[jonahgabriel]

What moved and why

Moved 80 ticket contracts into contracts/ from the change-control repository at source commit 49cfc14c21a2c50f9964c1aeed4b66001ce279a3. The scheduled closer's contract resolver reads contracts/<id>.yaml from this repository's default branch.

Count and source

The manifest had 84 ids; 1 was skipped and 3 removed, for a net of 80 moved.

Format rule

The only edit is yamlfmt output (pre-commit yamlfmt hook at pinned rev v0.17.2); the second run exited 0.

Equality proof

For all moved ids, yaml.safe_load of the change-control blob equals yaml.safe_load of the file, and ticket_id equals the id:. Before removals: 83 equal, 0 bad; the 80 kept are a subset.

Test runs

• New test tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py was red at origin/dev contracts: 83 failed, 1 passed (run with the 83-id tuple before the removals).
• Green at head after removals: 81 passed (80 id cases plus the count test); with the four existing contract tests, 97 passed.

Hooks and tests

hook-preflight over the 82 staged files: ok (round 1). Tests run: test_contract_binds_ac_labels_omn20074, test_contract_validation_core_validator_omn20074, test_contract_dod_evidence_id_length_omn17427, test_contract_validation_pinned_validator_omn14186, and the new test: 97 passed.

Removed ids

• OMN-15730 — private-repo-name (line 59)
• OMN-16265 — lab-config (line 34)
• OMN-17474 — private-repo-name (lines 96, 100, 102, 106)

The public-repo-hygiene hook refuses them on added lines. 1 skipped: contracts/OMN-17991.yaml already exists on dev.

contracts/OMN-20074.yaml gains requirement req-moved-contracts-cr0220, acceptance AC15, one evidence_requirements entry, and dod_evidence dod-moved-contracts-cr0220.

Closes OMN-20074

[jonahgabriel]

Lab: host=h201 lane=cr0220-obinf head=55e757c799409c26bb24107770794a8fa21b18b6 command=uv run pytest tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py tests/ci/test_contract_binds_ac_labels_omn20074.py tests/ci/test_contract_validation_core_validator_omn20074.py tests/ci/test_contract_dod_evidence_id_length_omn17427.py tests/ci/test_contract_validation_pinned_validator_omn14186.py -q observed=97 passed; hook-preflight ok over 82 files.

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: correctness, sonnet
Models failed: none
New finding threads: 6
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 123
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 123 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [CRITICAL] contracts/OMN-15330.yaml (correctness) — Unbound shell variables in contract checks cause silent failures | The contract files use shell variable expansion for PR numbers and repository names (e.g., ${PR_NUMBER}, ${REPO}) without defining th
• [CRITICAL] contracts/OMN-15642.yaml (correctness) — Shell injection via unescaped variable in check_value | The check_value field contains the literal string gh pr checks ${PR_NUMBER} --repo ${REPO}. If the contract validation engine executes this st
• [CRITICAL] contracts/OMN-16322.yaml (correctness) — DoS via unbounded base64 decode in DoD check | The DoD check for OMN-16322 pipes the output of gh api ... --jq .content directly into base64 -d without any size limit. The gh api command returns
• [CRITICAL] plan (correctness) — Unpinned GitHub Actions dependency | The diff does not contain any GitHub Actions workflow files. The dependency pinning rule applies to uses: references in workflow files, which are absent from thi
• [MAJOR] contracts/OMN-14953.yaml, contracts/OMN-14993.yaml, and all other contracts with occ-self-bind entries (correctness) — Self-referential PR_NUMBER in self-bind checks | The 'occ-self-bind-pr-*' dod_evidence entries use the template variable ${PR_NUMBER} in their check_value. In the context of a self-bind check, this va
• [MAJOR] All contracts containing occ-self-bind-pr-* entries (correctness) — Self-bind check validates wrong PR when evaluated in product PR context | The self-bind checks are designed to verify that a companion OCC PR exists. However, they use ${PR_NUMBER} which, when the con
• [MAJOR] contracts/OMN-15310.yaml (correctness) — Shell command injection risk in contract check values | The check_value fields contain shell commands that are executed in a CI environment. While the commands appear to use gh CLI, the use of shell i
• [MAJOR] contracts/ (correctness) — Missing schema validation for contract files | The 82 new and modified YAML contract files are added without any visible schema validation in the diff. If the contract schema (schema_version: "1.0.0")
• [MAJOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file only covers one contract, leaving 81 others untested | The PR adds a single test file (tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py) that appears to test only the OMN-20074 contra
• [MAJOR] contracts/OMN-15384.yaml (correctness) — grep -c 'class each' is not a valid Python class check | The DOD check in OMN-15384.yaml uses grep -c 'class each' to verify the presence of a test class in test_flat_node_migration_shape_parity.py.
• [MAJOR] contracts/OMN-15384.yaml (correctness) — Unpinned commit reference in DOD check | The DOD check in OMN-15384.yaml references a specific commit SHA 80f4c0e17f91f4489ef705dab72ea89764a35c13 in the GitHub API URL. While this is a full 40-char
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-15384.yaml (correctness) — DOD checks rely on external GitHub API without fallback | Multiple DOD checks use gh pr view and gh api commands that depend on the GitHub API and the gh CLI being available and authenticated. I
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Case-sensitive grep against lowercase 'success' will fail on GitHub API output | The check_value for the AC4 falsifier and the attempt-1 stable check uses grep -qx success to match the conclusion of
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Hardcoded commit SHA in check_value is a mutable reference | The check for occ-self-bind-pr-5629 uses a hardcoded commit SHA 4c6e8a2b2d285e0f54770ccf81fa4218489f69ba in the gh api command to fet
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Missing validation that the pinned SHA in the workflow is actually the expected one | The check grep -qE 'merge-hold-gate-reusable[.]yml@[0-9a-f]{40}' verifies that the workflow file contains a 40-c
• [MAJOR] contracts/OMN-15642.yaml (correctness) — Brittle grep -c check for test existence | The check grep -c 'def test_degraded_attach_readiness_does_not_degrade_gated_health_status' is used to verify the presence of a specific test function. `gr
• [MAJOR] contracts/OMN-15807.yaml (correctness) — grep -c used as boolean gate returns non-zero on zero matches | The check_value for dod-OmniNode-ai-omnibase_infra-pr-2902 uses grep -c 'class ModelBifrostLaneBackendBinding'. The -c flag prints a
• [MAJOR] contracts/OMN-15741.yaml (correctness) — Pinned commit SHAs in evidence checks are not cryptographically verified | Multiple contracts pin evidence checks to specific commit SHAs (e.g., 11548f3, 3de828e
• [MAJOR] contracts/OMN-15741.yaml (correctness) — Evidence checks lack error handling for API failures | The check_value commands in multiple contracts use gh api and gh pr view without any error handling. If the GitHub API is rate-limited, the
• [MAJOR] contracts/OMN-15837.yaml, contracts/OMN-15838.yaml, and similar contracts with templated commands (correctness) — Shell variable expansion in YAML command strings will not resolve | The evidence_requirements blocks use shell variable syntax (${PR_NUMBER}, ${REPO}) inside double-quoted YAML strings. If the consumi
