fix(OMN-15025,OMN-15712): done-flip guard bare-#N false positives + attachment supersession

[jonahgabriel]

Summary

Two defect classes in pre_tool_use_done_flip_guard.sh (OMN-13856 lineage) hard-blocked three fresh dod_verify PASS closeouts on 2026-08-05: OMN-15464 (8/8), OMN-15539 (12/12), OMN-15422 (18/18, correctly-superseded chain).

(a) OMN-15025 (adopted — pre-existing Backlog ticket, not duplicated): _PR_NUMBER_RE matched ANY bare #<digits> in prose as an unresolvable PR reference — e.g. OMN-15464's own description: "cause #2 is always mislabelled as cause #3". Narrowed the regex to require an adjacent PR/pull/pull request token, per OMN-15025's first suggested fix direction. A dropped bare match falls through to decide()'s existing fail-closed OCC-receipt/exempt-label path rather than silently allowing — not a detection weakening.

(b) OMN-15712 (new ticket — no prior duplicate found): the attachment PR scan had no supersession awareness. A stale CLOSED-unmerged attached PR still hard-blocked the flip even when the ticket's own OCC DoD contract had retired it:

• OMN-15539: attached omnibase_core#1533 is CLOSED/unmerged, but no OCC receipt anywhere cites pr_number: 1533 — the real DoD contract cites 1532/1996 instead.
• OMN-15422: attached omnibase_infra#2596 is CLOSED/unmerged, but an explicit PASS dod-...-pr-2596-superseded OCC receipt retires it in favor of merged #2597 (same head commit).

Added list_ticket_receipt_fields (reuses the existing git-backed origin/dev read used by the path-B OCC probe) + pr_citation_state to classify a blocking PR ref as uncited/superseded/active against the ticket's own OCC receipt set. Only when a ticket has at least one OCC receipt does this filtering apply — a ticket with zero OCC receipts is completely unaffected (no citation data exists to reason from), so the ordinary blocking behavior is untouched for the common non-OCC ticket shape.

Test plan

• TDD RED proven by git stash-ing done_flip_guard.py and confirming all 11 new OMN-15712 tests fail (AttributeError/TypeError) against the pre-fix guard.
• GREEN after restoring — pytest tests/hooks/test_done_flip_guard.py tests/hooks/test_linear_done_verify.py -q → 116/116 pass.
• Adversarial case covered explicitly: a ticket WITH OCC receipts where the blocking PR IS actively (non-superseded) cited and genuinely unmerged still BLOCKS (test_adversarial_active_unmerged_pr_still_blocks_despite_receipts).
• test_no_occ_receipts_at_all_is_unaffected_by_citation_filter proves the zero-receipt case is untouched.
• Real-fixture regression proof: replayed the actual OMN-15464 description text through parse_pr_refs — zero bare-#N false matches post-fix (was 2: #2, #3).
• ruff format, ruff check, mypy --ignore-missing-imports clean; full pre-commit run clean on push.

Ticket

OMN-15025, OMN-15712

Evidence-Source: OCC#6121
Evidence-Ticket: OMN-15025
Evidence-Ticket: OMN-15712

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 52 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1a357ee6-54dd-47a9-bbf8-3fc6a5cb6a56

📥 Commits

Reviewing files that changed from the base of the PR and between 80de61f and 36f2237.

📒 Files selected for processing (5)

• .secrets.baseline
• plugins/onex/hooks/lib/done_flip_guard.py
• plugins/onex/hooks/lib/linear_done_verify.py
• tests/hooks/test_done_flip_guard.py
• tests/hooks/test_linear_done_verify.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Blocking findings (critical/error): 0
Total findings: 0
Models succeeded: none

Note: All reviewer models failed or were unavailable. Degraded results are informational during the pilot phase (OMN-8524) and do not block merge. Error: cli_review exited non-zero (all models failed or binary error)

---

Gate semantics (pilot phase)

Verdict	Meaning	Blocks merge?
passed	No critical/error findings	No
blocked	CRITICAL or ERROR findings found	Yes
degraded	All models unavailable (infra)	No (pilot)

Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)

[jonahgabriel]

@codex DO NOT MERGE — verified regression by independent adversarial verifier (opus, wave-12 verify). The new pr_citation_state() 'uncited' branch in done_flip_guard.py makes ANY ticket holding >=1 OCC receipt non-blocking on ANY unmerged PR whose number is absent from receipts' pr_number field. Reproduced live on production default path: OMN-15422 (12 real receipts) + description citing genuinely-OPEN load-bearing omniclaude#1976 (state=OPEN, mergedAt=null) -> FIXED guard allow=True; LIVE guard on byte-identical input -> allow=False reason=pr_not_merged. Re-opens the OMN-8375/OMN-14582/OMN-14641 'Done while implementing PR still open' shape. Blast radius: 3257 receipt-bearing tickets on OCC origin/dev. Marking draft while a corrected fix lands (OPEN PR refs must always block; only CLOSED-unmerged refs get the supersession-awareness carve-out). Tracking: OMN-15712.

[jonahgabriel]

@codex Regression fixed and re-greened — safe to merge whenever picked up. Commit 36f2237 scopes the OMN-15712 citation-supersession carve-out to CLOSED-unmerged refs only:

• OPEN PR ref -> always blocks (unchanged from pre-OMN-15712 guard)
• CLOSED-unmerged ref -> blocks only if cited by an active (non-superseded) receipt, or the ticket has zero OCC receipts (prior behavior)
• MERGED -> never blocks (unchanged)

TDD: new test test_open_pr_in_description_must_block_omn_15712_regression pins the exact repro — confirmed RED against the pre-fix code via git-stash, GREEN post-fix. 118/118 tests pass (tests/hooks/test_done_flip_guard.py + test_linear_done_verify.py).

Live re-verification with the fixed guard against real Linear/gh/OCC state: OMN-15464 -> allowed (all_prs_merged); OMN-15539 -> allowed (blocking_refs_uncited_or_superseded_by_occ_contract, CLOSED-unmerged core#1533 never cited — unchanged); OMN-15422 -> allowed (same reason, CLOSED-unmerged infra#2596 explicitly superseded — unchanged); synthetic case (real OMN-15422 receipts + description citing this repo's own genuinely-OPEN PR #1976) -> blocked (pr_not_merged, state=OPEN) — the leak is closed.

CI green (all required contexts pass, mergeStateStatus=CLEAN, mergeable=MERGEABLE). Un-drafted. I will not merge this myself.