When does Knox trip?

Short Answer:

Knox trips whenever an "untrusted" Boot path has been booted from, this means anything which isn't the default boot configuration, including custom ROMs or Magisk-patched boot images.

Long Answer:

To be more specific than above, the e-Fuse will be tripped when any of the following applies:
the device boots with a non-Samsung signed:

  • Bootloader
  • Kernel
  • Kernel initialization script
  • Data