Skip to content

evidence(OMN-12939): promote OCC contract + receipts to main #2462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonahgabriel merged 2 commits into from
Jun 11, 2026
Merged

evidence(OMN-12939): promote OCC contract + receipts to main #2462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
67cad0d
evidence(OMN-12939): promote OCC contract + receipts to main
jonahgabriel Jun 11, 2026
c08cd4e
chore(OMN-12939): yamlfmt-normalize 8 contracts drifted by dev→main c…
jonahgabriel Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
295 changes: 158 additions & 137 deletions contracts/OMN-11513.yaml
View file
Open in desktop

Large diffs are not rendered by default.

220 changes: 113 additions & 107 deletions contracts/OMN-12564.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
---
schema_version: "1.0.0"
ticket_id: "OMN-12564"
title: "ci: harden OMN-12564 CI environment and OCC checkout lanes"
Expand All @@ -24,110 +25,115 @@ emergency_bypass:
justification: ""
follow_up_ticket_id: ""
dod_evidence:
- id: "dod-infra-pr-1824"
description: "omnibase_infra PR #1824 carries the versioned CI environment canary implementation and docs."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
&& grep -q '^pr_number: 1824$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
&& grep -q '^commit_sha: "5edfa569de568055427f1a5ead462ce3faa4bd94"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
- id: "dod-local-env-proof"
description: "Local temp-root proof built and then reused the immutable CI env without touching privileged paths."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-local-env-proof/command.yaml"
- id: "dod-infra-pr-1825"
description: "omnibase_infra PR #1825 disables setup-uv cache save for the direct OCC contract-compliance job after merge-group CI showed the post-job cache upload can cancel the queue run."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1825/command.yaml"
&& grep -q '^pr_number: 1825$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1825/command.yaml"
&& grep -q '^commit_sha: "dde9ee2b502de4507a5ab4f1d3b5c9a6860e8185"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1825/command.yaml"
- id: "dod-occ-pr-self"
description: "Self-binding receipt for the OCC PR carrying OMN-12564 central evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml"
&& grep -q '^pr_number: 2020$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml"
- id: "dod-occ-cache-pr-self"
description: "Self-binding receipt for the OCC PR carrying the cache-save follow-up evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-cache-pr-self/command.yaml"
&& grep -q '^pr_number: 2021$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-cache-pr-self/command.yaml"
- id: "dod-omniclaude-pr-1718-checkout-hardening"
description: >-
omniclaude PR #1718 extracts the OCC deploy-gate checkout into a bounded script, removes the blobless
partial-clone checkout path, and proves the stall case terminates with diagnostics instead of hanging
the deploy-gate job.
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1718-checkout-hardening/command.yaml"
&& grep -q '^pr_number: 1718$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1718-checkout-hardening/command.yaml"
&& grep -q '^commit_sha: "2850f546b0ee8913f8eae844f18455fefa1c1a32"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1718-checkout-hardening/command.yaml"
- id: "dod-occ-pr-2039-omniclaude-binding"
description: "Self-binding receipt for OCC PR #2039 carrying the omniclaude PR #1718 evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2039-omniclaude-binding/command.yaml"
&& grep -q '^pr_number: 2039$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2039-omniclaude-binding/command.yaml"
- id: "dod-omniclaude-pr-1735-main-hotfix"
description: >-
omniclaude PR #1735 carries the already-proven OMN-12564 bounded OCC deploy-gate checkout fix onto
main, where downstream reusable workflow callers resolve it via omniclaude@main.
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1735-main-hotfix/command.yaml"
&& grep -q '^pr_number: 1735$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1735-main-hotfix/command.yaml"
&& grep -q '^commit_sha: "b58e2c87d5912dea3cc5bb957462fa0358e529c7"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1735-main-hotfix/command.yaml"
- id: "dod-occ-pr-2326-omniclaude-main-hotfix-binding"
description: "Self-binding receipt for OCC PR #2326 carrying the omniclaude PR #1735 main-hotfix evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2326-omniclaude-main-hotfix-binding/command.yaml"
&& grep -q '^pr_number: 2326$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2326-omniclaude-main-hotfix-binding/command.yaml"
- id: "dod-occ-pr-2329-omniclaude-push-dod-binding"
description: "Self-binding receipt for OCC PR #2329 carrying the omniclaude PR #1735 push-event DoD resolver evidence refresh."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2329-omniclaude-push-dod-binding/command.yaml"
&& grep -q '^pr_number: 2329$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2329-omniclaude-push-dod-binding/command.yaml"
- id: "dod-occ-pr-2327-omniclaude-imperative-allowlist"
