Repository navigation
fix(OMN-16682): track the re-flipped trusted-CI seam in the runner routing policy - #2923
Merged
github-actions[bot] merged 1 commit intoAug 27, 2026
Conversation
…uting policy The hourly Runner Routing Audit asserted OMNI_TRUSTED_CI_RUNS_ON_JSON == '["self-hosted","omnibase-ci"]' while the seam was deliberately re-flipped to '["ubuntu-latest"]' at org scope and all five repo shadows on 2026-08-27T04:36:53-56Z. Every scheduled run therefore reported six drift findings (org + omnibase_core + omnibase_infra + omniclaude + omnimarket + onex_change_control) against intended state. That red was not merely cosmetic. audit-runner-routing.py returns 1 whenever any finding exists, so the audit's other surface -- audit_local_workflows, which carries the hosted-runner allowlist including the OMN-16683 fork-isolation entries -- was evaluated on a job that was already failing. Genuine new drift there could not have changed the job's signal, so the audit was blind exactly where it is load-bearing. Change: expected_json for the trusted seam now states the intended hosted value. OMNI_PUBLIC_PR_RUNS_ON_JSON is untouched (already '["ubuntu-latest"]'), the repositories list is untouched, and the hosted_runner_allowlist is untouched. The OCC carve-out is deliberately NOT folded into this seam: occ-*-manual-replay and the OCC autobind/companion-effect publishers read the dedicated OMNI_OCC_AUTOBIND_RUNS_ON_JSON knob with a literal '["self-hosted","omnibase-ci"]' fallback (OMN-16691), because they publish to the tailnet-only dev-lane broker that only the self-hosted fleet can reach. That variable is unset at org and repo scope, so the literal is the operating value. No Actions variable was created, patched, or deleted by this change. Verification: * scripts/audit-runner-routing.py --github-vars against live org+repo variables -> 'Runner routing audit passed.' exit 0 (was 6 findings, exit 1). * scripts/audit-runner-routing.py --local-workflows -> passed, exit 0. * uv run pytest tests/ci/test_runner_routing_audit.py -q -> 10 passed. * pre-commit run --files <both changed files> -> all applicable hooks passed.
Contributor
|
OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour. 📝 WalkthroughWalkthroughThe trusted CI runner expectation changed from self-hosted labels to ChangesTrusted CI runner routing
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The change updates the runner-routing audit policy to match the intended hosted-runner configuration and adjusts its test expectation; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Contributor
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical findings | No |
blocked |
CRITICAL findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)
jonahgabriel
pushed a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Aug 27, 2026
#7273) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#2923 * evidence: OCC companion self-bind for #7273 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
github-actions
Bot
deleted the
jonah/omn-16682-runner-routing-policy-expected-json
branch
August 27, 2026 08:49
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 27, 2026
… contract-compliance (#2926) `ci.yml`'s `contract-compliance` step met an empty `PR_NUMBER` with `exit 0`. That was a vacuous pass on a required gate: "Contract Compliance Check" is a GATE_JOBS entry in `scripts/ci/ci_summary_gate.py`, and CI Summary is this repo's sole required branch-protection context, so the umbrella poller counted a run that evaluated zero DoD check_values as a *provable* pass. Unlike a red gate, a green one that checked nothing never prompts investigation. Scope correction against the ticket body, which claimed "every dev push": `on.push.branches` here is `[main]`, so this never fired on a dev commit. The two live fail-open events are push-to-main (release-synced fast-forwards) and merge_group -- the latter unexercised today (no registry repo has a queue on dev as of 2026-08-24) but a latent bypass of the sole required context the instant a queue returns, with zero further code change. The fix is resolution, not narrowing. Excluding push/merge_group with a job-level `if:` would publish a `skipped` check run, which branch protection counts as passing -- the OMN-14863 skip-vector class. So the job keeps running on all three events and `scripts/ci/resolve_contract_compliance_pr.py` answers which PR's check_values apply: the event's own number on pull_request (no API call, behaviourally identical to pre-fix), the `pr-<n>-` segment of the gh-readonly-queue ref on merge_group (no API call), or the merged source PR of the pushed commit via `gh api repos/{repo}/commits/{sha}/pulls`. Anything unresolved -- including a transient gh failure -- exits 1. Verified live against the real API before landing: dev 8ce11d5 -> #2923, and the three most recent main commits -> #2837/#2823/#2835, so the push path now evaluates a real scope rather than going spuriously red. An all-zero SHA exits 1 with no stdout. Ships with the OMN-15547 incident replay its own default-deny rule demands: two verbatim `gh api` captures under tests/fixtures/omn16508/ -- the empty association list GitHub really returns for a commit no merged PR produced (6d7090d, head of closed-unmerged #2890), which the guard must reject, and a 21KB merged-PR response (5b904d8 -> #2378) as the control that stops a hard-wired `return None` from replaying the incident while failing every legitimate push-to-main closed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-16682 re-flip Finding A — the routing audit asserted the pre-flip seam
The trusted-CI seam was deliberately re-flipped to GitHub-hosted runners at org scope and at all five repo shadows on 2026-08-27T04:36:53–56Z.
config/runner_routing_policy.yaml:5was never moved with it, so the policy still asserted["self-hosted","omnibase-ci"]as intended state.What was wrong
Every scheduled
Runner Routing Auditrun reported six drift findings — org plusomnibase_core,omnibase_infra,omniclaude,omnimarket,onex_change_control— each of the formOMNI_TRUSTED_CI_RUNS_ON_JSON drifted to '["ubuntu-latest"]'; expected '["self-hosted","omnibase-ci"]'. All six describe intended state, not drift.Observed on the 07:58:03Z scheduled run (
33051942203): six::error title=Runner routing drift::lines, andAudit local workflow routingreportingRunner routing audit passed.immediately above them.Why this mattered beyond a red badge
scripts/audit-runner-routing.py::mainaccumulates findings from both surfaces and returns1if the combined list is non-empty. The variable half was guaranteed to contribute six findings on every run, so the job's pass/fail signal was pinned tofailregardless of what the other half found.That other half is
audit_local_workflows, which enforces thehosted_runner_allowlist— including the fork-isolation entries this epic cares about (omnigate.yml, "Fork-only untrusted PR verification must not execute on self-hosted runners", the OMN-16683 surface). A genuine new violation there would have produced one more error line inside an already-failing job and changed nothing observable. The audit was blind exactly where it is load-bearing.The change
One value: the trusted seam's
expected_jsonnow states the intended hosted value, plus a comment recording why it tracks the flip and why the OCC publishers do not.Deliberately untouched:
OMNI_PUBLIC_PR_RUNS_ON_JSON— already["ubuntu-latest"], unchanged.repositories— unchanged, all five shadows still audited.hosted_runner_allowlist— unchanged, all 8 entries and reasons intact.The OCC carve-out is not folded into this seam
occ-*-manual-replayand the OCC autobind / companion-effect publishers do not readOMNI_TRUSTED_CI_RUNS_ON_JSON. They read the dedicatedOMNI_OCC_AUTOBIND_RUNS_ON_JSONknob with a literal["self-hosted","omnibase-ci"]fallback (OMN-16691, fanned out across omnibase_infra#2922 / omnibase_compat#197 / omnidash#295 / omniintelligence#854 / omnibase_spi#281 / omnimemory#452). They publish to the tailnet-only dev-lane broker, which only the self-hosted fleet can reach.That variable is unset at org and repo scope (
404at both, verified read-only), so the literal is the operating value and the carve-out holds by construction.Verification
scripts/audit-runner-routing.py --github-varsagainst the live org and repo variables →Runner routing audit passed., exit0. Previously 6 findings, exit1.scripts/audit-runner-routing.py --local-workflows→Runner routing audit passed., exit0.uv run pytest tests/ci/test_runner_routing_audit.py -q→ 10 passed.test_policy_tracks_repos_that_drifted_to_hosted_minutesasserted the old literal and was updated with the reason; the synthetic policy fixtures in the other tests still exercise the self-hosted expectation, so drift detection itself remains covered.pre-commit run --files config/runner_routing_policy.yaml tests/ci/test_runner_routing_audit.py→ all applicable hooks passed.No Actions variable was created, patched, or deleted by this change. The re-flip lane remains the sole owner of the seam variables.
Evidence-Ticket: OMN-16682
Evidence-Source: OCC#7273
Summary by CodeRabbit