Repository navigation
feat(OMN-19514): vendor the ticket-join migrations, delegation_events.ticket_id and dod_verify_runs.delegation_correlation_id - #4102
Merged
Conversation
…ents.ticket_id and dod_verify_runs.delegation_correlation_id omnimarket node_projection_delegation 0047 adds nullable delegation_events.ticket_id (plus a partial index), and node_projection_dod_verdict 0002 adds nullable dod_verify_runs.delegation_correlation_id (plus a partial index), so a delegation run joins to the ticket it worked and to the DoD verdict that judged it. Vendored here first, per the node-migration vendor-parity ordering, ahead of the omnimarket source PRs. - both files byte-identical to the omnimarket branch sources - their application-migrations.tsv rows (tenant; omninode_internal) - their migration classes, expand-only, the reading the class checker suggests - the manifest count 214 -> 216 - a vendor pin test: exact bytes and manifest binding, the class line against the bytes, and the OMN-15361 application-database SQL gate on every shipped profile, with a positive control that the linter can fail Onex-Lane: dod-loop-join Onex-Session: c5b1a8edfa21458bb523788110eaff22
…the TEXT cast Onex-Lane: dod-loop-join Onex-Session: c5b1a8edfa21458bb523788110eaff22
jonahgabriel
added
the
hold:auto-merge
jonahgabriel
pushed a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Sep 25, 2026
…ibase_infra#4102 (#11206) * evidence(OMN-19514): author OCC companion for OmniNode-ai/omnibase_infra#4102 OCC companion by node_pr_lifecycle_fix_effect (OMN-13317 F1 / OMN-13990 / OMN-14285). Product PR head 6bf49dc7cccfaa2ba187d595be89d5a3ac85e57c. * evidence(OMN-19514): self-bind OCC#11206 + rebind contract_sha256 --------- Co-authored-by: omnimarket-bot <bot@omninode.ai>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 7
Nit-level findings suppressed: 1
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 7 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [MAJOR]
docker/migrations/forward/nodes/node_projection_delegation/0047_delegation_events_ticket_id.sql; docker/migrations/forward/nodes/node_projection_dod_verdict/0002_dod_verify_runs_delegation_correlation_id.sql(glm-review) — Non-concurrent CREATE INDEX on production tables | Both migrations create indexes with plain CREATE INDEX inside (or alongside) ALTER TABLE statements. On PostgreSQL this takes a lock that blocks all - [MAJOR]
docker/migrations/forward/nodes/node_projection_dod_verdict/0002_dod_verify_runs_delegation_correlation_id.sql(glm-review) — Join across TEXT and UUID columns without validation | The documented join is delegation_events.correlation_id (TEXT) = dod_verify_runs.delegation_correlation_id (UUID) with a cast. TEXT correlation i - [MINOR]
docker/migrations/forward/nodes/(glm-review) — Inconsistent transaction boundaries between the two migrations | 0047 wraps its statements in BEGIN/COMMIT; 0002 does not. If the migration runner does not itself supply a transaction, 0002 can leave - [MINOR]
docker/migrations/forward/nodes/node_projection_dod_verdict/0002_dod_verify_runs_delegation_correlation_id.sql(glm-review) — No foreign key or integrity link for delegation_correlation_id | The migration's stated purpose is that a verdict row references the delegation run that produced the work. A nullable UUID with a parti - [MINOR]
tests/unit/migrations/test_omn19514_ticket_join_vendor.py(glm-review) — Unit tests validate SQL shape by regex, never execution | The new test file asserts byte hashes, manifest rows, and regex shape, plus the linter gate, but contains no test that the migrations actually - [MINOR]
tests/unit/migrations/test_omn19514_ticket_join_vendor.py(glm-review) — Positive control only exercises the local profile | test_migration_passes_the_application_database_sql_gate iterates four profiles, but test_the_linter_is_live_positive_control asserts the linter can - [MINOR]
tests/unit/migrations/test_omn19514_ticket_join_vendor.py(glm-review) — NOT NULL regex exclusion is narrower than its comment | The lookbehind (?<!IS )NOT NULL excludes an IS NOT NULL predicate only when the two characters before are exactly 'IS '. It does not exclude, fo
Contributor
|
| Surface | Meaning | Blocks merge? |
