Repository navigation
wip(OMN-16964): parked link-5 replay-core branch (handoff to Lakshman) - #3410
Closed
jonahgabriel wants to merge 4 commits into
Closed
jonahgabriel wants to merge 4 commits into
jonahgabriel wants to merge 4 commits into
Conversation
… it by name OMN-16025 link 5 reads "complete ledger chain + replay green through an HONEST tier-2 verifier (SKIP != PASS)". The READER for that link merged in #3072 and #3079: it selects hop, replay_green and verifier_verdict out of a relation called ledger_chain. That relation exists in no database on any lane, so every run since link 2 was closed has reported ledger_replay_not_configured at 4 of 5 links (34355201941, 34356615155). Two changes, both on the consumer side of the leg. 1. Migration 105 creates ledger_chain in the omnibase_infra database, beside its two nearest neighbours 088 overseer_tick_ledger and 089 verification_receipt_ledger, which are verification ledgers in that same flat set. Five columns are a contract with the merged reader and are commented as such. verifier_verdict carries a CHECK pinning it to pass / fail / skip, so a column that cannot represent SKIP can never force a writer to lie. There is deliberately no payload column. The migration also grants chain_canary_reader column-scoped SELECT on exactly the five columns the reader selects, guarded on role existence with a NOTICE, matching the contract already documented against CHAIN_CANARY_READER_PASSWORD in docker-compose.infra.yml. No credential is minted or rotated. 2. The leg's source becomes a variable NAME. #3072 shipped a raw-DSN ledger_source field, which is the exposure OMN-18060 removed from the sibling projection leg: onex skill serialises every arg into the node payload, onto the bus and into the event log, and the flag lands in argv. ledger_source_env replaces it outright with no shim, because no CLI row ever set the old field and so no caller can break. The model refuses a value that parses as a connection string, and the handler refuses a DSN that arrived on any other flag, reporting a new REFUSED status that renders as a non-passing link 5 rather than as an error. The lane declaration is read through a new load_lane_ledger_readback, which shares one core with its projection sibling so a refusal cannot be lost from one copy. Its lane set and its block key are separate constants: widening one leg's scope must be a deliberate edit to that leg. expected_ledger_hops now gets the same comma-splitting as the terminal topic fields, because the workflow passes it as one scalar flag; without it the declared hops would arrive as one string matching nothing and a complete chain would report CHAIN_INCOMPLETE. Effect on the canary today: the relation is real and empty, so link 5 moves from "no source configured" to CHAIN_INCOMPLETE naming the hops it did not find. That is a changed, falsifiable status reached through a real connection, and it stays red until the writer lands. Ordinal 105, not 104: 104 is BURNED. OMN-17923 retired 104_create_validator_ro_role.sql and its record requires the migration to come back as a new number, never as 104. This is the first new forward migration since that retirement, which surfaced a conflation in the retirement gate: its byte-identity test fingerprinted the WHOLE forward directory, so it asserted not only "the retirement removed 104 and nothing in 001..103 changed" -- the invariant it owns and its docstring states -- but also "no forward migration may ever land again", which it never claimed and which its sibling test deliberately allows for by bounding itself to ordinal <= 104. The assertion is now scoped to ordinals at or below the retired one, via a new optional include predicate on compute_migration_fingerprint. Same algorithm, same stamped digest, same file count: the retirement proof is unchanged and now stays true as the stream grows. The artifact is restamped, 88 -> 89 files, which the unscoped sibling test enforces. docker-compose.infra.yml's CHAIN_CANARY_READER_PASSWORD comment named "migration 104" as the file granting that role. It is corrected: 104 is a burned ordinal, 105 issues the link-5 grant, and the link-2 grant it described is issued by no migration at all (OMN-18115). RED first. 6 of 7 canary-side tests and 3 of 4 lane-loader tests failed before the implementation. 1072 tests green after across the db and canary suites, mypy --strict clean.
…ate stops failing every PR
The Lane Census Staleness gate (OMN-13034) fails any PR when
deploy/lane-census/census-snapshot.json is more than 7 days old. The committed
snapshot was emitted 2026-09-02T12:28:09Z, so it crossed the threshold and now
fails for every PR touching a gated path, not only this one. The gate's own
error names the remedy: re-run the lane census on .201 and commit the result.
Done exactly that, read-only:
ssh .201 -> /data/omninode/omnibase_infra
./scripts/lane-census-check.sh --dry-run --json
`--dry-run` gathers the live docker inventory and diffs it against
deploy/lane-census/lane-manifest.yaml without publishing the bus event and
without touching any lane. No container was started, stopped, recreated or
retagged; prod, stability-test, judge and the collaborator lane were read and
nothing else.
The refreshed snapshot records what is actually running rather than what was
running eight days ago, and the drift count moves 2 -> 4. All four findings are
observations, not changes made here:
- [critical] prod: omninode-prod-runtime-worker absent (desired replicas=1).
Carried forward from the previous snapshot; unchanged by this PR and not
acted on by it, because prod is read-only to this lane.
- [warning] dev: omnibase-infra-forward-migration, onex-api and
omninode-infra-routing-decisions-consumer each carry
com.omninode.lane='dev' but are not declared in the lane manifest.
The three dev-lane warnings are new since 2026-09-02 and are the honest reason
the count rose: the manifest has not caught up with containers other work
added to the fully-mutable dev lane. Declaring them is a manifest decision that
belongs to whoever added them, so this commit records the drift rather than
silencing it — the gate's own instruction is "do not silence the check".
Separate concern from the rest of this PR, kept as its own commit for that
reason.
The Application Database Domain Enforcement gate (OMN-15361, ci.yml step "Enforce schema qualification in changed SQL") rejected the migration. It inspects only the DIFF, so the unqualified references in the older files of this set are grandfathered rather than permitted, and a new file does not get to copy them. Qualified: the CREATE TABLE target, the GRANT target, and all three COMMENT targets. The table lands in `public` either way — that is the search_path default the runner uses — so this changes nothing about what is created and everything about whether the statement says so explicitly. A note in the header records why, so the next reader does not simplify it back. The stream fingerprint is restamped, since the migration's bytes changed.
…locked on OMN-18116 PARKED, NOT PROPOSED. This branch has no PR and is not meant to merge as it stands: the module has no caller, and it cannot honestly acquire one until OMN-18116 lands. What this is: the pure, hermetic half of OMN-16025 link 5 — chain assembly, a causal-linkage replay, and a tier-2 verifier whose SKIP is a first-class non-passing member. Eight tests, written RED first, covering exactly the four cases OMN-16964 AC4 names — complete-chain-replay-green, missing-hop, verifier-SKIP, verifier-unavailable — plus correlation drift mid-chain (the OMN-16931 defect class) and the property that a SKIP is never rendered as a PASS under any input shape. All eight green, mypy --strict clean. Why it is parked rather than shipped: the replay it implements re-derives each hop's causal linkage from the preceding hop and compares. OMN-18116 measured that no producer ever writes that edge — parent_span_id is declared on every envelope and populated on none, and the bus envelope has no causation_id field at all. So the writer that would call this module could only ever record replay_green = false. Shipping it now would be dead code at best, and at worst would invite someone to wire it to a fabricated true. Deliberately absent: any writer node, any contract, any subscription, any persistence. Those belong with OMN-18116's fix, not ahead of it. Whoever picks up OMN-18116 should start here. The interface the merged reader expects is fixed by omnibase_infra#3072/#3079 and by migration 105 on jonah/omn-16964-ledger-chain-producer: correlation_id, hop, hop_index, replay_green, verifier_verdict.
Collaborator
Author
|
Closing as superseded (lane m4-carrier-census, OMN-19174). Checked against origin/dev on 2026-09-22: every one of the 27 files this parked branch touches exists on dev. 12 match the branch tip byte for byte, and the other 15 have grown since on dev (for example chain_replay.py, handler_chain_canary.py and test_chain_replay.py). The replay and tier-2 verifier core landed via #3072, #3079, #3381, #3481 and #3644. OMN-16964's four acceptance criteria are met on merged code, and this draft is the only OPEN attachment keeping the done-flip gate from closing it. The branch is kept, so this can be reopened if anything here turns out not to have landed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Handoff only. Not for merge in this form.
This is a draft handoff PR for the parked link-5 replay and tier-2 verify core on OMN-16964. It exists so the work is visible and reviewable on a durable surface, not because it is ready to land. Please do not merge it as it stands.
What this branch is
jonah/omn-16964-link5-replay-core-parked6f8b360a27ddc83f98da281011b9e47a02c1757adevdevCommits, oldest first:
27 files, +1637 / -80. The tip commit records the reason for parking: blocked on OMN-18116.
Why it is a draft
The tip is a
wipcommit by its own description, and the branch is 30 behinddev. Landing it in this shape would merge a parked work-in-progress across a month of drift. The intended path is that the assignee rebases onto currentdevand opens the real PR, at which point this draft can be closed.Auto-merge is deliberately not armed on this PR, and the branch has deliberately not been rebased — rebasing someone else's parked work is theirs to do, since only they can judge which of the four commits survive contact with current
dev.Push evidence
The push went through the governed pre-push hook with no overrides — no
PREPUSH_*variables, noENABLE_SMART_TESTS=off, no--no-verify, nocore.hooksPath. The selector escalated to a fail-closed full suite and placed it on the lab rather than the launching host:Deploy-scope DoD parityalso passed withoutcome=PASS_EVIDENCE.Note what that does and does not establish: 27,490 tests passed at this branch's tip, in isolation from current
dev. It is not a statement that the branch integrates withdevtoday, which is exactly what the rebase will determine.Ticket: OMN-16964. Opened by lane
collab-asks-2026-09-10as a handoff at the orchestrator's request.