ci: split docker smoke, fix mypy, update azure docs and dedupe aliases

[ecryptoguru]

• Splits Docker build and smoke tests into a dedicated docker-smoke CI job with a 120-minute timeout and NET_ADMIN/NET_RAW capability checks.
• Updates docs/llm-providers/azure.mdx with the preferred azure_ai/ model prefix and a full LYRASHIELD_* alias table.
• Adds LYRASHIELD_* aliases for dedupe settings and programmatic_tool_calling/server_conversation product env vars.
• Fixes mypy errors in lyrashield_adapter/cli.py and strix/core/inputs.py so verify-thin-fork.sh passes cleanly.

Verification:

• uv run ruff check strix lyrashield_adapter tests — passed
• uv run ruff format --check strix lyrashield_adapter tests — passed
• uv run mypy --exclude 'strix/interface/tui' strix lyrashield_adapter — passed
• uv run pytest -q — 593 passed

Summary by CodeRabbit

• Documentation

  • Updated Azure provider guidance with current model names, aliases, credential options, endpoint settings, and API-version configuration.
  • Clarified when programmatic tool calling is available.

• Configuration

  • Added LyraShield-prefixed environment variable alternatives for programmatic tool calling and deduplication services.
  • Improved handling of empty configuration values.

• Chores

  • Enhanced verification and Docker smoke tests with broader endpoint checks and improved failure diagnostics.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9df64e60-bb1b-4e36-9bda-66e04eb39dd2

📥 Commits

Reviewing files that changed from the base of the PR and between 9faf8b4 and 697d42f.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• docs/llm-providers/azure.mdx
• strix/config/models.py
• strix/config/settings.py

🚧 Files skipped from review as they are similar to previous changes (4)

• strix/config/models.py
• docs/llm-providers/azure.mdx
• strix/config/settings.py
• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The change expands LyraShield environment compatibility, updates Azure provider guidance and capability checks, and strengthens CI verification for the worker contract and sandbox container.

Changes

Runtime configuration and provider compatibility

Layer / File(s)	Summary
Environment aliases and capability configuration strix/config/settings.py, strix/config/models.py, docs/llm-providers/azure.mdx	Dedupe settings accept LyraShield-prefixed aliases and convert empty values to None. Programmatic tool-calling reads the LyraShield variable with legacy fallback. Azure documentation reflects the updated model names, aliases, and capability gate.

CI and sandbox validation

Layer / File(s)	Summary
Contract and Docker smoke checks .github/workflows/ci.yml	The verify job checks the public app contract and uploads build diagnostics on failure. Docker smoke tests add network capabilities, nmap, caido_api, GraphQL status validation, and Dockerfile diagnostics.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• ecryptoguru/lyrashield-engine#7: Both PRs modify runtime model and settings configuration for LyraShield environment compatibility.
• ecryptoguru/lyrashield-engine#33: Both PRs modify programmatic tool-calling capability handling.
• ecryptoguru/lyrashield-engine#42: Both PRs modify LyraShield environment-variable compatibility in runtime configuration.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main CI, Azure documentation, deduplication alias, and mypy changes in the pull request.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/docker-azure-ci

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lyrashield_adapter/cli.py`:
- Around line 58-69: Extend _STALE_EMPTY_ENV_VARS in lyrashield_adapter/cli.py
to include DEDUPE_LLM_API_KEY and DEDUPE_LLM_API_BASE so blank generic aliases
are purged before resolution. In strix/config/settings.py, update
DedupeSettings.api_key and api_base to use the existing empty-string-to-None
field validator pattern from LlmSettings._empty_env_to_none, covering callers
that bypass prepare_environment.

In `@strix/core/runner.py`:
- Around line 469-530: Update the ModelBehaviorError fallback in the root-agent
execution flow to rebuild run_config after creating the implicit-cache
model_settings and root_agent, so the retry uses the fallback configuration
rather than the original explicit prompt-cache settings. In the same fallback,
preserve resumed scan state by setting initial_input to [] when is_resume is
true, while continuing to build a new root task for non-resumed scans.

In `@strix/interface/main.py`:
- Around line 1102-1109: The dotenv loading paths use override=True despite
documenting that explicit shell exports take precedence. Update load_dotenv in
strix/interface/main.py lines 1102-1109 and the corresponding loading call in
lyrashield_adapter/cli.py lines 109-111 to use override=False, preserving the
documented precedence contract.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3bea81a3-cea9-4d56-b710-183f53e887b0

📥 Commits

Reviewing files that changed from the base of the PR and between 77bbada and 9faf8b4.

📒 Files selected for processing (9)

• .github/workflows/ci.yml
• docs/llm-providers/azure.mdx
• lyrashield_adapter/cli.py
• strix/config/models.py
• strix/config/settings.py
• strix/core/inputs.py
• strix/core/runner.py
• strix/interface/main.py
• tests/test_inputs.py