Repository navigation
OMN-12770 evidence: delegation route binding receipts - #2287
Merged
Merged
Conversation
📝 WalkthroughWalkthroughThe PR updates GitHub Actions, pre-commit rules, allowlists, and many contract evidence checks. It adds retrying ChangesBoundary validation and contract evidence updates
Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant validate_contract
participant validate_boundaries
participant uv
participant check_imperative_contracts
PullRequest->>GitHubActions: trigger pull_request / workflow_call
GitHubActions->>validate_contract: install validators
validate_contract->>uv: sync with retry loop
GitHubActions->>validate_boundaries: clone peer repos
validate_boundaries->>uv: sync workspace with retry loop
GitHubActions->>check_imperative_contracts: run --scan-freestanding
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/ci.yml (1)
169-188:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd explicit least-privilege permissions to
imperative-contract-guard.This job currently inherits default token scopes. Explicitly setting minimal permissions avoids accidental write access from repository-level defaults.
Suggested patch
imperative-contract-guard: name: Imperative Contract Guard + permissions: + contents: read runs-on: >- ${{ (github.event_name == 'pull_request' &&🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 169 - 188, The job imperative-contract-guard currently relies on default token scopes; add an explicit permissions block under the imperative-contract-guard job to enforce least-privilege (e.g., set permissions: contents: read and pull-requests: read) so the workflow only has read access required for uv run check-imperative-contracts and cannot perform writes; add the permissions entry directly beneath the job header (the imperative-contract-guard job name) so the steps (actions/checkout@v6, ./.github/actions/setup-uv, and the "Validate imperative contract guard wiring" run) inherit the constrained token scope.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main-target-guard.yml:
- Around line 10-24: Add an explicit permissions block to the workflow to
enforce least privilege: modify the workflow root (where the pull_request
trigger and job main-target-guard are defined) to declare only the specific
token permissions required (e.g., contents: read, pull-requests: write/read as
needed) instead of relying on defaults; update the workflow to include the
permissions: mapping immediately under the workflow root so the
main-target-guard job runs with only those declared scopes.
In @.pre-commit-config.yaml:
- Around line 139-146: The hook "check-imperative-contracts-freestanding" is
currently limited by types: [python] so with pass_filenames: false commits
touching only allowlists/*.yaml won't run the guard; update that hook (id:
check-imperative-contracts-freestanding, entry and pass_filenames settings) to
ensure it triggers for allowlist/policy changes—either remove the types
constraint or add an explicit files pattern matching allowlists (e.g.,
allowlists/.*\.ya?ml) or set always_run: true so the hook runs on non-Python
commits as well.
In `@contracts/OMN-10278.yaml`:
- Around line 187-188: The description text that references "PR `#452`" is
inconsistent with the enforced receipt binding which uses PR `#456` in the
check_value and evidence path
("drift/dod_receipts/OMN-10278/dod-omninode-infra-pr-456/command.yaml"); update
the human-readable description or header that mentions PR `#452` so it instead
references PR `#456` to match the check_value, evidence id/path and remove the
mismatch (search for the PR number in the same OMN-10278 contract and replace
452 → 456).
In `@contracts/OMN-10487.yaml`:
- Around line 41-49: The check for id "dod-rerun-state-pr-target" contains an
inconsistent path using $CONTRACT_REPO_DIR in the check_value grep commands;
replace references to
$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml with the
repository-relative path .github/workflows/occ-rerun-downstream.yml in the
check_value string (the three grep calls) so the command matches the same
normalized path style used elsewhere and keep the rest of the grep expressions
(--base dev, '\[skip ci\]', 'Evidence-Ticket: OMN-10487') unchanged.
In `@contracts/OMN-11068.yaml`:
- Around line 48-62: The check_value commands for the dod_evidence entries with
ids "dod-runtime-health-pr-1765" and "dod-occ-pr-1715" use undefined shell
variables ${PR_NUMBER} and ${REPO}; fix by prefixing each check_value with
inline variable assignments (e.g., REPO=<owner/repo> PR_NUMBER=<number>) before
the gh command so the gh pr view invocation in the check_value string resolves
correctly, updating the check_value strings for those entries accordingly.
