Repository navigation
chore(OMN-18641): register the expiring-DoD-check gate before it lands - #10122
Merged
Merged
Conversation
First of two, and the order is forced by two gates that both refuse the combined change. check-human-authored-privileged-pr refuses a human-authored diff touching .github/workflows/ci.yml, scripts/ci/ or scripts/validation/. check-bot-authored-authz-guard refuses a BOT-authored diff touching allowlists/ or grants/, because a machine writer must never mint its own authorization. A single PR carrying both surfaces is refused whichever identity opens it -- the same topology CLAUDE.md rule 12 records for grants/. So the registry entry lands first, human-authored, alone. The gate it registers arrives in the App-authored PR that follows, which the scripts canonical-form guard would otherwise refuse as an unregistered new script. Registering a path before the file exists is deliberate and is the same "arm the requirement before the guard lands" shape the incident-replay registry uses. Verified rather than assumed: the registry's own hooks accept this entry on a tree where scripts/validation/check_expiring_dod_checks.py does not exist. The entry is permanent CI-layer glue on the same terms as its siblings check_yamlfmt_contamination.py and check_release_staleness.py, and cites OMN-18641 for what the gate is for: a DoD check that pins an artifact at a fixed sha and then asserts wall-clock freshness of it expires by construction, and three such pairs now block every OMN-13034 companion.
jonahgabriel
enabled auto-merge (squash)
September 18, 2026 00:21
jonahgabriel
deleted the
jonah/omn-18641-register-expiring-check-lint
branch
September 18, 2026 00:50
Contributor
|
No OCC evidence companion was minted for this PR. the product repo 'OmniNode-ai/onex_change_control' IS the OCC repo, so this PR is itself an OCC evidence record; no companion is authored for one (OMN-16440, specimens OCC#6927/#6958) Matched in the repo: To clear this: Nothing to do. An OCC evidence PR carries its own evidence in its own diff; the companion it was declined would have carried only a bare existence probe. Reported by |
jonahgabriel
added a commit
that referenced
this pull request
Sep 18, 2026
…on check Contract Compliance Check re-executes dod-OmniNode-ai-onex_change_control-pr-10122's check_value fresh against every later PR bound to this ticket. That item asserts scripts/validation/check_expiring_dod_checks.py does NOT exist -- true when PR #10122 registered the allowlist path alone, and permanently false once this PR (#10136) lands the implementation, by the split this contract's own summary describes. Append a new dod_evidence item that supersedes it (evidence_artifact: supersedes_dod_evidence:dod-OmniNode-ai-onex_change_control-pr-10122) and proves the real state instead: the new test suite (tests/test_expiring_dod_checks_omn18641.py) passes. pytest is an EXECUTED probe, not a TEXT_READING_COMMAND, so the OUTSIDE-ITS-OWN-DIFF rule does not demote it even though the test file is added by this same PR. Verified locally: uv run python scripts/ci/run_contract_compliance_check.py --pr 10136 --repo OmniNode-ai/onex_change_control --contracts-dir contracts -> 1/3 PASS, 2 WARN, 0 BLOCK, "[PASS] All executable DoD checks satisfied."
jonahgabriel
added a commit
that referenced
this pull request
Sep 18, 2026
…on check Contract Compliance Check re-executes dod-OmniNode-ai-onex_change_control-pr-10122's check_value fresh against every later PR bound to this ticket. That item asserts scripts/validation/check_expiring_dod_checks.py does NOT exist -- true when PR #10122 registered the allowlist path alone, and permanently false once this PR (#10136) lands the implementation, by the split this contract's own summary describes. Append a new dod_evidence item that supersedes it (evidence_artifact: supersedes_dod_evidence:dod-OmniNode-ai-onex_change_control-pr-10122) and proves the real state instead: the new test suite (tests/test_expiring_dod_checks_omn18641.py) passes. pytest is an EXECUTED probe, not a TEXT_READING_COMMAND, so the OUTSIDE-ITS-OWN-DIFF rule does not demote it even though the test file is added by this same PR. Verified locally: uv run python scripts/ci/run_contract_compliance_check.py --pr 10136 --repo OmniNode-ai/onex_change_control --contracts-dir contracts -> 1/3 PASS, 2 WARN, 0 BLOCK, "[PASS] All executable DoD checks satisfied."
jonahgabriel
added a commit
that referenced
this pull request
Sep 18, 2026
) * feat(OMN-18641): refuse a DoD check that expires by construction A check that fetches an artifact at a PINNED sha and then asserts that artifact is recent RELATIVE TO NOW is true the day it is authored and false forever after. The sha cannot change, so the artifact cannot get newer, so the predicate can only rot, and no action anywhere restores it. contracts/OMN-13034.yaml carries three such pairs. On 2026-09-17 the newest crossed its seven-day horizon and took Contract Compliance Check to 2/17 PASS, 13 WARN, 2 BLOCK. Every OCC companion bound to that ticket blocked, which killed omnibase_infra#3726 and would have killed every successor it had. The contract's own prose shows the shape was accepted rather than missed: "each refresh of the census must re-point this probe at its own head". That is a treadmill -- each refresh hand-authors a fresh pair that starts expiring immediately -- and this gate is what ends it. Pinning is never discouraged; it is what makes evidence reproducible. Only the COMBINATION with a now-relative predicate is the defect. Two shapes are explicitly allowed and pinned by tests: a pinned ref with an exact-value assertion, and a now-relative assertion against an UNPINNED ref, which reads live state and is supposed to track the calendar. Wired as enforcement, not detection (rule 5): an unconditional job in ci.yml and an entry in ci_summary_gate's strict list, so the corpus is scanned on every PR rather than when someone remembers. WHAT THIS DOES NOT DO, and why. The six existing OMN-13034 entries are NOT repaired here. A DoD receipt is hash-bound to the entry it attests, so editing them invalidates ten receipts, and check_contract_change_rebinds_receipts.py refuses that -- correctly: a receipt whose expected hash is edited to match a changed check now attests to a check that never ran, which is the exact false-attestation failure this evidence plane exists to prevent. The documented repair is supersession, which is its own change in an append-only corpus. So they are recorded on a shrink-only debt baseline rather than tolerated in silence. Being on it is not permission: every occurrence NOT on it fails, which is what stops a seventh pair being authored. And a repaired entry must LEAVE the list -- the gate fails while a baselined entry no longer carries the shape, so the list cannot outlive the debt it records. The repair shape the follow-up must use is recorded and proven accepted by a test: measure age against the pinned COMMIT's own date. That keeps the seven-day claim, which dropping the assertion entirely would not. * chore(OMN-18641): mint the occ-preflight structural self-bind for PR #10136 occ-preflight eligibility reported OMN-18641's evidence verifies (receipts PASS, hashes bound) but no structural receipt bound this specific OCC PR (#10136 -- the App-authored implementation PR opened via open-pr-as-writer-app.yml). Mint the requested structural binding receipt under drift/occ_bindings, per the gate's own remediation text: not declared in dod_evidence, no binds_ac, no contract_entry_sha256 for an undeclared item. * chore(OMN-18641): supersede the registration-time absent-implementation check Contract Compliance Check re-executes dod-OmniNode-ai-onex_change_control-pr-10122's check_value fresh against every later PR bound to this ticket. That item asserts scripts/validation/check_expiring_dod_checks.py does NOT exist -- true when PR #10122 registered the allowlist path alone, and permanently false once this PR (#10136) lands the implementation, by the split this contract's own summary describes. Append a new dod_evidence item that supersedes it (evidence_artifact: supersedes_dod_evidence:dod-OmniNode-ai-onex_change_control-pr-10122) and proves the real state instead: the new test suite (tests/test_expiring_dod_checks_omn18641.py) passes. pytest is an EXECUTED probe, not a TEXT_READING_COMMAND, so the OUTSIDE-ITS-OWN-DIFF rule does not demote it even though the test file is added by this same PR. Verified locally: uv run python scripts/ci/run_contract_compliance_check.py --pr 10136 --repo OmniNode-ai/onex_change_control --contracts-dir contracts -> 1/3 PASS, 2 WARN, 0 BLOCK, "[PASS] All executable DoD checks satisfied." * chore(OMN-18641): mint the PASS receipt for the implementation-lands DoD item occ-preflight eligibility reported dod-omn-18641-implementation-lands-pr-10136 missing a PASS receipt (contract verifies, no receipt bound). Mint it at the canonical drift/dod_receipts/<TICKET>/<ITEM_ID>/command.yaml location, pinned to the contract's current sha256 and run against the real pytest suite. * chore(OMN-18641): re-pin implementation-lands receipt after rebase --------- Co-authored-by: jonahgabriel <jonah@omninode.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First of two. The order is forced, and by two gates that are both right.
Why this cannot be one PR
.github/workflows/ci.yml,scripts/ci/,scripts/validation/—check-human-authored-privileged-prallowlists/,grants/—check-bot-authored-authz-guard, because a machine writer must never mint its own authorizationA single PR carrying both surfaces is refused whichever identity opens it. That is the same topology
CLAUDE.mdrule 12 records forgrants/, and it applies toallowlists/too. Confirmed the hard way: this change was refused as a human PR (#10120), re-opened as the App (#10121), and refused again from the other side.So the registry entry lands first, human-authored, alone. The gate it registers arrives in the App-authored PR that follows — which the scripts canonical-form guard would otherwise refuse as an unregistered new script.
Registering a path before the file exists
Deliberate, and the same "arm the requirement before the guard lands" shape the incident-replay registry uses. Verified rather than assumed: the registry's own hooks accept this entry on a tree where
scripts/validation/check_expiring_dod_checks.pydoes not exist. Had they not, the two gates would have deadlocked the change entirely and that would be the finding instead.What the gate is for
A DoD check that fetches an artifact at a pinned commit sha and then asserts that artifact is recent relative to now is true the day it is authored and false forever after — the sha cannot change, so the artifact cannot get newer, so the predicate can only rot.
contracts/OMN-13034.yamlcarries three such pairs. On 2026-09-17 the newest crossed its seven-day horizon and tookContract Compliance Checkto2/17 PASS, 13 WARN, 2 BLOCK, blocking every OCC companion bound to that ticket. The contract's own prose shows the shape was accepted rather than missed: "each refresh of the census must re-point this probe at its own head". That is a treadmill, and the gate ends it.Scope measured before wiring: 9083 contracts scanned, findings in exactly one — so the gate is safe to make required without a migration.
The entry
Permanent CI-layer glue on the same terms as its siblings
check_yamlfmt_contamination.pyandcheck_release_staleness.py, citing OMN-18641.Nothing executes from this PR. It is a registry line.