Repository navigation
feat(OMN-14805): flip node_runtime_source_attestor_effect to canonical def-B (handflip) - #2349
Merged
jonahgabriel merged 6 commits intoJul 20, 2026
Merged
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 8 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (14)
📝 WalkthroughWalkthroughChangesSource attestation dispatch
Workflow execution routing
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant RuntimeEvent
participant DispatchCallback
participant HandlerSourceAttestation
RuntimeEvent->>DispatchCallback: dispatch ModelRuntimeBootedEvent
DispatchCallback->>HandlerSourceAttestation: handle(event)
HandlerSourceAttestation-->>DispatchCallback: ModelSourceAttestationResult
DispatchCallback-->>RuntimeEvent: SUCCESS result
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
added a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Jul 19, 2026
…ibase_infra#2349 (#4446) * evidence(OMN-14805): author OCC companion for OmniNode-ai/omnibase_infra#2349 OCC companion by node_pr_lifecycle_fix_effect (OMN-13317 F1 / OMN-13990 / OMN-14285). Product PR head 6bb46ad986f58bb69337f07a7122efa4b2346e00. * evidence(OMN-14805): self-bind OCC#4446 + rebind contract_sha256 --------- Co-authored-by: omnimarket-bot <bot@omninode.ai>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/call-reject-skip.yml (1)
45-45: 🔒 Security & Privacy | 🔵 Trivial | 🏗️ Heavy liftAvoid mutable
@devreferences for required cross-repository gates.These changes make gate implementations follow moving branches; the call-reject change also downgrades an immutable SHA to a branch. Pin the tested commits before release, or explicitly enforce protected branches and a receipt/verification mechanism for this temporary stack wiring.
.github/workflows/call-reject-skip.yml#L45-L45: replace@devwith the tested immutable commit SHA..github/workflows/cr-thread-gate-caller.yml#L43-L43: pin the delegated CodeRabbit gate to its tested commit SHA..github/workflows/deploy-gate.yml#L36-L36: pin the deploy-gate reusable workflow to its tested commit SHA..github/workflows/imperative-contract-guard.yml#L33-L33: pin the contract guard to its tested commit SHA..github/workflows/pr-title-check.yml#L31-L31: pin the PR-title reusable workflow to its tested commit SHA.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/call-reject-skip.yml at line 45, Replace mutable branch references with the tested immutable commit SHA for each delegated gate: .github/workflows/call-reject-skip.yml:45, .github/workflows/cr-thread-gate-caller.yml:43, .github/workflows/deploy-gate.yml:36, .github/workflows/imperative-contract-guard.yml:33, and .github/workflows/pr-title-check.yml:31. Update each workflow’s uses reference while preserving the existing reusable workflow targets.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cr-thread-gate.yml:
- Around line 43-50: Update the runner-selection expression in the workflow’s
runs-on configuration to apply the dev/public runner policy for every
PR-triggered event, including review, review-comment, and PR-backed
issue-comment paths. Pass the pull request base branch through workflow_call or
derive it from the PR number, then use that value instead of relying only on
github.event_name == 'pull_request'; retain the existing trusted-runner fallback
for non-dev or non-PR executions.
In @.github/workflows/dispatcher-route-coverage.yml:
- Around line 72-79: Update the checkout configuration used before running
scripts/check_dispatcher_route_coverage.py to set persist-credentials: false,
and restructure the workflow so the checkout using secrets.OMNI_GITHUB_TOKEN or
github.token is not exposed to or executed alongside PR-controlled workspace
code.
---
Nitpick comments:
In @.github/workflows/call-reject-skip.yml:
- Line 45: Replace mutable branch references with the tested immutable commit
SHA for each delegated gate: .github/workflows/call-reject-skip.yml:45,
.github/workflows/cr-thread-gate-caller.yml:43,
.github/workflows/deploy-gate.yml:36,
.github/workflows/imperative-contract-guard.yml:33, and
.github/workflows/pr-title-check.yml:31. Update each workflow’s uses reference
while preserving the existing reusable workflow targets.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 635de29e-d34c-4e50-b1af-64f130295e33
📒 Files selected for processing (33)
.github/workflows/artifact-reconciliation-webhook.yml.github/workflows/call-reject-skip.yml.github/workflows/canonical-inference-gate.yml.github/workflows/check-handshake.yml.github/workflows/ci.yml.github/workflows/contract-validation.yml.github/workflows/cr-thread-gate-caller.yml.github/workflows/cr-thread-gate.yml.github/workflows/dep-provenance-gate.yml.github/workflows/deploy-gate.yml.github/workflows/dispatch-parity-gate.yml.github/workflows/dispatcher-route-coverage.yml.github/workflows/duplication-sweep.yml.github/workflows/fresh-deploy-fitness.yml.github/workflows/imperative-contract-guard.yml.github/workflows/integration-test-check.yml.github/workflows/main-target-guard.yml.github/workflows/no-bare-compose-teardown.yml.github/workflows/node-migration-sync.yml.github/workflows/non-dev-base-guard.yml.github/workflows/omni-standards-compliance.yml.github/workflows/pr-title-check.yml.github/workflows/product-readiness-shadow.yml.github/workflows/receipt-honesty.yml.github/workflows/runner-disk-preflight.yml.github/workflows/runner-routing-audit.yml.github/workflows/security-scan.yml.github/workflows/seed-provenance-check.yml.github/workflows/shellcheck-gate.yml.github/workflows/skill-node-mapping-sync.yml.github/workflows/stale-todo-gate.yml.github/workflows/url-authority-gate.yml.github/workflows/validate-validator-requirements.yml
…l def-B (handflip) Pure rename attest->handle preserving the attestation body verbatim. The business-logic helpers (_resolve_main_head/_compute_distance/_emit_friction) are byte-identical base_ref<->HEAD, re-derived from git by the canonical-shape ratchet via the sanctioned hand-flip proof path (no fabricated equivalence replay). - handler: rename attest -> handle (canonical def-B dispatch entrypoint that auto-wiring _make_dispatch_callback binds); helpers preserved verbatim, no retained attest, no delegating shim. - tests: drive handle through the REAL _make_dispatch_callback (RED missing-handle ModelOnexError -> GREEN SUCCESS ModelDispatchResult) over a 4-event deterministic corpus; existing unit+integration tests repointed attest -> handle. - flip proof (scripts/ci/adequacy_receipts/): adequacy receipt (measured 32.99% branch coverage over the selected corpus + explicit uncovered waiver) + hand-flip proof (verbatim-preserved helper symbols + green parity tests), bound to one selected_input_hashes set. - baselines: remove node from canonical_handler_shape_baseline NON_CANONICAL (via --update, receipt-proven) + handler_dispatch_entrypoint_baseline known_entrypointless. - exemption: canonical 'handle' entrypoint added to validation_exemptions.yaml (generic-pattern checker visits sync FunctionDef but not async; the sync def-B handle is equally protocol-mandated). Parent epic: OMN-14510 (missing-handle burn-down). Proves the flip-proof engine + the verify_flip_bundle pre-PR seam gate end-to-end on one real node. Deploy-scoped (runtime node handler): the OCC companion for OMN-14805 carrying the deploy-scope DoD evidence is authored separately; the local pre-push deploy-scope gate reports NOTICE_COMPANION_UNMERGED until it merges.