---
Outside diff comments:
In @.github/workflows/ci.yml:
- Around line 169-188: The job imperative-contract-guard currently relies on
default token scopes; add an explicit permissions block under the
imperative-contract-guard job to enforce least-privilege (e.g., set permissions:
contents: read and pull-requests: read) so the workflow only has read access
required for uv run check-imperative-contracts and cannot perform writes; add
the permissions entry directly beneath the job header (the
imperative-contract-guard job name) so the steps (actions/checkout@v6,
./.github/actions/setup-uv, and the "Validate imperative contract guard wiring"
run) inherit the constrained token scope.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b5400483-39c4-4c12-9a2d-5573dfb55aee
📒 Files selected for processing (300)
.github/actions/validate-boundaries/action.yml.github/actions/validate-contract/action.yml.github/workflows/call-occ-preflight.yml.github/workflows/ci.yml.github/workflows/imperative-contract-guard.yml.github/workflows/main-target-guard.yml.github/workflows/occ-rerun-downstream.yml.gitignore.pre-commit-config.yamlallowlists/omnibase_infra.yamlallowlists/omniintelligence.yamlallowlists/omnimarket.yamlallowlists/omnimemory.yamlallowlists/onex_change_control.yamlcontracts/OMN-10143.yamlcontracts/OMN-10151.yamlcontracts/OMN-10207.yamlcontracts/OMN-10278.yamlcontracts/OMN-10316.yamlcontracts/OMN-10353.yamlcontracts/OMN-10377.yamlcontracts/OMN-10409.yamlcontracts/OMN-10424.yamlcontracts/OMN-10475.yamlcontracts/OMN-10483.yamlcontracts/OMN-10485.yamlcontracts/OMN-10487.yamlcontracts/OMN-10489.yamlcontracts/OMN-10490.yamlcontracts/OMN-10491.yamlcontracts/OMN-10500.yamlcontracts/OMN-10512.yamlcontracts/OMN-10518.yamlcontracts/OMN-10519.yamlcontracts/OMN-10520.yamlcontracts/OMN-10521.yamlcontracts/OMN-10535.yamlcontracts/OMN-10539.yamlcontracts/OMN-10540.yamlcontracts/OMN-10541.yamlcontracts/OMN-10542.yamlcontracts/OMN-10543.yamlcontracts/OMN-10544.yamlcontracts/OMN-10546.yamlcontracts/OMN-10547.yamlcontracts/OMN-10548.yamlcontracts/OMN-10552.yamlcontracts/OMN-10554.yamlcontracts/OMN-10561.yamlcontracts/OMN-10563.yamlcontracts/OMN-10564.yamlcontracts/OMN-10565.yamlcontracts/OMN-10566.yamlcontracts/OMN-10567.yamlcontracts/OMN-10569.yamlcontracts/OMN-10570.yamlcontracts/OMN-10572.yamlcontracts/OMN-10579.yamlcontracts/OMN-10580.yamlcontracts/OMN-10581.yamlcontracts/OMN-10584.yamlcontracts/OMN-10586.yamlcontracts/OMN-10587.yamlcontracts/OMN-10588.yamlcontracts/OMN-10589.yamlcontracts/OMN-10591.yamlcontracts/OMN-10592.yamlcontracts/OMN-10593.yamlcontracts/OMN-10602.yamlcontracts/OMN-10604.yamlcontracts/OMN-10605.yamlcontracts/OMN-10606.yamlcontracts/OMN-10607.yamlcontracts/OMN-10608.yamlcontracts/OMN-10609.yamlcontracts/OMN-10610.yamlcontracts/OMN-10611.yamlcontracts/OMN-10612.yamlcontracts/OMN-10613.yamlcontracts/OMN-10614.yamlcontracts/OMN-10615.yamlcontracts/OMN-10616.yamlcontracts/OMN-10617.yamlcontracts/OMN-10618.yamlcontracts/OMN-10619.yamlcontracts/OMN-10620.yamlcontracts/OMN-10621.yamlcontracts/OMN-10622.yamlcontracts/OMN-10626.yamlcontracts/OMN-10635.yamlcontracts/OMN-10636.yamlcontracts/OMN-10638.yamlcontracts/OMN-10640.yamlcontracts/OMN-10