Repository navigation
chore(occ-deps): update rerun state after b08400b9 - #1412
Closed
github-actions[bot] wants to merge 2 commits into
Closed
github-actions[bot] wants to merge 2 commits into
github-actions[bot] wants to merge 2 commits into
Conversation
Contributor
jonahgabriel
added a commit
that referenced
this pull request
Jul 10, 2026
The base dod-occ-companion-self receipt (merged in #3777) bound only a whole-file contract_sha256 with no pr_number, so appending this PR's two new dod_evidence entries broke is_bound_to_this_pr's grandfather clause and failed verify/verify on PR #3787 with "whole-file hash mismatch" (observed in CI run 29068074586). Add a net-new command.supersede.0001.yaml (no merged file edited) that rebinds the same historical PASS fact via a per-entry contract_entry_sha256, which is immune to future dod_evidence appends. Locally simulated validate_pr_receipts() for both this OCC PR (pr_number=3787) and omnibase_core PR #1412 (pr_number=1412): both now PASS all 5 checks.
jonahgabriel
added a commit
that referenced
this pull request
Jul 10, 2026
…up (#3787) * evidence(OMN-14223): OCC companion for omnibase_core #1412 core cleanup Appends independent-verification evidence to the existing (merged, append-only) OMN-14223 contract for omnibase_core PR #1412, which deletes the 6 OCC-stamp source files + 6 dedicated unit tests now canonical in omnibase_compat 0.5.6 (PR #173, bound by the original #3777 companion). Does not touch the 3 entries merged by #3777. * evidence(OMN-14223): self-bind core-1412 companion Rebind the dod-occ-companion-core-1412-self receipt's commit_sha from the placeholder (prior origin/dev tip) to the real commit that added it, so occ-preflight validates this companion PR's own eligibility. * evidence(OMN-14223): record OCC PR #3787 number on self-bind receipt Adds pr_number: 3787 (this OCC companion's own GitHub PR number, now known) to dod-occ-companion-core-1412-self as additional defense-in-depth alongside the existing commit_sha binding, per pr_ticket_mismatch hardening guidance. * evidence(OMN-14223): supersede dod-occ-companion-self whole-file binding The base dod-occ-companion-self receipt (merged in #3777) bound only a whole-file contract_sha256 with no pr_number, so appending this PR's two new dod_evidence entries broke is_bound_to_this_pr's grandfather clause and failed verify/verify on PR #3787 with "whole-file hash mismatch" (observed in CI run 29068074586). Add a net-new command.supersede.0001.yaml (no merged file edited) that rebinds the same historical PASS fact via a per-entry contract_entry_sha256, which is immune to future dod_evidence appends. Locally simulated validate_pr_receipts() for both this OCC PR (pr_number=3787) and omnibase_core PR #1412 (pr_number=1412): both now PASS all 5 checks. * fix(OMN-14223): drop contract_entry_sha256 from base receipts (version skew) check_receipt_hardening.py runs against onex_change_control's own PyPI-pinned omnibase-core (>=0.45.0,<0.46.0), which predates the contract_entry_sha256 field (OMN-13888, only on the git-ref-pinned bleeding-edge omnibase_core used by the append-only-gate and receipt-gate @main reusable workflows). The CI "Pre-commit" job's receipt-hardening step failed with "Extra inputs are not permitted" for both new base receipts. Fix: drop contract_entry_sha256 from the two base receipts and rely on contract_sha256 + pr_number (matching the precedent dod-omnibase-compat-pr-173 / dod-local-verification entries) — the pr_number binding correctly grandfathers these receipts against future contract growth via is_bound_to_this_pr, so per-entry hashing isn't needed here. The command.supersede.0001.yaml replacement keeps contract_entry_sha256, since check_receipt_hardening.py skips .supersede. files entirely (only validated by the bleeding-edge validate_pr_receipts / append-only gate). Re-verified locally with env -u PYTHONPATH (the real venv, matching CI exactly, since ambient PYTHONPATH in my shell was shadowing the venv with the canonical clone and produced a false local pass): check_receipt_hardening.py 0 violations, Receipt Honesty Gate 0 violations, append-only clean, and validate_pr_receipts() against the bleeding-edge clone (matching the verify/verify @main reusable workflow) still PASSES all 5 checks for both pr_number=3787 (this OCC PR) and pr_number=1412 (omnibase_core PR) contexts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated OCC rerun state update for merge b08400b.\n\nThis PR is opened instead of direct-pushing to protected main.
Evidence-Ticket: OMN-11758
Receipt-Gate-Requeue: 2026-05-23T18:23:43Z