Repository navigation
docs(OMN-15124): PARTIAL static evidence for candidate-isolation compatibility proof - #2637
Merged
jonahgabriel merged 1 commit intoAug 3, 2026
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Comment |
jonahgabriel
pushed a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Aug 3, 2026
#6017) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#2637 * evidence: OCC companion self-bind for #6017 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
jonahgabriel
added a commit
that referenced
this pull request
Aug 3, 2026
…cit AWS-blocked fields Fills the managed-staging-proof-kit template (docs/runbooks/managed-staging-proof-kit/fields.yaml -> one_tenant_contract_freeze) with only the subset of the 19 required fields answerable from committed, offline repo state: - topic_catalog + zero_collision_readback (offline, real build_canary_catalog_from_candidate()/verify_zero_collision() output, 164 topics / 56 groups, captioned as NOT the live cluster readback) - msk_epoch / group_start_reset_policy from the committed namespace yaml - rollback_authority from the teardown-rollback runbook's §0 ownership table - zero_prod_diff (self-referential grep against this file) 9 fields are marked BLOCKED — AWS SSO is dead on this host (human login pending) and there is no DB/deploy access, so account/region/namespace, MSK/RDS identifiers, gateway, synthetic tenant, digests-at-freeze-time, and omnidash exclusion cannot be produced here. A stale 7-day-old digest is cited for context only, explicitly not as a current value. plan_row_binding is separately BLOCKED for a structural reason: the current ROLLING_SEVEN_DAY_PLAN.md (rewritten 2026-08-01 under §0-AIM) no longer contains a "§3" heading or the "unverifiable by construction" string the ticket's AC #3 cites -- flagged as a plan-governor reconciliation gap, not fixed here. freeze_signature is deliberately left unfilled: this commit is not the OMN-15123 freeze event because the artifact is incomplete (11/19 rows blocked or partial). The packet says so explicitly so it cannot be mistaken for a completed freeze. SKIP=onex-check-node-migration-sync: this docs-only change trips the always_run onex-check-node-migration-sync local hook, which fails identically on a stock unmodified origin/dev checkout (verified before touching anything) because omnimarket dev still carries 9 per-node RLS migration files that omnibase_infra's same-day OMN-15423/OMN-15655 landing (commits 35fb883/3860bec7, merged 2026-08-03) already removed from the vendored tree + manifest as part of the house-tenant migration consolidation. The standard remediation (scripts/sync-node-migrations.sh) was attempted and reverted: it re-vendors those 9 files verbatim from omnimarket's stale copies, which reintroduces content the consolidation deliberately removed and fails tests/unit/scripts/validation/test_application_migration_manifest.py (2 tests) on push. Confirmed non-required in CI per scripts/enforcement_parity_manifest.yaml (OMN-14556 entry). Same disclosed pattern used minutes earlier in this session by the sibling OMN-15124 lane (PR #2637) for the identical pre-existing drift. Not fixed here — fixing it requires either updating sync-node-migrations.sh's selection logic to respect the house-tenant consolidation, or omnimarket removing its stale per-node files; both are real cross-repo engineering work outside this docs-evidence ticket's scope. No AWS/DB/deploy mutation performed. No ticket status flipped. OMN-15123
…atibility proof 0/5 ACs are satisfiable this session: AC1-AC4 require a live isolation-lane run against real MSK/RDS (AWS SSO dead, human login pending -- BLOCKED); AC5 cites a rolling-plan §3 B5 row that does not exist in the live plan document (same class of gap as OMN-15123 AC #3). Adds docs/evidence/OMN-15124/2026-08-03-candidate-isolation-static-evidence-partial.md recording the only 2 of 12 manifest fields answerable with zero live AWS/network dependency (typed_config_authority module introspection; no_raw_endpoint_fallback's static half via check_no_cloud_bus_wrapper.sh + PLAINTEXT grep), plus a field-by-field gap statement for the remaining 10. No AC checkbox is flipped; this is explicitly labeled PARTIAL, not a completed packet. Seam kit (fields.yaml, templates, seam test) from PR #2602 is unmodified -- seam test still 13/13 green. SKIP=onex-check-node-migration-sync used for this local commit only: that pre-commit hook (always_run:true, unconditional) fails on unmodified origin/dev HEAD itself -- verified via git stash before touching this branch -- because merged infra PR #2632 deleted 9 vendored node-migration files that omnimarket dev still ships. This is the documented recurring OMN-14975 drift class (see scripts/sync-node-migrations.sh header, "6th occurrence"); the corresponding CI job (node-migration-sync.yml) is NOT a required status check on infra dev and will independently show the same pre-existing red on this PR, so nothing is hidden. Re-vendoring here would mean touching 9 SQL files in the active tenant-RLS rekey stream (OMN-14894 et al.) that this ticket does not own -- out of scope for a docs-only candidate-isolation-proof ticket. OMN-15124
jonahgabriel
force-pushed
the
jonah/omn-15124-candidate-isolation-static-evidence
branch
from
August 3, 2026 20:06
4b9b86e to
8222eb6
Compare
Contributor
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical findings | No |
blocked |
CRITICAL findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524)
jonahgabriel
deleted the
jonah/omn-15124-candidate-isolation-static-evidence
branch
August 3, 2026 20:33
jonahgabriel
added a commit
that referenced
this pull request
Aug 3, 2026
…cit AWS-blocked fields (#2638) Fills the managed-staging-proof-kit template (docs/runbooks/managed-staging-proof-kit/fields.yaml -> one_tenant_contract_freeze) with only the subset of the 19 required fields answerable from committed, offline repo state: - topic_catalog + zero_collision_readback (offline, real build_canary_catalog_from_candidate()/verify_zero_collision() output, 164 topics / 56 groups, captioned as NOT the live cluster readback) - msk_epoch / group_start_reset_policy from the committed namespace yaml - rollback_authority from the teardown-rollback runbook's §0 ownership table - zero_prod_diff (self-referential grep against this file) 9 fields are marked BLOCKED — AWS SSO is dead on this host (human login pending) and there is no DB/deploy access, so account/region/namespace, MSK/RDS identifiers, gateway, synthetic tenant, digests-at-freeze-time, and omnidash exclusion cannot be produced here. A stale 7-day-old digest is cited for context only, explicitly not as a current value. plan_row_binding is separately BLOCKED for a structural reason: the current ROLLING_SEVEN_DAY_PLAN.md (rewritten 2026-08-01 under §0-AIM) no longer contains a "§3" heading or the "unverifiable by construction" string the ticket's AC #3 cites -- flagged as a plan-governor reconciliation gap, not fixed here. freeze_signature is deliberately left unfilled: this commit is not the OMN-15123 freeze event because the artifact is incomplete (11/19 rows blocked or partial). The packet says so explicitly so it cannot be mistaken for a completed freeze. SKIP=onex-check-node-migration-sync: this docs-only change trips the always_run onex-check-node-migration-sync local hook, which fails identically on a stock unmodified origin/dev checkout (verified before touching anything) because omnimarket dev still carries 9 per-node RLS migration files that omnibase_infra's same-day OMN-15423/OMN-15655 landing (commits 35fb883/3860bec7, merged 2026-08-03) already removed from the vendored tree + manifest as part of the house-tenant migration consolidation. The standard remediation (scripts/sync-node-migrations.sh) was attempted and reverted: it re-vendors those 9 files verbatim from omnimarket's stale copies, which reintroduces content the consolidation deliberately removed and fails tests/unit/scripts/validation/test_application_migration_manifest.py (2 tests) on push. Confirmed non-required in CI per scripts/enforcement_parity_manifest.yaml (OMN-14556 entry). Same disclosed pattern used minutes earlier in this session by the sibling OMN-15124 lane (PR #2637) for the identical pre-existing drift. Not fixed here — fixing it requires either updating sync-node-migrations.sh's selection logic to respect the house-tenant consolidation, or omnimarket removing its stale per-node files; both are real cross-repo engineering work outside this docs-evidence ticket's scope. No AWS/DB/deploy mutation performed. No ticket status flipped. OMN-15123
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OMN-15124 (parent epic OMN-14724, live status In Progress, 0/5 ACs checked) asks for a candidate-in-isolation MSK/RDS compatibility proof. This PR does not close any AC. AWS SSO is dead on every host available to this session (human login pending), so every live isolation-lane / MSK / RDS / k8s step is BLOCKED. Of the
candidate_isolation_compatibilitypacket's 12 manifest fields, exactly 2 are answerable with zero live AWS/network dependency; this PR records those 2 as labeled PARTIAL evidence plus a field-by-field gap statement for the remaining 10.Seam declaration
Seam is
omnibase_infra/docs/runbooks/managed-staging-proof-kit/fields.yaml(schema_version 1.0.0,packets.candidate_isolation_compatibility), landed by PR #2602 (merged) and matched field-by-field againsttests/ci/test_managed_staging_proof_kit_seam.py::REQUIRED_FIELDS. This PR does not touch the manifest, the template, or the seam test — it adds a new, separate, dated evidence artifact underdocs/evidence/OMN-15124/, which the seam test does not enforce (verified:tests/ci/test_managed_staging_proof_kit_seam.pystill 13/13 passed after this change).AC mapping (verbatim from the live ticket)
verify-fullfrom typed config authority, no raw-endpoint fallbackdocs/plans/ROLLING_SEVEN_DAY_PLAN.md) has no§3 B5row; its live section headings are0-AIM/0-CHAIN/0/1/2/3. Decisions/4/5/6, andgit log -pfor the file shows no plan-diff citing OMN-15124 by row. Same class of gap as OMN-15123 AC #3 — this is a plan-authoring/reconciliation gap, not something a build session resolves unilaterally.None of the 5 AC checkboxes are flipped by this PR.
What is actually in this PR
docs/evidence/OMN-15124/2026-08-03-candidate-isolation-static-evidence-partial.md— 2 filled fields, both re-run and pasted verbatim in this PR:typed_config_authority:build_aiokafka_auth_kwargs_from_env.__module__→omnibase_infra.event_bus.kafka_auth(pure module introspection, no live call, no network).no_raw_endpoint_fallback(static half only):scripts/check_no_cloud_bus_wrapper.sh(exit 0, clean) +grep -rn PLAINTEXT src/omnibase_infra/event_bus/(showsPLAINTEXTis a valid config-declared branch, not a silent fallback). The doc explicitly flags what this does not prove: that a liveAWS_MSK_IAM-configured candidate actually fails closed rather than degrading toPLAINTEXTwhen IAM env is unset — that's the live half of the negative control, unexercised.The remaining 10 fields are enumerated with their live-surface blocker in the doc's gap-statement table.
Adjacent context (not actioned)
Per the 2026-08-01 ticket comment: OMN-15639 tracks a separate MSK IAM group-authorization defect, explicitly out of this ticket's connection-level scope. Not touched here.
Pre-existing, unrelated CI note
node-migration-sync(local hookonex-check-node-migration-sync, CI jobnode-migration-sync.yml) fails on unmodifiedorigin/devHEAD itself — confirmed viagit stashbefore this branch had any diff. Cause: merged PR #2632 deleted 9 vendored node-migration files that omnimarketdevstill ships (my localomnimarketclone is atorigin/devtip, not stale). This is the documented recurring drift class (scripts/sync-node-migrations.shheader: "OMN-14975, 6th occurrence"). It is not a required status check ondev(confirmed viagh api .../branches/dev/protection/required_status_checks), so it will show red on this PR independently of anything done here — nothing is hidden. Re-vendoring would mean touching 9 SQL files inside the active tenant-RLS rekey stream (OMN-14894 et al.), which this docs-only ticket does not own.SKIP=onex-check-node-migration-syncwas used for the local commit only (disclosed in the commit message); every other local hook (90+) ran and passed, including the skip-token/bypass-detection hooks themselves.Gates run
uv run pytest tests/ci/test_managed_staging_proof_kit_seam.py -q→ 13 passedpre-commit(full suite except the one pre-existing hook above) → all passedprepush-smart-tests(governed selector) → no impacted tests, allowedprepush-deploy-scope-dod→ passedWhat remains blocked (unblock steps)
§3 B5-equivalent row to OMN-15124 in the live rolling plan.OMN-15124
Evidence-Ticket: OMN-15124
Evidence-Source: OCC#6027
promotion-receipt: OCC-6027
Merge-sweep update: after omnibase_infra#2639 merged, this branch was updated onto current
dev; the earlier node-migration-sync disclosure is historical commit-time context, not a current claim that dev remains out of sync. OCC#6027 binds this updated head for the receipt gate.