Skip to content

ci(OMN-20074): omnidash S6 cut-over, delete the OCC callers and enforce repo evidence - #394

Merged
jonahgabriel merged 4 commits into
devfrom
jonah/omn-20074-omnidash-s6-cutover
Oct 14, 2026
Merged

jonahgabriel merged 4 commits into
devfrom
jonah/omn-20074-omnidash-s6-cutover

Conversation

@jonahgabriel

Copy link
Copy Markdown
Contributor

What

OCC retirement S6 cut-over for omnidash (epic OMN-20068), in the shape of omniclaude#2614 and omnibase_core#1930, both merged. omnibase_infra (#4732, #4792) and omnimarket (#3398, #3513, #3523) were cut over earlier.

Deleted workflows: call-occ-preflight.yml, call-occ-autobind.yml, call-occ-companion-effect.yml, call-receipt-gate.yml, occ-autobind-cancel-recovery.yml. Deleted scripts/ci/occ_manual_replay_precheck.py and two tests that only read deleted callers (test_occ_companion_effect_edited_trigger_omn_18334.py, test_receipt_gate_pin_artifact_sha256_omn19994.py).

call-reject-skip.yml pins omniclaude reject-deploy-gate-skip.yml at 4358450ccbba0cee11e390208dd0b8b1728e94ab (omniclaude#2540, the pin omnibase_infra, omnimarket and omnibase_core use), so it stops producing "call-reject-skip-token / occ-preflight / eligibility".

call-repo-evidence-gate.yml: shadow "false", compare-with-occ "false", receipt-gate.yml pin 4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa (omnibase_core#1932, was fb0c6c2117d5868a398b0920cd0048d0824415b1), verifier-version 0.4.310 (was 0.4.305). The caller runs on pull_request_target, so this PR's own repo-evidence run uses the base branch's shadow caller.

.github/required-checks.yaml drops "occ-preflight / eligibility" and "verify / verify"; dev-required manifest rows go from 22 to 20. repo-evidence / dod-verify has no row (a dev ruleset is to require it).

workflow-script-refs.yml runs the new tests/ci/test_no_occ_callers_omn20074.py (10 tests) and tests/ci/test_repo_evidence_caller_omn20073.py, which now expects the S6 shape.

contracts/OMN-20074.yaml gains AC11 and AC12 bound to those two test files; AC9 and AC10 unchanged.

Merge precondition

omnidash dev protection still requires "occ-preflight / eligibility" and "verify / verify" according to the manifest on dev. This PR deletes their producers, so it can merge only after those two contexts are removed from omnidash dev protection. That removal needs operator consent; the 2026-10-12T10:44:52Z consent covered omniclaude only. Nothing on branch protection was changed by this PR's lane. The PR is opened as a draft until then.

Open omnidash PRs red only on OCC contexts today: #352, #356, #373, #389, #391, #392, #393. Each needs an update onto dev after this merges.

Tests

The 7-file tests/ci group above 74 passed; test_contract_validation_core_validator_omn20074.py 15 passed; all 5 contracts/*.yaml load with no duplicate mapping key (planted duplicate refused); pre-commit passed on commit.

Rollback

Revert this PR, or set compare-with-occ back to "true" in call-repo-evidence-gate.yml; the dev protection change is separate.

Mechanical edits drafted by Codex, reviewed and completed by the lane.

Lab: host=h202 lane=occfinish-1d5b command=uv run --no-project --python 3.12 --with pyyaml --with pytest python -m pytest tests/ci/test_no_occ_callers_omn20074.py tests/ci/test_repo_evidence_caller_omn20073.py tests/ci/test_workflow_script_refs_exist.py tests/ci/test_sibling_reads_pinned.py tests/ci/test_precommit_ci_backstops_omn19612.py tests/ci/test_precommit_staged_scope_omn19612.py tests/ci/test_precommit_pin_tests_run_in_ci_omn19612.py -q --noconftest -p no:cacheprovider -c /dev/null observed=74 passed; the new test against an archive of origin/dev c1eadc4 returned 8 failed, 2 passed.
Ticket: OMN-20074.

…ce repo evidence

OCC retirement S6 cut-over for omnidash, modelled on omniclaude#2614 and
omnibase_core#1930 (both merged).

