Repository navigation
feat(OMN-12515): detect freestanding imperative IO across all of src/ - #1949
Merged
jonahgabriel merged 3 commits intoMay 30, 2026
Conversation
Extend the imperative-contract-compliance scanner to audit freestanding modules (everything under src/ outside node_*/handlers/), closing the detection hole where raw HTTP inference, direct DB connections, raw Kafka clients, hardcoded inference params, topics, LAN IPs, and subprocess network ops went unscanned. - scan_freestanding_imperative_io(): AST-based per-module detector - _find_freestanding_modules(): enumerate non-node-governed src/ modules - EnumComplianceViolation: HARDCODED_CONFIG, RAW_HTTP_INFERENCE, RAW_KAFKA, DIRECT_DB, SUBPROCESS_NETWORK - ModelFreestandingImperativeResult: typed per-module result with inline '# no-contract-check: <reason>' suppression - --scan-freestanding CLI flag wiring node handlers AND freestanding modules through scan_repo/scan_repos with allowlist reuse TDD: consumer.py-style fixture (raw httpx.post + max_tokens=2048) flagged; clean module not flagged; existing scanner tests unchanged.
Pair the central ticket contract and PASS DoD receipts for the freestanding imperative-IO scanner work: full-suite tests, mypy/ruff/pre-commit static checks, and the end-to-end SEA proof that --scan-freestanding now reports src/pipeline/consumer.py.
|
Warning Review limit reached
More reviews will be available in 36 minutes and 21 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (15)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…tcher - Add contract_sha256 (OMN-10421) to all three OMN-12515 DoD receipts so the main receipt-gate accepts them (the local venv model predates the field). - Narrow validate_pr_contracts _HANDLER_FILE_PATTERN: a bare handler*.py only counts as a node handler when it lives inside a node_*/ tree. Library modules like scanners/handler_contract_compliance.py no longer false-positive the Layer 3 contract-sync gate. Regression test added. - Drop the accidentally-committed transient evidence file; ignore .onex_state/.
jonahgabriel
added this pull request to the merge queue
May 30, 2026
jonahgabriel
deleted the
jonahgabriel/omn-12515-extend-imperative-contract-scanner-to-detect-freestanding
branch
May 30, 2026 22:48
jonahgabriel
added a commit
that referenced
this pull request
Jun 11, 2026
…ceipts (omnimarket #1176, infra #1949) Central OMN-12971 OCC contract + dod_receipts for the Vertex $500-credit ADC runtime wiring (omnimarket #1176 routing-overlay backend + secret-discipline ratchet; omnibase_infra #1949 ADC bearer-token delivery to effects container). Secret-ref discipline: only logical refs committed; token VALUE resolved fail-closed at the effect boundary. deploy_pending — no live deploy by the code PRs. dod-occ-pr receipt added in the follow-up commit once this PR number is known.
jonahgabriel
added a commit
that referenced
this pull request
Jun 11, 2026
…ceipts (omnimarket #1176, infra #1949) Central OMN-12971 OCC contract + dod_receipts for the Vertex $500-credit ADC runtime wiring (omnimarket #1176 routing-overlay backend + secret-discipline ratchet; omnibase_infra #1949 ADC bearer-token delivery to effects container). Secret-ref discipline: only logical refs committed; token VALUE resolved fail-closed at the effect boundary. deploy_pending — no live deploy by the code PRs. dod-occ-pr receipt added in the follow-up commit once this PR number is known.
jonahgabriel
added a commit
that referenced
this pull request
Jul 29, 2026
…ening) Appends dod-OmniNode-ai-omnimarket-pr-1949 to contracts/OMN-15382.yaml, binding omnimarket PR #1949 (node_dod_verify fail-closed command-check execution + exact-match PR lookup, lane B2) to this ticket. Append-only: existing three dod_evidence entries are untouched and unreordered. Checks hardcode PR 1949 (no ${PR_NUMBER} substitution trap) and assert the PR's file list actually contains node_dod_verify, not just fetch it. Verified locally before commit: uv run python scripts/lint_contract_check_values.py contracts/OMN-15382.yaml uv run validate-yaml contracts/OMN-15382.yaml
jonahgabriel
added a commit
that referenced
this pull request
Jul 29, 2026
…et-pr-1949 Adds drift/dod_receipts/OMN-15382/dod-OmniNode-ai-omnimarket-pr-1949/command.yaml, which the prior commit (bind omnimarket PR #1949) omitted -- occ-preflight eligibility and verify/verify both failed closed (missing_receipt for OMN-15382:dod-OmniNode-ai-omnimarket-pr-1949:command). Receipt binds contract_entry_sha256 to the exact dod_evidence entry (verified via compute_contract_entry_sha256) and pr_number=5458 (this OCC PR), matching the existing OMN-15382 receipt convention. Both underlying checks were re-run live before minting the receipt: gh pr view 1949 --repo OmniNode-ai/omnimarket --json state -> OPEN gh pr view 1949 --repo OmniNode-ai/omnimarket --json files --jq [...] -> true Verified locally before commit: uv run python scripts/lint_contract_check_values.py contracts/OMN-15382.yaml -> clean uv run python -m omnibase_core.validation.validator_occ_merge_eligibility (full args) -> eligible=true pre-commit run --files <receipt> contracts/OMN-15382.yaml -> all pass
jonahgabriel
added a commit
that referenced
this pull request
Jul 29, 2026
…d contract dev independently landed its own contracts/OMN-15382.yaml (node_occ_companion_compute autobind reacting to OmniNode-ai/omnimarket PR #1949) after this branch diverged. Reconciled per the OCC append-only gate: every dev dod_evidence entry is kept byte-intact, in dev's original order, ahead of this branch's items (verified via compute_contract_entry_sha256 -- all existing receipts under drift/dod_receipts/ still validate against the merged file, so none needed regeneration). The one id collision (dod-OmniNode-ai-omnimarket-pr-1949) is resolved by keeping dev's entry untouched and renaming this branch's strictly-stronger duplicate (which additionally asserts the PR's file list contains node_dod_verify) to dod-OmniNode-ai-omnimarket-pr-1949-strict. Rebasing onto dev also surfaced 3 NEW Rule B (per-item PR binding) violations in dev's own autobind entries (occ-self-bind-pr-5459/5465/5466, each using the bare ${PR_NUMBER} placeholder while the id embeds a specific PR number) -- exactly the defect class this ticket's lint exists to catch, landing via the same autobind race. Per append-only, the originals are kept untouched; each is superseded (evidence_artifact: supersedes_dod_evidence:<id>) by an occ-self-bind-pr-<n>-strict entry hardcoding the PR number (verified live: PRs #5459/#5465/#5466 are real, merged OCC PRs), so contracts/OMN-15382.yaml stays clean under this PR's own lint as its authoring-time-clean design requires. Also shrinks .onex_ratchets/omn_15382_rule_b_baseline.yaml by 2 entries (contracts/OMN-15192.yaml::dod-OmniNode-ai-omnimarket-pr-1941-ci, contracts/OMN-15192.yaml::occ-self-bind-pr-5387) that an independent dev-side repair healed since this baseline was frozen -- the corpus-baseline test requires exact set equality and flagged them as stale. Verified locally (env -u PYTHONPATH, this Mac -- logged exception per root CLAUDE.md rule 11a for this bounded remediation): scripts/lint_contract_check_values.py contracts/OMN-14968.yaml contracts/OMN-15382.yaml -- exit 0 pytest tests/unit/scripts/test_lint_contract_check_values*.py -- 49 passed pytest tests/test_evidence_admissibility.py tests/test_evidence_admissibility_parity.py tests/test_contract_compliance_check.py tests/test_handler_contract_compliance_scan.py -- 180 passed scripts/validation/check_receipt_hardening.py -- exit 0
jonahgabriel
added a commit
that referenced
this pull request
Jul 29, 2026
…d contract dev independently landed its own contracts/OMN-15382.yaml (node_occ_companion_compute autobind reacting to OmniNode-ai/omnimarket PR #1949) after this branch diverged. Reconciled per the OCC append-only gate: every dev dod_evidence entry is kept byte-intact, in dev's original order, ahead of this branch's items (verified via compute_contract_entry_sha256 -- all existing receipts under drift/dod_receipts/ still validate against the merged file, so none needed regeneration). The one id collision (dod-OmniNode-ai-omnimarket-pr-1949) is resolved by keeping dev's entry untouched and renaming this branch's strictly-stronger duplicate (which additionally asserts the PR's file list contains node_dod_verify) to dod-OmniNode-ai-omnimarket-pr-1949-strict. Rebasing onto dev also surfaced 3 NEW Rule B (per-item PR binding) violations in dev's own autobind entries (occ-self-bind-pr-5459/5465/5466, each using the bare ${PR_NUMBER} placeholder while the id embeds a specific PR number) -- exactly the defect class this ticket's lint exists to catch, landing via the same autobind race. Per append-only, the originals are kept untouched; each is superseded (evidence_artifact: supersedes_dod_evidence:<id>) by an occ-self-bind-pr-<n>-strict entry hardcoding the PR number (verified live: PRs #5459/#5465/#5466 are real, merged OCC PRs), so contracts/OMN-15382.yaml stays clean under this PR's own lint as its authoring-time-clean design requires. Also shrinks .onex_ratchets/omn_15382_rule_b_baseline.yaml by 2 entries (contracts/OMN-15192.yaml::dod-OmniNode-ai-omnimarket-pr-1941-ci, contracts/OMN-15192.yaml::occ-self-bind-pr-5387) that an independent dev-side repair healed since this baseline was frozen -- the corpus-baseline test requires exact set equality and flagged them as stale. Verified locally (env -u PYTHONPATH, this Mac -- logged exception per root CLAUDE.md rule 11a for this bounded remediation): scripts/lint_contract_check_values.py contracts/OMN-14968.yaml contracts/OMN-15382.yaml -- exit 0 pytest tests/unit/scripts/test_lint_contract_check_values*.py -- 49 passed pytest tests/test_evidence_admissibility.py tests/test_evidence_admissibility_parity.py tests/test_contract_compliance_check.py tests/test_handler_contract_compliance_scan.py -- 180 passed scripts/validation/check_receipt_hardening.py -- exit 0
jonahgabriel
added a commit
that referenced
this pull request
Jul 29, 2026
…-time contract lint (#5458) * fix(OMN-15382): repair OMN-14968 dod_verify 3/7 FAIL + ship authoring-time contract lint contracts/OMN-14968.yaml failed dod_verify 3/7: four dod_evidence check_values opened with the human-readable prose "Recorded product receipt: ..." handed verbatim to `sh -c` (the literal word "Recorded" fails "command not found", exit 127), one of which piped into a bare `sha256sum` with no explicit assertion -- vacuously green on any input since `sh -c` has no `pipefail`. A sixth item used the OMN-14431 bare ${PR_NUMBER}/${REPO} runner placeholder, so it never pinned PR #2536 (class-3 mis-binding). Repairs contracts/OMN-14968.yaml with five append-only, hosted-runnable, falsifiable replacement entries (mirroring the OMN-14875/PR#4528 supersedes_dod_evidence idiom): a literal PR #2536 pin, gh-api content probes against omnibase_infra PR #2536's merge commit for the two committed test names + the static ratchet assertion string, and an in-checkout grep against the already-committed lane-render-parity receipt's sha256 fragments (replacing the vacuous pipe). Ships the mechanism in the same PR: scripts/lint_contract_check_values.py gains Rule A (executable-command-shape) and Rule B (per-item PR binding). A corpus-wide survey found the mis-binding defect recurs ~1,190 times historically and the prose defect ~244 times; both are frozen into shrink-only baselines under .onex_ratchets/ asserted by set equality so new instances hard-fail while historical debt stays visible. Adds contracts/OMN-15382.yaml (this ticket's own OCC evidence). * evidence(OMN-15382): self-bind PR #5458 -- hardcode real PR number * evidence(OMN-15382): bind pr_number 5458 on all receipts (occ-preflight PR-binding fix) * reconcile(OMN-15382): rebase onto dev, append-only merge with autobind contract dev independently landed its own contracts/OMN-15382.yaml (node_occ_companion_compute autobind reacting to OmniNode-ai/omnimarket PR #1949) after this branch diverged. Reconciled per the OCC append-only gate: every dev dod_evidence entry is kept byte-intact, in dev's original order, ahead of this branch's items (verified via compute_contract_entry_sha256 -- all existing receipts under drift/dod_receipts/ still validate against the merged file, so none needed regeneration). The one id collision (dod-OmniNode-ai-omnimarket-pr-1949) is resolved by keeping dev's entry untouched and renaming this branch's strictly-stronger duplicate (which additionally asserts the PR's file list contains node_dod_verify) to dod-OmniNode-ai-omnimarket-pr-1949-strict. Rebasing onto dev also surfaced 3 NEW Rule B (per-item PR binding) violations in dev's own autobind entries (occ-self-bind-pr-5459/5465/5466, each using the bare ${PR_NUMBER} placeholder while the id embeds a specific PR number) -- exactly the defect class this ticket's lint exists to catch, landing via the same autobind race. Per append-only, the originals are kept untouched; each is superseded (evidence_artifact: supersedes_dod_evidence:<id>) by an occ-self-bind-pr-<n>-strict entry hardcoding the PR number (verified live: PRs #5459/#5465/#5466 are real, merged OCC PRs), so contracts/OMN-15382.yaml stays clean under this PR's own lint as its authoring-time-clean design requires. Also shrinks .onex_ratchets/omn_15382_rule_b_baseline.yaml by 2 entries (contracts/OMN-15192.yaml::dod-OmniNode-ai-omnimarket-pr-1941-ci, contracts/OMN-15192.yaml::occ-self-bind-pr-5387) that an independent dev-side repair healed since this baseline was frozen -- the corpus-baseline test requires exact set equality and flagged them as stale. Verified locally (env -u PYTHONPATH, this Mac -- logged exception per root CLAUDE.md rule 11a for this bounded remediation): scripts/lint_contract_check_values.py contracts/OMN-14968.yaml contracts/OMN-15382.yaml -- exit 0 pytest tests/unit/scripts/test_lint_contract_check_values*.py -- 49 passed pytest tests/test_evidence_admissibility.py tests/test_evidence_admissibility_parity.py tests/test_contract_compliance_check.py tests/test_handler_contract_compliance_scan.py -- 180 passed scripts/validation/check_receipt_hardening.py -- exit 0 * evidence(OMN-15382): PASS receipts for the 4 append-only -strict entries occ-preflight/eligibility (and receipt-gate's verify/verify) requires a PASS receipt for every dod_evidence item across every ticket cited in this PR, including the 4 append-only supersession entries added by the prior reconciliation commit (dod-OmniNode-ai-omnimarket-pr-1949-strict, occ-self-bind-pr-5459-strict, occ-self-bind-pr-5465-strict, occ-self-bind-pr-5466-strict). None had a receipt yet -- verified live and recorded here: gh pr view 1949 --repo OmniNode-ai/omnimarket --json state -> MERGED gh pr view 1949 --repo OmniNode-ai/omnimarket --json files --jq ... node_dod_verify -> true gh pr view 5459/5465/5466 --repo OmniNode-ai/onex_change_control --json number,state -> all MERGED Locally simulated the exact CI invocation of validator_occ_merge_eligibility against this contract + receipt tree with occ-commit-sha = this commit's parent: eligible=true, missing_or_nonpass_receipts=[]. * fix(OMN-15382): supersede OCC 5472 self-bind placeholders
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-12515 — Extend imperative-contract scanner to detect freestanding imperative IO
Closes the linchpin detection hole behind the ecosystem imperative-code-prevention program (OMN-12499). The handler-contract scanner's
_find_node_dirs()only inspectedsrc/*/nodes/node_*/handlers/, so freestanding imperative code anywhere else insrc/was structurally never scanned (163 of 304 ecosystem violations, 54%, were invisible).Evidence-Ticket: OMN-12515
What changed
scan_freestanding_imperative_io(python_file, repo)inscanners/handler_contract_compliance.py— AST-based (not regex) per-module detector for: raw HTTP (httpx/requests/aiohttp/urllib), raw Kafka (KafkaProducer/KafkaConsumer/aiokafka/confluent_kafka), direct DB/cache (asyncpg/psycopg/sqlite3/redis), hardcoded inference params (max_tokens/temperature/top_p/timeout/... as call kwargs and dict-literal values), hardcoded ONEX topic literals, hardcoded LAN/private IPs, andsubprocessnetwork/git ops (ssh/scp/git/...)._find_freestanding_modules(repo_root)invalidators/arch_handler_contract_compliance.py— enumeratessrc/**/*.pynot governed by the node scanner (excludesnode_*/handlers/,node.py, tests, caches,__init__.py).EnumComplianceViolation:HARDCODED_CONFIG,RAW_HTTP_INFERENCE,RAW_KAFKA,DIRECT_DB,SUBPROCESS_NETWORK.ModelFreestandingImperativeResult— typed, frozen per-module result with inline# no-contract-check: <reason>suppression and allowlist reuse.--scan-freestandingflag oncheck-imperative-contracts, wiring node handlers AND freestanding modules throughscan_repo/scan_reposwith the existing allowlist mechanism. Default-off; the flag enables full coverage.TDD / verification
tests/unit/scanners/test_freestanding_imperative_io.py(12 cases incl. the keystone consumer.py shape, clean module, DB/Kafka/subprocess/IP/topic, inline suppression, docstring/syntax-error skips) andtests/unit/scripts/test_check_imperative_contracts_freestanding.py(module enumeration, flag on/off, CLI fail-on-debt). Existing scanner/CLI tests unchanged.uv run pytest tests/ -q→ 3340 passed, 17 skipped.uv run mypy src/ --strict→ clean (171 files).uv run ruff check src/ tests/+pre-commit run --all-files→ all pass.consumer.py now detected (end-to-end proof)
uv run check-imperative-contracts --repo-root "$OMNI_HOME/onex-self-extending-agent" --scan-freestanding:Siblings also surfaced:
eval/eval_runner.py,deploy/mcp_client.py,pipeline/deployer.py, plus hardcoded.201LAN IPs and subprocess SSH/SCP ops — matching the 2026-05-30 catalog's 14 SEA broad-scan entries.OCC receipt pairing
contracts/OMN-12515.yaml+drift/dod_receipts/OMN-12515/{dod-full-suite,dod-static-checks,dod-sea-proof}/command.yaml. Localreceipt_gate_cli→RECEIPT GATE PASSED: 3 check(s).