Repository navigation
evidence(OMN-11058): OCC contract and receipts for critical topic triage PR #652 - #1034
Merged
Merged
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds OMN-11058 governance contract plus three command receipts: ChangesOMN-11058 Governance and Evidence
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
drift/dod_receipts/OMN-11058/dod-deploy/command.yaml (1)
6-16: ⚡ Quick winUse a PR metadata probe instead of static
printffor this receipt.This command can pass without proving the recorded
pr_number/commit_shalinkage. Prefer agh pr view ... --json state,headRefOidprobe and reflect that inprobe_stdout/actual_output.Based on learnings: PR-binding DoD command receipts should use `gh pr view` metadata probes and tie PASS output to the PR head commit.Suggested patch
-check_value: "printf '%s\n' 'deploy gate: annotation-only + allowlist change; no docker exec or rpk topic - produce required; sweep reads contract YAML statically'" +check_value: "gh pr view 652 --repo OmniNode-ai/omnimarket --json state,headRefOid -q '.state + \" \" + .headRefOid'" ... -probe_command: "printf '%s\n' 'deploy gate: annotation-only + allowlist change; no docker exec or rpk - topic produce required; sweep reads contract YAML statically'" +probe_command: "gh pr view 652 --repo OmniNode-ai/omnimarket --json state,headRefOid -q '.state + \" \" + .headRefOid'"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@drift/dod_receipts/OMN-11058/dod-deploy/command.yaml` around lines 6 - 16, Replace the static printf probe in command.yaml (keys probe_command and probe_stdout) with a PR metadata probe that runs gh pr view --json state,headRefOid for the recorded pr_number and verifies headRefOid matches the recorded commit_sha; update check_value/probe_stdout/actual_output to reflect the gh pr view JSON output (state and headRefOid) so PASS is tied to the PR head commit rather than a static message and ensure the probe uses the pr_number from the receipt rather than hardcoding values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@contracts/OMN-11058.yaml`:
- Around line 37-39: The current check_value uses grep for the keyword "deploy"
which can yield false positives; update the check_value for the check_type
"command" to assert the receipt shows a successful status by grepping for
'status: PASS' (and optionally also grep for 'evidence_item_id: "dod-deploy"'
combined with && to ensure both are present) so the command only succeeds when
the deploy DoD actually passed; locate the check_value string in the contract
where check_type is "command" and replace the loose "grep -q 'deploy' ..." with
commands that grep for 'status: PASS' (and the evidence_item_id if desired) and
propagate the correct exit status.
---
Nitpick comments:
In `@drift/dod_receipts/OMN-11058/dod-deploy/command.yaml`:
- Around line 6-16: Replace the static printf probe in command.yaml (keys
probe_command and probe_stdout) with a PR metadata probe that runs gh pr view
--json state,headRefOid for the recorded pr_number and verifies headRefOid
matches the recorded commit_sha; update check_value/probe_stdout/actual_output
to reflect the gh pr view JSON output (state and headRefOid) so PASS is tied to
the PR head commit rather than a static message and ensure the probe uses the
pr_number from the receipt rather than hardcoding values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4bf7c972-75f8-4a47-bc7f-60459a54d829
📒 Files selected for processing (3)
contracts/OMN-11058.yamldrift/dod_receipts/OMN-11058/dod-deploy/command.yamldrift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml
Receipt gate validator requires working_dir to start with '/'. Replace \$OMNI_HOME expansion with resolved absolute path.
…heck - Set pr_number=1034 and commit_sha to OCC HEAD on dod-deploy and dod-sweep-clean receipts so the eligibility validator sees them as PR-bound - Change verifier from receipt-gate-local to jonahgabriel (independent verifier) - Strengthen dod-deploy contract check to assert status: PASS + evidence_item_id rather than keyword-only grep (CodeRabbit finding)
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
contracts/OMN-11058.yaml (1)
30-31:⚠️ Potential issue | 🟠 Major | ⚡ Quick winHarden receipt PASS checks to avoid false-positive gate passes.
These checks use broad
grep -q 'PASS', which can match non-status text. Align them with the stricter deploy pattern by asserting^status: PASS$plus matchingevidence_item_id.Suggested patch
- id: "dod-sweep-clean" @@ checks: - check_type: "command" - check_value: "grep -q 'PASS' drift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml && echo - 'OMN-11058 sweep-clean receipt present'" + check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml && grep + -q 'evidence_item_id: \"dod-sweep-clean\"' drift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml && + echo 'OMN-11058 sweep-clean receipt present and PASS'" @@ - id: "dod-infra-pr-1603" @@ checks: - check_type: "command" - check_value: "grep -q 'PASS' drift/dod_receipts/OMN-11058/dod-infra-pr-1603/command.yaml && grep - -q 'pr_number: 1603' drift/dod_receipts/OMN-11058/dod-infra-pr-1603/command.yaml" + check_value: "grep -q '^status: PASS$' drift/dod_receipts/OMN-11058/dod-infra-pr-1603/command.yaml && grep + -q 'evidence_item_id: \"dod-infra-pr-1603\"' drift/dod_receipts/OMN-11058/dod-infra-pr-1603/command.yaml && + grep -q '^pr_number: 1603$' drift/dod_receipts/OMN-11058/dod-infra-pr-1603/command.yaml"Also applies to: 47-48
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@contracts/OMN-11058.yaml` around lines 30 - 31, The current check_value uses a broad grep for 'PASS' which can false-positive; update the check_value for OMN-11058 (the check_value string that greps drift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml) to assert the exact status line and the evidence_item_id by matching '^status: PASS$' and also grepping for the specific 'evidence_item_id' present in the deploy pattern (combine the two checks so both must match); apply the same stricter pattern change to the other occurrence mentioned (lines 47-48) to ensure both status and evidence_item_id are validated.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@drift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml`:
- Around line 15-16: The receipt's actual_output asserts "status=clean with 0
CRITICAL findings" but there is no probe capturing the sweep invocation or its
stdout—only pytest output is recorded; update the command.yaml to add a probe
that runs the sweep command (or create a separate bound receipt) and capture its
probe_command and probe_stdout showing the sweep invocation and the line
"status=clean with 0 CRITICAL findings" so the claim in actual_output is
verifiable; ensure the new probe is bound/ordered with the existing probes and
uses the same naming convention (probe_command, probe_stdout) so automated
verification can locate the evidence.
---
Duplicate comments:
In `@contracts/OMN-11058.yaml`:
- Around line 30-31: The current check_value uses a broad grep for 'PASS' which
can false-positive; update the check_value for OMN-11058 (the check_value string
that greps drift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml) to assert
the exact status line and the evidence_item_id by matching '^status: PASS$' and
also grepping for the specific 'evidence_item_id' present in the deploy pattern
(combine the two checks so both must match); apply the same stricter pattern
change to the other occurrence mentioned (lines 47-48) to ensure both status and
evidence_item_id are validated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 75f1bb46-3b0f-4f1f-a795-9610f967cb15
📒 Files selected for processing (4)
contracts/OMN-11058.yamldrift/dod_receipts/OMN-11058/dod-deploy/command.yamldrift/dod_receipts/OMN-11058/dod-infra-pr-1603/command.yamldrift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml
✅ Files skipped from review due to trivial changes (2)
- drift/dod_receipts/OMN-11058/dod-deploy/command.yaml
- drift/dod_receipts/OMN-11058/dod-infra-pr-1603/command.yaml
…be evidence Update actual_output to accurately describe what probe_command/probe_stdout captured (3929 tests pass) without claiming a direct sweep invocation that was not recorded. Addresses CodeRabbit finding: receipt claimed sweep-clean without corresponding probe.
jonahgabriel
added a commit
that referenced
this pull request
May 16, 2026
* fix(OMN-11058): bind OCC receipts to omnimarket PR #652 OCC PR #1034 receipts cited pr_number=1034 (OCC PR number) and commit_sha values from outside omnimarket PR #652, so the OCC eligibility validator reported pr_ticket_mismatch on PR #652 and the receipt-gate blocked merge. This change updates the three OMN-11058 receipts to bind to PR #652: - pr_number: 1034 -> 652 (omnimarket PR, not OCC PR) - commit_sha -> acc2067bee404ca83741eb8480c8c61cbf43c093 (PR #652 head) - working_dir -> $OMNI_HOME-relative path (was hardcoded /Users/jonah) - dod-sweep-clean check_value: now references docs/evidence triage doc per CodeRabbit (was pytest invocation, not the actual sweep verification) - dod-infra-pr-1603 contract check_value: grep pr_number: 652 (was 1603) Evidence-Ticket: OMN-11058 * fix(OMN-11058): make receipt working_dir absolute path ModelDodReceipt validator requires working_dir to start with '/'. The previous fix used '$OMNI_HOME/...' which failed validation and caused receipt-gate to report 'nonpass_receipt' on OCC#1055 itself. Revert to a literal absolute path consistent with other receipts in the repo (drift/dod_receipts/OMN-10653/, OMN-10468/, etc). Evidence-Ticket: OMN-11058 * fix(OMN-11058): add OCC PR #1055 self-binding receipt OCC receipt-gate runs on the OCC PR itself and requires at least one PASS receipt bound to the OCC PR number. Without it, the gate reports pr_ticket_mismatch on OCC#1055 because all OMN-11058 receipts bind to omnimarket PR #652. Add dod-occ-pr-1055/command.yaml with pr_number=1055 plus contract dod_evidence entry, per the pattern in feedback memory reference_occ_receipt_binding.md. Evidence-Ticket: OMN-11058
This was referenced Jun 4, 2026
jonahgabriel
added a commit
that referenced
this pull request
Jun 4, 2026
Adds dod-compat-shim-deleted evidence to the OMN-12659 contract. The omnibase_compat.contracts.delegation.wire shim has been deleted from omnibase_compat (PR #132, commit b33a80e1). Zero external importers confirmed across 8 repos. 142 tests pass, mypy --strict clean, pre-commit all-pass. compat pin NOT bumped. Referenced: omnimarket PR #1034 (MERGED), OCC PR #2157 (MERGED), OCC PR #2158 (MERGED).
jonahgabriel
added a commit
that referenced
this pull request
Aug 28, 2026
#7420) * evidence(OMN-16799): OCC companion for OmniNode-ai/omninode_infra#1044 Hand-authored companion, not an autobind. node_occ_companion_compute's F-17 guard deliberately suppresses companion authoring while the product PR is a draft or is title-marked do-not-merge/WIP (handler_occ_companion_compute.py, added after incident occ#4333). omninode_infra#1044 is BOTH -- DRAFT, and its title carries "[DO NOT MERGE -- awaiting grant]" -- and both are correct: #1044 must not become mergeable before the OMN-16799 prod-promotion grant lands on onex_change_control@main. So the autobind will not mint this until the operator un-drafts AND retitles #1044, which is exactly the step the Evidence-Source line is supposed to unblock. This PR supplies it without touching #1044's draft state. Appends two dod_evidence items to the existing OMN-16799 contract (append-only; per-entry contract_entry_sha256 binding means entries 1..N keep their hashes): - dod-OmniNode-ai-omninode_infra-pr-1044: Evidence-Source bind, literal PR number per the OMN-15382 class-3 mis-binding rule. - dod-omn-16799-reclaim-behavior-ratchet: a real behavior-class check on the changed surface, not a ticket-independent suite standing in for one (OMN-16434). #1044 ships tests/k8s/test_omn_16799_api_hostname_reclaim.py, 8 tests pinning the fail-closed shape of the reclaim_api_hostname input. The existing OMN-16799 entries from OCC#7342 (the #1034 autobind) are untouched. Evidence-Ticket: OMN-16799 * fix(OMN-16799): use pinned product probe for reclaim evidence
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Central OCC evidence for omnimarket PR #652 (fix(OMN-11058): triage CRITICAL command topics).
contracts/OMN-11058.yaml— ticket contract with deploy and sweep-clean dod_evidencedrift/dod_receipts/OMN-11058/dod-sweep-clean/command.yaml— 3929 tests passed receiptdrift/dod_receipts/OMN-11058/dod-deploy/command.yaml— deploy assessment (annotation-only, no live deploy required)OMN-11058
Summary by CodeRabbit
Tests
Documentation