feat(OMN-16839): committed REST-PATCH PR-body helper with a read-back assertion (gh pr edit writes nothing)

[jonahgabriel]

Closes OMN-16839.

Problem

gh pr edit <n> --body ... / --body-file ... exits 1 on OmniNode-ai repos: the edit path calls the deprecated Projects-classic GraphQL API, which the org no longer serves. The PR body is not written.

The failure is in the dangerous direction. There is no output a casual reader notices, the exit code is easy to lose (a && chain, a || true, a pipeline whose last stage succeeds, or a caller that simply does not check), and the next step — a Receipt-Gate run, a merge, a closeout report — proceeds believing an Evidence-Source: / Evidence-Ticket: line is published when nothing changed.

This is the third rediscovery. It is recorded in memory reference_gh_pr_edit_projects_classic and worked around privately each time with an ad-hoc gh api --method PATCH. A rule in a memory file is not a mechanism.

Blast radius: PR bodies are how evidence stamps reach the Receipt Gate. A silently-dropped body write is a missing stamp the author believes they filed — the same class as OMN-15441 / OMN-15460 / OMN-15564, but originating locally rather than in CI.

What this ships

scripts/pr_body.py — the one committed copy of that workaround, alongside heavy_lock.py and ledger_lock.py (same directory, same friction-to-committed-helper pattern, OMN-16822 / OMN-16532). It carries the two assertions the ad-hoc gh api form never had:

• Identity, before writing (AC1). The caller names --repo OWNER/NAME --pr N; the helper GETs that PR and refuses to write unless the served html_url and number are that PR. Body-writing automation with no target-identity check is how OCC#5621's body was overwritten with omnibase_infra#2589's (OMN-15564) — cross-repo and unattributable.
• Read-back, after writing (AC1). Success is never concluded from the mutation call returning. The helper re-GETs the PR and compares what the API now serves against what it intended. It never exits 0 without having confirmed the published body. This is the gh pr edit defect, caught.
• Idempotent --append. Reads the current body, adds the text after a blank line, and no-ops if the text is already present verbatim. Evidence appends get retried (a lane re-runs a closeout, a sweep passes twice); two Evidence-Source: lines in one body is the over-match class OMN-14675 describes.
• Distinct exit codes + a pr_body: marker. 65 identity mismatch (nothing written), 69 gh unavailable, 70 read-back mismatch. Deliberately not 127: a bare 127 with no marker means the helper itself is missing, and those two must stay mechanically distinguishable — the lesson OMN-16822 encoded after flock(1)'s absence produced exactly that markerless 127.
• The payload goes over stdin as JSON rather than --field body=..., so newlines, backticks, and leading dashes in an evidence block survive untouched.

Tests — tests/unit/scripts/test_pr_body.py (14, TDD red-first)

Written before the helper existed; the first run failed with FileNotFoundError: .../scripts/pr_body.py at collection.

The suite drives the helper against a scripted stand-in for gh (injected via --gh-bin), so nothing touches the network. The stand-in can be told to accept a PATCH and change nothing — the gh pr edit behaviour, reproduced.

• the no-op write is caught: PATCH accepted, body unchanged → exit 70, pr_body: marker, and the test asserts the served body really is still the old one, i.e. the helper did not lie about what is published;
• a successful --set is confirmed by read-back;
• --append preserves the existing body and adds the text; running it twice leaves exactly one copy of the stamp;
• identity mismatch refuses to write — both a wrong-repo html_url (asked for omnibase_infra#42, served onex_change_control#42) and a wrong number; in each case the served body is asserted untouched;
• a missing gh exits 69 with the marker, with a negative control asserting an absent helper is a markerless failure;
• an AST walk over the script asserts neither pr nor edit is ever a literal handed to gh (with api/PATCH as the positive control) — prose about the broken verb is expected in the header, a call site is not;
• --dry-run prints the intended body and writes nothing; --set/--append are mutually exclusive; pure-function coverage of the append composition rule.

Follow-on (separate repo, separate PR)

The dispatch-template sweep — docs/standards/DISPATCH_LANE_BRIEF.md CORE block, docs/runbooks/pr-landing-ceremony.md, docs/runbooks/merge-sweep-standing-procedure.md — lands in omni_home, since that is where those docs live. AC3/AC4 are tracked there.

dod_evidence

• Helper: scripts/pr_body.py (executable, SPDX-stamped)
• Tests: tests/unit/scripts/test_pr_body.py — 14 passed
• Red-first proof: collection error FileNotFoundError: .../scripts/pr_body.py before implementation
• uv run ruff check clean; uv run mypy scripts/pr_body.py --strict → Success: no issues found in 1 source file
• Governed pre-push selector: 1946 passed, 13 skipped (497.91s)
• Every heavy run in this PR serialized through scripts/heavy_lock.py (OMN-16822)

Evidence-Ticket: OMN-16839
Evidence-Source: OCC#7404

[coderabbitai]

Warning

Review limit reached

Next included review available in 25 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 131 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8590d2bc-5f81-4ab2-85ac-50219c41ae29

📥 Commits

Reviewing files that changed from the base of the PR and between 25a24fa and 0bae1a7.

📒 Files selected for processing (2)

• scripts/pr_body.py
• tests/unit/scripts/test_pr_body.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8468/OMN-8524) and do not block merge. Error: all review endpoints [192.168.86.201:8000 192.168.86.201:8000 ] unreachable — preflight short-circuit (no models available)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical findings	No
blocked	CRITICAL findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)