• [MAJOR] contracts/OMN-15837.yaml, contracts/OMN-15838.yaml, and similar contracts with hardcoded SHAs (correctness) — Hardcoded commit SHA in evidence check may become stale or invalid | The check_value in multiple contracts references a specific commit SHA (c6b51a8) to fetch a file f
• [MAJOR] contracts/OMN-16171.yaml (correctness) — Unquoted YAML scalars with colons break parsing | In contracts/OMN-16171.yaml, the keys schema_version, ticket_id, and title are written without quotes. The values '1.0.0', 'OMN-16171', and 'Stop sour
• [MAJOR] contracts/OMN-16056.yaml (correctness) — Commands in contracts execute arbitrary shell code | The check_value fields in the contract files contain shell commands that are executed by the CI system. For example, in OMN-16056.yaml, the comma
• [MAJOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file uses hardcoded PR numbers and repo names | The test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py likely contains hardcoded references to PR numbers and repo names. This mak
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Shell variable expansion inside YAML double-quoted scalar | The check_value for 'dod-infra-2818-new-handler' uses a YAML double-quoted scalar containing shell variables like $base_check and $head_body
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Shell script uses non-portable base64 -d flag | The check_value for 'dod-infra-2818-new-handler' uses 'base64 -d' to decode the GitHub API response. The '-d' flag is GNU coreutils syntax. On macOS (BS
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Shell script uses non-portable base64 -d flag in legacy-deleted check | The check_value for 'dod-infra-2818-legacy-deleted' does not use base64, but the 'dod-OmniNode-ai-omnibase_infra-pr-4581' check
• [MAJOR] contracts/OMN-16322.yaml (correctness) — DoD check relies on hardcoded commit SHA | The DoD check for OMN-16322 uses a hardcoded commit SHA 632b5350bd717b9d649ffe9dfd154ada05c93885 to fetch the file content. This makes the check non-reprod
• [MAJOR] contracts/ (correctness) — Missing validation of YAML schema in new contracts | The PR adds 81 new YAML contract files. There is no evidence in the diff that these files are validated against a schema. If the YAML files contain
• [MAJOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file only covers one contract | The PR adds a test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py that appears to test only one specific contract (OMN-20074). Given that 81 new co
• [MAJOR] contracts/OMN-14060.yaml (correctness) — grep -cFx pattern matches literal filename instead of glob | The check_value uses grep -cFx '.github/workflows/application-acl-postgres16-proof.yml'. The -F flag treats the pattern as a fixed string
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Unpinned commit SHAs in gh api content checks | Multiple dod_evidence checks use gh api repos/.../contents/...?ref=<sha> where the SHA is a full 40-character commit. While full SHAs are compliant wi
• [MAJOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file only tests one contract, not the 81 added contracts | The PR adds 81 new contract YAML files but only includes one test file: tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py. This
• [MAJOR] contracts/OMN-16661.yaml, contracts/OMN-16769.yaml, and others (correctness) — grep -c returns exit code 1 on zero matches, breaking DoD validation | The DoD checks use grep -c 'pattern' to verify the presence of a specific function or class in a remote file. The grep -c com
• [MAJOR] contracts/OMN-16661.yaml, contracts/OMN-16769.yaml (correctness) — Duplicate DoD checks within the same evidence entry | In several contract files (e.g., OMN-16661, OMN-16769), the same check_value command is listed twice under the same dod_evidence entry. This i
• [MAJOR] contracts/OMN-16788.yaml (correctness) — evidence_artifact supersedes_dod_evidence may invalidate prior check | In OMN-16788.yaml, the check dod-occ-evidence-admissibility-validator declares `evidence_artifact: "supersedes_dod_evidence:dod
• [MAJOR] contracts/OMN-16788.yaml (correctness) — gh pr checks with ${PR_NUMBER} and ${REPO} may not be expanded | In OMN-16788.yaml, the evidence requirement uses gh pr checks ${PR_NUMBER} --repo ${REPO}. If these environment variables are not set
• [MAJOR] contracts/OMN-14060.yaml (correctness) — Duplicate DoD check command in OMN-14060 | The 'dod-OmniNode-ai-omnibase_infra-pr-2957' evidence block contains two identical command checks that both grep for 'def _gap_shortfall' in the same file at
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-16926.yaml (correctness) — grep -c returns exit 1 on zero matches, breaking DoD gate | Multiple DoD checks use 'grep -c' to verify a symbol exists in a file. When the symbol is absent, grep -c prints '0' and exits with status 1
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-16926.yaml (correctness) — DoD checks fetch arbitrary remote content without integrity verification | The 'gh api ... --jq .content | base64 -d' pattern downloads file content from a remote repository at a pinned ref and pipes
• [MAJOR] contracts/OMN-16947.yaml, contracts/OMN-16961.yaml (correctness) — Unsubstituted shell variables in evidence commands | The evidence_requirements sections in multiple contracts (e.g., OMN-16947, OMN-16961) use shell variable syntax ${PR_NUMBER} and ${REPO} in com
