Repository navigation
fix(OMN-18601): bind the PSA evidence to omninode_infra#1580 on the lane that gate reads - #10440
Merged
Merged
Conversation
…ane that gate reads The eligibility gate on omninode_infra#1580 refused with pr_ticket_mismatch: all nine OMN-18601 receipts resolve and PASS, but none binds the PR under review. For a product-repo PR that binding is the PRODUCT repo's number, not the OCC companion's. occ-autobind did mint pr-1580 receipts, in OCC#10439, but merged them to this repository's DEV lane. A hotfix targeting omninode_infra main pins its evidence at OCC MAIN — the failing run recorded occ_commit_sha 4841460, main's head — and the two lanes carry different OMN-18601 contracts, so the dev-side binding is invisible from the lane being read. The test-suite receipt is the honest owner of the field: that suite was run on #1580's branch. No contract entry changes, so every contract_entry_sha256 on this lane stays valid and the whole-file hash is untouched. Refs: OMN-18601, OMN-18089 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5jA4UseYGEptrKijm4X9g
Eligibility on this PR needs a receipt naming this PR, the same way #1580 needs one naming #1580. The parity receipt carries it: its measurement is about the hotfix branch this companion evidences. No contract entry changes. Refs: OMN-18601 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5jA4UseYGEptrKijm4X9g
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Binds the OMN-18601 PSA evidence on this lane to
omninode_infra#1580, the hotfix that puts the Keycloak seed Job's pod-security fix on main.Why the gate refused
omninode_infra#1580's eligibility run returned:All nine OMN-18601 receipts resolve and are PASS. None binds the PR under review. For a product-repo PR that binding is the product repo's number —
_receipt_bound_to_pracceptsreceipt.pr_number == <PR under review>or acommit_shaamong the PR's commits — and the binding minted with OCC#10437 names the OCC companion, 10437, which is the right answer only when the PR under review is the OCC PR.The lane, which is the part worth knowing
occ-autobinddid mint pr-1580 receipts. They are in OCC#10439, merged to this repository'sdevlane at 16:51:13Z.A hotfix targeting
omninode_inframain pins its evidence at OCC main —occ_commit_sha 48414607above is main's head. The same ticket carries different contracts on the two lanes, so a dev-side binding is invisible from the lane the gate reads. The receipts exist; they are in the wrong place for this consumer.This change puts the binding where the pinned lane can see it.
dod-omn18601-psa-test-suiteis the honest owner of the field: that suite was run on #1580's branch.What this does not change
No contract entry is touched, so every
contract_entry_sha256on this lane stays valid and the whole-file hash is unchanged. No grant is authored, no workflow dispatched, andonex-prodkeeps running exactly what it runs now.OCC#10439 should not be closed on the strength of the bot's
already_boundnote. That note reasons about the merged-companion gate, which had indeed passed against OCC#10437; it says nothing about eligibility, which is what actually refused. Whether autobind minting todevfor a main-targeted hotfix is a defect is worth a separate look.hotfix-evidence: OCC-10437
backmerge: #1563
Evidence-Class: hotfix
Evidence-Ticket: OMN-18601
🤖 Generated with Claude Code
https://claude.ai/code/session_01P5jA4UseYGEptrKijm4X9g