Deleted workflows:
- call-occ-preflight.yml
- call-occ-autobind.yml
- call-occ-companion-effect.yml
- call-receipt-gate.yml
- occ-autobind-cancel-recovery.yml

Deleted scripts/ci/occ_manual_replay_precheck.py (run only by the two
deleted callers) and the tests test_occ_companion_effect_edited_trigger_omn_18334.py
and test_receipt_gate_pin_artifact_sha256_omn19994.py.

call-reject-skip.yml:
- reject-deploy-gate-skip.yml pin moves from
  61761f04a8c8edfb810bd261bb82ed60b8bcad2d to
  4358450ccbba0cee11e390208dd0b8b1728e94ab (omniclaude#2540), the pin
  omnibase_infra, omnimarket and omnibase_core use
- the scan runs with no nested change-control preflight, so this caller
  stops producing "call-reject-skip-token / occ-preflight / eligibility"

call-repo-evidence-gate.yml:
- shadow "false", compare-with-occ "false"
- reusable pin moves from fb0c6c2117d5868a398b0920cd0048d0824415b1
  (omnibase_core#1914) to 4e4f5e0404d364e296c5d37db6aa3ab9e07f8ffa
  (omnibase_core#1932)
- verifier-version from 0.4.305 to 0.4.310
- Rollback is setting compare-with-occ back to "true"

.github/required-checks.yaml:
- drops the rows "occ-preflight / eligibility" and "verify / verify"
- the scan row names the new pin
- repo-evidence / dod-verify gets no row (a dev ruleset is to require it)

workflow-script-refs.yml:
- the step that ran the deleted companion-effect test now runs
  tests/ci/test_no_occ_callers_omn20074.py and
  tests/ci/test_repo_evidence_caller_omn20073.py

tests/ci/test_no_occ_callers_omn20074.py is new (10 tests).
tests/ci/test_repo_evidence_caller_omn20073.py now expects the S6 shape.

contracts/OMN-20074.yaml:
- gains AC11 and AC12 with evidence and dod_evidence entries bound to
  those two test files
- AC9 and AC10 are unchanged

Tests:
- the 7 changed or neighbouring tests/ci files: 74 passed
- test_contract_validation_core_validator_omn20074.py: 15 passed
- the new test on an archive of origin/dev c1eadc4: 8 failed, 2 passed
- All 5 contracts/*.yaml load with no duplicate mapping key
- pre-commit on the changed files passed

Merge precondition:
- omnidash dev branch protection still requires "occ-preflight /
  eligibility" and "verify / verify" (per the manifest on dev)
- this PR deletes their producers, so it can merge only after those two
  contexts are removed from dev protection, which is an operator-consented
  step not taken here

Mechanical edits drafted by Codex, reviewed and completed in the lane.
@jonahgabriel
jonahgabriel marked this pull request as ready for review October 12, 2026 17:23
@jonahgabriel

Copy link
Copy Markdown
Contributor Author

Lab: head=f57fa43fc96771520cfabad047a5d49295864a64 (host h202, lane omn20074-s6b)

Merge Status

  • The branch was 4 commits behind dev (merge state BEHIND, ci GREEN at the previous head ad64e23, unarmed, handed to the landing controller on 2026-10-12).
  • A lane merged origin/dev (89f1ad8) into the branch with no conflicts; the new head is the merge commit.
  • No file of this PR's own diff changed in the merge.

Dev Commits Brought In

  • fb9b4ee (omnibase_core pin bump)
  • f3ffde6 (OMN-20885, onex-schema-compat validates with omnibase_core models)
  • a88518f (OMN-20008)
  • 89f1ad8 (OMN-19987)

OCC Callers Check

  • After the merge, a grep of the tree outside contracts/ for occ-preflight, call-occ, occ-autobind, occ-companion, call-receipt-gate and occ_manual finds only test fixtures and comments (tests/ci/test_no_occ_callers_omn20074.py, test_workflow_script_refs_exist.py, pre-commit and workflow comments); no workflow calls an OCC reusable.

Test Results (host h202, python3 -m pytest -q -o addopts="")

  • test_no_occ_callers_omn20074: 10 passed
  • test_repo_evidence_caller_omn20073: 8 passed
  • test_sibling_reads_pinned: 32 passed
  • test_workflow_script_refs_exist: 12 passed

Not Run Locally

  • test_schema_compat_core_owner_omn20885: 9 failed, 6 passed on h202 because the host python has no omnibase_core module; this file arrives from dev unchanged
  • test_contract_validation_core_validator_omn20074: did not finish within the time limit on h202
  • CI on the new head is the check for both.

Left alone (not OCC callers)

  • Both still read onex_change_control: pr-title-check.yml and security-scan.yml (reusables pinned at a89a6f30).

Pending

  • The next omnidash product PR after merge opens no change-control companion.

@jonahgabriel
jonahgabriel merged commit d3f67d9 into dev Oct 14, 2026
30 checks passed
@jonahgabriel
jonahgabriel deleted the jonah/omn-20074-omnidash-s6-cutover branch October 14, 2026 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant