Repository navigation
ci(OMN-20074): S6 part 2, omnibase_infra deletes its OCC callers - #4792
Conversation
Adds tests/ci/test_no_occ_callers_omn20074.py with 7 tests that parse every workflow under .github/workflows and the CI Summary gate. The tests fail while any workflow calls an OCC reusable workflow (occ-preflight.yml, call-occ-autobind-reusable.yml, call-occ-companion-effect-reusable.yml), while receipt-gate.yml is called outside caller mode, while the skip-token reusable pin is not 4358450ccbba0cee11e390208dd0b8b1728e94ab (omniclaude#2540), while any job needs or conditions on occ-preflight, while the companion gate or heal workflows exist, and while CI Summary or .github/required-checks.yaml expects an OCC companion context. At dev 1d716d2 all 7 fail; the run is `uv run pytest tests/ci/test_no_occ_callers_omn20074.py -q -k no_occ_callers`. This is the failing test commit for S6 part 2 of the OCC retirement (epic OMN-20068); the change that makes them pass follows in the same pull request.
S6 part 2 of the OCC retirement (epic OMN-20068) for omnibase_infra deletes the OCC callers. S6 part 1 (omnibase_infra#4732) already set compare-with-occ to "false" in call-repo-evidence-gate.yml, so that input is unchanged here. Deleted five workflows: call-occ-autobind.yml, call-occ-companion-effect.yml, occ-companion-merge-heal.yml, occ-preflight-heal.yml, call-receipt-gate.yml. ci.yml: removed the occ-preflight job (a call to omnibase_core occ-preflight.yml), the occ-born-path-trigger-coverage job and the occ-companion-merged job (OCC Companion Merged Gate, OMN-15214). Removed all 43 needs edges on occ-preflight and the 9 job conditions that read needs.occ-preflight.result. hostile-reviewer.yml: removed its occ-preflight job and its needs edges; its pull_request types no longer include edited, because no job there reads the PR title or body. call-reject-skip.yml: re-pinned the omniclaude reject-deploy-gate-skip.yml reusable from 2173a846258c05b77858c454176f22ff1e41a3aa to 4358450ccbba0cee11e390208dd0b8b1728e94ab (omniclaude#2540), which has no nested occ-preflight job. scripts/ci/ci_summary_gate.py: STRICT_GATE_JOBS no longer holds occ-preflight / eligibility or the OCC Companion Merged Gate; EXPECTED_EXTERNAL_CONTEXTS no longer holds verify / verify; the two OCC entries of MEASURED_NOT_ENFORCED_CONTEXTS and the five occ-* entries of EXTERNAL_SWEEP_EXCLUSIONS are gone; the OMN-19167 conditional sweep arm (which existed only for occ-autobind and occ-companion-effect) and the --pr-title, --pr-head-ref and --event-actor arguments are gone. .github/required-checks.yaml drops the verify / verify row; config/runner_routing_policy.yaml drops three retired contexts. Deleted four scripts that only the deleted workflows and jobs ran: check_occ_companion_merged.py, occ_preflight_heal.py, occ_companion_merge_heal.py, occ_manual_replay_precheck.py. Deleted ten test files that read only deleted files, and edited eighteen others to assert the OCC names are absent. contracts/OMN-20074.yaml gains AC3 and the evidence item dod-no-occ-callers-ac3, bound to tests/ci/test_no_occ_callers_omn20074.py. The 7 tests in tests/ci/test_no_occ_callers_omn20074.py failed at dev 1d716d2 (7 of 7) and pass here (7 passed). 46 files changed, 286 insertions, 8514 deletions. No ruleset or branch protection is changed by this commit.
The test_contract_sync_gate_carries_no_event_gate test previously raised a KeyError when reading jobs["contract-sync-gate"]["if"] because the preceding commit removed the job's only condition, needs.occ-preflight.result == 'success'. The test now reads the condition with job.get("if", ""), allowing jobs without an 'if:' to pass the "no event gate" assertion while jobs gated on github.event_name still fail it. This failure was found on lab host h101 at sha 0bfcb84 in a run of tests/ci, tests/unit/scripts, tests/scripts, tests/unit/docker and tests/integration/ci, and was absent at the dev baseline run on the same host. After the change, 41 tests pass locally across that file and tests/unit/scripts/test_heavy_lock.py.
