Skip to content

feat(OMN-16677): expose the tier-0 local runtime harness as onex run - #1603

Merged
jonahgabriel merged 2 commits into
devfrom
jonah/omn-16677-onex-run-harness
Aug 27, 2026
Merged

jonahgabriel merged 2 commits into
devfrom
jonah/omn-16677-onex-run-harness

Conversation

@jonahgabriel

@jonahgabriel jonahgabriel commented Aug 27, 2026 •

Copy link
Copy Markdown
Contributor

What

Registers onex run <workflow> on the packaged onex click group, so the tier-0
infra-free local runtime harness (OMN-13420) is reachable as a product surface instead
of only as an internal module path against a venv-relative interpreter.

Before: ./.venv/bin/python -m omnibase_core.runtime.harness.harness_cli delegation ...
After: onex run delegation ...

How

src/omnibase_core/runtime/harness/harness_cli.py's argparse core is refactored into
shared callables — run_harness_workflow (the run itself) and build_inference_adapter
(adapter selection, including the fail-loud VALIDATION_ERROR on under-specified
combinations) — plus a WORKFLOW_DEFAULT_PROMPTS map that both entry points read, so the
accepted workflow names and their default prompts cannot drift apart.

src/omnibase_core/cli/cli_run.py is the new click command: flag parsing only, then
hand-off to run_harness_workflow. python -m omnibase_core.runtime.harness.harness_cli
remains as a thin argparse shim over the same callable. One implementation of the run, no
parallel copy, no back-compat rename.

run-node (remote Kafka node dispatch) is not renamed or otherwise touched beyond one
line of help text on each command distinguishing local in-process harness (run) from
remote dispatch (run-node).

Diff shape

 src/omnibase_core/cli/cli_commands.py            |   5 +
 src/omnibase_core/cli/cli_run.py                 | 134 ++++++++
 src/omnibase_core/cli/cli_run_node.py            |   4 +
 src/omnibase_core/runtime/harness/harness_cli.py | 151 ++++++--
 tests/unit/cli/test_cli_run_harness.py           | 418 +++++++++++++++++++++++
 5 files changed, 685 insertions(+), 27 deletions(-)

Verification

  • tests/unit/cli/test_cli_run_harness.py (418 lines, TDD-first, click CliRunner) asserts
    exit code, evidence-packet fields (bus_impl: EventBusInmemory, infra_free: true), the
    sea variant, UUID-only --correlation-id handling, the surviving python -m shim, and
    the OMN-13496 false-green negative control — --inference fixture with no
    --fixture-completion still raises VALIDATION_ERROR.
  • Governed pre-push impacted-test selector run on the .201 serialized queue lane, no
    bypass flags (PREPUSH_FULL_SUITE, ENABLE_SMART_TESTS, PREPUSH_ALLOW_LOCAL_FULL_SUITE,
    --no-verify all unused). This branch's selection was the whole tests/ tree.
  • origin/dev was merged up into this branch before the push so it carries the OMN-16297
    flaky-assertion fix (omnibase_core#1602, squash 918ba72e22612a6b0d36750f15f35d8308934dd5);
    without it the run could be refused by a sub-millisecond wall-clock assertion unrelated to
    this change.

OMN-16677

Evidence-Ticket: OMN-16677
Evidence-Source: OCC#7295

jonahgabriel and others added 2 commits August 26, 2026 16:32
The infra-free local runtime harness (OMN-13420) is the documented first-run
experience, but was reachable only as:

    ./.venv/bin/python -m omnibase_core.runtime.harness.harness_cli delegation ...

That is not a product surface — it leaks an internal module path, assumes the
venv layout, and is invisible to `onex --help`. `[project.scripts] onex` already
pointed at the click group; the harness was simply never registered on it.

Adds `onex run <delegation|sea>` with the same options the harness CLI already
accepted. The argparse core is refactored into one shared callable,
`run_harness_workflow`, which both the new click command and the existing
`python -m` shim call. There is no second copy of the logic and no behavior
change: the `python -m` path keeps working exactly as before.

`run-node` (remote Kafka dispatch) is untouched; both commands now carry one
help line naming which runtime they target, so they are not confusable.

Refs: OMN-16677
@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

Next included review available in 52 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 130 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3f976ea9-016e-4eb1-b3e8-323688866390

📥 Commits

Reviewing files that changed from the base of the PR and between 918ba72 and c458ac1.

📒 Files selected for processing (5)
  • src/omnibase_core/cli/cli_commands.py
  • src/omnibase_core/cli/cli_run.py
  • src/omnibase_core/cli/cli_run_node.py
  • src/omnibase_core/runtime/harness/harness_cli.py
  • tests/unit/cli/test_cli_run_harness.py

Comment @coderabbitai help to get the list of available commands.

jonahgabriel pushed a commit to OmniNode-ai/onex_change_control that referenced this pull request Aug 27, 2026
…#7295)

* evidence: OCC companion pass 1 for OmniNode-ai/omnibase_core#1603

* evidence: OCC companion self-bind for #7295

---------

Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
@jonahgabriel
jonahgabriel enabled auto-merge (squash) August 27, 2026 13:20
@jonahgabriel
jonahgabriel merged commit 2a5ac71 into dev Aug 27, 2026
287 of 299 checks passed
@jonahgabriel
jonahgabriel deleted the jonah/omn-16677-onex-run-harness branch August 27, 2026 14:02
jonahgabriel added a commit that referenced this pull request Aug 28, 2026
… models, secrets pragma, release-identity bump

Five gate failures on omnibase_core#1604, fixed in one pass so the governed
selector runs once rather than five times.

1. Empty section header parsed to None and refused the whole file.
   `logging:` with no children under it is valid YAML that parses to None,
   not a mapping, so `normalize_user_config` raised "'logging' must be a
   mapping ... got NoneType" and aborted `config init --force`,
   `refresh-credentials` and `bootstrap apply` for a file any user can
   produce by commenting out the keys in a section. An empty section carries
   no values, so its defaults are filled instead. Pinned by a RED-first
   test: reverting the six-line guard reproduces the exact ModelOnexError.

2. User-configuration value models are now immutable (`frozen=True` on all
   five). Nothing in src/ or tests/ mutates them — verified by grep for
   attribute assignment before the change — so this closes the hole rather
   than describing it.

3. detect-secrets flagged two test fixtures (a fake `lin_api_secret` and an
   AWS secret *name*, not a value). Marked with the tool's own documented
   `pragma: allowlist secret` mitigation; the assert was split across lines
   so the pragma fits without a long-line violation.

4. pyproject 0.46.13 -> 0.46.14. The OMN-13411 release-identity gate refuses
   a PR whose packaged source changed while the version merely equals the
   latest published version.

Not fixed, deliberately: CodeRabbit's suggestion to type `logging.level`
with the existing `EnumLogLevel`. That enum's values are lowercase
("info"/"debug"), while this config's on-disk contract is uppercase
("INFO"). Adopting it would silently rewrite every existing user's
`level: INFO` to `level: info` — the exact class of silent config rewrite
this ticket exists to eliminate. Declined on the PR thread, not skipped.

kb-doc-gate is failing for an unrelated infrastructure reason (its own
checkout of `.omniclaude-kb-doc-gate/scripts/kb_doc_gate.py` is missing);
it failed identically on #1603, which merged.

Verification: ruff format (no changes), ruff check clean, mypy --strict
clean on all touched files, tests/unit/cli 613 passed, and
test_cli_user_config.py 28 passed including the new RED-first test.
github-actions Bot pushed a commit that referenced this pull request Aug 28, 2026
…rs (#1604)

* fix(OMN-16037): unify ~/.onex/config.yaml schema across all CLI writers

`~/.onex/config.yaml` had two incompatible writers. `onex config init`
wrote `{mode: standalone, kafka, logging}`; `onex init --user-config`
wrote `{version, mode, credentials, paths}`. Whichever ran last silently
redefined the file the connect-cloud onboarding flow depends on.

Surviving schema is the union, keyed on the richer version/mode/
credentials/paths shape and retaining the operational kafka/logging
sections: version, mode, credentials, paths, kafka, logging.