641.yamlcontracts/OMN-10644.yamlcontracts/OMN-10645.yamlcontracts/OMN-10648.yamlcontracts/OMN-10649.yamlcontracts/OMN-10650.yamlcontracts/OMN-10653.yamlcontracts/OMN-10655.yamlcontracts/OMN-10656.yamlcontracts/OMN-10657.yamlcontracts/OMN-10661.yamlcontracts/OMN-10665.yamlcontracts/OMN-10669.yamlcontracts/OMN-10670.yamlcontracts/OMN-10675.yamlcontracts/OMN-10676.yamlcontracts/OMN-10688.yamlcontracts/OMN-10689.yamlcontracts/OMN-10691.yamlcontracts/OMN-10692.yamlcontracts/OMN-10693.yamlcontracts/OMN-10694.yamlcontracts/OMN-10695.yamlcontracts/OMN-10696.yamlcontracts/OMN-10697.yamlcontracts/OMN-10698.yamlcontracts/OMN-10705.yamlcontracts/OMN-10715.yamlcontracts/OMN-10717.yamlcontracts/OMN-10718.yamlcontracts/OMN-10720.yamlcontracts/OMN-10721.yamlcontracts/OMN-10722.yamlcontracts/OMN-10723.yamlcontracts/OMN-10724.yamlcontracts/OMN-10725.yamlcontracts/OMN-10726.yamlcontracts/OMN-10727.yamlcontracts/OMN-10728.yamlcontracts/OMN-10729.yamlcontracts/OMN-10730.yamlcontracts/OMN-10731.yamlcontracts/OMN-10733.yamlcontracts/OMN-10734.yamlcontracts/OMN-10736.yamlcontracts/OMN-10737.yamlcontracts/OMN-10741.yamlcontracts/OMN-10742.yamlcontracts/OMN-10743.yamlcontracts/OMN-10744.yamlcontracts/OMN-10745.yamlcontracts/OMN-10748.yamlcontracts/OMN-10749.yamlcontracts/OMN-10750.yamlcontracts/OMN-10753.yamlcontracts/OMN-10754.yamlcontracts/OMN-10755.yamlcontracts/OMN-10768.yamlcontracts/OMN-10769.yamlcontracts/OMN-10771.yamlcontracts/OMN-10773.yamlcontracts/OMN-10778.yamlcontracts/OMN-10779.yamlcontracts/OMN-10780.yamlcontracts/OMN-10782.yamlcontracts/OMN-10783.yamlcontracts/OMN-10784.yamlcontracts/OMN-10786.yamlcontracts/OMN-10790.yamlcontracts/OMN-10791.yamlcontracts/OMN-10796.yamlcontracts/OMN-10799.yamlcontracts/OMN-10800.yamlcontracts/OMN-10810.yamlcontracts/OMN-10811.yamlcontracts/OMN-10813.yamlcontracts/OMN-10814.yamlcontracts/OMN-10815.yamlcontracts/OMN-10816.yamlcontracts/OMN-10817.yamlcontracts/OMN-10818.yamlcontracts/OMN-10819.yamlcontracts/OMN-10820.yamlcontracts/OMN-10822.yamlcontracts/OMN-10824.yamlcontracts/OMN-10835.yamlcontracts/OMN-10836.yamlcontracts/OMN-10837.yamlcontracts/OMN-10846.yamlcontracts/OMN-10847.yamlcontracts/OMN-10848.yamlcontracts/OMN-10859.yamlcontracts/OMN-10862.yamlcontracts/OMN-10866.yamlcontracts/OMN-10868.yamlcontracts/OMN-10870.yamlcontracts/OMN-10871.yamlcontracts/OMN-10872.yamlcontracts/OMN-10873.yamlcontracts/OMN-10874.yamlcontracts/OMN-10889.yamlcontracts/OMN-10895.yamlcontracts/OMN-10963.yamlcontracts/OMN-10964.yamlcontracts/OMN-10966.yamlcontracts/OMN-10972.yamlcontracts/OMN-10978.yamlcontracts/OMN-10983.yamlcontracts/OMN-11012.yamlcontracts/OMN-11065.yamlcontracts/OMN-11068.yamlcontracts/OMN-11070.yamlcontracts/OMN-11080.yamlcontracts/OMN-11083.yamlcontracts/OMN-11088.yamlcontracts/OMN-11104.yamlcontracts/OMN-11116.yamlcontracts/OMN-11130.yamlcontracts/OMN-11131.yamlcontracts/OMN-11137.yamlcontracts/OMN-11138.yamlcontracts/OMN-11139.yamlcontracts/OMN-11140.yamlcontracts/OMN-11141.yamlcontracts/OMN-11142.yamlcontracts/OMN-11143.yamlcontracts/OMN-11144.yamlcontracts/OMN-11149.yamlcontracts/OMN-11150.yamlcontracts/OMN-11151.yamlcontracts/OMN-11152.yamlcontracts/OMN-11153.yamlcontracts/OMN-11154.yamlcontracts/OMN