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-17079.yaml, and other contract files with grep -c checks (correctness) — grep -c returns exit code 1 on zero matches, breaking command checks | The check_value commands use grep -c to verify the presence of a symbol. When the target symbol is absent, grep -c prints '0'
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-17079.yaml, and other contract files with hardcoded SHAs (correctness) — Hardcoded commit SHAs in check_value commands are not verifiable at review time | Multiple contract files embed full 40-character commit SHAs in gh api commands (e.g., `?ref=976add544c784450d63982d1
• [MAJOR] contracts/OMN-14060.yaml (correctness) — grep -ciE with multiple patterns is fragile and may match unintended files | The check grep -ciE 'nodes/|handlers/|runtime/|services/|docker|monitor_logs|deploy' in OMN-14060 uses a case-insensitive
• [MAJOR] contracts/OMN-17135.yaml (correctness) — Truncated patch excerpts prevent verification of dod_evidence command syntax | The patch excerpt for contracts/OMN-17135.yaml is truncated at check_value: |- with no visible content. The same applie
• [MAJOR] contracts/OMN-14060.yaml (correctness) — dod_evidence check_value uses shell variable expansion that may not be supported | In contracts/OMN-14060.yaml, the command field under evidence_requirements uses ${PR_NUMBER} and ${REPO} shel
• [MAJOR] contracts/OMN-14060.yaml (correctness) — grep -c prints count to stdout, which may be interpreted as the check result | When grep -c is used in a dod_evidence command check, it prints the match count to stdout. If the check framework cap
• [MAJOR] contracts/OMN-17137.yaml (correctness) — grep -c exit code semantics break evidence verification | The check_value commands use grep -c to verify the presence of specific symbols in source files. grep -c prints the count of matching line
• [MAJOR] contracts/OMN-17137.yaml (correctness) — Unpinned commit SHAs in evidence checks allow tampering | The evidence checks reference specific commit SHAs (e.g., ref=783633eb6fa5aa576bfe2554bb9cab166f36822c). While these are full 40-character S
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-17166.yaml, and all other contract files using ${PR_NUMBER}/${REPO}/${OMNI_HOME} in command fields (correctness) — Shell command injection via unquoted variable expansion in evidence commands | The evidence_requirements commands embed ${PR_NUMBER} and ${REPO} without quoting. If the invoking shell or CI runner exp
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-17166.yaml, and all contract files with piped gh api | base64 -d | grep -c patterns (correctness) — grep -c returns non-zero exit code when count is zero, breaking check semantics | The check_value commands use 'grep -c' to assert the presence of a symbol. grep -c prints the count and exits 0 when m
• [MAJOR] contracts/OMN-14060.yaml (correctness) — grep -cFx with a single filename cannot distinguish 'file present' from 'file absent' in paginated output | The check 'gh api .../pulls/3031/files --paginate --jq '.[].filename' | grep -cFx 'tests/hel
• [MAJOR] contracts/ directory, tests/ci/ (correctness) — Contract files lack schema validation and are not machine-verifiable without external tooling | The 81 new YAML contract files are added without a corresponding JSON Schema, OpenAPI, or any validation
• [MAJOR] contracts/OMN-17166.yaml (correctness) — dod_evidence check_value for test_passes omits the actual test command in OMN-17166 | In contracts/OMN-17166.yaml, the dod_evidence item 'dod-occ-diff-derived-behavior-proof-pr-4581' declares check_ty
• [MAJOR] All contracts/*.yaml files containing gh api check_value commands (correctness) — gh api commands in contracts execute with ambient CI credentials, enabling information disclosure | The check_value commands invoke 'gh api' against public repository endpoints. In a CI environment, t
• [MAJOR] contracts/OMN-17221.yaml (correctness) — grep -cFx with no match exits 1, breaking contract check | In OMN-17221.yaml the check gh api ... | grep -cFx 'docs/runbooks/lab-prepush-host-table.md' uses grep -c which prints the count and exit
• [MAJOR] contracts/OMN-17277.yaml (correctness) — grep -cFx pattern in OMN-17277 has same exit-code ambiguity | The check `gh api repos/OmniNode-ai/omnibase_infra/pulls/3127/files --paginate --jq '.[].filename' | grep -cFx '.github/workflows/contract
• [MAJOR] contracts/OMN-17221.yaml (correctness) — Unpinned commit SHA in gh api ref parameter | In OMN-17221.yaml the check `gh api repos/OmniNode-ai/omnibase_infra/contents/scripts/push_lanes/detect_foreign_prepush.py?ref=50d45a7f824acdbe7daeb8455cd
• [MAJOR] contracts/OMN-17296.yaml (correctness) — Unsanitized variable interpolation in shell commands | The contract files embed shell commands that interpolate environment variables directly into command strings (e.g., `gh pr view ${PR_NUMBER} --re
• [MAJOR] contracts/OMN-14060.yaml, contracts/OMN-17296.yaml (correctness) — Inconsistent variable usage across contract files | Some contract files use hardcoded repository names and PR numbers (e.g., gh pr view 8000 --repo OmniNode-ai/onex_change_control), while others use
• [MAJOR] contracts/OMN-14115.yaml, OMN-14953.yaml, OMN-14993.yaml, OMN-15330.yaml, OMN-15384.yaml, OMN-16418.yaml, OMN-16367.yaml (sonnet) — Evidence checks assert only that a PR or file exists, not behavior | Many generated dod_evidence checks are gh pr view ... --json number,state or --json files. These exit 0 for any existing PR reg
• [MAJOR] contracts/OMN-15358.yaml (sonnet) — Placeholder command shipped in evidence_requirements (OMN-15358) | The tests requirement has the literal command uv run pytest <hand-authored target> -q. In a shell, < is an input redirect, so t
• [MAJOR] contracts/OMN-15741.yaml, OMN-15642.yaml, OMN-16788.yaml, OMN-16343.yaml, OMN-15484.yaml (sonnet) — Admissibility-validator item supersedes real PR evidence with a ticket-independent test | Many contracts add dod-occ-evidence-admissibility-validator with `evidence_artifact: supersedes_dod_evidence
• [MAJOR] contracts/OMN-16293.yaml, contracts/OMN-16171.yaml (sonnet) — Cross-ticket and cross-repo evidence bound to the wrong contract | OMN-16293 binds PR #4581, whose proof target is test_catalog_service_modules_exist_omn17166.py. That file belongs to OMN-17166, whi
• [MAJOR] contracts/OMN-17277.yaml, evidence_requirements[1] (sonnet) — Placeholder pytest command is executable and shell-hostile | The evidence_requirements 'tests' command in OMN-17277 is the literal string uv run pytest <hand-authored target> -q. If a gate runs it t
• [MAJOR] contracts/OMN-17277.yaml, dod_evidence[1] (sonnet) — Generic validator check supersedes the PR-specific check with no cwd | In OMN-17277, dod-occ-evidence-admissibility-validator carries `evidence_artifact: supersedes_dod_evidence:dod-OmniNode-ai-omni
• [MAJOR] contracts/OMN-17152.yaml, contracts/OMN-17166.yaml, contracts/OMN-17277.yaml, contracts/OMN-14060.yaml (sonnet) — Self-bind and diff-scope checks pass on any existing PR | Several checks only prove that the referenced PR exists, not that it is merged, belongs to the ticket, or touches the claimed files. Examples:
• [MINOR] contracts/OMN-15092.yaml (correctness) — Unquoted shell command with grep -cFx may misbehave on empty input | In OMN-15092, the check_value uses a pipeline: 'gh api ... | grep -cFx ...'. If the gh api command returns no files (empty output),
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file covers only one contract pattern | The test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py adds 117 lines of tests, but the PR adds 81 new contract files. The test likely cover
• [MINOR] All contracts in this PR (correctness) — Inconsistent check_value templating across contract types | Some contracts use ${PR_NUMBER} and ${REPO} template variables (e.g., OMN-14953, OMN-14993), while others use literal values (e.g., OMN-1509
• [MINOR] contracts/OMN-15092.yaml (correctness) — grep -cFx returns count, not boolean, in pipeline context | The check 'grep -cFx pattern' outputs the number of matching lines. When used in a pipeline with 'gh api ... | grep -cFx ...', the exit code
• [MINOR] contracts/ (correctness) — Inconsistent contract structure across files | The contract files show inconsistent use of fields. Some files (e.g., OMN-15310.yaml) include evidence_requirements with kind: "ci" and kind: "tests", wh
• [MINOR] contracts/OMN-15310.yaml (correctness) — Redundant API calls in contract checks | Some contract checks make multiple API calls that could be combined. For example, OMN-15310.yaml makes two separate gh api calls to check the same PR. This is
• [MINOR] contracts/OMN-14060.yaml (correctness) — Missing schema_version in OMN-14060.yaml excerpt | The excerpt for OMN-14060.yaml starts with a comment line and does not show the schema_version field, unlike OMN-15384.yaml which explicitly includ
• [MINOR] contracts/OMN-14060.yaml, contracts/OMN-15384.yaml (correctness) — Inconsistent DOD evidence structure across contracts | The DOD evidence structure varies between contracts. Some use evidence_artifact with supersedes_dod_evidence, others use direct checks. Thi
• [MINOR] contracts/OMN-14060.yaml (correctness) — DoD evidence is not idempotent due to ephemeral API state | The dod-OmniNode-ai-omnibase-infra-pr-2570 check relies on the default behavior of the GitHub Jobs API, which returns the most recent atte
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — No test coverage for the contract validation logic | The PR adds 81 contract files and one test file. The test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py is 117 lines, but the diff
• [MINOR] contracts/OMN-15642.yaml (correctness) — Inconsistent source and status fields in dod_evidence | In contracts/OMN-15642.yaml, some dod_evidence entries have source: "generated" and no status field, while others have `source: "manual"
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file covers only one contract; no regression tests for the other 81 | The PR adds 82 files, but only one test file is included: tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py. This tes
• [MINOR] contracts/ (correctness) — Inconsistent evidence check patterns across contracts | The contracts use a mix of gh pr view, gh api, and grep-based checks, with no consistent pattern. Some checks verify the existence of a PR
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file only covers one contract, leaving 81 others untested | The PR adds 82 contract files but only includes a test for OMN-20074. The test file tests/ci/test_moved_ticket_contracts_cr0220_omn2007
• [MINOR] contracts/OMN-15837.yaml, contracts/OMN-15838.yaml, and similar contracts (correctness) — Duplicate evidence blocks across multiple contracts suggest copy-paste without adaptation | The evidence blocks in OMN-15837 and OMN-15838 are nearly identical, differing only in the ticket ID in the
• [MINOR] contracts/OMN-15837.yaml, contracts/OMN-15838.yaml, and similar contracts (correctness) — grep -c returns a count, not a boolean, which may not match the check's intent | The check_value uses grep -c to count occurrences of a function definition. The check likely intends to verify the func
• [MINOR] contracts/OMN-16056.yaml (correctness) — Missing error handling for gh api failures | The commands in the contract files use gh api to fetch file contents. If the API call fails (e.g., due to network issues, rate limiting, or a missing fil
• [MINOR] contracts/OMN-14060.yaml (correctness) — Shell script in YAML check_value is not sanitized | The check_value fields contain shell scripts that are executed by the CI system. If the YAML file is compromised, an attacker could inject malicious
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file added but no corresponding contract for the test | The PR adds a test file 'tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py' but does not add a corresponding contract file for the te
• [MINOR] contracts/ (correctness) — Inconsistent DoD check types across contracts | The DoD checks in the new contracts use a mix of command and manual check types. The manual check type is not verifiable by CI, which undermines t
• [MINOR] contracts/OMN-16343.yaml (correctness) — Contract OMN-16343 references three repos but only one is in the infra repo | The contract OMN-16343 is located in the omnibase_infra repository but its evidence requirements and dod_evidence referenc
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file test_moved_ticket_contracts_cr0220_omn20074.py is not shown in patch excerpt | The PR adds a test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (+117 lines) but the patch exce
• [MINOR] contracts/ (correctness) — 82 new contract files added in a single PR with no visible validation | The PR adds 81 new YAML contract files and modifies one existing contract (OMN-20074.yaml). There is no visible CI check in the
• [MINOR] contracts/OMN-14060.yaml (correctness) — Missing error handling for gh api failures | The dod_evidence checks use gh api commands without error handling. If the GitHub API is unavailable, the PR is deleted, or the commit is garbage-collect
• [MINOR] contracts/OMN-14060.yaml (correctness) — Contract files reference external PRs without versioning | The contract files reference specific PR numbers (e.g., PR #3121, #3754, #3755) and commit SHAs. If these PRs are closed, merged, or the comm
• [MINOR] contracts/OMN-14060.yaml, contracts/OMN-16661.yaml, and others (correctness) — Unpinned commit SHAs in DoD checks | The DoD checks reference specific commit SHAs (e.g., ref=872ae88402d8d1e7c15c719e21ba1f8fd9439553). These are full 40-character SHAs, which is the required secur
• [MINOR] contracts/OMN-14060.yaml (correctness) — Truncated hunk in OMN-14060.yaml | The patch excerpt for OMN-14060.yaml begins mid-file at source: "generated" without the schema_version, ticket_id, or title fields. The hunk header shows `@@
• [MINOR] contracts/OMN-14060.yaml (correctness) — Test file references specific test paths that may not exist | In OMN-14060.yaml, the dod-occ-diff-derived-behavior-proof check runs `uv run pytest tests/unit/contracts/test_protocol_ownership.py tes
• [MINOR] contracts/OMN-16788.yaml (correctness) — Multiple self-bind PRs for a single ticket | OMN-16788.yaml binds to three OCC companion PRs: #7322, #7330, and #7341. Each is checked with `gh pr view --repo OmniNode-ai/onex_change_control --jso
• [MINOR] contracts/OMN-20074.yaml (correctness) — OMN-20074.yaml is modified, not added | File 73 in the list is contracts/OMN-20074.yaml (modified, +17/-0). The patch excerpt for this file is not shown in the provided diff. The change adds 17 line
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file for moved ticket contracts may have brittle assertions | The test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (117 lines) is added. Without the patch excerpt, the test log
• [MINOR] contracts/OMN-14060.yaml (correctness) — OMN-14060 missing schema_version and ticket_id fields | The OMN-14060.yaml excerpt begins mid-document with a comment line and lacks the 'schema_version' and 'ticket_id' fields that are present in OMN
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file for moved ticket contracts not shown in patch excerpt | The test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py is listed as added (+117/-0) but no patch excerpt is provided in
• [MINOR] plan (correctness) — 80 of 82 contract files have no patch excerpt in this chunk | Only two of the 82 changed files (OMN-14060 and OMN-16926) have patch excerpts in this review chunk. The remaining 80 files, including the
• [MINOR] contracts/OMN-16947.yaml, contracts/OMN-16961.yaml (correctness) — Missing error handling for command execution | The contracts define commands to be executed (e.g., gh pr view, uv run pytest), but there is no specification of how failures are handled. If a comma
• [MINOR] contracts/OMN-16947.yaml (correctness) — Test file paths may not exist in target repo | The dod-occ-diff-derived-behavior-proof check in OMN-16947 runs pytest on specific test files (e.g., `tests/unit/observability/runner_health/test_runne
• [MINOR] contracts/OMN-14060.yaml, contracts/OMN-17079.yaml, and other contract files with occ-self-bind checks (correctness) — Contract files lack a mechanism to validate the OCC companion PR state | The occ-self-bind-pr-* checks use gh pr view <number> --json number,state to verify the existence and state of an OCC compa
• [MINOR] contracts/OMN-14060.yaml, contracts/OMN-17079.yaml, and other contract files with test_passes checks (correctness) — Test paths in check_value may not exist in the target repository | The dod-occ-diff-derived-behavior-proof checks reference test files such as `tests/unit/nodes/node_evidence_autoclose_sweep_effect/
• [MINOR] contracts/OMN-17079.yaml and other contract files (correctness) — Contract files are generated but lack a schema validation step | The contract files are marked as source: "generated" but there is no evidence of a schema validation step that ensures the YAML struc
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file test_moved_ticket_contracts_cr0220_omn20074.py is not reviewed in this chunk | The test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py is listed as a changed file but its pat
• [MINOR] contracts/OMN-14060.yaml (correctness) — gh api commands in dod_evidence may leak repository content to logs | The gh api ... --jq '.content' | base64 -d | grep -c pattern downloads and decodes file content from the repository. If the chec
• [MINOR] contracts/ (correctness) — 82 contract files added with no visible schema validation or CI check for YAML validity | The PR adds 81 new YAML contract files and modifies 1 existing one. There is no visible test or CI check that
• [MINOR] contracts/OMN-17137.yaml (correctness) — Missing error handling for gh api failures | The evidence checks use gh api to fetch file contents. If the API call fails (e.g., due to network issues, rate limiting, or authentication errors), the
• [MINOR] All contracts/*.yaml files (correctness) — No idempotency or re-execution semantics defined for dod_evidence checks | The contracts define check commands but do not specify what happens when a check is re-executed. The gh api commands are stat
• [MINOR] tests/ci/ (correctness) — Test file covers only one ticket out of 82 changed files | tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py is the sole test file in the diff, and it is scoped to OMN-20074. The remaining 81 co
• [MINOR] All contracts/*.yaml files with gh api ...?ref=<sha> patterns (correctness) — Commit SHA pinning in gh api refs is correct but fragile against repository force-push | The gh api content queries use full 40-character commit SHAs (e.g., 1fc3dad, c
• [MINOR] contracts/OMN-17277.yaml (correctness) — OMN-17277 declares a test requirement with a placeholder command | The evidence_requirements section of OMN-17277.yaml includes a kind: tests entry whose command is the literal string `uv run py
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — 80 of 82 files are new contract YAMLs with no visible validation | The PR adds 80 new contract YAML files and modifies one existing file (OMN-20074.yaml). The only test file added is `tests/ci/test_mo
• [MINOR] contracts/OMN-17296.yaml (correctness) — Missing validation for variable substitution | The templated contracts rely on variables like ${PR_NUMBER} and ${REPO} being set in the execution environment. There is no visible mechanism in the
• [MINOR] tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py (correctness) — Test file name suggests specific scope but content is not fully visible | The test file tests/ci/test_moved_ticket_contracts_cr0220_omn20074.py is added, but the patch excerpt is truncated. The name
• [MINOR] contracts/OMN-16418.yaml, OMN-16420.yaml, OMN-16661.yaml, OMN-16769.yaml, OMN-16821.yaml, OMN-15642.yaml (sonnet) — Deploy-assessment gate satisfied by unrelated grep, with duplicated checks | dod-deploy-assessment is described as clearing the deploy-gate (F-05). It is implemented as a grep for a function or clas
• [MINOR] contracts/OMN-16293.yaml (sonnet) — Claimed assertion not enforced by the command (OMN-16293 scope check) | The dod-infra-2818-scope description says it 'confirms the exact 35-file change set'. The command only prints `[.files[].path]
• [MINOR] contracts/OMN-15484.yaml, contracts/OMN-16322.yaml (sonnet) — Mutable live-PR state used as durable evidence | Several checks read live GitHub state that changes over time: statusCheckRollup filtered by name with grep -qx SUCCESS, gh pr checks, and an unpi
• [MINOR] contracts/OMN-16343.yaml (sonnet) — Evidence probe asserts presence of a tag-pinned action (OMN-16343) | The omnibase_core PR #1577 check counts occurrences of create-github-app-token@v1 in release.yml. This treats a tag-referenced ac
• [MINOR] contracts/OMN-17166.yaml, evidence_requirements[1] and dod_evidence[3] (sonnet) — Evidence item id does not match the id named in the description | In OMN-17166, the evidence_requirements description says the proof is 'Bound as dod_evidence item `dod-occ-diff-derived-behavior-proof
• [MINOR] contracts/OMN-17152.yaml, contracts/OMN-17166.yaml, contracts/OMN-17221.yaml, contracts/OMN-14060.yaml (sonnet) — String-presence grep on pinned blob is weak behavior evidence | Several 'Evidence-Source autobind' checks fetch a file at a commit and grep -c for a class or def name, for example 'class ProcessInfo

Findings demoted from threads (anchor rejected)

• [MAJOR] hostile-reviewer (correctness)

  CI evidence checks use unbound variables, making them non-falsifiable | In contracts/OMN-16343.yaml, the evidence_requirements entries for CI checks use shell variables ${PR_NUMBER} and ${REPO} that are never defined or bound in the contract. The description text references specific PR numbers (2831, 433, 1577) and repos, but the command template does not substitute them. When executed, these commands will either fail with an undefined variable or, if the shell treats them as empty, produce a meaningless in

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (correctness)

  dod_evidence check for PR #2831 only verifies existence, not state | In contracts/OMN-16343.yaml, the dod-OmniNode-ai-omnibase_infra-pr-2831 entry checks gh pr view 2831 --repo OmniNode-ai/omnibase_infra --json number,state and gh pr view 2831 --repo OmniNode-ai/omnibase_infra --json files. The first command outputs the state but does not assert that the state is 'merged' or 'open'. The second command lists files but does not verify that the expected files are present. Neither check is falsifiable in th

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (sonnet)

  Ambiguous ${PR_NUMBER}/${REPO} placeholders on multi-PR contracts | OMN-16343 declares three evidence_requirements, each with the identical command gh pr checks ${PR_NUMBER} --repo ${REPO}. Their descriptions refer to different PRs in different repos (#2831, #433, #1577). Substitution gives the commands no way to know which PR each one targets. The same placeholder pattern recurs on other contracts that bind several PRs, for example OMN-16367 and OMN-15642, which carry one ci requirement but many dod_ev

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (correctness)

  dod_evidence check_value for test_passes uses relative paths that depend on cwd | The test_passes check in contracts/OMN-14060.yaml uses uv run pytest tests/ci/test_bus_command_dto_no_literal_secret_omn17106.py ... with cwd: "${OMNI_HOME}/omnibase_infra". The cwd field uses a shell variable ${OMNI_HOME}. If the check framework does not expand this variable, the cwd will be the literal string ${OMNI_HOME}/omnibase_infra, which does not exist, and the test command will fail. This is the same varia

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (correctness)

  OMN-14060.yaml excerpt is a fragment without schema context | The patch excerpt for OMN-14060.yaml shows only two lines: a check_value and a cwd. The full file is 59 lines but the excerpt is truncated. Without the schema_version, ticket_id, and dod_evidence structure, it is not possible to verify that this fragment is well-formed YAML or that the check_value is attached to a valid check_type. The check_value references a test file `tests/unit/infra/test_catalog_service_modules_exist_omn17166

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (sonnet)

  OMN-14060 contract carries evidence bound to OMN-17137 | contracts/OMN-14060.yaml includes self-bind items described as 'self-bind for OMN-17137'. It also runs pytest targets named for OMN-16422 and OMN-17137, and a separate contracts/OMN-17137.yaml is added in the same PR. Evidence for one ticket appears under another ticket's contract, which breaks the one-ticket-one-contract binding. This may be intended for moved tickets, but nothing in the visible diff documents it. Duplicate bindings can let one PR's

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[github-actions]

✅ Hostile Reviewer — REVIEWED

Critical findings: 4
Major findings: 66
Total findings: 130
Models succeeded: correctness,sonnet
Models unavailable: none

Action required: findings were posted as review threads. Address or reject each one, then resolve its thread — the Hostile Review Thread Gate fails while hostile-reviewer threads are unresolved (OMN-17492).

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	Fails this job with a named reason

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review; voters from the private CI overlay (OMN-8468/OMN-17492/OMN-20910/OMN-20923)