fix(engine): Deep Review v20 wave 3 — resume revision guard, replay User-Agent and worker pin

[ecryptoguru]

Result

Closes Deep Review v20 engine findings P2-5 and P2-6 and advances the reviewed worker-consumer pin (P2-3). Three commits in item order:

• 3.1 9851a9ef — resume refuses a cached repository clone whose HEAD moved off the recorded revision. The check is read-only (git rev-parse HEAD); _assert_checkout_revision() and its checkout --detach are not called on this path and the altered clone is left untouched.
• 3.2 a3439087 — replay requests default to LyraShield/<version> (+https://lyrashieldai.com) via the lyrashield-engine package-version lookup. A caller-supplied User-Agent wins in any letter case.
• 3.3 1667a1a0 — .lyrashield-worker-pin moves from the squash-orphaned 68a31904 to merged web main c99cd61d and apps/worker/src/engine/run-json-1-1.test.ts joins scripts/worker-contract-tests.txt. Self-contained and independently droppable.

Rulings honoured

• No edits under strix/**; deliberate openai, litellm, openai-agents and cryptography pins unchanged; no lockfile regeneration.
• Commit 3.3 is last and droppable as instructed.
• No web ENGINE_REVISION values touched.
• No comma before "and"/"or" in added text or commit messages (0 hits on the diff).

Validation

• scripts/verify-controlled-derivative.sh on head 1667a1a0: footprint digest PASS, uv sync --frozen PASS, ruff PASS, ruff format PASS (378 files), pytest PASS (2504 passed / 4 skipped), mypy PASS (191 files), bandit PASS (advisory only).
• Failing-first evidence: test_resume_refuses_a_clone_whose_head_moved failed on baseline with DID NOT RAISE SystemExit; test_replay_default_user_agent_identifies_lyrashield failed with ['strix'] on the wire; test_upstream_brand_default_header_fails_gate failed because the exact-match allowlist hid the old default.
• Independent re-run by the dispatching agent: 26/26 tests pass across test_resume_state.py, test_replay_scope_admission.py and test_customer_branding.py.
• CI on head 1667a1a0: ALL GREEN — verify (ruff/pytest 2504/mypy/bandit/footprint + pinned worker contract), dependency audit, sandbox image build. The verify log shows WORKER_PIN: c99cd61d and a clean verify-worker-contract.sh run against a real web checkout at that SHA.

Evidence boundary

• verify-worker-contract.sh was verified by CI (above), not re-run locally — the engine environment has no web checkout.
• Merging this PR does not deploy engine code. Web deploy-azure.yml and release-tauri.yml remain pinned to engine 81cd6f70; runtime closure for 3.1 and 3.2 requires a separately reviewed web engine-pin change and a production release with live readback.

Not touched

strix/**, engine dependency pins and lockfile, sandbox flags, worker container definitions, web ENGINE_REVISION, billing, pricing, Myra flags, trial-claim backfill.

Report back

• The pin file on origin/main contained 68a31904 (squash-orphaned as the handoff stated). If web PRs 1–2 merge before this PR and the founder prefers the pin on the post-merge SHA, drop 1667a1a0 and re-pin.
• The previous setdefault("User-Agent", "strix") emitted a duplicate header when a caller supplied a lowercase user-agent key; the new default resolves caller keys case-insensitively.
• The stale exact-match allowlist entry for the old UA line was removed so the customer-branding gate now catches upstream branding in outbound default headers.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 5acf24ce-ae60-44ab-a760-59b7308c0618

📥 Commits

Reviewing files that changed from the base of the PR and between 81cd6f7 and 1667a1a.

📒 Files selected for processing (9)

• .lyrashield-worker-pin
• lyrashield/interface/main.py
• lyrashield/interface/utils.py
• lyrashield/tools/proxy/caido_api.py
• scripts/customer-branding-allowlist.json
• scripts/worker-contract-tests.txt
• tests/test_customer_branding.py
• tests/test_replay_scope_admission.py
• tests/test_resume_state.py

 _____________________________________________________________
< I'm sorry, Dave. I'm afraid I can't let you write that bug. >
 -------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}