Repository navigation
feat(OMN-18601): OCC evidence for the prod manifest arm's immutable-Job guard - #10463
Merged
Merged
Conversation
…ob guard Three items for the omninode_infra change that ports the OMN-15812 pre-apply Job guard into deploy-onex-prod.yml's manifest arm, after run 35465514637 failed in the apply on an immutable Job template. dod-omn18601-prod-job-guard-asymmetry names the defect as a count rather than a theory: 14 OMN-15812 references in deploy-onex-staging.yml against 0 in deploy-onex-prod.yml, which is why identical bytes applied cleanly on dev-system and were refused in production. It also rules out what was NOT the cause — every gate premise passed, the dispatch gating was correct, and the rendered Job carries the admissibility fix. dod-omn18601-prod-job-guard-detects proves the ported guard fires, measured against LIVE onex-prod and non-mutating: the server dry-run of the rendered Job returns "field is immutable", the literal the guard's IMMUTABLE_CONFLICT_RE matches, while the SAME dry-run on the ConfigMap in the same namespace succeeds. A dry-run failing on both would have proven nothing. The DELETE half is deliberately not exercised, because exercising it would mutate production, and the receipt says so rather than implying coverage it does not have. dod-omn18601-prod-job-guard-placed-and-bounded asserts by parsing that the guard is step 14, strictly between the gate at 13 and the apply at 15 — so it can never delete on an unauthorized dispatch — and that its 94 executable lines carry an explicit allowlist and no cluster-wide Job sweep. The checker reads executable lines only, because the guard's comments discuss the sweep it refuses to do; that produced a false positive on the first run and was corrected rather than papered over by loosening the assertion. Verified before pushing: all 17 declared check_values execute, every contract_entry_sha256 equals the recomputed per-entry hash, the fourteen pre-existing entries still bind their merged receipts, honesty rules clean, no corruption sentinel. Refs: OMN-18601, OMN-15812, OMN-18764 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5jA4UseYGEptrKijm4X9g
Eligibility binds a ticket's evidence to the PR under review by pr_number. No contract entry changes, so every per-entry hash stays valid. Refs: OMN-18601 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5jA4UseYGEptrKijm4X9g
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OCC evidence for the
omninode_infrachange that ports the OMN-15812 pre-apply Job guard intodeploy-onex-prod.yml's manifest arm.Why
Run 35465514637 passed every premise the manifest arm enforces — grant match,
rendered_digestmatch, subtree bound, staging-apply receipt bound to the promoted commitad45e2cc— and then failed in the apply:A
batch/v1Job's.spec.templateis immutable, so the inert Job left inonex-prodby the 2026-09-18 reconcile (uid d612f3af, zero pods ever admitted) was an unremovable obstacle to applying the corrected manifest over it.The cause is a counted asymmetry, not a theory:
deploy-onex-staging.ymlcarries 14 OMN-15812 references,deploy-onex-prod.ymlcarried 0. Same bytes, clean on dev-system, refused in production.The three items
…-asymmetry…-detectsonex-prod…-placed-and-boundedTwo things stated rather than glossed
The DELETE half is not exercised. Testing it would mutate production — it would remove the live Job. Its correctness rests on the ported branch being the staging guard's own delete-then-let-SSA-recreate step, which has run this path since OMN-15812, plus the detection half proven here deciding whether it runs at all. The receipt says this instead of implying coverage it doesn't have.
My structure checker had a false positive on its first run. It matched
get jobsinside the guard's own comment explaining why it refuses to sweep. Fixed by having it read executable lines only — not by loosening the assertion.Verification before pushing
All 17 declared
check_values execute; everycontract_entry_sha256equals the recomputed per-entry hash; the fourteen pre-existing entries still bind their merged receipts; honesty rules clean; no corruption sentinel. The live probe was non-mutating: a server dry-run persists nothing and no delete was issued, soonex-prodis exactly as the failed promotion left it.Nothing in production is mutated by merging this
Contract items and receipts only. No grant is authored here, no workflow dispatched.
hotfix-evidence: OCC-10454
backmerge: #1580
Evidence-Class: hotfix
Evidence-Ticket: OMN-18601
🤖 Generated with Claude Code
https://claude.ai/code/session_01P5jA4UseYGEptrKijm4X9g