Repository navigation
diag(OMN-16788): surface per-ticket dod_verify check detail + credential capability from the sweep runner - #2938
Conversation
…ial capability from the sweep runner The evidence-autoclose sweep records only per-ticket COUNTS. When CI and a local dod_verify disagree on the same ticket and the same contract, the run log cannot say why, because the per-check detail goes to capture files this job never publishes. That is residual #2 of the 2026-08-27 beta DoD-verification status doc, and "which verifier is authoritative" gates `--apply`. Adds an opt-in `diagnose_tickets` workflow_dispatch input. When empty — the value every scheduled run uses — the step is skipped entirely and costs nothing. When set, it runs BEFORE the sweep (so a sweep timeout cannot swallow it) and prints: 1. what this run's GitHub credential can actually READ, per repo the bound contracts cite. Capability only; no token value is printed or derived. 2. the full per-check table for each named ticket — id, status, message — plus the OCC governance ref, refresh outcome and resolved sha. The ticket list is passed through env and format-validated rather than interpolated into the shell (OMN-16323). Refs: OMN-16788
|
OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required. |
|
Warning Review limit reachedNext included review available in 38 minutes. View limit detailsLimit details: You’ve used the included review currently available. Your 131 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Comment |
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical findings | No |
blocked |
CRITICAL findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)
#7322) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#2938 * evidence: OCC companion self-bind for #7322 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
1 participant
Why
OMN-16788. The evidence-autoclose sweep records only per-ticket counts (dod_verify_total_checks/verified/failed). The per-check detaildod_verifyproduces goes to capture files this job never publishes, so when CI and a local run disagree on the same ticket and the same contract, the run log cannot say why.Measured 2026-08-27, same day, same contracts:
Which verifier is authoritative is undecided, and that question gates
--apply. This is residual #2 of the 2026-08-27 beta DoD-verification status doc.What this adds
An opt-in
diagnose_ticketsworkflow_dispatchinput. Empty is the default and the value every scheduled run uses, so the step is skipped entirely and scheduled runs cost nothing extra.When set, it runs before the sweep (a sweep timeout cannot swallow it) and prints:
gh pr view/gh pr checks/gh api repos/.../pulls/..., and_live_pr_checks_for_itemis fail-closed by design: unresolvable live PR state is FAILED, not SKIPPED. A wrongly-scoped token therefore produces a confident wrong verdict rather than an error.occ_governance_ref, refresh outcome, and resolved sha.The ticket list is passed through
envand format-validated against^OMN-[0-9]+(,OMN-[0-9]+)*$rather than interpolated into the shell (OMN-16323).Scope
Diagnostic only. No behaviour change to any scheduled run, no
--apply, no Linear mutation, no new secret.Note on why this lands before the run it enables
workflow_dispatchinputs are validated against the workflow definition on the default branch, so dispatchingdiagnose_ticketson the feature branch returns HTTP 500. The input has to exist ondevbefore the diagnostic run it exists to enable can be dispatched.Refs: OMN-16788
Evidence-Ticket: OMN-16788
Evidence-Source: OCC#7322