Repository navigation
contract+evidence(OMN-12971): Vertex runtime wiring contract + dod receipts - #2503
Merged
Merged
Conversation
|
Warning Review limit reached
More reviews will be available in 1 minute and 14 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
enabled auto-merge (squash)
June 11, 2026 17:10
jonahgabriel
force-pushed
the
jonah/omn-12971-vertex-occ-receipt
branch
from
June 11, 2026 17:13
108598e to
9015442
Compare
jonahgabriel
force-pushed
the
jonah/omn-12971-vertex-occ-receipt
branch
from
June 11, 2026 17:26
9d38682 to
71fa0c6
Compare
…ceipts (omnimarket #1176, infra #1949) Central OMN-12971 OCC contract + dod_receipts for the Vertex $500-credit ADC runtime wiring (omnimarket #1176 routing-overlay backend + secret-discipline ratchet; omnibase_infra #1949 ADC bearer-token delivery to effects container). Secret-ref discipline: only logical refs committed; token VALUE resolved fail-closed at the effect boundary. deploy_pending — no live deploy by the code PRs. dod-occ-pr receipt added in the follow-up commit once this PR number is known.
…ontract The dod-occ-pr receipt pinned a stale contract_sha256 (622e4b25) that did not match the actual contracts/OMN-12971.yaml hash (475aef69), failing OCC merge eligibility with reason=contract_hash_mismatch. Pin the correct hash and refresh the head-SHA reference.
…act_sha256 CI yamlfmt reformats contracts/OMN-12971.yaml to a canonical form whose hash (be7c61fa) differs from the hand-authored version; re-pin every dod receipt's contract_sha256 to the normalized hash so OCC merge-eligibility (validator_occ_merge_eligibility) passes. Drops an unrelated stray dod-omninode-infra-pr receipt that a concurrent process appended (not declared in this contract).
jonahgabriel
force-pushed
the
jonah/omn-12971-vertex-occ-receipt
branch
from
June 11, 2026 17:32
766d7fa to
f42b1cd
Compare
jonahgabriel
added this pull request to the merge queue
Jun 11, 2026
jonahgabriel
added a commit
that referenced
this pull request
Jul 27, 2026
…locked product PRs (#5171) * evidence(OMN-15241, OMN-13930): independent OCC evidence mint for 5 blocked product PRs Append-only mint by an INDEPENDENT verifier (not the implementer of any of the five PRs; no-self-evidence rule). Every probe recorded here was executed by the author verbatim from the committed contract text, and every falsifiability claim was proven by running a RED control -- not asserted. OMN-15241 (5 net-new entries): dod-omnimarket-pr-1919-hook-wired-92986d89 dod-omnibase-compat-pr-183-hook-wired-78ad16e4 dod-omnidash-pr-273-hook-wired-d461b57c dod-occ-pr-5143-hook-wired-9e9ae927 dod-omn-15241-seeded-red-run-30269831694 Each product-PR entry asserts BOTH halves of the wiring at the pinned head -- the .pre-commit-hooks wrapper script AND the .pre-commit-config.yaml entry that invokes it (5143 additionally asserts the ci.yml SKIP-list clause). exit 0 at head, exit 1 at the repo's dev merge base, for all four. The fifth entry re-verifies the seeded-RED proof the ticket rests on: omnimarket run 30269831694 concluded failure on job 'required-check-skip-guard / check-skip-vectors' and the paired clean control run 30264429868 concluded success; throwaway PR #1914 is CLOSED unmerged. OMN-13930 (1 net-new entry): dod-omnibase-infra-pr-2503-deploy-scope-304891d1 Deploy-scope probe over the two runtime paths the deploy-gate flagged. Scope stated honestly: #2503 ships no deployed artifact (no Dockerfile, compose file, k8s manifest, or image build context; `onex delegate` is a local CLI entry point), so the gate's own sanctioned hermetic `gh api .../contents/...?ref=<sha>` form is the probe that ran, not a live-runtime probe that would be vacuous here. Four clauses, the load-bearing one being that cli_delegate.py CALLS check_omnimarket_drift -- an import alone would leave the surface unguarded, which is the exact defect OMN-13930 fixes. exit 0 at 304891d1, exit 1 at dev. Append-only: 6 net-new dod_evidence entries, 6 net-new receipt files, ZERO deletions and zero edits to any existing entry or receipt (git numstat on contracts/: 140 insertions, 0 deletions). Read-only throughout: no deploy, restart, lane mutation, Kafka mutation, database mutation, or production mutation. Evidence-Ticket: OMN-15241 * evidence(OMN-15241, OMN-13930): OCC#5171 self-bind entries + PASS receipts Net-new occ-self-bind-pr-5171 entry on both contracts (OMN-14650), plus their PASS receipts. Probe executed by the author: gh pr view 5171 --repo OmniNode-ai/onex_change_control --json number,state => {"number":5171,"state":"OPEN"}. Append-only: additions only, zero deletions. Evidence-Ticket: OMN-15241
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OMN-12971 — OCC receipt: Vertex runtime wiring (ADC $500-credit path, secret-ref discipline)
Central OMN-12971 contract +
dod_receiptsfor the Vertex runtime-wiring PR set:cloud-vertex-geminibifrost backend (secret_ref: llm.vertex.access_token) in routing overlay +vertex-gemini-flashtier/registry +requires_secret_reffield + thecheck_backend_secret_disciplineenforcement ratchet (pre-commit hook + CI gate). ADDITIVE next to the Gemini AI-Studio key path.runtime_policy.contract.yamlfile-source secret mapping + host allowlist;docker-compose.infra.ymltoken-file mount on main + effects runtimes; regeneratedruntime-policy.env.Receipts carried
contracts/OMN-12971.yamldrift/dod_receipts/OMN-12971/dod-omnimarket-pr/command.yaml(PR evidence(OMN-11268): bind runner health models contract and receipt #1176, PASS)drift/dod_receipts/OMN-12971/dod-infra-pr/command.yaml(PR feat(OMN-12515): detect freestanding imperative IO across all of src/ #1949, PASS)drift/dod_receipts/OMN-12971/dod-omninode-infra-pr/command.yaml(PR feat(OMN-10211): add dod_evidence + receipts for substrate_gates scaffold #497, PASS)drift/dod_receipts/OMN-12971/dod-deploy-assessment/command.yaml(PASS, deploy_pending)drift/dod_receipts/OMN-12971/dod-occ-pr/command.yaml(this PR contract+evidence(OMN-12971): Vertex runtime wiring contract + dod receipts #2503, PASS)Secret-ref discipline
Only the logical ref
llm.vertex.access_tokenis committed anywhere. The bearer-token VALUE is a short-lived OAuth access token minted from ADC and resolved fail-closed at the effect boundary — never committed.Deploy
deploy_pending — code PRs perform no live deploy/restart/topic/.201 mutation. Runtime effect arrives via the standard batched stability/runtime image rebuild plus operator ADC token mount + overlay endpoint URL.
Evidence-Ticket: OMN-12971
Evidence-Source: OCC#2503