- New `cli/cli_user_config.py` is the single read/normalize/write surface;
  `ModelCliUserConfig` (extra="forbid") types the managed sections and
  `EnumUserConfigMode` replaces the free-string mode.
- All four writers migrated onto it: `config init`, `init --user-config`,
  `refresh-credentials`, and `bootstrap apply` (the last two could
  otherwise re-persist a legacy shape). Each had its own private
  `_config_path`; now there is one `user_config_path`, and exactly one
  raw-YAML call site (`parse_user_config_text`).
- Legacy files migrate rather than break: `mode: standalone` -> `local`,
  missing sections filled with defaults. Validated sections are merged
  back OVER the raw mapping, so unmanaged sections (the `aws:` block
  written by refresh-credentials) and hand-added keys inside managed
  sections survive every rewrite. `--force` now migrates in place instead
  of destroying user credentials.
- `config init`/`config get` gain the hidden `--onex-home` override that
  `init --user-config` already had, so all writers are testable and
  symmetric.

Ticket premise correction: the ticket also claimed `onex health` was not
registered in `cli_commands.py` and asked to register or de-scope it. That
half is false — `health` is registered at `cli_commands.py:355` via
`@cli.command()` and runs clean, so OMN-8796's DoD claim is accurate and
needs no correction. The real adjacent defect was next to it:
`init --user-config` told new users to run `onex health --mode local`,
which fails with `No such option: --mode` — the first command a new user
was told to type. Hint corrected, with a test asserting every printed
`Run: onex ...` hint is actually invocable.

Also carries the repo's own yamlfmt normalization of five node contract
descriptions and the deploy-gate action, which were pre-existing drift on
dev that the yamlfmt hook rewrites on every commit.

Tests: 27 new covering both writers producing byte-identical output, the
template-vs-model anti-drift ratchet, legacy migration in both directions,
preservation of unmanaged/unknown keys, and health registration.
605 tests in tests/unit/cli pass; mypy --strict clean on all touched files.

* fix(OMN-16037): satisfy release and secret gates

* fix(OMN-16037): CI remediation — empty section headers, frozen config models, secrets pragma, release-identity bump

Five gate failures on omnibase_core#1604, fixed in one pass so the governed
selector runs once rather than five times.

1. Empty section header parsed to None and refused the whole file.
   `logging:` with no children under it is valid YAML that parses to None,
   not a mapping, so `normalize_user_config` raised "'logging' must be a
   mapping ... got NoneType" and aborted `config init --force`,
   `refresh-credentials` and `bootstrap apply` for a file any user can
   produce by commenting out the keys in a section. An empty section carries
   no values, so its defaults are filled instead. Pinned by a RED-first
   test: reverting the six-line guard reproduces the exact ModelOnexError.

2. User-configuration value models are now immutable (`frozen=True` on all
   five). Nothing in src/ or tests/ mutates them — verified by grep for
   attribute assignment before the change — so this closes the hole rather
   than describing it.

3. detect-secrets flagged two test fixtures (a fake `lin_api_secret` and an
   AWS secret *name*, not a value). Marked with the tool's own documented
   `pragma: allowlist secret` mitigation; the assert was split across lines
   so the pragma fits without a long-line violation.

4. pyproject 0.46.13 -> 0.46.14. The OMN-13411 release-identity gate refuses
   a PR whose packaged source changed while the version merely equals the
   latest published version.

Not fixed, deliberately: CodeRabbit's suggestion to type `logging.level`
with the existing `EnumLogLevel`. That enum's values are lowercase
("info"/"debug"), while this config's on-disk contract is uppercase
("INFO"). Adopting it would silently rewrite every existing user's
`level: INFO` to `level: info` — the exact class of silent config rewrite
this ticket exists to eliminate. Declined on the PR thread, not skipped.

kb-doc-gate is failing for an unrelated infrastructure reason (its own
checkout of `.omniclaude-kb-doc-gate/scripts/kb_doc_gate.py` is missing);
it failed identically on #1603, which merged.

Verification: ruff format (no changes), ruff check clean, mypy --strict
clean on all touched files, tests/unit/cli 613 passed, and
test_cli_user_config.py 28 passed including the new RED-first test.

* fix(OMN-16037): pin kb doc gate to validator-ref repair

---------

Co-authored-by: jonahgabriel <jonah.neugass@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant