. Strix is an active pentesting runtime; this change integrates its skills and tests installation, without installing that runtime or launching a scan.
- Manifest owns the source identity: usestrix/strix revision f7a32ae62d94872631bc8415073868d02a6ffdaf, nine complete skills and Apache-2.0 LICENSE, 85,970 bytes. Each blob was retrieved from that Git tree and verified before writing. No root NOTICE exists at this revision; original license and skill metadata remain intact.
- Original references live under template/ai-kit/vendor/strix; .gitattributes preserves their bytes on Windows. Installer shares bounded manifest/tree verification with Cloudflare: identity, required files, case-fold aliases and path segments, linked/non-regular paths, one MiB/file and five MiB total limits, sizes, Git blobs and SHA-256. It never fetches or executes upstream code.
- --with-strix / the boolean strix setting select only this payload. Defaults and preset bundles omit it; presets preserve prior explicit selection. Cloudflare and Strix choices are independent. Registry entries are filtered when absent.
- Short skill is the only discoverable entry point: Codex allow_implicit_invocation=false; Claude disable-model-invocation=true. All nine upstream skills remain conditional references, including cloud and CI instructions. Runtime setup, target execution, publication and fixes remain governed by the user's scope and Core.
- The installed contract owns mode selection, runtime boundaries and usage. Upstream's floating installer, cloud fallback and model examples do not become defaults. Code targets are writable, so execution uses an isolated reviewed copy; headless scope is selected explicitly to avoid accidentally reviewing only a diff. Local execution can expose code to the chosen model provider.
- Existing baseline/conflict/candidate/backup behavior manages the selected files. Disabling selection retains/reports old files; native-client retirement still needs explicit review. Nothing removes locally adapted source instructions silently.
- Checker exempts only successfully manifest-verified external references from authored-language, document-size and active-model example restrictions; UTF-8, skill metadata and Markdown links remain checked. Model examples in these references are not active AI-KIT provider selections.
Read at the pinned revision on 2026-10-12: skill workflow, runtime package, CLI flags, Docker client and mount handling. The package declares Python >=3.12 and version 1.7.0; this is source metadata, not evidence of an installed or matching published runtime. Docker network capabilities and writable mounts invalidate any assumption of automatically enforced isolation. A reference pin alone does not pin external dependencies or images.
- Full Windows/Python 3.12.14 discovery: 285 tests in 938.375 seconds, 281 passed and four runtime skips (POSIX hook, symlink creation and two junction scenarios). This includes both optional integrations, the unlisted-empty-directory guard, checker regressions and existing installer behavior; no failures.
- Windows/Python 3.12.14 targeted integration: 12 tests passed in 72.911 seconds. Covered absent defaults/all presets, independent persistent choices, process/network-free preview/apply, complete pin/license, manual source/native metadata, links/doctor, nested upgrades/backups, local adaptations/conflicts/candidates, retained deselection and native retirement, malformed identities/settings, traversal/reserved names/case-fold directory aliases, incomplete trees, linked sources/targets and CLI preview. The later unlisted-empty-directory guard is covered by full discovery.
- Kit validation passed with zero errors/warnings, including reference and private/team Git visibility. All 10 Strix and 21 Cloudflare blobs also matched with core.autocrlf=true; no upstream bytes were modified. Changed Python files passed Python 3.10 grammar. Strix skill-creator validation passed using existing Ubuntu Python/PyYAML.
- An additional installed Composer fixture checked all 16 Strix entry-point/reference/metadata paths in private and team modes: private paths were ignored, team paths remained visible, and installed links resolved. The check used NUL-delimited Git path input/output to avoid Windows text-stream newline translation.
- Offline Windows wheel build without new dependencies/build isolation passed fresh-environment installation, packaged kit validation, default install, both optional payloads with Codex/Claude copies, doctor (zero errors/warnings) and stable rerun. This verifies packaged resources, not Linux/macOS wheel execution or native activation.
- Self-review covered canonical ownership, preserved defaults and earlier local work, conditional discovery, exact bounded file coverage, path/link refusal, byte preservation/license, independent extras, conflicts/baselines/candidates/backups, retained deselection, client retirement, registry links, visibility and wheel resources. External examples retain their original bytes without becoming active model choices.
- Strix CLI was not found on the local PATH. No runtime/dependencies/images were installed, and no target, model, container, cloud, CI scan or native client activation was run. Runtime readiness and actual vulnerability results remain unverified.
- Release labeling as v1.1.0: eight CLI tests passed; CLI version source, wheel filename/metadata and packaged VERSION matched 1.1.0. Rebuilt offline Windows wheel passed fresh-environment default/both-extra installs, doctor and stable rerun. A synthetic 0.13.0-to-1.1.0 upgrade preserved project facts, settings, adapted skill bytes and both pin manifests. The full 285-test run above preceded labeling; this task changed only documentation and VERSION. Release record.