Repository navigation
feat(OMN-18641): refuse a DoD check that expires by construction - #10136
Merged
Merged
Conversation
Contributor
Author
|
No OCC evidence companion was minted for this PR. the product repo 'OmniNode-ai/onex_change_control' IS the OCC repo, so this PR is itself an OCC evidence record; no companion is authored for one (OMN-16440, specimens OCC#6927/#6958) Matched in the repo: To clear this: Nothing to do. An OCC evidence PR carries its own evidence in its own diff; the companion it was declined would have carried only a bare existence probe. Reported by |
jonahgabriel
force-pushed
the
jonah/omn-18641-expiring-dod-check-lint
branch
from
September 18, 2026 03:05
60f44e4 to
f79a8ea
Compare
jonahgabriel
added a commit
that referenced
this pull request
Sep 18, 2026
…10136 occ-preflight eligibility reported OMN-18641's evidence verifies (receipts PASS, hashes bound) but no structural receipt bound this specific OCC PR (#10136 -- the App-authored implementation PR opened via open-pr-as-writer-app.yml). Mint the requested structural binding receipt under drift/occ_bindings, per the gate's own remediation text: not declared in dod_evidence, no binds_ac, no contract_entry_sha256 for an undeclared item.
jonahgabriel
added a commit
that referenced
this pull request
Sep 18, 2026
…on check Contract Compliance Check re-executes dod-OmniNode-ai-onex_change_control-pr-10122's check_value fresh against every later PR bound to this ticket. That item asserts scripts/validation/check_expiring_dod_checks.py does NOT exist -- true when PR #10122 registered the allowlist path alone, and permanently false once this PR (#10136) lands the implementation, by the split this contract's own summary describes. Append a new dod_evidence item that supersedes it (evidence_artifact: supersedes_dod_evidence:dod-OmniNode-ai-onex_change_control-pr-10122) and proves the real state instead: the new test suite (tests/test_expiring_dod_checks_omn18641.py) passes. pytest is an EXECUTED probe, not a TEXT_READING_COMMAND, so the OUTSIDE-ITS-OWN-DIFF rule does not demote it even though the test file is added by this same PR. Verified locally: uv run python scripts/ci/run_contract_compliance_check.py --pr 10136 --repo OmniNode-ai/onex_change_control --contracts-dir contracts -> 1/3 PASS, 2 WARN, 0 BLOCK, "[PASS] All executable DoD checks satisfied."
A check that fetches an artifact at a PINNED sha and then asserts that artifact is recent RELATIVE TO NOW is true the day it is authored and false forever after. The sha cannot change, so the artifact cannot get newer, so the predicate can only rot, and no action anywhere restores it. contracts/OMN-13034.yaml carries three such pairs. On 2026-09-17 the newest crossed its seven-day horizon and took Contract Compliance Check to 2/17 PASS, 13 WARN, 2 BLOCK. Every OCC companion bound to that ticket blocked, which killed omnibase_infra#3726 and would have killed every successor it had. The contract's own prose shows the shape was accepted rather than missed: "each refresh of the census must re-point this probe at its own head". That is a treadmill -- each refresh hand-authors a fresh pair that starts expiring immediately -- and this gate is what ends it. Pinning is never discouraged; it is what makes evidence reproducible. Only the COMBINATION with a now-relative predicate is the defect. Two shapes are explicitly allowed and pinned by tests: a pinned ref with an exact-value assertion, and a now-relative assertion against an UNPINNED ref, which reads live state and is supposed to track the calendar. Wired as enforcement, not detection (rule 5): an unconditional job in ci.yml and an entry in ci_summary_gate's strict list, so the corpus is scanned on every PR rather than when someone remembers. WHAT THIS DOES NOT DO, and why. The six existing OMN-13034 entries are NOT repaired here. A DoD receipt is hash-bound to the entry it attests, so editing them invalidates ten receipts, and check_contract_change_rebinds_receipts.py refuses that -- correctly: a receipt whose expected hash is edited to match a changed check now attests to a check that never ran, which is the exact false-attestation failure this evidence plane exists to prevent. The documented repair is supersession, which is its own change in an append-only corpus. So they are recorded on a shrink-only debt baseline rather than tolerated in silence. Being on it is not permission: every occurrence NOT on it fails, which is what stops a seventh pair being authored. And a repaired entry must LEAVE the list -- the gate fails while a baselined entry no longer carries the shape, so the list cannot outlive the debt it records. The repair shape the follow-up must use is recorded and proven accepted by a test: measure age against the pinned COMMIT's own date. That keeps the seven-day claim, which dropping the assertion entirely would not.
…10136 occ-preflight eligibility reported OMN-18641's evidence verifies (receipts PASS, hashes bound) but no structural receipt bound this specific OCC PR (#10136 -- the App-authored implementation PR opened via open-pr-as-writer-app.yml). Mint the requested structural binding receipt under drift/occ_bindings, per the gate's own remediation text: not declared in dod_evidence, no binds_ac, no contract_entry_sha256 for an undeclared item.
…on check Contract Compliance Check re-executes dod-OmniNode-ai-onex_change_control-pr-10122's check_value fresh against every later PR bound to this ticket. That item asserts scripts/validation/check_expiring_dod_checks.py does NOT exist -- true when PR #10122 registered the allowlist path alone, and permanently false once this PR (#10136) lands the implementation, by the split this contract's own summary describes. Append a new dod_evidence item that supersedes it (evidence_artifact: supersedes_dod_evidence:dod-OmniNode-ai-onex_change_control-pr-10122) and proves the real state instead: the new test suite (tests/test_expiring_dod_checks_omn18641.py) passes. pytest is an EXECUTED probe, not a TEXT_READING_COMMAND, so the OUTSIDE-ITS-OWN-DIFF rule does not demote it even though the test file is added by this same PR. Verified locally: uv run python scripts/ci/run_contract_compliance_check.py --pr 10136 --repo OmniNode-ai/onex_change_control --contracts-dir contracts -> 1/3 PASS, 2 WARN, 0 BLOCK, "[PASS] All executable DoD checks satisfied."
…DoD item occ-preflight eligibility reported dod-omn-18641-implementation-lands-pr-10136 missing a PASS receipt (contract verifies, no receipt bound). Mint it at the canonical drift/dod_receipts/<TICKET>/<ITEM_ID>/command.yaml location, pinned to the contract's current sha256 and run against the real pytest suite.
jonahgabriel
force-pushed
the
jonah/omn-18641-expiring-dod-check-lint
branch
from
September 18, 2026 03:40
9c18a78 to
ddb3d4e
Compare
jonahgabriel
enabled auto-merge (squash)
September 18, 2026 03:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-18641
Opened as the onexbot-occ-writer App through the OMN-18327
dispatch path (.github/workflows/open-pr-as-writer-app.yml),
dispatched by @jonahgabriel.
Change-control PRs on this repo's privileged surfaces are opened
as the App rather than under the shared human account: every lane
here commits as one person, so a human-authored PR on an owned
path is un-approvable by construction, which is what froze the
fleet behind OCC#9362 on 2026-09-13.
This workflow merges nothing. Every existing required check gates
this PR exactly as it gates any other.
Evidence-Ticket: OMN-18641
Evidence-Source: OCC#10137