Skip to content

evidence(OMN-12243): bind core guard receipt to PR - #1724

Merged
jonahgabriel merged 1 commit into
devfrom
codex/omn-12243-core-pr-receipt
May 26, 2026
Merged

jonahgabriel merged 1 commit into
devfrom
codex/omn-12243-core-pr-receipt

Conversation

@jonahgabriel

@jonahgabriel jonahgabriel commented May 26, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Adds PR-bound OCC evidence for omnibase_core#1171 so Receipt Gate can validate the OMN-12243 main-target-guard hotfix.

Verification

  • uv run validate-yaml contracts/OMN-12243.yaml
  • uv run pre-commit run --files contracts/OMN-12243.yaml drift/dod_receipts/OMN-12243/.../command.yaml

Summary by CodeRabbit

  • New Features

    • Added main-target protection workflow with automated verification checks to enhance deployment security
  • Chores

    • Updated verification evidence records with refreshed checksums across multiple deployment components to maintain integrity and audit compliance

Review Change Stack

@jonahgabriel
jonahgabriel added this pull request to the merge queue May 26, 2026
@coderabbitai

coderabbitai Bot commented May 26, 2026 •

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d7dca43c-5e99-4953-b84e-d42ab9108f88

📥 Commits

Reviewing files that changed from the base of the PR and between 2bb1ee9 and fb3b589.

📒 Files selected for processing (6)
  • contracts/OMN-12243.yaml
  • drift/dod_receipts/OMN-12243/dod-main-target-guard-bootstrap-prs/command.yaml
  • drift/dod_receipts/OMN-12243/dod-omnibase-core-pr-1171/command.yaml
  • drift/dod_receipts/OMN-12243/dod-omnibase-infra-pr-1768/command.yaml
  • drift/dod_receipts/OMN-12243/dod-omniclaude-pr-1684/command.yaml
  • drift/dod_receipts/OMN-12243/dod-omnimarket-pr-931/command.yaml

📝 Walkthrough

Walkthrough

This PR extends the OMN-12243 contract with a new main-target-guard workflow evidence entry and creates a corresponding evidence receipt file. The contract hash update triggers refreshes of the contract_sha256 values across four existing evidence files to maintain referential integrity.

Changes

Contract Evidence and Hash Update

Layer / File(s) Summary
Add main-target-guard evidence entry and receipt
contracts/OMN-12243.yaml, drift/dod_receipts/OMN-12243/dod-omnibase-core-pr-1171/command.yaml
New dod-omnibase-core-pr-1171 evidence entry added to the contract with a verification check asserting PASS status. Corresponding command.yaml receipt file created with full metadata including probe details, timestamps, commit SHA, and recorded PASS output with exit code 0.
Refresh contract_sha256 in evidence files
drift/dod_receipts/OMN-12243/dod-main-target-guard-bootstrap-prs/command.yaml, drift/dod_receipts/OMN-12243/dod-omnibase-infra-pr-1768/command.yaml, drift/dod_receipts/OMN-12243/dod-omniclaude-pr-1684/command.yaml, drift/dod_receipts/OMN-12243/dod-omnimarket-pr-931/command.yaml
Four existing evidence files update their contract_sha256 field to match the refreshed contract hash, preserving all other receipt fields and run metadata unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

  • OmniNode-ai/onex_change_control#1124: Both PRs extend dod_evidence entries in contract YAMLs with corresponding drift/dod_receipts/**/command.yaml evidence records that validate outcomes via status: PASS checks, following the same evidence-binding pattern.

Poem

🐰 A guardian for the main branch stands tall,
New evidence recorded in receipts, one and all,
Hashes refresh with each contract refrain,
Protection and trust flow through the chain,
OMN-12243 grows ever more sane! 🛡️

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/omn-12243-core-pr-receipt

Comment @coderabbitai help to get the list of available commands and usage tips.

Merged via the queue into dev with commit 8d9b915 May 26, 2026
26 of 28 checks passed
@jonahgabriel
jonahgabriel deleted the codex/omn-12243-core-pr-receipt branch May 26, 2026 16:48
jonahgabriel added a commit that referenced this pull request Jul 12, 2026
…rving checks pinned to head SHA

Unblocks omnimarket#1724, whose occ-preflight fails with reason=missing_contract
(cascading into OCC Preflight Dependency + 4 gates that then refuse to start).

Both substantive check_values are CONTENT READS pinned to #1724's head SHA
(dbfc5d6bc72b0bddd83c3d6313ac03fff6165d28). They observe the product source, not
this receipt corpus. A CI-outcome check would be circular: #1724's CI is red
BECAUSE this contract is missing.

RED direction proven by execution for both checks:
  emitter compute_contract_entry_sha256  #1724 -> exit 0 | dev -> exit 1 | bogus SHA -> exit 1
  stamp CONTRACT_ENTRY_SHA_LINE_RE       #1724 -> exit 0 | dev -> exit 1 | bogus SHA -> exit 1
Bare existence (--jq .sha) rejected for occ_evidence_stamp.py: the file exists on
dev too, so existence does not discriminate.
jonahgabriel added a commit that referenced this pull request Jul 12, 2026
…rving checks pinned to head SHA (#4008)

* evidence(OMN-14418): OCC companion for omnimarket#1724 — product-observing checks pinned to head SHA

Unblocks omnimarket#1724, whose occ-preflight fails with reason=missing_contract
(cascading into OCC Preflight Dependency + 4 gates that then refuse to start).

Both substantive check_values are CONTENT READS pinned to #1724's head SHA
(dbfc5d6bc72b0bddd83c3d6313ac03fff6165d28). They observe the product source, not
this receipt corpus. A CI-outcome check would be circular: #1724's CI is red
BECAUSE this contract is missing.

RED direction proven by execution for both checks:
  emitter compute_contract_entry_sha256  #1724 -> exit 0 | dev -> exit 1 | bogus SHA -> exit 1
  stamp CONTRACT_ENTRY_SHA_LINE_RE       #1724 -> exit 0 | dev -> exit 1 | bogus SHA -> exit 1
Bare existence (--jq .sha) rejected for occ_evidence_stamp.py: the file exists on
dev too, so existence does not discriminate.

* evidence(OMN-14418): normalize OCC receipt bindings

* evidence(OMN-14418): bind companion to OCC PR
jonahgabriel added a commit that referenced this pull request Jul 12, 2026
occ-preflight failed #4012 with reason=pr_ticket_mismatch: every existing OMN-14418
receipt binds to the source (#1724) or to the earlier companion (#4008), and none to
#4012. Per validator_occ_merge_eligibility._receipt_bound_to_pr a receipt binds when
pr_number == the PR under check, or commit_sha is one of that PR's commits.

The merged dod-occ-self-commit receipt binds #4008 and is immutable under the
Append-Only Gate, so the binding for THIS PR is APPENDED as a net-new self-bind item
(dod-occ-self-commit-4012, pr_number: 4012) rather than edited into the existing one.

All three already-merged receipts re-verified: still bind after the append
(contract_entry_sha256 is immune to contract appends).

Substantive check unchanged and re-proven from the committed YAML:
  pulls/1724/files -> exit 0  GREEN (0 deploy surfaces)
  pulls/4/files    -> exit 1  RED   (Dockerfile.projection + docker-compose)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant