Repository navigation
OMN-12770 hotfix evidence: delegation route binding receipts - #2288
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
added a commit
that referenced
this pull request
Jun 7, 2026
* evidence(OMN-12770): add delegation route binding receipts * evidence(OMN-12770): bind OCC receipts to hotfix PRs * style(OMN-12770): normalize OCC receipt YAML
jonahgabriel
added a commit
that referenced
this pull request
Jul 13, 2026
…vidence infra#2287 was reissued as #2288 at a new head (f7588b2979d...) after two real CI-gate fixes: (1) branch renamed to reference the cited ticket OMN-14548 instead of the epic OMN-14507, fixing the verify/verify identity- binding gate; (2) a follow-up commit removing a mypy --strict redundant-cast finding (CI's Omni Standards Gate / Type Safety Validation runs --strict, catching what a local non-strict single-file run missed). Re-pins dod-verify-*-static-markers to the new head (all G1-G3 markers re-verified present). dod-forbid-verify-independent-review and occ-self-bind-pr-4093 get description-only updates (PR number references), re-hashed accordingly. New: dod-no-deploy-required-flag-unwired closes the deploy-gate (OMN-8912) finding -- #2288 touches a runtime path, and deploy-gate requires a cited ticket to carry deploy DoD evidence. Proves the negative claim (not asserted in prose): downloads the full repo tree at #2288's head and confirms ONEX_BOUNDARY_DLQ_ENABLED is referenced by zero docker-compose/service- catalog files, so the flag has no path to become true in any deployed environment via existing config -- no live deploy action is required for this default-off landing. A live deploy readback belongs to the separate flip-on ticket (OMN-14551). Verified locally: validate_occ_merge_eligibility resolves eligible:true for #2288; run_contract_compliance_check --pr 2288 reports 4/4 PASS; check_receipt_hardening.py exits 0.
jonahgabriel
added a commit
that referenced
this pull request
Jul 13, 2026
#2288 gained a second follow-up commit (e43e7b3c) sanitizing two raw exception interpolations CodeRabbit flagged as Major security findings. Re-pins dod-verify-2288-static-markers and dod-no-deploy-required-flag- unwired to that final head; both re-verified locally (all G1-G3 markers still present, deploy-evidence negative-claim still holds). Verified locally: eligible:true, check_receipt_hardening.py exits 0, run_contract_compliance_check --pr 2288 reports 4/4 PASS.
jonahgabriel
added a commit
that referenced
this pull request
Jul 13, 2026
…-DLQ fix (#4093) * evidence(OMN-14548): OCC companion for omnibase_infra#2287 — boundary-DLQ fix Non-implementer-style DoD companion for omnibase_infra#2287 (OMN-14548, child of epic OMN-14507). Two independent verification events, neither self-authored by #2287's implementer: 1. dod-verify-2287-static-markers: hermetic gh-api reads at #2287's head confirm forbid-verify's requested G1-G3 gap fixes (non-retryable content-error classification, split swallow_observed/swallow_prevented metric naming, best-effort-DLQ honesty language) are actually present in the shipped code. 2. dod-forbid-verify-independent-review: re-confirms the cross-agent seam- match finding forbid-verify made in its independent review (verbatim quote in the contract) — the real EventBusKafka._publish_raw_to_dlq signature at event_bus/mixin_kafka_dlq.py:560-570 (pinned SHA, not a moving dev ref) matches #2287's call field-for-field. Net-new files only: contracts/OMN-14548.yaml + 2 receipts under drift/dod_receipts/OMN-14548/. Self-bind for this OCC PR's own occ-preflight (self-referential ticket-token extraction) follows in a subsequent commit once the real PR number is known. * fix(OMN-14548): add PR#4093 self-bind receipt for OCC's own occ-preflight Same fix shape as prior OCC companions in this session (OMN-14504/#4081): this companion PR's own title contains the OMN-14548 token, so occ-preflight's self-referential ticket-token extraction requires a PASS receipt bound to THIS PR (#4093), not only to the product PR #2287. occ-self-bind-pr-4093 closes that gap. Verified locally: validate_occ_merge_eligibility resolves eligible:true for both #2287 and #4093 snapshots; run_contract_compliance_check --pr 4093 reports 3/3 PASS. * fix(OMN-14548): rebind OCC companion to infra#2288, add deploy-gate evidence infra#2287 was reissued as #2288 at a new head (f7588b2979d...) after two real CI-gate fixes: (1) branch renamed to reference the cited ticket OMN-14548 instead of the epic OMN-14507, fixing the verify/verify identity- binding gate; (2) a follow-up commit removing a mypy --strict redundant-cast finding (CI's Omni Standards Gate / Type Safety Validation runs --strict, catching what a local non-strict single-file run missed). Re-pins dod-verify-*-static-markers to the new head (all G1-G3 markers re-verified present). dod-forbid-verify-independent-review and occ-self-bind-pr-4093 get description-only updates (PR number references), re-hashed accordingly. New: dod-no-deploy-required-flag-unwired closes the deploy-gate (OMN-8912) finding -- #2288 touches a runtime path, and deploy-gate requires a cited ticket to carry deploy DoD evidence. Proves the negative claim (not asserted in prose): downloads the full repo tree at #2288's head and confirms ONEX_BOUNDARY_DLQ_ENABLED is referenced by zero docker-compose/service- catalog files, so the flag has no path to become true in any deployed environment via existing config -- no live deploy action is required for this default-off landing. A live deploy readback belongs to the separate flip-on ticket (OMN-14551). Verified locally: validate_occ_merge_eligibility resolves eligible:true for #2288; run_contract_compliance_check --pr 2288 reports 4/4 PASS; check_receipt_hardening.py exits 0. * fix(OMN-14548): re-pin OCC evidence to infra#2288 final head #2288 gained a second follow-up commit (e43e7b3c) sanitizing two raw exception interpolations CodeRabbit flagged as Major security findings. Re-pins dod-verify-2288-static-markers and dod-no-deploy-required-flag- unwired to that final head; both re-verified locally (all G1-G3 markers still present, deploy-evidence negative-claim still holds). Verified locally: eligible:true, check_receipt_hardening.py exits 0, run_contract_compliance_check --pr 2288 reports 4/4 PASS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
uv run pre-commit run --all-files-> passeduv run python scripts/check_dod_evidence_present.py contracts/OMN-12770.yaml-> passeduv run python scripts/lint_contract_check_values.py contracts/OMN-12770.yaml-> passeduv run validate-yaml contracts/OMN-12770.yaml-> contract validModelDodReceipt.model_validate(...)-> all four receipts validuv run python -m omnibase_core.validation.validator_occ_merge_eligibility ... --repo onex_change_control --pr-number 2288-> eligibleuv run python -m omnibase_core.validation.validator_occ_merge_eligibility ... --repo omnimarket --pr-number 1091-> eligiblehotfix-evidence: OCC-12770
backmerge: #2287
Evidence-Ticket: OMN-12770
Evidence-Source: OCC#2288
Linear: OMN-12770