Repository navigation
evidence(OMN-12952): OCC contract + receipt for per-leg delegation e2e probe harness - #2571
Merged
Merged
Conversation
…e probe harness
Contract: contracts/OMN-12952.yaml
Receipt: drift/dod_receipts/OMN-12952/dod-e2e-probe-dry-run/command.yaml
Dry-run evidence: 9 tests skip cleanly from clean checkout (no live bus needed).
Code PR: omnimarket branch jonah/omn-12952-lane-parameterized-e2e-probe
HEAD eee2087c030a86ec2e46268e7cf41a7f0c8afd3d
|
Warning Review limit reached
More reviews will be available in 2 hours, 46 minutes, and 59 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jonahgabriel
enabled auto-merge
June 12, 2026 16:45
…sha256 yamlfmt (max_line_length:100, include_document_start:true) reformats contracts/OMN-12952.yaml at CI pre-commit time; the receipt hardening gate then computes sha256 of the reformatted bytes and mismatches the original hash c5dbb0... stored in the receipt. Fix: apply yamlfmt with the repo .yamlfmt config locally, update receipt contract_sha256 to the post-format hash 37b9cb..., so the gate binds contract and receipt to the same canonical byte representation.
jonahgabriel
added this pull request to the merge queue
Jun 12, 2026
jonahgabriel
added a commit
that referenced
this pull request
Aug 3, 2026
…nd-only supersession) Evidence-shape repair only. No product source is touched and no substantive check is weakened; two append-only supersession entries are added to contracts/OMN-15355.yaml and nothing above them is edited, deleted, or reordered. NON-IMPLEMENTER EVIDENCE AUTHORSHIP: this lane ([fable-resume-0802/evrepair-15355]) is NOT the implementer of OMN-15355's product work. That work landed in OmniNode-ai/omnibase_infra #2568 / #2571, promoted to dev by #2548. This commit only repairs how the already-landed proof is bound, per feedback_no_self_authored_evidence. DEFECT (twice-reproduced; dod_verify correlation ids 8870151e-03d7-442e-a9b1-3d7d66cde84d and 98ea11fa-bb5f-4970-a326-c3991f0e7110, both 6 total / 4 verified / 2 failed): the auto-appended live-state checks `dod-OmniNode-ai-omnibase_infra-pr-2571::pr-live-state` and `dod-occ-evidence-admissibility-validator::pr-live-state` both bind to omnibase_infra#2571. #2571 IS merged (7228ce0c) — but into the stacked feature branch `jonah/omn-15418-p0-...`, not dev. A feature-branch base has an empty required-status-check set, and `_fetch_pr_checks_green` fails closed on an empty set, so both checks report "no required checks reported on the jonah/omn-15355-acl-proof-dsn branch" and can never clear. Sibling #2568 has the identical shape. REPAIR: bind to omnibase_infra#2548 — base `dev`, MERGED 2026-07-31T06:09:46Z, merge commit 3863623e4844dc9b0db69ceb4e77942737fbca32 (confirmed on origin/dev), required set `CI Summary` = pass. Carriage is proven by content identity rather than ancestry, because squash merges discard lineage: the exact symbol the landed #2571 receipt greps (`def _admin_dsn_for_database`) is present at 3863623e and at origin/dev head, and #2548's file set is a strict superset of #2571's and #2568's. Falsifiability, executed both directions before commit: GREEN all five new check_values exit 0 as written (gh pr view/checks 2548; `?ref=3863623e...` carriage grep returns 1; admissibility suite 76 passed in 0.47s). RED same ref with an absent symbol -> grep -c 0, exit 1; the pre-ACL dev ref -> file absent, exit 1. The admissibility suite is re-declared VERBATIM by its replacement, so family binding is preserved. Supersession is non-vacuous by construction: under OMN-15390 an appended marker retires its target only when the appended item is itself VERIFIED, so if these checks go red the original entries execute and carry their own verdicts. Known residual, NOT addressed here: contracts/OMN-15355.yaml is on OCC origin/dev but absent from origin/main, so a DurableEvidenceGate CONTRACT_ON_OCC_MAIN assertion still cannot pass. That leg clears only via a dev->main promotion PR; no main-targeting PR is opened by this lane. Refs: OMN-15355
jonahgabriel
added a commit
that referenced
this pull request
Aug 3, 2026
…nd-only supersession) (#5989) * fix(OMN-15355): rebind evidence to dev-merged parent infra#2548 (append-only supersession) Evidence-shape repair only. No product source is touched and no substantive check is weakened; two append-only supersession entries are added to contracts/OMN-15355.yaml and nothing above them is edited, deleted, or reordered. NON-IMPLEMENTER EVIDENCE AUTHORSHIP: this lane ([fable-resume-0802/evrepair-15355]) is NOT the implementer of OMN-15355's product work. That work landed in OmniNode-ai/omnibase_infra #2568 / #2571, promoted to dev by #2548. This commit only repairs how the already-landed proof is bound, per feedback_no_self_authored_evidence. DEFECT (twice-reproduced; dod_verify correlation ids 8870151e-03d7-442e-a9b1-3d7d66cde84d and 98ea11fa-bb5f-4970-a326-c3991f0e7110, both 6 total / 4 verified / 2 failed): the auto-appended live-state checks `dod-OmniNode-ai-omnibase_infra-pr-2571::pr-live-state` and `dod-occ-evidence-admissibility-validator::pr-live-state` both bind to omnibase_infra#2571. #2571 IS merged (7228ce0c) — but into the stacked feature branch `jonah/omn-15418-p0-...`, not dev. A feature-branch base has an empty required-status-check set, and `_fetch_pr_checks_green` fails closed on an empty set, so both checks report "no required checks reported on the jonah/omn-15355-acl-proof-dsn branch" and can never clear. Sibling #2568 has the identical shape. REPAIR: bind to omnibase_infra#2548 — base `dev`, MERGED 2026-07-31T06:09:46Z, merge commit 3863623e4844dc9b0db69ceb4e77942737fbca32 (confirmed on origin/dev), required set `CI Summary` = pass. Carriage is proven by content identity rather than ancestry, because squash merges discard lineage: the exact symbol the landed #2571 receipt greps (`def _admin_dsn_for_database`) is present at 3863623e and at origin/dev head, and #2548's file set is a strict superset of #2571's and #2568's. Falsifiability, executed both directions before commit: GREEN all five new check_values exit 0 as written (gh pr view/checks 2548; `?ref=3863623e...` carriage grep returns 1; admissibility suite 76 passed in 0.47s). RED same ref with an absent symbol -> grep -c 0, exit 1; the pre-ACL dev ref -> file absent, exit 1. The admissibility suite is re-declared VERBATIM by its replacement, so family binding is preserved. Supersession is non-vacuous by construction: under OMN-15390 an appended marker retires its target only when the appended item is itself VERIFIED, so if these checks go red the original entries execute and carry their own verdicts. Known residual, NOT addressed here: contracts/OMN-15355.yaml is on OCC origin/dev but absent from origin/main, so a DurableEvidenceGate CONTRACT_ON_OCC_MAIN assertion still cannot pass. That leg clears only via a dev->main promotion PR; no main-targeting PR is opened by this lane. Refs: OMN-15355 * fix(OMN-15355): add durable receipts + carrier self-bind for the rebind amendment Closes the `occ-preflight / eligibility` red on OCC#5989, which failed `reason=missing_receipt` then `reason=pr_ticket_mismatch`. Both are the OCC in-repo invariant (I3): an OCC PR carries its own contract AND its own receipts. Adds three net-new receipt files (no existing receipt is edited, deleted, or renamed) and one net-new self-bind evidence item: drift/dod_receipts/OMN-15355/dod-OmniNode-ai-omnibase_infra-pr-2548/command.yaml drift/dod_receipts/OMN-15355/dod-OmniNode-ai-omnibase_infra-pr-2548-admiss/command.yaml drift/dod_receipts/OMN-15355/occ-self-bind-pr-5989/command.yaml Every receipt was TOOL-GENERATED by executing its check for real and recording the actual exit code and output — never hand-asserted: carriage grep at ?ref=3863623e... -> rc 0, stdout "1" uv run pytest tests/test_evidence_admissibility.py -q -> rc 0, 76 passed in 0.47s gh pr view 5989 ... --json number,state -> rc 0, {"number":5989,"state":"OPEN"} `occ-self-bind-pr-5989` is a NET-NEW self-bind, not a supersession: `occ-self-bind-pr-5632` binds the ORIGINAL autobind companion and remains true and untouched; this one binds the repair companion that carries the amendment. Hash binding: appending the self-bind item moved the whole-file contract_sha256 to sha256:6e755409b66ed8208cb2b4686abc9b4d73af4d2b57356fc320422e97ac24bd7d, so the three new receipts carry that value. The per-entry contract_entry_sha256 values of the two rebind items are UNCHANGED by the append (041ddf8d... and 16cb2858...), which is the OMN-13888 property that makes appending non-destructive. The three pre-existing receipts still carry the older whole-file hash and are correctly accepted through the entry-hash dual-accept path — they are immutable and were not rebound. Verified locally before push: pre-commit (contract + 3 receipts) -> exit 0 validator_occ_append_only --ticket-id OMN-15355 -> ok: true, violations: [] validator_occ_merge_eligibility --pr-number 5989 -> eligible: true, reason "eligible", detail "OCC evidence is present, PASS, hash-bound, and PR-bound", missing_or_nonpass_receipts: [] Refs: OMN-15355
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Evidence-Source: OCC#0
Evidence-Ticket: OMN-12952