Repository navigation
fix(OMN-16878): make receipt-honesty and contract-validation actually block on infra - #2973
Conversation
… block on infra
OMN-16876 census item 2. Both checks ran on every omnibase_infra PR and could
not block a merge.
That is sharper here than in any other repo: `dev` requires exactly ONE status
check, "CI Summary" (the OMN-4497 single-umbrella design), so
EXPECTED_EXTERNAL_CONTEXTS in scripts/ci/ci_summary_gate.py IS the entire
external enforcement surface. A context missing from that tuple has no second
surface to fall back on and no branch-protection signal that it is missing.
Both entries close a Done ticket that live state contradicts:
- OMN-13328 ("receipt-honesty REQUIRED on all repos that produce receipts")
-- its OCC contract asserted omnibase_infra, omniclaude and omnimarket
"were already flipped". Live readback 2026-08-28: none of the three was
enforced on any surface.
- OMN-13326 ("contract-validation REQUIRED across all 6 repos") -- genuinely
required on omnibase_core, omnibase_compat, omnibase_spi, omniintelligence
and omnidash; wired on neither omnibase_infra nor omniclaude.
Admission, measured not assumed:
- #2955..#2970 (2026-08-28): 16/16 present, 16/16 green for both.
- Backfilled BOTH existing merge-time fixtures with real API reads under the
fixtures own merge-time filter (started_at <= mergedAt), not synthesised
rows: omn15496 (#2546..#2567) and omn15979 (#2705..#2720). The second
window independently measured 32/32 present, 32/32 green across both
contexts. Three independent windows agree; no freeze-baseline ratchet is
indicated.
Non-vacuity (OMN-16876 finding 5) -- 16/16 green is also exactly the vacuous
pass shape, so each was proven able to FAIL on real input:
receipt-honesty gamed receipt (verifier == runner) -> exit 1; real -> 0
contract-validation schema-invalid contract -> exit 1; OMN-10041.yaml -> 0
Both producers declare pull_request AND merge_group and carry no `needs:` and
no job-level `if:`, so no upstream failure can skip them; and this layer admits
only "success", so a skip fails closed rather than passing.
Evidence-Source: OCC#7433
|
Warning Review limit reachedNext included review available in 1 minute. View limit detailsLimit details: You’ve used the included review currently available. Your 131 included PR review attempts over the past 7 days set your current allowance at 1 review per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
Comment |
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical findings | No |
blocked |
CRITICAL findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)
1 participant
Ticket
OMN-16878 — wire
receipt-honestyandcontract-validationinto omnibase_infra's real enforcement surface. Executes item 2 of the OMN-16876 enforcement census.Evidence-Ticket: OMN-16878
Evidence-Source: OCC#7454
Original-Evidence-Source: OCC#7433
The gap
Both checks ran on every omnibase_infra PR and could not block a merge. House Rule 5: detection not wired as a pre-merge gate is advisory and gets ignored.
This is sharper here than in any other repo.
devrequires exactly one status check —CI Summary(the OMN-4497 single-umbrella design) — soEXPECTED_EXTERNAL_CONTEXTSinscripts/ci/ci_summary_gate.pyis the entire external enforcement surface. A context missing from that tuple has no second surface to fall back on and no branch-protection signal that it is missing. It simply stops mattering, silently.Two Done tickets that live state contradicts
Correction comments with the full readback are on both tickets. Neither needed re-implementation — only wiring.
Admission — measured, not assumed
omn15496fixture, backfilledomn15979fixture, backfilledBoth existing merge-time fixtures were backfilled with real API reads under the fixtures' own declared merge-time filter (
started_at <= mergedAt) — not synthesised rows — following the precedent set forDep Provenance Gate(OMN-15737) andIntegration Test Removal Gate(OMN-15979). Three independent windows agree.Non-vacuity — mandatory, per OMN-16876 finding 5
Zero reds across three windows is also exactly the vacuous-pass shape: a checker fed empty or inapplicable input prints PASS and exits 0 forever. Each was therefore proven able to FAIL on real input, with a positive control:
receipt-honestyverifier == runner[SELF_ATTESTATION])contract-validationticket_idint,titlelist,dod_evidencestring, extra keycontracts/OMN-10041.yamlNegative fixtures were local-only and are deliberately not committed. The
receipt-honestyvalidator also exits 1, not 0, when handed no arguments — it does not manufacture a green from empty input; the workflow's "0 changed receipt files" short-circuit is an explicit, readable applicability guard.Baseline freeze?
Not needed. Zero reds across three independent windows, so nothing had to be frozen and nothing was force-greened. These are straight promotions, not OMN-14340 / OMN-14355-shaped ratchets.
Why no
if: always()fix hereomniclaude's three producers needed one (
needs: occ-preflightwith noif:is skip-as-pass under branch protection — OMN-15057 vector 5). Neither producer here hasneeds:or a job-levelif:at all, so no upstream failure can skip them. Belt and braces regardless: that hazard is a branch-protection property, and this layer'sEXTERNAL_GOOD_CONCLUSIONSadmits onlysuccess, so a skipped producer failsCI Summaryclosed rather than satisfying it.Both producers declare
pull_requestandmerge_group, so requiring them cannot wedge a queue SHA if a queue is ever re-enabled.Tests
tests/ci/test_omn_16878_enforcement_wiring.py— pins tuple membership, that neither context is simultaneously listed inMEASURED_NOT_ENFORCED_CONTEXTS, both producer triggers, the no-skip-path producer property, and thatskippedis never a good external conclusion.uv run pytest tests/ci/test_omn_16878_enforcement_wiring.py tests/ci/test_ci_summary_gate.py -q→ 90 passed.