Repository navigation
refactor(OMN-20687): route host deployment through the operator node - #4656
Conversation
|
OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required. Considered 125 changed file(s):
This verdict is occ-autobind's, derived from this head and its merge base alone. A second producer, the occ-companion-effect backstop, consumes its own command on the lab bus and may still mint a companion under the generic binding. Whether it does depends on that consumer running, not on this diff (OMN-18876). |
|
Companion PR: https://github.com/OmniNode-ai/omnibase_internal/pull/250 head=d43e131eceeca100738b78067107bf00f4a12969. Install the operator package on caller hosts before activating the infra caller cutover; the paired changes must land/install together. |
Pull request was converted to draft
onex-runtime-deploy is a console script of omnibase_internal, installed in that clone's .venv by the onex-internal-clone-sync timer and on no host's PATH, so the bare-name default made a lane refresh exit when #4656 landed. Adds resolve_runtime_deploy() to sibling_clone_manifest.sh, sourced by cut-lab-ref.sh, refresh_dev_lane.sh and refresh_stability_lane.sh. Order (the clone lookup omniclaude#2592 uses for onex-host-reconcile): DEPLOY_RUNTIME if set; else the omnibase_internal clone's .venv/bin/onex-runtime-deploy (OMNIBASE_INTERNAL_HOME, else the sibling of OMNI_HOME as written, then of its resolved target); else PATH. The refusal now lists every path tried. New tests/scripts/test_resolve_runtime_deploy_omn20687.py.
…13221) * evidence(OMN-20687): author OCC companion for OmniNode-ai/omnibase_infra#4656 OCC companion by node_pr_lifecycle_fix_effect (OMN-13317 F1 / OMN-13990 / OMN-14285). Product PR head d6e5a532b82e429031b19fccc6e75e56a68a5822. * evidence(OMN-20687): self-bind OCC#13221 + rebind contract_sha256 --------- Co-authored-by: omnimarket-bot <bot@omninode.ai>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 2
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 0
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 9 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — handler_runtime_deploy.sh uses undefined ONEX_DEPLOY_REPOSITORY_ROOT | The renamed script now references the environment variable ONEX_DEPLOY_REPOSITORY_ROOT with a fail-fast default expansion. Howeve - [MAJOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — resolve_runtime_deploy may resolve to a non-executable path | The resolve_runtime_deploy function in sibling_clone_manifest.sh sets DEPLOY_RUNTIME to a path if it is executable, but falls back to the - [MAJOR]
tests/scripts/test_compose_generation_single_writer_omn17291.py(qwen3-review) — Test subprocess calls use empty env, breaking git operations | Two test functions in test_compose_generation_single_writer_omn17291.py now pass env={} to subprocess.run for git commands. This strips a - [MAJOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — Inconsistent naming between file path and command name | The script is renamed from scripts/deploy-runtime.sh to src/omnibase_infra/handlers/handler_runtime_deploy.sh, but the command name is onex-run - [MAJOR]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) — Executable discovery via PATH in resolve_runtime_deploy | The new resolve_runtime_deploy() function falls back to locating onex-runtime-deploy on the PATH (line `DEPLOY_RUNTIME_TRIED+="${DEPLOY_RUNTIM - [MAJOR]
N/A (external to repository)(gpt-oss-review) — External integrations may still reference old deploy-runtime.sh path | Only internal references were updated to onex-runtime-deploy. Any external CI jobs, automation, or third‑party tools that invoke - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — Missing test coverage for resolve_runtime_deploy fallback behavior | The new resolve_runtime_deploy function in sibling_clone_manifest.sh has complex fallback logic (DEPLOY_RUNTIME env var, OMNIBASE_I - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) — Missing unit tests for resolve_runtime_deploy | The newly introduced resolve_runtime_deploy() logic is exercised only indirectly via scripts that call it. No direct unit test verifies its search order - [MINOR]
scripts/runtime_build/lane_lock.sh(gpt-oss-review) — Potential race condition with ONEX_LANE_LOCK_HELD inheritance | Lane lock scripts rely on the environment variable ONEX_LANE_LOCK_HELD to prevent deadlock. The variable is exported without sanitisatio
Findings demoted from threads (anchor rejected)
-
[MINOR] hostile-reviewer (qwen3-review)
resolve_runtime_deploy performs filesystem checks in a loop | The resolve_runtime_deploy function iterates over candidate home directories and checks for the existence of an executable file in each. While this is a one-time cost at startup, it adds latency to every deploy invocation. If the candidate list is long or the filesystem is slow, this could delay the deploy. The function is called from multiple scripts, so the cost is multiplied. | Evidence: for home in ${homes[@]+"${homes[@]}"}; do
DEPLOY_RUNResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MINOR] hostile-reviewer (gpt-oss-review)
Increased startup cost for scripts sourcing sibling_clone_manifest.sh | The sibling_clone_manifest.sh file grew by ~55 lines, adding complex path resolution logic executed on every invocation of cut‑lab‑ref.sh and related scripts. This adds measurable overhead to script start‑up, especially in CI environments where many short‑lived processes are spawned. | Evidence: scripts/runtime_build/sibling_clone_manifest.sh: added 55 lines implementing clone lookup and resolve_runtime_deploy. | Fix: Cache the resolved
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492).
✅ Hostile Reviewer — REVIEWEDCritical findings: 1
Semantics (OMN-17492 — the model finds, thread resolution gates)
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review (Qwen3.8-27B), gpt-oss-review (gpt-oss-120b) (OMN-8468/OMN-8524/OMN-17492) |
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 7
Nit-level findings suppressed: 0
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 7 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) — resolve_runtime_deploy may execute untrusted binary from PATH | The helper functionresolve_runtime_deployfalls back to the bare command nameonex-runtime-deploywhen it cannot locate the executa - [CRITICAL]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(gpt-oss-review) —handler_runtime_deploy.shnow requires undefined environment variable | The renamed deployment handler setsSCRIPT_DIR_FOR_ENVto `${ONEX_DEPLOY_REPOSITORY_ROOT:?deployment handler must bind repos - [MAJOR]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) — Unsanitized use of OMNI_HOME to construct executable search paths |resolve_runtime_deploybuilds candidate paths from the value ofOMNI_HOMEusing string manipulation (`${home%/*}/omnibase_intern - [MAJOR]
Repository root (affects many files)(gpt-oss-review) — Rename of public deployment script breaks external contracts | The primary deployment entry pointscripts/deploy-runtime.shhas been renamed to `src/omnibase_infra/handlers/handler_runtime_deploy.sh - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) — Potential failure to locate sibling clone when OMNI_HOME is a symlink |resolve_runtime_deployderives sibling paths by stripping the last component of${OMNI_HOME}and appending `/omnibase_intern - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) —resolve_runtime_deployalways returns success even when no binary is found | The function ends withreturn 0regardless of whether a valid executable was discovered. Callers rely on the side‑effec - [MINOR]
tests/scripts/test_cut_lab_ref.py(gpt-oss-review) — Test fixtures still reference old stub script name | Several unit tests (e.g.,test_cut_lab_ref.py) create a stub namedstub-deploy-runtime.shbut the production script is now `onex-runtime-deploy
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 5
Nit-level findings suppressed: 0
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 5 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — Unbound variable crash in handler_runtime_deploy.sh | The script setsset -euo pipefailat the top. The diff changesSCRIPT_DIR_FOR_ENVto use${ONEX_DEPLOY_REPOSITORY_ROOT:?...}. However, the d - [MAJOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — Inconsistent error handling in resolve_runtime_deploy | Insibling_clone_manifest.sh, theresolve_runtime_deployfunction always returns 0, even when no executable is found. It sets `DEPLOY_RUNTIM - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — Potential path traversal in resolve_runtime_deploy | Theresolve_runtime_deployfunction constructs paths usingOMNI_HOMEandOMNIBASE_INTERNAL_HOME. If these environment variables are set to ma - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — Missing test for resolve_runtime_deploy fallback | The newresolve_runtime_deployfunction has a fallback toonex-runtime-deployon PATH. There is no visible test in the diff that verifies this fa - [MINOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — Removed main call in handler_runtime_deploy.sh | The diff removesmain "$@"from the end ofhandler_runtime_deploy.sh. This implies the script is no longer intended to be executed directly, but ra
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 13
Nit-level findings suppressed: 1
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 13 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — resolve_repo_root ignores ONEX_DEPLOY_REPOSITORY_ROOT | The diff changesresolve_repo_root()to initializedirwith${ONEX_DEPLOY_REPOSITORY_ROOT:?...}instead of the script's own directory. How - [CRITICAL]
scripts/runtime_build/cut-lab-ref.sh, scripts/runtime_build/refresh_dev_lane.sh, scripts/runtime_build/refresh_stability_lane.sh(gpt-oss-review) — Undefined function resolve_runtime_deploy in refresh and cut scripts | The scriptsscripts/runtime_build/cut-lab-ref.sh,scripts/runtime_build/refresh_dev_lane.sh, and `scripts/runtime_build/refre - [MAJOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — SCRIPT_DIR_FOR_ENV derivation may break relative paths | The diff changesSCRIPT_DIR_FOR_ENVto use${ONEX_DEPLOY_REPOSITORY_ROOT:?...}/scripts. This assumes the script is always located in `<repo - [MAJOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — resolve_runtime_deploy trusts DEPLOY_RUNTIME without validation | The newresolve_runtime_deploy()function insibling_clone_manifest.shallows the operator to setDEPLOY_RUNTIMEto any path. If - [MAJOR]
scripts/runtime_build/cut-lab-ref.sh(qwen3-review) — cut-lab-ref.sh uses command -v instead of file existence check | The diff changes the check forDEPLOY_RUNTIMEfrom[[ ! -x "${DEPLOY_RUNTIME}" && ! -f "${DEPLOY_RUNTIME}" ]]to `! command -v "${D - [MAJOR]
scripts/runtime_build/refresh_dev_lane.sh(qwen3-review) — refresh_dev_lane.sh uses command -v instead of file existence check | Similar tocut-lab-ref.sh, the diff changes the check forDEPLOY_RUNTIMEto! command -v "${DEPLOY_RUNTIME}". This has the s - [MAJOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — Inconsistent naming: onex-runtime-deploy vs handler_runtime_deploy.sh | The diff renamesscripts/deploy-runtime.shtosrc/omnibase_infra/handlers/handler_runtime_deploy.shand refers to it as `one - [MAJOR]
.github/workflows/prod-promotion-lineage.yml(gpt-oss-review) — GitHub workflow still references old deploy script path in steps | Theprod-promotion-lineage.ymlworkflow updates thepathsfilter to reference `src/omnibase_infra/handlers/handler_runtime_deploy - [MAJOR]
.pre-commit-config.yaml(gpt-oss-review) — Shellcheck pre‑commit hook pattern excludes renamed deploy script | The.pre-commit-config.yamlupdates thefilesregex for the shellcheck hook to include `src/omnibase_infra/handlers/handler_runt - [MINOR]
tests/scripts/test_compose_generation_single_writer_omn17291.py(qwen3-review) — Tests use env={} which may break in CI environments | The diff addsenv={}tosubprocess.run()calls intest_compose_generation_single_writer_omn17291.py. This clears the environment, which may - [MINOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — Missing documentation for ONEX_DEPLOY_REPOSITORY_ROOT | The diff introducesONEX_DEPLOY_REPOSITORY_ROOTas a required environment variable for the deploy handler, but there is no documentation expla - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — resolve_runtime_deploy performs multiple filesystem checks | Theresolve_runtime_deploy()function checks multiple candidate paths for theonex-runtime-deploybinary. Each check involves a filesys - [MINOR]
config/governed_helper_baseline.json(gpt-oss-review) — Governed helper baseline JSON may still contain stale script references | Only two entries inconfig/governed_helper_baseline.jsonwere updated to the new handler path. Other entries (not shown) mig
onex-runtime-deploy is a console script of omnibase_internal, installed in that clone's .venv by the onex-internal-clone-sync timer and on no host's PATH, so the bare-name default made a lane refresh exit when #4656 landed. Adds resolve_runtime_deploy() to sibling_clone_manifest.sh, sourced by cut-lab-ref.sh, refresh_dev_lane.sh and refresh_stability_lane.sh. Order (the clone lookup omniclaude#2592 uses for onex-host-reconcile): DEPLOY_RUNTIME if set; else the omnibase_internal clone's .venv/bin/onex-runtime-deploy (OMNIBASE_INTERNAL_HOME, else the sibling of OMNI_HOME as written, then of its resolved target); else PATH. The refusal now lists every path tried. New tests/scripts/test_resolve_runtime_deploy_omn20687.py.
Update the cloud migration regression test and three pre-commit filters to follow src/omnibase_infra/handlers/handler_runtime_deploy.sh.
Add the temporary uv.lock with git add -f so host global ignore rules do not prevent the version collision regression tests from setting up.
a854b43 to
38dc468
Compare
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 4
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 12
Nit-level findings suppressed: 1
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 12 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — handler_runtime_deploy.sh main() entry point removed | The diff for src/omnibase_infra/handlers/handler_runtime_deploy.sh removes the final 'main "$@"' call and the preceding blank line. The file now - [CRITICAL]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) — Untrusted PATH search for onex-runtime-deploy | The new helperresolve_runtime_deploy(added inscripts/runtime_build/sibling_clone_manifest.sh) falls back to locatingonex-runtime-deployvia th - [MAJOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — SCRIPT_DIR_FOR_ENV now depends on ONEX_DEPLOY_REPOSITORY_ROOT | The line 'SCRIPT_DIR_FOR_ENV="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"' was replaced with 'SCRIPT_DIR_FOR_ENV="${ONEX_DEPLOY_REPOS - [MAJOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — resolve_repo_root uses ONEX_DEPLOY_REPOSITORY_ROOT instead of BASH_SOURCE | resolve_repo_root() previously walked up from the script's own directory to find pyproject.toml. It now starts from ONEX_DEP - [MAJOR]
scripts/runtime_build/refresh_dev_lane.sh, scripts/runtime_build/refresh_stability_lane.sh(qwen3-review) — refresh_dev_lane.sh and refresh_stability_lane.sh remove DEPLOY_RUNTIME default | Both scripts previously had 'DEPLOY_RUNTIME="${DEPLOY_RUNTIME:-${REPO_ROOT}/scripts/deploy-runtime.sh}"'. This line is - [MAJOR]
tests/ci/test_governed_helper_gate.py(gpt-oss-review) — Test suite still references removeddeploy-runtime.shpath | The incident replay filetests/incident_replays/registry.yamlhad the entry- scripts/deploy-runtime.shremoved, but other test files - [MINOR]
scripts/ci/detect_test_paths.py(qwen3-review) — detect_test_paths.py hardcodes a single file path instead of a prefix | The change adds 'or path == ("src/omnibase_infra/handlers/handler_runtime_deploy.sh")' to the condition that previously was 'if - [MINOR]
.onex_ratchets/canonical_file_shape_baseline.txt(qwen3-review) — canonical_file_shape_baseline.txt removes deploy-runtime.sh but no entry for new path | The baseline file removes 'scripts/deploy-runtime.sh' from its list. The new file 'src/omnibase_infra/handlers/h - [MINOR]
tests/scripts/test_compose_generation_single_writer_omn17291.py(qwen3-review) — test_compose_generation_single_writer adds env={} to git subprocess calls | Two subprocess.run calls for 'git ls-files' and 'git check-ignore' now pass 'env={}'. This strips the entire environment, in - [MINOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — Dual invocation model: shell script and Python console script | The handler file is a shell script that is also the target of a Python console-script entry point. The shell file no longer calls main() - [MINOR]
scripts/runtime_build/refresh_dev_lane.sh(qwen3-review) — refresh_dev_lane.sh comment references wrong path | A comment in refresh_dev_lane.sh was changed to 'DEV_LANE_ONLY_RUNTIME_SERVICES in scripts/onex-runtime-deploy' but the actual path is 'src/omnibase - [MINOR]
scripts/runtime_build/refresh_dev_lane.sh, scripts/runtime_build/refresh_stability_lane.sh(gpt-oss-review) — Repeated sourcing of lane lock script may cause redundant I/O |scripts/runtime_build/refresh_dev_lane.shandscripts/runtime_build/refresh_stability_lane.shboth sourcelane_lock.shwhich perfo
Findings demoted from threads (anchor rejected)
-
[MAJOR] hostile-reviewer (qwen3-review)
cut-lab-ref.sh exec no longer uses bash explicitly | The execute line changed from 'exec bash "${DEPLOY_RUNTIME}" --execute --force ...' to 'exec "${DEPLOY_RUNTIME}" --repository-root "${REPO_ROOT}" --execute --force ...'. If DEPLOY_RUNTIME resolves to a Python console script (as resolve_runtime_deploy suggests), this is fine. But if an operator sets DEPLOY_RUNTIME to a shell script that lacks a proper shebang or is not marked executable, 'exec' will fail with 'Permission denied' rather than 'command not fo
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (qwen3-review)
resolve_runtime_deploy trusts OMNIBASE_INTERNAL_HOME without validation | resolve_runtime_deploy uses OMNIBASE_INTERNAL_HOME to locate the omnibase_internal clone's .venv/bin/onex-runtime-deploy. If an attacker or a misconfigured environment sets OMNIBASE_INTERNAL_HOME to a directory containing a malicious executable at .venv/bin/onex-runtime-deploy, the refresh scripts will exec that binary with the operator's privileges. The function checks only that the file is executable (-x), not that it is a Python sc
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (gpt-oss-review)
Potential injection via unquoted variable expansions in DEPLOY_RUNTIME_TRIED |
DEPLOY_RUNTIME_TRIEDis built by concatenating unquoted path strings that may contain spaces or special characters. If such a path appears, later logging could be malformed, and error messages may be misleading, potentially aiding an attacker in probing the environment. | Evidence: Lines inscripts/runtime_build/sibling_clone_manifest.shsuch as `DEPLOY_RUNTIME_TRIED+="${DEPLOY_RUNTIME_TRIED:+ }${home}/.venv/bin/onex-runtime-Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (gpt-oss-review)
cut-lab-ref.shretains legacy default for DEPLOY_RUNTIME |scripts/runtime_build/cut-lab-ref.shstill initializesDEPLOY_RUNTIMEto${REPO_ROOT}/scripts/deploy-runtime.shbefore invokingresolve_runtime_deploy. If the resolver does not override the variable (e.g., when OMNI_HOME is unset and PATH does not contain a valid binary), the script will attempt to execute the old, now‑removeddeploy-runtime.sh, causing a runtime failure. | Evidence: Inscripts/runtime_build/cut-lab-ref.shthe line `DEResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492).
…s the baseline The move to handlers/handler_runtime_deploy.sh made the baselined bare mkdir lock a new key in config/governed_helper_baseline.json, which the ratchet refuses. The deploy lock now goes through acquire_lock_with_holder, which takes the directory atomically and records pid, host and started_at. The baseline entry is removed (21 to 20 occurrences) and the gate test count is updated.
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, gpt-oss-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 11
Nit-level findings suppressed: 1
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 11 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — resolve_repo_root ignores ONEX_DEPLOY_REPOSITORY_ROOT when walking up | The diff changesresolve_repo_root()to initializedirfrom${ONEX_DEPLOY_REPOSITORY_ROOT:?...}instead of `$(dirname "$0" - [MAJOR]
scripts/runtime_build/refresh_dev_lane.sh, scripts/runtime_build/refresh_stability_lane.sh(qwen3-review) — refresh_dev_lane.sh and refresh_stability_lane.sh may not pass --repository-root | The diff showsrefresh_dev_lane.shandrefresh_stability_lane.shremoving the hardcodedDEPLOY_RUNTIMEpath and - [MAJOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(qwen3-review) — acquire_lock_with_holder writes host and pid without atomicity guarantee | The newacquire_lock_with_holderfunction writespid,host, andstarted_atfiles into the lock directory after `mkdir - [MAJOR]
scripts/ci/detect_test_paths.py(qwen3-review) — detect_test_paths.py mapping for handler_runtime_deploy.sh is incomplete | The diff adds a mapping forsrc/omnibase_infra/handlers/handler_runtime_deploy.shindetect_test_paths.py. However, the c - [MAJOR]
scripts/runtime_build/sibling_clone_manifest.sh(gpt-oss-review) — Executable search path for onex-runtime-deploy is unpinned | The new resolve_runtime_deploy() function falls back to locating onex-runtime-deploy via the system PATH when neither an internal clone nor - [MAJOR]
src/omnibase_infra/handlers/handler_runtime_deploy.sh(gpt-oss-review) — Lane lock acquisition does not guarantee lock release on abnormal exit | The acquire_lock() function creates a lock directory and writes holder metadata, but there is no corresponding trap or finally‑ - [MAJOR]
scripts/runtime_build/refresh_dev_lane.sh, scripts/runtime_build/refresh_stability_lane.sh(gpt-oss-review) — Inconsistent migration of deploy-runtime.sh references leaves stale documentation | While most scripts and workflow files have been updated to reference onex-runtime-deploy, several comments and a few - [MINOR]
scripts/deploy-agent/tests/unit/test_dev_lane_cloud_migrations_omn18438.py, etc.(qwen3-review) — Test updates for DEPLOY_SCRIPT path are consistent but brittle | Multiple tests updateDEPLOY_SCRIPTto point tosrc/omnibase_infra/handlers/handler_runtime_deploy.sh. This is correct. However, th - [MINOR]
scripts/runtime_build/sibling_clone_manifest.sh(qwen3-review) — resolve_runtime_deploy resolution order is complex | Theresolve_runtime_deployfunction insibling_clone_manifest.shhas a complex resolution order: 1.DEPLOY_RUNTIMEenv var, 2. `OMNIBASE_INTE - [MINOR]
scripts/runtime_build/cut-lab-ref.sh, scripts/runtime_build/refresh_dev_lane.sh, scripts/runtime_build/refresh_stability_lane.sh(gpt-oss-review) — Repeated resolution of onex-runtime-deploy adds overhead | Multiple wrapper scripts (e.g., cut‑lab‑ref.sh, refresh_dev_lane.sh, refresh_stability_lane.sh) invoke resolve_runtime_deploy() on each execu - [MINOR]
tests/scripts/test_resolve_runtime_deploy_omn20687.py(gpt-oss-review) — New resolve_runtime_deploy() lacks comprehensive test coverage for failure modes | The added test suite (test_resolve_runtime_deploy_omn20687.py) covers successful resolution paths but does not exerci
1 participant
Lane refresh and lab-ref deployment now enter through the canonical operator command instead of invoking
scripts/deploy-runtime.sh. The old executable is deleted with no shim. Its native functions live in a private handler resource with explicit checkout binding and no standalone invocation; existing preflights, locks, rollback, migration fences, provenance and readback remain in place.Companion: https://github.com/OmniNode-ai/omnibase_internal/commit/d43e131eceeca100738b78067107bf00f4a12969 (head=d43e131eceeca100738b78067107bf00f4a12969). Per the operator-tooling placement architecture, the contract, declarative node, definition-B handler, typed models and
onex.nodesregistration live inomnibase_internal/nodes/. That operator package reuses infra's contract auto-wiring, dispatcher, bus and result publisher. Existing market redeploy nodes retain orchestration and signed-agent command ownership. Install the operator package on caller hosts before activating this caller cutover; the paired changes must land/install together.Repointed native regression coverage and caller command tests; CI selection, lineage workflow and shellcheck follow the new resource. The canonical-file and incident-replay debt baselines shrink. One existing governed-helper debt entry changes path only: its count, digest and removal ticket are unchanged. The deploy lock entry is removed: the lock now records its holder (pid, host, started_at) through acquire_lock_with_holder. Infra version is 0.38.68.
Validation: 777 focused infra tests passed without skips; subsequent Git-environment correction: six compose tests passed. Eight canonical node/parity tests passed; five cases were compared live against the legacy entry before deletion and retained as captured fixtures. Removing the definition-B handler makes
tests/unit/scriptsfail collection (exit 2). Pre-commit clean in both repos.Lab: host=h201 (omninode-pc); command=
python3 /home/jonah/lab-run/runs/rlane-cv-20687-0517-32fa05/lab-proof/run-proof.pyfrom the companion internal worktree; result=exit 0 through contract auto-wiring, MessageDispatchEngine, canonical in-memory command/terminal bus; head=a8992bde5aab1689f3cbc543ece7e00c68121dd9; companion_head=d43e131eceeca100738b78067107bf00f4a12969. In-process because the checkout, operator environment, host locks and Docker daemon belong to the effect host. No live deployment/restart was performed.First tool only, OMN-20687. Remaining ordered slices are recorded at https://linear.app/omninode/issue/OMN-20687#comment-947db8dd. Protected concurrent-lane scripts are unchanged.
Evidence-Ticket: OMN-20687
Evidence-Source: OCC#13221
Commit d6e5a53 adds resolve_runtime_deploy() to scripts/runtime_build/sibling_clone_manifest.sh, which cut-lab-ref.sh, refresh_dev_lane.sh, and refresh_stability_lane.sh now call instead of defaulting DEPLOY_RUNTIME to the bare name. This change is required because onex-runtime-deploy is not on PATH or in the dispatch venv on h201, h202, or h101, and exists only in the omnibase_internal clone's .venv/bin, meaning a lane refresh would exit 64 without this resolution logic. The lookup order matches omniclaude#2592, checking DEPLOY_RUNTIME, then the omnibase_internal clone's .venv/bin/onex-runtime-deploy (via OMNIBASE_INTERNAL_HOME or siblings of OMNI_HOME), and finally PATH, with tests confirming 11 passed in test_resolve_runtime_deploy_omn20687.py and 27 total when including test_cut_lab_ref.py and test_sibling_clone_manifest_parity.py. The refusal lists every path looked in.
Lab: host=h201 (omninode-pc); command=
OMNI_HOME=/home/jonah/Code/omni_home bash scripts/runtime_build/cut-lab-ref.sh --ref origin/dev --lane dev(plan mode, no --execute, no redeploy, no --cold); result=exit 0, the plan names/data/omninode/omnibase_internal/.venv/bin/onex-runtime-deployafter passing over the stale/home/jonah/Code/omnibase_internal/.venv/bin/onex-runtime-deploy;refresh_dev_lane.sh --ref origin/devin plan mode passed its onex-runtime-deploy check on the same host; head=d6e5a532b82e429031b19fccc6e75e56a68a5822.Lab pool readback (OMN-18893)
Lab pool readback (OMN-18893)
Live-contact exception: The live contact consists of the lab readback in this body, specifically the cut-lab-ref.sh plan mode on h201 and the lab pool proof on lab-202 for earlier heads, plus a local readback at head fb1bf41 that acquire_lock_with_holder takes the lock once and refuses the second taker on host omnipc2.