…s6-part2-occ-callers # Conflicts: # .github/required-checks.yaml # contracts/OMN-20074.yaml
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, local-studio-planner
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 15
Nit-level findings suppressed: 0
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 15 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
tests/ci/test_ci_summary_gate.py(qwen3-review) — Test asserts 'occ-preflight' not in needs_list but zone-filter jobs still have it | The testtest_tier_jobs_are_zone_filter_gated_in_ci_ymlintests/ci/test_ci_summary_gate.pywas modified to asse - [CRITICAL]
.github/workflows/call-receipt-gate.yml(local-studio-planner) — Removal of Receipt Gate enforcement leaves evidence unverified | The PR removes thecall-receipt-gate.ymlworkflow and its registration in.github/required-checks.yaml. This gate enforced 'Enforce - [CRITICAL]
scripts/ci/check_occ_companion_merged.py(local-studio-planner) — Removal of OCC Companion Merged Gate allows unverified evidence merges | The PR removesscripts/ci/check_occ_companion_merged.pyand its registration inSTRICT_GATE_JOBS. This gate prevented the m - [MAJOR]
.github/required-checks.yaml(qwen3-review) — Removed OCC preflight may leave stale check-runs blocking merges | The PR removesocc-preflightfromci.ymlandhostile-reviewer.yml, and removesocc-preflight / eligibilityfrom `STRICT_GATE_ - [MAJOR]
.github/workflows/call-reject-skip.yml(qwen3-review) — SHA pin bump in call-reject-skip.yml without diff review | Theuses:reference incall-reject-skip.ymlwas bumped from2173a846258c05b77858c454176f22ff1e41a3aato `4358450ccbba0cee11e390208dd0b8 - [MAJOR]
tests/ci/test_no_occ_callers_omn20074.py(qwen3-review) — New test test_no_occ_callers_omn20074.py is not shown in diff | The contractOMN-20074.yamlreferencestests/ci/test_no_occ_callers_omn20074.pyas the falsifier for AC4, and the file is listed as - [MAJOR]
.github/workflows/hostile-reviewer.yml(qwen3-review) — hostile-reviewer.yml gate job may not fail on skipped hostile-review | Thehostile-review-gatejob inhostile-reviewer.ymlnow hasneeds: hostile-review(a single string, not a list). The gate s - [MAJOR]
.github/workflows/occ-preflight-heal.yml(local-studio-planner) — Removal of self-heal workflows introduces manual merge friction | The PR removesocc-preflight-heal.ymlandocc-companion-merge-heal.yml. These workflows automatically re-ran failed CI jobs when e - [MAJOR]
scripts/ci/ci_summary_gate.py(local-studio-planner) — CI Summary gate registry inconsistent with workflow changes | The PR updatesscripts/ci/ci_summary_gate.pyto remove references to OCC-related gates (occ-preflight / eligibility, `OCC Companion Me - [MAJOR]
tests/ci/test_check_occ_companion_merged.py(local-studio-planner) — Removal of comprehensive test suites for OCC logic | The PR removes multiple test files (test_check_occ_companion_merged.py,test_occ_companion_merge_heal_omn18812.py, `test_occ_preflight_heal_omn - [MINOR]
scripts/ci/pr_trailers.py(qwen3-review) — pr_trailers.py docstring updated but consumer reference may be stale | The docstring inpr_trailers.pywas updated to remove the reference tocheck_occ_companion_merged.pyas a consumer, stating t - [MINOR]
tests/ci/test_edited_trigger_scope_omn16171.py(qwen3-review) — test_edited_trigger_scope_omn16171.py removes hostile-reviewer.yml from MUST_NOT_LIST_EDITED | The testtest_edited_trigger_scope_omn16171.pymovedhostile-reviewer.ymlfromMUST_NOT_LIST_EDITED - [MINOR]
tests/ci/test_incident_replay_omn17427.py(qwen3-review) — test_incident_replay_omn17427.py filters check_runs to only cancelled rows | The testtest_incident_replay_omn17427.pywas modified to use_captured_cancellations()which filters the loaded check- - [MINOR]
.github/workflows/ci.yml(local-studio-planner) — CI matrix re-runs on PR body edits may increase runner load | The PR removes theeditedtrigger fromci.ymland related workflows, relying on separate heal workflows instead. If these heal workflo - [MINOR]
.github/workflows/call-occ-autobind.yml(local-studio-planner) — Documentation gaps in removed workflow rationale | The PR removes workflows with extensive inline documentation explaining their design, failure modes, and incident history. This knowledge is lost unl
✅ Hostile Reviewer — REVIEWEDCritical findings: 3
Semantics (OMN-17492 — the model finds, thread resolution gates)
Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review (Qwen3.8-27B), local-studio-planner (Qwen3.6-35B-A3B) (OMN-8468/OMN-8524/OMN-17492) |
…tifacts On omnibase_infra#4792 the ci.yml job contract-compliance (name Contract Compliance Check) failed with "Contract Compliance evidence resolution failed: PR body is missing required 'Evidence-Source:' line". The job resolved the PR body's Evidence-Source line to an OCC companion commit, checked out onex_change_control at that commit and ran the DoD check against OCC's contracts. With the OCC autobind deleted no pull request carries that line, so no pull request could pass it. This commit deletes that job, the deferred test_passes step of the ci-summary job that judged its record (the ci-summary timeout-minutes goes from 145 back to 100), and the artifact contract-compliance-deferred in config/ci_evidence_policy.yaml. Repo-owned evidence (repo-evidence / dod-verify, contracts/OMN-*.yaml in this repository) replaces it. Deleted six scripts: scripts/ci/run_contract_compliance_with_evidence.py, defer_test_passes_driver.py, resolve_contract_compliance_pr.py, resolve_contract_compliance_evidence.py, classify_contract_compliance_scope.py, deferred_test_passes_gate.py; their six entries leave .onex_ratchets/canonical_file_shape_baseline.txt. Deleted eight test files that read only those files and three incident-replay registry cases; removed Contract Compliance Check from the gate lists in scripts/ci/ci_summary_gate.py together with the PullRequestContext helpers that only that job used (83 lines removed). Test first: test_no_occ_callers_ci_resolves_no_evidence_source in tests/ci/test_no_occ_callers_omn20074.py failed before this change (1 failed, 7 passed) and all 8 tests in that file pass after it.
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, local-studio-planner
Models failed: none
New finding threads: 6
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 1
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 9 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
.github/required-checks.yaml(qwen3-review) — Removal of 'verify / verify' required check without branch-protection update | The diff removes the 'verify / verify' entry from .github/required-checks.yaml and the call-receipt-gate.yml workflow, bu - [CRITICAL]
.github/workflows/call-receipt-gate.yml(local-studio-planner) — Removal of Receipt Gate enforcement | The pull request removes thecall-receipt-gate.ymlworkflow and its registration in.github/required-checks.yaml. This gate enforced 'Enforcement by Receipt', - [CRITICAL]
scripts/ci/check_occ_companion_merged.py(local-studio-planner) — Removal of OCC Companion Merged Gate | Thecheck_occ_companion_merged.pyscript and its associated workflow/job are removed. This gate ensured that onex_change_control evidence companions were merge - [MAJOR]
scripts/ci/check_occ_companion_merged.py(qwen3-review) — Removal of OCC companion-merged gate eliminates the merge-ordering invariant | The diff removes check_occ_companion_merged.py and its registration in ci_summary_gate.py. This gate enforced that a prod - [MAJOR]
tests/ci/test_no_occ_callers_omn20074.py(qwen3-review) — New test test_no_occ_callers_omn20074.py is added but its coverage of the removal is unverified | The diff adds tests/ci/test_no_occ_callers_omn20074.py (+177 lines) as the falsifier for AC4. However, - [MAJOR]
.github/workflows/ci.yml(local-studio-planner) — Removal of OCC Preflight dependency | Theci.ymlworkflow no longer calls theocc-preflightreusable workflow, and jobs likezone-filter,lint, andeffect-assertion-gateno longer depend on - [MAJOR]
tests/ci/(local-studio-planner) — Removal of comprehensive test suites for OCC logic | The PR removes multiple test files (test_check_occ_companion_merged.py,test_deferred_test_passes_gate.py, etc.) that covered the now-removed O - [MINOR]
.github/workflows/hostile-reviewer.yml(qwen3-review) — Removal of 'edited' trigger from hostile-reviewer.yml may leave stale check-runs | The diff removes 'edited' from the pull_request trigger types in hostile-reviewer.yml, with the comment 'no job here - [MINOR]
config/(local-studio-planner) — Orphaned Configuration References | Theconfig/runner_routing_policy.yamlandconfig/ci_evidence_policy.yamlfiles have been updated to remove OCC-related entries. Ensure that no other configurati
Findings demoted from threads (anchor rejected)
-
[MAJOR] hostile-reviewer (qwen3-review)
OCC preflight removal shifts admission to repo-evidence only, but repo-evidence is a pull_request_target trigger | The diff removes occ-preflight from ci.yml and hostile-reviewer.yml, and removes OCC companion gates from ci_summary_gate.py. The contract OMN-20074 states that 'pull-request admission needs repo-owned evidence only.' However, the repo-evidence caller (call-repo-evidence-gate.yml) uses a pull_request_target trigger, which means it runs on the base branch, not the PR head. This is a deliberate e
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (qwen3-review)
ci_summary_gate.py removes 'Contract Compliance Check' from GATE_JOBS but the job may still exist in ci.yml | The diff removes 'Contract Compliance Check' from the GATE_JOBS tuple in ci_summary_gate.py. However, the diff excerpt for ci.yml is truncated and does not show whether the 'contract-compliance' job was also removed from ci.yml. If the job still exists in ci.yml but is no longer registered in GATE_JOBS, CI Summary will not judge its verdict, creating a silent gap where a failing contract-compliance
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (local-studio-planner)
Incomplete removal of OCC references in CI Summary | While many OCC-related jobs and contexts are removed from
ci_summary_gate.py, the file still contains comments and logic that may reference OCC states or expectations. Specifically, the removal ofverify / verify(Receipt Gate) andOCC Companion Merged Gatemust be fully reflected in all assertion logic to avoid false positives or negatives in CI Summary verdicts. | Evidence: scripts/ci/ci_summary_gate.py (modified, removed 'verify / verify' from EXResolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MAJOR] hostile-reviewer (local-studio-planner)
Disruption of Evidence Chain Integrity | The PR removes the mechanisms that enforced the link between product PRs and onex_change_control evidence companions (OCC). This breaks the 'Enforcement by Receipt' model, potentially allowing merges without proper evidence linkage. The new architecture must explicitly define how evidence integrity is maintained without these gates. | Evidence: contracts/OMN-20074.yaml (modified, summary updated to reflect OCC removal) | Fix: Document the new evidence chain model and
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MINOR] hostile-reviewer (qwen3-review)
Removal of occ-preflight from ci.yml reduces the dependency chain but may increase runner usage | The diff removes the occ-preflight job from ci.yml and removes 'needs: occ-preflight' from multiple downstream jobs (zone-filter, docs-only-marker, lint, effect-assertion-gate). This reduces the dependency chain and allows jobs to start earlier. However, the occ-preflight job was a gate that prevented heavy jobs from running when OCC evidence was missing. Without it, heavy jobs may run on PRs that would have be
Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492). -
[MINOR] hostile-reviewer (local-studio-planner)
Reduced CI Workflow Complexity | The removal of the
occ-preflightjob and related dependencies reduces the number of jobs in the CI matrix. This is a performance improvement but must be balanced against the security implications noted above. | Evidence: .github/workflows/ci.yml (modified, removedocc-preflightjob) | Fix: Monitor CI execution times to confirm the expected reduction and ensure no critical checks were inadvertently skipped.Resolve this thread when addressed — the
Hostile Review Thread Gateblocks while hostile-reviewer threads are unresolved (OMN-17492).
