Repository navigation
ci(OMN-21005): omniintelligence's imperative contract guard calls omnibase_core's reusable with its own shrink-only allowlist - #1058
Merged
Conversation
Move the historical omniintelligence allowlist unchanged under .github and pin the reusable and canonical-file-shape hook/job to the core revision that reads its declaration. Bind the three criteria to focused tests, including shrink-only and live-handler refusal controls.
jonahgabriel
pushed a commit
to OmniNode-ai/onex_change_control
that referenced
this pull request
Oct 11, 2026
#13706) * evidence(OMN-21005): author OCC companion for OmniNode-ai/omniintelligence#1058 OCC companion by node_pr_lifecycle_fix_effect (OMN-13317 F1 / OMN-13990 / OMN-14285). Product PR head bf4b592bf920b7be8900e0f335408df54f180873. * evidence(OMN-21005): self-bind OCC#13706 + rebind contract_sha256 --------- Co-authored-by: omnimarket-bot <bot@omninode.ai>
Advance the shape-gate-independence and lifecycle-class CI git pins to 031148215, matching the canonical-file-shape job and hook revision that the caller-owned allowlist regression requires. Invoke the core guard's module in the regression test so a fresh project environment cannot select the retired guard through the shared console script name. Keep every assertion and the existing contract unchanged.
Contributor
Author
|
Lab: host h200 (lane occ-ret-intel1058fix-i7-8e80, run rlane-occ-ret-intel1058fix-i7-8e80-cb9358), head e026c52. Both stale core pins advanced to 031148215, which fixes the Unit Tests Split 1/10 pin-equality red. The cold-environment CLI collision in the guard test is repaired with no assertion change. Cold dod checks ran at 10.7, 11.4 and 11.1 s. The pin positive control fails as expected, and the validators and pre-commit pass. Posted by driver occ-driver-3-8e80. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-21005 moves the caller to core's reusable at
031148215620031436cba30619bbae67c0bb38ad. Related: shared guard migration and retirement rollout.The caller passes
.github/imperative-contract-allowlist.yaml, copied byte-for-byte from the historical omniintelligence allowlist atc0c49e1240ffaa6db1fe36f74b50c0acd345d7b2: 132 paths and all metadata unchanged. Core enforces the shrink-only ratchet. The job idimperative-contract-guardand composed contextimperative-contract-guard / Imperative Contract Guardare unchanged. The controller's current required-context cache (read_at2026-10-11T17:04:48Z) lists this context on dev; the dispatch premise that it was optional was false.The old canonical-file-shape revision refused this file at its new path as
new-exception-file. The hook and CI job advance together to the same core revision that accepts the caller's declaration. The focused check runs in existing CI and pre-commit, andcontracts/OMN-21005.yamlbinds each criterion to executabletest_passescommands. Application dependencies and the lock stay unchanged; the tests use isolated core 0.47.41 as the canary did. The live parity probe below uses the exact pinned core source.Lab: host=h101 lane=occ-ret-intelguard2-i4-8e80 command=uv run pytest tests/ci/test_imperative_contract_guard_caller_omn21005.py -q -n 0 observed=head 5 passed; merge base 5 failed; DoD head 3 verified, base 3 failed; pinned core/OCC clean 0/0 and planted live handler 1/1; shrink-only control refused extra path; old shape refused, new shape accepted; clean-root, changed-file pre-commit and actionlint passed.
AC3 scanned isolated copies of the tree with freestanding scanning enabled. Raw
httpx.getplanted in the live demotion handler produced one undeclared HTTP transport in each pinned guard; clean trees produced zero new findings. Findings match exactly. The planted request was scanned without execution. The core ratchet admitted unchanged and shrinking lists and refused a planted extra path.Historical parity is against the requested OCC revision. The old caller pinned only its reusable workflow; that workflow defaults its validator checkout to main without an explicit input.
The full changed-file pre-commit run passed on h101, including clean-root, secrets and public-repository hygiene. No root-file exception, baseline or suppression annotation was added.
Evidence-Ticket: OMN-21005
Evidence-Source: OCC#13706