Repository navigation
feat(OMN-14168): RUNTIME_OPS_READBACK no-PR runtime-ops evidence gate - #1651
Merged
Merged
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 1 minute Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
added a commit
that referenced
this pull request
Jul 9, 2026
…fresh-ticket companion) Residual follow-up to #1653. The residual hypothesis ("OccAutobindAdapter only SYNCS an existing OCC contract and no-ops when a fresh ticket has none — the contract-CREATION path may be required to mint for a first-time ticket") is REFUTED against live code: - The create-if-absent branch already exists and is wired live: adapter_occ_autobind.py:285-294 writes contracts/<ticket>.yaml via _CONTRACT_TEMPLATE when `not contract_path.is_file()`, and the live OccAutobindAdapter has been injected in _ensure_sub_handlers since facb4e8 (2026-06-24, #1392) — never a noop on the merge_sweep path. - run_git uses check=True and re-raises CalledProcessError (occ_git_transport.py), so a failed OCC push RAISES → fix_applied=False → not counted. A mint failure can never surface as "fixed but no companion". The only clean-return-no-mint path is the idempotency guard (already Evidence-Source: OCC#-bound), which #1653 now gates via the OccCompanionVerifier read-back. The genuine gap was COVERAGE: the sole end-to-end test (TestAutobindForcePush) forced Path.is_file=True (the SYNC path), so nothing locked the CREATE path and the residual could not be falsified empirically. This adds TestAutobindCreatesContractForFreshTicket (2 tests), verifying the EFFECT (not the call), mirroring the #1653 mutation-test style: - fresh ticket (is_file=False) → a net-new contracts/<ticket>.yaml is WRITTEN with the contract template, the auto/* companion branch is force-pushed, and Evidence-Source: OCC#<n> is patched back onto the product PR. - existing contract (is_file=True) → SYNC binds receipts + pushes + patches WITHOUT rewriting the contract (OMN-13888 whole-file-hash: never modify an existing contract). Mutation-verified: reverting the `if not contract_path.is_file()` create guard (→ `if False`) makes test_fresh_ticket_mints_net_new_contract_and_pushes fail (only receipts written, no contract) — the test genuinely guards the mint. dod_evidence: - env -u PYTHONPATH uv run pytest tests/unit/nodes/node_pr_lifecycle_fix_effect/test_adapter_occ_autobind.py: 26 passed - node_pr_lifecycle_fix_effect + node_pr_lifecycle_orchestrator test dirs: 274 passed - mutation (revert create guard): fresh-ticket test FAILS as designed, source restored clean - ruff format + ruff check: clean; mypy --strict fix_effect node: Success (19 files) - pre-commit (changed file, OMNIBASE_INFRA_PATH set): all hooks pass - Live fresh-mint end-to-end proof: NOT run — no safe target (only open omnimarket PRs are #1653 [self-authoring prohibited] and #1651 [already bound OCC#3740]); merge_sweep has no single-PR scope. proof_class=code-only for the live link; create path is code-verified + mutation-locked. OCC companion for OMN-14173 is owed (Codex authors it per feedback_no_self_authored_evidence).
jonahgabriel
added a commit
that referenced
this pull request
Jul 9, 2026
… — verify pushed companion, not the call (#1653) * fix(OMN-14173): fail-closed prs_fixed accounting for OCC autobind arm — verify pushed companion, not the call merge_sweep --fix-only reported prs_fixed=2 on omnimarket #1651/#1652 while authoring ZERO OCC companions (a false-success of the exact class the tooling targets). Root cause = accounting, not routing. Trace: - Routing (STEP 2A): _block_reason_for_fix already routes occ-preflight/eligibility (with a ticket) to RECEIPT_EVIDENCE_SOURCE_AUTOBIND via the OCC-evidence subset match (handler_pr_lifecycle_orchestrator.py) — the OMN-13990 follow-up already landed this. The pre-supplied "{verify/verify}-only" diagnosis was stale vs HEAD. Re-asserted with a fresh witness test. - Accounting (STEP 2B, the real defect): HandlerPrLifecycleFix.handle set fix_applied=True whenever _route() returned without raising — including the no-op / idempotent / short-circuit paths that push NO companion. _fix_one then counted prs_dispatched=1 off fix_applied. Fix (fail-closed, verify the effect not the call): - New OccCompanionVerifier reads GitHub back after the autobind adapter runs and confirms all three: product PR body carries Evidence-Source: OCC#<n>, that OCC PR is OPEN, and the auto/* companion branch exists on the OCC remote. Any missing evidence / resolution error fails CLOSED (verified=False). - HandlerPrLifecycleFix gains occ_companion_verified on its result, set from the verifier for the autobind arm. Default verifier is fail-closed (proves nothing → counts nothing); the merge-sweep orchestrator injects the live verifier. - _fix_one gates prs_fixed for RECEIPT_EVIDENCE_SOURCE_AUTOBIND on occ_companion_verified, never on fix_applied. All other block reasons keep their existing dispatch semantics (no regression to merge arm, OccContractAdapter, CI/code/coderabbit arms). Tests (STEP 3, executed): new test_occ_companion_fail_closed_accounting.py proves (i) occ-preflight/eligibility routes to the autobind arm, (ii) an unverified / unpushed companion is NOT counted in prs_fixed (fail-closed), and the happy path counts exactly once. Live-adapter wiring test asserts the orchestrator injects the real OccCompanionVerifier. dod_evidence: - env -u PYTHONPATH uv run pytest tests/ -m "not kafka": 12271 passed, 60 skipped - new test_occ_companion_fail_closed_accounting.py: 7 passed - ruff format + ruff check --fix: clean - mypy --strict on both nodes: Success, no issues in 27 files - pre-commit (scoped to changed files, OMNIBASE_INFRA_PATH set): all hooks pass * test(OMN-14173): lock OccAutobindAdapter create-if-absent mint path (fresh-ticket companion) Residual follow-up to #1653. The residual hypothesis ("OccAutobindAdapter only SYNCS an existing OCC contract and no-ops when a fresh ticket has none — the contract-CREATION path may be required to mint for a first-time ticket") is REFUTED against live code: - The create-if-absent branch already exists and is wired live: adapter_occ_autobind.py:285-294 writes contracts/<ticket>.yaml via _CONTRACT_TEMPLATE when `not contract_path.is_file()`, and the live OccAutobindAdapter has been injected in _ensure_sub_handlers since facb4e8 (2026-06-24, #1392) — never a noop on the merge_sweep path. - run_git uses check=True and re-raises CalledProcessError (occ_git_transport.py), so a failed OCC push RAISES → fix_applied=False → not counted. A mint failure can never surface as "fixed but no companion". The only clean-return-no-mint path is the idempotency guard (already Evidence-Source: OCC#-bound), which #1653 now gates via the OccCompanionVerifier read-back. The genuine gap was COVERAGE: the sole end-to-end test (TestAutobindForcePush) forced Path.is_file=True (the SYNC path), so nothing locked the CREATE path and the residual could not be falsified empirically. This adds TestAutobindCreatesContractForFreshTicket (2 tests), verifying the EFFECT (not the call), mirroring the #1653 mutation-test style: - fresh ticket (is_file=False) → a net-new contracts/<ticket>.yaml is WRITTEN with the contract template, the auto/* companion branch is force-pushed, and Evidence-Source: OCC#<n> is patched back onto the product PR. - existing contract (is_file=True) → SYNC binds receipts + pushes + patches WITHOUT rewriting the contract (OMN-13888 whole-file-hash: never modify an existing contract). Mutation-verified: reverting the `if not contract_path.is_file()` create guard (→ `if False`) makes test_fresh_ticket_mints_net_new_contract_and_pushes fail (only receipts written, no contract) — the test genuinely guards the mint. dod_evidence: - env -u PYTHONPATH uv run pytest tests/unit/nodes/node_pr_lifecycle_fix_effect/test_adapter_occ_autobind.py: 26 passed - node_pr_lifecycle_fix_effect + node_pr_lifecycle_orchestrator test dirs: 274 passed - mutation (revert create guard): fresh-ticket test FAILS as designed, source restored clean - ruff format + ruff check: clean; mypy --strict fix_effect node: Success (19 files) - pre-commit (changed file, OMNIBASE_INFRA_PATH set): all hooks pass - Live fresh-mint end-to-end proof: NOT run — no safe target (only open omnimarket PRs are #1653 [self-authoring prohibited] and #1651 [already bound OCC#3740]); merge_sweep has no single-PR scope. proof_class=code-only for the live link; create path is code-verified + mutation-locked. OCC companion for OMN-14173 is owed (Codex authors it per feedback_no_self_authored_evidence).
…gate Adds the omnimarket half of the RUNTIME_OPS_READBACK no-PR runtime-ops evidence class (design docs/plans/2026-07-08-nopr-runtime-ops-evidence-class.md). Gives a genuine, independently-verified, no-source-change runtime-ops fix (kubectl patch / live restart / config repair — no repo diff, no PR) a closure path that does NOT re-open the self-attestation hole. Surface A — DurableEvidenceGate (node_dod_verify): - EnumDurableEvidenceCheck += RUNTIME_OPS_READBACK. - New pure services/runtime_ops_readback.py verifies a PASS receipt set: G1 verifier!=runner, G2a no PR + no mixing, G2b mutation_verb in the GOVERNED omnibase_core allowlist, G3 no_source_change + non-empty readback (+optional freshness), G4 prod target fails closed (OMN-13418 grant not waived), G5 prevention_followup linked. - evaluate() branches at the Check-2 boundary: when every PASS receipt is evidence_class==RUNTIME_OPS and none carries a pr_number, it runs the readback check instead of CONTRACT_CITES_MERGE_COMMIT; a mixed RUNTIME_OPS+PR set is refused. Check 1 (RECEIPT_TRACKED) and Check 5 (DONE_CLASS_LABEL, requiring RUNTIME_OBSERVED) are unchanged; Check 3 uses the runtime-ops contract stub's runtime_readback key so the contract-on-governance-ref invariant stays intact. Surface B — close gate (node_linear_triage): - EnumCloseEvidenceKind += RUNTIME_OPS_READBACK. - RuntimeOpsReadbackProbe + RuntimeOpsReadbackSubprocessProbe (fail-closed, git-backed, reuses the OCC probe plumbing) verify a tracked typed receipt. - _apply_runtime_ops_readback constructs the close evidence and routes through the single _mark_done chokepoint — never from a Linear label alone (G6). Surface C (L1 hook) is DEFERRED to OMN-13856; the autogen-tick caller wiring is also deferred. runtime-observed is NOT added to is_exempt(). BLOCKED-ON-CORE-RELEASE: this PR imports omnibase_core RUNTIME_OPS enum + runtime_ops_verb_loader, which ship in omnibase_core 0.46.7 (companion PR). omnimarket CI pulls the RELEASED omnibase_core, so verify/mypy stay RED until 0.46.7 is released; Codex sequences core release + merge. dod_evidence: built + fully gated locally against the sibling omnibase_core 0.46.7 worktree (UV_NO_SYNC + extracted wheel). mypy --strict clean (5 files); ruff format+check clean; pre-commit all hooks pass incl. DurableEvidenceGate regression; 289 node_dod_verify + node_linear_triage tests pass, incl. 30 new Surface-A acceptance/abuse + 22 new Surface-B probe/apply tests.
jonahgabriel
force-pushed
the
jonah/omn-14168-runtime-ops-readback-gate
branch
from
July 9, 2026 12:20
2596d91 to
6c114d2
Compare
✅ Architectural Review — PASSEDErrors: 0 What this checks
No architectural violations found. Static architectural lint — no model inference (OMN-14176). |
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical/error findings | No |
blocked |
CRITICAL or ERROR findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8524)
jonahgabriel
added a commit
that referenced
this pull request
Jul 10, 2026
…t dispatch Piece 5/5 of the OMN-14180 canonical OCC stamp-model. Generalizes the OMN-14173 OccCompanionVerifier read-back to EVERY fix arm and closes OMN-14174's dispatch-vs-effect over-count. The merge-sweep orchestrator (node_pr_lifecycle_orchestrator) used to increment prs_fixed on the strength of the fix handler returning fix_applied=True — i.e. on DISPATCH. Only the OCC-autobind arm was hardened (OMN-14173); every other arm (CODE_FAILURE / CI_FAILURE / CODERABBIT / CONFLICT), which mixed-failure PRs fall through to, still counted on dispatch. That over-counted prs_fixed for PRs where nothing landed (OMN-14174: omnimarket #1651/#1652 reported prs_fixed=2 with zero companions). Change: after a fix arm runs, the orchestrator performs an INDEPENDENT read-back over live gh/remote state — never the handler's self-reported flag (CLAUDE.md Rule 3) — and counts the fix ONLY when the OCC stamp is confirmed landed: (a) the referenced OCC companion PR exists on the remote and is open, and (b) the product PR body carries the Evidence-Source: OCC#<n> + Evidence-Ticket stamp, parsed via the Piece-2 canonical parser (omnibase_compat.contracts.pr_occ_stamp — the SAME parser the gate uses, no second extraction path). Fail-closed: a noop / dispatched-but-not-landed / dry-run arm counts 0. Arms that legitimately land no OCC stamp under-count (the safe direction OMN-14174 requires; full per-arm effect read-back is the deferred generalization). - New: node_pr_lifecycle_orchestrator/handlers/occ_stamp_readback.py (ProtocolOccStampReadback + live OccStampReadback via gh pr view + fail-closed _UnverifiedOccStampReadback default). Wired live in _ensure_sub_handlers. - _dispatch_fix_parallel._fix_one gates counted_as_fixed on the read-back for every arm (replaces the autobind-only occ_companion_verified special case). - metadata.yaml: declare the new omnibase_compat schema dependency. - pyproject: bump omnibase-compat ==0.5.5 -> ==0.5.6 (dependencies + override-dependencies); omnibase-core stays >=0.46.7,<0.47.0. Tests (all green locally): - false-success regression: noop dispatch, nothing landed -> prs_fixed == 0 - true-success: real companion landed (body stamped + OCC PR open) -> counted - over-count regression: mixed-failure CODE_FAILURE dispatch, no stamp -> 0 - read-back unit coverage (real Piece-2 parser, in-memory gh fetcher) Gate evidence: ruff format+check clean; mypy clean on the orchestrator node + new module + touched tests; node-metadata dependency check PASS; runtime import-check clean; /onex:compliance_sweep parity (0 new violations); node orchestrator/fix + integration + golden-chain + merge_sweep/e2e suites green. OCC companion: pending independent verifier (implementer does not self-author evidence). The Piece-2 OCC-stamp schema was relocated from omnibase_core to omnibase_compat under OMN-14223 (lowest shared layer). Depends on omnibase-compat 0.5.6 (omnibase_compat#173) being published to PyPI; validated locally against the compat-dev build.
jonahgabriel
added a commit
that referenced
this pull request
Jul 10, 2026
…t dispatch Piece 5/5 of the OMN-14180 canonical OCC stamp-model. Generalizes the OMN-14173 OccCompanionVerifier read-back to EVERY fix arm and closes OMN-14174's dispatch-vs-effect over-count. The merge-sweep orchestrator (node_pr_lifecycle_orchestrator) used to increment prs_fixed on the strength of the fix handler returning fix_applied=True — i.e. on DISPATCH. Only the OCC-autobind arm was hardened (OMN-14173); every other arm (CODE_FAILURE / CI_FAILURE / CODERABBIT / CONFLICT), which mixed-failure PRs fall through to, still counted on dispatch. That over-counted prs_fixed for PRs where nothing landed (OMN-14174: omnimarket #1651/#1652 reported prs_fixed=2 with zero companions). Change: after a fix arm runs, the orchestrator performs an INDEPENDENT read-back over live gh/remote state — never the handler's self-reported flag (CLAUDE.md Rule 3) — and counts the fix ONLY when the OCC stamp is confirmed landed: (a) the referenced OCC companion PR exists on the remote and is open, and (b) the product PR body carries the Evidence-Source: OCC#<n> + Evidence-Ticket stamp, parsed via the Piece-2 canonical parser (omnibase_compat.contracts.pr_occ_stamp — the SAME parser the gate uses, no second extraction path). Fail-closed: a noop / dispatched-but-not-landed / dry-run arm counts 0. Arms that legitimately land no OCC stamp under-count (the safe direction OMN-14174 requires; full per-arm effect read-back is the deferred generalization). - New: node_pr_lifecycle_orchestrator/handlers/occ_stamp_readback.py (ProtocolOccStampReadback + live OccStampReadback via gh pr view + fail-closed _UnverifiedOccStampReadback default). Wired live in _ensure_sub_handlers. - _dispatch_fix_parallel._fix_one gates counted_as_fixed on the read-back for every arm (replaces the autobind-only occ_companion_verified special case). - metadata.yaml: declare the new omnibase_compat schema dependency. - pyproject: bump omnibase-compat ==0.5.5 -> ==0.5.6 (dependencies + override-dependencies); omnibase-core stays >=0.46.7,<0.47.0. Tests (all green locally): - false-success regression: noop dispatch, nothing landed -> prs_fixed == 0 - true-success: real companion landed (body stamped + OCC PR open) -> counted - over-count regression: mixed-failure CODE_FAILURE dispatch, no stamp -> 0 - read-back unit coverage (real Piece-2 parser, in-memory gh fetcher) Gate evidence: ruff format+check clean; mypy clean on the orchestrator node + new module + touched tests; node-metadata dependency check PASS; runtime import-check clean; /onex:compliance_sweep parity (0 new violations); node orchestrator/fix + integration + golden-chain + merge_sweep/e2e suites green. OCC companion: pending independent verifier (implementer does not self-author evidence). The Piece-2 OCC-stamp schema was relocated from omnibase_core to omnibase_compat under OMN-14223 (lowest shared layer). Depends on omnibase-compat 0.5.6 (omnibase_compat#173) being published to PyPI; validated locally against the compat-dev build.
jonahgabriel
added a commit
that referenced
this pull request
Jul 10, 2026
…t dispatch (#1664) * fix(OMN-14191): merge-sweep counts prs_fixed only after read-back, not dispatch Piece 5/5 of the OMN-14180 canonical OCC stamp-model. Generalizes the OMN-14173 OccCompanionVerifier read-back to EVERY fix arm and closes OMN-14174's dispatch-vs-effect over-count. The merge-sweep orchestrator (node_pr_lifecycle_orchestrator) used to increment prs_fixed on the strength of the fix handler returning fix_applied=True — i.e. on DISPATCH. Only the OCC-autobind arm was hardened (OMN-14173); every other arm (CODE_FAILURE / CI_FAILURE / CODERABBIT / CONFLICT), which mixed-failure PRs fall through to, still counted on dispatch. That over-counted prs_fixed for PRs where nothing landed (OMN-14174: omnimarket #1651/#1652 reported prs_fixed=2 with zero companions). Change: after a fix arm runs, the orchestrator performs an INDEPENDENT read-back over live gh/remote state — never the handler's self-reported flag (CLAUDE.md Rule 3) — and counts the fix ONLY when the OCC stamp is confirmed landed: (a) the referenced OCC companion PR exists on the remote and is open, and (b) the product PR body carries the Evidence-Source: OCC#<n> + Evidence-Ticket stamp, parsed via the Piece-2 canonical parser (omnibase_compat.contracts.pr_occ_stamp — the SAME parser the gate uses, no second extraction path). Fail-closed: a noop / dispatched-but-not-landed / dry-run arm counts 0. Arms that legitimately land no OCC stamp under-count (the safe direction OMN-14174 requires; full per-arm effect read-back is the deferred generalization). - New: node_pr_lifecycle_orchestrator/handlers/occ_stamp_readback.py (ProtocolOccStampReadback + live OccStampReadback via gh pr view + fail-closed _UnverifiedOccStampReadback default). Wired live in _ensure_sub_handlers. - _dispatch_fix_parallel._fix_one gates counted_as_fixed on the read-back for every arm (replaces the autobind-only occ_companion_verified special case). - metadata.yaml: declare the new omnibase_compat schema dependency. - pyproject: bump omnibase-compat ==0.5.5 -> ==0.5.6 (dependencies + override-dependencies); omnibase-core stays >=0.46.7,<0.47.0. Tests (all green locally): - false-success regression: noop dispatch, nothing landed -> prs_fixed == 0 - true-success: real companion landed (body stamped + OCC PR open) -> counted - over-count regression: mixed-failure CODE_FAILURE dispatch, no stamp -> 0 - read-back unit coverage (real Piece-2 parser, in-memory gh fetcher) Gate evidence: ruff format+check clean; mypy clean on the orchestrator node + new module + touched tests; node-metadata dependency check PASS; runtime import-check clean; /onex:compliance_sweep parity (0 new violations); node orchestrator/fix + integration + golden-chain + merge_sweep/e2e suites green. OCC companion: pending independent verifier (implementer does not self-author evidence). The Piece-2 OCC-stamp schema was relocated from omnibase_core to omnibase_compat under OMN-14223 (lowest shared layer). Depends on omnibase-compat 0.5.6 (omnibase_compat#173) being published to PyPI; validated locally against the compat-dev build. * chore(OMN-14191): regen uv.lock for omnibase-compat 0.5.6 pyproject.toml already pinned omnibase-compat==0.5.6; uv.lock still resolved 0.5.5 (published before the pin landed). compat 0.5.6 is now live on PyPI — regenerate the lock so frozen sync resolves cleanly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-14168 — RUNTIME_OPS_READBACK no-PR runtime-ops evidence gate (omnimarket half)
Implements the omnimarket half of the RUNTIME_OPS_READBACK class per
docs/plans/2026-07-08-nopr-runtime-ops-evidence-class.md. Gives a genuine, independently-verified, no-source-change runtime-ops fix (kubectl patch / live restart / config repair — no repo diff, no PR) a closure path without re-opening the self-attestation hole.Surface A —
DurableEvidenceGate(node_dod_verify)EnumDurableEvidenceCheck += RUNTIME_OPS_READBACK.services/runtime_ops_readback.pyverifies a PASS receipt set against every guardrail: G1 verifier≠runner, G2a no PR + no RUNTIME_OPS/PR mixing, G2bmutation_verbin the governed omnibase_core allowlist, G3no_source_change+ non-empty readback (+ optional freshness), G4 prod target fails closed (OMN-13418 grant NOT waived; UNKNOWN fails closed), G5prevention_followuplinked.evaluate()branches at the Check-2 boundary: when every PASS receipt isevidence_class == RUNTIME_OPSand none carries apr_number, it runs the readback check instead ofCONTRACT_CITES_MERGE_COMMIT; a mixed set is refused. Check 1 (RECEIPT_TRACKED) and Check 5 (DONE_CLASS_LABEL requiring RUNTIME_OBSERVED) are unchanged. Check 3 uses the runtime-ops contract stub'sruntime_readbackkey so the contract-on-governance-ref invariant stays intact.Surface B — close gate (node_linear_triage)
EnumCloseEvidenceKind += RUNTIME_OPS_READBACK.RuntimeOpsReadbackProbe+RuntimeOpsReadbackSubprocessProbe(fail-closed, git-backed) verify a tracked typed receipt end-to-end._apply_runtime_ops_readbackconstructs the close evidence and routes through the single_mark_donechokepoint — never from a Linear label alone (G6).Deferred (out of scope, per operator)
linear_done_verify.py) → OMN-13856;runtime-observedis NOT added tois_exempt()._applystaged and directly tested).dod_evidence (verified locally against the sibling omnibase_core 0.46.7 worktree)
Because omnimarket CI pulls the released omnibase_core (0.46.6), local proof used the sibling 0.46.7 build (
UV_NO_SYNC=1+ extracted wheel):mypy --strict— Success, 5 changed files, 0 errors.ruff format/ruff check— clean.DurableEvidenceGate regressionhook.tests/unit/nodes/node_dod_verify+tests/nodes/node_linear_triage+tests/integration/node_dod_verify, incl. 30 new Surface-A acceptance/abuse (test_runtime_ops_readback_gate.py) and 22 new Surface-B probe/apply (test_omn_14168_runtime_ops_readback_close.py) tests. Acceptance regression accepts a well-formed readback and rejects each abuse (self-attested, PR-bearing, git-verb, label-only/untracked, prod-without-grant, stale, mixed, missing prevention).This PR imports
omnibase_coreEnumEvidenceClass.RUNTIME_OPS+validation.runtime_ops_verb_loader, which ship in omnibase_core 0.46.7 (companion PR OmniNode-ai/omnibase_core#1405). omnimarket CI resolves the released omnibase_core, so verify / mypy will be RED until 0.46.7 is released. This is expected — Codex sequences core release → then this merges.occ-preflightwill also be RED pending a NET-NEW OCC evidence companion (Evidence-Source: OCC#); perfeedback_no_self_authored_evidenceI do not author my own companion. Do NOT merge from here; Codex owns the queue.Closes OMN-14168
Evidence-Source: OCC#3740
Evidence-Ticket: OMN-14168