|
Lab: head=eb8463e56fa382ec744ce3b3966a66b89c112422 |
Merge origin/dev at 3a19875 into the OMN-20074 branch. Pull the pinned boundary broker from Redpanda's registry and use disposable local scratch images for deploy-agent metadata checks. Keep unit-test host identity, manifests, and lane locks separate from lab host state.
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, local-studio-planner
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 15
Nit-level findings suppressed: 1
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 15 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
.github/workflows/ci.yml(local-studio-planner) — Removal of OCC preflight creates unverified merge path | The PR removes theocc-preflightjob fromci.ymland all dependent workflows. This job previously validated that an onex_change_control com - [CRITICAL]
.github/required-checks.yaml(local-studio-planner) — Removal of Receipt Gate bypasses enforcement by receipt | The PR removes thecall-receipt-gate.ymlworkflow and its reference inrequired-checks.yaml. This gate enforced 'Enforcement by Receipt', - [MAJOR]
contracts/OMN-20074.yaml(qwen3-review) — Missing test for new AC4 requirement | The contract OMN-20074.yaml adds a new requirementreq-no-occ-callers-s6-part2with acceptance criterion AC4 and a DoD evidence itemdod-no-occ-callers-ac4t - [MAJOR]
.github/workflows/call-receipt-gate.yml(qwen3-review) — Removal of receipt-gate caller without replacement | The PR removescall-receipt-gate.ymland theverify / verifyentry fromrequired-checks.yamlandEXPECTED_EXTERNAL_CONTEXTS. The receipt-ga - [MAJOR]
.github/workflows/ci.yml(qwen3-review) — ci.yml: zone-filter no longer gated on occ-preflight, but downstream jobs may assume preflight ran | In ci.yml,zone-filterpreviously hadneeds: occ-preflight. This dependency is removed. However - [MAJOR]
scripts/ci/ci_summary_gate.py(local-studio-planner) — CI Summary gate configuration inconsistency | Theci_summary_gate.pyscript is modified to remove references to OCC-related gates (occ-preflight / eligibility,OCC Companion Merged Gate, `Contra - [MAJOR]
tests/ci/(local-studio-planner) — Removal of comprehensive test suites for removed scripts | The PR removes numerous scripts and their corresponding test files. While the removal is part of a larger refactor, the sheer volume of remov - [MAJOR]
.github/workflows/(local-studio-planner) — Loss of self-healing capability for stale preflight verdicts | Theocc-preflight-heal.ymlandocc-companion-merge-heal.ymlworkflows are removed. These workflows automatically re-ran failed prefli - [MINOR]
.github/workflows/call-reject-skip.yml(qwen3-review) — call-reject-skip.yml: SHA pin bump without documented rationale | Theuses:reference in call-reject-skip.yml is bumped from2173a846258c05b77858c454176f22ff1e41a3aato `4358450ccbba0cee11e390208d - [MINOR]
scripts/ci/pr_trailers.py(qwen3-review) — pr_trailers.py: docstring updated but only one consumer remains | The docstring in pr_trailers.py is updated to reflect that only one CI gate now reads trailers (the ref resolver), since check_occ_com - [MINOR]
tests/ci/test_no_occ_callers_omn20074.py(qwen3-review) — Removed test files not replaced by equivalent coverage | The PR removes 15 test files, including test_check_occ_companion_merged.py (937 lines), test_deferred_test_passes_gate.py (835 lines), test_occ - [MINOR]
config/ci_evidence_policy.yaml(qwen3-review) — config/ci_evidence_policy.yaml: removed contract-compliance-deferred artifact without updating CI Summary | The PR removes thecontract-compliance-deferredevidence artifact from config/ci_evidence_ - [MINOR]
.github/workflows/hostile-reviewer.yml(qwen3-review) — hostile-reviewer.yml: removal of occ-preflight dependency changes gate semantics | In hostile-reviewer.yml, thehostile-reviewjob previously hadneeds: occ-preflightand thehostile-review-gate - [MINOR]
config/runner_routing_policy.yaml(qwen3-review) — runner_routing_policy.yaml: removed OCC gate names without verifying no other references | The PR removesOCC Companion Merged Gate (OMN-15214),occ-preflight / eligibility, andverify / verify - [MINOR]
.github/required-checks.yaml(local-studio-planner) — Inconsistent rationale updates in required-checks.yaml | Therequired-checks.yamlfile has updated rationales for some gates but the removal of others leaves gaps in documentation. The rationale for
Generalize the excluded-host comment in the deploy-agent unit fixture. Public Repo Hygiene flagged its private host identifier on added line 101.
There was a problem hiding this comment.
Hostile Reviewer — adversarial findings (OMN-17492)
Models succeeded: qwen3-review, local-studio-planner
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 11
Nit-level findings suppressed: 0
The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.
Below quorum: 11 finding(s) raised by one model only (OMN-18479)
These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.
- [CRITICAL]
.github/required-checks.yaml(qwen3-review) — Removal of receipt-gate caller without branch protection update | The PR removes .github/workflows/call-receipt-gate.yml and the corresponding 'verify / verify' entry from .github/required-checks.yaml - [CRITICAL]
.github/workflows/call-receipt-gate.yml(local-studio-planner) — Removal of Receipt Gate enforcement eliminates merge protection | The diff removes thecall-receipt-gate.ymlworkflow and its registration in.github/required-checks.yaml. The Receipt Gate enforce - [CRITICAL]
scripts/ci/check_occ_companion_merged.py(local-studio-planner) — Removal of OCC Companion Merged Gate allows unverified evidence merge | The diff removesscripts/ci/check_occ_companion_merged.pyand its registration inSTRICT_GATE_JOBS. This gate ensures that t - [MAJOR]
contracts/OMN-20074.yaml(qwen3-review) — Missing test for new no-occ-callers requirement | The contract OMN-20074.yaml adds a new requirement 'req-no-occ-callers-s6-part2' with acceptance criteria AC4 that mandates a test 'tests/ci/test_no_o - [MAJOR]
scripts/ci/ci_summary_gate.py(local-studio-planner) — Incomplete OCC retirement leaves CI Summary in inconsistent state | The diff removes OCC callers from workflows and scripts but fails to updateci_summary_gate.py'sEXPECTED_EXTERNAL_CONTEXTSor ` - [MAJOR]
.github/workflows/occ-preflight-heal.yml(local-studio-planner) — Removal of preflight heal workflows breaks self-healing for stale OCC verdicts | The diff removesocc-preflight-heal.ymlandocc-companion-merge-heal.yml. These workflows are critical for automati - [MAJOR]
tests/ci/test_check_occ_companion_merged.py(local-studio-planner) — Removal of test suites for removed scripts creates coverage gap | The diff removes numerous scripts (e.g.,check_occ_companion_merged.py,deferred_test_passes_gate.py) and their corresponding test - [MINOR]
.github/workflows/call-reject-skip.yml(qwen3-review) — Pin bump for reject-deploy-gate-skip without diff review | The PR updates the pin for 'reject-deploy-gate-skip.yml' from SHA 2173a84... to 4358450.... While both are full SHAs, the diff does not show - [MINOR]
scripts/ci/ci_summary_gate.py(qwen3-review) — Potential stale references in ci_summary_gate.py comments | The diff modifies ci_summary_gate.py to remove OCC-related gates. However, the comment block around line 400 still references 'OCC Companion - [MINOR]
tests/ci/test_ci_summary_gate.py(qwen3-review) — Removed tests for deleted scripts lack replacement coverage | Several test files are removed (e.g., test_occ_companion_merge_heal_omn18812.py, test_deferred_test_passes_gate.py) corresponding to the d - [MINOR]
.github/workflows/call-repo-evidence-gate.yml(local-studio-planner) — Inconsistent removal of OCC references in comments and config | The diff removes OCC workflows but leaves some references to OCC in comments and configuration files that may be misleading or outdated.
Merges origin/dev (0be783b) into PR #4782 branch bot/bump-omnibase-core-pin-2f90bd814b14 at head 1e7e9ba. The head was based on 1d716d2. Dev has since merged #4792 (OMN-20074 S6 part 2), which deleted .github/workflows/occ-preflight-heal.yml and scripts/ci/occ_preflight_heal.py. The check "Heal stale occ-preflight" failed at the head because it checked out dev and found scripts/ci/occ_preflight_heal.py absent. The merge was clean; the net diff against dev stays only .github/workflows/check-handshake.yml (the omnibase_core pin bump). scripts/check_release_identity.py --base origin/dev exits 0.
Lab: lab pool host (its identity lives in the private deployment overlay), command
onex_lab_run --via ssh --ref jonah/omn-20074-infra-s6-part2-occ-callers -- uv run pytest tests/ci tests/unit/scripts tests/scripts tests/unit/docker tests/integration/ci tests/unit/ci tests/test_compose_profile_teardown_policy.py tests/test_git_env_isolation_omn18434.py -q -n auto --no-covat sha bd1031f, observed 12953 passed, 49 failed, 31 errors, 46 skipped, 10 xfailed, exit 1. The same 49 failed and 31 errors, with identical test ids, fail at dev a9d3c4a on the same host, so this change adds no failure. This change touches workflows, one CI gate script and tests and no runtime path, so no runtime deploy applies. The lab runner's bus transport returned exit 69 (no host advertised), so the runs used--via ssh.What this does
S6 part 2 of the OCC retirement (ticket OMN-20074, epic OMN-20068) for omnibase_infra: it deletes the repository's OCC callers. Pull-request admission here now needs the repo-owned evidence verdict (
repo-evidence / dod-verify) and no change-control companion.Premises checked at the start of the lane:
Inventory at dev 1d716d2, and what this PR does with each
occ-preflight, line 201 calls omnibase_core occ-preflight.yml@52851458622f368c3b596c82bf810bc6acce1d5eneedsedges onocc-preflight(lines 218, 252, 307, 788, 853, 1067, 1089, 1122, 1172, 1216, 1263, 1325, 1371, 1450, 1495, 1628, 1681, 1779, 1839, 1914, 2056, 2092, 2125, 2162, 2313, 2361, 2420, 2565, 2785, 2870, 3078, 3126, 3170, 3455, 3687, 4157, 5022, 5467, 5507, 5607, 5999, 6250, 6614)needs.occ-preflight.result(lines 2389, 2583, 3079, 3180, 3458, 3692, 5608, 6000, 6251)occ-born-path-trigger-coverageocc-companion-merged(OCC Companion Merged Gate (OMN-15214))occ-preflight, line 91 calls omnibase_core occ-preflight.yml@52851458622f368c3b596c82bf810bc6acce1d5e; needs at lines 101 and 623; result read at line 643editedtrigger type is dropped because no job there reads the PR title or bodyverify / verify)occ-preflightcalls omnibase_core occ-preflight.ymlocc-preflight / eligibility) and :151 (OCC Companion Merged Gate (OMN-15214)) in STRICT_GATE_JOBS; :542 (verify / verify) in EXPECTED_EXTERNAL_CONTEXTS; :980 and :991 in MEASURED_NOT_ENFORCED_CONTEXTS; :1305, :1319, :1332, :1384, :1397 in EXTERNAL_SWEEP_EXCLUSIONS; :1445-1717 the OMN-19167 conditional arm (CONDITIONAL_SWEEP_EXCLUSIONS, line 1659, exists only forocc-autobindandocc-companion-effect) and the --pr-title, --pr-head-ref and --event-actor argumentsverify / verifyOR.1 inventory check (knowledge-base-internal beta/tracking/omn-20069-occ-operational-scan-2026-09-29.tsv, 436 rows for omnibase_infra, 23 with disposition retain_until_OR5_per_consumer_cutover): ci.yml, hostile-reviewer.yml, call-receipt-gate.yml, scripts/ci/ci_summary_gate.py and scripts/ci/occ_companion_merge_heal.py are rows of that disposition and are handled above. call-occ-autobind.yml, call-occ-companion-effect.yml, occ-companion-merge-heal.yml and occ-preflight-heal.yml are rows under retain_pending_source_owner_review and are handled above. Differences between the OR.1 rows and live dev: call-reject-skip.yml has no OR.1 row because its preflight is nested in the pinned omniclaude reusable; call-repo-evidence-gate.yml did not exist at OR.1.