This was referenced Jul 20, 2026
jonahgabriel
force-pushed
the
jonah/omn-14805-source-attestation-defb-handflip
branch
from
July 20, 2026 04:14
e68b8e3 to
ebdd084
Compare
jonahgabriel
deleted the
jonah/omn-14805-source-attestation-defb-handflip
branch
July 20, 2026 04:27
This was referenced Jul 20, 2026
jonahgabriel
pushed a commit
that referenced
this pull request
Jul 20, 2026
…onical def-B Behavior-preserving hand-flip (OMN-14781) of HandlerBrokerDiskWatermark: the op-method probe_disk_watermark(inp) is renamed to the canonical def-B handle(inp) dispatch entrypoint that auto-wiring's _make_dispatch_callback binds. The probe body and every business-logic helper (_classify / _probe_path / _real_docker_info / _real_disk_usage / _resolve_volume_mountpoint) are preserved byte-identically; no envelope import, no Plugin* base. - Removes the node from BOTH baselines (shrink-only): canonical-shape NON_CANONICAL (91->90) and handler-dispatch-entrypoint known_entrypointless (37->36). - Adds the adequacy receipt + hand-flip proof under scripts/ci/adequacy_receipts/ bound to one selected-input corpus; verify_flip_bundle (OMN-14809) passes all six assertions. - Adds the sync-handle generic-name exemption (mirrors handler_release_identity). - Repoints the existing unit suite to handle() (behavior-equivalence parity) and adds a new dispatch-entrypoint test driving the REAL _make_dispatch_callback (RED->GREEN: pre-flip binds _missing_handle and raises ModelOnexError). Class-B Tier-1 flip under epic OMN-14355 (hand-flip path, canary #2349 template). Evidence-Ticket: OMN-14816 Evidence-Source: OMN-14816
jonahgabriel
added a commit
that referenced
this pull request
Jul 20, 2026
…onical def-B (#2354) * feat(OMN-14816): regenerate node_broker_disk_watermark_compute to canonical def-B Behavior-preserving hand-flip (OMN-14781) of HandlerBrokerDiskWatermark: the op-method probe_disk_watermark(inp) is renamed to the canonical def-B handle(inp) dispatch entrypoint that auto-wiring's _make_dispatch_callback binds. The probe body and every business-logic helper (_classify / _probe_path / _real_docker_info / _real_disk_usage / _resolve_volume_mountpoint) are preserved byte-identically; no envelope import, no Plugin* base. - Removes the node from BOTH baselines (shrink-only): canonical-shape NON_CANONICAL (91->90) and handler-dispatch-entrypoint known_entrypointless (37->36). - Adds the adequacy receipt + hand-flip proof under scripts/ci/adequacy_receipts/ bound to one selected-input corpus; verify_flip_bundle (OMN-14809) passes all six assertions. - Adds the sync-handle generic-name exemption (mirrors handler_release_identity). - Repoints the existing unit suite to handle() (behavior-equivalence parity) and adds a new dispatch-entrypoint test driving the REAL _make_dispatch_callback (RED->GREEN: pre-flip binds _missing_handle and raises ModelOnexError). Class-B Tier-1 flip under epic OMN-14355 (hand-flip path, canary #2349 template). Evidence-Ticket: OMN-14816 Evidence-Source: OMN-14816 * fix(OMN-14816): offload broker disk probe dispatch --------- Co-authored-by: Jonah Gray <jonah.g.gray@gmail.com>
jonahgabriel
added a commit
that referenced
this pull request
Jul 20, 2026
…f-B (#2360) * feat(OMN-14825): regenerate node_model_router_compute to canonical def-B Rename HandlerScoreModels.score_candidates -> handle(request) -> response (canonical definition B, OMN-14355). Pure method rename: the scoring body and every module-level scoring helper are byte-identical base_ref<->HEAD (OMN-14781 hand-flip path, mirrors canary PR #2349). No ModelEventEnvelope, no Plugin base, stateless/deterministic COMPUTE. - Repoint live caller services/routing_api/routes.py + unit/integration tests. - Shrink NON_CANONICAL + known_entrypointless twin baselines. - Adequacy receipt + hand-flip proof + legacy-vs-def-B equivalence goldens. - validation_exemptions.yaml: sync def-B handle entrypoint (matches OMN-14805). Proof: - verify_flip_bundle (OMN-14809) OK: all six assertions hold. - canonical_handler_shape ratchet --full: new=0 unproven_flips=0. - Tests-as-proof RED (13 fail on pre-flip base) -> GREEN (14 pass on flip). - ruff/mypy clean; pre-commit (commit stage) 61 passed / 0 failed. Deploy-scope DoD: this flip touches a deploy-scoped runtime handler. Per the no-self-authored-evidence rule the OCC companion for OMN-14825 is authored separately (Codex/autobind); the local pre-push mirror reports NOTICE_COMPANION_UNMERGED and the hosted deploy-gate resolves the companion. Closes OMN-14825 Evidence-Ticket: OMN-14825 Evidence-Source: OMN-14825 * fix(OMN-14825): sync model router contract --------- Co-authored-by: Jonah Gray <jonah.g.gray@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Flips
node_runtime_source_attestor_effect(HandlerSourceAttestation) to canonicaldef-B via the HANDFLIP path (a pure rename
attest→handle, no golden recording,no self-authored equivalence replay — the canonical-shape ratchet re-derives the proof
from git). This is CANARY #1 of the canonical-shape flip-proof engine: it proves the
engine plus the new
verify_flip_bundlepre-PR seam gate end-to-end on one real node.ratchet OMN-14355; hand-flip proof path OMN-14781; seam gate OMN-14809).
omnibase_infra(auto-merge disabled → non-draft, do not merge/arm).What changed
attest(event)→handle(event: ModelRuntimeBootedEvent) -> ModelSourceAttestationResultas the canonical def-B dispatch entrypoint auto-wiring's
_make_dispatch_callbackbinds.The three business-logic helpers (
_resolve_main_head/_compute_distance/_emit_friction)are byte-identical base_ref↔HEAD. No retained
attest, no delegating shim._make_dispatch_callbackover a4-event deterministic corpus (RED missing-handle → GREEN SUCCESS); existing unit + integration
tests repointed
attest→handle.scripts/ci/adequacy_receipts/): adequacy receipt + hand-flip proof, bound toone
selected_input_hashesset.canonical_handler_shape_baseline.pyNON_CANONICAL(via--update, receipt-proven) and fromhandler_dispatch_entrypoint_baseline.yamlknown_entrypointless(OMN-14135 shrink-only).handleentrypoint added tovalidation_exemptions.yaml— thegeneric-pattern checker visits sync
ast.FunctionDefbut not async, so it flags this syncdef-B
handlewhile missing the asynchandleon every other canonical handler;handleisthe protocol-mandated def-B name (mirrors the existing
executeprotocol-entrypoint exemptions).dod_evidence
RED (pre-flip, current dev tree) — the missing-handle defect
Driving the REAL
_make_dispatch_callback(HandlerSourceAttestation(), None)over a realModelRuntimeBootedEvent:GREEN (post-flip) — dispatch reaches handle and returns SUCCESS
Each GREEN case asserts
result.status is EnumDispatchStatus.SUCCESS, oneModelSourceAttestationResultoutput event, and the expected verdict.Hand-flip proof summary (
...node_runtime_source_attestor_effect.handflip.json)receipt_schema: handflip_proof.v1;base_ref: 71ab1bf6…(pre-flip dev commit,git rev-parse --verifyreal)preserved_symbols:HandlerSourceAttestation._resolve_main_head/._compute_distance/._emit_friction— re-derived byte-identical (AST-normalized) base_ref↔HEAD by the ratchet from git (
DIVERGED: []).parity.status: pass,test_ids: the 5 dispatch tests above;selected_input_hashes: the 4-event corpus.branch_coverage_pct: 32.99(measured over the selected corpus) + explicituncovered_waiver(the git-subprocess helper branches are network-dependent and stubbed in thedeterministic dispatch corpus; equivalence is proven by git-verbatim preservation + green parity,
not by a broad coverage claim),
handler_module_sha256pinned to the post-format handler file,same
selected_input_hashesas the hand-flip proof.LOCAL SEAM GATE —
verify_flip_bundle(OMN-14809) PASSLive canonical-shape ratchet
--full— green with exactly this 1 proven flipDispatch-entrypoint validator — green (node removed from baseline, handle present)
Gates
ruff format --check+ruff check: cleanmypy(handler + node):Success: no issues foundpre-commit runon all changed files: all hooks Passed (incl. ONEX Pattern Validation with thehandleexemption, dispatch-entrypoint gate, canonical-shape via--full)OCC companion requirement (deploy-gate / receipt-gate)
This PR touches a deploy-scoped runtime node handler, so the required deploy-gate and
Receipt-Gate need the OCC companion for OMN-14805 (net-new file in
onex_change_control,authored separately per the no-self-authored-evidence rule) carrying the deploy-scope DoD evidence.
Until that companion is authored + merged, the local pre-push deploy-scope mirror reports
NOTICE_COMPANION_UNMERGED(exit 0) and the hosted deploy-gate / Receipt-Gate remain pending.Do not merge until the OCC companion lands.
Evidence-Ticket: OMN-14805
Evidence-Source: OCC#4447
Evidence-Commit: ffee3834f42c9fb11e370b006f8b640314e48890
Summary by CodeRabbit
handleentrypoint.handlewhile keeping verdicts and outputs consistent.devand improved webhook publishing gating.