Repository navigation
feat(topology, OMN-15423/OMN-15655): declare the omniintelligence service database - #2632
Merged
jonahgabriel merged 2 commits intoAug 3, 2026
Merged
Conversation
📝 WalkthroughWalkthroughThe PR adds the ChangesOmniintelligence database topology
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant TableDeclaration
participant GrantDerivation
participant Topology
participant DatabaseWiring
TableDeclaration->>GrantDerivation: Submit database_ref and relation
GrantDerivation->>Topology: Resolve declared database
Topology->>DatabaseWiring: Select binding and DSN environment key
DatabaseWiring-->>TableDeclaration: Resolve dispatch_eval_results
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
jonahgabriel
added a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Aug 2, 2026
The machine mint (node_occ_companion_effect) that produced this companion for OmniNode-ai/omnibase_infra#2632 emitted all THREE command.supersede.2632.yaml files with a byte-identical replacement.check_value — one grep -c 'def validate_omniintelligence_database_invariants' over src/omnibase_infra/topology/application_database.py. So one probe was made the authoritative proof of three distinct bars (S1 distinctness), and none of them referenced the item it replaced (S2 family binding). That is the OMN-15459 wrong-item rebind, the OCC#5534 shape, and it is what turned Supersession Binding Ratchet + Pre-commit + CI Summary red on this PR. NON-IMPLEMENTER evidence authorship (feedback_no_self_authored_evidence): I am not the implementer of omnibase_infra#2632 and wrote none of its product code, pins, or tests. This companion was bot-authored by app/onexbot-occ-writer. Each replacement now carries the SUPERSEDED ITEM'S OWN declared check from contracts/OMN-15655.yaml, re-executed live by this lane at 2026-08-02T22:29Z, with the real probe output recorded: dod-OmniNode-ai-omnimarket-pr-2010 -> "true" (exit 0) dod-market-2010-schema-source-probe -> OK omninode_internal both relations (exit 0) occ-self-bind-pr-5962 -> "true" (exit 0) TWO declared checks were RE-STATED, not copied, and this is the one substantive judgement in the diff. The contract's checks for #2010 and #5962 assert .state == "open"; both PRs have since MERGED (#2010 at 488e4e05, #5962 at cbc5029), so copying them verbatim would have recorded a FAILING probe as status PASS. Each replacement instead asserts the same identity anchors the declared check names — PR number, base.ref, and the exact evidence-bound head (#2010 head c0484781, #5962 head ref codex/omn-15655-market2010-occ) — plus .merged == true and, for #2010, the merge commit. That is a strictly stronger, durable form of the same bar: the evidence-bound head did not merely exist on an open PR, it landed. The S2 anchors (PR numbers 2010 / 5962, the schema-probe path and relation names) are preserved, so each check still discriminates its own item. These files are net-new in this PR relative to the merge base, so editing them is an add, not a mutation — no append-only violation, and no higher-token repair record is required. Gate evidence, run on .200 (patch-transfer, all 3 files sha256-verified identical on both hosts before any gate ran): - check_receipt_hardening.py --supersession-corpus: 2344 violating files vs baseline 2344, exact match. RED control: the same gate with only this repair reverted returns 2347 vs 2344 and names these exact 3 files as S1+S2, exit 1 — reproducing the live CI failure, so the check is non-vacuous. Baseline NOT padded. - check_receipt_hardening.py over the changed receipts (the Pre-commit step that was red): exit 0. - validator_occ_append_only OMN-15655: ok=true. RED control: mutating a merged base receipt in place returns receipt_file_mutated, exit 1; restored, green again. Diff vs merge base is 0 deletions. - tests/unit/scripts/test_supersession_binding_gate.py: 20 passed. - check_receipt_hardening.py --check-supersession-wiring: PASSED. - check_yamlfmt_contamination.py --corpus: PASSED. No merge, no auto-merge, no baseline padding, no product-source edit. Refs OMN-15655, OMN-15459.
jonahgabriel
added a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Aug 3, 2026
#5978) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#2632 * evidence: OCC companion self-bind for #5978 * evidence(OMN-15655): repair OCC#5978 OMN-15459 wrong-item rebinds The machine mint (node_occ_companion_effect) that produced this companion for OmniNode-ai/omnibase_infra#2632 emitted all THREE command.supersede.2632.yaml files with a byte-identical replacement.check_value — one grep -c 'def validate_omniintelligence_database_invariants' over src/omnibase_infra/topology/application_database.py. So one probe was made the authoritative proof of three distinct bars (S1 distinctness), and none of them referenced the item it replaced (S2 family binding). That is the OMN-15459 wrong-item rebind, the OCC#5534 shape, and it is what turned Supersession Binding Ratchet + Pre-commit + CI Summary red on this PR. NON-IMPLEMENTER evidence authorship (feedback_no_self_authored_evidence): I am not the implementer of omnibase_infra#2632 and wrote none of its product code, pins, or tests. This companion was bot-authored by app/onexbot-occ-writer. Each replacement now carries the SUPERSEDED ITEM'S OWN declared check from contracts/OMN-15655.yaml, re-executed live by this lane at 2026-08-02T22:29Z, with the real probe output recorded: dod-OmniNode-ai-omnimarket-pr-2010 -> "true" (exit 0) dod-market-2010-schema-source-probe -> OK omninode_internal both relations (exit 0) occ-self-bind-pr-5962 -> "true" (exit 0) TWO declared checks were RE-STATED, not copied, and this is the one substantive judgement in the diff. The contract's checks for #2010 and #5962 assert .state == "open"; both PRs have since MERGED (#2010 at 488e4e05, #5962 at cbc5029), so copying them verbatim would have recorded a FAILING probe as status PASS. Each replacement instead asserts the same identity anchors the declared check names — PR number, base.ref, and the exact evidence-bound head (#2010 head c0484781, #5962 head ref codex/omn-15655-market2010-occ) — plus .merged == true and, for #2010, the merge commit. That is a strictly stronger, durable form of the same bar: the evidence-bound head did not merely exist on an open PR, it landed. The S2 anchors (PR numbers 2010 / 5962, the schema-probe path and relation names) are preserved, so each check still discriminates its own item. These files are net-new in this PR relative to the merge base, so editing them is an add, not a mutation — no append-only violation, and no higher-token repair record is required. Gate evidence, run on .200 (patch-transfer, all 3 files sha256-verified identical on both hosts before any gate ran): - check_receipt_hardening.py --supersession-corpus: 2344 violating files vs baseline 2344, exact match. RED control: the same gate with only this repair reverted returns 2347 vs 2344 and names these exact 3 files as S1+S2, exit 1 — reproducing the live CI failure, so the check is non-vacuous. Baseline NOT padded. - check_receipt_hardening.py over the changed receipts (the Pre-commit step that was red): exit 0. - validator_occ_append_only OMN-15655: ok=true. RED control: mutating a merged base receipt in place returns receipt_file_mutated, exit 1; restored, green again. Diff vs merge base is 0 deletions. - tests/unit/scripts/test_supersession_binding_gate.py: 20 passed. - check_receipt_hardening.py --check-supersession-wiring: PASSED. - check_yamlfmt_contamination.py --corpus: PASSED. No merge, no auto-merge, no baseline padding, no product-source edit. Refs OMN-15655, OMN-15459. * evidence(OMN-15655): re-bind contract_sha256 after the dev merge (OCC#5978) Consequence of merging dev, found by the gate and not waved through. Three receipts this PR ADDS pin the contract by legacy whole-file hash (contract_sha256), so appending dev's new dod_evidence entry to contracts/OMN-15655.yaml invalidated them: Receipt Hardening Gate: contract_sha256 mismatch — receipt has 'sha256:c5f7b323f6dfbed5527f2f0b5c6e78a83a52a8448a530e1c33a603b54eb7220d' but sha256(contracts/OMN-15655.yaml) is 'sha256:bf63e53bba1a94e60da6d53bca5936417f8883e5473846d698af5b68d5d5c0ac' Rebound to the current hash with the canonical helper (omnibase_core.validation.validator_receipt_gate.compute_contract_sha256), not hand-typed: drift/dod_receipts/OMN-15655/dod-OmniNode-ai-omnibase_infra-pr-2632/command.yaml drift/dod_receipts/OMN-15655/dod-occ-evidence-admissibility-validator/command.yaml drift/dod_receipts/OMN-15655/occ-self-bind-pr-5978/command.yaml WHY THIS IS HONEST, not a hash papered over a stale claim: the contract change that invalidated them is the addition of an UNRELATED entry (dod-omn15655-carried-in-omninode-infra-pr-802, merged in OCC#5991). No probe, no check_value, and no result any of these three receipts records was touched by it. The mismatch is the known whole-file-binding coupling the gate's own message calls out — a receipt bound to the whole contract is invalidated by an append to any OTHER entry. The structurally correct fix the gate recommends (mint entry-scoped contract_entry_sha256, OMN-13888) is NOT available for these three: none of them has a corresponding dod_evidence entry in contracts/OMN-15655.yaml, so compute_contract_entry_sha256 raises ContractEntryNotFoundError. That residual is disclosed, not silently absorbed — these receipts will be invalidated again by the next append to this contract. All three files are net-new in this PR relative to origin/dev, so editing them is an add, not a mutation. The dev-owned receipt drift/dod_receipts/OMN-15655/dod-omn15655-carried-in-omninode-infra-pr-802/command.yaml was NOT touched — it carries no whole-file binding and is absent from this commit. Re-verified on .200 against origin/dev: - check_receipt_hardening.py over every changed receipt: clean, no output. - check_receipt_hardening.py --supersession-corpus: 2344 vs baseline 2344. - validator_occ_append_only OMN-15655 --base-ref origin/dev: ok=true. - committed deletions vs origin/dev: 0. - check_yamlfmt_contamination.py --corpus: PASSED. Refs OMN-15655, OMN-13888. * evidence(OMN-15655): amend 2 supersession reason strings — state the check substitution Evidence-honesty defect found by the r1 adversarial verifier in the DURABLE artifact, not in a report. Two of the three command.supersede.2632.yaml files carried the reason string: "Replacement carries this item's OWN declared check from contracts/OMN-15655.yaml, re-executed live by a non-implementer" That sentence is false as written for those two. Their declared checks assert .state == "open", and both subject PRs have since merged, so the declared check could not be carried — it was necessarily STRENGTHENED to .merged == true. The r1 commit message disclosed this at length; the durable receipt did not, and the receipt is what a future reader audits. A reason string that implies a verbatim carry when a substitution occurred is the same class of defect this whole repair exists to remove. Re-verified live before amending, both polarities: DECLARED (contract, verbatim) -> exit 1 gh api repos/OmniNode-ai/omnimarket/pulls/2010 ... .state == "open" stdout: error: unexpected #2010 state gh api repos/OmniNode-ai/onex_change_control/pulls/5962 ... .state == "open" stdout: error: unexpected #5962 state REPLACEMENT (as recorded in the receipts) -> exit 0 ... .merged == true and .merge_commit_sha == 488e4e05... -> true ... .merged == true (head ref codex/omn-15655-market2010-occ) -> true Each amended reason now names the substitution explicitly: which clause changed, that the original exits 1 today with its stdout, that copying it verbatim would have recorded a FAILING probe as status PASS, and that the replacement preserves the identity anchors (PR number, base.ref, exact evidence-bound head) while adding .merged == true — a strictly stronger, durable form of the same bar. THE THIRD FILE IS DELIBERATELY UNTOUCHED. dod-market-2010-schema-source-probe is a content probe against a pinned ref, not a PR-state probe; its declared check WAS carried verbatim and still exits 0, so its reason string is accurate as written. Amending all three would have been the lazy uniform edit and would have made a true sentence false. CONTRACT-ENTRY MISMATCH: NOT FIXED HERE, AND WHY. The dod_evidence entry 'dod-OmniNode-ai-omnimarket-pr-2010' in contracts/OMN-15655.yaml still describes "PR #2010 ... is open on dev at the exact evidence-bound head" and still declares the .state == "open" check that now exits 1. That entry is MERGED, so editing either its description or its check_value in this PR is precisely what validator_occ_append_only rejects (a PR editing a merged dod_evidence entry), and no entry-level supersession mechanism exists for contract entries the way it does for receipts. Inventing one here would be scope creep on an evidence-repair PR. The mismatch is therefore recorded on OMN-15655 for disposition rather than papered over. Same applies to the occ-self-bind-pr-5962 entry's check_value. NO probe output, status, exit_code, check_value, contract hash or pr_number was touched by this commit — the diff is reason prose only. Verified: 2 files changed, and every 'replacement:' block is byte-identical to the r1 commit. NON-IMPLEMENTER evidence authorship: I am not the implementer of omnibase_infra#2632 and wrote none of its product code, pins, or tests. Refs OMN-15655, OMN-15459. --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai> Co-authored-by: Jonah Gray <jonah@omninode.ai>
jonahgabriel
force-pushed
the
jonah/omn-15423-omniintelligence-topology-database
branch
from
August 3, 2026 05:22
f26acc6 to
9f7e2ec
Compare
Contributor
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical findings | No |
blocked |
CRITICAL findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524)
…ase so strict wiring resolves node_dispatch_outcome_bridge_effect node_dispatch_outcome_bridge_effect (omnimarket) declares db_io.db_tables[0].database_ref: omniintelligence and runs on runtime_profiles: ['effects'], where ONEX_WIRING_STRICT_MODE makes an unresolved reference boot-fatal rather than a skipped handler. No topology instance declared that database, so _resolve_projection_database_target raised "Unknown database_ref 'omniintelligence'" on all seven supported profiles. This is OMN-15655 AC-2, the one residual its omnimarket half (#2010) deliberately left open. What lands: - src/omnibase_infra/topology/instances/{local,onex-dev,onex-prod}.yaml: the omniintelligence logical database — physical_name omniintelligence, schema public @ OMNINODE_INTERNAL, owner owner_omniintelligence, principal role_omniintelligence, binding omninode_runtime_service on OMNIINTELLIGENCE_DB_URL. ADR-0027 unified the tenant/internal application pair and explicitly kept "identity-plane and independently service-owned databases ... separate"; omniintelligence is one of those. - table_grant_derivation.derive_topology_table_grants: derivation is now per-logical-database. The single-database version routed every service-database declaration into the application residual bucket, so the new principal would have shipped grant-less while --check stayed green. - scripts/generate_application_database_table_grants.py: --write/--check/ --prove render and assert every declared database, not just application. - docker/catalog/database-topology/*.yaml: re-rendered with the canonical scripts/render_application_database_topology.py (all 7 profiles). - validate_omniintelligence_database_invariants, called from load_topology_profile, pins the declaration so a silent instance edit fails the loader in CI instead of the pod at rollout. OMNINODE_INTERNAL is falsifiable, not a default: the live relation has no tenant_id column (readback below) and its only writer enumerates thirteen columns, none of them a tenant key. A TENANT domain would select TenantProjectionTableOperation, which unconditionally stamps row["tenant_id"] and demands a verified tenant authority — every write would fail on a column that does not exist. Evidence-Ticket: OMN-15423
jonahgabriel
force-pushed
the
jonah/omn-15423-omniintelligence-topology-database
branch
from
August 3, 2026 14:57
9f7e2ec to
d243814
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tests/unit/topology/test_omniintelligence_service_database.py (1)
143-158: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd negative tests for the remaining invariant branches.
test_invariants_reject_a_repointed_physical_databaseonly exercises thephysical_namedrift branch ofvalidate_omniintelligence_database_invariants. The validator also raises on schema/domain drift, schema-owner drift, binding-set drift, per-bindingdatabase_refdrift, principal drift, anddsn_envdrift (application_database.py lines 354-393). None of these branches has a test.Add parametrized cases mirroring this test's
model_copy(update={...})pattern for each remaining branch so a future edit to the instance YAML fails the loader as intended, not just the physical_name case.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/unit/topology/test_omniintelligence_service_database.py` around lines 143 - 158, Extend test_invariants_reject_a_repointed_physical_database with parametrized negative cases covering schema/domain, schema-owner, binding-set, per-binding database_ref, principal, and dsn_env drift in validate_omniintelligence_database_invariants. Build each mutated topology with the existing model_copy(update={...}) pattern and assert ValueError with the corresponding invariant message, preserving the current physical_name case.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tests/unit/topology/test_omniintelligence_service_database.py`:
- Around line 143-158: Extend
test_invariants_reject_a_repointed_physical_database with parametrized negative
cases covering schema/domain, schema-owner, binding-set, per-binding
database_ref, principal, and dsn_env drift in
validate_omniintelligence_database_invariants. Build each mutated topology with
the existing model_copy(update={...}) pattern and assert ValueError with the
corresponding invariant message, preserving the current physical_name case.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b77eb46e-99e4-4a06-a812-2ceb39e90206
⛔ Files ignored due to path filters (1)
docker/migrations/forward/_ledger/application-migrations.tsvis excluded by!**/*.tsv
📒 Files selected for processing (26)
docker/catalog/database-topology/judge.yamldocker/catalog/database-topology/local.yamldocker/catalog/database-topology/onex-dev.yamldocker/catalog/database-topology/onex-prod.yamldocker/catalog/database-topology/prod.yamldocker/catalog/database-topology/stability-test.yamldocker/catalog/database-topology/test.yamldocker/migrations/forward/nodes/node_canary_score_reducer/0002_capability_scores_tenant_id_and_rls.sqldocker/migrations/forward/nodes/node_projection_context_roi/003_context_roi_scores_tenant_id_and_rls.sqldocker/migrations/forward/nodes/node_projection_cost_summary/0002_llm_cost_aggregates_tenant_id_and_rls.sqldocker/migrations/forward/nodes/node_projection_delegation/0030_delegation_budget_state_house_tenant_rekey.sqldocker/migrations/forward/nodes/node_projection_dep_health/002_dep_health_findings_tenant_id_and_rls.sqldocker/migrations/forward/nodes/node_projection_instruction_eval/0002_instruction_eval_aggregate_snapshots_tenant_id_and_rls.sqldocker/migrations/forward/nodes/node_projection_pattern_learning/0001_pattern_learning_artifacts_tenant_id_and_rls.sqldocker/migrations/forward/nodes/node_projection_routing_decision/0022_agent_routing_decisions_tenant_id_and_rls.sqldocker/migrations/forward/nodes/node_projection_skill_executions/0002_skill_execution_snapshots_tenant_id_and_rls.sqlscripts/generate_application_database_table_grants.pysrc/omnibase_infra/topology/application_database.pysrc/omnibase_infra/topology/instances/local.yamlsrc/omnibase_infra/topology/instances/onex-dev.yamlsrc/omnibase_infra/topology/instances/onex-prod.yamlsrc/omnibase_infra/topology/table_grant_derivation.pytests/unit/runtime/auto_wiring/test_handler_wiring_db_injection.pytests/unit/scripts/validation/test_application_migration_manifest.pytests/unit/topology/test_application_database_table_grants.pytests/unit/topology/test_omniintelligence_service_database.py
💤 Files with no reviewable changes (9)
- docker/migrations/forward/nodes/node_projection_dep_health/002_dep_health_findings_tenant_id_and_rls.sql
- docker/migrations/forward/nodes/node_projection_routing_decision/0022_agent_routing_decisions_tenant_id_and_rls.sql
- docker/migrations/forward/nodes/node_projection_skill_executions/0002_skill_execution_snapshots_tenant_id_and_rls.sql
- docker/migrations/forward/nodes/node_projection_cost_summary/0002_llm_cost_aggregates_tenant_id_and_rls.sql
- docker/migrations/forward/nodes/node_projection_pattern_learning/0001_pattern_learning_artifacts_tenant_id_and_rls.sql
- docker/migrations/forward/nodes/node_projection_context_roi/003_context_roi_scores_tenant_id_and_rls.sql
- docker/migrations/forward/nodes/node_projection_instruction_eval/0002_instruction_eval_aggregate_snapshots_tenant_id_and_rls.sql
- docker/migrations/forward/nodes/node_projection_delegation/0030_delegation_budget_state_house_tenant_rekey.sql
- docker/migrations/forward/nodes/node_canary_score_reducer/0002_capability_scores_tenant_id_and_rls.sql
jonahgabriel
force-pushed
the
jonah/omn-15423-omniintelligence-topology-database
branch
from
August 3, 2026 15:22
d243814 to
3972ca0
Compare
jonahgabriel
changed the title
jonahgabriel
deleted the
jonah/omn-15423-omniintelligence-topology-database
branch
August 3, 2026 18:06
jonahgabriel
added a commit
that referenced
this pull request
Aug 3, 2026
…atibility proof 0/5 ACs are satisfiable this session: AC1-AC4 require a live isolation-lane run against real MSK/RDS (AWS SSO dead, human login pending -- BLOCKED); AC5 cites a rolling-plan §3 B5 row that does not exist in the live plan document (same class of gap as OMN-15123 AC #3). Adds docs/evidence/OMN-15124/2026-08-03-candidate-isolation-static-evidence-partial.md recording the only 2 of 12 manifest fields answerable with zero live AWS/network dependency (typed_config_authority module introspection; no_raw_endpoint_fallback's static half via check_no_cloud_bus_wrapper.sh + PLAINTEXT grep), plus a field-by-field gap statement for the remaining 10. No AC checkbox is flipped; this is explicitly labeled PARTIAL, not a completed packet. Seam kit (fields.yaml, templates, seam test) from PR #2602 is unmodified -- seam test still 13/13 green. SKIP=onex-check-node-migration-sync used for this local commit only: that pre-commit hook (always_run:true, unconditional) fails on unmodified origin/dev HEAD itself -- verified via git stash before touching this branch -- because merged infra PR #2632 deleted 9 vendored node-migration files that omnimarket dev still ships. This is the documented recurring OMN-14975 drift class (see scripts/sync-node-migrations.sh header, "6th occurrence"); the corresponding CI job (node-migration-sync.yml) is NOT a required status check on infra dev and will independently show the same pre-existing red on this PR, so nothing is hidden. Re-vendoring here would mean touching 9 SQL files in the active tenant-RLS rekey stream (OMN-14894 et al.) that this ticket does not own -- out of scope for a docs-only candidate-isolation-proof ticket. OMN-15124
jonahgabriel
added a commit
that referenced
this pull request
Aug 3, 2026
…atibility proof (#2637) 0/5 ACs are satisfiable this session: AC1-AC4 require a live isolation-lane run against real MSK/RDS (AWS SSO dead, human login pending -- BLOCKED); AC5 cites a rolling-plan §3 B5 row that does not exist in the live plan document (same class of gap as OMN-15123 AC #3). Adds docs/evidence/OMN-15124/2026-08-03-candidate-isolation-static-evidence-partial.md recording the only 2 of 12 manifest fields answerable with zero live AWS/network dependency (typed_config_authority module introspection; no_raw_endpoint_fallback's static half via check_no_cloud_bus_wrapper.sh + PLAINTEXT grep), plus a field-by-field gap statement for the remaining 10. No AC checkbox is flipped; this is explicitly labeled PARTIAL, not a completed packet. Seam kit (fields.yaml, templates, seam test) from PR #2602 is unmodified -- seam test still 13/13 green. SKIP=onex-check-node-migration-sync used for this local commit only: that pre-commit hook (always_run:true, unconditional) fails on unmodified origin/dev HEAD itself -- verified via git stash before touching this branch -- because merged infra PR #2632 deleted 9 vendored node-migration files that omnimarket dev still ships. This is the documented recurring OMN-14975 drift class (see scripts/sync-node-migrations.sh header, "6th occurrence"); the corresponding CI job (node-migration-sync.yml) is NOT a required status check on infra dev and will independently show the same pre-existing red on this PR, so nothing is hidden. Re-vendoring here would mean touching 9 SQL files in the active tenant-RLS rekey stream (OMN-14894 et al.) that this ticket does not own -- out of scope for a docs-only candidate-isolation-proof ticket. OMN-15124
jonahgabriel
added a commit
that referenced
this pull request
Aug 4, 2026
…d by #2632's stale-pin regeneration (#2656) infra#2634 (merged 2026-08-03T05:05:30Z) correctly derived TABLE grants for all nine house-tenant relations to tenant_projection_writer. infra#2632 (merged 2026-08-03T18:06:11Z, an ancestor of the deployed onex-dev SHA 2e5ef7d) then re-ran the derivation's --write step, but its "refresh topology grants after dev rebase" sub-commit resolved omnimarket contracts via the CI workflow's hardcoded fallback pin (4637e625, 2026-07-30) instead of omnimarket's actual dev HEAD. That pin still declared schema: omninode_internal for these relations -- omnimarket's reclassification (485be549) landed on omnimarket dev at 2026-08-03T15:56:54Z, *after* #2632 merged. The regeneration silently reverted eight of the nine relations back to omninode_runtime/omninode_internal and dropped delegation_judge_verdict_events and the omninode_runtime nightly_loop_configs SELECT grant entirely, wedging _require_projection_binding_privileges on every profile and crash-looping omninode-runtime + omninode-runtime-effects on onex-dev. Fix: regenerate local.yaml/onex-dev.yaml/onex-prod.yaml (+ rendered docker/catalog/database-topology/*.yaml) via scripts/generate_application_database_table_grants.py --write against omnimarket's current dev HEAD (54356a83, includes 485be549), restoring all nine relations to tenant_projection_writer and the nightly_loop_configs grant to omninode_runtime. --check --prove confirms 43/43 PASS, 0 FAIL, 0 RESIDUAL on every one of the 7 shipped profiles. Regression test follows the existing OMN-15547 incident-replay pattern: a captured fixture of the exact reverted bytes (byte-identical to the deployed instance) proves the failure reproduces, then the shipped topology is proven to resolve cleanly for all nine relations plus the nightly_loop_configs read. Root cause posted to OMN-15655 (parent ticket, comment 132a9d8b); this regression had no existing ticket, filed as OMN-15701 (child). Seams: topology instance grant declarations (this repo) must track omnimarket's node contract db_io.db_tables schema classification (omnimarket) -- OMN-14208 seam-matching applies. The CI derivation- consistency gate's hardcoded omnimarket pin (ci.yml:2330) is a recurring staleness vector, flagged (not fixed here) as an OMN-15701 follow-up. Refs: OMN-15655, OMN-15701, OMN-14208, OMN-15656 Evidence-Ticket: OMN-15701
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
node_dispatch_outcome_bridge_effect(omnimarket) declaresdb_io.db_tables[0].database_ref: omniintelligenceand carriesdescriptor.runtime_profiles: ['effects']. On the effects podONEX_WIRING_STRICT_MODE=1makes an unresolved reference boot-fatal, not askipped handler. No topology instance declared that database, so
_resolve_projection_database_targetraisedValueError: Unknown database_ref 'omniintelligence'on all seven supportedprofiles.
This is OMN-15655 AC-2 — the one residual the omnimarket half (#2010)
explicitly left open ("
node_dispatch_outcome_bridge_effecteither declares atopology-declared
database_refor is explicitly deferred with a recordedreason").
node_projection_delegation(schema: unresolved) is out ofscope and stays a typed residual; it needs a product decision, not a
mechanical fix.
2026-08-01T05:16Z, dod_evidence attached there). OMN-15655 stays open — no
closing keyword in this PR.
RED → GREEN, measured on the shipped topology
In-process repro (
load_topology_profile+_resolve_projection_database_target,driven from the real omnimarket contract, no runtime, no Kafka):
Before —
bf070a94e, all 7 profiles:Intermediate (declaration only, before the derived grant) — the failure
moves to the OMN-15418 privilege validator, proving both halves are load-bearing:
After — all 7 profiles:
Cross-repo derivation gate against the CI-pinned omnimarket
(
4637e625c99ef17c190aa471a5e51b7f646c6dfd, the exact refci.ymlchecks out):Was
PASS=41 RESIDUAL=2ondev. The retired residual is this one; theremaining
RESIDUAL=1isnode_projection_delegation/delegation_judge_verdict_events(schema: unresolved), reported as a typedresidual, not hidden.