description: "Self-binding receipt for OCC PR #2327 carrying the omniclaude imperative guard allowlist baseline required by the OMN-12564 main hotfix path."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2327-omniclaude-imperative-allowlist/command.yaml"
&& grep -q '^pr_number: 2327$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2327-omniclaude-imperative-allowlist/command.yaml"
- id: "dod-infra-pr-1824"
description: "omnibase_infra PR #1824 carries the versioned CI environment canary implementation and
docs."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
&& grep -q '^pr_number: 1824$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
&& grep -q '^commit_sha: "5edfa569de568055427f1a5ead462ce3faa4bd94"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1824/command.yaml"
- id: "dod-local-env-proof"
description: "Local temp-root proof built and then reused the immutable CI env without touching privileged
paths."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-local-env-proof/command.yaml"
- id: "dod-infra-pr-1825"
description: "omnibase_infra PR #1825 disables setup-uv cache save for the direct OCC contract-compliance
job after merge-group CI showed the post-job cache upload can cancel the queue run."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1825/command.yaml"
&& grep -q '^pr_number: 1825$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1825/command.yaml"
&& grep -q '^commit_sha: "dde9ee2b502de4507a5ab4f1d3b5c9a6860e8185"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-infra-pr-1825/command.yaml"
- id: "dod-occ-pr-self"
description: "Self-binding receipt for the OCC PR carrying OMN-12564 central evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml"
&& grep -q '^pr_number: 2020$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-self/command.yaml"
- id: "dod-occ-cache-pr-self"
description: "Self-binding receipt for the OCC PR carrying the cache-save follow-up evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-cache-pr-self/command.yaml"
&& grep -q '^pr_number: 2021$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-cache-pr-self/command.yaml"
- id: "dod-omniclaude-pr-1718-checkout-hardening"
description: >-
omniclaude PR #1718 extracts the OCC deploy-gate checkout into a bounded script, removes the blobless
partial-clone checkout path, and proves the stall case terminates with diagnostics instead of hanging
the deploy-gate job.
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1718-checkout-hardening/command.yaml"
&& grep -q '^pr_number: 1718$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1718-checkout-hardening/command.yaml"
&& grep -q '^commit_sha: "2850f546b0ee8913f8eae844f18455fefa1c1a32"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1718-checkout-hardening/command.yaml"
- id: "dod-occ-pr-2039-omniclaude-binding"
description: "Self-binding receipt for OCC PR #2039 carrying the omniclaude PR #1718 evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2039-omniclaude-binding/command.yaml"
&& grep -q '^pr_number: 2039$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2039-omniclaude-binding/command.yaml"
- id: "dod-omniclaude-pr-1735-main-hotfix"
description: >-
omniclaude PR #1735 carries the already-proven OMN-12564 bounded OCC deploy-gate checkout fix onto
main, where downstream reusable workflow callers resolve it via omniclaude@main.
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1735-main-hotfix/command.yaml"
&& grep -q '^pr_number: 1735$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1735-main-hotfix/command.yaml"
&& grep -q '^commit_sha: "b58e2c87d5912dea3cc5bb957462fa0358e529c7"$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-omniclaude-pr-1735-main-hotfix/command.yaml"
- id: "dod-occ-pr-2326-omniclaude-main-hotfix-binding"
description: "Self-binding receipt for OCC PR #2326 carrying the omniclaude PR #1735 main-hotfix evidence."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2326-omniclaude-main-hotfix-binding/command.yaml"
&& grep -q '^pr_number: 2326$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2326-omniclaude-main-hotfix-binding/command.yaml"
- id: "dod-occ-pr-2329-omniclaude-push-dod-binding"
description: "Self-binding receipt for OCC PR #2329 carrying the omniclaude PR #1735 push-event DoD
resolver evidence refresh."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2329-omniclaude-push-dod-binding/command.yaml"
&& grep -q '^pr_number: 2329$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2329-omniclaude-push-dod-binding/command.yaml"
- id: "dod-occ-pr-2327-omniclaude-imperative-allowlist"
description: "Self-binding receipt for OCC PR #2327 carrying the omniclaude imperative guard allowlist
baseline required by the OMN-12564 main hotfix path."
source: "manual"
status: "verified"
checks:
- check_type: "command"
check_value: >-
grep -q '^status: PASS$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2327-omniclaude-imperative-allowlist/command.yaml"
&& grep -q '^pr_number: 2327$' "$CONTRACT_REPO_DIR/drift/dod_receipts/OMN-12564/dod-occ-pr-2327-omniclaude-imperative-allowlist/command.yaml"
Loading
Loading