-11155.yamlcontracts/OMN-11156.yamlcontracts/OMN-11157.yamlcontracts/OMN-11158.yamlcontracts/OMN-11159.yamlcontracts/OMN-11160.yamlcontracts/OMN-11166.yamlcontracts/OMN-11168.yamlcontracts/OMN-11169.yamlcontracts/OMN-11170.yamlcontracts/OMN-11171.yamlcontracts/OMN-11173.yamlcontracts/OMN-11174.yamlcontracts/OMN-11176.yamlcontracts/OMN-11177.yamlcontracts/OMN-11183.yamlcontracts/OMN-11184.yamlcontracts/OMN-11185.yamlcontracts/OMN-11189.yamlcontracts/OMN-11194.yamlcontracts/OMN-11202.yamlcontracts/OMN-11203.yamlcontracts/OMN-11206.yamlcontracts/OMN-11227.yamlcontracts/OMN-11228.yamlcontracts/OMN-11231.yamlcontracts/OMN-11234.yamlcontracts/OMN-11241.yamlcontracts/OMN-11243.yamlcontracts/OMN-11246.yamlcontracts/OMN-11247.yamlcontracts/OMN-11249.yamlcontracts/OMN-11261.yamlcontracts/OMN-11262.yamlcontracts/OMN-11266.yamlcontracts/OMN-11267.yamlcontracts/OMN-11268.yamlcontracts/OMN-11269.yamlcontracts/OMN-11270.yamlcontracts/OMN-11271.yamlcontracts/OMN-11272.yamlcontracts/OMN-11273.yamlcontracts/OMN-11274.yamlcontracts/OMN-11276.yamlcontracts/OMN-11277.yamlcontracts/OMN-11278.yamlcontracts/OMN-11279.yamlcontracts/OMN-11280.yamlcontracts/OMN-11282.yamlcontracts/OMN-11283.yamlcontracts/OMN-11284.yamlcontracts/OMN-11285.yamlcontracts/OMN-11292.yamlcontracts/OMN-11294.yamlcontracts/OMN-11297.yamlcontracts/OMN-11298.yamlcontracts/OMN-11299.yamlcontracts/OMN-11301.yamlcontracts/OMN-11330.yamlcontracts/OMN-11331.yamlcontracts/OMN-11346.yamlcontracts/OMN-11348.yamlcontracts/OMN-11350.yamlcontracts/OMN-11354.yamlcontracts/OMN-11379.yamlcontracts/OMN-11381.yamlcontracts/OMN-11382.yamlcontracts/OMN-11384.yamlcontracts/OMN-11385.yamlcontracts/OMN-11386.yamlcontracts/OMN-11413.yamlcontracts/OMN-11420.yamlcontracts/OMN-11421.yamlcontracts/OMN-11423.yaml
Comment on lines
+10
to
+24
| on: | ||
| pull_request: | ||
| types: [opened, edited, synchronize] | ||
|
|
||
| jobs: | ||
| main-target-guard: | ||
| name: main-target-guard | ||
| runs-on: >- | ||
| ${{ | ||
| (github.event.pull_request.head.repo.full_name != github.repository) | ||
| && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]') | ||
| || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]') | ||
| }} | ||
| timeout-minutes: 5 | ||
|
|
There was a problem hiding this comment.
Declare explicit workflow permissions to enforce least privilege.
This workflow doesn’t need broad token scopes; relying on defaults weakens security posture if repository defaults are permissive.
Suggested patch
on:
pull_request:
types: [opened, edited, synchronize]
+permissions:
+ contents: read
+ pull-requests: read
+
jobs:
main-target-guard:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/main-target-guard.yml around lines 10 - 24, Add an
explicit permissions block to the workflow to enforce least privilege: modify
the workflow root (where the pull_request trigger and job main-target-guard are
defined) to declare only the specific token permissions required (e.g.,
contents: read, pull-requests: write/read as needed) instead of relying on
defaults; update the workflow to include the permissions: mapping immediately
under the workflow root so the main-target-guard job runs with only those
declared scopes.
Comment on lines
+139
to
+146
| - id: check-imperative-contracts-freestanding | ||
| name: Imperative contract guard with freestanding reachability | ||
| language: system | ||
| entry: >- | ||
| uv run check-imperative-contracts --repo-root . --allowlists-dir allowlists --scan-freestanding | ||
| pass_filenames: false | ||
| types: [python] | ||
| stages: [pre-commit] |
There was a problem hiding this comment.
Freestanding guard can be bypassed on allowlist-only commits.
Line 145 gates this hook to Python-file changes; combined with pass_filenames: false, commits that only modify allowlists/*.yaml (or other non-Python policy files) won’t run the guard locally.
Suggested fix
- id: check-imperative-contracts-freestanding
name: Imperative contract guard with freestanding reachability
language: system
entry: >-
uv run check-imperative-contracts --repo-root . --allowlists-dir allowlists --scan-freestanding
pass_filenames: false
- types: [python]
+ always_run: true
stages: [pre-commit]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.pre-commit-config.yaml around lines 139 - 146, The hook
"check-imperative-contracts-freestanding" is currently limited by types:
[python] so with pass_filenames: false commits touching only allowlists/*.yaml
won't run the guard; update that hook (id:
check-imperative-contracts-freestanding, entry and pass_filenames settings) to
ensure it triggers for allowlist/policy changes—either remove the types
constraint or add an explicit files pattern matching allowlists (e.g.,
allowlists/.*\.ya?ml) or set always_run: true so the hook runs on non-Python
commits as well.
Comment on lines
+187
to
+188
| check_value: "grep -q '^status: PASS$' \"drift/dod_receipts/OMN-10278/dod-omninode-infra-pr-456/command.yaml\" | ||
| && grep -q '^pr_number: 456$' \"drift/dod_receipts/OMN-10278/dod-omninode-infra-pr-456/command.yaml\"" |
There was a problem hiding this comment.
Fix PR-number mismatch between description and enforced receipt binding.
Line 182 says PR #452, but this evidence block’s id/path/checks bind to `PR `#456 (including Line 188). Please align the description to the bound PR number to avoid audit ambiguity.
Suggested fix
- description: "omninode_infra PR `#452` — port tag-based network discovery to prod cluster Terraform
+ description: "omninode_infra PR `#456` — port tag-based network discovery to prod cluster Terraform
(migrate from broken terraform_remote_state)"Based on learnings: only internal consistency issues in contracts/*.yaml should be flagged in this repository context.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-10278.yaml` around lines 187 - 188, The description text that
references "PR `#452`" is inconsistent with the enforced receipt binding which
uses PR `#456` in the check_value and evidence path
("drift/dod_receipts/OMN-10278/dod-omninode-infra-pr-456/command.yaml"); update
the human-readable description or header that mentions PR `#452` so it instead
references PR `#456` to match the check_value, evidence id/path and remove the
mismatch (search for the PR number in the same OMN-10278 contract and replace
452 → 456).
Source: Learnings
Comment on lines
+41
to
+49
| - id: "dod-rerun-state-pr-target" | ||
| description: "OCC rerun-state automation opens dev-targeted PRs without suppressing CI." | ||
| source: "manual" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: >- | ||
| grep -q -- '--base dev' "$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml" && ! | ||
| grep -q '\\[skip ci\\]' "$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml" && grep | ||
| -q 'Evidence-Ticket: OMN-10487' "$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml" |
There was a problem hiding this comment.
Inconsistent path normalization: $CONTRACT_REPO_DIR should be removed.
Lines 47-49 use $CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml, but other files in this PR (e.g., OMN-10485.yaml line 70) reference workflow files with bare relative paths like .github/workflows/call-occ-preflight.yml. The PR's stated objective is to normalize paths away from $CONTRACT_REPO_DIR toward repository-relative locations.
🔧 Suggested fix
- check_value: >-
- grep -q -- '--base dev' "$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml" && !
- grep -q '\\[skip ci\\]' "$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml" && grep
- -q 'Evidence-Ticket: OMN-10487' "$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml"
+ check_value: >-
+ grep -q -- '--base dev' .github/workflows/occ-rerun-downstream.yml && !
+ grep -q '\\[skip ci\\]' .github/workflows/occ-rerun-downstream.yml && grep
+ -q 'Evidence-Ticket: OMN-10487' .github/workflows/occ-rerun-downstream.yml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-10487.yaml` around lines 41 - 49, The check for id
"dod-rerun-state-pr-target" contains an inconsistent path using
$CONTRACT_REPO_DIR in the check_value grep commands; replace references to
$CONTRACT_REPO_DIR/.github/workflows/occ-rerun-downstream.yml with the
repository-relative path .github/workflows/occ-rerun-downstream.yml in the
check_value string (the three grep calls) so the command matches the same
normalized path style used elsewhere and keep the rest of the grep expressions
(--base dev, '\[skip ci\]', 'Evidence-Ticket: OMN-10487') unchanged.
Comment on lines
+48
to
+62
| - id: "dod-runtime-health-pr-1765" | ||
| description: "omnibase_infra PR #1765 is the rebased healthcheck fix replacing closed PR #1608." | ||
| source: "manual" | ||
| status: "verified" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: "gh pr view ${PR_NUMBER} --repo ${REPO} --json state,title" | ||
| - id: "dod-occ-pr-1715" | ||
| description: "OCC PR #1715 carries the replacement OMN-11068 receipt binding for omnibase_infra PR | ||
| #1765." | ||
| source: "manual" | ||
| status: "verified" | ||
| checks: | ||
| - check_type: "command" | ||
| check_value: "gh pr view ${PR_NUMBER} --repo ${REPO} --json state,title" |
There was a problem hiding this comment.
Undefined shell variables will cause command failure.
The new dod_evidence entries use ${PR_NUMBER} and ${REPO} variables without defining them. The check_value commands will fail unless these environment variables happen to be set externally.
Compare to the pattern in contracts/OMN-10983.yaml line 38:
check_value: "REPO=OmniNode-ai/omnimarket PR_NUMBER=699 gh pr view ${PR_NUMBER} --repo ${REPO} ..."Here, the variables are defined inline before use. The new entries should follow the same pattern.
🔧 Proposed fix
- id: "dod-runtime-health-pr-1765"
description: "omnibase_infra PR `#1765` is the rebased healthcheck fix replacing closed PR `#1608`."
source: "manual"
status: "verified"
checks:
- check_type: "command"
- check_value: "gh pr view ${PR_NUMBER} --repo ${REPO} --json state,title"
+ check_value: "PR_NUMBER=1765 REPO=OmniNode-ai/omnibase_infra gh pr view ${PR_NUMBER} --repo ${REPO} --json state,title"
- id: "dod-occ-pr-1715"
description: "OCC PR `#1715` carries the replacement OMN-11068 receipt binding for omnibase_infra PR
`#1765`."
source: "manual"
status: "verified"
checks:
- check_type: "command"
- check_value: "gh pr view ${PR_NUMBER} --repo ${REPO} --json state,title"
+ check_value: "PR_NUMBER=1715 REPO=OmniNode-ai/onex_change_control gh pr view ${PR_NUMBER} --repo ${REPO} --json state,title"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@contracts/OMN-11068.yaml` around lines 48 - 62, The check_value commands for
the dod_evidence entries with ids "dod-runtime-health-pr-1765" and
"dod-occ-pr-1715" use undefined shell variables ${PR_NUMBER} and ${REPO}; fix by
prefixing each check_value with inline variable assignments (e.g.,
REPO=<owner/repo> PR_NUMBER=<number>) before the gh command so the gh pr view
invocation in the check_value string resolves correctly, updating the
check_value strings for those entries accordingly.
* evidence(OMN-12770): add delegation route binding receipts * evidence(OMN-12770): bind OCC receipts to hotfix PRs * style(OMN-12770): normalize OCC receipt YAML
jonahgabriel
force-pushed
the
hotfix/omn-12770-occ-evidence
branch
from
June 7, 2026 12:03
d12d784 to
4cb53b3
Compare
jonahgabriel
added this pull request to the merge queue
Jun 7, 2026
jonahgabriel
added a commit
that referenced
this pull request
Jul 13, 2026
…ight Same fix shape as prior OCC companions in this session (OMN-14504/#4081): this companion PR's own title contains the OMN-14548 token, so occ-preflight's self-referential ticket-token extraction requires a PASS receipt bound to THIS PR (#4093), not only to the product PR #2287. occ-self-bind-pr-4093 closes that gap. Verified locally: validate_occ_merge_eligibility resolves eligible:true for both #2287 and #4093 snapshots; run_contract_compliance_check --pr 4093 reports 3/3 PASS.
jonahgabriel
added a commit
that referenced
this pull request
Jul 13, 2026
…-DLQ fix (#4093) * evidence(OMN-14548): OCC companion for omnibase_infra#2287 — boundary-DLQ fix Non-implementer-style DoD companion for omnibase_infra#2287 (OMN-14548, child of epic OMN-14507). Two independent verification events, neither self-authored by #2287's implementer: 1. dod-verify-2287-static-markers: hermetic gh-api reads at #2287's head confirm forbid-verify's requested G1-G3 gap fixes (non-retryable content-error classification, split swallow_observed/swallow_prevented metric naming, best-effort-DLQ honesty language) are actually present in the shipped code. 2. dod-forbid-verify-independent-review: re-confirms the cross-agent seam- match finding forbid-verify made in its independent review (verbatim quote in the contract) — the real EventBusKafka._publish_raw_to_dlq signature at event_bus/mixin_kafka_dlq.py:560-570 (pinned SHA, not a moving dev ref) matches #2287's call field-for-field. Net-new files only: contracts/OMN-14548.yaml + 2 receipts under drift/dod_receipts/OMN-14548/. Self-bind for this OCC PR's own occ-preflight (self-referential ticket-token extraction) follows in a subsequent commit once the real PR number is known. * fix(OMN-14548): add PR#4093 self-bind receipt for OCC's own occ-preflight Same fix shape as prior OCC companions in this session (OMN-14504/#4081): this companion PR's own title contains the OMN-14548 token, so occ-preflight's self-referential ticket-token extraction requires a PASS receipt bound to THIS PR (#4093), not only to the product PR #2287. occ-self-bind-pr-4093 closes that gap. Verified locally: validate_occ_merge_eligibility resolves eligible:true for both #2287 and #4093 snapshots; run_contract_compliance_check --pr 4093 reports 3/3 PASS. * fix(OMN-14548): rebind OCC companion to infra#2288, add deploy-gate evidence infra#2287 was reissued as #2288 at a new head (f7588b2979d...) after two real CI-gate fixes: (1) branch renamed to reference the cited ticket OMN-14548 instead of the epic OMN-14507, fixing the verify/verify identity- binding gate; (2) a follow-up commit removing a mypy --strict redundant-cast finding (CI's Omni Standards Gate / Type Safety Validation runs --strict, catching what a local non-strict single-file run missed). Re-pins dod-verify-*-static-markers to the new head (all G1-G3 markers re-verified present). dod-forbid-verify-independent-review and occ-self-bind-pr-4093 get description-only updates (PR number references), re-hashed accordingly. New: dod-no-deploy-required-flag-unwired closes the deploy-gate (OMN-8912) finding -- #2288 touches a runtime path, and deploy-gate requires a cited ticket to carry deploy DoD evidence. Proves the negative claim (not asserted in prose): downloads the full repo tree at #2288's head and confirms ONEX_BOUNDARY_DLQ_ENABLED is referenced by zero docker-compose/service- catalog files, so the flag has no path to become true in any deployed environment via existing config -- no live deploy action is required for this default-off landing. A live deploy readback belongs to the separate flip-on ticket (OMN-14551). Verified locally: validate_occ_merge_eligibility resolves eligible:true for #2288; run_contract_compliance_check --pr 2288 reports 4/4 PASS; check_receipt_hardening.py exits 0. * fix(OMN-14548): re-pin OCC evidence to infra#2288 final head #2288 gained a second follow-up commit (e43e7b3c) sanitizing two raw exception interpolations CodeRabbit flagged as Major security findings. Re-pins dod-verify-2288-static-markers and dod-no-deploy-required-flag- unwired to that final head; both re-verified locally (all G1-G3 markers still present, deploy-evidence negative-claim still holds). Verified locally: eligible:true, check_receipt_hardening.py exits 0, run_contract_compliance_check --pr 2288 reports 4/4 PASS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
uv run python scripts/check_dod_evidence_present.py contracts/OMN-12770.yaml-> passeduv run python scripts/lint_contract_check_values.py contracts/OMN-12770.yaml-> passeduv run validate-yaml contracts/OMN-12770.yaml-> contract validModelDodReceipt.model_validate(...)-> all five receipts validuv run python -m omnibase_core.validation.validator_occ_merge_eligibility ... --pr-number 2287 ...->eligible=trueuv run pre-commit run --files contracts/OMN-12770.yaml drift/dod_receipts/OMN-12770/*/command.yaml-> passedLinear: OMN-12770