Test first
tests/ci/test_no_occ_callers_omn20074.py has 7 tests that parse every workflow, the CI Summary gate and the required-checks manifest. At dev 1d716d2 (commit 3e4b352) all 7 fail; on this branch all 7 pass. The command is
uv run pytest tests/ci/test_no_occ_callers_omn20074.py -q -k no_occ_callers. There is no skip list and no allowlist; the test names OCC reusables by the file-name ruleocc-*.ymlandcall-occ-*.yml, requires receipt-gate.yml to run only withevidence-source: caller, and requires the skip-token reusable pin 4358450ccbba0cee11e390208dd0b8b1728e94ab. contracts/OMN-20074.yaml gains AC4 and the evidence item dod-no-occ-callers-ac4 bound to it.Scratch pull request proof
Three draft scratch pull requests against dev, closed unmerged. Dev's call-repo-evidence-gate.yml runs on
pull_request_target, so each ran on dev's definition (compare-with-occ "false"). Each concludedrepo-evidence / dod-verifyas failure:The first head of omnibase_infra#4791 (113fda9, check run 113999706131) changed no test file and was refused with the stale-evidence message; the head above adds a docstring-only edit to the bound test, which makes it an always-pass control.
Positive control:
repo-evidence / dod-verifyconcluded success on the merged dev heads of #4767, #4765 and #4758 (check runs 113813114010, 113802506448, 113731199381), as recorded in the comment above "repo-evidence / dod-verify" in scripts/ci/ci_summary_gate.py. The scratch heads were read by exact head sha.Ruleset: before and after for omnibase_infra dev
Before (required_status_checks):
CI Summary(app 15368). Rulesets: 13269702 (merge queue, active) and 21865235 (main). Source: lane occ-drive-5d21, ledger STATUS 2026-10-09T14:37:01Z; the OR.1 live-contexts record of 2026-09-29 (knowledge-base-internal beta/tracking/omn-20069-live-occ-required-contexts-2026-09-29.tsv) lists no omnibase_infra row.After:
CI Summary(app 15368), unchanged. Rulesets 13269702 and 21865235 unchanged.No context is added or removed, because none of the OCC contexts this PR removes (
occ-preflight / eligibility,call-reject-skip-token / occ-preflight / eligibility,verify / verify,OCC Companion Merged Gate (OMN-15214),occ-companion-effect / Publish occ-companion-effect command) is a protection context; they were enforced inside CI Summary, which this PR edits. This lane read no GitHub branch-protection state. The orchestrator reads dev and main protection live before the merge. In-repo statements disagree with the ledger record: the header of .github/required-checks.yaml names 17 dev contexts and 5 main contexts (includingverify / verify) verified 2026-07-20. The ruleset change, if the live read shows any of the removed contexts, waits for the orchestrator.Not in this PR
occentry point in pyproject.toml (S9, scripts and source modules).occ-preflightas a historical root-cause class; no workflow produces it any more.Where deployment values live
This PR adds no host, lane, role, watched branch, endpoint or routing order to shipped code. The lab host that ran the tests and the lane names are recorded in the private deployment overlay, the lab-run record under
.onex_state/lab-run/runs.jsonland the rolling work ledger.