|---|---|---|
| Review threads | Per-finding, posted by the reviewer | No (informational) |
Hostile Review Thread Gate |
Deterministic: unresolved hostile-reviewer threads exist | Fails until resolved (not yet a required context) |
degraded verdict |
Fewer than 2 models succeeded (infra) | No |
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)
Contributor
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 7
Nit-level findings suppressed: 1
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 7 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [MAJOR]
docker/migrations/forward/nodes/node_projection_dod_verdict/0002_dod_verify_runs_delegation_correlation_id.sql(glm-review) — Cross-type join between TEXT and UUID invites silent mismatches | The join delegation_events.correlation_id (TEXT) = dod_verify_runs.delegation_correlation_id::text depends on textual canonicalization - [MAJOR]
docker/migrations/forward/nodes/node_projection_dod_verdict/0002_dod_verify_runs_delegation_correlation_id.sql(glm-review) — No integrity mechanism binds the correlation columns | Both new columns are unconstrained free-text/UUID with no foreign keys or domain checks, so the documented join is advisory only. A UUID can be i - [MINOR]
docker/migrations/forward/nodes/node_projection_dod_verdict/0002_dod_verify_runs_delegation_correlation_id.sql(glm-review) — Inconsistent transaction boundaries between the two migrations | 0047 wraps its statements in BEGIN/COMMIT; 0002 does not. If the runner executes 0002 in autocommit mode, a failure between ADD COLUMN - [MINOR]
docker/migrations/forward/nodes/node_projection_delegation/0047_delegation_events_ticket_id.sql(glm-review) — CREATE INDEX without CONCURRENTLY on live tables | Both migrations build non-partial-free indexes with plain CREATE INDEX, which takes a SHARE lock and blocks writes to delegation_events and dod_verif - [MINOR]
tests/unit/migrations/test_omn19514_ticket_join_vendor.py(glm-review) — NOT NULL detector regex has false negatives and false positives | The assertion r"(?<!IS )NOT NULL" would miss 'SET NOT NULL' and 'DEFAULT NOT NULL' style embeddings it was not designed for, and would - [MINOR]
tests/unit/migrations/test_omn19514_ticket_join_vendor.py(glm-review) — Index existence and identity are untested; only ADD COLUMN is asserted | The additive test asserts exactly one ADD COLUMN per file but makes no claim about the CREATE INDEX statements: name, target co - [MINOR]
docker/migrations/forward/_ledger/application-migrations.tsv(glm-review) — Manifest insert breaks apparent file ordering in the ledger TSV | The 0047 delegation entry is appended after nodes/node_projection_savings/091 rather than after the 0046 delegation entry, so the ledg
jonahgabriel
deleted the
jonah/omn-19514-vendor-ticket-join-migrations
branch
September 25, 2026 08:41
jonahgabriel
pushed a commit
that referenced
this pull request
Sep 25, 2026
…y_runs migrations OMN-19514 (#4102) added 0002_dod_verify_runs_delegation_correlation_id.sql to node_projection_dod_verdict's vendored set without updating this test's hardcoded two-file expectation, so test_the_vendored_pair_matches_the_checksum_the_ledger_records fails on dev itself (reproduced identically at origin/dev a6afd00, positive control) as well as on this PR's merged head. Extend the check to the current vendored set of three files instead of a fixed pair. Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a
jake-b-omni
added a commit
that referenced
this pull request
Sep 25, 2026
…dors, not two (#4149) `dev` is red on test_the_vendored_pair_matches_the_checksum_the_ledger_records. OMN-19514 (#4102) vendored a third migration into node_projection_dod_verdict, 0002_dod_verify_runs_delegation_correlation_id.sql, and this test asserts the ledger carries exactly the OMN-18900 create/grant pair. The change is cherry-picked verbatim from Jonah's #4088, which already contains this exact fix. It is lifted out on its own because #4088 is a 27-file feature PR sitting at CHANGES_REQUESTED, and the repo cannot merge anything until this test is green: the post-release version bump (#4146) inherits the failure, and release-identity then refuses every other open PR for being behind the published version. One deadlock, broken at its cheapest point. #4088 keeps the rest of its diff and this file will merge into it unchanged. Claude-Session: https://claude.ai/code/session_01WNif1YXdzBpx5etNjVyyKa Co-authored-by: Jonah Gray <jonah@omninode.ai> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
jonahgabriel
added a commit
that referenced
this pull request
Sep 26, 2026
…nce capture (K1 infra, salvaged from #3951) (#4088) * fix(OMN-19344): declare migration 0045's class so the declaration check passes on dev omnibase_infra#3945 added forward/nodes/node_projection_delegation/0045_terminal_construction_outcome_metrics.sql. omnibase_infra#4039 then merged the migration class gate with a declaration file written before 0045 existed. Since then the whole-tree Node Migration Declaration Check fails on dev (read on a7ea811), and every omnibase_infra PR inherits the red. The entry is the checker's own reading (check_migration_class.py --suggest): forward-only, CREATE OR REPLACE plus ALTER VIEW. Applied migration bytes are unchanged. Onex-Lane: k6-omn18933 Onex-Session: 58cf36df4fd1452589e6d5ee00c357d8 * feat(OMN-18933): refuse a delegation before dispatch unless its bounded lane row agrees K6 of OMN-18925. On the dev lane and the authorized isolated lab (dogfood), the runtime delegation dispatch port now resolves the selected consumer contract against that lane's declared row (lane, broker, consumer, terminal route, repository owner) before the broker is constructed. A missing row, a broker mismatch, a consumer or owner mismatch, a route row on ci-bus or prod, or installed overlay bytes that disagree with the omnimarket wheel RECORD all refuse there, so nothing is published for the correlation. A lane is claimed by its name, by its declared (runtime_environment, internal listener) pair, or by its declared external broker. The .201 dev lane's runtime reports local on redpanda:9092, the listener every compose lane shares, so the caller's dev label is never the identity. The rebuild trigger's overlay model learns broker_topology.runtime_environment so omnimarket can declare it next. Carved from Codex draft omnibase_infra#3951 (bounded_delegation_routes.py, its two models, the addressed transport protocol, EventBusKafka.bootstrap_servers and their unit tests) and credited in each file. Onex-Lane: k6-omn18933 Onex-Session: 58cf36df4fd1452589e6d5ee00c357d8 * perf(OMN-18933): read the packaged lane overlay once per process The installed wheel changes only with a redeploy, which restarts the runtime. Onex-Lane: k6-omn18933 Onex-Session: 58cf36df4fd1452589e6d5ee00c357d8 * fix(OMN-18933): scope overlay refusals to bounded runtimes; strip broker credentials Self-review findings: a malformed or out-of-scope declaration on one lane, or an unreadable overlay, refused every runtime, including stability-test, judge, staging and prod, which the gate never covers. They now refuse only a runtime that claims a bounded lane; the rest log that the gate is not armed. EventBusKafka.bootstrap_servers returns the sanitized host list, as every other exposure in the class does, because the dispatch port logs it. Onex-Lane: k6-omn18933 Onex-Session: 58cf36df4fd1452589e6d5ee00c357d8 * fix(OMN-18933): no new infra protocol; roundtrip-cover the route models CI (run 35993722160) refused two things: a new Protocol in omnibase_infra (protocol ownership: 117 > 116) and three models with no serialization disposition. The route gate now reads the transport's environment and bootstrap_servers attributes directly, so no protocol is added and an in-process bus (no broker address) resolves to None as before. The three K6 models get an explicit JSON roundtrip test and a disposition pointing at it. Onex-Lane: k6-omn18933 Onex-Session: 58cf36df4fd1452589e6d5ee00c357d8 * test(OMN-18933): integration proof of the gate through the real port and Kafka bus identity The Integration Test Coverage gate (run 35995848620) requires a tests/integration test for a feature PR. This composes an unstarted EventBusKafka, the real RuntimeDelegationDispatchPort and the real validator: a mismatched row refuses before the broker exists, the declared row reaches the broker, and a runtime outside the gate dispatches untouched. Onex-Lane: k6-omn18933 Onex-Session: 58cf36df4fd1452589e6d5ee00c357d8 * feat(OMN-18931): dogfood fault-pin admission and typed terminal-evidence capture, salvaged from #3951 The K1 infra half of omnibase_infra#3951, which no other PR carries: - dogfood_delegation_fault_routes: a backend pin is admitted only as a declared dogfood fault route (single hop, HTTP 429 or 503, 240s, no escalation), resolved from the packaged omnimarket lane overlay. The runtime is classified by the bounded route gate's own rule (claimed_bounded_lane), so the shared compose listener redpanda:9092 alone never claims dogfood. The route slug is held as backend_key, read from the overlay's backend_id key. - bounded_delegation_routes: the broker-identity checks are extracted, unchanged, into validate_bounded_lane_broker_identity, and the lane claim is exposed as claimed_bounded_lane, so the fault gate and the route gate share one rule. - RuntimeDelegationDispatchPort: backend_id and no_escalation go onto the wire only after that admission; an opt-in terminal-evidence sink receives the consumed terminal's raw envelope bytes, topic, partition and offset, bound to the actual dispatch tenant. - RuntimePatternBBroker: TerminalPayload keeps the raw envelope, partition and offset; dispatch_request takes an optional terminal observer. - handler_wiring: the consumer re-checks the pin before the delegation orchestrator's typed request leg runs. - render_bifrost_delegation_contract: the dogfood render appends the declared fault backends; no other lane renders one. - capture, bind and finalize evidence scripts, the K1-K6 runner, the fixed-status fault provider and its two dogfood-profile compose services. Stacked on omnibase_infra#4056 (OMN-18933), which carries the reworked bounded-route gate including the listener-name classification fix. Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a * fix(OMN-18931): add no infra protocol; the evidence sink is a typed callable and the pin reads bus identity by attribute omnibase_infra's protocol-ownership ratchet admits no new Protocol, and the bounded route gate already reads environment and bootstrap_servers as plain attributes (OMN-18933). The two protocols carried over from #3951 are removed: the sink is DelegationTerminalEvidenceSink, a Callable alias, and the pin admission reads the bus identity the same way the route gate does. Version 0.38.58, past the published 0.38.57. Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a * fix(OMN-18931): the salvaged scripts pass mypy --strict (no Any returned as int) Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a * fix(OMN-18931): regenerate the runner image identity lock for the version bump The PR's pyproject.toml/uv.lock version bump (0.38.57 -> 0.38.58) feeds the shared CI env digest, so the recorded runner-image identity went stale. Regenerated via scripts/ci/runner_image_identity.py --mode generate. RED before: test_recorded_identity_matches_recomputed_identity and test_identity_uses_shared_env_digest_as_a_binding_component failed, lock recorded shared_env_digest 99110eda10a86b271a810b4f vs recomputed 105217eb63ab02cc12602770. GREEN after: both tests pass, full tests/ci/test_runner_image_identity.py (11/11) passes. Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a * fix(OMN-18931): declare the two dogfood delegation-fault containers in the lane manifest and render tests The PR added dogfood-delegation-fault-429 and -503 to docker-compose.dogfood.yml without the lane-manifest entries the parity test requires, and without adding them to the dogfood render test's expected service and port sets. Both are long-running (kind: service, replicas: 1) and publish no host port. The manifest edit carries a read-only verified: attestation from the lab-200 host. Entries drafted through onex delegate (deployed dev lane, run f1c441ee-603a-4a2e-8b51-d1178e48942c, Qwen3.8-27B, cost 0). Onex-Lane: infra-3951-salvage-split Onex-Session: 2df5b14a70fb4fd89dc0cc4218139afe * fix(OMN-18931): vendored-pair ledger check tracks all three dod_verify_runs migrations OMN-19514 (#4102) added 0002_dod_verify_runs_delegation_correlation_id.sql to node_projection_dod_verdict's vendored set without updating this test's hardcoded two-file expectation, so test_the_vendored_pair_matches_the_checksum_the_ledger_records fails on dev itself (reproduced identically at origin/dev a6afd00, positive control) as well as on this PR's merged head. Extend the check to the current vendored set of three files instead of a fixed pair. Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a * fix(OMN-18931): the OMN-19514 linter positive control retargets an undeclared schema, since public is the tenant schema after OMN-17887 Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a * fix(OMN-18931): advance the Receipt Gate pin so attempt-scoped supersede receipts resolve The verify job on this PR returned nonpass_receipt for the two sibling proof keys of OMN-18931 (omnimarket#2840 and #2841). Both keys carry attempt-scoped supersession records on OCC dev, and the validator the gate ran could not see them: the caller pin aeaf3b16 selects a copy of receipt-gate.yml whose inner validator ref is still 37bd8519, where the supersede-suffix pattern excludes a dot. Reproduced locally against the same OCC tree and PR commits: - validator at 37bd8519: eligible=false, reason=nonpass_receipt, the same two keys the CI log names - validator at a03b1072 (the inner ref at 9cc9f035): eligible=true This repoints the caller at 9cc9f035 (omnibase_core#1740), the pin omnimarket already carries since omnimarket#2769 under OMN-19149. The receipt-gate.yml copy differs between the two pins only in that inner ref. Related: OMN-19149, OMN-19050 Onex-Lane: infra-3951-salvage-split Onex-Session: a68655aa197947c585d16729ece58c2a --------- Co-authored-by: onexbot-occ-writer[bot] <307849072+onexbot-occ-writer[bot]@users.noreply.github.com>
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-19514: vendor the two ticket-join migrations
A delegation run can now be joined to the ticket it worked, and through that ticket to the DoD verdict that judged it. Two node-owned omnimarket migrations add the join columns. They are vendored here first, per the node-migration vendor-parity ordering, ahead of the omnimarket source PRs.
What this changes
nodes/node_projection_delegation/0047_delegation_events_ticket_id.sqldelegation_events.ticket_id TEXTplus a partial indexe7d8902e...nodes/node_projection_dod_verdict/0002_dod_verify_runs_delegation_correlation_id.sqlomninode_internal.dod_verify_runs.delegation_correlation_id UUIDplus a partial indexf057edc2...application-migrations.tsvrow and its migration class. Both areexpand-only, which is whatcheck_migration_class.py --suggestreports for them.tests/unit/migrations/test_omn19514_ticket_join_vendor.pypins the exact bytes and the manifest binding. It also checks the class line against the bytes (one added column, no constraint, drop, update, delete or unique index) and runs the OMN-15361 application-database SQL gate on every shipped profile, with a positive control showing the linter can fail.Tests
Lab readback (rule 24), .201 dev lane, compose project
omnibase-infraThe window was exclusive on the dev runtime surface and acknowledged by the runtime train. Both files were applied by hand from these exact bytes to
omnidash_analyticsonomnibase-infra-postgres:ALTER TABLEplusCREATE INDEX, clean. The omnimarket branch code was copied into the three runtime containers. Then:01aa12ee-9887-49a3-8621-31688f13f23e(correlation66051a4b-131a-46d5-b175-74b95175ed48) wrote itsdelegation_eventsrow withticket_id = OMN-1951468c787e2-122f-47cb-ab5b-d4c366252de2) wrote adod_verify_runsrow withdelegation_correlation_id = 66051a4b...The DoD status is
skippedbecause OMN-19514 had no change-control contract yet when it ran. The join does not depend on the verdict. Finding:delegation_events.correlation_idisTEXTon the lab, so the join casts:v.delegation_correlation_id::text = d.correlation_id. The migration's comment now says so.Both columns and their indexes were dropped again when the lane was restored, so the forward-migration runner applies these files fresh on the real deploy. That restore also put the three containers back on released bytes, and a control run afterwards wrote its row normally.
Landing order
onex delegate --ticketPR can land at any point.Evidence-Ticket: OMN-19514
Evidence-Source: OCC#11206