Repository navigation
chore(OMN-13912): post-release dev version bump to 0.38.15 - #3033
Closed
onexbot-occ-writer[bot] wants to merge 1 commit into
Closed
onexbot-occ-writer[bot] wants to merge 1 commit into
onexbot-occ-writer[bot] wants to merge 1 commit into
Conversation
Disarms the OMN-13412 release-identity gate that publishing v0.38.14 armed against dev. Triggered-by: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/33314493673
Contributor
Author
|
OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required. |
Contributor
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical findings | No |
blocked |
CRITICAL findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review (OMN-8468/OMN-8524)
jonahgabriel
pushed a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Aug 30, 2026
#7687) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#3033 * evidence: OCC companion self-bind for #7687 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
auto-merge was automatically disabled
August 30, 2026 14:59
Pull request was closed
Collaborator
|
Superseded by #3038 and closed. Two defects in the OMN-13912 post-release bump automation make this PR structurally unmergeable:
OCC evidence was never the blocker: eligibility was green ( #3038 carries the same bump from a ticket-named branch, plus the regenerated runner-image lock. Analysis and proposed DoD amendment are on OMN-13912. |
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 30, 2026
…dentity relock (#3038) * chore(OMN-13912): post-release dev version bump to 0.38.15 Disarms the OMN-13412 release-identity gate that publishing v0.38.14 armed against dev. Triggered-by: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/33314493673 * chore(OMN-13912): post-release dev version bump to 0.38.15 + runner identity relock Replacement for the app-opened #3033, which is unmergeable on two counts: 1. Receipt Gate axis-2 identity binding requires the BRANCH NAME to reference the Evidence-Ticket. #3033's branch is 'automation/post-release-dev-bump-0.38.15' and the OMN-16140 commit-message fallback is NOT wired end to end: the reusable receipt-gate.yml passes --pr-commit-text to validator_occ_merge_eligibility but NOT to validator_receipt_gate_cli, so commit_texts arrives empty ("commit messages checked=0") even though the commit subject names OMN-13912. Renaming a branch closes the PR (OMN-14768 F-11), so this is a new branch. 2. docker/runners/runner-image.lock.json binds pyproject.toml + uv.lock bytes (scripts/ci/runner_image_identity.py MANIFEST_INPUTS), so any version bump invalidates the recorded identity_digest and shared_env_digest. #3033 bumped the manifest without regenerating the lock, reddening tests/ci/test_runner_image_identity.py and runner-image-build-smoke. Both are defects in the OMN-13912 post-release bump automation itself. Local proof: - scripts/ci/runner_image_identity.py --mode verify -> exit 0 - scripts/check_release_identity.py -> "OK: version 0.38.15 is ahead of latest published 0.38.14." --------- Co-authored-by: onexbot-occ-writer[bot] <onexbot-occ-writer[bot]@users.noreply.github.com>
jonahgabriel
added a commit
that referenced
this pull request
Aug 30, 2026
…dentity relock Replacement for the app-opened #3033, which is unmergeable on two counts: 1. Receipt Gate axis-2 identity binding requires the BRANCH NAME to reference the Evidence-Ticket. #3033's branch is 'automation/post-release-dev-bump-0.38.15' and the OMN-16140 commit-message fallback is NOT wired end to end: the reusable receipt-gate.yml passes --pr-commit-text to validator_occ_merge_eligibility but NOT to validator_receipt_gate_cli, so commit_texts arrives empty ("commit messages checked=0") even though the commit subject names OMN-13912. Renaming a branch closes the PR (OMN-14768 F-11), so this is a new branch. 2. docker/runners/runner-image.lock.json binds pyproject.toml + uv.lock bytes (scripts/ci/runner_image_identity.py MANIFEST_INPUTS), so any version bump invalidates the recorded identity_digest and shared_env_digest. #3033 bumped the manifest without regenerating the lock, reddening tests/ci/test_runner_image_identity.py and runner-image-build-smoke. Both are defects in the OMN-13912 post-release bump automation itself. Local proof: - scripts/ci/runner_image_identity.py --mode verify -> exit 0 - scripts/check_release_identity.py -> "OK: version 0.38.15 is ahead of latest published 0.38.14."
github-actions Bot
pushed a commit
that referenced
this pull request
Aug 30, 2026
…e-red classes behind it (#3041) OMN-16989 recorded 15 host-coupled `omnibase_infra` failures on `.201` and set `repos_denied=omnibase_infra` on `h201`. Every one of the 15 was measured inside the `.201` GATE-RUNNER CONTAINER via `scripts/ci/run_on_gate_runner.sh` -- a different execution environment from the one the table routes work to, which is the `.201` HOST over the OMN-16991 remote leg. Re-measured on the host over the real leg, receipts in `.onex_state/prepush_distribution/receipts.jsonl`: tests/unit/ + tests/integration/chains/ 24930 collected, pytest_exit=0, 695s tests/ci/ (the tree the 15 came from) 1892 collected, pytest_exit=0, 122s both host_mode=authorizing, chosen_host=omninode-pc. Zero host-coupled failures. The denial was pinning a verdict from an environment nothing dispatches to. Four real defects surfaced on the way and are fixed, not denied around: 1. The remote wrapper's PATH prefix was macOS-only by construction. `/opt/homebrew/bin` has no meaning on a Linux row and h201 is the fleet's only one. Its measured non-interactive PATH omits `~/.local/bin`, where BOTH `uv` and `shellcheck` live -- already covered by the existing entries, so this caused no red on h201, but the list is now Linux-complete. The added entries go AFTER every measured one, so they can only add resolution. 2. The transplanted tree has no remote-tracking refs. `git bundle create <b> HEAD` carries one ref, and this suite subprocesses the hook, which resolves `${PREPUSH_BASE_REF:-origin/dev}` first. On h201 the whole `test_prepush_hook_host_identity_guard.py` behavioral proof reduced to `base ref 'origin/dev' could not be resolved`. The dispatcher now hands the wrapper the base ref and sha and the wrapper `update-ref`s it in. BASE_SHA is a merge-base, so it is always an ancestor of HEAD and already in the bundle. Unresolvable => skipped silently: it may only add resolution, never refuse. 3. `check_deploy_scope_dod.resolve_omni_home` walks EVERY parent of the repo root, so on the transplant it reached `/data/omninode` and imported an omniclaude clone pinned at omniclaude#1600 (the host's current clone, #1963, is not an ancestor). Four tests failed on `has no attribute 'parse_evidence_metadata'` -- a red about another repo's clone freshness on whichever host ran the suite, with nothing saying so. Same cross-repo-hidden-input shape OMN-16989 named on the env-parity tests. `load_canonical_validator` now asserts the surface it calls and raises a NAMED staleness error; the fixture skips with that reason. The hook still hard-errors, but with a remediation instead of an AttributeError five frames down. 4. `test_release_identity_passes_when_version_ahead` asserted an AMBIENT repo-state precondition ("someone bumped the version in this PR") rather than stating it. Between a release tag landing and the post-release bump landing (OMN-13912, PR #3033, itself blocked on a stale runner-image identity lock) it is red on EVERY developer clone and ONLY there: `actions/checkout` does not fetch tags, so in CI `git tag --list` is empty, the gate is exempt and the test passes; locally the tags exist and it fails. Measured 2026-08-30 -- dev at 0.38.14 with `v0.38.14` cut at 13:24Z -- it refused every local governed pre-push in the repo while being invisible in CI. The test now names the precondition and skips with it. The GATE is untouched: `check-release-identity` (pre-commit) and the CI gate both still run the real script against the real diff. Table + tests, per the runbook's promotion procedure: - `scripts/hooks/prepush_hosts.tsv`: h201 `repos_denied` -> `-`, note carries the measured numbers. - `test_201_is_denied_for_omnibase_infra_until_omn16989_closes` -> `test_201_denies_no_repo_since_omn16989_closed`. - `test_a_repo_denied_host_is_never_chosen` now drives a SYNTHETIC table (the `_SYNTHETIC_TABLE` precedent set when h105 left shadow), so the placement RULE is no longer pinned to whichever repo the lab happens to deny today -- pinning it made a capacity-policy edit look like a mechanism regression, which is exactly the failure this run hit. - `test_no_row_denies_a_repo_today_so_the_rule_needs_a_synthetic_fixture` guards that fixture choice: the moment a real row denies a repo again, it fails and says the live table may be pinned again. Not fixed here: `pyproject.toml` version-vs-published is a release-cut condition owned by OMN-13912; this diff touches neither `src/**` nor `pyproject.toml`, so the release-identity gate itself does not apply to it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Automated post-release disarm step (OMN-13912). Publishing
v0.38.14left dev's[project].versionequal to the highest published tag, which ARMS the OMN-13412 release-identity gate (scripts/check_release_identity.py) against every subsequent dev PR that touchessrc/**.This PR bumps
[project].versionto0.38.15and re-locksuv.lock, so the gate is disarmed by the same flow that armed it rather than by whichever unrelated PR trips it first.Ticket
OMN-13912 — release train must auto-bump project.version post-publish.
Triggered by
Release workflow: https://github.com/OmniNode-ai/omnibase_infra/actions/runs/33314493673
Test plan
release-identityis green on this PR (that IS the behaviour under test)Evidence-Ticket: OMN-13912
Evidence-Source: OCC#7687