What lands
src/omnibase_infra/topology/instances/{local,onex-dev,onex-prod}.yaml—the
omniintelligencelogical database:physical_name: omniintelligence,schema
public@OMNINODE_INTERNAL, ownerowner_omniintelligence(NOLOGIN), principal
role_omniintelligence(LOGIN, NOBYPASSRLS), bindingomninode_runtime_service→OMNIINTELLIGENCE_DB_URL. Additive only; theapplicationblock is byte-identical todev.table_grant_derivation.derive_topology_table_grants— derivation is nowper-logical-database. The single-database version routed every
service-database declaration into the
applicationresidual bucket, so thenew principal would have shipped grant-less while
--checkstayed green —the same "declared but never granted" shape OMN-15656 exists to prevent.
scripts/generate_application_database_table_grants.py—--write/--check/--proverender and assert every declared databaseinstead of hard-coding
databases["application"].docker/catalog/database-topology/*.yaml— re-rendered for all 7 profileswith the canonical
scripts/render_application_database_topology.py. Nohand-edited catalog.
validate_omniintelligence_database_invariants, called fromload_topology_profile— pins physical name, schema/domain, owner, bindingprincipal and DSN key, so a silent instance edit fails the topology loader in
CI rather than the pod at rollout ([[feedback_a_rule_is_not_a_mechanism]]).
Seams (OMN-14208)
database_refomniintelligencenode_dispatch_outcome_bridge_effectcontract.yamldb_io.db_tables[0]schemapublicomniintelligenceDB has only thepublicnamespacephysical_nameomniintelligencepg_databasereadbackdsn_envOMNIINTELLIGENCE_DB_URLhandler_wiring._DB_URL_ENV_MAP["omniintelligence"],docs/patterns/db_url_contract.mdprincipalrole_omniintelligencedocs/patterns/db_url_contract.mdrole columnomninode_runtime_servicehandler_wiring._INTERNAL_PROJECTION_BINDING(fixed constant selected by theOMNINODE_INTERNALdomain)Each of these is asserted against the shipped topology in
tests/unit/topology/test_omniintelligence_service_database.py— not assertedin prose.
Why
OMNINODE_INTERNALand notTENANTFalsifiable, not a default:
tenant_idcolumn. Readback fromomnibase-infra-stability-test-postgres,omniintelligenceDB: 14 columns(
task_id,dispatch_id,ticket_id,verdict,quality_score,token_cost,dollars_cost,model_calls,evaluated_at,created_at,eval_latency_ms,usage_source,estimation_method,source_payload_hash), PK(task_id, dispatch_id).node_pattern_feedback_effect/handlers/handler_dispatch_outcome.py)enumerates thirteen columns in
SQL_UPSERT_DISPATCH_EVAL_RESULT, none ofthem a tenant key.
TENANTdomain selectsTenantProjectionTableOperation, whichunconditionally sets
row["tenant_id"] = context.tenant_idand requires averified tenant authority. Every write would fail on a column that does not
exist — a green boot with a guaranteed-red runtime.
and operational relations" to the platform-internal domain, and explicitly
keeps "identity-plane and independently service-owned databases ...
separate" from the unified application pair.
The 2026-08-02 house-tenant ruling ("all nine unclassified relations are TENANT
data") governs the nine application-database residuals — empirically the 8
application.publicplaceholders plusdelegation_judge_verdict_events.dispatch_eval_resultsis the tenth, separate residual: a different physicaldatabase, no tenant column, no RLS. It falls under the ruling's counterpart
clause — attribution-meaningless infrastructure state stays
omninode_internal.Honest residuals — this does NOT make onex-dev green on its own
OMNIINTELLIGENCE_DB_URLis blanked on onex-dev. All three runtimedeployments (
omninode_infra k8s/onex-dev/runtime/deployment-omninode-runtime{,-effects,-worker}.yaml)set
- name: OMNIINTELLIGENCE_DB_URL / value: ""as the OMN-13769 workaround._make_projection_dispatch_callbackreadsbinding.dsn_envfrom theenvironment at wiring time and fails closed on an empty value, so on that
lane this change converts an
Unknown database_refboot failure into arequires topology bindings with configured DSNsboot failure until thesecretKeyRefis restored. Pinned as a test(
test_wiring_still_requires_a_configured_dsn_after_the_declaration) so itcannot be mistaken for a green path. Cross-repo, not fixed here.
topology/kubernetes/source-lock.yamlpins
instances/onex-dev.yamlsource_sha256: 0868751b…; this branch movesit to
25c92eaf…. Without a re-render + lock bump (the same companion fix(monitoring): alert on terminal-state heartbeat warning in monitor_logs.py (OMN-4826) #801did for OMN-15656) onex-dev keeps serving the pre-declaration configmap.
Cross-repo, not fixed here.
ProjectionBindingConnections.getasserts
current_user == binding.principal, but every shipped DSN for thisdatabase connects as
postgres(
docker/catalog/services/*.yaml,docker-compose.infra.yml). Identicalpre-existing class to the
applicationdatabase'somninode_runtimeprincipal, which is why
omninode-runtimesits indocker/catalog/database-consumers.yamldeferred_consumersunder OMN-15421.Provisioning
role_omniintelligenceis that ticket's scope, not this one.checksum_ledgersis a required field the service database cannot satisfytruthfully.
ModelDeploymentTopologyDatabaserequires a ledger with fourdistinct columns (stream/domain/version/checksum). The live
omniintelligence.public.schema_migrationsis service-owned and carries(id, migration_name, applied_at, checksum)— no stream and no domaincolumn;
docker/migrations/forward/_ledger/bootstrap.sqlitself refuses thisshape ("service-owned migration_id ledger cannot be selected"). I declared
the platform-canonical shape under the key
service_ownedrather thanmapping
domain_columnontoapplied_at: a bespoke mapping would make anyfuture ledger-parity check pass vacuously, while the canonical shape fails
closed against reality and surfaces the real gap. Nothing reads
checksum_ledgersfor a non-application database today (sole consumer is theapplication-scoped OMN-15413 integration test). The durable fix is a core
model change making the ledger optional for service-owned databases —
omnibase-core==0.46.8is a PyPI pin, so that is a separate release, notthis PR.
migration:pointer is stale. The contract citesomniintelligence/deployment/database/migrations/023_create_debug_intelligence_tables.sql,but that file creates
failure_streaks,ci_failure_events,debug_trigger_records,debug_fix_records— notdispatch_eval_results, which has no DDL anywhere in the workspace despiteexisting live. omnimarket-owned field; flagged, not touched.
Gates — run on
.200(stickybeatz-studio), per rule 11ajonah@192.168.86.200does not route (LAN alias dead); used the documentedTailscale MagicDNS fallback
stickybeatz-studio. Patch-transfer, with contentverified in both directions: all 16 changed files sha256-identical between this
Mac and the
.200worktree before any gate ran, both worktrees at basebf070a94e.ruff format --check src/ tests/ scripts/→ 4984 files already formattedruff check src/ tests/ scripts/→ All checks passedmypy src/omnibase_infra/→ Success, 2746 source filespytest tests/unit/ tests/ci/ -n 8→ branch 24491 passed / 0 failed;base
bf070a94e24443 passed / 0 failed (delta +48 = the new tests)pytest tests/ -n 8: branch 25 failed / 42 errors, basebf070a94e25 failed / 42 errors. Error sets are byte-identical.Failure sets differ only in a rotating population of
parallel-worker-env-sensitive tests (base loses 4 in
tests/unit/utils/test_util_db_transaction.py; branch loses 3 elsewhere) —every one passes in isolation and in the clean
tests/unit + tests/cirunabove, on both revisions. All 42 errors are service-dependent
(
localhost:19092Kafka, Postgres, LLM endpoints, docker) and.200runs nolocal infra stack. One branch-only failure,
tests/ci/test_validate_test_root_collection.py, was proven to be the.proof-dependencies/omnimarketclone I created for the gate run: removingthe directory returns 21 passed, and it is not in the commit.
pre-commit run --all-files→ all hooks pass except a pre-existing SPDXyear failure on two files this PR does not touch
(
tests/scripts/test_deploy_runtime_core_contracts_resolution.py,tests/ci/test_runner_routing_audit.py, both2026vs expected2025) —reproduced identically on base
bf070a94e. Not absorbed..200: pre-push impacted-testselection 7124 passed / 10 skipped, no bypass flags anywhere.
Test coverage added
tests/unit/topology/test_omniintelligence_service_database.py(new) —per-profile resolution through the real resolver; binding/principal/DSN-key
assertions; DSN-contract parity with
_DB_URL_ENV_MAP; physical separation fromthe application pair; the domain justification driven through
topology.table_domain; invariant enforcement plus a repointed-databaserejection; and the measured onex-dev DSN residual.
tests/unit/topology/test_application_database_table_grants.py— multi-databasederivation routing, undeclared-database residual, per-database grant/instance
parity, and every existing shipped-grant assertion parametrised over both
databases.
tests/unit/runtime/auto_wiring/test_handler_wiring_db_injection.py— theassertion that pinned omniintelligence as an open blocker is split, not
deleted: the "a DB-URL-map entry alone does not authorise a relation" property
moves to
omnimemory(still mapped, still undeclared), and a new test assertsthe closed half.
No merges, no OCC companion, no gate-bypass-token usage, no Linear status flips.
Summary by CodeRabbit
New Features
Bug Fixes
Maintenance
Evidence-Ticket: OMN-15423
Evidence-Source: OCC#6010