Repository navigation
feat(OMN-14665): triage 5 docstring-IP findings + self-wire ip/kafka/sqlite arch gates into core CI + pre-commit - #1454
Conversation
…sqlite arch gates Triages the three pre-existing finding classes that #1447 (OMN-14659) left un-self-wired and wires all three WS8 arch ValidatorNode gates into this repo's own pre-commit config + CI so omnibase_core lints itself green. Triage (per-line sanctioned annotations, never a blanket allowlist): - arch-no-hardcoded-ip: the 5 findings in models/handlers/model_handler_packaging.py (lines 35/36/122/132/133) are illustrative RFC1918/RFC5737 example IPs in docstrings that DOCUMENT that IP-literal hosts are valid in artifact-reference URL netlocs — pure documentation, not config. Annotated each with `# onex-allow-internal-ip`. (The pre-existing file-level `# onex-allow-file-internal-ip` only covers the OMN-13294 private-ip gate, which does not honor a file-level marker for this ported gate.) - arch-no-direct-kafka-producer: the 8 findings are ALL false positives from the oracle's SUBSTRING match on symbol names — ProtocolKafkaProducer* health-check protocol types and this check's own Node/Model/Visitor class names, none of which is a producer client. Added an additive, opt-in per-line `# onex-allow-kafka-producer` marker to the visitor (mirrors the raw-sqlite3 `# di-ok` mechanism; corpus lines carry no marker so oracle flag/message parity is preserved) and annotated the 8 lines. New tests cover the marker. - arch-no-raw-sqlite3: the 1 finding (runtime/harness/harness_projection_store_sqlite.py) is the zero-infra local-harness projection store — an in-process adapter bootstrap that owns its own connection by design (OMN-13420). Annotated the call with the sanctioned `# di-ok` marker. Wiring: - .pre-commit-config.yaml: added check-no-hardcoded-ip / check-no-direct-kafka-producer / check-no-raw-sqlite3 hooks (scoped to src/, matching the check-no-env-fallbacks precedent). Updated the now-stale "intentionally NOT self-wired" comment. - .github/workflows/: three STANDALONE no-`needs:` validator workflows (OMN-14666/14668 skip-then-vacuous-green lesson) running each node's unit tests + a blocking src/ self-scan, mirroring validator-no-io-outside-effects.yml. The SAME COMPUTE node backs the pre-commit hook and the CI self-scan, so verdicts cannot drift. Not added to required_status_checks (that is a branch-protection mutation, out of scope for this lane). - Fixed a pre-existing print-ok marker placement (opening line) in runtime_no_direct_kafka_producer_check.py that surfaced once the file was touched. dod_evidence: - All three gates self-scan src/ green: exit 0 for hardcoded-ip / kafka-producer / raw-sqlite3. - 58 validator-node unit tests pass (incl. 3 new suppression-marker tests). - 105 model_handler_packaging + mixin_health_check unit tests pass. - ruff format + ruff check clean; mypy clean on changed src; pre-commit clean on changed files (all three new hooks report Passed). Closes OMN-14665
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (13)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…ibase_core#1454 (#4313) * evidence(OMN-14665): author OCC companion for OmniNode-ai/omnibase_core#1454 OCC companion by node_pr_lifecycle_fix_effect (OMN-13317 F1 / OMN-13990 / OMN-14285). Product PR head 501ff50621e3df817c34ea7b5192d9068bd78628. * evidence(OMN-14665): self-bind OCC#4313 + rebind contract_sha256 * evidence(OMN-14665): repair OCC 4313 command bindings --------- Co-authored-by: omnimarket-bot <bot@omninode.ai>
1 participant
Summary
Closes OMN-14665. Triages the three pre-existing finding classes that #1447 (OMN-14659) explicitly left un-self-wired, then wires all three WS8 arch ValidatorNode gates (
arch-no-hardcoded-ip,arch-no-direct-kafka-producer,arch-no-raw-sqlite3) into omnibase_core's own.pre-commit-config.yaml+ CI so core lints itself (CLAUDE.md Rule #5 — enforcement in-repo).Triage — per-line sanctioned annotations, never a blanket allowlist
models/handlers/model_handler_packaging.pylines 35/36/122/132/133 are illustrative RFC1918/RFC5737 example IPs in docstrings that document that IP-literal hosts are valid in artifact-reference URL netlocs. Pure documentation, not config. Annotated each with# onex-allow-internal-ip. (The file's existing# onex-allow-file-internal-iponly covers the OMN-13294 private-ip gate; the ported OMN-14659 gate honors only the per-line marker.)ProtocolKafkaProducer*health-check protocol types and this check's ownNode/Model/Visitorclass names — none is a producer client. Added an additive, opt-in per-line# onex-allow-kafka-producermarker to the visitor (mirrors the raw-sqlite3# di-okmechanism; corpus lines carry no marker, so oracle flag/message parity is preserved) and annotated the 8 lines. New unit tests cover the marker (line-exact; deliberately does not leak onto the following line).runtime/harness/harness_projection_store_sqlite.pyis the zero-infra local-harness projection store, an in-process adapter bootstrap that owns its own connection by design (OMN-13420). Annotated with the sanctioned# di-okmarker.Wiring
.pre-commit-config.yaml: addedcheck-no-hardcoded-ip/check-no-direct-kafka-producer/check-no-raw-sqlite3hooks (scoped tosrc/, matching thecheck-no-env-fallbacksprecedent); replaced the now-stale "intentionally NOT self-wired" comment..github/workflows/: three STANDALONE, no-needs:validator workflows (OMN-14666/14668 skip-then-vacuous-green lesson) running each node's unit tests + a blockingsrc/self-scan, mirroringvalidator-no-io-outside-effects.yml. The same COMPUTE node backs the pre-commit hook and the CI self-scan, so local/CI verdicts cannot drift.# print-okmarker placement (opening line) inruntime_no_direct_kafka_producer_check.pythat surfaced once the file was touched.Not added to
required_status_checks— that is a branch-protection mutation, out of scope for this (non-gated dev) lane. Operator/Codex can promote to required later.dod_evidence
src/green (exit 0): hardcoded-ip, kafka-producer, raw-sqlite3.# onex-allow-kafka-producersuppression tests.model_handler_packaging+mixin_health_checkunit tests pass.ruff format+ruff checkclean;mypyclean on changed src;pre-commit run --files <changed>— all three new hooks report Passed, full run 0 failures.🤖 Generated with Claude Code
Evidence-Ticket: OMN-14665
Evidence-Source: OCC#4315
Evidence-Commit: fdd79e6a59dc2a5186d39d561f1c2ffdf390219d
Evidence-Head: 501ff50