[jonahgabriel]

Summary

OMN-18942, the dedup-window acceptance criterion (AC-3).

Measured 2026-09-23. SLACK_BOT_TOKEN / SLACK_CHANNEL_ID were set on this repository at 10:43Z. After that, every scheduled run of pr-ci-zombie-detector.yml re-posted the same unchanged findings to the channel (runs 35850665037 10:46Z, 35851297482 10:53Z, 35852673260 11:07Z). At origin/dev c159b71 the evaluator called post_slack_alert(combined_alerts) whenever there was a finding. It kept no prior-alert state, had no window, and recorded no suppression.

Behaviour

• Key: (repo, check) for the pull-request half ((repo, workflow) for the scheduled half, which this job does not run).
• Suppressed: the failure count is unchanged or lower than the count last posted, and the post is inside alert_dedup_window_hours. Each suppression is logged (SUPPRESSED <key> failures=... window until ...), listed under dedup.suppressed in the report artifact, and shown as a row in a "Alert dedup (OMN-18942)" job-summary table. It also raises no ::warning annotation.
• Posted: a new key, a higher count (worsened a->b), or an expired window. The message names how many unchanged findings it suppressed.
• Resolved: recorded and not posted. The key is dropped, so a recurrence reads as new. If a repository is unreadable this run, its keys are carried rather than resolved, so a transient 403 does not cause a re-post later.
• Window: 24h, declared as the required policy key route.nonrequired_check_alert.alert_dedup_window_hours (rule 8, no default). The justification is in the policy comment: an unchanged non-required-check failure is a triage item, not a page. Once a day keeps it visible, and any worsening re-posts at once. 6h (the .201 reporter's cadence) would put four copies a day in the channel for a class that blocks nothing.

State store and failure direction

• Store: the previous run's own nonrequired-check-report artifact. Each report now carries alert_state. The next run lists this workflow's runs on its own ref (GITHUB_REF_NAME) through the Actions API, skips itself, takes the newest run with an unexpired report artifact, downloads the zip, and reads alert_state. The read uses GH_TOKEN, the App token the job already mints with permission-actions: read on this repository. There is no new credential and no workflow permissions: change. The same file that suppresses also records the suppression, so no second store can drift from the evidence.
• Fails OPEN to the channel. Absent prior state (no artifact, or one that predates this change) and unreadable prior state (fetch refused, corrupt zip or JSON, wrong schema, malformed entry, a post timestamp in the future) suppress nothing. Every finding posts. An unreadable state adds a marker to the message and a ::warning annotation, and the summary says why. A duplicate post is noise; a wrongly suppressed one is the silent-gate defect.
• A post counts only when acknowledged. Slack answers a refused post with HTTP 200 and ok:false. The post now counts only on ok:true. Otherwise the state is not advanced and the finding is retried on the next run instead of being suppressed for a window.
• Serialised. The alerter job has a concurrency group without cancel-in-progress. Overlapping runs would otherwise each read the run before the other and re-post. The lookup accepts an in-progress run whose report is already uploaded.
• Missing-destination refusal: unchanged. resolve_destination is checked whenever there is a finding, including when every finding is suppressed, so findings with no destination still exit 1.

Out of scope

• The 3-vs-9 repository list (AC-2) is a separate B1 item. It is not touched here; the run step still names three repositories.
• AC-4 and AC-5, and the ticket state, are unchanged by this PR.

Classification: not runtime-affecting

This is CI tooling: one workflow, one scripts/ci evaluator, and a policy key read only by that evaluator and the .201 probe (which reads failure_threshold only). I asked the rebuild trigger itself (trigger_rebuild_on_merge.py --dry-run over this diff's files): No rebuild trigger: no runtime_change label or runtime path changes detected. The positive control on src/omnibase_infra/runtime/service_kernel.py returns Runtime change detected. So rule 24's lab pass does not apply. The proof is the focused tests plus a live read-only run against the real Actions API, below, and the post-merge scheduled runs.

Lab readback

• host: operator Mac. Surface: the live GitHub Actions API for OmniNode-ai/omnibase_infra, read-only, --dry-run (no post).
• command: GITHUB_REF_NAME=dev GITHUB_REPOSITORY=OmniNode-ai/omnibase_infra GITHUB_RUN_ID=0 uv run python scripts/ci/nonrequired_check_failure_rate.py --owner OmniNode-ai --repo omnibase_infra --no-scheduled --policy config/runner_routing_policy.yaml --report <scratch>/report.json --prior-state-workflow pr-ci-zombie-detector.yml --dry-run
• observation: exit 0. The fetch found the latest real report (run 35857023828), downloaded and parsed its zip, and classified it absent: prior report predates alert state (no alert_state key). Three live findings were marked due with reason prior_state_absent. The summary rendered Delivered: dry run, nothing sent and no state advanced and a DUE table with | escaped.
• restored=yes: read-only; nothing mutated.
• Expected first live runs after merge: the first scheduled run reads a pre-change artifact, so it reports absent and posts once. That post is the first carrying alert_state. Every later run inside 24h with unchanged counts should log SUPPRESSED and post nothing.

Tests

tests/ci/test_nonrequired_check_alert_dedup_omn18942.py: 26 tests, written RED first against origin/dev c159b71 (20 of 20 failed at the time of writing). They drive the real main() with _gh_json, _gh_bytes and urlopen replaced at the module boundary:

• unchanged count inside the window: suppressed and recorded (report, summary, log line, no annotation). Positive control: the same finding with empty prior state posts.
• a lower count is suppressed; a worsened count re-posts with worsened 3->4.
• a new finding posts while an unchanged one is suppressed; a resolved finding is not posted and is dropped.
• window expiry posts; the boundary control, 60s inside the window, is suppressed.
• unreadable prior state (corrupt JSON, corrupt zip, wrong schema, runs listing refused) posts with the marker; absent state and a pre-change report post as absent.
• ok:false from Slack does not advance the state; a missing destination still exits 1 when everything is suppressed.
• an unreadable repository carries its keys, with a control that a readable one resolves them; a future post timestamp does not suppress.
• a dry run posts nothing and advances no state; summary cells escape |.
• the policy declares the window and fails loudly without it; the workflow passes --prior-state-workflow, scopes to the ref, is serialised, and rides the App token with actions: read.

Focused run, all evaluator suites: uv run pytest tests/ci/test_nonrequired_check_alert_dedup_omn18942.py tests/ci/test_nonrequired_check_failure_rate_omn18254.py tests/ci/test_scheduled_run_failure_rate_omn18322.py tests/unit/scripts/test_fleet_failure_sink_omn18942.py tests/ci/test_alert_token_source_omn18254.py tests/ci/test_incident_replay_omn18254.py tests/ci/test_ci_evidence_policy.py: 152 passed. mypy --strict is clean on the script, and pre-commit run --all-files is clean.

Evidence-Ticket: OMN-18942
Evidence-Source: OCC#10920

[onexbot-occ-writer]

No OCC evidence companion was minted for this PR.

product PR is a draft; companion suppressed (F-17)

Matched in the state: draft

To clear this: Mark the PR ready for review. The ready_for_review trigger re-fires the born path and the companion mints then.

Reported by node_occ_companion_effect (decline code pr_draft, OMN-16665). This decision was made against the PR's LIVE state at compute time, not at publish time — a green publisher job only means the command reached the broker.

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Critical findings: 0
Major findings: 3
Total findings: 6
Models succeeded: glm-review

Note: Fewer than 2 reviewer models succeeded. Degraded results are informational (OMN-8468/OMN-8524) and do not block merge. Error: cli_review exit 2 (fewer than 2 models succeeded — partial/total outage)

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	No

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 6
Nit-level findings suppressed: 0

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 6 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] scripts/ci/nonrequired_check_failure_rate.py: fetch_prior_alert_state / main (glm-review) — Branch filter keyed on GITHUB_REF_NAME diverges from concurrency ref scoping | The concurrency group serialises on github.ref, but the prior-state fetch filters run history by GITHUB_REF_NAME. For pul
• [MAJOR] scripts/ci/nonrequired_check_failure_rate.py: next_alert_state (glm-review) — Resolved keys are dropped from state even when delivery failed | next_alert_state guards the due findings' entries on delivered, so a failed Slack post leaves them retried next run. Resolved keys, h
• [MAJOR] tests/ci/test_nonrequired_check_alert_dedup_omn18942.py (glm-review) — ScheduledAlert dedup path untested end to end | Every end-to-end harness run passes --no-scheduled, so the ScheduledAlert half (the 'scheduled|' key namespace, render_scheduled suppression, and the in
• [MINOR] scripts/ci/nonrequired_check_failure_rate.py: REPORT_ARTIFACT; .github/workflows/pr-ci-zombie-detector.yml (glm-review) — Artifact-as-state couples dedup correctness to report upload success | The design stores dedup state inside the report artifact uploaded by a separate workflow step. The script writes the report file,
• [MINOR] scripts/ci/nonrequired_check_failure_rate.py: fetch_prior_alert_state (glm-review) — Artifact zip downloaded without size bound | The artifact listing response includes size_in_bytes, which is not consulted before _gh_bytes pulls the entire zip into memory and json.loads the member. A
• [MINOR] scripts/ci/nonrequired_check_failure_rate.py: post_slack_alert (glm-review) — Lost Slack acknowledgement yields duplicate post, state then suppresses | post_slack_alert returns False on a urlopen exception. If the post actually reached Slack but the response read timed out (tim